Record the AI-assisted asset review loop and MakeHuman OBJ transform gotchas in MEMORY.md

Record the rejected prototype shirt-shell experiment
Fix the prototype crotch material and loosen the shirt
2026-11-05 19:22:43 +01:00 · 2026-11-04 21:31:45 +01:00 · 2026-11-04 21:26:00 +01:00 · 2026-11-04 19:36:52 +01:00 · 2026-11-04 19:31:58 +01:00 · 2026-11-04 19:27:51 +01:00
228 changed files with 11085 additions and 2227 deletions
@@ -0,0 +1,212 @@
+---
+name: gig-line-blender-asset-contract
+description: Use when adding, rebuilding, auditing or fixing any Gig Line Blender-authored character, NPC base, gear, prop or venue geometry. Covers the required 13 core bones (optional extra bones allowed), five tint slots, 16,000/16,000 character budgets, gear attach space, 256² texture/AO rules, headless flatpak Blender commands, optional MCP guidance, and the inspect/audit/fit/proportion/capture gates. Do not use for pure GDScript/UI work or release publishing.
+compatibility: Gig Line repository checkout. Godot 4.7.2 on PATH; Blender 5.2 LTS via the org.blender.Blender flatpak for build/bake/render. Audit, fit, inspect and proportion checks are stdlib-only.
+metadata:
+  project: Gig Line
+  domain: 3d-assets
+  version: "1.0.0"
+  triggers: Blender, NPC, character, gear, prop, npc_base, GLB, AO, texel, asset rebuild, fit, audit
+---
+
+# Gig Line Blender Asset Contract
+
+Use this skill for any change that touches:
+
+- `assets/models/blender/**`
+- `assets/models/generated/npc_base.glb`
+- `assets/textures/npc/**`
+- `tools/blender_assets.py`, `tools/npc_pipeline.py`, `tools/bake_ao.py`,
+  `tools/npc_proportions.py` or `tools/npc_baseline.py`
+- Blender-authored venue/prop geometry
+
+The project contract and measured gates override any generic Blender advice.
+Blender MCP is optional interactive tooling; the headless flatpak CLI remains
+authoritative and CI never needs Blender or MCP. The `blender-skills` pack is
+optional, local guidance only, and gitignored. Setup and safety are in
+`docs/asset-tooling.md#optional-interactive-blender-mcp`.
+
+## Read first
+
+From the repository root, read the relevant sources rather than relying on this
+skill alone:
+
+1. `AGENTS.md` — required workflow and verification.
+2. `TODO.md` and `MEMORY.md` — current track, claimed tasks, known gotchas.
+3. `docs/blender-assets.md` — library contract and command reference.
+4. `docs/asset-tooling.md` — exact rebuild/bake/capture commands.
+5. `docs/npc-visual-review.md` and `docs/3d-model-review.md` — accepted limits,
+   scorecards and known blockers.
+6. `docs/known-limitations.md` — limits that must not be silently “fixed” into
+   contract changes.
+
+The contract lives in code and docs, not in this skill. If they disagree, stop
+and resolve the source of truth before editing assets.
+
+## Non-negotiable contract
+
+| Area | Rule |
+| --- | --- |
+| Mesh root | `npc_base` mesh node, skinned under `Rig`; preserve the limb node names. |
+| Bones | The 13 required core bones: `Head`, `HipL/R`, `KneeL/R`, `ShoulderL/R`, `ElbowL/R`, `HandL/R`, `Spine`, `Neck`. Optional extra bones (fingers, face, toes) are allowed; they must not move the core rest positions or break animation proxies. |
+| Tint slots | `skin`, `cloth`, `pants`, `accessory`, `hair`. |
+| Orientation | Front is Blender −Y / Godot +Z; feet grounded near y = 0; metres. |
+| Character budget | **16,000 triangles / 16,000 glTF vertices** per character (`CHAR_MAX_TRIS`/`CHAR_MAX_VERTS`). |
+| Frozen fallback | `npc_base` remains the low-poly fallback; it shares the 16,000/16,000 cap but is not required to use it. Do not silently lower the cap. |
+| Gear budget | **1,500 triangles** per gear piece; authored in attach-point space. |
+| Prop budget | **4,000 triangles** per prop. |
+| Gear attach | Use the catalogued attach points; verify with `fit`. Runtime `GEAR_OFFSETS` (lanyard forward, firefighter helmet up) and `HAND_ITEM_FORWARD` are intentional, not asset-contract changes. |
+| Textures | 256² albedo/normal/ORM maps. Cloth and pants use `NPC_FABRIC_UV_SCALE = (4,4,1)` and **skip** baked per-character AO; skin/hair/gear keep baked AO. |
+| CI | Offline and skill-free. Committed GLBs/AO/maps must make CI pass without Blender or MCP. |
+| Licensing | No new asset source without ADR-0015: CC0, or CC-BY with attribution in `CREDITS.md`; record provenance. |
+
+Do not change the renderer, engine baseline, runtime dependency graph or the
+`npc_base` contract as part of an asset pass.
