@aephia/atlas-kit 0.6.0-next.99 → 0.6.0

package/dist/combat/actions/index.js

@@ -1,23 +1,32 @@
 import { fleetAttackInstructionKey, validateFleetAttackActors, } from '../../internal/planning/fleet-attack-xp.js';
 import { resolveXpRuntime } from '../../internal/planning/xp-runtime.js';
-import { getAddressEncoder, isAddress } from '@solana/kit';
+import { hashRegionAccess, regionsContainingSystem, } from '../../internal/planning/region-access.js';
+import { isAddress } from '@solana/kit';
+import { requireDisabledLevelRent } from '../../internal/planning/rent-catalog.js';
 import { resolveActionRuntime } from '../../internal/planning/action-runtime.js';
 import { InvalidActionInputError, SageSdkError } from '../../client/errors.js';
 import { readContextRawAccounts } from '../../client/reconciliation.js';
 import { getRetrieveLootInstructionDataEncoder } from '../../internal/c4/runtime-bindings.js';
-import { lootAccountDefinition, } from '../../internal/c4/combat.js';
+import { lootAccountDefinition, } from '../../internal/c4/loot.js';
 import { deriveFleetAddress, fleetAccountDefinition, } from '../../internal/c4/fleet.js';
 import { deriveFleetCrewBindingAddress, fleetCrewBindingAccountDefinition, matchesFleetCrewBindingIdentity, } from '../../internal/c4/fleet-crew-binding.js';
 import { deriveFactionAccountAddress, deriveFactionEconomicsConfigAddress, deriveFactionOwnershipAddress, deriveFactionRelationTrackerAddress, deriveFactionTreasuryAddress, deriveKingSystemTrackerAddress, deriveRegionTrackerAddress, factionAccountDefinition, factionEconomicsConfigAccountDefinition, factionOwnershipAccountDefinition, factionRelationTrackerAccountDefinition, factionTreasuryAccountDefinition, kingSystemTrackerAccountDefinition, regionTrackerAccountDefinition, } from '../../internal/c4/factions.js';
-import { characterAccountDefinition, findCharacterPda, } from '../../internal/c4/identity.js';
+import { factionValue } from '../../internal/c4/faction.js';
+import { characterAccountDefinition, findCharacterPda, } from '../../internal/c4/character.js';
 import { deriveLoyaltyContributionAddress, deriveLoyaltyEpochAddress, loyaltyContributionAccountDefinition, loyaltyEpochAccountDefinition, } from '../../internal/c4/loyalty.js';
 import { atlasRewardConfigAccountDefinition, atlasRewardRegistryAccountDefinition, deriveAtlasRewardConfigAddress, deriveAtlasRewardRegistryAddress, } from '../../internal/c4/rewards.js';
 import { deriveStarSystemAddress, starSystemAccountDefinition, } from '../../internal/c4/world.js';
 import { requireGameAddress } from '../../internal/game-context.js';
-import { adaptApplyCombatStimulantInstruction, adaptAttackFleetInstruction, adaptAttackStarbaseInstruction, adaptRetrieveLootInstruction, validatePlanAuthorization, } from '../../internal/planning/authorization-adapter.js';
-import { createPlan, } from '../../planning/index.js';
+import { adaptApplyCombatStimulantInstruction, adaptAttackFleetInstruction, adaptAttackStarbaseInstruction, adaptRetrieveLootInstruction, readPlanAuthorization, } from '../../internal/planning/authorization-adapter.js';
+import { buildPlannerPlan } from '../../planning/plan-construction.js';
 import { readGameCombatConfiguration } from '../../registry/combat.js';
+import { CLOCK_ADDRESS, readClock, } from '../../internal/planning/faction-enrollment.js';
 import { resolveCargo, } from '../../registry/index.js';
+import { accountAbsentPrecondition, accountStatePrecondition, } from '../../internal/planning/account-state.js';
+import { stimulantStatId } from '../../internal/c4/stimulant.js';
+import { readCombatStorageAction } from '../../internal/planning/combat-storage-actions.js';
+import { RENT_ADDRESS } from '../../internal/planning/rent.js';
+import { planStorageFunding } from '../../internal/planning/storage-actions.js';
 function invalid(field, value, acceptedRange, remedy) {
     throw new InvalidActionInputError(field, value, acceptedRange, remedy);
 }
@@ -38,19 +47,13 @@ function assertKeys(value, field, required, optional = []) {
 function validateOptions(value) {
     const options = readRecord(value, 'options');
     assertKeys(options, 'options', ['authorization']);
-    const authorizationRecord = readRecord(options.authorization, 'authorization');
-    assertKeys(authorizationRecord, 'authorization', ['profile', 'authority', 'keyIndex'], ['certificate']);
-    const authorization = authorizationRecord;
-    validatePlanAuthorization(authorization);
+    const authorization = readPlanAuthorization(options.authorization);
     return { authorization };
 }
 function validateAttackOptions(value) {
     const options = readRecord(value, 'options');
     assertKeys(options, 'options', ['authorization', 'loot']);
-    const authorizationRecord = readRecord(options.authorization, 'authorization');
-    assertKeys(authorizationRecord, 'authorization', ['profile', 'authority', 'keyIndex'], ['certificate']);
-    const authorization = authorizationRecord;
-    validatePlanAuthorization(authorization);
+    const authorization = readPlanAuthorization(options.authorization);
     if (typeof options.loot !== 'string' || !isAddress(options.loot)) {
         invalid('options.loot', options.loot, 'one valid new Loot account address', 'Generate a new address-only Loot signer and provide its public address before retrying.');
     }
@@ -69,10 +72,7 @@ function validateAttackStance(value) {
 function validateRetrieveOptions(value) {
     const options = readRecord(value, 'options');
     assertKeys(options, 'options', ['authorization', 'atUnixSeconds']);
-    const authorizationRecord = readRecord(options.authorization, 'authorization');
-    assertKeys(authorizationRecord, 'authorization', ['profile', 'authority', 'keyIndex'], ['certificate']);
-    const authorization = authorizationRecord;
-    validatePlanAuthorization(authorization);
+    const authorization = readPlanAuthorization(options.authorization);
     if (typeof options.atUnixSeconds !== 'bigint' || options.atUnixSeconds < 0n) {
         invalid('options.atUnixSeconds', options.atUnixSeconds, 'a non-negative bigint Unix timestamp', 'Provide the explicit current Unix timestamp used to evaluate Loot exclusivity before retrying.');
     }
@@ -122,13 +122,21 @@ function validateLootSelection(value, loot, fleet, retrievingProfile, atUnixSeco
         if (item === undefined) {
             invalid(`${field}.itemIndex`, itemIndex, `an available Loot item index below ${String(loot.items.length)}`, 'Refresh the Loot snapshot and select an existing item before retrying.');
         }
-        if (item.destroyer.address !== fleet.address &&
-            atUnixSeconds < item.exclusivityUnlockAtUnixSeconds) {
-            fail(`Loot item ${String(itemIndex)} is exclusive to Fleet ${item.destroyer.address}, not Fleet ${fleet.address}. Use the destroying Fleet or wait for chain-authoritative exclusivity resolution before retrying.`, loot.address);
+        // The retriever is the Fleet's controlling Profile. Reward cargo stays
+        // locked to the destroying Profile until it expires and is swept; ordinary
+        // cargo is exclusive to the destroying Profile only until the unlock time.
