@maka/maka-cli 5.63.1 → 5.65.0

package/bundle/typescript/src/commands/game/sideQuest/factories/scene-chunks.js

@@ -1,4 +1,5 @@
 import { SKILL_NAMES } from '../models/player.js';
+import { Logger } from '../utilities/logger.js';
 import { AUGMENTATIONS } from '../augmentations.js';
 import { isOutdoorsPlace } from '../utilities/outdoors.js';
 /**
@@ -44,32 +45,26 @@ export function isFixerName(name) {
  * Returns '' when no player is available.
  */
 /**
- * SPELL OUT THE CLUE RULE, IN THIS RUNNER'S TERMS. The dossier already
- * hints at it in prose ("con"-bypass barriers for a talker), and the
- * model still missed it: the single most common generation failure on
- * record is a barrier this runner can't open with no clue written for
- * it. It's character-dependent, which is what made it look like random
- * flakiness -- a Face satisfies exactly ONE of the four bypass types, so
- * three quarters of the barriers the model naturally reaches for demand
- * a clue item, and it keeps forgetting.
+ * THE ONE BARRIER RULE THAT STILL DEPENDS ON WHO IS PLAYING.
  *
- * So state it mechanically instead of hinting: name the types they can
- * and can't do, and name the consequence. normalizeSkeleton repairs this
- * anyway -- this is the half that stops the fault being authored at all.
+ * This used to name all three barrier types the runner could and could
+ * not force, and demand a clue for each one they could not -- the
+ * single most common generation failure on record, and one that looked
+ * like random flakiness precisely because it varied with the character.
+ *
+ * It shrank to this because the clue/key rule became UNCONDITIONAL for
+ * panels and locks (see partyCanDispel): a code is findable and a key
+ * is placeable, so both are openable by ANY runner and there is nothing
+ * character-dependent left to state. A ward is the exception that
+ * cannot be written away -- no clue rescues it for a mundane team -- so
+ * it is the only thing this still says.
  */
-export function bypassBrief(player) {
-    const ALL = ['lockpick', 'hack', 'spell', 'con'];
-    const can = ALL.filter(t => canBypassUnaided(player, t));
-    const cannot = ALL.filter(t => !can.includes(t));
-    const canText = can.length > 0
-        ? `Unaided, this runner can only get past a barrier by: ${can.join(', ')}.`
-        : `Unaided, this runner cannot force ANY barrier type on their own.`;
-    const cannotText = cannot.length > 0 ? ` They CANNOT ${cannot.join(', ')}.` : '';
-    return `- BARRIER RULE, MECHANICAL (most common reason a draft is rejected): ${canText}${cannotText}
-  Every puzzle whose bypassType is one they cannot do MUST have its own "clue"-role item --
-  category "Book", placed in a DIFFERENT room from the barrier, and in a room reachable
-  WITHOUT passing through that barrier. Prefer barriers they can actually engage with; when
-  you write one they can't, write its clue in the same breath.`;
+export function wardBrief(player) {
+    return partyCanDispel(player)
+        ? `- WARDS: this runner can dispel, so a "ward" device is fair game.`
+        : `- WARDS: NOBODY at this table can dispel. Do NOT write a "ward" device -- there is no
+  findable answer to a ward, so a mundane team simply cannot pass one. Use a "lock" or a
+  "panel"; both have a way through that anyone can find.`;
 }
 export function buildPlayerDossier(player) {
     if (!player)
@@ -146,7 +141,7 @@ ${caps.map(c => `- ${c}`).join('\n')}
 Tailoring rules:
 - Include at least one route, subplot, or payoff that rewards THIS runner's toolkit (matrix
   content and hasNode rooms for a decker/technomancer; astral angles or Awakened opposition
-  for a mage; melee-shaped trouble for an adept; social leverage and "con"-bypass barriers
+  for a mage; melee-shaped trouble for an adept; social leverage and people worth talking round
   for a talker; recon value for a drone owner). Pick what fits this character and this
   story -- don't bolt on every plane at once.
 - Never gate FINISHING the run behind a capability they lack: no matrix-plane winCondition
@@ -162,7 +157,7 @@ Tailoring rules:
   dice below the runner's pools, and a centerpiece enforcer can match or slightly exceed
   them. Don't send soft civilians at a combat monster, or elite security at a runner built
   for talking their way through.
-${bypassBrief(player)}
+${wardBrief(player)}
 `.trim();
 }
 // ============================ Prompt builders ============================
@@ -226,10 +221,10 @@ export function buildSkeletonPrompt(tier, player, previousError, rumor, crew, ca
     // for more guns. Scaling the map too would just add walking.
     const heads = partyHeadcount(crew);
     const scope = tier <= 1
-        ? `3 to 4 rooms, exactly ${heads} NPC${heads === 1 ? '' : 's'} besides the client, and exactly 1 puzzle`
+        ? `3 to 4 rooms, exactly ${heads} NPC${heads === 1 ? '' : 's'} besides the client, and exactly 1 device`
         : tier === 2
-            ? `4 to 6 rooms, ${2 * heads} NPCs besides the client, and 1 to 2 puzzles`
-            : `6 to 8 rooms, ${3 * heads} to ${4 * heads} NPCs besides the client, and 2 to 3 puzzles`;
+            ? `4 to 6 rooms, ${2 * heads} NPCs besides the client, and 1 to 2 devices`
+            : `6 to 8 rooms, ${3 * heads} to ${4 * heads} NPCs besides the client, and 2 to 3 devices`;
     const dossier = buildPlayerDossier(player) + buildTeamBlock(crew);
     // The hub's active street rumor becomes the job's backdrop -- gossip
     // the runner heard at the noodle stand pays off as foreshadowing when
@@ -282,10 +277,14 @@ ${JSON_ONLY}
                           // acts on camera cost runners dearly, and deckers loop the feeds.
     "exits": [{ "direction": "north"|"east"|"south"|"west"|"up"|"down", "targetRoom": string,
                 "keyRequired"?: string, // an items[].name with role "key"
-                "puzzle"?: string }] // a puzzles[].name guarding this door. A door puzzle
-                                      // lives ON THE DOOR ONLY: that puzzle must have NO
-                                      // "room" field of its own (setting both is the most
-                                      // common structural mistake -- don't).
+                "device"?: string, // a devices[].name that holds this door shut. That
+                                    // device's own "room" MUST be the room declaring this
+                                    // exit -- you have to stand where the mechanism is.
+                "guard"?: string }] // an npcs[].name who STANDS in this doorway and will
+                                     // not move. A person, not a mechanism: the way past
+                                     // is talking them round or putting them down.
+                                     // NEVER set "device" and "guard" on one exit -- a
+                                     // door is gated by a thing OR a person, never both.
     // Doors are TWO-WAY automatically: declare each connection from ONE
     // side only (with its keyRequired/puzzle on that one declaration) --
     // never declare the reverse direction too.
@@ -300,18 +299,21 @@ ${JSON_ONLY}
     "plane"?: "meat"|"matrix"|"astral" // "matrix" = ICE guarding a hasNode room;
                                         // "astral" = a spirit. Default meat.
   }],
-  "puzzles": [{
-    "name": string, "concept": string, // what the barrier physically IS (a maglock, a
-                                        // keypad, a scanner, a doorman, a ward)
-    "room"?: string, // room-anchored placement -- OMIT when an exits[].puzzle references it
-    "bypassType"?: "lockpick"|"hack"|"spell"|"con", // the matching risky route: literal
-                          // lock -> "lockpick"; terminal/scanner -> "hack"; ward -> "spell";
-                          // a PERSON/voice-gate that could be talked past -> "con". Omit if
-                          // no such route. EXACTLY these lowercase strings.
-    "requiresPuzzle"?: string, // another puzzle solved FIRST (no cycles)
-    "rewardItem"?: string // an items[].name with role "reward" -- REQUIRED for room-anchored
-                           // puzzles (solving it is how the player gets that item); omit for
-                           // door puzzles (the open door is the reward)
+  "devices": [{
+    "name": string, "concept": string, // what it physically IS (a maglock, a keypad, a
+                                        // scanner, a ward) -- a THING, never a person
+    "room": string, // REQUIRED. A device always stands in ONE room -- the one you must be
+                     // in to reach it. If it holds a door, declare that exit FROM THIS
+                     // SAME ROOM with "device": "<this name>".
+    "kind": "lock"|"panel"|"ward", // lock = a mechanism: picked, breached, or opened by its
+                          // key. panel = an interface: a code, or hacked. ward = a working:
+                          // cast at or dispelled. EXACTLY these lowercase strings.
+                          // A device is always a THING. A doorman or a checkpoint guard is
+                          // NOT a device -- write them into npcs[] and name them in that
+                          // exit's "guard"; people are got past socially, not picked.