+
+## Workflow
+
+### 1. Preflight and claim
+
+```bash
+git status --short
+git log --oneline -5
+godot --version
+flatpak run org.blender.Blender --version | head -3
+```
+
+Inspect the current asset and the relevant docs. Claim the TODO item with `[-]`
+before starting. Work on one asset family per commit.
+
+### 2. Establish a baseline
+
+Run the checks that do not need Blender first:
+
+```bash
+python3 tools/blender_assets.py audit
+python3 tools/blender_assets.py fit
+python3 tools/blender_assets.py texels
+python3 tools/npc_proportions.py report
+python3 tools/npc_pipeline.py audit
+```
+
+For a specific incoming or existing GLB:
+
+```bash
+flatpak run org.blender.Blender --background \
+  --python "$PWD/tools/blender_assets.py" -- \
+  inspect --file "$PWD/path/to/asset.glb" --category npc_gear --json
+```
+
+Record the before measurements (tris/verts, head/shoulder/hip/leg/arm/foot,
+fabric texel density, gear clearance). Do not “improve” an asset without a
+measurable target.
+
+### 3. Optional Blender-skill routing
+
+If the local `blender-skills` pack is installed, load `blender-director`, then
+only the specialists the task needs:
+
+- character mesh/face/hands: `character-artist`, `retopology`
+- rig/weights/pose: `rigging`
+- UVs/texel density: `uv-workflow`
+- maps/materials: `texture-workflow`, `materials`, `lookdev`
+- gear/props: `prop-artist`, `hard-surface`
+- budget/LOD/collision: `asset-optimization`, `lod-pipeline`, `collision-proxy`
+- final review: `qa-review`
+
+If MCP is available, use it for interactive part exploration only; mirror the result into a scripted change or local `.blend`, then re-export and run the CLI audit/fit gates. Never make the build, CI, tests or runtime depend on MCP. Setup: `docs/asset-tooling.md#optional-interactive-blender-mcp`.
+
+### 4. Build or bake
+
+Characters, gear and library props:
+
+```bash
+flatpak run org.blender.Blender --background \
+  --python "$PWD/tools/blender_assets.py" -- build --only <name>
+
+flatpak run org.blender.Blender --background \
+  --python "$PWD/tools/bake_ao.py" -- --only <name>
+```
+
+NPC base and its material maps:
+
+```bash
+python3 tools/npc_pipeline.py prepare      # only when fabric tiles change
+flatpak run org.blender.Blender --background \
+  --python "$PWD/tools/npc_pipeline.py" -- build
+python3 tools/npc_pipeline.py audit
+```
+
+Do not overwrite a review image or a promoted texture pick. Use a new `-vN`
+path and document the promotion.
+
+### 5. Import and capture
+
+```bash
+godot --headless --path . --import
+godot --headless --path . --script res://src/test/test_runner.gd
+
+# neutral baseline: 8 variants x 6 views, raw frames stay in tmp/
+godot --path . --script res://src/test/capture_npc_baseline.gd \
+  -- --out=res://tmp/npc-baseline
+
+# final-context: 96 frames across both venues and day/night
+godot --path . --script res://src/test/capture_npc_review.gd \
+  -- --out=res://tmp/npc-review
+```
+
+Compare before/after with `tools/npc_baseline.py compare`; do not replace the
+committed baseline sheet until a fix actually lands. See
+`references/verification.md` for the full gate matrix.
+
+### 6. Verify and hand off
+
+At minimum:
+
+- `blender_assets.py audit` and `fit` exit 0.
+- `npc_proportions.py` passes the stylized guide.
+- `npc_pipeline.py audit` passes if the base/textures changed.
+- texel density is inside the authored/fabric bands.
+- No character exceeds 16,000/16,000; gear/prop caps hold.
+- 24-NPC budget and Web/Compatibility path remain green.
+- Contract tests, headless suite, capture gates and docs check pass.
+- The diff contains only the intended assets, tools, tests and docs.
+
+State in the handoff: files changed, measurements before/after, skills used,
+gates run, and any accepted limit.
+
+## Failure playbook
+
+- **`Class "..." hides a global script class`** — a stray `.gd` backup is in the
+  project. Delete `tmp/*.gd` backups, `rm -rf .godot`, re-import; never keep
+  `class_name` copies in `tmp/`.
+- **Blender cannot see the path** — the flatpak cwd is `/app/blender`; use
+  absolute paths (`"$PWD/..."`).
+- **Empty or stale captures** — close modals/pause, check the capture script's
+  settle frames, and remove stale output directories before re-running.
+- **Pose harness mismatch** — the current `capture_npc_pose.gd` is blocked per
+  `docs/3d-model-review.md`; do not use its frames as pose evidence until the
+  recipe is fixed.
+- **Asset test fails after import** — re-run audit/fit first, then import; if the
+  manifest or AO path changed, rebuild the affected asset rather than editing
+  the manifest by hand.
