@maka/maka-cli 5.201.0 → 5.203.0

package/bundle/typescript/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@maka/maka-cli",
-  "version": "5.201.0",
+  "version": "5.203.0",
   "type": "module",
   "summary": "A command line tool for scaffolding Meteor 3.x applications using either React.",
   "description": "A command line tool for scaffolding Meteor 3.x applications using React.",

package/bundle/typescript/src/commands/game/sideQuest/commands/compile.js

@@ -1,6 +1,7 @@
 import { Command } from './command.js';
 import { rollPool, formatRoll } from '../utilities/dice.js';
 import { hint } from '../utilities/hints.js';
+import { spriteMatrix } from '../sprite-powers.js';
 import { fuzzyPickName } from '../utilities/fuzzy-match.js';
 /** Exported for game.ts: re-shelling a REGISTERED sprite after travel
  *  or a resumed save needs the same stat builder. */
@@ -161,6 +162,12 @@ export class CompileCommand extends Command {
             // A sprite rides its compiler's persona: same grid, same host.
             if (shell)
                 shell.matrixPosition = actor.matrixPosition;
+            // ...and carries its OWN Matrix array (p.254, p.259), which is what
+            // fills the [Sleaze]/[Attack] bracket on every roll it makes. It
+            // has no deck for the rig lookup to find, so without this its
+            // limits computed to 0 and rollPool refused them as "not a limit".
+            if (shell)
+                shell.spriteMatrixAttrs = spriteMatrix(typeKey, level);
             if (shell && this.game) {
                 const entry = this.game.companions.find(c => c.npc === shell);
                 if (entry)

package/bundle/typescript/src/commands/game/sideQuest/commands/erase-mark.js

@@ -13,6 +13,17 @@ export class EraseMarkCommand extends Command {
     static verb = 'unmark';
     static description = 'Erase Mark (Complex Action, SR5 p.239): "unmark me" scrubs the marks others hold on your persona; "unmark <icon>" needs three marks on that icon first. Computer + Logic [Attack] v. Willpower + Firewall. An Attack action -- GOD counts it. Also "erase mark on <icon>".';
     static npcPolicy = 'authorized';
+    /**
+     * A PLACER'S NAME STARTING A SENTENCE. `hostLabel` yields "the Approach
+     * host", lowercase and correct mid-clause -- and these lines open with
+     * it, so a bench read "the Approach host's key sloughs off...". The
+     * same class of blemish grid-names.ts records at length: cosmetic, and
+     * not harmless on a repro bench, where a reviewer meeting broken prose
+     * reasonably starts doubting the fixture.
+     */
+    static opening(name) {
+        return name.charAt(0).toUpperCase() + name.slice(1);
+    }
     /** p.239: two marks at -4, three at -10; one is unpenalised. */
     static penaltyFor(count) {
         if (count >= 3)
@@ -180,7 +191,7 @@ export class EraseMarkCommand extends Command {
         if (attempt.hits <= resist.hits) {
             this.logger.write(`${actor.name} failed Erase Mark on ${label} (${chosen.name}): ${attempt.hits} v ${resist.hits}.`);
             return [
-                `The key holds. ${chosen.name}'s mark is still written into ${label} and your scrub slides off it.`,
+                `The key holds. ${EraseMarkCommand.opening(chosen.name)}'s mark is still written into ${label} and your scrub slides off it.`,
                 hint(` (A Complex Action each try${take > 1 ? `; going for ${take} at once cost you ${penalty} dice` : ''}.)`),
                 ...(god.length > 0 ? [`\n${god.join('\n')}`] : []),
             ].join('');
@@ -192,7 +203,7 @@ export class EraseMarkCommand extends Command {
         this.logger.write(`${actor.name} erased ${take} of ${chosen.name}'s mark(s) on ${label}: ${attempt.hits} v ${resist.hits}.`);
         const left = this.remainingOn(target, actor);
         return [
-            `{light-blue-fg}${chosen.name}'s ${take > 1 ? `${take} keys slough` : 'key sloughs'} off ${label} -- the recognition pattern unwrites itself and ${target.kind === 'self' ? 'your icon stops answering to it' : 'the icon forgets it ever agreed'}.{/light-blue-fg}`,
+            `{light-blue-fg}${EraseMarkCommand.opening(chosen.name)}'s ${take > 1 ? `${take} keys slough` : 'key sloughs'} off ${label} -- the recognition pattern unwrites itself and ${target.kind === 'self' ? 'your icon stops answering to it' : 'the icon forgets it ever agreed'}.{/light-blue-fg}`,
             target.kind === 'self'
                 ? (left > 0
                     ? `\n${left} mark${left === 1 ? '' : 's'} still on you.`