+    "grantsItem"?: string // an items[].name with role "reward" -- what opening it hands
+                           // over. Omit for a device that holds a door: the open way IS
+                           // the reward.
   }],
   "items": [{
     "name": string,
@@ -367,7 +369,7 @@ commlink of their own too.
 
 Hard structural rules (validated mechanically -- a violation is rejected):
 - Every exits[].targetRoom, npcs[].startLocation, items[].room name a real rooms[].name;
-  every items[].heldBy names a real npcs[].name; every exits[].puzzle names a real
+  every items[].heldBy names a real npcs[].name; every exits[].device names a real
   puzzles[].name; every keyRequired names a real items[].name with role "key".
 - "client" names a real npcs[].name, stationed in a REACHABLE room, holding a
   Commlink-category item.
@@ -378,18 +380,22 @@ Hard structural rules (validated mechanically -- a violation is rejected):
   placed beyond them: every key must be reachable WITHOUT passing through the door it opens.
 - A "reachable": false room never connects to a reachable one, and nothing the player must
   retrieve (winCondition item, keys, clues) is ever placed in one.
-- Each puzzle is placed EXACTLY one way: its own "room", or exactly one exits[].puzzle
-  reference. Each puzzle has exactly one "clue"-role Book item (forPuzzle set) in a
-  DIFFERENT room -- EXCEPT when the puzzle's bypassType matches a skill the runner's
-  dossier shows real strength in (a lockpick barrier for a master locksmith, a con
-  barrier for a silver-tongued face): their skill IS the way past, and the clue may be
-  omitted. When in doubt, include the clue. requiresPuzzle chains never cycle.
+- EVERY device names its own "room". If it holds a door, that door's exit is declared
+  from THAT SAME room with "device": "<its name>".
+- EVERY WAY THROUGH IS FINDABLE -- no exceptions, and no dependence on who is playing:
+    * every "panel" gets a code AND exactly one "clue"-role Book item (forDevice set) in a
+      DIFFERENT room, reachable without passing the panel itself;
+    * every "lock" gets a "key"-role item placed in the world, reachable without passing
+      the lock itself.
+  Write the clue or the key in the same breath as the device. A runner with the matching
+  skill can still take the shortcut -- pick the lock, hack the panel -- but the found way
+  must exist for a runner who has neither.
 - The winCondition item must not be heldBy winCondition.toNpc. If a matrix-plane item is the
   winCondition item, its room has hasNode true AND a "matrix"-plane NPC stationed there.
 - ${isContinuation
         ? 'ZERO "starting"-role items -- the runner arrives with everything they own. 4-6'
         : '3-5 "starting"-role items (basics the runner doesn\'t already own -- see the dossier), 4-6'}
-  "loot"-role world items, one "clue" per puzzle.
+  "loot"-role world items, one "clue" per panel and one "key" per lock.
 
 Scope: ${scope}. Gritty noir Shadowrun tone: a client, a job, a debt, a betrayal -- and a
 fresh premise, not a generic "corp blackmail vault" rerun.${repairNote(previousError)}
@@ -409,6 +415,9 @@ ${skeletonContext(skeleton)}
 For EVERY room in the skeleton, write evocative 2-3 sentence prose expanding its "concept" --
 gritty cyberpunk noir, concrete sensory detail, no mechanics talk and no spoilers (never
 reveal passphrases, hidden items, or plot twists in a room description).
+Never write a CODE-SHAPED string into room prose -- no door numbers, unit numbers, serials,
+or stencilled digits on a wall. The barriers' answers are the only codes in this world, and
+a number in scenery is a number a player will carry to the nearest lock and type.
 
 "At" SPOTS -- named places WITHIN a room the player can "move to":
 - Give 2-4 "spots" ONLY where positioning matters (bars, markets, offices, warehouses --
@@ -446,7 +455,13 @@ reveal passphrases, hidden items, or plot twists in a room description).
   ({ "<item name>": "<spot name>" }) -- a prize belongs at the guarded spot, not
   floating in the doorway; loose scatter can stay unanchored.
 - "exitSpots": which spot each exit leaves from ({ "<direction>": "<spot name>" }).
-  Give one to EVERY exit of a spotted room. An exit blocked by a barrier deserves its
+  Give one to EVERY exit of a spotted room, and copy the spot name EXACTLY as you wrote
+  it in "spots" -- this is the only thing that tells the engine which way out a doorway
+  leads. Leave one off and the engine has to GUESS from the spot's name, which is how a
+  spot called "the back door" ended up bound to the stairs DOWN and stranded in the middle
+  of the floor. A vertical way out (stairs, a ladder, a floor hatch) needs a spot that
+  reads vertical, and a door needs one that reads like a door.
+  An exit blocked by a barrier deserves its
   OWN named spot -- a back gate is not the entrance; two gates are two spots -- so the
   player always knows which gate is which.
 - ONE STORY: the prose and the spot data must agree. When the prose mentions a
@@ -502,47 +517,57 @@ ${JSON_ONLY}
 One entry per skeleton npc, "name" copied exactly.${repairNote(previousError)}
 `.trim();
 }
-export function buildPuzzlesPrompt(skeleton, previousError) {
-    if (skeleton.puzzles.length === 0)
+export function buildDevicesPrompt(skeleton, previousError) {
+    if (skeleton.devices.length === 0)
         return '';
     return `
-You are writing the barriers (puzzles) for a Shadowrun text adventure.
+You are writing the DEVICES for a Shadowrun text adventure. A device is a THING that is
+shut and can be opened -- a lock, a panel, a ward. Never a person.
 
 ${skeletonContext(skeleton)}
 
-For EVERY puzzle in the skeleton, expand its "concept" (what the barrier physically is --
-that's fixed, as is its bypassType):
-- "riddle": what the player sees on approaching it, shown verbatim -- PLAIN and concrete,
-  never a cryptic riddle-poem. Describe the barrier as a THING: what it is, how it's
-  secured, and what kind of credential it visibly expects (a keypad implies a code, an
-  intercom awaits a spoken phrase, a scrawled sign says "password"). Write NO people into
-  it -- no guards, no dialogue, no "they demand": anyone standing watch does their own
-  demanding in play, in their own voice. Never state the credential itself.
-- "requiredPhrase": the exact credential -- ALL LOWERCASE, 2-5 plain words, no punctuation.
-  A concrete literal thing (a code, a passphrase, a name), never wordplay.
-- "successMessage" / "failureMessage": one sentence each, in-fiction.
-- "lockedMessage": only for puzzles with "requiresPuzzle" -- what the player sees trying it
-  too early, hinting at the prerequisite without naming mechanics.
-- "guardsExit": ONLY for a puzzle with a "room" (never a door-guarding puzzle) whose
-  concept is physically TERRAIN blocking a passage -- rubble, a collapsed rack, a
-  security shutter across a walkway -- name the exact "direction" of one of that
-  room's own exits (from the skeleton) that it seals. A barrier on a container, safe,
-  or item pickup guards nothing physical -- leave this unset.
-- "footprint": "small" | "medium" | "large" -- how much of the room the barrier's
-  wreckage/blockage occupies. Only meaningful alongside "guardsExit".
+For EVERY device in the skeleton, expand its "concept" (what it physically is -- that's
+fixed, as is its "kind"):
+- "description": what the player sees on approaching it, shown verbatim -- PLAIN and
+  concrete, never a cryptic riddle-poem. Describe it as a THING: what it is, how it's
+  secured, and what it visibly expects. Write NO people into it -- no guards, no dialogue,
+  no "they demand": anyone standing watch does their own demanding in play, in their own
+  voice. Never state the credential itself, and never write ANY OTHER number into it -- no
+  unit number, no model number, no serial, no floor number. Every code-shaped string a
+  player reads is one they will go and type.
+- "code": ONLY for kind "panel", and REQUIRED for one. The exact credential it accepts, and
+  it MUST BE THE SAME KIND OF THING your "description" says the panel wants. This is the
+  single most confusing thing in the game when it drifts: a player who reads "a keypad with
+  worn digits" and then finds "double or nothing" written in a notebook does not believe
+  they have the code, and goes looking for a number that does not exist.
+    * If the description shows a NUMERIC pad, dial, or counter -- digits only, 3-6 of them,
+      no spaces ("470912"). Then it really does take a number.
+    * Otherwise (an intercom, a voice-gate, a spoken passphrase, a name, a sign reading
+      "password") -- ALL LOWERCASE, 2-5 plain words, no punctuation.
+  Either way a concrete literal thing, never wordplay.
+  OMIT "code" for a "lock" or a "ward". You cannot talk at a mechanical lock, and a ward
+  answers to the Art -- neither has anything to hear a phrase with, so a code on one is a
+  promise the game cannot keep.
+- "openMessage" / "refuseMessage": one sentence each, in-fiction.