+        const destroyer = item.destroyer?.address;
+        if (item.rewardReclaimAtUnixSeconds > 0n) {
+            if (destroyer !== retrievingProfile) {
+                fail(`Loot item ${String(itemIndex)} is reward cargo locked to ${destroyer === undefined ? 'no destroying Profile' : `destroying Profile ${destroyer}`}, not Profile ${retrievingProfile}. Reward cargo never opens to other Profiles; it is swept after ${String(item.rewardReclaimAtUnixSeconds)} Unix seconds. Choose another item or use the destroying Profile's Fleet before retrying.`, loot.address);
+            }
+            if (atUnixSeconds > item.rewardReclaimAtUnixSeconds) {
+                fail(`Loot item ${String(itemIndex)} reward cargo expired at ${String(item.rewardReclaimAtUnixSeconds)} Unix seconds and is swept to the reward treasury, not retrievable at ${String(atUnixSeconds)}. Choose another item or refresh the Loot before retrying.`, loot.address);
+            }
         }
-        if (loot.profile.address !== retrievingProfile &&
-            atUnixSeconds < item.rewardReclaimAtUnixSeconds) {
-            fail(`Loot item ${String(itemIndex)} reward cargo is exclusive to Profile ${loot.profile.address}, not Profile ${retrievingProfile}, until ${String(item.rewardReclaimAtUnixSeconds)} Unix seconds. Use the reward-owning Profile or wait for chain-authoritative reward reclaim resolution before retrying.`, loot.address);
+        else if (atUnixSeconds < item.exclusivityUnlockAtUnixSeconds &&
+            destroyer !== retrievingProfile) {
+            fail(`Loot item ${String(itemIndex)} is exclusive to ${destroyer === undefined ? 'no Profile (a Starbase kill)' : `destroying Profile ${destroyer}`} until ${String(item.exclusivityUnlockAtUnixSeconds)} Unix seconds, not Profile ${retrievingProfile}. Use the destroying Profile's Fleet or wait for the exclusivity window to pass before retrying.`, loot.address);
         }
         const cargoRequests = denseArray(target.cargo, `${field}.cargo`);
         if (cargoRequests.length === 0 || cargoRequests.length > 65_536) {
@@ -185,7 +193,7 @@ function requireAccount(account, address, message) {
 }
 function stimulantFingerprint(stimulant) {
     const effects = stimulant.effects
-        .map(({ charges, deltaBps, stackRuleId, statId }) => `${String(charges)}:${String(deltaBps)}:${String(stackRuleId)}:${String(statId)}`)
+        .map(({ charges, deltaBps, stackRule, stat }) => `${String(charges)}:${String(deltaBps)}:${stackRule}:${stat}`)
         .join(',');
     return [
         stimulant.cargo.id,
@@ -210,35 +218,14 @@ function rawCargoFingerprint(fleet) {
         .join(',');
     return [fleet.cargoHold.seqId, fleet.cargoHold.storageCost, items].join('|');
 }
-async function hashAccountState(account) {
-    const owner = getAddressEncoder().encode(account.owner);
-    const canonical = new Uint8Array(owner.length + account.data.length);
-    canonical.set(owner);
-    canonical.set(account.data, owner.length);
-    const digest = new Uint8Array(await globalThis.crypto.subtle.digest('SHA-256', canonical));
-    return [...digest].map((byte) => byte.toString(16).padStart(2, '0')).join('');
-}
-async function precondition(account, describes) {
-    return Object.freeze({
-        address: account.address,
-        dataHash: await hashAccountState(account),
-        describes,
-        kind: 'account-state',
-    });
-}
-function absentPrecondition(address, describes) {
-    return Object.freeze({
-        address,
-        describes,
-        kind: 'account-absent',
-    });
-}
 /** Plans application of one configured combat stimulant without predicting its effects.
  *
  * The planner validates Fleet ownership and Game membership, current catalog
- * membership, known cargo balance, crewed non-destroyed state, and fresh
- * whole-account Fleet state. Permission, stacking, charge application, and
- * combat arithmetic remain chain-authoritative.
+ * membership, known cargo balance, a crewed Fleet that is neither destroyed
+ * nor respawning, and fresh whole-account Fleet state. Only stimulants whose
+ * effects use the `refresh` stack rule are planned, as the game applies no
+ * other rule yet. Permission, charge application, and combat arithmetic remain
+ * chain-authoritative.
  *
  * @example
  * ```ts
@@ -264,8 +251,13 @@ export async function planFleetApplyCombatStimulant(ctx, fleet, stimulant, input
     if (fleet.game !== game) {
         fail(`Fleet ${fleet.address} belongs to Game ${fleet.game}, not configured Game ${game}. Refresh the Fleet through this context and retry.`, fleet.address);
     }
-    if (fleet.state.kind === 'destroyed') {
-        fail(`Fleet ${fleet.name} (${fleet.address}) is destroyed and cannot apply a combat stimulant. Respawn the Fleet, refresh it, and retry.`, fleet.address);
+    if (fleet.state.kind === 'destroyed' || fleet.state.kind === 'respawn') {
+        fail(`Fleet ${fleet.name} (${fleet.address}) is ${fleet.state.kind} and cannot apply a combat stimulant. Wait until it is back at a Starbase, refresh it, and retry.`, fleet.address);
+    }
+    // The game applies only refresh-rule effects and refuses the others.
+    const unsupported = stimulant.effects.find(({ stackRule }) => stackRule !== 'refresh');
+    if (unsupported !== undefined) {
+        fail(`Stimulant ${stimulant.cargo.name} has a ${unsupported.stackRule} effect on ${unsupported.stat}; the game applies only refresh effects. Choose another stimulant.`, fleet.address);
     }
     const combat = await readGameCombatConfiguration(ctx);
     const definitions = await Promise.all(combat.data.stimulantDefinitions.definitions.map(async (definition) => ({
@@ -311,41 +303,32 @@ export async function planFleetApplyCombatStimulant(ctx, fleet, stimulant, input
     if (current.crewCount <= 0) {
         fail(`Fleet ${fleet.name} (${fleet.address}) has no crew and cannot apply a combat stimulant. Crew the Fleet, refresh it through this context, and retry.`, fleet.address);
     }
-    const description = `Apply one ${catalogued.cargo.name} combat stimulant from Fleet ${fleet.name} (${fleet.address}); permission, stacking, charge application, and combat outcomes remain chain-authoritative.`;
-    return createPlan({
+    const instruction = adaptApplyCombatStimulantInstruction({
+        authorization: options.authorization,
+        fleet: fleet.address,
+        game,
+        stimCargoId: catalogued.cargo.id,
+    });
+    // A stimulant for a stat without an entry grows the Fleet; the program funds
+    // that from the Profile vault with the signing key.
