Reorder TODO and docs around character and map priorities

AGENTS.md

@@ -19,10 +19,23 @@ The project should be developed in small, reviewable steps. Agents must keep pla
 - `docs/architecture.md` — The arc42-style architecture documentation (goals, constraints, building blocks, runtime views, decisions, risks).
 - `docs/gameplay.md` — Gameplay systems, venues, and the escalation model.
 - `docs/asset-tooling.md` — Asset pipelines, model tools, and screenshot gates.
+- `docs/npc-model-sourcing.md` — Character-source evaluation, licence rules and the character-development plan.
 - `docs/getting-started.md` — Setup, run/test commands, and the controls table.
 - `docs/smoke-checklist.md` — The manual smoke-test checklist.
 - `docs/adr/` — Architecture Decision Records.
 
+## Priority and Versioning
+
+`TODO.md` is the priority source. The active order is:
+
+1. unversioned development tracks (currently character development and local map development);
+2. versioned release milestones, in version order;
+3. future/unversioned candidates and deferred work.
+
+Do not assign a version number to an unversioned track until its scope is accepted into a
+release. When a version is assigned, it must be the next semantic version that matches the
+scope (major/minor/patch), not a placeholder.
+
 ## Required Workflow
 
 ### 1. Start by Inspecting the Repository
@@ -47,6 +60,9 @@ All planned implementation work must be represented in `TODO.md`.
 - Use level-2 headings (`##`) for milestones or stable themes. A milestone should state its goal
   and an explicit exit criterion; a theme groups small related work that does not need a
   milestone.
+- Order level-2 sections by current priority: unversioned development tracks first, then
+  versioned release milestones in version order, then future/deferred work. Do not assign a
+  version number to an unversioned track until it is scheduled for a release.
 - Use level-3 headings (`###`) for workstreams inside a milestone (for example, `0.8.1
   First-shift tutorial`). Keep the hierarchy to three levels: milestone → workstream → checkbox.
 - Use checkbox items for each concrete task, normally under a level-3 workstream. Direct
@@ -87,6 +103,10 @@ Recommended format:
 - [ ] Document the test procedure in `README.md`.
 ```
 
+Order the actual file as described in "Priority and Versioning": unversioned development tracks
+first (for example character and local-map development), then versioned milestones in version
+order, then future/deferred work.
+
 ### 3. Move Completed Sections to `DONE.md`
 
 `TODO.md` uses nested sections. Apply these completion rules:
@@ -175,6 +195,8 @@ The root-level `CHANGELOG.md` records the user-facing changes for every release.
 
 - Add an entry for every patch, minor, and major version change.
 - Follow Semantic Versioning (`major.minor.patch`): bump major for breaking or vision-level changes, minor for new features, and patch for fixes and small polish.
+- A version increment is not complete until its `CHANGELOG.md` entry, `config/version` update and
+  matching local release build have all been produced and verified.
 - Group each entry under `Added`, `Changed`, `Fixed`, and `Removed` headings, and date every entry.
 - Describe changes in user-facing terms, not as raw commit messages.
 - Add the entry when its work ships. If the version number is not yet known, record it under `Unreleased` and move it into a numbered version when the version is tagged.
@@ -198,13 +220,33 @@ For each task:
 5. Update documentation if the change creates lasting context: add features to `docs/development-status.md`, adjust the README links or other `docs/` files as needed, and record decisions/gotchas in `MEMORY.md`.
 6. Mark the task complete.
 7. Keep completed level-3 workstreams in place until the parent milestone is complete; then move the entire level-2 milestone to `DONE.md` after recording its `CHANGELOG.md` entry.
-8. Commit the changes to the version control system with a descriptive message.
-9. If a level-2 milestone from `TODO.md` has been fully completed, ensure its `CHANGELOG.md` entry is in place, then create a new version or tag in the version control system to mark the milestone.
-10. Push the committed changes to the shared repository if applicable.
-11. Note the new version or tag created in the version control system in any relevant documentation or handoff summary.
+8. Commit each coherent, verified change as it is completed. Do not wait until a whole
+   milestone is finished; keep commits small and descriptive and push them when the branch is
+   shareable.
+9. On every major, minor or patch version increment: update `config/version`, add the
+   `CHANGELOG.md` entry, run the local release build (`tools/build_releases.sh`), verify the
+   artifacts and checksums, then commit, tag and push the version.
+10. If a level-2 milestone from `TODO.md` has been fully completed, ensure its `CHANGELOG.md`
+    entry and matching build are in place, then create the next semantic version or tag.
+11. Push committed changes to the shared repository if applicable.
+12. Note the new version, build artifacts or tag in the relevant documentation and handoff
+    summary.
 
 Avoid unrelated refactors unless they are required for the task or explicitly approved.
 
+### 9. Commit, Build and Version Discipline
+
+- **Commit often.** Make a commit after each coherent change or verified task, not only when a
+  milestone or release is finished. Keep the working tree clean between tasks where possible.
+- **Push regularly.** Push shareable commits to the shared repository; do not accumulate a long
+  local-only history.
+- **Build every version.** Major, minor and patch increments each require a local release build
+  and artifact/checksum verification before tagging. A changelog entry alone is not a release.
+- **CI is a second gate, not a substitute.** Tag builds remain automated, but the local build is
+  the required pre-tag check for every version.
+- **Unversioned tracks stay unversioned.** Character, map and other development tracks do not get
+  a placeholder version; the version is assigned when the work is scoped into a release.
+
 ## Collaboration Rules
 
 - Prefer clear, reversible changes over broad rewrites.
@@ -213,6 +255,8 @@ Avoid unrelated refactors unless they are required for the task or explicitly ap
 - Do not claim a task is complete without verification.
 - Keep documentation synchronized with the implementation.
 - Mention files changed and checks run in handoff summaries.
+- Commit coherent increments as you go; do not wait until the end of a milestone.
+- Run a release build whenever a major, minor or patch version is incremented.
 - Leave follow-up work as checkbox items in `TODO.md` rather than hiding it in prose.
 - If blocked, document the blocker in `MEMORY.md` and add a corresponding task to `TODO.md`.
 - Avoid overwriting another contributor’s work; inspect recent changes before editing shared files.

MEMORY.md

@@ -4,6 +4,16 @@ Session memory for durable decisions, state, and gotchas. Keep concise, remove o
 
 ## Decisions
 
+- **Priority order (2026-11-03):** `TODO.md` now leads with the unversioned **Character
+  development** and **Local map development** tracks, then the versioned 0.10.0 release
+  candidate and later releases. Do not attach a placeholder version to an unversioned track;
+  assign one only when its scope enters a release. Character development is generator-first
+  (ADR-0015); local map development evaluates OSM/3D data, licensed reference imagery,
+  AI-assisted composition and development-only Gaussian splatting.
+- **Commit/build discipline (2026-11-03):** commit each coherent verified change as it lands, not
+  only at milestone end, and push shareable commits. Every major, minor and patch version requires
+  a `CHANGELOG.md` entry, a local `tools/build_releases.sh` build and artifact/checksum
+  verification before tagging. CI tag builds are the second gate, not a substitute.
 - **Gaussian splatting / photo-derived maps (unversioned local track):** expanded in
   `TODO.md` "Gaussian splatting evaluation". Accepted photo channels are team captures,
   permissioned user/volunteer photos and clearly licensed downloads; every set needs a

PLAN.md

@@ -14,6 +14,23 @@ The game is about **judgment, communication, access verification, and proportion
 - **Emergency help is a last resort.** Responders handle crises the guard cannot safely manage; calling them has costs.
 - **Readability beats raw fidelity.** The GL Compatibility renderer, clear silhouettes, the focus ring, and the HUD stay legible.