+- **Uncertain about a visual change** — produce a labelled before/after sheet and
+  ask for review; do not hide a regression behind a budget claim.
+
+## Bundled references
+
+- [`references/asset-contract.md`](references/asset-contract.md) — full contract,
+  inventory, file locations and provenance rules.
+- `docs/asset-tooling.md#optional-interactive-blender-mcp` — optional MCP installation, connection, safety and
+  part-workflow instructions.
+- [`references/verification.md`](references/verification.md) — command matrix,
+  capture gates, expected results and acceptance criteria.
+
+## Do not
+
+- Make the build, CI, tests or runtime depend on MCP, Blender or API calls.
+- Change the bone/tint/contract to make a generic asset fit.
+- Rewrite committed baselines or overwrite existing images.
+- Commit `.blend` sources, raw captures or generated AI inputs.
+- Treat an asset audit as a substitute for visual review at portrait and crowd
+  distance.
@@ -0,0 +1,141 @@
+# Asset Contract Reference
+
+This is a working summary. The authoritative sources remain
+`docs/blender-assets.md`, `docs/asset-tooling.md`, ADR-0013, the tests in
+`src/test/tests/` and the constants in `tools/blender_assets.py` /
+`tools/npc_pipeline.py`.
+
+## Library inventory
+
+- **Character variants (8):** `npc_casual`, `npc_jacket`, `npc_coat`,
+  `npc_vest`, `npc_dress`, `npc_hoodie`, `npc_firefighter`, `npc_guard`.
+- **Frozen fallback:** `npc_base` / `assets/models/generated/npc_base.glb`.
+- **Gear:** 18 attach-space pieces covering head, back, chest and hand items.
+- **Library props:** 20 Blender-authored props plus 6 generated props.
+- **Venues:** procedural venues in `src/game/world_builder.gd`; Blender venue
+  geometry follows the same budgets and collision/provenance rules.
+
+## Skeleton and geometry
+
+The required contract skeleton has 13 core bones:
+
+```text
+Head, Spine, Neck,
+HipL, HipR,
+KneeL, KneeR,
+ShoulderL, ShoulderR,
+ElbowL, ElbowR,
+HandL, HandR
+```
+
+Optional extra bones (fingers, face controls, toes) are allowed if they do not
+move these core rest positions and do not break `NpcAvatar`'s animation proxies.
+
+Requirements:
+
+- `npc_base` mesh node exists and is skinned under `Rig`.
+- Limb node names stay stable for `NpcAvatar` and tests.
+- Front is Blender −Y / Godot +Z.
+- Feet are grounded at approximately y = 0; no floating origin.
+- Units are metres; character height is approximately 1.8 m.
+- No zero-area/duplicate degenerate faces in the exported mesh.
+- Every character has UVs in [0,1] unless a planned UDIM/atlas change is
+  explicitly accepted.
+
+## Material slots
+
+Exactly these five tint slots:
+
+```text
+skin, cloth, pants, accessory, hair
+```
+
+- Neutral albedo is authored in Blender; runtime tinting is authoritative.
+- Slot names are contract values; do not rename or add a sixth slot casually.
+- The procedural fallback (`NpcAvatar._build_body`) must keep working when the
+  GLB is missing.
+
+## Budgets
+
+| Asset | Limit |
+| --- | --- |
+| Character (library and base fallback) | 16,000 triangles / 16,000 glTF vertices |
+| Gear piece | 1,500 triangles |
+| Prop | 4,000 triangles |
+| Library prop/venue total | must stay inside the venue tests and library budget |
+
+`CHAR_MAX_TRIS`, `CHAR_MAX_VERTS`, `GEAR_MAX_TRIS`, `PROP_MAX_TRIS` and related
+constants live in `tools/blender_assets.py`. The budget is per character, not an
+average. Measure after every mesh change. Do not lower the cap to make a diff
+pass.
+
+## Gear and hand items
+
+- Gear is authored in the attach-point space documented by `GEAR` /
+  `GEAR_ATTACH` / `ATTACH_BLENDER`.
+- `blender_assets.py fit` measures gear boxes against the character's head band,
+  clothing radius and back clearance.
+- Runtime offsets are intentional:
+  - `NpcAvatar.GEAR_OFFSETS = {"lanyard": Vector3(0,0,0.04),
+    "firefighter_helmet": Vector3(0,0.03,0)}`
+  - `NpcAvatar.HAND_ITEM_FORWARD = Vector3(0,0,0.04)`
+- An offset is **not** an authored-asset change; do not bake it into the GLB
+  without a separate contract decision.
+- Open-palm grip (no finger-curl rig) is the accepted stylized limit.
+
+## Textures and AO
+
+- NPC maps are 256² albedo + normal + packed ORM.
+- `TEX_SIZE = 256` in `tools/npc_pipeline.py`.
+- Fabric UV scale is `Materials.NPC_FABRIC_UV_SCALE = Vector3(4,4,1)`.