+    const storage = await planFleetStorage(ctx, instruction, [account.address], options.authorization.profile, 'combat stimulant', catalogued.effects.map(({ stat }) => stimulantStatId(stat)));
+    const description = `Apply one ${catalogued.cargo.name} combat stimulant from Fleet ${fleet.name} (${fleet.address}); permission, stacking, charge application, and combat outcomes remain chain-authoritative. ${storage.disclosure}`;
+    return buildPlannerPlan({
         kind: 'combat.apply-stimulant',
         preconditions: [
-            await precondition(account, `Fleet ${fleet.name} retains its configured Game, owning Profile, supported crewed state, and known ${catalogued.cargo.name} cargo balance.`),
+            await accountStatePrecondition(account, `Fleet ${fleet.name} retains its configured Game, owning Profile, supported crewed state, and known ${catalogued.cargo.name} cargo balance.`),
+            storage.guard,
         ],
         steps: [
             {
                 describes: description,
-                instruction: adaptApplyCombatStimulantInstruction({
-                    authorization: options.authorization,
-                    fleet: fleet.address,
-                    game,
-                    stimCargoId: catalogued.cargo.id,
-                }),
+                instruction,
                 signers: [options.authorization.authority],
             },
         ],
         summary: description,
     });
 }
-function factionId(fleet) {
-    if (fleet.npcFactionId > 0)
-        return fleet.npcFactionId;
-    switch (fleet.faction) {
-        case 'mud':
-            return 1;
-        case 'oni':
-            return 2;
-        case 'ustur':
-            return 3;
-        case 'unaligned':
-            return 0;
-    }
-}
 function shipFingerprint(fleet) {
     return fleet.ships
         .map(({ id, quantity }) => `${String(id)}:${String(quantity)}`)
@@ -401,6 +384,25 @@ async function validateCurrentAttackFleet(fleet, account) {
     }
     return currentAccount;
 }
+/** The program attacks only with an attacker that is Idle or subwarping at
+ * chain time (a finished warp counts as Idle), carries its required crew, and
+ * has usable AP: stored AP refills right after an attack, but stays unusable
+ * until the reload completes. */
+function validateAttackerReadiness(fleet, account, clock) {
+    const now = readClock(requireAccount(clock, CLOCK_ADDRESS, 'The Clock sysvar is missing. Refresh chain time and retry the attack.'));
+    const current = fleetAccountDefinition.decode(account);
+    const label = `Attacking Fleet ${fleet.name} (${fleet.address})`;
+    const { state } = current;
+    if (state.kind !== 'idle' &&
+        state.kind !== 'subwarp' &&
+        !(state.kind === 'warp' && now >= state.arrivesAtUnixSeconds))
+        fail(`${label} is ${state.kind === 'warp' ? 'still warping' : state.kind}; only an Idle or subwarping Fleet can attack. Wait or move it into space, refresh the Fleet, and retry.`, fleet.address);
+    if (current.crewCount < current.stats.misc.requiredCrew)
+        fail(`${label} has ${String(current.crewCount)} crew but needs ${String(current.stats.misc.requiredCrew)} to attack. Load crew, refresh the Fleet, and retry.`, fleet.address);
+    // Zero stored AP is refused earlier, and the fresh account matches the snapshot.
+    if (now < current.apReloadExpiresAt)
+        fail(`${label} has no usable ability power at chain time ${String(now)}: stored AP ${String(current.ap)} with reload completing at ${String(current.apReloadExpiresAt)}. Wait for the reload, refresh the Fleet, and retry.`, fleet.address);
+}
 async function optionalCrewBinding(ctx, fleet) {
     const address = await deriveFleetCrewBindingAddress(fleet.address);
     const [envelope] = await ctx.data.readMany(fleetCrewBindingAccountDefinition, [address]);
@@ -411,7 +413,7 @@ async function optionalCrewBinding(ctx, fleet) {
     return envelope?.address;
 }
 async function resolveRewardAccounts(ctx, fleet, registry, config, epochIndex) {
-    const resolvedFaction = factionId(fleet);
+    const resolvedFaction = fleet.npcFactionId > 0 ? fleet.npcFactionId : factionValue(fleet.faction);
     if (resolvedFaction === 0)
         return { config, registry };
     const [epochAddress, contributionAddress] = await Promise.all([
@@ -446,35 +448,86 @@ async function resolveRewardAccounts(ctx, fleet, registry, config, epochIndex) {
         registry,
     };
 }
-async function resolveNpcAccounts(ctx, fleet, requireFactionAccount) {
+/** Reads and requires an NPC Fleet's canonical FactionOwnership and, when
+ * `withFaction`, its Faction account; a player Fleet has neither. */
+async function resolveNpcAccounts(ctx, fleet, withFaction) {
     if (fleet.npcFactionId === 0)
         return {};
-    const ownershipAddress = await deriveFactionOwnershipAddress(fleet.game, 'fleet', fleet.address);
-    const [ownership] = await ctx.data.readMany(factionOwnershipAccountDefinition, [ownershipAddress]);
+    const addresses = await Promise.all([
+        deriveFactionOwnershipAddress(fleet.game, 'fleet', fleet.address),
+        ...(withFaction
+            ? [deriveFactionAccountAddress(fleet.game, fleet.npcFactionId)]
+            : []),
+    ]);
+    const [ownership, faction] = await readContextRawAccounts(ctx, addresses);
+    const ownershipData = ownership && factionOwnershipAccountDefinition.decode(ownership);
     if (ownership === undefined ||
-        ownership.data.game !== fleet.game ||
-        ownership.data.asset.kind !== 'fleet' ||
-        ownership.data.asset.fleet !== fleet.address ||
-        ownership.data.controllingFactionId !== fleet.npcFactionId) {
-        fail(`NPC Fleet ${fleet.address} has no matching canonical FactionOwnership for faction ${String(fleet.npcFactionId)}. Refresh the Fleet and faction ownership relationship before retrying.`, ownershipAddress);
-    }
-    if (!requireFactionAccount)
-        return { ownership: ownership.address };
-    const factionAddress = await deriveFactionAccountAddress(fleet.game, fleet.npcFactionId);
-    const faction = await ctx.data.read(factionAccountDefinition, factionAddress);