package/bundle/typescript/src/commands/game/sideQuest/commands/order.js

@@ -265,6 +265,16 @@ export class OrderCommand extends Command {
     // Result strings that mean the atomic tier bounced -- collected from
     // real refusals (go/attack/talk/take across sessions). The ’ variant
     // covers commands that answer with a smart quote.
-    static ATOMIC_REFUSAL = /not a way to go|can['’]t go that way|isn['’]t here|don['’]t see|there is no item|too heavy|doesn['’]t know how|not valid|doesn['’]t seem to have/i;
+    //
+    // THE MATRIX REFUSALS WERE MISSING, and a repro bench found it the day
+    // sprites started being billed at all (wjFBY3zgyWzJP9adw). Order a
+    // sprite at a maglock slaved to a host you hold no mark on and `hack`
+    // answers "a host's devices answer nobody who holds no mark on the
+    // host itself" -- a refusal, nothing rolled, nothing changed. It
+    // matched none of the phrases below, so the atomic tier read it as
+    // obedience and charged a task for it. Free before this only because
+    // no sprite was ever charged for anything; a spirit ordered into the
+    // same wall has always paid a service for nothing.
+    static ATOMIC_REFUSAL = /not a way to go|can['’]t go that way|isn['’]t here|don['’]t see|there is no item|too heavy|doesn['’]t know how|not valid|doesn['’]t seem to have|answer nobody who holds no mark|no cyberdeck|needs a MARK|hold none on|is not here to|nothing here answers to|finds no persona|finds no device/i;
 }
 //# sourceMappingURL=order.js.map

package/bundle/typescript/src/commands/game/sideQuest/engine-version.js

@@ -715,5 +715,52 @@
 //     somebody happened to look -- the "wrong ability on a sprite is
 //     worse than a missing one" case. It wants the glitch contract in one
 //     place first, and that is its own piece of work.
-export const ENGINE_VERSION = '1.63.0';
+// 1.64.0 (2026-09-15): NPC KITS -- "everyone is basically naked."
+//   - NEW CATALOG KIND 'npc-kit' (v21): SR5 p.379-385's Professional
+//     Rating tiers 0-6 as rows, each the book's own statblock AND gear
+//     (npc-kits.ts reads them; catalog.ts npcKitFor). Before this every
+//     NPC was an attribute block: no armor (soak on Body alone), no
+//     weapon (bare fists, always melee).
+//   - SEED SHAPE: ISceneSeedJson.securityTier (the SITE's PR, never the
+//     campaign job number), IPlayerSeedJson.kit / lieutenant. The
+//     generator declares the tier from a closed 0-6 table, clamps it
+//     against the job number, and assigns a kit to every hostile
+//     deterministically -- the model never writes a slug.
+//   - THE PARTY NUDGE IS THE LIEUTENANT (p.380-381): a party that
+//     outguns the tier draws the printed lieutenant, and the group's PR
+//     and Group Edge read one higher. Never a kit from a tier above.
+//   - GROUP EDGE (p.380) on the CombatEncounter keyed by kit; MORALE
+//     (p.379-380) breaks a team to surrender at the book's casualty
+//     thresholds, PR 5-6 never. npc-combat-brain.ts is the gamemaster.
+//   - EPHEMERALS: gangers are the PR 1 kit, sweep officers the PR 3
+//     kit with a real Biometric Reader; bystanders stay unarmed.
+//     Scene.removeActor(name, {spill:false}) so a departing body takes
+//     its gun with it.
+//   - LOOT: worn armor is RUINED on a kill (Item.ruined -- rated 0,
+//     worth nothing, saved); guns and commlinks drop intact.
+//   - PURGED: the dead `firearms` skill key from the NPC prompt, the
+//     ganger constant and the seed doc; a seed still carrying it maps
+//     onto pistols/automatics/longarms at the boundary.
+// 1.65.0 (2026-09-16): THREE THINGS THE FIRST SPRITE BENCH FOUND. The
+//   repro bench for wjFBY3zgyWzJP9adw made an ordered sprite's dice
+//   visible for the first time, and visible dice are readable dice.
+//   - A SPRITE'S MATRIX ARRAY IS ITS OWN (p.254, p.259). It carries no
+//     deck, so baseMatrixAttribute's rig lookup returned 0 and every
+//     bracketed sprite roll computed a limit of zero -- which rollPool
+//     refuses as "not a limit" and said so, out loud, in the
+//     transcript. commands/compile.ts now stamps the book's per-type
+//     table (sprite-powers.spriteMatrix) onto the shell, so [Sleaze],
+//     [Attack] and [Data Processing] finally have numbers in them.
+//     Only Resonance equals Level; the four attributes do not.
+//   - A REFUSED ORDER MUST NOT COST A TASK. order.ts decides the atomic
+//     tier bounced by matching the result against a phrase list, and
+//     the Matrix refusals were never in it -- so a sprite ordered at a
+//     maglock slaved to a host it holds no mark on was told no AND
+//     charged for it. Free before only because sprites were charged for
+//     nothing; a spirit walked into the same wall and paid a service.
+//   - Erase Mark opened two lines with a host's lowercase label ("the
+//     Approach host's key sloughs off..."). Cosmetic, and the same
+//     class of blemish grid-names.ts records at length, because a
+//     reviewer meeting broken prose on a bench doubts the fixture.
+export const ENGINE_VERSION = '1.65.0';
 //# sourceMappingURL=engine-version.js.map