 
+## Development Priorities
+
+The active planning order is set in [`TODO.md`](TODO.md) and in `AGENTS.md`:
+
+1. **Character development (unversioned).** Expand the owned procedural character library with
+   crowd, age, build, hair and outfit variety. Keep the frozen bone/tint/gear contract; see
+   [ADR-0015](docs/adr/0015-npc-model-variety-sourcing.md) and
+   [`docs/npc-model-sourcing.md`](docs/npc-model-sourcing.md). Quaternius is a reference;
+   MakeHuman is deferred to a separate local pipeline.
+2. **Local map development (unversioned).** Move beyond stylized venue reconstruction with
+   licensed OpenStreetMap and 3D building data, downloaded reference imagery for photoreal
+   facades, AI-assisted composition, and a Gaussian-splatting evaluation that stays in the
+   development pipeline unless it proves runtime-safe.
+3. **Versioned release hardening.** The 0.10.0 release candidate and later semantic versions come
+   after the unversioned development tracks in planning order. Versions are assigned only when a
+   track's scope is accepted into a release.
+
 ## Core Gameplay Loop
 
 1. Watch the entrance, steps, queue, and sidewalk.
@@ -152,14 +169,15 @@ The action wheel prioritizes de-escalation: Stop, Look, Point, No, Ask, Inspect,
 
 The visual direction is readable stylized realism:
 
-- **Blender library:** 8 skinned NPC variants, 18 gear pieces, and 20 street/venue props, with baked albedo/normal/AO/ORM maps, a manifest, and procedural fallbacks. `Rig/Head` stays the focus anchor.
+- **Character direction:** 8 skinned NPC variants, 18 gear pieces and 20 street/venue props, with four crowd-variety variants prototyped. The generator-first expansion is the active character track ([ADR-0015](docs/adr/0015-npc-model-variety-sourcing.md)); Quaternius is a reference and MakeHuman is deferred to a local pipeline.
 - **Realism pass:** AI-assisted per-phase skyline panoramas, v2 surface tiles with normal maps, wet asphalt at night, a warm day haze, phase-specific sun/exposure/fog, a visible flashlight beam, and denser foliage.
+- **Local map direction:** the venues are currently stylized reconstructions. The local-map track evaluates licensed OpenStreetMap/3D building data, licensed reference photography, AI-assisted composition and Gaussian splatting as a development tool; online data and splat rendering are not runtime dependencies.
 - **References and QA:** runtime UI art lives in `assets/images/ui/`; reference/art-direction sets live in `docs/screens/designs/` and `docs/screens/concepts/`; captures live in `docs/screenshots/`; realism runs live in `docs/screens/realism/`. `screen_designs.py compare/judge` and `tools/check_screenshots.sh` guard drift.
 - **Storage convention:** see [ADR-0014](docs/adr/0014-runtime-image-root.md). Never overwrite an existing image; new outputs get a new path or `-vN` suffix.
 
-The path from the current vertical slice to the 0.10.0 release candidate — content depth, onboarding, accessibility, platform QA and release readiness — is tracked in [`TODO.md`](TODO.md); this plan stays at the product/design level.
+The active planning order — unversioned character and local-map development first, then the versioned 0.10.0 release-candidate hardening and later releases — is tracked in [`TODO.md`](TODO.md); this plan stays at the product/design level.
 
-Primary decisions: [ADR-0007](docs/adr/0007-locomotion-and-input-layers.md), [ADR-0008](docs/adr/0008-cone-focus-and-head-ring.md), [ADR-0009](docs/adr/0009-radial-action-menu.md), [ADR-0010](docs/adr/0010-procedural-npc-presentation.md), [ADR-0011](docs/adr/0011-aim-free-selection-and-precision-walk.md), [ADR-0012](docs/adr/0012-surface-materials-and-generated-props.md), [ADR-0013](docs/adr/0013-blender-authored-npc-characters.md).
+Primary decisions: [ADR-0007](docs/adr/0007-locomotion-and-input-layers.md), [ADR-0008](docs/adr/0008-cone-focus-and-head-ring.md), [ADR-0009](docs/adr/0009-radial-action-menu.md), [ADR-0010](docs/adr/0010-procedural-npc-presentation.md), [ADR-0011](docs/adr/0011-aim-free-selection-and-precision-walk.md), [ADR-0012](docs/adr/0012-surface-materials-and-generated-props.md), [ADR-0013](docs/adr/0013-blender-authored-npc-characters.md), [ADR-0015](docs/adr/0015-npc-model-variety-sourcing.md).
 
 ## Tech Stack
 
@@ -176,7 +194,7 @@ Primary decisions: [ADR-0007](docs/adr/0007-locomotion-and-input-layers.md), [AD
 
 ## Versioning and Delivery
 
-`config/version` in `project.godot` is the single version source (currently `0.10.0-rc.1`). Releases are tagged `v<version>`; the CI pipeline builds and publishes the standard artifacts plus the optional Desktop HQ zip. Version bumps follow [Semantic Versioning](https://semver.org/). See [`docs/RELEASING.md`](docs/RELEASING.md) and [`README.md`](README.md) for commands.
+`config/version` in `project.godot` is the single version source (currently `0.10.0-rc.1`). Releases are tagged `v<version>`; the CI pipeline builds and publishes the standard artifacts plus the optional Desktop HQ zip. Version bumps follow [Semantic Versioning](https://semver.org/): every major, minor and patch increment needs a changelog entry, a local `tools/build_releases.sh` build, and artifact/checksum verification before tagging. Unversioned development tracks do not receive a version until their scope enters a release. See [`docs/RELEASING.md`](docs/RELEASING.md) and [`README.md`](README.md) for commands.
 
 ## Design Direction
 
@@ -189,4 +207,3 @@ The game should feel like a tense workplace simulation with occasional crisis mo
 - A rare Bob Dobbs cameo (Easter-egg appearance; placement note in `MEMORY.md`).
 - Specific unusual NPC behaviors, such as slapping their own face, using hands as scissors, or interacting with props unexpectedly.
 - Live 3D body-camera replay; additional venues or seasonal events; real voice/dialogue audio; an image-to-mesh prop pipeline.
-- More varied NPC silhouettes (age, build, hair and outfit), using either an extended procedural character generator or a reviewed CC0/CC-BY source; the evaluation and pending decision are in `docs/npc-model-sourcing.md`.

README.md

@@ -6,6 +6,16 @@ The central design goal is simple:
 
 > The player wins by choosing the lowest level of escalation that keeps everyone safe.
 
+## Development Priorities
+
+The active planning order lives in [`TODO.md`](TODO.md) and [`AGENTS.md`](AGENTS.md):
+
+1. **Character development** — crowd, age, build, hair and outfit variety on the owned procedural library, keeping the frozen NPC contract. Source evaluation and the licence decision are in [`docs/npc-model-sourcing.md`](docs/npc-model-sourcing.md).
+2. **Local map development** — licensed OpenStreetMap/3D data, reference-derived photoreal facades, AI-assisted composition and a Gaussian-splatting development evaluation.
+3. **Versioned release hardening** — the 0.10.0 release candidate and later semantic versions follow the unversioned development tracks.
+
+Versions are assigned only when a track's scope is accepted into a release. Every major, minor and patch version requires a changelog entry, a local release build and artifact verification before tagging.
+
 ## Screenshots
 
 | | |
@@ -107,12 +117,14 @@ Full setup, every run/test/smoke command, and the controls table are in
 
 ## Project Documentation
 
-- [`PLAN.md`](PLAN.md) — Game design plan and scenario details.
-- [`AGENTS.md`](AGENTS.md) — Development and collaboration workflow.
+- [`PLAN.md`](PLAN.md) — Game design plan, development priorities and scenario details.
+- [`TODO.md`](TODO.md) — Priority-ordered tasks: character and local-map development, release milestones, and future work.