+- "guardsExit": ONLY when the concept is physically TERRAIN blocking a passage -- rubble, a
+  collapsed rack, a security shutter across a walkway -- name the exact "direction" of one
+  of its own room's exits that it seals. A device on a container, safe, or item pickup
+  guards nothing physical: leave it unset.
+- "footprint": "small" | "medium" | "large" -- how much of the room the blockage occupies.
+  Only meaningful alongside "guardsExit".
 
 ${JSON_ONLY}
-[ { "name": string, "riddle": string, "requiredPhrase": string, "successMessage": string,
-    "failureMessage": string, "lockedMessage"?: string, "guardsExit"?: string, "footprint"?: string } ]
-One entry per skeleton puzzle, "name" copied exactly.${repairNote(previousError)}
+[ { "name": string, "description": string, "code"?: string, "openMessage": string,
+    "refuseMessage": string, "guardsExit"?: string, "footprint"?: string } ]
+One entry per skeleton device, "name" copied exactly.${repairNote(previousError)}
 `.trim();
 }
-export function buildItemsPrompt(skeleton, puzzles, previousError) {
+export function buildItemsPrompt(skeleton, devices, previousError) {
     const clueSpecs = skeleton.items
-        .filter(i => i.role === 'clue' && i.forPuzzle)
+        .filter(i => i.role === 'clue' && i.forDevice)
         .map(i => {
-        const phrase = puzzles.find(p => p.name === i.forPuzzle)?.requiredPhrase;
-        return `- "${i.name}" is the clue for puzzle "${i.forPuzzle}": its "details" text MUST contain the exact phrase "${phrase ?? 'UNKNOWN'}" verbatim (a diary entry, scrawled note, or manual that gives it away once read).`;
+        const code = devices.find(d => d.name === i.forDevice)?.code;
+        return `- "${i.name}" is the clue for device "${i.forDevice}": its "details" text MUST contain the exact code "${code ?? 'UNKNOWN'}" verbatim (a diary entry, scrawled note, or manual that gives it away once read).`;
     })
         .join('\n');
     return `
@@ -562,6 +587,14 @@ For EVERY item in the skeleton, expand it into a full item ("name" and "category
 Clue requirements (mechanically validated -- the exact phrase must appear in "details"):
 ${clueSpecs || '- (no clue items in this scene)'}
 
+THE ONLY CODES IN THIS WORLD are the clue phrases listed just above. No other item may
+carry a code-shaped string -- no serial numbers, no model numbers, no unit or locker or
+apartment numbers, no "access code" on a scrap of paper that isn't a listed clue. A player
+who reads a number writes it down and takes it to the nearest lock; a second plausible
+number is indistinguishable from the real one and it costs them the run. Quantities and
+prices are fine (a clip "holds 10 rounds", a stick "carries 2000 nuyen") -- those read as
+amounts, not credentials.
+
 ${JSON_ONLY}
 [ { "name": string, "description": string, "size": string, "category": string,
     "shape": string, "color": string, "texture": string, "rating": string, "weight": number,
@@ -571,32 +604,33 @@ One entry per skeleton item, "name" and "category" copied exactly.${repairNote(p
 }
 // ========================= Parse / validate / assemble ====================
 /**
- * Whether THIS runner can reliably work a barrier of the given bypassType
- * with their own hands -- no written-down credential required. This is
- * what loosens the "every puzzle needs a discoverable clue" rule when the
- * scene is generated against a dossier: a lockpick maglock in a scene
- * built for a master locksmith doesn't need its code lying in a book --
- * the pick IS their route. Deliberately conservative: EXPLICIT skill
- * ratings only (the combatSkill fallback would let any bruiser "qualify"
- * as a hacker), threshold 3 (trained professional), and with no dossier
- * at all the strict clue rule stays.
+ * Can anyone at this table unweave a WARD?
+ *
+ * The last surviving branch of what used to be canBypassUnaided, which
+ * asked the same question of all three barrier kinds. The other two are
+ * gone because their answers stopped mattering (ruling 2026-08-27):
+ *
+ *   A PANEL takes a code, and a code is FINDABLE. Write it down and any
+ *   runner can type it; a decker who did not need it loses nothing.
+ *   A LOCK takes a key, and a key is FINDABLE. Place it and any runner
+ *   can carry it to the door; picking becomes the SHORTCUT for someone
+ *   with locksmith, not the requirement.
+ *
+ * So for those two the clue/key rule is UNCONDITIONAL now, and the
+ * character-dependent waiver is gone with the condition it rested on.
+ *
+ * A WARD is irreducible. There is no findable answer to a ward; it takes
+ * Magic. A mundane team cannot dispel one however much is written down,
+ * so a ward generated for a party with nobody awakened is an unopenable
+ * barrier no clue can rescue. That is where the character dependence is
+ * REAL rather than incidental, and it is the only place this survives.
+ *
+ * Named for what it now is: a one-case function still called
+ * canBypassUnaided would attract the other two cases back.
  */
-export function canBypassUnaided(player, bypassType) {
-    if (!player || !bypassType)
-        return false;
-    // THROUGH skillRating, NOT the raw sheet (bug found 2026-08-26): the
-    // raw read sailed past the "incompetent-<skill>" quality, which
-    // skillRating pins to 0 (player.ts) -- an Incompetent-locksmith runner
-    // was qualifying to have the lockpick clue waived on the strength of a
-    // number the rest of the game refuses to honour.
-    const rated = (skill) => player.skillRating(skill);
-    switch (bypassType) {
-        case 'lockpick': return rated('locksmith') >= 3;
-        case 'hack': return rated('hacking') >= 3 || player.isTechnomancer() || !!player.getAnyCyberdeck();
-        case 'spell': return player.isAwakened() && !player.adept;
-        case 'con': return rated('con') >= 3 || player.charisma >= 5;
-        default: return false;
-    }
+export function partyCanDispel(player) {
+    // Adepts are awakened but cannot cast, so they cannot unweave a ward.
+    return !!player && player.isAwakened() && !player.adept;
 }
 /** Strips accidental markdown fences and parses; throws with a useful message. */
 export function parseJsonReply(reply) {
@@ -668,7 +702,7 @@ export function validateSkeleton(skeleton, player, crew) {
     const roomNames = new Set(skeleton.rooms.map(r => r.name));
     const npcNames = new Set(skeleton.npcs.map(n => n.name));
     const itemNames = new Set(skeleton.items.map(i => i.name));
-    const puzzleNames = new Set((skeleton.puzzles ?? []).map(p => p.name));
+    const deviceNames = new Set((skeleton.devices ?? []).map(d => d.name));
     const startRooms = skeleton.rooms.filter(r => r.isStartRoom);
     if (startRooms.length !== 1)
         fail(`exactly one room must have "isStartRoom": true (found ${startRooms.length}).`);
@@ -677,11 +711,33 @@ export function validateSkeleton(skeleton, player, crew) {
         for (const exit of room.exits ?? []) {
             if (!roomNames.has(exit.targetRoom))
                 fail(`exit from "${room.name}" targets unknown room "${exit.targetRoom}".`);
-            if (exit.puzzle) {
-                if (!puzzleNames.has(exit.puzzle))
-                    fail(`exit from "${room.name}" references unknown puzzle "${exit.puzzle}".`);
-                doorRefs.set(exit.puzzle, (doorRefs.get(exit.puzzle) ?? 0) + 1);
+            // A DOOR IS GATED BY A PERSON OR A MECHANISM, NEVER BOTH.
+            // Stated as a validator and not only in the prompt, because a
+            // prompt that can express a contradiction eventually will: two
+            // gates on one door means beating the guard leaves the door still
+            // locked, or picking the lock leaves the body still in it, and
+            // the player cannot tell which half they failed to solve.
+            if (exit.device && exit.guard) {
+                fail(`exit from "${room.name}" has BOTH a device ("${exit.device}") and a guard ("${exit.guard}") -- a door is gated by a thing or a person, never both. Drop one.`);
             }
+            if (exit.device) {
+                if (!deviceNames.has(exit.device))
+                    fail(`exit from "${room.name}" references unknown device "${exit.device}".`);
+                // THE ROOM-OWNED RULE MADE ENFORCEABLE rather than merely true.
+                // The old model made "placed in a room AND on a door" possible
+                // and validated it away; room ownership makes that
+                // unrepresentable, but makes a NEW incoherence expressible --
+                // an exit naming a device that lives somewhere else. It fails
+                // exactly like the shared-door case: the door locks, and the
+                // mechanism is in a room the player has no reason to look in.