+- Cloth/pants skip the per-character baked AO; skin/hair/gear keep it. This
+  avoids the large blotchy magnification that appeared at 256².
+- Gear/props may have their own AO maps; `tools/bake_ao.py` writes
+  `<name>_ao.png` next to the GLB and Godot wires it into the AO channel.
+- Never overwrite an existing committed image; use a new `-vN` candidate and
+  promote only after review.
+- Run `python3 tools/asset_pipeline.py audit <path>` and the relevant
+  `npc_pipeline.py audit` before committing map changes.
+
+## File map
+
+| Path | Role |
+| --- | --- |
+| `tools/blender_assets.py` | Catalogue, builders, audit/fit/inspect/texels/sheet. |
+| `tools/npc_pipeline.py` | `npc_base` builder, texture preparation and audit. |
+| `tools/bake_ao.py` | Blender AO bake into `<name>_ao.png`. |
+| `tools/npc_proportions.py` | Exported-GLB proportion audit (no Blender). |
+| `tools/npc_baseline.py` | Contact sheets/comparisons (no Blender). |
+| `assets/models/blender/manifest.json` | Generated asset manifest. |
+| `assets/models/blender/**/*.glb` | Committed library assets. |
+| `assets/models/generated/npc_base.glb` | Frozen NPC fallback. |
+| `assets/textures/npc/*_{albedo,normal,orm}.png` | Committed NPC maps. |
+| `src/test/capture_npc_baseline.gd` | 48-frame neutral baseline. |
+| `src/test/capture_npc_review.gd` | 96-frame final-context review. |
+
+## Provenance and source rules
+
+- Procedural Blender assets are project-owned.
+- External/CC assets need ADR-0015 clearance: CC0 preferred, CC-BY only with
+  attribution in `CREDITS.md`; no service assets with redistribution limits.
+- Editable `.blend` files under `assets/models/blender_src/` are gitignored;
+  only exported `.glb`, AO maps, manifests and committed preview sheets ship.
+- AI-generated source images are development inputs, not shipped assets. Keep
+  raw generations under gitignored paths until picked, checked and credited.
+- Do not copy a downloaded/Street View/AI reference into a committed asset
+  without the licence and provenance review.
+
+## Verification invariants
+
+The asset pass is not complete unless:
+
+1. `python3 tools/blender_assets.py audit` exits 0.
+2. `python3 tools/blender_assets.py fit` exits 0 and the report is reviewed.
+3. `python3 tools/npc_proportions.py report` passes the stylized guide.
+4. `python3 tools/npc_pipeline.py audit` passes when the base/textures changed.
+5. The 48-frame baseline and 96-frame final-context review are captured, with no
+   blank frames.
+6. The 24-NPC budget smoke is inside its frame budget.
+7. The full Godot suite and Python tooling tests pass.
+8. No runtime contract, renderer or dependency changed except the rebuilt
+   assets and their generated metadata.
@@ -0,0 +1,130 @@
+# Verification Matrix
+
+Run from the repository root. Stop and fix the first failure before continuing.
+
+## Environment
+
+```bash
+godot --version
+flatpak run org.blender.Blender --version | head -3
+git status --short
+```
+
+Expected: Godot 4.7.2; Blender 5.2 LTS flatpak; clean or intentionally scoped
+working tree. Blender's flatpak cwd is `/app/blender`; all paths passed to
+Blender must be absolute.
+
+## Asset checks
+
+| Check | Command | Expected |
+| --- | --- | --- |
+| Contract audit | `python3 tools/blender_assets.py audit` | exit 0, no `BAD` assets |
+| Gear fit | `python3 tools/blender_assets.py fit` | exit 0; review head band/clothing/back clearances |
+| Texture/texel density | `python3 tools/blender_assets.py texels` | authored 40–400 px/m; fabric ≥250 px/m |
+| NPC base | `python3 tools/npc_pipeline.py audit` | exit 0, contract bones/slots/maps |
+| Proportions | `python3 tools/npc_proportions.py report` | all eight inside the stylized guide |
+| Single incoming GLB | `flatpak run org.blender.Blender --background --python "$PWD/tools/blender_assets.py" -- inspect --file "$PWD/path.glb" --category <cat> --json` | contract result and measurements |
+| Part GLB (local) | `flatpak run org.blender.Blender --background --python "$PWD/tools/npc_parts.py" -- inspect --file "$PWD/tmp/npc-parts/<variant>/<part>.glb"` | measurements; a part GLB is not a shipped asset |
+| Prop audit | `python3 tools/model_pipeline.py audit` | exit 0 when generated props changed |
+| Texture audit | `python3 tools/asset_pipeline.py audit assets/textures/ai/game_ready` | exit 0 when textures changed |
+
+## Build/bake
+
+```bash
+# one library asset
+flatpak run org.blender.Blender --background \
+  --python "$PWD/tools/blender_assets.py" -- build --only npc_guard
+
+# bake AO for the same asset
+flatpak run org.blender.Blender --background \
+  --python "$PWD/tools/bake_ao.py" -- --only npc_guard
+
+# NPC base material maps/base
+python3 tools/npc_pipeline.py prepare
+flatpak run org.blender.Blender --background \
+  --python "$PWD/tools/npc_pipeline.py" -- build
+python3 tools/npc_pipeline.py audit
+```
+
+Only run `prepare` when AI fabric inputs changed. Do not run a full library
+rebuild just to hide a small diff; build the affected asset and its AO map.