-    if (faction.data.game !== fleet.game ||
-        faction.data.factionId !== fleet.npcFactionId) {
-        fail(`Faction ${factionAddress} does not match NPC Fleet ${fleet.address}'s Game and faction id. Refresh the faction registry relationship before retrying.`, factionAddress);
-    }
-    return { factionAccount: faction.address, ownership: ownership.address };
+        ownershipData?.game !== fleet.game ||
+        ownershipData.asset.kind !== 'fleet' ||
+        ownershipData.asset.fleet !== fleet.address ||
+        ownershipData.controllingFactionId !== fleet.npcFactionId) {
+        fail(`NPC Fleet ${fleet.address} has no matching canonical FactionOwnership for faction ${String(fleet.npcFactionId)}. Refresh the Fleet and faction ownership relationship before retrying.`, addresses[0]);
+    }
+    if (!withFaction)
+        return { ownership };
+    const factionData = faction && factionAccountDefinition.decode(faction);
+    if (faction === undefined ||
+        factionData?.game !== fleet.game ||
+        factionData.factionId !== fleet.npcFactionId) {
+        fail(`Faction ${addresses[1]} is missing or does not match NPC Fleet ${fleet.address}'s Game and faction id. Refresh the faction registry relationship before retrying.`, addresses[1]);
+    }
+    return { faction, ownership };
 }
 function generatedStance(stance) {
     return {
         ammoUsage: stance.ammoUsage === 'none' ? 0 : stance.ammoUsage === 'light' ? 1 : 2,
     };
 }
+/** Requires a live Fleet snapshot of the configured Game with known AP, crew
+ * and ship composition; an attacking Fleet also needs AP available. */
+function validateAttackFleet(fleet, role, game) {
+    const label = `The ${role} Fleet ${fleet.name} (${fleet.address})`;
+    if (fleet.game !== game) {
+        fail(`${label} belongs to Game ${fleet.game}, not configured Game ${game}. Refresh the Fleet through this context and retry.`, fleet.address);
+    }
+    if (fleet.state.kind === 'destroyed') {
+        fail(`${label} is destroyed and cannot participate in this attack. Refresh the Fleet after respawn and retry.`, fleet.address);
+    }
+    if (!Number.isSafeInteger(fleet.ap) ||
+        fleet.ap < 0 ||
+        !Number.isSafeInteger(fleet.crewCount) ||
+        fleet.crewCount <= 0) {
+        fail(`${label} has unknown or invalid AP or crew state. Refresh the Fleet through this context and retry.`, fleet.address);
+    }
+    if (fleet.ships.length === 0 ||
+        fleet.ships.some(({ quantity }) => quantity <= 0n)) {
+        fail(`${label} has no valid known ship composition. Refresh Fleet composition and retry.`, fleet.address);
+    }
+    if (role === 'attacking' && fleet.ap === 0) {
+        fail(`${label} has no known AP available. Wait for AP reload, refresh the Fleet, and retry.`, fleet.address);
+    }
+}
+/** Validates the inputs every attack shares: the stance, an attacking Fleet
+ * owned by the authorization Profile that can attack, and a new Loot address
+ * distinct from the authorization signers. */
+function validateAttack(ctx, attacker, inputStance, inputOptions) {
+    const options = validateAttackOptions(inputOptions);
+    const stance = validateAttackStance(inputStance);
+    const game = requireGameAddress(ctx);
+    if (attacker.ownerProfile.address !== options.authorization.profile) {
+        fail(`Attacking Fleet ${attacker.address} does not belong to authorization Profile ${options.authorization.profile}. Choose an owned Fleet and retry.`, attacker.address);
+    }
+    if (options.loot === options.authorization.authority ||
+        options.loot === options.authorization.profile) {
+        fail(`The new Loot address ${options.loot} must be distinct from the authorization authority and Profile. Generate a separate Loot signer address and retry.`, options.loot);
+    }
+    validateAttackFleet(attacker, 'attacking', game);
+    return { game, options, stance };
+}
 /** Plans one singleton Fleet-on-Fleet attack without predicting its outcome.
  *
+ * At chain time the attacker must be Idle or subwarping (a finished warp
+ * counts as Idle), carry its required crew, and have finished reloading AP.
  * Range, randomness, recent slot hashes, final combat arithmetic, and chain
  * races remain authoritative. This Plan cannot be combined with another
  * gameplay instruction because the generated program contract requires a
@@ -497,47 +550,16 @@ function generatedStance(stance) {
  * ```
  */
 export async function planFleetAttackFleet(ctx, attacker, defender, inputStance, inputOptions) {
-    const options = validateAttackOptions(inputOptions);
-    const stance = validateAttackStance(inputStance);
-    const game = requireGameAddress(ctx);
+    const { game, options, stance } = validateAttack(ctx, attacker, inputStance, inputOptions);
     if (attacker.address === defender.address) {
         fail(`Fleet ${attacker.address} cannot attack itself. Choose a distinct defending Fleet and retry.`, attacker.address);
     }
-    if (attacker.ownerProfile.address !== options.authorization.profile) {
-        fail(`Attacking Fleet ${attacker.address} does not belong to authorization Profile ${options.authorization.profile}. Choose an owned Fleet and retry.`, attacker.address);
-    }
-    if (options.loot === options.authorization.authority ||
-        options.loot === options.authorization.profile) {
-        fail(`The new Loot address ${options.loot} must be distinct from the authorization authority and Profile. Generate a separate Loot signer address and retry.`, options.loot);
-    }
-    for (const [role, fleet] of [
-        ['attacking', attacker],
-        ['defending', defender],
-    ]) {
-        if (fleet.game !== game) {
-            fail(`The ${role} Fleet ${fleet.address} belongs to Game ${fleet.game}, not configured Game ${game}. Refresh both Fleets through this context and retry.`, fleet.address);
-        }
-        if (fleet.state.kind === 'destroyed') {
-            fail(`The ${role} Fleet ${fleet.name} (${fleet.address}) is destroyed and cannot participate in this attack. Refresh the Fleet after respawn and retry.`, fleet.address);
-        }