+- [`docs/README.md`](docs/README.md) — Documentation index, current priorities and visual previews.
+- [`docs/npc-model-sourcing.md`](docs/npc-model-sourcing.md) — Character-source evaluation, licence rules and the character-development plan.
+- [`AGENTS.md`](AGENTS.md) — Development, commit, build and collaboration workflow.
 - [`DONE.md`](DONE.md) — Completed task sections.
 - [`MEMORY.md`](MEMORY.md) — Persistent session notes.
 - [`CHANGELOG.md`](CHANGELOG.md) — User-facing changes by version.
-- [`docs/README.md`](docs/README.md) — Documentation index and visual previews.
 - [`docs/architecture.md`](docs/architecture.md) — arc42-style architecture documentation.
 - [`docs/gameplay.md`](docs/gameplay.md) — Gameplay systems, venues, and the escalation model.
 - [`docs/hollywood-boulevard-map.md`](docs/hollywood-boulevard-map.md) — Real-site references, game mapping and limitations for the Hollywood venue.
@@ -130,7 +142,6 @@ Full setup, every run/test/smoke command, and the controls table are in
 - [`docs/npc-visual-review.md`](docs/npc-visual-review.md) — 0.9.4 NPC baseline, acceptance criteria and ranked visual gaps; 0.9.5 texture comparison is in [`docs/blender_previews/sheet_texture_refinement_0.9.5.jpg`](docs/blender_previews/sheet_texture_refinement_0.9.5.jpg).
 - [`docs/npc-proportion-audit.md`](docs/npc-proportion-audit.md) — NPC proportion measurements against the shared stylized guide.
 - [`docs/adr/`](docs/adr/) — Architecture Decision Records.
-- [`TODO.md`](TODO.md) — Active tasks plus the 0.x gap analysis and milestone roadmap.
 
 ## Development Status
 
@@ -141,9 +152,12 @@ Walk of Fame/awning surfaces and per-phase skyline haze), on top of the v0.9.4
 NPC visual optimization and the v0.9.3 UI/accessibility polish pass. It builds on
 v0.9.2's Hollywood/Joke Shop map rebuilds, v0.9.1's Godot 4.7.2 baseline,
 v0.9.0's production-quality pass, v0.8's
-tutorial/campaign/resume work and the v0.7.x venue/gear/judge work. See [`docs/development-status.md`](docs/development-status.md)
-for the implemented list and [`TODO.md`](TODO.md) for the 0.x roadmap. Manual
-verification uses the [`docs/smoke-checklist.md`](docs/smoke-checklist.md).
+tutorial/campaign/resume work and the v0.7.x venue/gear/judge work. The active
+planning priorities are the unversioned character and local-map development tracks;
+the 0.10.0 release candidate is the next versioned release. See
+[`docs/development-status.md`](docs/development-status.md) for the implemented list
+and [`TODO.md`](TODO.md) for the priority-ordered roadmap. Manual verification uses
+the [`docs/smoke-checklist.md`](docs/smoke-checklist.md).
 
 ## Credits, Privacy and Accessibility
 

TODO.md

@@ -3,210 +3,16 @@
 Work is grouped by theme. Each item should be small enough to complete and verify on its own;
 see `AGENTS.md` for the workflow and `MEMORY.md` for the decisions behind these plans.
 
-## Gap Analysis and 0.x Roadmap
-
-Baseline: **v0.9.6** (2026-11-03). Three playable venues, tutorial/campaign/checkpoint resume,
-difficulty/help, audio/accessibility settings, a 24-NPC budget baseline, a complete
-escalation/access/radio loop, shift review, the Blender asset library, 272 headless + 101 Python
-tests, a 21/21 clean screen-design judge and an optional Forward+ Desktop HQ build. This is a strong
-release-candidate foundation, not yet a 0.10.0 release candidate.
-
-### Documentation audit (completed 2026-11-01)
-
-- [x] Make `docs/architecture.md` the single architecture source: asset/content pipeline
-      contracts, runtime venue-switch/fallback flows, deployment/version constraints, quality
-      requirements, risk register and documentation ownership map.
-- [x] Keep command-heavy operational pages separate but subordinate: `docs/asset-tooling.md`,
-      `docs/blender-assets.md`, `docs/getting-started.md`, `docs/RELEASING.md` and
-      `docs/smoke-checklist.md` link to architecture rather than acting as parallel sources.
-- [x] Remove the obsolete `docs/plan-graphics-v0.6.md` and its links; completed graphics work is
-      represented by ADR-0013, the asset pipeline section and the changelog.
-- [x] Resolve stale claims: README release version/download row, development status
-      "Forward+ not implemented", and Blender props "not AO-baked".
-- [x] Record the documentation ownership rule in `docs/architecture.md` §12: design intent
-      (`PLAN.md`), mechanics (`gameplay.md`), system architecture/contracts (`architecture.md`),
-      decisions (ADRs), status (`development-status.md`), roadmap (`TODO.md`), operations
-      (tooling/release docs).
-
-### Gap register (remaining roadmap)
-
-| Area | Current baseline | Remaining gap | Risk | Milestone |
-| --- | --- | --- | --- | --- |
-| Content and balance | 3 venues with validated 12+ event matrices, recovery events and contextual dialogue | External playtest evidence, balance/fairness pass, event-weight tuning and final content lock | Repetition or unfair outcomes survive into the release candidate | 0.10.0 |
-| Dialog/UI | Audited terminology, copy, button states, focus/navigation, modal close, long strings and all 21 screen captures | Keep the capture/compare/judge gate current as content changes | Low; the remaining risk is drift after new UI is added | Complete (0.9.3) |
-| Animation/presentation | Procedural pose layers, portrait captures, reduced hem clipping, 8,000/8,000 NPC cap | Thorough NPC silhouette/face/gear/pose/LOD optimization before visual QA | Close-up jank reduces perceived quality | Complete (0.9.4) |
-| Audio/accessibility | Procedural ambience/SFX, volume controls, captions/reduce-motion settings, searchable Help | Full accessibility/localization acceptance review, audio caption coverage and P0/P1 fixes | Public release cannot claim accessible play | 0.10.0 |
-| Localization | English JSON table, validation and input-generated Help | Pseudo-locale/layout audit and translator workflow sign-off | Text expansion/clipping at release | 0.10.0 |
-| Performance/platform | 24-NPC headless budget (6.94 ms), Compatibility/Web/HQ paths | Target hardware matrix, Web/HQ manual profiling, frame-time/memory evidence | Platform-specific drops or startup failures | 0.9.6 / 0.10.0 |
-| Save lifecycle | Settings/campaign/history/checkpoint files, atomic writes | Migration fixtures from 0.8/0.9, fresh-install/upgrade verification, rollback instructions | Player progress loss on upgrade | 0.10.0 |
-| QA/CI | Headless suite, smokes, screenshot compare, 21/21 judge | Release-candidate smoke matrix, final gallery and release dry run | Regressions escape the release gate | 0.9.6 / 0.10.0 |
-| Release/legal | Unsigned desktop/macOS builds, Web/HQ packages | Signing/notarization decision, checksums, AI-asset provenance, credits, privacy/body-camera and rating review | Public release blocked by trust/policy | 0.10.0 |
-| Documentation | Architecture/ADR/status/roadmap ownership established | Final README/changelog/status/TODO/smoke-checklist sign-off and known-limitations page | Docs drift at launch | 0.9.6 / 0.10.0 |
-| Future 0.x | Stable 0.x feature set | Live replay, more venues, VO/music, image-to-mesh props and seasonal content | Scope creep before release | Unscheduled |
-
-**Current priority:** map optimization, the **pre-build NPC revisit**, the
-**0.9.3 UI polish**, **0.9.4 NPC visual optimization**, **0.9.5 texture
-refinement** and **0.9.6 integration** passes are complete (all moved to
-`DONE.md`). The **0.10.0 release candidate** is next: content lock, external
-playtest, balance, save migration and release/legal sign-off. The source version
-is 0.10.0-rc.1; the v0.9.6 release is published.