+                const owner = (skeleton.devices ?? []).find(d => d.name === exit.device);
+                if (owner && owner.room !== room.name) {
+                    fail(`exit from "${room.name}" is held by device "${exit.device}", which stands in "${owner.room}" -- a device can only hold a door of its OWN room. Move the device, or declare this exit from "${owner.room}".`);
+                }
+                doorRefs.set(exit.device, (doorRefs.get(exit.device) ?? 0) + 1);
+            }
+            if (exit.guard && !npcNames.has(exit.guard))
+                fail(`exit from "${room.name}" is guarded by unknown npc "${exit.guard}".`);
             if (exit.keyRequired && !itemNames.has(exit.keyRequired))
                 fail(`exit from "${room.name}" requires unknown key item "${exit.keyRequired}".`);
         }
@@ -695,40 +751,72 @@ export function validateSkeleton(skeleton, player, crew) {
             fail(`item "${item.name}" placed in unknown room "${item.room}".`);
         if (item.heldBy && !npcNames.has(item.heldBy))
             fail(`item "${item.name}" heldBy unknown npc "${item.heldBy}".`);
-        if (item.forPuzzle && !puzzleNames.has(item.forPuzzle))
-            fail(`clue item "${item.name}" references unknown puzzle "${item.forPuzzle}".`);
+        if (item.forDevice && !deviceNames.has(item.forDevice))
+            fail(`clue item "${item.name}" references unknown device "${item.forDevice}".`);
     }
-    // The three structural faults real generations actually shipped -- an
-    // unplaced-or-double-placed puzzle, a puzzle with no clue item at all
-    // (unfixable by ANY items pass), and unreachable rooms -- must die HERE,
-    // before four detail passes build on bad bones.
-    for (const puzzle of skeleton.puzzles ?? []) {
-        if (puzzle.room && !roomNames.has(puzzle.room))
-            fail(`puzzle "${puzzle.name}" placed in unknown room "${puzzle.room}".`);
-        if (puzzle.rewardItem && !itemNames.has(puzzle.rewardItem))
-            fail(`puzzle "${puzzle.name}" rewards unknown item "${puzzle.rewardItem}".`);
-        const refs = doorRefs.get(puzzle.name) ?? 0;
-        if (puzzle.room && refs > 0)
-            fail(`puzzle "${puzzle.name}" is placed both in room "${puzzle.room}" AND on a door (exits[].puzzle) -- exactly one or the other.`);
-        if (!puzzle.room && refs === 0)
-            fail(`puzzle "${puzzle.name}" isn't placed anywhere -- set its "room", or reference it from one exits[].puzzle.`);
+    // The structural faults real generations actually shipped -- a device
+    // with no way through at all (unfixable by ANY items pass) and
+    // unreachable rooms -- must die HERE, before four detail passes build
+    // on bad bones.
+    //
+    // WHAT LEFT WITH THE PUZZLE MECHANIC: the unplaced-or-double-placed
+    // check. A device names its own room and always has one, so "placed
+    // both in a room and on a door" is now unrepresentable rather than
+    // merely invalid -- the room-owned rule doing the work two validators
+    // in two files used to do in near-identical prose.
+    for (const device of skeleton.devices ?? []) {
+        if (!device.room)
+            fail(`device "${device.name}" has no "room" -- every device stands in one.`);
+        else if (!roomNames.has(device.room))
+            fail(`device "${device.name}" placed in unknown room "${device.room}".`);
+        if (device.grantsItem && !itemNames.has(device.grantsItem))
+            fail(`device "${device.name}" grants unknown item "${device.grantsItem}".`);
+        const refs = doorRefs.get(device.name) ?? 0;
         if (refs > 1)
-            fail(`puzzle "${puzzle.name}" is referenced by ${refs} doors -- a puzzle can only guard one.`);
-        const clue = skeleton.items.find(i => i.role === 'clue' && i.forPuzzle === puzzle.name);
-        if (!clue) {
-            // Loosened when the dossier says the runner can work this barrier
-            // unaided -- their bypass skill IS the way past (player note from a
-            // real failed generation: "it just needs a way past, and if the
-            // player has the means, it should be allowed").
-            if (!canBypassUnaided(player, puzzle.bypassType)) {
-                fail(`puzzle "${puzzle.name}" has no "clue"-role item with "forPuzzle": "${puzzle.name}" and its bypassType (${puzzle.bypassType ?? 'none'}) is not something this runner reliably handles -- add a "clue"-role Book item in a different room, or give the barrier a bypassType matching the runner's dossier strengths.`);
+            fail(`device "${device.name}" is referenced by ${refs} doors -- a device can only hold one.`);
+        // EVERY WAY THROUGH IS FINDABLE, and it no longer depends on who is
+        // playing. A code is findable and a key is placeable, so both are
+        // openable by ANY runner; the skilled route (pick, hack) is the
+        // SHORTCUT, not the requirement. That kills the character-dependent
+        // waiver which was the single most common generation failure on
+        // record -- and which looked like random flakiness precisely
+        // because it varied with the character.
+        const kind = device.kind ?? 'panel';
+        if (kind === 'panel') {
+            const clue = skeleton.items.find(i => i.role === 'clue' && i.forDevice === device.name);
+            if (!clue) {
+                fail(`panel "${device.name}" has no "clue"-role item with "forDevice": "${device.name}" -- every panel's code must be written down somewhere findable, so a runner who cannot hack can still open it.`);
+            }
+            else if (!clue.room) {
+                fail(`clue item "${clue.name}" needs a "room".`);
+            }
+            else if (refs === 0 && clue.room === device.room) {
+                // THE RULE IS REACHABILITY, NOT DISTANCE -- and the distinction
+                // only appeared once devices became room-owned. A door device
+                // stands in the room you approach the door FROM, so its own
+                // room is on the safe side and is a perfectly good place for
+                // the clue; excluding it would leave a device on the start
+                // room's only exit with nowhere legal at all. For a device
+                // that holds no door (a safe), the same room is merely
+                // uninteresting, so keep the old separation there.
+                fail(`clue item "${clue.name}" sits in the SAME room as its device "${device.name}", which guards no door -- place the clue in a different room.`);
             }
         }
-        else {
-            if (!clue.room)
-                fail(`clue item "${clue.name}" needs a "room" (a different one than its puzzle's).`);
-            if (puzzle.room && clue.room === puzzle.room)
-                fail(`clue item "${clue.name}" sits in the SAME room as its puzzle "${puzzle.name}" -- place the clue in a different room.`);
+        else if (kind === 'lock') {
+            // A lock's findable way through is its KEY. Either the door it
+            // holds names one, or a key-role item exists for it.
+            const holdsDoor = refs > 0;
+            const keyed = skeleton.rooms.some(r => (r.exits ?? []).some(e => e.device === device.name && e.keyRequired));
+            const looseKey = skeleton.items.some(i => i.role === 'key');
+            if (holdsDoor && !keyed && !looseKey) {
+                fail(`lock "${device.name}" holds a door with no "keyRequired" and the scene has no "key"-role item -- a runner without locksmith has no way through it. Add a key.`);
+            }
+        }
+        // A WARD is the exception no clue can rescue: there is no findable
+        // answer to one, so it is gated on the party rather than on an
+        // item. See partyCanDispel.
+        if (kind === 'ward' && !partyCanDispel(player)) {
+            fail(`device "${device.name}" is a ward, and nobody at this table can dispel -- there is no findable answer to a ward, so it would be unopenable. Make it a "lock" or a "panel".`);
         }
     }
     if (!itemNames.has(skeleton.winCondition.item))
@@ -755,7 +843,7 @@ export function validateSkeleton(skeleton, player, crew) {
     const edges = [];
     for (const room of skeleton.rooms) {
         for (const exit of room.exits ?? []) {
-            edges.push({ a: room.name, b: exit.targetRoom, keyRequired: exit.keyRequired, puzzle: exit.puzzle });
+            edges.push({ a: room.name, b: exit.targetRoom, keyRequired: exit.keyRequired, device: exit.device });
         }
     }
     const reachable = new Set([startRooms[0].name]);
@@ -768,7 +856,7 @@ export function validateSkeleton(skeleton, player, crew) {
             if (!from || reachable.has(to))
                 continue;
             const keyLoc = edge.keyRequired ? itemRoom.get(edge.keyRequired) : undefined;
-            const passable = !!edge.puzzle || !edge.keyRequired || (keyLoc !== undefined && reachable.has(keyLoc));
+            const passable = !!edge.device || !edge.keyRequired || (keyLoc !== undefined && reachable.has(keyLoc));
             if (passable) {
                 reachable.add(to);
                 grew = true;
@@ -829,7 +917,7 @@ function freeStrandedRooms(skeleton) {
     const edges = [];
     for (const room of skeleton.rooms ?? []) {
         for (const exit of room.exits ?? []) {
-            edges.push({ a: room.name, b: exit.targetRoom, keyRequired: exit.keyRequired, puzzle: exit.puzzle });
+            edges.push({ a: room.name, b: exit.targetRoom, keyRequired: exit.keyRequired, device: exit.device });
         }
     }
     // Same walk the validator runs, so a repair here is judged by exactly
@@ -847,7 +935,7 @@ function freeStrandedRooms(skeleton) {
                 if (reachable.has(to))
                     continue;
                 const keyLoc = edge.keyRequired ? locs.get(edge.keyRequired) : undefined;
-                if (!!edge.puzzle || !edge.keyRequired || (keyLoc !== undefined && reachable.has(keyLoc))) {
+                if (!!edge.device || !edge.keyRequired || (keyLoc !== undefined && reachable.has(keyLoc))) {
                     reachable.add(to);
                     grew = true;
                 }
@@ -867,7 +955,7 @@ function freeStrandedRooms(skeleton) {
         // ground, held shut by a key nobody can get to.