-        if (!Number.isSafeInteger(fleet.ap) ||
-            fleet.ap < 0 ||
-            !Number.isSafeInteger(fleet.crewCount) ||
-            fleet.crewCount <= 0) {
-            fail(`The ${role} Fleet ${fleet.name} (${fleet.address}) has unknown or invalid AP or crew state. Refresh the Fleet through this context and retry.`, fleet.address);
-        }
-        if (fleet.ships.length === 0 ||
-            fleet.ships.some(({ quantity }) => quantity <= 0n)) {
-            fail(`The ${role} Fleet ${fleet.name} (${fleet.address}) has no valid known ship composition. Refresh Fleet composition and retry.`, fleet.address);
-        }
-    }
-    if (attacker.ap === 0) {
-        fail(`Attacking Fleet ${attacker.name} (${attacker.address}) has no known AP available. Wait for AP reload, refresh the Fleet, and retry.`, attacker.address);
-    }
+    validateAttackFleet(defender, 'defending', game);
     const currentAccounts = await readContextRawAccounts(ctx, [
         attacker.address,
         defender.address,
         options.loot,
+        CLOCK_ADDRESS,
     ]);
     if (currentAccounts[2] !== undefined) {
         fail(`Loot account ${options.loot} already exists. Generate a new unused Loot signer address and retry.`, options.loot);
@@ -546,6 +568,7 @@ export async function planFleetAttackFleet(ctx, attacker, defender, inputStance,
         validateCurrentAttackFleet(attacker, currentAccounts[0]),
         validateCurrentAttackFleet(defender, currentAccounts[1]),
     ]);
+    validateAttackerReadiness(attacker, attackerAccount, currentAccounts[3]);
     const registryAddress = await deriveAtlasRewardRegistryAddress(game);
     const registry = await ctx.data.read(atlasRewardRegistryAccountDefinition, registryAddress);
     if (registry.data.game !== game) {
@@ -590,12 +613,12 @@ export async function planFleetAttackFleet(ctx, attacker, defender, inputStance,
         describes: 'Both operator XP budgets remain canonical and reconciled; earned XP and bank balances may change.',
     }));
     const instruction = adaptAttackFleetInstruction({
-        ...(attackerNpc.factionAccount === undefined
+        ...(attackerNpc.faction === undefined
             ? {}
-            : { attackerFactionAccount: attackerNpc.factionAccount }),
+            : { attackerFactionAccount: attackerNpc.faction.address }),
         ...(attackerNpc.ownership === undefined
             ? {}
-            : { attackerFleetOwnership: attackerNpc.ownership }),
+            : { attackerFleetOwnership: attackerNpc.ownership.address }),
         attackerRewardsConfig: attackerRewards.config,
         ...(attackerRewards.contribution === undefined
             ? {}
@@ -616,7 +639,7 @@ export async function planFleetAttackFleet(ctx, attacker, defender, inputStance,
         defenderCharacter,
         ...(defenderNpc.ownership === undefined
             ? {}
-            : { defenderFleetOwnership: defenderNpc.ownership }),
+            : { defenderFleetOwnership: defenderNpc.ownership.address }),
         defenderRewardsConfig: defenderRewards.config,
         ...(defenderRewards.contribution === undefined
             ? {}
@@ -635,7 +658,7 @@ export async function planFleetAttackFleet(ctx, attacker, defender, inputStance,
         stance: generatedStance(stance),
     });
     const description = `Attack Fleet ${defender.name} (${defender.address}) with Fleet ${attacker.name} (${attacker.address}) using ${stance.ammoUsage} ammunition; range, randomness, rewards, Loot, damage, and final combat arithmetic remain chain-authoritative.`;
-    return createPlan({
+    return buildPlannerPlan({
         kind: 'combat.attack-fleet',
         preconditions: [
             {
@@ -645,8 +668,8 @@ export async function planFleetAttackFleet(ctx, attacker, defender, inputStance,
                 describes: 'The exact attack instruction and both canonical operators remain bound.',
             },
             ...xpGuards,
-            await precondition(attackerAccount, `Attacking Fleet ${attacker.name} retains its owner, Game, live state, crew, AP, faction, and ship composition.`),
-            await precondition(defenderAccount, `Defending Fleet ${defender.name} retains its owner, Game, live state, crew, faction, and ship composition.`),
+            await accountStatePrecondition(attackerAccount, `Attacking Fleet ${attacker.name} retains its owner, Game, live state, crew, AP, faction, and ship composition.`),
+            await accountStatePrecondition(defenderAccount, `Defending Fleet ${defender.name} retains its owner, Game, live state, crew, faction, and ship composition.`),
         ],
         steps: [
             {
@@ -674,26 +697,26 @@ function systemFingerprint(system) {
         version: system.version,
     }, (_key, value) => typeof value === 'bigint' ? value.toString() : value);
 }
-function starbaseFactionId(owner) {
-    switch (owner) {
-        case 'mud':
-            return 1;
-        case 'oni':
-            return 2;
-        case 'ustur':
-            return 3;
-        case 'unaligned':
-            return null;
-    }
-}
 /** Plans one singleton Fleet-on-Starbase attack without predicting its outcome.
  *
+ * At chain time the attacker must be Idle or subwarping (a finished warp
+ * counts as Idle), carry its required crew, and have finished reloading AP.
  * The planner validates the owned attacking Fleet, canonical target System and
  * nested shared Starbase, configured faction ownership mode, reward
  * configuration, and the optional dynamic-NPC capture economy. Range,
  * capture-cost debit outcome, randomness, damage, rewards, and final
  * admissibility remain chain-authoritative.
  *
+ * Requires Disabled rent: the Game's rent catalog and the target System's
+ * Starbase-level rent history must not exist, and both stay guarded absent until
+ * signing.
+ *
+ * From the RegionTracker, the attack reads only the target System's Region, so
+ * the Plan guards only that Region's owner, safety status and risk zone and a
+ * Starbase capture or upgrade in another Region leaves it valid. If the
+ * System's stored Region disagrees with the Region map, the whole tracker stays
+ * guarded.