-
-## Milestone 0.10.0 — Release candidate
-
-Goal: freeze the feature set, prove it with external players, clear release/legal blockers and
-verify every distribution path. This is the next minor release after the 0.9.x patch line.
-
-### Content lock and external playtest
-
-- [x] Declare a content/feature freeze for 0.10.0; only release-blocking fixes and balance changes
-      may land after the freeze. (Frozen 2026-11-03 after the 0.9.6 integration
-      checkpoint; this pass is limited to release reliability, accessibility,
-      balance evidence and packaging.)
-- [x] Produce a release-candidate build with the tutorial, campaign, all three venues, Help,
-      accessibility settings and checkpoint/resume enabled. (Clean worktree
-      `a9658ec` built `0.10.0-rc.1`: Linux 161.5 MB, Windows 197.2 MB, macOS
-      148.0 MB, Web 97.8 MB and HQ 241.6 MB. The Web/HQ archives include the
-      credits, privacy, accessibility and known-limitations pages; SHA-256
-      manifests were written; the Linux and HQ binaries launched headless and the
-      Web index/wasm/pck/docs returned HTTP 200. Not published because external
-      playtest and legal approval remain open.)
-- [ ] Run at least five first-time-player sessions covering the tutorial and one full venue shift;
-      record where players get stuck, misunderstand evidence or choose disproportionate escalation.
-- [ ] Triage findings by severity (P0/P1/P2) and fix every P0/P1 onboarding/accessibility issue;
-      keep the rest as explicit known limitations or post-0.10 items.
-- [ ] Re-run the affected tutorial/campaign smokes after each fix and capture a fresh first-hour
-      walkthrough for the release notes.
-
-### Balance and fairness pass
-
-- [x] Define measurable targets for routine compliance, access-decision accuracy, peaceful
-      resolution, justified emergency calls and false-positive/false-negative rates.
-      (`docs/balance-acceptance.md` defines cohorts, denominators, 36 matrix cells,
-      seeds, thresholds and matched emergency-first comparisons. Documentation verified;
-      targets are not measured results.)
-- [ ] Run scripted venue sweeps across easy/normal/hard and all four phases; compare outcomes and
-      tune event weights, reaction tables, compliance and report strictness where targets fail.
-- [ ] Review emergency calls against actual danger: no routine behavior should make emergency the
-      dominant winning move, and genuine threats must remain answerable. Include the
-      type-derived `_read_npc_truth()` mismatch with observed threats/forced entry;
-      use independently labelled behavior evidence, not the helper as its own oracle.
-- [ ] Verify the reputation grades, debrief explanations and campaign progression still communicate
-      the de-escalation-first design after tuning.
-- [ ] Record the balance evidence and any deliberate exceptions in `docs/development-status.md`
-      or `MEMORY.md`.
-
-### Save migration and session reliability
-
-- [x] Add fixtures for a 0.8-era settings/campaign/history save and a 0.9.0 checkpoint; verify
-      migration/default-filling and a clean first launch with no files. (Committed
-      fixtures under `src/test/fixtures/saves/`; 9 migration/failure tests cover
-      old settings/campaign/history, the 0.9.0 checkpoint, all three venue
-      checkpoint round-trips, clean install, corrupt JSON and a blocked atomic
-      replace. Suite is now 272 tests.)
-- [x] Test fresh install → tutorial → campaign → pause → quit → resume → review → next venue on
-      an isolated user-data directory. (Tutorial and campaign smokes shared one
-      isolated `XDG_DATA_HOME`; tutorial completion/replay/skip then campaign
-      resume/review-continue/help both passed. Pause/menu behavior is covered by
-      `smoke_session_shell.gd`.)
-- [x] Test corrupt JSON, partial temp files, missing optional fields and a failed atomic rename;
-      confirm fallback behavior never destroys a valid save. (Corrupt/partial files
-      fall back to defaults; a blocked temp path reports an error and leaves the
-      prior valid settings intact. `_load_json` now uses the non-logging JSON
-      instance parser.)
-- [x] Verify checkpoint resume after all three venues, after an incident, with NPCs at the door and
-      with flashlight/body-camera/door state set. (The migration suite round-trips a
-      checkpoint for Hollywood, the Joke Shop and the TV Studio with an open
-      incident, one NPC row, flashlight/body-camera/door flags; the campaign smoke
-      resumes a live checkpoint through the real `GameManager`.)
-- [x] Document save locations, schema versions, reset behavior and rollback/export instructions in
-      `docs/getting-started.md` and the release notes. (`getting-started.md` now
-      documents the four files, version-1 checkpoint, atomic write/fallback,
-      clean install, reset and backup/rollback.)
-
-### Release engineering and distribution
-
-- [x] Run `tools/build_releases.sh` from a clean checkout and verify Linux/Windows/macOS/Web/HQ
-      artifact names, sizes and checksums. (Clean worktree `a9658ec` built the
-      five artifacts listed above; `PUBLISH_DRY_RUN=1` produced and printed
-      `build/SHA256SUMS-0.10.0-rc.1.txt` without touching the API.)
-- [ ] Smoke-test fresh Linux portable/AppImage, Windows portable/installer, macOS unzip/launch,
-      Web static hosting and Desktop HQ Vulkan fallback on the target matrix.
-      (Linux portable and Desktop HQ launched headless; Web files served over a
-      local static server with HTTP 200. AppImage/installer were not built locally
-      and Windows/macOS launch testing still needs the target matrix.)
-- [x] Add a disk-space preflight and retention policy to the release/publish scripts so a full
-      Gitea host cannot leave a partially uploaded release. (`publish_release.sh`
-      checks artifact size/free space, writes SHA-256 checksums, supports
-      `PUBLISH_DRY_RUN`, rolls back uploaded assets/new releases on failure, and
-      offers opt-in `RETAIN_RELEASES` pruning; dry-run verified.)
-- [x] Verify release metadata, tag/version consistency, asset counts and download links; retain
-      at least the latest 0.8/0.9 releases and document older-asset pruning.
-      (Source/version and tag are both 0.9.6; all seven published releases carry
-      5–7 assets, including the retained v0.8.0/v0.8.1/v0.9.0/v0.9.1 line.
-      `publish_release.sh` documents opt-in `RETAIN_RELEASES` pruning and
-      `RELEASING.md` describes the seven-release policy.)
-- [x] Decide and document whether macOS signing/notarization is required for 0.10.0 or explicitly
-      remains a future release blocker; record the quarantine instructions either way.
-      (0.10.0 ships unsigned with quarantine instructions; signing/notarization
-      remains an explicit public-release blocker in `RELEASING.md` and
-      `known-limitations.md`.)
-
-### Legal, credits and platform policy
-
-- [x] Audit AI-assisted asset provenance and licenses; record source/model usage and any
-      redistribution constraints for textures, characters, props and UI art.
-      (`CREDITS.md` records the Blender/OpenRouter toolchain, default model slugs,
-      missing per-file generation metadata and the commercial-rights review as an
-      explicit release blocker.)
-- [x] Audit audio/SFX/music licensing (or confirm everything is procedural) and add a credits file.
-      (All runtime audio is procedural; no external music/SFX files are bundled.
-      `CREDITS.md` records this.)
-- [x] Review body-camera/privacy language, mental-health-crisis representation, age/content rating
-      and storefront requirements; fix any release-blocking copy or content.
-      (`PRIVACY.md` clarifies the simulated body camera/local-only data; the
-      accessibility and known-limitations pages record the remaining
-      mental-health/rating/storefront review as a release blocker rather than
-      claiming approval.)