         const gate = edges.find(e => {
             const touchesBoth = (reachable.has(e.a) && strandedNames.has(e.b)) || (reachable.has(e.b) && strandedNames.has(e.a));
-            if (!touchesBoth || e.puzzle || !e.keyRequired)
+            if (!touchesBoth || e.device || !e.keyRequired)
                 return false;
             const keyLoc = itemRoom().get(e.keyRequired);
             return keyLoc === undefined || !reachable.has(keyLoc);
@@ -888,7 +976,7 @@ function freeStrandedRooms(skeleton) {
 const STAFFED_ROOM_TYPES = /^(market|shop|store|bar|pub|tavern|restaurant|cafe|clinic|pawn|stall|vendor|kiosk|dispensary)/i;
 /**
  * WHERE A CLUE MAY LIVE. The validator's reachability walk treats every
- * puzzle door as PASSABLE (`!!edge.puzzle ||` in validateSkeleton), which
+ * puzzle door as PASSABLE (`!!edge.device ||` in validateSkeleton), which
  * is right for "can the runner eventually get there" and dead wrong for
  * "can the runner read this BEFORE facing the barrier". So a clue placed
  * behind the very door its puzzle guards validates clean and softlocks in
@@ -905,7 +993,7 @@ const STAFFED_ROOM_TYPES = /^(market|shop|store|bar|pub|tavern|restaurant|cafe|c
  *
  * Returns [] when nowhere is safe -- callers MUST bail, never guess.
  */
-function safeRoomsFor(skeleton, puzzle) {
+function safeRoomsFor(skeleton, device) {
     const start = (skeleton.rooms ?? []).find(r => r.isStartRoom);
     if (!start)
         return [];
@@ -928,8 +1016,8 @@ function safeRoomsFor(skeleton, puzzle) {
             grew = false;
             for (const room of skeleton.rooms ?? []) {
                 for (const exit of room.exits ?? []) {
-                    // A barrier is a wall until it is solved. That is the whole point.
-                    if (exit.puzzle)
+                    // A barrier is a wall until it is opened. That is the whole point.
+                    if (exit.device)
                         continue;
                     const a = room.name, b = exit.targetRoom;
                     if (isolated.has(a) || isolated.has(b))
@@ -954,14 +1042,21 @@ function safeRoomsFor(skeleton, puzzle) {
     // its room: the puzzles pass can later emit `guardsExit` sealing one of
     // that room's doors, which is unknowable here, so be conservative. Fall
     // back to merely excluding the room itself when that leaves nothing.
-    // A door puzzle needs no extra exclusion -- cutting its edge already
+    // A door device needs no extra exclusion -- cutting its edge already
     // leaves exactly the near-side component, and the near-side room is a
     // fine place to find the clue.
-    let reached = walk(puzzle.room);
-    if (puzzle.room && reached.size <= 1)
+    const holdsDoor = (skeleton.rooms ?? []).some(r => (r.exits ?? []).some(e => e.device === device.name));
+    let reached = walk(device.room);
+    if (device.room && reached.size <= 1)
         reached = walk();
     const candidates = (skeleton.rooms ?? [])
-        .filter(r => reached.has(r.name) && r.name !== puzzle.room && !isolated.has(r.name));
+        // A DOOR device's own room is on the SAFE side of the door it
+        // holds, so it is a legal home for the clue -- excluding it would
+        // leave a device on the start room's only exit with nowhere at all.
+        // A device guarding nothing keeps the old separation: its own room
+        // is reachable but uninteresting.
+        .filter(r => reached.has(r.name) && !isolated.has(r.name)
+        && (holdsDoor || r.name !== device.room));
     if (candidates.length === 0)
         return [];
     // Rank: earned over free (not the curb), unowned over owned, deeper
@@ -975,7 +1070,7 @@ function safeRoomsFor(skeleton, puzzle) {
         const cur = bfs.shift();
         for (const room of skeleton.rooms ?? []) {
             for (const exit of room.exits ?? []) {
-                if (exit.puzzle)
+                if (exit.device)
                     continue;
                 const pair = [room.name, exit.targetRoom];
                 if (!pair.includes(cur))
@@ -1070,7 +1165,14 @@ function resolveDirectionCollisions(skeleton) {
     }
     return notes;
 }
-export function normalizeSkeleton(skeleton, player) {
+/**
+ * `player` is GONE from this signature, not underscored. Its only
+ * consumer was the character-dependent clue waiver, and with the
+ * clue/key rule unconditional there is nothing here that varies with
+ * who is playing. A parameter kept "just in case" is an invitation to
+ * make normalization character-dependent again.
+ */
+export function normalizeSkeleton(skeleton) {
     const notes = [];
     // Topology before anything that reasons about topology: freeStranded-
     // Rooms, clue placement and the curb all walk this graph, and they
@@ -1154,80 +1256,62 @@ export function normalizeSkeleton(skeleton, player) {
             notes.push(`normalized: start room "${start.name}" is indoors but every direction on it is taken -- could not inject a curb.`);
         }
     }
-    const doorRefs = new Map();
-    for (const room of skeleton.rooms ?? []) {
-        for (const exit of room.exits ?? []) {
-            if (exit.puzzle)
-                doorRefs.set(exit.puzzle, (doorRefs.get(exit.puzzle) ?? 0) + 1);
-        }
-    }
-    for (const puzzle of skeleton.puzzles ?? []) {
-        if (puzzle.room && (doorRefs.get(puzzle.name) ?? 0) === 1) {
-            notes.push(`normalized: puzzle "${puzzle.name}" was double-placed (room + door); kept the door placement.`);
-            delete puzzle.room;
-        }
-    }
-    // THE CLUE ITEM -- half of every generation failure on record.
-    //
-    // Measured 2026-08-26 across 20 sessions: 19 job attempts, 3 valid
-    // scenes, 12 outright give-ups. The dominant fault, at both the
-    // skeleton and the assembled stage, is a puzzle whose clue item is
-    // missing, roomless, or sitting in its own puzzle's room. It is
-    // character-dependent, which is why it looked like flakiness: a Face
-    // (con 5, no locksmith/hacking, magic 0) satisfies canBypassUnaided
-    // for exactly ONE bypassType, so every lockpick/hack/spell barrier
-    // demands a clue -- and the model keeps forgetting to write one.
-    //
-    // Repaired here rather than by retrying, because retries reproduce it
-    // verbatim: the skeleton prompt feeds back the ERROR but not the map
-    // the model just drew, so attempt 2 redraws from scratch and forgets
+    // NO DOUBLE-PLACEMENT REPAIR ANY MORE. A device always names its own
+    // room, so "placed in a room AND on a door" is unrepresentable rather
+    // than something to reconcile -- the room-owned rule retiring a
+    // repair as well as a validator.
     // again. Runs BEFORE reward reconciliation on purpose -- that step
     // treats role "clue" as load-bearing, so anything promoted here is
     // protected from being converted into an unplaced reward.
     //
-    // Synthesis happens EVEN WHEN canBypassUnaided waives the clue. The
-    // waiver is a latent softlock: getBypassHint promises the player "the
-    // answer is recorded somewhere out in the world", bypass is a coin
-    // flip, and a failed flip burns the route with "Only the real code
-    // will open it" -- for a code that was never written down.
+    // PANELS ONLY. A lock's findable way through is its key, not a
+    // written code, and a ward has no findable answer at all (it is
+    // refused outright at validation when nobody can dispel). Synthesis
+    // is unconditional for panels now -- there is no waiver left to
+    // second-guess, which is what made the old version's log lines need
+    // to explain which kind of failure they were.
     const SYNTHESIZED_CLUE_CAP = 2;
     let synthesized = 0;
     const CLUE_NOUN = {
-        lockpick: 'Maintenance Log',
-        hack: 'Service Log',
-        spell: 'Ritual Notes',
-        con: 'Staff Roster',
+        panel: 'Service Log',
     };
-    for (const puzzle of skeleton.puzzles ?? []) {
+    for (const device of skeleton.devices ?? []) {
+        // Only a panel has a code to write down.