+
+## Import and tests
+
+```bash
+godot --headless --path . --import
+godot --headless --path . --script res://src/test/test_runner.gd
+python3 -m unittest discover -s tools/tests -t tools -p 'test_*.py'
+python3 tools/check_docs.py
+```
+
+Expected: Godot suite passes; Python tooling suite passes; docs check OK. The
+project uses its own headless runner, not GUT.
+
+## Capture gates
+
+```bash
+# neutral studio baseline: 48 frames (8 characters x 6 views)
+godot --path . --script res://src/test/capture_npc_baseline.gd \
+  -- --out=res://tmp/npc-baseline-after
+
+# final-context: 96 frames (8 models x 3 distances x 2 venues x day/night)
+godot --path . --script res://src/test/capture_npc_review.gd \
+  -- --out=res://tmp/npc-review-after
+
+# optional hand close-up: 8 frames
+godot --path . --script res://src/test/capture_npc_baseline.gd \
+  -- --out=res://tmp/npc-hands --view=hand
+```
+
+Raw frames stay under `tmp/` and are never committed. Compare with:
+
+```bash
+python3 tools/npc_baseline.py compare \
+  --before tmp/npc-baseline --after tmp/npc-baseline-after \
+  --out docs/blender_previews/sheet_npc_baseline_compare-<topic>.jpg
+```
+
+Do not replace the committed baseline sheet until the change is accepted.
+
+## Budget/performance
+
+```bash
+godot --headless --path . --script res://src/test/smoke_npc_budget.gd
+```
+
+Expected report: 24 avatars / 168 meshes / 131,616 triangles (current baseline)
+inside the 50 ms budget. Record the actual frame time; do not copy an old number
+without measuring.
+
+## Visual review criteria
+
+The part pipeline (`tools/npc_parts.py`) builds/extracts head/face/hand parts under
+`tmp/npc-parts/<variant>/`; these are local working files and are **not shipped**. Only the
+assembled character GLBs, AO/maps, the manifest and the review sheets are committed. An
+assembled GLB still goes through `blender_assets.py inspect`/`audit`/`fit` before any part is
+accepted. The `npc_base.blend` fallback is frozen: never save prototype detail into it.
+
+For each changed variant, inspect at least:
+
+- 2 m portrait: eyes, mouth, ears, neck/shoulder, hair/headgear clearance.
+- 4.2 m conversation: hands, gear contact, clothing silhouette.
+- 8 m crowd: readable silhouette and LOD/impostor swap.
+- Day and night/LATE final-context frames.
+- Front, three-quarter and profile for a shape change.
+
+Accepted stylized limits are in `docs/npc-visual-review.md` and
+`docs/known-limitations.md`. Do not turn an accepted limit into an unreviewed
+contract change.
+
+## Final diff review
+
+```bash
+git diff --check
+git status --short
+git diff --stat
+```
+
+Check that only intended `.glb`, AO/maps, manifest, tests and docs changed. If a
+`.blend`, raw capture, generated AI input or temporary sheet is staged, stop and
+remove it. Commit one coherent asset family per commit.
@@ -0,0 +1,254 @@
+---
+name: gig-line-release-qa
+description: Use when preparing, validating, tagging or publishing a Gig Line release or release candidate, or when running the full screenshot, screen-design and realism QA gates. Covers version/changelog discipline, smoke and tooling matrices, clean-worktree builds, checksums, Web/HQ verification, publish rollback and post-release records. Do not use for ordinary asset edits or feature work.
+compatibility: Gig Line repository checkout with Godot 4.7.2 on PATH and Python 3 + Pillow. Release export needs installed Godot export templates; publishing needs Gitea credentials and is intentionally CI/tag-driven.
+metadata:
+  project: Gig Line
+  domain: release-qa
+  version: "1.0.0"
+  triggers: release, tag, version bump, changelog, build releases, publish, screenshots, screen design, realism judge, release candidate, deployment
+---
+
+# Gig Line Release and Visual QA
+
+Use this skill for version bumps, release candidates, tags, artifact builds,
+publishing, and the full visual/QA gate. For a Blender/asset rebuild, use
+`gig-line-blender-asset-contract` first.
+
+## Read first
+
+1. `AGENTS.md` — release procedure and verification rules.
+2. `TODO.md` — current milestone, blockers and release exit criteria.
+3. `docs/RELEASING.md` — build/publish commands, artifact list, macOS policy.