-- [x] Add the player-facing credits, known limitations, accessibility statement and privacy note to
-      the release package/README. (`README.md` links `CREDITS.md`, `PRIVACY.md`,
-      `docs/accessibility.md` and `docs/known-limitations.md`; the Web and Desktop
-      HQ package builders copy those documents into the shipped archives.)
-- [ ] Mark external legal/storefront approval as complete or explicitly block the 0.10.0 release on it.
-
-### Documentation and visual sign-off
-
-- [ ] Update `README.md`, `PLAN.md`, `docs/architecture.md`, ADRs, `docs/development-status.md`,
-      `docs/getting-started.md`, `docs/smoke-checklist.md`, `CHANGELOG.md` and this roadmap.
-- [ ] Regenerate the full screenshot gallery and realism baselines after content lock; run
-      `check_screenshots.sh` and the pinned vision judge, recording model/spend/verdicts.
-- [ ] Run the manual smoke checklist on every target and attach/link the release-candidate evidence.
-- [ ] Verify the tutorial/campaign/help text at maximum font scale and with the longest strings.
-- [x] Remove or archive stale plans/notes and confirm no contradictory version/status claims remain.
-- [x] Document the character development toolchain in `docs/architecture.md`: base vs library
-      sources, tool/artifact/gate table, runtime attach/animation contracts and rebuild discipline.
-      (Added §5 "Character development tooling" plus risk and ownership-map updates;
-      documentation check passed.)
-
-### Release-candidate QA and exit
-
-- [ ] Run the complete headless suite, Python tooling, tutorial/campaign/session/scenario smokes,
-      24-NPC budget smoke and release build from a clean checkout.
-- [ ] Run the manual QA matrix: fresh install, upgrade, offline launch, gamepad, accessibility
-      settings, pause/resume, all venues and Desktop HQ fallback.
-- [ ] Confirm no P0/P1 defects remain; P2 items must be documented as known limitations or
-      post-0.10 work.
-- [ ] Create the `v0.10.0` version bump, changelog entry and tag; build/publish the release and
-      verify all assets and download links.
-- [ ] Exit: the release candidate is content-locked, externally played, legally reviewed,
-      documented, reproducibly built, and approved as the 0.10.0 release candidate.
+**Priority order:** Character development → Local map development → versioned release milestones →
+future/deferred work. See `AGENTS.md` §Priority and Versioning.
 
 ## Character development
 
 Goal: break the eight-character clone effect with four licence-cleared crowd-variety looks while
 keeping the frozen `npc_base` bone, tint-slot and gear-attach contract. The procedural generator is
 the primary path; Quaternius is a reviewed reference and MakeHuman is deferred to a separate local
-development pipeline. Start only after the current release candidate is published; this work must
-not delay the release.
+development pipeline. This is the current development priority; keep it out of the frozen
+0.10.0 release candidate and assign a release version only when its scope is accepted.
 
 ### Source review and decision
 
@@ -432,6 +238,206 @@ reference-image licence and privacy gates above rather than replacing them.
       facades, passes performance/navigation/visual QA and has complete provenance; or the
       pipeline is rejected with the findings recorded.
 
+## Milestone 0.10.0 — Release candidate
+
+Goal: freeze the feature set, prove it with external players, clear release/legal blockers and
+verify every distribution path. This remains the next versioned release after the 0.9.x patch
+line, but follows the unversioned character and local-map tracks in planning order.
+
+### Content lock and external playtest
+
+- [x] Declare a content/feature freeze for 0.10.0; only release-blocking fixes and balance changes
+      may land after the freeze. (Frozen 2026-11-03 after the 0.9.6 integration
+      checkpoint; this pass is limited to release reliability, accessibility,
+      balance evidence and packaging.)
+- [x] Produce a release-candidate build with the tutorial, campaign, all three venues, Help,
+      accessibility settings and checkpoint/resume enabled. (Clean worktree
+      `a9658ec` built `0.10.0-rc.1`: Linux 161.5 MB, Windows 197.2 MB, macOS
+      148.0 MB, Web 97.8 MB and HQ 241.6 MB. The Web/HQ archives include the
+      credits, privacy, accessibility and known-limitations pages; SHA-256
+      manifests were written; the Linux and HQ binaries launched headless and the
+      Web index/wasm/pck/docs returned HTTP 200. Not published because external
+      playtest and legal approval remain open.)
+- [ ] Run at least five first-time-player sessions covering the tutorial and one full venue shift;
+      record where players get stuck, misunderstand evidence or choose disproportionate escalation.
+- [ ] Triage findings by severity (P0/P1/P2) and fix every P0/P1 onboarding/accessibility issue;
+      keep the rest as explicit known limitations or post-0.10 items.
+- [ ] Re-run the affected tutorial/campaign smokes after each fix and capture a fresh first-hour
+      walkthrough for the release notes.
+
+### Balance and fairness pass
+
+- [x] Define measurable targets for routine compliance, access-decision accuracy, peaceful
+      resolution, justified emergency calls and false-positive/false-negative rates.
+      (`docs/balance-acceptance.md` defines cohorts, denominators, 36 matrix cells,
+      seeds, thresholds and matched emergency-first comparisons. Documentation verified;
+      targets are not measured results.)
+- [ ] Run scripted venue sweeps across easy/normal/hard and all four phases; compare outcomes and
+      tune event weights, reaction tables, compliance and report strictness where targets fail.
+- [ ] Review emergency calls against actual danger: no routine behavior should make emergency the
+      dominant winning move, and genuine threats must remain answerable. Include the
+      type-derived `_read_npc_truth()` mismatch with observed threats/forced entry;
+      use independently labelled behavior evidence, not the helper as its own oracle.
+- [ ] Verify the reputation grades, debrief explanations and campaign progression still communicate
+      the de-escalation-first design after tuning.
+- [ ] Record the balance evidence and any deliberate exceptions in `docs/development-status.md`
+      or `MEMORY.md`.
+
+### Save migration and session reliability
+
+- [x] Add fixtures for a 0.8-era settings/campaign/history save and a 0.9.0 checkpoint; verify
+      migration/default-filling and a clean first launch with no files. (Committed
+      fixtures under `src/test/fixtures/saves/`; 9 migration/failure tests cover
+      old settings/campaign/history, the 0.9.0 checkpoint, all three venue
+      checkpoint round-trips, clean install, corrupt JSON and a blocked atomic
+      replace. Suite is now 272 tests.)
+- [x] Test fresh install → tutorial → campaign → pause → quit → resume → review → next venue on
+      an isolated user-data directory. (Tutorial and campaign smokes shared one
+      isolated `XDG_DATA_HOME`; tutorial completion/replay/skip then campaign
+      resume/review-continue/help both passed. Pause/menu behavior is covered by
+      `smoke_session_shell.gd`.)
+- [x] Test corrupt JSON, partial temp files, missing optional fields and a failed atomic rename;
+      confirm fallback behavior never destroys a valid save. (Corrupt/partial files
+      fall back to defaults; a blocked temp path reports an error and leaves the
+      prior valid settings intact. `_load_json` now uses the non-logging JSON
+      instance parser.)
+- [x] Verify checkpoint resume after all three venues, after an incident, with NPCs at the door and
+      with flashlight/body-camera/door state set. (The migration suite round-trips a
+      checkpoint for Hollywood, the Joke Shop and the TV Studio with an open
+      incident, one NPC row, flashlight/body-camera/door flags; the campaign smoke
+      resumes a live checkpoint through the real `GameManager`.)
+- [x] Document save locations, schema versions, reset behavior and rollback/export instructions in
+      `docs/getting-started.md` and the release notes. (`getting-started.md` now
+      documents the four files, version-1 checkpoint, atomic write/fallback,
+      clean install, reset and backup/rollback.)