package/bundle/typescript/src/commands/game/sideQuest/factories/npc-factory.js

@@ -28,6 +28,15 @@ export class NPCFactory {
             npc.setAuthoredAppearance(json.appearance);
         return npc;
     }
+    /**
+     * ONLY FOUR FIELDS CROSS HERE, on purpose. `startSpot`, `guarding`,
+     * `hostile`, `kit` and `lieutenant` are applied by scene-factory AFTER
+     * the NPC is placed (Steps 3 and 4.04), because each depends on
+     * something the constructor cannot see -- the room it stands in, the
+     * items heldBy already put in its hands. Adding one of them to this
+     * config would silently reorder it ahead of that. (`startingItems` is
+     * dropped too, and documented as ignored for NPCs in repro-scene.ts.)
+     */
     convertPlayerSeedToConstructorConfig(seed) {
         if (!seed.name) {
             throw new Error(`Cannot create NPC without a name`);
@@ -40,8 +49,35 @@ export class NPCFactory {
             playerName: seed.name,
             lifestyleChoices: seed.lifestyleChoices,
             startLocation,
-            combat: seed.combat
+            combat: seed.combat ? { ...seed.combat, skills: splitLegacySkills(seed.combat.skills) } : undefined,
         };
     }
 }
+/**
+ * A SEED STILL SPEAKING THE OLD SKILL NAMES (skills.ts, stage 3): the
+ * same group-purchase reading persistence.ts applies to saves -- a
+ * condensed `firearms: N` meant "good with guns, all of them", so it
+ * lands as Pistols, Automatics and Longarms at N (p.88) where none was
+ * set; `athletics: N` lands as Gymnastics, Running and Swimming. The
+ * retired keys are dropped so they cannot ride into `Player.skills` as
+ * dead entries. Mapped, never merely deleted: a "sharpshooter" the
+ * model wrote with the old key was a sharpshooter, not a nobody.
+ */
+export function splitLegacySkills(skills) {
+    if (!skills)
+        return undefined;
+    const out = { ...skills };
+    const spread = (legacy, onto) => {
+        const n = out[legacy];
+        if (n === undefined)
+            return;
+        if (n > 0)
+            for (const key of onto)
+                out[key] ??= n;
+        delete out[legacy];
+    };
+    spread('firearms', ['pistols', 'automatics', 'longarms']);
+    spread('athletics', ['gymnastics', 'running', 'swimming']);
+    return out;
+}
 //# sourceMappingURL=npc-factory.js.map