+ *
  * @example
  * ```ts
  * declare const ctx: SageContext;
@@ -711,32 +734,7 @@ function starbaseFactionId(owner) {
  * ```
  */
 export async function planFleetAttackStarbase(ctx, attacker, target, inputStance, inputOptions) {
-    const options = validateAttackOptions(inputOptions);
-    const stance = validateAttackStance(inputStance);
-    const game = requireGameAddress(ctx);
-    if (attacker.ownerProfile.address !== options.authorization.profile) {
-        fail(`Attacking Fleet ${attacker.address} does not belong to authorization Profile ${options.authorization.profile}. Choose an owned Fleet and retry.`, attacker.address);
-    }
-    if (options.loot === options.authorization.authority ||
-        options.loot === options.authorization.profile) {
-        fail(`The new Loot address ${options.loot} must be distinct from the authorization authority and Profile. Generate a separate Loot signer address and retry.`, options.loot);
-    }
-    if (attacker.game !== game) {
-        fail(`Attacking Fleet ${attacker.address} belongs to Game ${attacker.game}, not configured Game ${game}. Refresh the Fleet through this context and retry.`, attacker.address);
-    }
-    if (attacker.state.kind === 'destroyed') {
-        fail(`Attacking Fleet ${attacker.name} (${attacker.address}) is destroyed and cannot attack a Starbase. Refresh the Fleet after respawn and retry.`, attacker.address);
-    }
-    if (!Number.isSafeInteger(attacker.ap) ||
-        attacker.ap <= 0 ||
-        !Number.isSafeInteger(attacker.crewCount) ||
-        attacker.crewCount <= 0) {
-        fail(`Attacking Fleet ${attacker.name} (${attacker.address}) has no known positive AP or valid crew state. Wait for AP reload, refresh the Fleet, and retry.`, attacker.address);
-    }
-    if (attacker.ships.length === 0 ||
-        attacker.ships.some(({ quantity }) => quantity <= 0n)) {
-        fail(`Attacking Fleet ${attacker.name} (${attacker.address}) has no valid known ship composition. Refresh Fleet composition and retry.`, attacker.address);
-    }
+    const { game, options, stance } = validateAttack(ctx, attacker, inputStance, inputOptions);
     if (target.game !== game) {
         fail(`Target Star System ${target.address} belongs to Game ${target.game}, not configured Game ${game}. Refresh the target through this context and retry.`, target.address);
     }
@@ -755,9 +753,10 @@ export async function planFleetAttackStarbase(ctx, attacker, target, inputStance
         deriveRegionTrackerAddress(game),
         deriveFleetCrewBindingAddress(attacker.address),
     ]);
-    const [probeRelationsAccount, probeRegistryAccount] = await readContextRawAccounts(ctx, [
-        relationTrackerAddress,
-        registryAddress,
+    const [[probeRelationsAccount, probeRegistryAccount], attackerNpc, rent] = await Promise.all([
+        readContextRawAccounts(ctx, [relationTrackerAddress, registryAddress]),
+        resolveNpcAccounts(ctx, attacker, true),
+        requireDisabledLevelRent(ctx, game, target, 'the Starbase attack'),
     ]);
     const probeRelations = factionRelationTrackerAccountDefinition.decode(requireAccount(probeRelationsAccount, relationTrackerAddress, `FactionRelationTracker ${relationTrackerAddress} is missing. Refresh faction relationships and retry.`));
     const probeRegistry = atlasRewardRegistryAccountDefinition.decode(requireAccount(probeRegistryAccount, registryAddress, `AtlasRewardRegistry ${registryAddress} is missing. Refresh reward configuration and retry.`));
@@ -768,12 +767,6 @@ export async function planFleetAttackStarbase(ctx, attacker, target, inputStance
         fail(`AtlasRewardRegistry ${registryAddress} belongs to another Game. Refresh the configured reward registry and retry.`, registryAddress);
     }
     const rewardConfigAddress = await deriveAtlasRewardConfigAddress(game, probeRegistry.activeConfigVersion);
-    const attackerOwnership = attacker.npcFactionId === 0
-        ? undefined
-        : await deriveFactionOwnershipAddress(game, 'fleet', attacker.address);
-    const attackerFaction = attacker.npcFactionId === 0
-        ? undefined
-        : await deriveFactionAccountAddress(game, attacker.npcFactionId);
     const requiresNpcEconomy = attacker.npcFactionId > 0 &&
         probeRelations.dynamicCaptureEnabled &&
         probeRelations.nemesisActive;
@@ -797,10 +790,9 @@ export async function planFleetAttackStarbase(ctx, attacker, target, inputStance
         character,
         regionTracker,
         crewBindingAddress,
-        ...(attackerOwnership === undefined ? [] : [attackerOwnership]),
-        ...(attackerFaction === undefined ? [] : [attackerFaction]),
         ...(factionEconomicsConfig === undefined ? [] : [factionEconomicsConfig]),
         ...(captorTreasury === undefined ? [] : [captorTreasury]),
+        CLOCK_ADDRESS,
     ];
     const dependencyAccounts = await readContextRawAccounts(ctx, dependencyAddresses);
     const current = new Map(dependencyAddresses.map((address, index) => [
@@ -811,6 +803,7 @@ export async function planFleetAttackStarbase(ctx, attacker, target, inputStance
         fail(`Loot account ${options.loot} already exists. Generate a new unused Loot signer address and retry.`, options.loot);
     }
     const attackerAccount = await validateCurrentAttackFleet(attacker, current.get(attacker.address));
+    validateAttackerReadiness(attacker, attackerAccount, current.get(CLOCK_ADDRESS));
     const systemAccount = requireAccount(current.get(target.address), target.address, `Target Star System ${target.name} (${target.address}) is missing. Refresh world state and retry the attack.`);
     const currentSystem = starSystemAccountDefinition.decode(systemAccount);
     if ((await deriveStarSystemAddress(currentSystem.game, currentSystem.systemId)) !== target.address ||
@@ -834,7 +827,8 @@ export async function planFleetAttackStarbase(ctx, attacker, target, inputStance
     if (ownership === undefined && relations.dynamicCaptureEnabled) {
         fail(`Target Starbase ${target.address} requires canonical FactionOwnership while dynamic capture is enabled. Refresh Starbase ownership and retry.`, ownershipAddress);
     }
-    const legacyOwner = starbaseFactionId(target.starbase.owner);
+    // KingSystemTracker records an unaligned owner as null.
+    const legacyOwner = factionValue(target.starbase.owner) || null;
     if (ownership !== undefined &&
         (ownership.game !== game ||
             ownership.asset.kind !== 'starbase' ||
@@ -875,6 +869,20 @@ export async function planFleetAttackStarbase(ctx, attacker, target, inputStance
     if (regionTrackerData.game !== game) {
         fail(`RegionTracker ${regionTracker} does not match configured Game ${game}. Refresh world region data and retry.`, regionTracker);
     }
+    // The attack reads the target's stored Region. When the Region map agrees,
+    // guard only that Region's access data; otherwise keep the whole tracker.