+        if ((device.kind ?? 'panel') !== 'panel')
+            continue;
         const items = skeleton.items ?? [];
-        let clue = items.find(i => i.role === 'clue' && i.forPuzzle === puzzle.name);
+        let clue = items.find(i => i.role === 'clue' && i.forDevice === device.name);
         // Reclassify before inventing: the model often authored the object
         // and only mislabelled it. Cheaper than synthesis and it keeps the
         // model's own prose intent.
         if (!clue) {
-            const mislabelled = items.find(i => i.forPuzzle === puzzle.name && i.role !== 'clue');
+            const mislabelled = items.find(i => i.forDevice === device.name && i.role !== 'clue');
             if (mislabelled) {
-                notes.push(`normalized: item "${mislabelled.name}" was a ${mislabelled.role} pointing at puzzle "${puzzle.name}"; promoted it to that puzzle's clue.`);
+                notes.push(`normalized: item "${mislabelled.name}" was a ${mislabelled.role} pointing at device "${device.name}"; promoted it to that device's clue.`);
                 mislabelled.role = 'clue';
                 mislabelled.category = 'Book';
                 clue = mislabelled;
             }
         }
-        const safe = safeRoomsFor(skeleton, puzzle);
+        const safe = safeRoomsFor(skeleton, device);
         if (clue) {
             // A clue in its own puzzle's room, or with no room at all, is the
             // same repair: put it somewhere legal and safe.
-            const needsRoom = !clue.room || clue.room === puzzle.room;
+            // Same rule as the validator: a DOOR device's own room is on the
+            // safe side, so a clue there is fine. Only a device guarding
+            // nothing wants its clue moved out of its own room.
+            const holdsDoor = (skeleton.rooms ?? []).some(r => (r.exits ?? []).some(e => e.device === device.name));
+            const needsRoom = !clue.room || (!holdsDoor && clue.room === device.room);
             if (needsRoom) {
                 // A holder standing in a safe room is the better answer than a
                 // book on the floor -- but only if the validators can see it.
                 const holderRoom = clue.heldBy ? (skeleton.npcs ?? []).find(n => n.name === clue.heldBy)?.startLocation : undefined;
                 const target = (holderRoom && safe.includes(holderRoom)) ? holderRoom : safe[0];
                 if (!target) {
-                    notes.push(`could not relocate clue "${clue.name}": no room is reachable without passing puzzle "${puzzle.name}".`);
+                    notes.push(`could not relocate clue "${clue.name}": no room is reachable without passing device "${device.name}".`);
                 }
                 else {
-                    const was = clue.room ? `sat in its own puzzle's room "${clue.room}"` : 'had no room';
+                    const was = clue.room ? `sat in its own device's room "${clue.room}"` : 'had no room';
                     clue.room = target;
                     delete clue.heldBy;
                     notes.push(`normalized: clue "${clue.name}" ${was}; moved it to "${target}" (reachable without passing the barrier).`);
@@ -1236,31 +1320,25 @@ export function normalizeSkeleton(skeleton, player) {
             continue;
         }
         if (safe.length === 0) {
-            // How bad this is depends on the runner. If the barrier happens to
-            // be one they can force unaided, validateSkeleton's waiver still
-            // lets the draft through -- it just ships a barrier with no written
-            // answer, which is the gamble-only case getBypassHint over-promises
-            // on. If they can't force it, the draft is dead and the validator
-            // will say so. Two very different log lines; say which one it is.
-            notes.push(canBypassUnaided(player, puzzle.bypassType)
-                ? `could not synthesize a clue for puzzle "${puzzle.name}": nowhere is reachable without passing it -- it ships on the runner's own ${puzzle.bypassType}, with no written answer anywhere.`
-                : `could not synthesize a clue for puzzle "${puzzle.name}": nowhere is reachable without passing it.`);
+            // One log line now, not two: with the waiver gone the draft is
+            // simply dead here, and validateSkeleton will say so.
+            notes.push(`could not synthesize a clue for panel "${device.name}": nowhere is reachable without passing it.`);
             continue;
         }
         if (synthesized >= SYNTHESIZED_CLUE_CAP) {
-            notes.push(`declined to synthesize a clue for puzzle "${puzzle.name}": already invented ${SYNTHESIZED_CLUE_CAP} this skeleton -- a fresh draft is the better bet.`);
+            notes.push(`declined to synthesize a clue for panel "${device.name}": already invented ${SYNTHESIZED_CLUE_CAP} this skeleton -- a fresh draft is the better bet.`);
             continue;
         }
         // The NAME is the entire brief the items prose pass receives (an
         // ISkeletonItem has no concept field), so it has to imply the object.
-        const noun = CLUE_NOUN[puzzle.bypassType ?? ''] ?? 'Notes';
-        let name = `${puzzle.name} ${noun}`;
+        const noun = CLUE_NOUN[device.kind ?? 'panel'] ?? 'Notes';
+        let name = `${device.name} ${noun}`;
         for (let i = 2; items.some(it => it.name === name); i++)
-            name = `${puzzle.name} ${noun} ${i}`;
+            name = `${device.name} ${noun} ${i}`;
         skeleton.items = items;
-        skeleton.items.push({ name, role: 'clue', category: 'Book', forPuzzle: puzzle.name, room: safe[0] });
+        skeleton.items.push({ name, role: 'clue', category: 'Book', forDevice: device.name, room: safe[0] });
         synthesized++;
-        notes.push(`normalized: puzzle "${puzzle.name}" had no clue item; synthesized Book clue "${name}" in "${safe[0]}" (reachable without passing the barrier).`);
+        notes.push(`normalized: panel "${device.name}" had no clue item; synthesized Book clue "${name}" in "${safe[0]}" (reachable without passing the barrier).`);
     }
     // REWARD-REFERENCE reconciliation. A rewardItem (a puzzle's, or the
     // winCondition's) must point at an UNPLACED role-"reward" item, but
@@ -1276,18 +1354,18 @@ export function normalizeSkeleton(skeleton, player) {
     // reward reference is dropped instead (door puzzles don't need one).
     const itemByName = new Map(skeleton.items.map(i => [i.name, i]));
     const loadBearing = new Set(['clue', 'key', 'winCondition', 'starting']);
-    for (const puzzle of skeleton.puzzles ?? []) {
-        if (!puzzle.rewardItem)
+    for (const device of skeleton.devices ?? []) {
+        if (!device.grantsItem)
             continue;
-        const item = itemByName.get(puzzle.rewardItem);
+        const item = itemByName.get(device.grantsItem);
         if (!item || item.role === 'reward')
             continue;
         if (loadBearing.has(item.role) || item.name === skeleton.winCondition?.item) {
-            notes.push(`normalized: puzzle "${puzzle.name}" claimed the ${item.role} item "${item.name}" as its reward; dropped the reward reference (the ${item.role} role is load-bearing).`);
-            delete puzzle.rewardItem;
+            notes.push(`normalized: device "${device.name}" claimed the ${item.role} item "${item.name}" as what it grants; dropped the reference (the ${item.role} role is load-bearing).`);
+            delete device.grantsItem;
         }
         else {
-            notes.push(`normalized: item "${item.name}" was a placed ${item.role} but is puzzle "${puzzle.name}"'s reward; converted to an unplaced reward.`);
+            notes.push(`normalized: item "${item.name}" was a placed ${item.role} but is device "${device.name}"'s grant; converted to an unplaced reward.`);
             item.role = 'reward';
             delete item.room;
             delete item.heldBy;
@@ -1335,11 +1413,11 @@ export function normalizeSkeleton(skeleton, player) {
 export function ensureClueDetails(skeleton, details) {
     const notes = [];
     const byName = new Map((details.items ?? []).map(i => [i.name, i]));
-    for (const puzzleDetail of details.puzzles ?? []) {
-        const phrase = (puzzleDetail.requiredPhrase ?? '').trim();
+    for (const deviceDetail of details.devices ?? []) {
+        const phrase = (deviceDetail.code ?? '').trim();
         if (!phrase)
             continue;
-        const clues = (skeleton.items ?? []).filter(i => i.role === 'clue' && i.forPuzzle === puzzleDetail.name);
+        const clues = (skeleton.items ?? []).filter(i => i.role === 'clue' && i.forDevice === deviceDetail.name);
         if (clues.length === 0)
             continue;
         // An item literally NAMED the phrase satisfies the validator too, and
@@ -1379,17 +1457,114 @@ export function ensureClueDetails(skeleton, details) {
         }
         const body = (detail.details ?? '').trim();
         detail.details = `${body}${body ? ' ' : ''}Scrawled in the margin, in a different hand: "${phrase}".`;
-        notes.push(`normalized: clue "${target.name}" didn't carry puzzle "${puzzleDetail.name}"'s answer; wrote it into the margin.`);
+        notes.push(`normalized: clue "${target.name}" didn't carry device "${deviceDetail.name}"'s code; wrote it into the margin.`);
     }
     return notes;
 }
 /** Merges the skeleton's structure with the detail passes into a full seed. */
+/**
+ * Resolve a spot name the model WROTE to a spot that actually EXISTS.