package/bundle/typescript/src/commands/game/sideQuest/factories/scene-chunks.js

@@ -4,6 +4,7 @@ import { Logger } from '../utilities/logger.js';
 import { catalogAugmentations } from '../utilities/catalog.js';
 import { isOutdoorsPlace } from '../utilities/outdoors.js';
 import { clampDeviceKind } from '../utilities/affordances.js';
+import { clampSecurityTier, expectedStrengthFor, kitSlugForTier, maxSecurityTierFor, partyDrawsLieutenant } from '../npc-kits.js';
 /**
  * CHUNKED scene generation (see SceneSeedGenerator.generate for the
  * pipeline that drives this module). One monolithic whole-scene completion
@@ -195,6 +196,73 @@ function repairNote(previousError) {
 export function partyHeadcount(crew) {
     return (crew?.length ?? 0) + 1;
 }
+/**
+ * HOW HARD THIS TABLE HITS, per head, on the scale npc-kits.ts
+ * expectedStrengthFor uses for a grunt (attack pool + defense pool).
+ *
+ * REUSES THE NUMBERS THAT ALREADY EXIST rather than inventing a third
+ * formula: the leader's figure is exactly the "Combat calibration"
+ * line buildPlayerDossier prints (getAttackPool + getDefensePool), and
+ * a crew member's is the body + agility + logic + magic sum the hiring
+ * price already reads (Game.spawnCrew's asking cut), scaled onto the
+ * same axis. Averaged per head, because the lieutenant question is
+ * "does this party outclass the tier", not "how many of them are there"
+ * -- head count already scales the OPPOSITION COUNT (Scope, above).
+ *
+ * A dossier player that is not a real Player (the tests' stubs, a
+ * server-side draft with no engine handle) contributes nothing and the
+ * crew alone decides; no player and no crew is 0, which never draws a
+ * lieutenant.
+ */
+export function partyStrength(player, crew) {
+    const heads = [];
+    const p = player;
+    if (p && typeof p.getAttackPool === 'function' && typeof p.getDefensePool === 'function') {
+        heads.push(p.getAttackPool() + p.getDefensePool());
+    }
+    for (const m of crew ?? []) {
+        const c = m.combat;
+        heads.push(1.5 * ((c.body ?? 3) + (c.agility ?? 3) + (c.logic ?? 3) + (c.magic ?? 0)));
+    }
+    if (heads.length === 0)
+        return 0;
+    return heads.reduce((s, h) => s + h, 0) / heads.length;
+}
+/**
+ * SETTLE WHO GUARDS THIS PLACE (npc-kits.ts, SR5 p.379-385). Called once
+ * per accepted skeleton, after validateSkeleton and before the detail
+ * passes: clamps the declared securityTier against the campaign job
+ * number (a job #1 does not draw elite corporate security however the
+ * model felt about it), and decides whether the site posts its
+ * lieutenant -- p.380-381's own mechanism for a tougher group, and the
+ * whole of how opposition scales to a strong party. The lieutenant is
+ * the hostile guarding the prize's room if there is one, else the first
+ * hostile. Returns the notes for the generation log.
+ */
+export function settleSecurity(skeleton, campaignTier, player, crew) {
+    const notes = [];
+    const declared = skeleton.securityTier;
+    const settled = clampSecurityTier(declared, campaignTier);
+    if (declared !== settled) {
+        notes.push(`securityTier ${declared === undefined ? 'absent' : JSON.stringify(declared)} -> ${settled} (job #${campaignTier} fields at most PR ${maxSecurityTierFor(campaignTier)}).`);
+    }
+    skeleton.securityTier = settled;
+    const hostiles = skeleton.npcs.filter(n => n.name !== skeleton.client && n.hostile === true);
+    if (hostiles.length === 0) {
+        delete skeleton.lieutenant;
+        return notes;
+    }
+    const strength = partyStrength(player, crew);
+    if (!partyDrawsLieutenant(strength, settled)) {
+        delete skeleton.lieutenant;
+        return notes;
+    }
+    const prizeRoom = skeleton.items.find(i => i.name === skeleton.winCondition?.item)?.room;
+    const pick = hostiles.find(n => prizeRoom !== undefined && n.startLocation === prizeRoom) ?? hostiles[0];
+    skeleton.lieutenant = pick.name;
+    notes.push(`party strength ${strength.toFixed(1)} outguns PR ${settled} (expects ~${expectedStrengthFor(settled)}) -- ${pick.name} is the lieutenant.`);
+    return notes;
+}
 function buildTeamBlock(crew) {
     if (!crew || crew.length === 0)
         return '';
@@ -478,7 +546,19 @@ ${JSON_ONLY}
                        // again more per job after that
     "rewardItem"?: string // optional bonus: an items[].name with role "reward"
   },
-  "client": string // the npcs[].name of the run's CLIENT -- see CLIENT below
+  "client": string, // the npcs[].name of the run's CLIENT -- see CLIENT below
+  "securityTier": 0|1|2|3|4|5|6 // WHO GUARDS THIS PLACE. Pick from the SITE, not the payout,
+                                // and use EXACTLY one of these integers:
+                                //   0 street thugs, squatters, a mall cop
+                                //   1 a gang's block, street scum holding a corner
+                                //   2 corporate security at an ordinary office or warehouse
+                                //   3 a police patrol, a licensed private force
+                                //   4 an organized-crime crew on its own ground
+                                //   5 elite corporate security -- a real corp facility
+                                //   6 elite special forces -- military; needs a real reason
+                                // Every "hostile" npc is armed and armored by the engine
+                                // from this tier's statblock; you write WHO they are, the
+                                // engine writes WHAT they carry.
 }
 