+    const regionAccess = (await regionsContainingSystem(regionTrackerAccount, systemAccount, game))
+        .map(({ id }) => id)
+        .join() === String(currentSystem.regionId ?? '')
+        ? {
+            kind: 'region-access',
+            address: regionTracker,
+            game,
+            system: target.address,
+            accessHash: await hashRegionAccess(regionTrackerAccount, systemAccount, game),
+            describes: `The Region holding target Star System ${target.name} keeps its owner, safety status and risk zone; other Regions may change.`,
+        }
+        : undefined;
     const crewBindingAccount = current.get(crewBindingAddress);
     const crewBinding = crewBindingAccount === undefined ? undefined : crewBindingAddress;
     if (crewBindingAccount !== undefined) {
@@ -883,27 +891,6 @@ export async function planFleetAttackStarbase(ctx, attacker, target, inputStance
             fail(`FleetCrewBinding ${crewBindingAddress} does not belong to Fleet ${attacker.address} and Profile ${attacker.ownerProfile.address}. Refresh the Fleet crew relationship and retry.`, crewBindingAddress);
         }
     }
-    const attackerNpc = {};
-    let attackerOwnershipAccount;
-    let attackerFactionAccount;
-    if (attackerOwnership !== undefined && attackerFaction !== undefined) {
-        attackerOwnershipAccount = requireAccount(current.get(attackerOwnership), attackerOwnership, `NPC Fleet ${attacker.address} has no canonical FactionOwnership. Refresh the Fleet faction relationship and retry.`);
-        const npcOwnership = factionOwnershipAccountDefinition.decode(attackerOwnershipAccount);
-        if (npcOwnership.game !== game ||
-            npcOwnership.asset.kind !== 'fleet' ||
-            npcOwnership.asset.fleet !== attacker.address ||
-            npcOwnership.controllingFactionId !== attacker.npcFactionId) {
-            fail(`NPC Fleet ${attacker.address} has no matching canonical FactionOwnership for faction ${String(attacker.npcFactionId)}. Refresh the Fleet and faction ownership relationship before retrying.`, attackerOwnership);
-        }
-        attackerFactionAccount = requireAccount(current.get(attackerFaction), attackerFaction, `Faction ${attackerFaction} is missing for NPC Fleet ${attacker.address}. Refresh the faction registry relationship and retry.`);
-        const npcFaction = factionAccountDefinition.decode(attackerFactionAccount);
-        if (npcFaction.game !== game ||
-            npcFaction.factionId !== attacker.npcFactionId) {
-            fail(`Faction ${attackerFaction} does not match NPC Fleet ${attacker.address}'s Game and faction id. Refresh the faction registry relationship before retrying.`, attackerFaction);
-        }
-        attackerNpc.ownership = attackerOwnership;
-        attackerNpc.factionAccount = attackerFaction;
-    }
     let economicsAccount;
     let treasuryAccount;
     if (factionEconomicsConfig !== undefined && captorTreasury !== undefined) {
@@ -950,33 +937,29 @@ export async function planFleetAttackStarbase(ctx, attacker, target, inputStance
             'King-system target membership and ownership remain unchanged.',
         ],
         [characterAccount, 'The attacking Profile Character remains canonical.'],
-        [
-            regionTrackerAccount,
-            'The configured Game RegionTracker remains canonical.',
-        ],
-        ...(crewBindingAccount === undefined
+        ...(regionAccess
             ? []
             : [
                 [
-                    crewBindingAccount,
-                    'The optional Fleet crew binding remains unchanged.',
+                    regionTrackerAccount,
+                    `Target Star System ${target.name}'s stored Region differs from the Region map at its coordinate, so the whole configured Game RegionTracker remains guarded.`,
                 ],
             ]),
-        ...(attackerOwnershipAccount === undefined
+        ...(crewBindingAccount === undefined
             ? []
             : [
                 [
-                    attackerOwnershipAccount,
-                    'NPC Fleet ownership remains unchanged.',
+                    crewBindingAccount,
+                    'The optional Fleet crew binding remains unchanged.',
                 ],
             ]),
-        ...(attackerFactionAccount === undefined
+        ...(attackerNpc.ownership === undefined
+            ? []
+            : [[attackerNpc.ownership, 'NPC Fleet ownership remains unchanged.']]),
+        ...(attackerNpc.faction === undefined
             ? []
             : [
-                [
-                    attackerFactionAccount,
-                    'The NPC faction account remains unchanged.',
-                ],
+                [attackerNpc.faction, 'The NPC faction account remains unchanged.'],
             ]),
         ...(economicsAccount === undefined
             ? []
@@ -994,12 +977,12 @@ export async function planFleetAttackStarbase(ctx, attacker, target, inputStance
                     'The dynamic-capture treasury remains unchanged.',
                 ],
             ]),
-    ].map(([account, describes]) => precondition(account, describes)));
+    ].map(([account, describes]) => accountStatePrecondition(account, describes)));
     const absencePreconditions = [
-        absentPrecondition(options.loot, `Loot account ${options.loot} remains absent until execution.`),
+        accountAbsentPrecondition(options.loot, `Loot account ${options.loot} remains absent until execution.`),
         ...(crewBindingAccount === undefined
             ? [
-                absentPrecondition(crewBindingAddress, 'Optional Fleet crew binding remains absent.'),
+                accountAbsentPrecondition(crewBindingAddress, 'Optional Fleet crew binding remains absent.'),
             ]
             : []),
     ];
@@ -1011,11 +994,13 @@ export async function planFleetAttackStarbase(ctx, attacker, target, inputStance
         character,
     });
     const description = `Attack with Fleet ${attacker.name} (${attacker.address}) against the shared Starbase at ${target.name} (${target.address}) using ${stance.ammoUsage} ammunition; range, capture-cost debit outcome, randomness, rewards, Loot, damage, and final admissibility remain chain-authoritative.`;
-    return createPlan({
+    return buildPlannerPlan({
         kind: 'combat.attack-starbase',
         preconditions: [
             ...statePreconditions,
+            ...(regionAccess ? [regionAccess] : []),
             ...absencePreconditions,
+            ...rent.guards,
             ...runtime.guards,
         ],
         steps: [
@@ -1023,12 +1008,12 @@ export async function planFleetAttackStarbase(ctx, attacker, target, inputStance
                 describes: `${description} ${runtime.description}`,
                 instruction: adaptAttackStarbaseInstruction({
                     ...runtime.accounts,
-                    ...(attackerNpc.factionAccount === undefined
+                    ...(attackerNpc.faction === undefined
                         ? {}
-                        : { attackerFactionAccount: attackerNpc.factionAccount }),
+                        : { attackerFactionAccount: attackerNpc.faction.address }),
                     ...(attackerNpc.ownership === undefined
                         ? {}
-                        : { attackerFleetOwnership: attackerNpc.ownership }),
+                        : { attackerFleetOwnership: attackerNpc.ownership.address }),
                     authorization: options.authorization,
                     ...(captorTreasury === undefined ? {} : { captorTreasury }),
                     character,
@@ -1046,6 +1031,7 @@ export async function planFleetAttackStarbase(ctx, attacker, target, inputStance
                     loot: options.loot,
                     recentSlothashes: 'SysvarS1otHashes111111111111111111111111111',
                     regionTracker,
+                    ...rent.accounts,
                     rewardConfig: rewardConfigAddress,
                     rewardRegistry: registryAddress,
                     stance: generatedStance(stance),
@@ -1067,11 +1053,11 @@ function lootSnapshotFingerprint(loot) {
         loot.coordinates.x,
         loot.coordinates.y,
         ...loot.items.map((item) => [
-            item.destroyer.address,
+            item.destroyer?.address ?? '',
             item.exclusivityUnlockAtUnixSeconds,
             item.rewardReclaimAtUnixSeconds,
             item.inventory.sequenceId,
-            item.inventory.storageCostRaw,
+            item.inventory.usedStorageUnitsRaw,
             ...item.inventory.items
                 .map(({ cargo, quantityRaw }) => `${String(cargo.id)}:${String(quantityRaw)}`)
                 .sort(),
@@ -1087,11 +1073,11 @@ function rawLootFingerprint(address, loot) {
         loot.coordinates.x,
         loot.coordinates.y,
         ...loot.items.map((item) => [
-            item.destroyer,
+            item.destroyer ?? '',
             item.exclusivityUnlockAtUnixSeconds,
             item.rewardReclaimAtUnixSeconds,
             item.inventory.sequenceId,
-            item.inventory.storageCostRaw,
+            item.inventory.usedStorageUnitsRaw,
             ...item.inventory.amounts
                 .map(({ amount, cargoId }) => `${String(cargoId)}:${String(amount)}`)
                 .sort(),
@@ -1100,10 +1086,12 @@ function rawLootFingerprint(address, loot) {
 }
 /** Plans one transaction-exclusive retrieval from a loaded Loot snapshot.