+
+### Release engineering and distribution
+
+- [x] Run `tools/build_releases.sh` from a clean checkout and verify Linux/Windows/macOS/Web/HQ
+      artifact names, sizes and checksums. (Clean worktree `a9658ec` built the
+      five artifacts listed above; `PUBLISH_DRY_RUN=1` produced and printed
+      `build/SHA256SUMS-0.10.0-rc.1.txt` without touching the API.)
+- [ ] Smoke-test fresh Linux portable/AppImage, Windows portable/installer, macOS unzip/launch,
+      Web static hosting and Desktop HQ Vulkan fallback on the target matrix.
+      (Linux portable and Desktop HQ launched headless; Web files served over a
+      local static server with HTTP 200. AppImage/installer were not built locally
+      and Windows/macOS launch testing still needs the target matrix.)
+- [x] Add a disk-space preflight and retention policy to the release/publish scripts so a full
+      Gitea host cannot leave a partially uploaded release. (`publish_release.sh`
+      checks artifact size/free space, writes SHA-256 checksums, supports
+      `PUBLISH_DRY_RUN`, rolls back uploaded assets/new releases on failure, and
+      offers opt-in `RETAIN_RELEASES` pruning; dry-run verified.)
+- [x] Verify release metadata, tag/version consistency, asset counts and download links; retain
+      at least the latest 0.8/0.9 releases and document older-asset pruning.
+      (Source/version and tag are both 0.9.6; all seven published releases carry
+      5–7 assets, including the retained v0.8.0/v0.8.1/v0.9.0/v0.9.1 line.
+      `publish_release.sh` documents opt-in `RETAIN_RELEASES` pruning and
+      `RELEASING.md` describes the seven-release policy.)
+- [x] Decide and document whether macOS signing/notarization is required for 0.10.0 or explicitly
+      remains a future release blocker; record the quarantine instructions either way.
+      (0.10.0 ships unsigned with quarantine instructions; signing/notarization
+      remains an explicit public-release blocker in `RELEASING.md` and
+      `known-limitations.md`.)
+
+### Legal, credits and platform policy
+
+- [x] Audit AI-assisted asset provenance and licenses; record source/model usage and any
+      redistribution constraints for textures, characters, props and UI art.
+      (`CREDITS.md` records the Blender/OpenRouter toolchain, default model slugs,
+      missing per-file generation metadata and the commercial-rights review as an
+      explicit release blocker.)
+- [x] Audit audio/SFX/music licensing (or confirm everything is procedural) and add a credits file.
+      (All runtime audio is procedural; no external music/SFX files are bundled.
+      `CREDITS.md` records this.)
+- [x] Review body-camera/privacy language, mental-health-crisis representation, age/content rating
+      and storefront requirements; fix any release-blocking copy or content.
+      (`PRIVACY.md` clarifies the simulated body camera/local-only data; the
+      accessibility and known-limitations pages record the remaining
+      mental-health/rating/storefront review as a release blocker rather than
+      claiming approval.)
+- [x] Add the player-facing credits, known limitations, accessibility statement and privacy note to
+      the release package/README. (`README.md` links `CREDITS.md`, `PRIVACY.md`,
+      `docs/accessibility.md` and `docs/known-limitations.md`; the Web and Desktop
+      HQ package builders copy those documents into the shipped archives.)
+- [ ] Mark external legal/storefront approval as complete or explicitly block the 0.10.0 release on it.
+
+### Documentation and visual sign-off
+
+- [ ] Update `README.md`, `PLAN.md`, `docs/architecture.md`, ADRs, `docs/development-status.md`,
+      `docs/getting-started.md`, `docs/smoke-checklist.md`, `CHANGELOG.md` and this roadmap.
+- [ ] Regenerate the full screenshot gallery and realism baselines after content lock; run
+      `check_screenshots.sh` and the pinned vision judge, recording model/spend/verdicts.
+- [ ] Run the manual smoke checklist on every target and attach/link the release-candidate evidence.
+- [ ] Verify the tutorial/campaign/help text at maximum font scale and with the longest strings.
+- [x] Remove or archive stale plans/notes and confirm no contradictory version/status claims remain.
+- [x] Document the character development toolchain in `docs/architecture.md`: base vs library
+      sources, tool/artifact/gate table, runtime attach/animation contracts and rebuild discipline.
+      (Added §5 "Character development tooling" plus risk and ownership-map updates;
+      documentation check passed.)
+
+### Release-candidate QA and exit
+
+- [ ] Run the complete headless suite, Python tooling, tutorial/campaign/session/scenario smokes,
+      24-NPC budget smoke and release build from a clean checkout.
+- [ ] Run the manual QA matrix: fresh install, upgrade, offline launch, gamepad, accessibility
+      settings, pause/resume, all venues and Desktop HQ fallback.
+- [ ] Confirm no P0/P1 defects remain; P2 items must be documented as known limitations or
+      post-0.10 work.
+- [ ] Create the `v0.10.0` version bump, changelog entry and tag; build/publish the release and
+      verify all assets and download links.
+- [ ] Exit: the release candidate is content-locked, externally played, legally reviewed,
+      documented, reproducibly built, and approved as the 0.10.0 release candidate.
+
+## Gap Analysis and 0.x Roadmap
+
+Baseline: **v0.9.6** (2026-11-03). Three playable venues, tutorial/campaign/checkpoint resume,
+difficulty/help, audio/accessibility settings, a 24-NPC budget baseline, a complete
+escalation/access/radio loop, shift review, the Blender asset library, 272 headless + 101 Python
+tests, a 21/21 clean screen-design judge and an optional Forward+ Desktop HQ build. This is the
+baseline; 0.10.0-rc.1 is the current candidate source, with release approvals still open.
+
+### Documentation audit (completed 2026-11-01)
+
+- [x] Make `docs/architecture.md` the single architecture source: asset/content pipeline
+      contracts, runtime venue-switch/fallback flows, deployment/version constraints, quality
+      requirements, risk register and documentation ownership map.
+- [x] Keep command-heavy operational pages separate but subordinate: `docs/asset-tooling.md`,
+      `docs/blender-assets.md`, `docs/getting-started.md`, `docs/RELEASING.md` and
+      `docs/smoke-checklist.md` link to architecture rather than acting as parallel sources.
+- [x] Remove the obsolete `docs/plan-graphics-v0.6.md` and its links; completed graphics work is
+      represented by ADR-0013, the asset pipeline section and the changelog.
+- [x] Resolve stale claims: README release version/download row, development status
+      "Forward+ not implemented", and Blender props "not AO-baked".
+- [x] Record the documentation ownership rule in `docs/architecture.md` §12: design intent
+      (`PLAN.md`), mechanics (`gameplay.md`), system architecture/contracts (`architecture.md`),
+      decisions (ADRs), status (`development-status.md`), roadmap (`TODO.md`), operations
+      (tooling/release docs).