+4. `docs/release-qa.md` — manual QA matrix and balance protocol.
+5. `docs/development-status.md`, `CHANGELOG.md`, `README.md` — current claims.
+6. `MEMORY.md` — release gotchas, especially the clean-worktree rule.
+
+A release is not just a tag. It includes a version bump, changelog, clean build,
+artifact/checksum verification, CI publication, and post-release records.
+
+## Hard rules
+
+- **Do not tag while the TODO still lists unresolved release blockers.** Check
+  external playtest, legal/AI provenance, signing and target-hardware items.
+- **Never reuse a tag.** If a published version needs a fix, bump the patch and
+  create a new tag.
+- **Build from a clean checkout or detached worktree.** A normal working tree can
+  pack ignored `tmp/` and `build/` content into exports, inflating a ~160 MB
+  package to 1.6–3.1 GB.
+- A tag push triggers CI checks/build/publish. Do not upload manually unless CI is
+  unavailable and you have followed the same preflight.
+- Do not commit generated realism runs, raw captures, API keys, or build artifacts.
+- The vision judge is an optional development aid with external API cost, never a
+  hard CI gate.
+- Keep `project.godot`, changelog, tag and release asset version equal.
+
+## Release workflow
+
+### 1. Scope and version
+
+Choose the semantic increment from `AGENTS.md`:
+
+- MAJOR: incompatible/removed behavior, save/config contract or core-pillar
+  replacement.
+- MINOR: new user-facing feature/venue.
+- PATCH: fixes and polish.
+
+Update:
+
+1. `project.godot` `config/version`.
+2. `CHANGELOG.md` with a dated entry.
+3. `README.md`, `PLAN.md`, `docs/architecture.md`,
+   `docs/development-status.md`, `TODO.md`/`DONE.md` and `MEMORY.md` as needed.
+
+For a release candidate, use a prerelease version only if the project policy
+allows it and never present it as the final release.
+
+### 2. Preflight
+
+```bash
+git status --short
+git log --oneline -5
+git tag -l "v<version>"
+rg -n 'config/version' project.godot
+```
+
+Expected: only intended release changes; tag does not exist; version matches the
+changelog and planned artifacts.
+
+### 3. Automated checks
+
+```bash
+godot --headless --path . --script res://src/test/test_runner.gd
+python3 -m unittest discover -s tools/tests -t tools -p 'test_*.py'
+python3 tools/check_docs.py
+python3 tools/blender_assets.py audit
+python3 tools/blender_assets.py fit
+python3 tools/npc_proportions.py report
+python3 tools/npc_pipeline.py audit
+```
+
+Then run the smoke matrix, using isolated user-data directories for
+tutorial/campaign:
+
+```bash
+for s in smoke_audio smoke_crowd smoke_emergency smoke_npc_budget \
+         smoke_plan_verbs smoke_scenario_content smoke_session_shell \
+         smoke_timeline smoke_ui_flows; do
+  godot --headless --path . --script res://src/test/$s.gd || exit 1
+done
+
+XDG_DATA_HOME=/tmp/gig-line-campaign godot --path . --fixed-fps 60 \
+  --script res://src/test/smoke_campaign.gd
+XDG_DATA_HOME=/tmp/gig-line-tutorial godot --path . --fixed-fps 60 \
+  --script res://src/test/smoke_tutorial.gd -- --tutorial
+
+godot --path . --script res://src/test/smoke_movement.gd
+godot --path . --script res://src/test/smoke_props.gd
+godot --path . --script res://src/test/smoke_focus_radial.gd
+```
+
+Use a fresh `$XDG_DATA_HOME` for campaign/tutorial and check the exit code, not
+just the log.
+
+### 4. Visual and judge gates
+
+```bash
+./tools/check_screenshots.sh
+python3 tools/screen_designs.py compare
+python3 tools/screen_designs.py judge --model auto   # optional, record model/verdicts
+```
+
+For realism/venue work:
+
+```bash
+godot --path . --script res://src/test/capture_realism.gd \
+  -- --out=res://docs/screens/realism/<run>/after
+python3 tools/scene_concepts.py realism --run docs/screens/realism/<run> \
+  --judge --model <pinned-model>
+```
+
+Requirements:
+
+- Gallery: 21 good / 0 bad; screen judge has no unexplained `diff`.
+- Realism runs stay under `docs/screens/realism/` (gitignored); only decisions and
+  committed sheets/docs are tracked.
+- Record judge model, run count/attempts, spend if exposed, and verdicts.
+- Review every `review` verdict; turn layout regressions into fixes or documented
+  known limitations.