  *
- * The planner validates the owned idle Fleet, Loot identity, destroyer
- * exclusivity, and every requested known quantity. Range, recent-slot inputs,
- * destination capacity, intervening races, and final acquired quantities
- * remain chain-authoritative.
+ * The planner validates the owned idle Fleet, its normalized crew and usable
+ * ability power at `atUnixSeconds`, Loot identity, destroyer exclusivity and
+ * reward locks against the authorization Profile, and every requested known
+ * quantity. Retrieval spends the Fleet's whole ability power pool. Range,
+ * recent-slot inputs, destination capacity, intervening races, and final
+ * acquired quantities remain chain-authoritative.
  *
  * @example
  * ```ts
@@ -1151,6 +1139,13 @@ export async function planFleetRetrieveLoot(ctx, fleet, loot, inputWant, inputOp
         currentFleet.crewCount !== fleet.crewCount) {
         fail(`Fleet ${fleet.name} (${fleet.address}) changed or no longer matches its canonical Game, owner, label, idle state, or crew. Refresh the Fleet and retry.`, fleet.address);
     }
+    if (currentFleet.crewCount < currentFleet.stats.misc.requiredCrew) {
+        fail(`Fleet ${fleet.name} (${fleet.address}) has ${String(currentFleet.crewCount)} crew but needs ${String(currentFleet.stats.misc.requiredCrew)} to retrieve Loot. Load crew, refresh the Fleet, and retry.`, fleet.address);
+    }
+    if (currentFleet.ap <= 0 ||
+        options.atUnixSeconds < currentFleet.apReloadExpiresAt) {
+        fail(`Fleet ${fleet.name} (${fleet.address}) has no usable ability power at ${String(options.atUnixSeconds)} Unix seconds: stored AP ${String(currentFleet.ap)} with reload completing at ${String(currentFleet.apReloadExpiresAt)}. Retrieving Loot spends the whole AP pool; wait for the reload, refresh the Fleet, and retry.`, fleet.address);
+    }
     const lootAccount = requireAccount(lootAccountValue, loot.address, `Loot ${loot.address} is no longer available. Refresh Loot discovery and choose an available account before retrying.`);
     const currentLoot = lootAccountDefinition.decode(lootAccount);
     if (rawLootFingerprint(lootAccount.address, currentLoot) !==
@@ -1160,28 +1155,33 @@ export async function planFleetRetrieveLoot(ctx, fleet, loot, inputWant, inputOp
     const lootCreator = loot.profile.address === options.authorization.profile
         ? undefined
         : loot.profile.address;
-    const description = `Request ${selection.summary} from Loot ${loot.address} with Fleet ${fleet.name} (${fleet.address}); range, recent-slot randomness, cargo capacity, availability races, and final transfer quantities remain chain-authoritative.`;
-    return createPlan({
+    const instruction = adaptRetrieveLootInstruction({
+        authorization: options.authorization,
+        fleet: fleet.address,
+        game,
+        loot: loot.address,
+        ...(lootCreator === undefined ? {} : { lootCreator }),
+        recentSlothashes: 'SysvarS1otHashes111111111111111111111111111',
+        want: selection.generated.map(([itemIndex, cargo]) => [
+            itemIndex,
+            cargo.map(([cargoId, quantity]) => [cargoId, quantity]),
+        ]),
+    });
+    // Retrieved cargo can open hold lines, which the program funds from the
+    // Profile vault before the emptied Loot refunds its rent.
+    const storage = await planFleetStorage(ctx, instruction, [fleetAccount.address], options.authorization.profile, 'Loot retrieval');
+    const description = `Request ${selection.summary} from Loot ${loot.address} with Fleet ${fleet.name} (${fleet.address}); this spends the Fleet's whole ability power pool. Range, recent-slot randomness, cargo capacity, availability races, and final transfer quantities remain chain-authoritative. ${storage.disclosure}`;
+    return buildPlannerPlan({
         kind: 'combat.retrieve-loot',
         preconditions: [
-            await precondition(fleetAccount, `Fleet ${fleet.name} retains its configured Game, owning Profile, idle state, and normalized crew.`),
-            await precondition(lootAccount, `Loot ${loot.address} retains its identity, creator, destroyer exclusivity, and requested known quantities.`),
+            await accountStatePrecondition(fleetAccount, `Fleet ${fleet.name} retains its configured Game, owning Profile, idle state, and normalized crew.`),
+            await accountStatePrecondition(lootAccount, `Loot ${loot.address} retains its identity, creator, destroyer exclusivity, and requested known quantities.`),
+            storage.guard,
         ],
         steps: [
             {
                 describes: description,
-                instruction: adaptRetrieveLootInstruction({
-                    authorization: options.authorization,
-                    fleet: fleet.address,
-                    game,
-                    loot: loot.address,
-                    ...(lootCreator === undefined ? {} : { lootCreator }),
-                    recentSlothashes: 'SysvarS1otHashes111111111111111111111111111',
-                    want: selection.generated.map(([itemIndex, cargo]) => [
-                        itemIndex,
-                        cargo.map(([cargoId, quantity]) => [cargoId, quantity]),
-                    ]),
-                }),
+                instruction,
                 semantics: [{ kind: 'exclusive', scope: 'transaction' }],
                 signers: [options.authorization.authority],
             },
@@ -1189,4 +1189,16 @@ export async function planFleetRetrieveLoot(ctx, fleet, loot, inputWant, inputOp
         summary: description,
     });
 }
+/** Reads the Profile, Rent and the action's other storage accounts, and plans
+ * its Profile storage funding. */
+async function planFleetStorage(ctx, instruction, addresses, profile, label, stimulantStats) {
+    const all = [...addresses, profile, RENT_ADDRESS];
+    const rows = await readContextRawAccounts(ctx, all);
+    const accounts = new Map(all.map((address, index) => [address, rows[index]]));
+    return planStorageFunding({
+        action: readCombatStorageAction(instruction, accounts, stimulantStats),
+        accounts,
+        label,
+    });
+}
 //# sourceMappingURL=index.js.map