+
+### Gap register (remaining roadmap)
+
+| Area | Current baseline | Remaining gap | Risk | Milestone |
+| --- | --- | --- | --- | --- |
+| Character development | 8-variant library; source/licence review and Quaternius/MakeHuman evaluation complete | Four crowd variants, role pools, gear fit and runtime integration | Repetition remains or external assets break the contract | Unversioned |
+| Local map development | Stylized venue geometry and reference maps | OSM/3D data, photoreal references, AI-assisted composition and splat evaluation | Licensing/provenance or performance failure | Unversioned |
+| Content and balance | 3 venues with validated 12+ event matrices, recovery events and contextual dialogue | External playtest evidence, balance/fairness pass, event-weight tuning and final content lock | Repetition or unfair outcomes survive into the release candidate | 0.10.0 |
+| Dialog/UI | Audited terminology, copy, button states, focus/navigation, modal close, long strings and all 21 screen captures | Keep the capture/compare/judge gate current as content changes | Low; the remaining risk is drift after new UI is added | Complete (0.9.3) |
+| Animation/presentation | Procedural pose layers, portrait captures, reduced hem clipping, 8,000/8,000 NPC cap | Thorough NPC silhouette/face/gear/pose/LOD optimization before visual QA | Close-up jank reduces perceived quality | Complete (0.9.4) |
+| Audio/accessibility | Procedural ambience/SFX, volume controls, captions/reduce-motion settings, searchable Help | Full accessibility/localization acceptance review, audio caption coverage and P0/P1 fixes | Public release cannot claim accessible play | 0.10.0 |
+| Localization | English JSON table, validation and input-generated Help | Pseudo-locale/layout audit and translator workflow sign-off | Text expansion/clipping at release | 0.10.0 |
+| Performance/platform | 24-NPC headless budget (6.94 ms), Compatibility/Web/HQ paths | Target hardware matrix, Web/HQ manual profiling, frame-time/memory evidence | Platform-specific drops or startup failures | 0.9.6 / 0.10.0 |
+| Save lifecycle | Settings/campaign/history/checkpoint files, atomic writes | Migration fixtures from 0.8/0.9, fresh-install/upgrade verification, rollback instructions | Player progress loss on upgrade | 0.10.0 |
+| QA/CI | Headless suite, smokes, screenshot compare, 21/21 judge | Release-candidate smoke matrix, final gallery and release dry run | Regressions escape the release gate | 0.9.6 / 0.10.0 |
+| Release/legal | Unsigned desktop/macOS builds, Web/HQ packages | Signing/notarization decision, checksums, AI-asset provenance, credits, privacy/body-camera and rating review | Public release blocked by trust/policy | 0.10.0 |
+| Documentation | Architecture/ADR/status/roadmap ownership established | Final README/changelog/status/TODO/smoke-checklist sign-off and known-limitations page | Docs drift at launch | 0.9.6 / 0.10.0 |
+| Future 0.x | Stable 0.x feature set | Live replay, more venues, VO/music, image-to-mesh props and seasonal content | Scope creep before release | Unscheduled |
+
+**Current priority:** the unversioned **Character development** and **Local map development**
+tracks are the active planning order. The **0.10.0 release candidate** follows them in this list
+as the next versioned release; content lock, external playtest, balance, save migration and
+release/legal sign-off remain tracked there. The source version is 0.10.0-rc.1; the v0.9.6
+release is published. Earlier map/NPC/UI/texture/integration passes are complete and in
+`DONE.md`.
+
 ## Future 0.x / non-blocking candidates
 
 - [ ] Live 3D body-camera replay.

docs/README.md

@@ -2,19 +2,26 @@
 
 This folder holds the project documentation, visual references and generated QA evidence.
 
+## Current priorities
+
+1. [Character development](../TODO.md#character-development) — crowd, age, build, hair and outfit variety; generator-first, with the frozen NPC contract.
+2. [Local map development](../TODO.md#local-map-development) — OpenStreetMap/3D data, licensed reference imagery, photoreal facades, AI-assisted composition and Gaussian-splatting evaluation.
+3. [0.10.0 release candidate](../TODO.md#milestone-0100--release-candidate) — versioned release hardening after the unversioned development tracks.
+
 ## Start here
 
-- [`../PLAN.md`](../PLAN.md) — product and game-design plan
-- [`gameplay.md`](gameplay.md) — controls, venues and escalation
-- [`joke-shop-map.md`](joke-shop-map.md) — Sunset Strip real-site mapping
-- [`tutorial.md`](tutorial.md) — first-shift tutorial beats
+- [`../PLAN.md`](../PLAN.md) — product, design intent and development priorities
+- [`../TODO.md`](../TODO.md) — priority-ordered active tasks and roadmap
+- [`npc-model-sourcing.md`](npc-model-sourcing.md) — character-source evaluation, licence rules and the character-development plan
 - [`architecture.md`](architecture.md) — arc42 system architecture
 - [`getting-started.md`](getting-started.md) — setup, run/test commands and controls
 - [`asset-tooling.md`](asset-tooling.md) — image/model pipelines and screenshot gates
+- [`gameplay.md`](gameplay.md) — controls, venues and escalation
+- [`joke-shop-map.md`](joke-shop-map.md) — Sunset Strip real-site mapping
+- [`tutorial.md`](tutorial.md) — first-shift tutorial beats
 - [`npc-visual-review.md`](npc-visual-review.md) — NPC visual baseline, acceptance criteria and ranked gaps
 - [`npc-proportion-audit.md`](npc-proportion-audit.md) — NPC proportion ratios and stylized guide results
-- [`npc-model-sourcing.md`](npc-model-sourcing.md) — free/open-source character sources, contract evaluation and the character-development plan
-- [`development-status.md`](development-status.md) — implemented features and current gaps
+- [`development-status.md`](development-status.md) — implemented features, current gaps and active planning
 - [`accessibility.md`](accessibility.md) — accessibility statement and known gaps
 - [`known-limitations.md`](known-limitations.md) — release-candidate blockers and accepted limits
 - [`smoke-checklist.md`](smoke-checklist.md) — manual verification

docs/RELEASING.md

@@ -27,6 +27,12 @@ godot --headless --export-release "Linux" build/gig-line-smoke.x86_64
 `project.godot` sets `config/version`. Keep it in sync with the release tag
 (e.g. `v0.3.0` → `config/version="0.3.0"`, plus a git tag `v0.3.0`).
 
+Every major, minor and patch increment is a version in its own right: add the
+`CHANGELOG.md` entry, run the local build (`tools/build_releases.sh`), verify the
+artifact names/sizes/checksums, and only then commit and tag. A changelog entry
+without a matching build is not a completed version. Unversioned development tracks
+do not get a placeholder version; assign one when the scope enters a release.
+
 ## 3. CI (Gitea Actions)
 
 The repository ships a Gitea Actions workflow (`.gitea/workflows/build.yml`):

docs/architecture.md

@@ -117,6 +117,7 @@ The asset/content pipeline is part of the architecture, not an external build de
 | Gear/props | Blender flatpak + tool + bake | `npc_gear/*.glb`, `props/*.glb`, `*_ao.png` | `NpcAvatar`, `WorldBuilder` | primitive assets / generated props |
 | Surface/UI art | Python pipelines / AI-assisted references | `assets/textures/ai/game_ready/`, `assets/images/` | `SurfaceMaterials`, `UiArt` | neutral material / procedural UI |
 | Screenshots/QA | capture scripts + `scene_concepts`/`screen_designs` | `docs/screenshots/`, `docs/screens/realism/` | reviewers and CI gates | regenerate; never runtime input |
+| Local map data (planned) | OSM/3D building extract + licensed reference photos + AI/splat evaluation | derived map assets with provenance sidecars | `WorldBuilder` venue specs | current stylized venue geometry |
 | Release | Gitea workflow + build/publish scripts | platform binaries, Web zip, Desktop HQ zip | players | source build |
 
 Contracts that keep the pipeline replaceable:
@@ -133,8 +134,10 @@ Characters have two authored sources and one procedural fallback. The eight-vari
 Blender library (`assets/models/blender/npc/`) is the normal presentation path; the
 older skinned `npc_base` (`assets/models/generated/npc_base.glb`) remains a frozen
 contract and fallback; `NpcAvatar`'s procedural rig is the offline last resort.
-Blender is a developer tool only — runtime, tests and CI consume committed GLBs and
-maps.
+Four crowd-variety prototypes have been built and audited locally but are not yet in
+the shipped catalogue; generator-first expansion is the active character track
+(ADR-0015). Blender is a developer tool only — runtime, tests and CI consume committed
+GLBs and maps.