 CLIENT: every run has a CLIENT -- "a Mr. Johnson", the employer's deniable face, the person
@@ -646,17 +726,22 @@ For EVERY npc in the skeleton, expand its "concept":
   will refuse it and the player will burn a run trusting it. An NPC may say that a code
   EXISTS, who holds it, or where it's written down -- never what it is. The engine hands
   the real pass to whoever genuinely holds it, at runtime (see npc.ts).
-- "combat": OPTIONAL attribute block -- omit for anyone who'd never fight. Each attribute
-  1-8 (soft civilian 1-2, street-level 3-4, hardened enforcer 5-6, elite 7-8):
+- "combat": OPTIONAL attribute block -- omit for anyone who'd never fight, and OMIT IT FOR
+  EVERY HOSTILE: the engine outfits opposition from the site's security tier (the book's
+  own Professional Rating statblocks, gear included), and a "combat" block on a hostile is
+  ignored. Write one only for a NON-hostile who might still end up in a fight (a bodyguard
+  who is not security, a bartender with a shotgun). Each attribute 1-8 (soft civilian 1-2,
+  street-level 3-4, hardened enforcer 5-6, elite 7-8):
   { "body", "agility", "reaction", "combatSkill", "strength"?, "willpower"?, "logic"?,
     "intuition"?, "charisma"?, "magic"?, "resonance"?, "adept"?,
-    "skills"?: { "firearms"?, "blades"?, "clubs"?, "unarmed"?, "sneaking"?, "perception"?, "palming"?,
-                 "hacking"?, "cybercombat"?, "electronic-warfare"?, "hardware"?, "locksmith"?, "computer"?,
-                 "negotiation"?, "con"?, "intimidation"?, "etiquette"?, "leadership"?, "performance"?, "disguise"?,
-                 "medicine"?, "assensing"?, "counterspelling"?, "conjuring"?, "gunnery"? } }
-  "magic" 3-6 ONLY for a genuinely Awakened concept; give combat blocks to anyone the story
-  expects in a firefight. "skills" is
-  optional flavor for defined concepts (a sharpshooter's "firearms": 6).
+    "skills"?: { "pistols"?, "automatics"?, "longarms"?, "blades"?, "clubs"?, "unarmed"?, "sneaking"?,
+                 "perception"?, "palming"?, "hacking"?, "cybercombat"?, "electronic-warfare"?, "hardware"?,
+                 "locksmith"?, "computer"?, "negotiation"?, "con"?, "intimidation"?, "etiquette"?,
+                 "leadership"?, "performance"?, "disguise"?, "medicine"?, "assensing"?, "counterspelling"?,
+                 "conjuring"?, "gunnery"? } }
+  "magic" 3-6 ONLY for a genuinely Awakened concept. "skills" is optional flavor for defined
+  concepts (a sharpshooter's "longarms": 6). There is no generic gun skill: guns are "pistols",
+  "automatics" (SMGs, machine pistols, assault rifles) or "longarms" (rifles, shotguns).
 
 ${JSON_ONLY}
 [ { "name": string, "description": string, "dialogue": string[], "combat"?: { ... } } ]
@@ -2605,9 +2690,11 @@ export function assembleScene(skeleton, details, playerName) {
     // from the exit they hold, so moving one would leave `guarding: true`
     // with nothing behind it. See factories/npc-spread.ts.
     const spreadStations = spreadStationedNpcs(npcStation, new Map(rooms.map(r => [r.name, (r.spots ?? []).map(s => s.name)])), name => guardPost.has(name));
+    const tierKit = skeleton.securityTier === undefined ? undefined : kitSlugForTier(skeleton.securityTier);
     const npcs = skeleton.npcs.map(npc => {
         const detail = npcDetail.get(npc.name);
         const station = spreadStations.get(npc.name);
+        const kit = npc.hostile === true && npc.name !== skeleton.client ? tierKit : undefined;
         const roomSpots = (rooms.find(r => r.name === npc.startLocation)?.spots ?? []);
         const startSpot = station && station.room === npc.startLocation && roomSpots.some(s => s.name === station.spot)
             ? station.spot
@@ -2630,8 +2717,18 @@ export function assembleScene(skeleton, details, playerName) {
                 // other would put the flag on every checkpoint clerk in the
                 // game, which is the failure this feature is built to avoid.
                 hostile: npc.hostile === true || undefined,
+                // WHAT THEY CARRY (npc-kits.ts, catalog v21): every hostile is
+                // outfitted from the site's security tier, deterministically --
+                // the model never writes a kit slug, because a slug it invented
+                // is a whole failure class (itemFromCatalog throws on one) and
+                // the tier is the one number it was asked for. THE KIT IS THE
+                // STATLINE: a `combat` block the model wrote for a guard is
+                // dropped here, not merged, so a dead key cannot ride in beside
+                // the book's numbers. Non-hostiles keep theirs.
+                ...(kit ? { kit } : {}),
+                ...(kit && skeleton.lieutenant === npc.name ? { lieutenant: true } : {}),
                 lifestyleChoices: [],
-                combat: detail?.combat,
+                combat: kit ? undefined : detail?.combat,
             },
         };
     });
@@ -2772,6 +2869,7 @@ export function assembleScene(skeleton, details, playerName) {
             completionMessage: skeleton.completionMessage,
         },
         client: skeleton.client,
+        ...(skeleton.securityTier !== undefined ? { securityTier: skeleton.securityTier } : {}),
     };
 }
 /**