+
+### 5. Clean build
+
+Commit the release preparation first, then build the committed tree in a clean
+worktree:
+
+```bash
+git worktree add --detach /tmp/gig-line-release HEAD
+cd /tmp/gig-line-release
+./tools/build_releases.sh
+```
+
+Verify artifact names/sizes and checksums:
+
+```bash
+ls -lh build/gig-line-*<version>*
+PUBLISH_DRY_RUN=1 ./tools/publish_release.sh <version>
+sha256sum -c build/SHA256SUMS-<version>.txt
+```
+
+Check package contents:
+
+```bash
+unzip -l build/gig-line-web-<version>.zip | head
+unzip -l build/gig-line-desktop-hq-<version>.zip | head
+unzip -p build/gig-line-desktop-hq-<version>.zip override.cfg
+```
+
+Check the runnable Linux and HQ packages:
+
+```bash
+./build/gig-line-linux-<version>.x86_64 --headless --quit-after 60
+unzip -q build/gig-line-desktop-hq-<version>.zip -d /tmp/gig-line-hq
+/tmp/gig-line-hq/gig-line-linux-<version>.x86_64 --headless --quit-after 60
+```
+
+Check Web static serving with a local HTTP server and `curl` for `index.html`,
+`index.wasm`, `index.pck` and the player docs. Windows/macOS/AppImage/installer
+checks require the target matrix; if unavailable, record that explicitly.
+
+Remove the worktree after verification:
+
+```bash
+git worktree remove --force /tmp/gig-line-release
+```
+
+### 6. Tag and publish
+
+Only after every gate is green:
+
+```bash
+git add -A
+git commit -m "Release <version> <topic>"
+git tag -a "v<version>" -m "Gig Line <version>"
+git push origin main "v<version>"
+```
+
+CI builds and publishes on the tag. Verify:
+
+- Tag commit equals the release commit.
+- CI checks/build job succeeded.
+- Release page has the expected 7 assets (Linux, Windows, macOS, NSIS setup,
+  AppImage, Web, Desktop HQ).
+- Asset names and download links point at the released version.
+
+`tools/publish_release.sh` preflights artifact size/free space, writes SHA-256
+checksums, rolls back newly uploaded assets/release on failure, and supports
+opt-in retention:
+
+```bash
+RETAIN_RELEASES=7 ./tools/publish_release.sh <version>
+```
+
+The default `RETAIN_RELEASES=0` never prunes.
+
+### 7. Post-release record
+
+Update `README.md`, `docs/development-status.md`, `MEMORY.md`, `CHANGELOG.md`,
+`TODO.md`/`DONE.md` and the release page with the built/CI result. Commit the
+release record and push. Record any skipped check and the reason; never leave a
+tag with unreported missing verification.
+
+## Known gotchas
+
+- **Dirty build inflation:** always use the clean worktree above.
+- **`Class ... hides a global script class`:** remove stray `.gd` backups in
+  `tmp/`, delete `.godot`, re-import.
+- **Screenshot staging:** `capture_ui_states.gd` needs its settle frames and
+  staged state; do not capture a paused frame or a stale modal.
+- **Judge keys:** OpenRouter calls need `.env`/`OPENROUTER_API_KEY`; never commit
+  the key or generated review folders.
+- **Tag builds publish automatically:** do not run a second manual publish that
+  duplicates assets; use the existing release if re-running.
+- **macOS is unsigned unless policy changes:** record quarantine instructions and
+  do not claim notarization.
+- **Release blockers are real:** external playtest, legal/storefront approval,
+  AI-provider rights and target-hardware checks cannot be replaced by green unit
+  tests.
+
+## Bundled references
+
+- [`references/release-runbook.md`](references/release-runbook.md) — version,
+  build, tag, CI, publish and rollback sequence.
+- [`references/qa-gates.md`](references/qa-gates.md) — full command matrix,
+  expected results and evidence to record.
+
+## Completion checklist
+
+- [ ] Version/changelog/docs/tag match.
+- [ ] No unresolved release blockers for a final tag.
+- [ ] Godot, Python, smokes, asset and docs gates pass.
+- [ ] Gallery and optional judges reviewed with evidence.
+- [ ] Clean worktree build and checksums verified.
+- [ ] Linux/HQ/Web checks recorded; unavailable platforms noted.
+- [ ] Tag pushed; CI/publish succeeded; seven assets verified.
+- [ ] Release record and durable docs committed.
@@ -0,0 +1,171 @@
+# QA Gate Matrix
+
+Run from the repository root. Capture the exit code and the useful report line,
+not only the final “OK”.
+
+## 1. Source and docs
+
+```bash
+git status --short
+git log --oneline -5
+python3 tools/check_docs.py
+git diff --check
+```
+
+Expected: intended files only; `check_docs: OK`; no whitespace errors.
+
+## 2. Automated suites
+
+```bash
+godot --headless --path . --script res://src/test/test_runner.gd
+python3 -m unittest discover -s tools/tests -t tools -p 'test_*.py'
+```
+
+Expected: the current Godot suite passes (historically 272+ tests) and the
+Python tooling suite passes (currently 160 tests). Do not edit expected counts
+without inspecting the suite.