 
 | Tool | Role | Committed artifact | Verification gate |
 | --- | --- | --- | --- |
@@ -169,6 +172,36 @@ Evidence and detailed contracts live in [`blender-assets.md`](blender-assets.md)
 [`npc-proportion-audit.md`](npc-proportion-audit.md); command-level usage is in
 [`asset-tooling.md`](asset-tooling.md).
 
+### Local map development tooling (planned)
+
+The current venues are hand-authored procedural reconstructions in
+`src/game/world_builder.gd`. The **Local map development** track in
+[`TODO.md`](../TODO.md#local-map-development) is unversioned and planned: it will
+test whether licensed data and reference photography can replace or supplement the
+stylized geometry without moving map data, AI composition or splat rendering into
+the runtime.
+
+Planned stages and gates:
+
+| Stage | Source | Output | Gate |
+| --- | --- | --- | --- |
+| Footprints and massing | Offline OpenStreetMap extract + licence-compatible 3D building data (OSM Buildings, Overture, CityGML/LOD1–2) | Local footprint/massing scenes, extract date and query pinned | ODbL attribution/share-alike review; scale/orientation and venue-footprint comparison |
+| Reference imagery | Wikimedia Commons, own/team photos or other clearly licensed images | Reference boards and material candidates | Written author/licence/attribution, privacy redaction, no unlicensed Street View or scraped commercial imagery |
+| AI-assisted composition | Project image tooling | Palette/facade-rhythm boards and material candidates | Model/prompt/output recorded; human review; never treated as licensed map data |
+| Photoreal facade kit | Project-authored geometry and derived materials | Committed facade modules and PBR maps | WorldBuilder budget, collider/nav coverage, Compatibility-readability and screenshot review |
+| Gaussian splatting | Licensed/permissioned photo sets + pinned offline toolchain | Development-only splat, texture or proxy experiments | Per-path ADR; runtime only if performance, collision/navigation and provenance are proven |
+
+Contracts for any future map source:
+
+- Runtime consumes committed, derived assets only; no online OSM, photo or splat
+  service is a build or play dependency.
+- OSM ODbL, photo licences, capture permissions and privacy redaction are recorded
+  in a provenance sidecar before an asset enters the repository.
+- Collision and navigation stay mesh-based; a splat may never become the playable
+  floor or the access/occlusion authority.
+- The stylized venue geometry remains the fallback until a data-backed block passes
+  the venue budget, navigation, visual and provenance gates.
+
 ### Content authoring and runtime data flow
 
 `ScenarioFactory` is the source of truth for the three authored venues. `tools/export_venues.gd`
@@ -315,6 +348,7 @@ Architecture decisions are recorded as ADRs:
 - Unsigned macOS builds, AI asset provenance and any storefront/legal requirements are release blockers for a public release.
 - Documentation drift has already occurred (release version, implemented status and obsolete plan docs); the ownership map and roadmap must be kept current in the same change as the implementation.
 - Character quality is only partly automatable: proportions, budgets and gear fit are measured, but face realism and venue-lighting readability still need the baseline/review sheets and human sign-off after any mesh, map or material change.
+- Local-map data and photo-derived assets add a second provenance and privacy risk: OSM share-alike, photo rights, faces/plates, property permission and rapidly churning splat tooling must be resolved before any derived asset ships.
 
 ## 12. Documentation Consolidation and Ownership
 
@@ -332,11 +366,12 @@ architecture document.
 | [`docs/blender-assets.md`](blender-assets.md) | Blender character/gear/prop contracts and attach points | Detailed asset contract appendix |
 | [`docs/npc-visual-review.md`](npc-visual-review.md) | NPC baseline views, acceptance criteria and ranked visual gaps | Visual-QA appendix to the character tooling section |
 | [`docs/npc-proportion-audit.md`](npc-proportion-audit.md) | Measured proportions against the stylized guide | Measurement appendix to the character tooling section |
+| [`docs/npc-model-sourcing.md`](npc-model-sourcing.md) | Character-source evaluation, licence rules and the character-development plan | Supports the character tooling section and ADR-0015 |
 | [`docs/getting-started.md`](getting-started.md) | Setup, commands, controls | Developer onboarding |
 | [`docs/RELEASING.md`](RELEASING.md) | Release checklist and CI/publishing steps | Deployment appendix to §7 |
 | [`docs/smoke-checklist.md`](smoke-checklist.md) | Manual verification script | QA appendix to §10 |
 | [`docs/development-status.md`](development-status.md) | Implemented features and current gaps | Status companion to the roadmap |
-| [`TODO.md`](../TODO.md) | Active tasks and 0.x roadmap | Planning source; no architecture duplication |
+| [`TODO.md`](../TODO.md) | Priority-ordered active tasks, unversioned development tracks and versioned roadmap | Planning source; no architecture duplication |
 | [`CHANGELOG.md`](../CHANGELOG.md) | User-facing release history | Release/version companion |
 
 Consolidation decisions:
@@ -344,7 +379,7 @@ Consolidation decisions:
 - **Architecture owns the "how"** (components, contracts, data flow, constraints, quality gates); **PLAN/gameplay own the "what"**; **ADRs own the "why"**. Links replace duplicated prose.
 - **Asset and release documents remain separate** because they are command-heavy operational procedures; their architecture-relevant contracts and failure modes are summarized in §5 and §7.
 - **Completed plans are removed, not kept as competing roadmaps.** Historical graphics work is summarized by ADR-0013, the asset pipeline section and the v0.6.0 changelog; new work belongs in TODO.
-- **Status and roadmap are separate from architecture.** `docs/development-status.md` records what exists; `TODO.md` records what remains, including the 0.x gap analysis and milestone exit criteria.
+- **Status and roadmap are separate from architecture.** `docs/development-status.md` records what exists; `TODO.md` records what remains, ordered as unversioned development tracks, versioned milestones and deferred work.
 - **Documentation drift is a tracked risk:** release/version, test counts, renderer status, and stale plans must be corrected in the same commit as the change that invalidates them.
 
 ## 13. Glossary

docs/asset-tooling.md

@@ -146,6 +146,27 @@ python3 tools/blender_assets.py audit   # no Blender needed
 godot --headless --path . --import
 ```
 
+## Local map development (planned)
+
+The **Local map development** track in [`TODO.md`](../TODO.md#local-map-development)
+is not implemented yet; there are no map-generation commands to run. The planned
+pipeline will evaluate:
+
+- offline OpenStreetMap extracts for footprints and licence-compatible 3D building
+  massing (OSM Buildings, Overture, CityGML/LOD1–2);
+- downloaded reference imagery from Wikimedia Commons, own/team photography or
+  other clearly licensed sources, with author/licence/attribution and privacy
+  redaction recorded per set;
+- AI-assisted composition boards for palette, facade rhythm and material study,
+  with model/prompt/output provenance and human acceptance;
+- Gaussian splatting as a development-only capture/reference/texture/proxy tool,
+  version-pinned offline and outside CI, until an ADR proves runtime safety.
+
+No online map/photo/splat service is a build or play dependency. Committed map
+assets will need provenance sidecars, ODbL/photo-licence review and the same
+`WorldBuilder` venue-budget/navigation/collider gates as the current stylized
+geometry. The detailed task plan and exit criteria live in `TODO.md`.
+
 ## Confirmed game assets
 
 Everything below is audited and shipped in the game; development-only outputs

docs/development-status.md

@@ -1,5 +1,9 @@
 # Development Status
 
+Current planning priorities are the unversioned **Character development** and **Local map
+development** tracks in [`TODO.md`](../TODO.md); neither is part of the implemented list below
+yet. The 0.10.0 release candidate remains the next versioned release.
+
 Implemented so far:
 
 - Godot 4.7.2 project scaffold, input map, procedural world builder (CI/local/release unified)