package/bundle/typescript/src/commands/game/sideQuest/factories/scene-factory.js

@@ -14,6 +14,7 @@ import { migrateLegacySeed } from './seed-migration.js';
 import { Device } from '../models/device.js';
 import { fuzzyPickName } from '../utilities/fuzzy-match.js';
 import { adoptSeededIce } from '../utilities/ic-actors.js';
+import { NPC_EQUIP_CATEGORIES, outfitNpcBySlug } from '../npc-kits.js';
 /**
  * How many AI enrichment calls may be in flight at once.
  *
@@ -512,27 +513,58 @@ Key Locations: ${json.rooms.map(r => r.name).join(', ')}
                 logger.error(`Scene "${json.name}": the door ${String(direction)} of ${room.name} was locked by "${wanted ?? '(nothing)'}", which no device holds and no item matches -- it ships unlocked rather than as a wall.`);
             }
         }
+        // Step 4.04: NPCs get their kit (npc-kits.ts, SR5 p.379-385, catalog
+        // v21). AFTER "heldBy" has landed (Step 4.5 above -- the numbering is
+        // historical, the source order is what runs) and BEFORE the equip
+        // step below, on purpose: an author who put a weapon in this NPC's
+        // hands with heldBy is the author speaking, and the kit yields its
+        // own weapon to it (respectCarried) while its armor still layers.
+        // The seed's `kit` is applied here rather than in npc-factory for
+        // the same reason startSpot/guarding/hostile are applied at Step 3
+        // instead of the constructor: the factory drops every field but four,
+        // and the ordering guarantee above only holds in THIS loop.
+        for (const npcJson of json.npcs ?? []) {
+            if (!npcJson.player.kit)
+                continue;
+            const npc = scene.getActor(npcJson.player.name);
+            if (!npc)
+                continue;
+            outfitNpcBySlug(npc, npcJson.player.kit, {
+                lieutenant: npcJson.player.lieutenant === true,
+                respectCarried: true,
+            });
+        }
         // Step 4.05: NPCs wear their gear. "heldBy" only puts items in an NPC's
         // inventory, but combat pools (see Player.getWeaponProfile /
         // getArmorValue) read from EQUIPPED slots -- without this, an enforcer
         // "holding" an assault rifle and an armored jacket would fight
         // bare-fisted in street clothes. Only weapon/armor categories are
-        // auto-equipped: plot items (datachips, books, keys) stay in inventory
-        // where "give"/death-drops expect them. Failures are non-fatal -- a
-        // second weapon just stays holstered in inventory.
-        const combatCategories = new Set([
-            Category.Weapon, Category.MeleeWeapon, Category.RangedWeapon,
-            Category.Armor, Category.BodyArmor, Category.ArmorClothing, Category.Shield,
-            Category.Helmet, Category.ArmArmor, Category.LegArmor, Category.Boots, Category.Gloves,
-        ]);
+        // auto-equipped (NPC_EQUIP_CATEGORIES -- the one list, shared with the
+        // ephemeral governor): plot items (datachips, books, keys) stay in
+        // inventory where "give"/death-drops expect them. Failures are
+        // non-fatal -- a second weapon just stays holstered in inventory.
+        //
+        // FIRST WEAPON WINS (2026-09-15, the day kits gave every guard two).
+        // `equip` SWAPS, so the unguarded loop this used to be would have
+        // ended every PR 1 ganger holding the knife with the Browning
+        // holstered -- the exact bug archetypes.ts:outfitArchetype documents
+        // for runners. It never fired here only because no seeded NPC ever
+        // carried two weapons. Armor still layers, so only weapons are
+        // guarded.
+        const weaponCategories = new Set([Category.Weapon, Category.MeleeWeapon, Category.RangedWeapon]);
         for (const npcJson of json.npcs ?? []) {
             const npc = scene.getActor(npcJson.player.name);
             if (!npc)
                 continue;
             for (const item of [...npc.inventory.getAllItems()]) {
-                if (combatCategories.has(item.category)) {
+                if (!NPC_EQUIP_CATEGORIES.has(item.category))
+                    continue;
+                if (weaponCategories.has(item.category) && npc.getCarriedWeapon())
+                    continue;
+                try {
                     npc.equip(item);
                 }
+                catch { /* nothing to slot it into -- stays holstered */ }
             }
         }
         // Step 4.1: Add Starting Items for the Player (skipped when continuing

package/bundle/typescript/src/commands/game/sideQuest/factories/scene-seed-generator.js