+ *
+ * Generated cross-references are prose, not identifiers: the rooms pass
+ * writes spot names into `exitSpots` by hand, and it varies the surface
+ * form constantly -- an article ("the loading dock"), a capital ("Back
+ * Door"), a plural, a hyphen. An exact-match test threw every one of
+ * those away silently and fell back to guessing the binding from the
+ * spot's name, which is the failure this whole seam exists to remove.
+ *
+ * Conservative on purpose, in this order: exact, then punctuation- and
+ * article-insensitive, then a UNIQUE containment match. Ambiguity
+ * resolves to undefined -- binding an exit to the wrong spot is worse
+ * than leaving it unbound, because unbound still gets a considered
+ * answer from the runtime while wrong is simply wrong.
+ */
+export function resolveSpotName(declared, spotNames) {
+    const want = declared.trim().toLowerCase();
+    if (want.length === 0 || spotNames.length === 0)
+        return undefined;
+    if (spotNames.includes(want))
+        return want;
+    const loosen = (s) => s.toLowerCase()
+        .replace(/[^a-z0-9\s]/g, ' ')
+        .replace(/\b(the|a|an)\b/g, ' ')
+        .replace(/\s+/g, ' ')
+        .trim();
+    const loose = loosen(want);
+    if (loose.length === 0)
+        return undefined;
+    const exactLoose = spotNames.filter(n => loosen(n) === loose);
+    if (exactLoose.length === 1)
+        return exactLoose[0];
+    const contained = spotNames.filter(n => {
+        const ln = loosen(n);
+        return ln.length > 0 && (ln.includes(loose) || loose.includes(ln));
+    });
+    return contained.length === 1 ? contained[0] : undefined;
+}
+/** A credential that is nothing but digits -- what a keypad actually takes. */
+const NUMERIC_ANSWER = /^\d+$/;
+/** Prose that promises the player a NUMBER: a pad, a dial, digits. */
+const NUMERIC_DEVICE = /\b(keypad|key pad|number pad|numeric pad|pin pad|numeric keypad|combination dial|number dial|digits?|numeric code|numeric)\b/i;
+/** Prose that promises the player WORDS: something spoken or written. */
+const SPOKEN_DEVICE = /\b(intercom|voice[- ]gate|voice panel|passphrase|password|speak|spoken|say the|watchword|countersign)\b/i;
+/**
+ * THE BARRIER MUST WANT WHAT THE ANSWER IS.
+ *
+ * Playtest 2026-08-27, 12:15: "there are conflicting numbers here for the
+ * code... let's make it less confusing", then "all these codes are wrong,
+ * it seems like the AI is just making them up".
+ *
+ * The second half was NPCs inventing credentials, fixed in the wave
+ * before this one. The first half is older and entirely separate, and it
+ * was written into the generator on purpose, two lines apart in
+ * buildPuzzlesPrompt: the riddle was invited to describe a keypad ("a
+ * keypad implies a code") while requiredPhrase was required to be "2-5
+ * plain words". So a generated keypad could never take a number, and the
+ * player who read "worn digits" and then found "double or nothing"
+ * scrawled in a notebook did not believe they had the code. They went
+ * looking for a number instead -- and every stray number in the scene
+ * became a candidate.
+ *
+ * The prompt now demands the two agree. This is the deterministic floor
+ * under that instruction, in the same spirit as ensureClueDetails: the
+ * ANSWER is authoritative (clue items quote it verbatim and solve()
+ * matches it exactly), so the presentation is what gets corrected, and
+ * it is corrected by ADDING a plain sentence rather than rewriting
+ * generated prose -- surgery on a model's sentence is how you get
+ * nonsense, and a player only needs to be told which kind of thing to
+ * type.
+ */
+export function ensureCredentialKindAgrees(details) {
+    const notes = [];
+    for (const device of details.devices ?? []) {
+        const phrase = (device.code ?? '').trim();
+        const riddle = device.description ?? '';
+        if (phrase.length === 0 || riddle.length === 0)
+            continue;
+        const answerIsNumeric = NUMERIC_ANSWER.test(phrase);
+        const promisesNumber = NUMERIC_DEVICE.test(riddle);
+        const promisesWords = SPOKEN_DEVICE.test(riddle);
+        if (!answerIsNumeric && promisesNumber && !promisesWords) {
+            // The expensive direction: the player hunts for digits that were
+            // never generated, while the words sit unrecognised in their pack.
+            device.description = `${riddle.trimEnd()} It takes a spoken passphrase, not a number.`;
+            notes.push(`device "${device.name}": description promised a number, code is a phrase -- said so plainly.`);
+            continue;
+        }
+        if (answerIsNumeric && promisesWords && !promisesNumber) {
+            device.description = `${riddle.trimEnd()} It takes a numeric code, not a spoken phrase.`;
+            notes.push(`device "${device.name}": description promised words, code is a number -- said so plainly.`);
+        }
+    }
+    return notes;
+}
 export function assembleScene(skeleton, details, playerName) {
     // The answer has to be legible before anything is assembled from it.
     ensureClueDetails(skeleton, details);
+    ensureCredentialKindAgrees(details);
     const roomDetail = new Map(details.rooms.map(r => [r.name, r]));
     const npcDetail = new Map(details.npcs.map(n => [n.name, n]));
-    const puzzleDetail = new Map(details.puzzles.map(p => [p.name, p]));
+    const deviceDetail = new Map(details.devices.map(d => [d.name, d]));
     const itemDetail = new Map(details.items.map(i => [i.name, i]));
     // "At" spots from the rooms pass, normalized before they touch the
     // seed: valid cover tags only, at most 5 spots, and a spotted room
@@ -1450,18 +1625,34 @@ export function assembleScene(skeleton, details, playerName) {
             size: detail?.size && VALID_SIZES.has(detail.size) ? detail.size : undefined,
             spots: spots.length > 0 ? spots : undefined,
             levels: levels.length > 0 ? levels : undefined,
-            // Per-exit spots, honored only when the named spot survived
-            // normalization -- an invalid one falls back to the doorway-name
-            // heuristic (utilities/spots.ts exitSpot), never a phantom place.
+            // Per-exit spots. An explicit direction -> spot binding is the
+            // ONLY thing that tells the grid which way out a doorway spot
+            // actually serves; without one the runtime falls back to matching
+            // the spot's NAME (models/room.ts namedDoorwayFor), which is how
+            // "the back door" ended up bound to a DOWN exit and seated in the
+            // middle of the floor (playtest 2026-08-27, 12:17).
+            //
+            // So a near-miss is REPAIRED rather than dropped. The model
+            // routinely names the right spot with the wrong surface form --
+            // "the loading dock" for a spot called "loading dock", "Back Door"
+            // for "back door" -- and the old exact-match test threw all of
+            // those away, silently, straight into the name heuristic.
+            //
+            // What this deliberately does NOT do is invent a binding for an
+            // exit the model left unbound. Pairing an unbound doorway to a
+            // plausible exit is the runtime's job and is being centralised
+            // there; a second implementation here is exactly the divergence
+            // that caused this bug. Unbound stays unbound, and the runtime
+            // decides -- with better information than generation has.
             exits: (room.exits ?? []).map(e => {
                 const declared = detail?.exitSpots?.[e.direction];
-                const spot = typeof declared === 'string' ? declared.trim().toLowerCase() : undefined;
+                const raw = typeof declared === 'string' ? declared.trim().toLowerCase() : undefined;
                 return {
                     direction: e.direction,
                     targetRoom: e.targetRoom,
                     keyRequired: e.keyRequired,
-                    puzzle: e.puzzle,
-                    atSpot: spot && spots.some(s => s.name === spot) ? spot : undefined,
+                    device: e.device,
+                    atSpot: raw ? resolveSpotName(raw, spots.map(s => s.name)) : undefined,
                 };
             }),
         };
@@ -1495,6 +1686,77 @@ export function assembleScene(skeleton, details, playerName) {
             }
         }
     }
+    // A GUARDED DOORWAY ALWAYS GETS A SPOT -- the one exception to the
+    // "unbound stays unbound" rule above, and it earns it.
+    //
+    // That rule is right in general: the runtime pairs a doorway to an
+    // exit with better information than generation has. But a GUARD is
+    // not paired by the runtime at all -- spots.ts holdsGround finds a
+    // blocker by reading the exit's own cell and its approach, so a guard
+    // whose exit has no spot is `guarding: true` with NO EFFECT. The
+    // player walks straight past a person the fiction says stops them.