@@ -9,7 +9,7 @@ import { GenerationCapture } from '../utilities/generation-capture.js';
 import { fetchCanonContext } from '../utilities/canon-lore.js';
 import { providerUnavailable } from '../utilities/draft-failure-note.js';
 import { SceneSynthesizer } from './scene-factory.js';
-import { buildSkeletonPrompt, buildRoomsPrompt, buildNpcsPrompt, buildDevicesPrompt, buildItemsPrompt, pickRunType, parseJsonReply, validateSkeleton, normalizeSkeleton, assembleScene, classifyRepair, CHUNK_SCHEMAS, unwrapChunk, VAULT_HOST_RATING, } from './scene-chunks.js';
+import { buildSkeletonPrompt, buildRoomsPrompt, buildNpcsPrompt, buildDevicesPrompt, buildItemsPrompt, pickRunType, parseJsonReply, validateSkeleton, normalizeSkeleton, settleSecurity, assembleScene, classifyRepair, CHUNK_SCHEMAS, unwrapChunk, VAULT_HOST_RATING, } from './scene-chunks.js';
 // The fixer name convention and the player dossier live with the prompt
 // builders now (see scene-chunks.ts); re-exported so the existing
 // import sites (call.ts, game.ts) keep working unchanged.
@@ -241,6 +241,15 @@ export class SceneSeedGenerator {
                 // for a scaled opposition, and this is what makes the aim
                 // stick when the model quietly ignores it.
                 validateSkeleton(skeleton, player, crew);
+                // WHO GUARDS THIS PLACE (npc-kits.ts): clamp the declared tier
+                // against the job number and post the lieutenant if this table
+                // outguns it. After validation, so a rejected skeleton never
+                // has its security settled; before the detail passes, so the
+                // NPC prompt can be told which entries the kit will dress.
+                for (const note of settleSecurity(skeleton, tier, player, crew)) {
+                    notes.push(note);
+                    logger.write(`SceneSeedGenerator: ${note}`);
+                }
                 GenerationCapture.record({
                     stage: 'skeleton', outcome: 'accepted', pipeline, attempt,
                     prompt, reply, notes,

package/bundle/typescript/src/commands/game/sideQuest/game.js

@@ -1759,7 +1759,11 @@ export default class Game {
             name: `${item.name} (autopilot)`,
             description: `${this.player.name}'s drone running its dog-brain autopilot: it follows them, watches, and ${armed ? 'shoots what threatens them' : 'has cameras where guns would go -- it never attacks'}.`,
             kind: 'drone',
-            combat: { body: item.droneBody, agility: pilot, reaction: pilot, logic: pilot, intuition: pilot, willpower: pilot, strength: 1, charisma: 1, skills: { perception: pilot, ...(armed ? { firearms: pilot } : {}) } },
+            // `firearms` is not a skill (skills.ts, stage 3) and this shell
+            // carried it as a dead key until 2026-09-15: an armed drone rolls
+            // Gunnery (p.131, and what getAttackPool reads for a jumped-in
+            // frame) and, for a mounted gun's own skill, the split three.
+            combat: { body: item.droneBody, agility: pilot, reaction: pilot, logic: pilot, intuition: pilot, willpower: pilot, strength: 1, charisma: 1, skills: { perception: pilot, ...(armed ? { gunnery: pilot, automatics: pilot, pistols: pilot, longarms: pilot } : {}) } },
             room, plane: 'meat', force: pilot, boundDevice: item,
         });
         // Take-command weight checks (Player.addInventory) enforce this cap

package/bundle/typescript/src/commands/game/sideQuest/models/item.js

@@ -49,6 +49,21 @@ export class Item extends AbstractItem {
     // work (rest.ts). A reboot does NOT clear it; that is the whole
     // difference from `jammed`.
     bricked = false;
+    /**
+     * RUINED (Room.layOutBody, catalog v21 NPC kits): armor that soaked
+     * the rounds that killed its wearer. Rated 0 (armorValue, armorBonus)
+     * and worth nothing (commerce.ts priceOf); it drops, so the runner
+     * sees what the guard was wearing, and it is not a free set of full
+     * body armor -- the plates are what stopped the rounds. Saved.
+     */
+    ruined = false;
+    /** Mark this piece ruined, and say so on it. Idempotent. */
+    ruin(how) {
+        if (this.ruined)
+            return;
+        this.ruined = true;
+        this.description = `${this.description} RUINED -- ${how}.`;
+    }
     /**
      * SPRITE POWERS ON A FILE (SR5 p.256-257,
      * utilities/sprite-power-actions.ts). Matrix-plane items only; all
@@ -581,6 +596,8 @@ export class Item extends AbstractItem {
      * clothing 0. Only the highest worn piece counts (Player.armorBreakdown).
      */
     get armorValue() {
+        if (this.ruined)
+            return 0;
         const w = this.row?.wearable;
         if (w?.armor !== undefined)
             return w.armor;
@@ -598,6 +615,8 @@ export class Item extends AbstractItem {
     }
     /** A "+" accessory's bonus (helmet +2, shield +6, p.437-438): the row's, else the class value. */
     get armorBonus() {
+        if (this.ruined)
+            return 0;
         const w = this.row?.wearable;
         if (w?.armorBonus !== undefined)
             return w.armorBonus;

package/bundle/typescript/src/commands/game/sideQuest/models/npc.js

@@ -705,6 +705,18 @@ export class NPC extends Player {
      * "nobody in particular", which every rule reads as no opinion.
      */
     faction;
+    /**
+     * WHAT THIS GRUNT CARRIES AND HOW TRAINED THEY ARE (npc-kits.ts, SR5
+     * p.379-385): the kit row's slug, its Professional Rating, and
+     * whether this one is the team's lieutenant (p.380-381). Set by
+     * outfitNpcKit and read by the Combat Turn for Group Edge and morale.
+     * Absent on every NPC built from an attribute block alone, which is
+     * every NPC there was before catalog v21. Session state, never saved:
+     * a seeded NPC is re-outfitted from its seed on every synthesis.
+     */
+    kit;
+    professionalRating;
+    lieutenant;
     /**
      * SET ONLY BY THE EPHEMERAL GOVERNOR (utilities/ephemeral.ts): this
      * body is a passing face, not a character. Its presence trims the

package/bundle/typescript/src/commands/game/sideQuest/models/player.js

@@ -630,6 +630,14 @@ export class Player extends AbstractPlayer {
      * long as the sprite.
      */
     cookiedBy = new Map();
+    /**
+     * A SPRITE'S FOUR MATRIX ATTRIBUTES (SR5 p.254, p.259), stamped on the
+     * shell by commands/compile.ts. A sprite carries no deck, so without
+     * this every bracketed sprite roll computed a limit of 0 -- which
+     * rollPool rightly refuses as "not a limit" rather than honouring.
+     * Only Resonance equals Level; the four attributes are per TYPE.
+     */
+    spriteMatrixAttrs;
     /**
      * DIAGNOSTICS (p.257): the Teamwork bonus a machine sprite is holding
      * on ONE device -- "it takes the sprite's entire attention", so there
@@ -907,6 +915,16 @@ export class Player extends AbstractPlayer {
     baseMatrixAttribute(kind) {
         if (this.icHost)
             return this.icHost.attributes()[kind];
+        // A SPRITE'S ARRAY IS ITS OWN (SR5 p.254, p.259). It has no deck, so
+        // the rig lookup below returned 0 -- and a 0 reaching rollPool is
+        // refused as "not a limit", which is exactly what a repro bench
+        // caught the day an ordered sprite's dice first became visible
+        // (wjFBY3zgyWzJP9adw): the roll happened, unlimited, and said so.
+        // Set on the shell at compile time from sprite-powers.spriteMatrix,
+        // which carries the book's per-type table; only Resonance equals
+        // Level, the four attributes do not.
+        if (this.spriteMatrixAttrs)
+            return this.spriteMatrixAttrs[kind];
         if (this.isTechnomancer()) {
             switch (kind) {
                 case 'attack': return this.charisma;

package/bundle/typescript/src/commands/game/sideQuest/models/room.js

@@ -124,9 +124,18 @@ export class Room extends AbstractRoom {
                 for (const [slot, item] of Object.entries(group)) {
                     if (!item)
                         continue;
-                    held.addItem(item);
+                    const piece = item;
+                    // WORN ARMOR COMES OFF RUINED (2026-09-15, with the NPC kits
+                    // that put real armor on guards): the jacket stopped the rounds
+                    // that killed the wearer, and that is what a jacket is for.
+                    // Guns and commlinks drop intact -- a PR 5 kill is still the
+                    // Ares Alpha, it is just not a free set of full body armor.
+                    if (piece.armorValue > 0 || piece.armorBonus > 0) {
+                        piece.ruin(`it took the rounds that dropped ${actor.name}`);
+                    }
+                    held.addItem(piece);
                     group[slot] = null;
-                    this.logger.write(`${actor.name}'s ${slot} falls with the body in ${this.name}.`);
+                    this.logger.write(`${actor.name}'s ${slot} falls with the body in ${this.name}${piece.ruined ? ' (ruined)' : ''}.`);
                 }
             }
         }