+    //
+    // Warn-and-continue was the first instinct and it is not enough: it
+    // leaves a silent, player-visible wrong. Failing the draft is the
+    // other extreme, and it is the expensive-retry path ensureClueDetails
+    // exists to escape -- three regenerations of a 6,000-token chunk to
+    // not write one word down. So REPAIR it, deterministically, the way
+    // ensureClueDetails writes a missing phrase into its clue.
+    //
+    // Reuse before invention: a spotted room already carries a doorway
+    // spot (normalizeSpots injects one), so nearly always this just binds
+    // the exit to the door that is already there.
+    for (const room of rooms) {
+        const skel = skeleton.rooms.find(r => r.name === room.name);
+        for (const e of (room.exits ?? [])) {
+            const guarded = (skel?.exits ?? []).find(se => se.direction === e.direction)?.guard;
+            if (!guarded || e.atSpot)
+                continue;
+            const spots = (room.spots ?? []);
+            const doorish = spots.find(sp => /door|entrance|entry|threshold|gate/i.test(sp.name));
+            if (doorish) {
+                e.atSpot = doorish.name;
+            }
+            else {
+                const invented = `the ${e.direction} doorway`;
+                room.spots = [...spots, { name: invented }];
+                e.atSpot = invented;
+            }
+        }
+    }
+    // A GUARD'S POST IS DERIVED FROM WHAT THEY GUARD.
+    //
+    // exits[].guard names the person; the exit already knows its atSpot.
+    // Taking the spot from the exit rather than asking the model to also
+    // station them correctly means the fiction and the geometry cannot
+    // disagree about where the guard is standing -- and standing IN the
+    // doorway is exactly what makes them unpassable (spots.ts
+    // holdsGround reads the exit cell and its approach).
+    const guardPost = new Map();
+    for (const room of rooms) {
+        for (const e of (room.exits ?? [])) {
+            const named = (skeleton.rooms.find(r => r.name === room.name)?.exits ?? [])
+                .find(se => se.direction === e.direction)?.guard;
+            if (!named)
+                continue;
+            // Should be unreachable: the repair above gives every guarded
+            // exit a spot. Kept as a tripwire rather than deleted -- if it
+            // ever fires, a guard is standing somewhere that cannot hold a
+            // door, and that is worth a line in the log rather than silence.
+            if (!e.atSpot) {
+                // GUARDED, because assembleScene must not start REQUIRING a
+                // session just to warn about something. Logger.getInstance()
+                // throws when none has been initialised, and this function was
+                // callable without one before -- a diagnostic that can break
+                // its caller is worse than no diagnostic.
+                try {
+                    Logger.getInstance().write(`assembleScene: "${named}" guards ${room.name}'s ${e.direction} exit, but that exit has no atSpot -- they will not physically hold the doorway.`);
+                }
+                catch { /* no session: the note is a nicety, not a contract */ }
+            }
+            guardPost.set(named, { room: room.name, spot: e.atSpot });
+        }
+    }
     const npcs = skeleton.npcs.map(npc => {
         const detail = npcDetail.get(npc.name);
         const station = npcStation.get(npc.name);
@@ -1508,8 +1770,11 @@ export function assembleScene(skeleton, details, playerName) {
             dialogue: detail?.dialogue ?? [],
             player: {
                 name: npc.name,
-                startLocation: npc.startLocation,
-                startSpot,
+                // A posted guard starts where their door is, whatever the
+                // skeleton said -- the post wins over the roster.
+                startLocation: guardPost.get(npc.name)?.room ?? npc.startLocation,
+                startSpot: guardPost.get(npc.name)?.spot ?? startSpot,
+                guarding: guardPost.has(npc.name) || undefined,
                 lifestyleChoices: [],
                 combat: detail?.combat,
             },
@@ -1553,23 +1818,46 @@ export function assembleScene(skeleton, details, playerName) {
     // school, same as every other spot/exit validation in this file).
     const VALID_FOOTPRINTS = new Set(['small', 'medium', 'large']);
     const roomExitDirsByName = new Map(rooms.map(r => [r.name, new Set((r.exits ?? []).map(e => e.direction.toLowerCase()))]));
-    const puzzles = (skeleton.puzzles ?? []).map(puzzle => {
-        const detail = puzzleDetail.get(puzzle.name);
-        const guardsExit = puzzle.room && detail?.guardsExit && roomExitDirsByName.get(puzzle.room)?.has(detail.guardsExit.toLowerCase())
+    // WHICH EXIT EACH DEVICE HOLDS. Derived from the exit that names it,
+    // never asked of the model twice -- the skeleton says it once, on the
+    // exit, and this is the only place it becomes the device's own field.
+    //
+    // WITHOUT THIS THE DOOR NEVER LOCKS. scene-factory locks a door from
+    // its device's `opensExit`; a device assembled without one is a
+    // keypad beside a door that stands open, with no crash, no error and
+    // no failing test. Caught by an end-to-end probe rather than by the
+    // suite, which is exactly the failure mode this field has.
+    const heldExit = new Map();
+    for (const room of skeleton.rooms ?? []) {
+        for (const e of room.exits ?? []) {
+            if (e.device)
+                heldExit.set(e.device, e.direction);
+        }
+    }
+    const devices = (skeleton.devices ?? []).map(device => {
+        const detail = deviceDetail.get(device.name);
+        const guardsExit = device.room && detail?.guardsExit && roomExitDirsByName.get(device.room)?.has(detail.guardsExit.toLowerCase())
             ? detail.guardsExit.toLowerCase()
             : undefined;
         const footprint = guardsExit && detail?.footprint && VALID_FOOTPRINTS.has(detail.footprint) ? detail.footprint : undefined;
+        // KIND CLAMPS, never throws. A device whose kind we cannot read is
+        // still a device, and rejecting a whole draft over one word is a
+        // worse outcome than a panel where the model meant something else.
+        const kind = device.kind === 'lock' || device.kind === 'ward' ? device.kind : 'panel';
+        // A CODE ONLY BELONGS ON A PANEL -- enforced here as well as in the
+        // prompt, because the prompt is advice and this is not. You cannot
+        // talk at a mechanical lock.
+        const code = kind === 'panel' ? (detail?.code || undefined) : undefined;
         return {
-            name: puzzle.name,
-            room: puzzle.room,
-            riddle: detail?.riddle ?? puzzle.concept,
-            requiredPhrase: detail?.requiredPhrase ?? '',
-            successMessage: detail?.successMessage ?? 'It opens.',
-            failureMessage: detail?.failureMessage ?? 'Nothing happens.',
-            lockedMessage: detail?.lockedMessage,
-            requiresPuzzle: puzzle.requiresPuzzle,
-            rewardItem: puzzle.rewardItem,
-            bypassType: puzzle.bypassType,
+            name: device.name,
+            room: device.room,
+            kind,
+            opensExit: heldExit.get(device.name),
+            description: detail?.description ?? device.concept,
+            code,
+            grantsItem: device.grantsItem,
+            openMessage: detail?.openMessage ?? 'It opens.',
+            refuseMessage: detail?.refuseMessage ?? 'Nothing happens.',
             guardsExit,
             footprint,
         };
@@ -1580,10 +1868,19 @@ export function assembleScene(skeleton, details, playerName) {
         story: skeleton.story,
         currency: { type: 'nuyen', authorityRoomTags: ['Bank'] },
         residenceTiers: ['Street', 'Squatter', 'Low', 'Middle', 'High', 'Luxury'],
-        rooms,
+        rooms: rooms.map(r => ({
+            ...r,
+            // A DEVICE RIDES ITS OWN ROOM -- there is no scene-level devices[]
+            // to reconcile against room membership, because room ownership IS
+            // the placement.
+            devices: devices.filter(d => d.room === r.name).map(({ room: _room, ...d }) => d),
+        })),
         npcs,
         items,
-        puzzles,
+        // The tombstone (see types/save-file.ts): always empty, never read
+        // by this build. A generated seed is written fresh, so this is only
+        // shape-compatibility for an older reader.
+        puzzles: [],
         player: {
             name: playerName,
             startLocation: startRoom,
@@ -1619,8 +1916,8 @@ export function classifyRepair(message) {
         return 'items';
     if (/startingItems|Win condition (item|rewardItem)|items\[/i.test(message))
         return 'items';
-    if (/requiredPhrase|riddle|lockedMessage/i.test(message))
-        return 'puzzles';
+    if (/code|description|openMessage/i.test(message))
+        return 'devices';
     if (/npcs\[|dialogue/i.test(message))
         return 'npcs';
     if (/rooms\[\d+\][^]*name/i.test(message))