+
+## 3. Asset gates
+
+```bash
+python3 tools/blender_assets.py audit
+python3 tools/blender_assets.py fit
+python3 tools/blender_assets.py texels
+python3 tools/npc_pipeline.py audit
+python3 tools/npc_proportions.py report
+```
+
+Expected: exit 0, no `BAD` assets, all eight characters inside the stylized
+proportion guide, no budget/contract regression.
+
+Optional texture/model audits when those assets changed:
+
+```bash
+python3 tools/asset_pipeline.py audit assets/textures/ai/game_ready
+python3 tools/model_pipeline.py audit
+```
+
+## 4. Smoke matrix
+
+Headless:
+
+```bash
+for s in smoke_audio smoke_crowd smoke_emergency smoke_npc_budget \
+         smoke_plan_verbs smoke_scenario_content smoke_session_shell \
+         smoke_timeline smoke_ui_flows; do
+  echo "== $s"
+  godot --headless --path . --script res://src/test/$s.gd || exit 1
+done
+```
+
+Isolated data:
+
+```bash
+rm -rf /tmp/gig-line-release-campaign /tmp/gig-line-release-tutorial
+XDG_DATA_HOME=/tmp/gig-line-release-campaign godot --path . --fixed-fps 60 \
+  --script res://src/test/smoke_campaign.gd
+XDG_DATA_HOME=/tmp/gig-line-release-tutorial godot --path . --fixed-fps 60 \
+  --script res://src/test/smoke_tutorial.gd -- --tutorial
+```
+
+Windowed input/UI:
+
+```bash
+godot --path . --script res://src/test/smoke_movement.gd
+godot --path . --script res://src/test/smoke_props.gd
+godot --path . --script res://src/test/smoke_focus_radial.gd
+```
+
+Expected: 14 smokes green. `smoke_npc_budget` should print the current mesh,
+triangle and frame-time evidence; the 50 ms budget is a safety ceiling.
+
+## 5. Screenshot and design gates
+
+```bash
+./tools/check_screenshots.sh
+python3 tools/screen_designs.py compare
+```
+
+Expected: 21 good / 0 bad; no unexplained compare output. The judge is optional:
+
+```bash
+python3 tools/screen_designs.py judge --model auto
+```
+
+Record model, confidence/verdict summary, `diff` count and any manual review.
+`docs/ui-copy.md#screen-design-judge-report` is the durable record.
+
+## 6. Realism judge (when visual assets/lighting changed)
+
+```bash
+godot --path . --script res://src/test/capture_realism.gd \
+  -- --out=res://docs/screens/realism/<run>/after
+python3 tools/scene_concepts.py realism --run docs/screens/realism/<run> \
+  --judge --model <pinned-model>
+```
+
+Expected: a complete set of required stage captures, no stale pauses/modals, and
+a report under the gitignored run directory. Record:
+
+- pinned model/fallbacks
+- shots attempted/completed
+- spend if the tool exposes it
+- mean score and Pillow gap
+- every `review` verdict and disposition
+
+Do not commit the run. Commit only the decision/report summary and any durable
+comparison sheet explicitly intended for review.
+
+## 7. Package checks
+
+Use the clean worktree from `release-runbook.md`.
+
+```bash
+PUBLISH_DRY_RUN=1 ./tools/publish_release.sh <version>
+sha256sum -c build/SHA256SUMS-<version>.txt
+unzip -l build/gig-line-web-<version>.zip
+unzip -l build/gig-line-desktop-hq-<version>.zip
+unzip -p build/gig-line-desktop-hq-<version>.zip override.cfg
+./build/gig-line-linux-<version>.x86_64 --headless --quit-after 60
+```
+
+Expected:
+
+- names match the version;
+- Linux/Windows/macOS/Web/HQ present locally;
+- Web contains HTML/wasm/pck and docs;
+- HQ contains `override.cfg`, executables and docs;
+- Linux/HQ start without a script error.
+
+Windows installer/AppImage and macOS launch require CI or the target matrix. If
+not available, mark them as unverified rather than passing them by analogy.
+
+## 8. Release verification
+
+After the tag push:
+
+- CI checks job succeeded;
+- CI build job succeeded;
+- release page has seven assets;
+- each artifact name includes the released version;
+- the tag points at the release commit;
+- README/changelog/status and release notes agree.
+
+## Evidence summary template
+
+```text
+Release: vX.Y.Z (commit)
+Godot: pass (N/N)
+Python tooling: pass (N/N)
+Smokes: 14/14
+Assets: audit/fit/proportions/npc audit pass
+Budget: 24 NPCs, N meshes, N triangles, N ms
+Gallery: 21 good / 0 bad
+Screen judge: N/N match, N review, N diff
+Realism: model, attempts, mean, gap, review dispositions
+Build: clean worktree, artifact sizes/checksums
+Launch: Linux/HQ/Web checks; unverified platforms
+CI/release: run id, seven assets
+Skipped checks + reason:
+Known limitations:
+```
@@ -0,0 +1,171 @@
+# Release Runbook
+
+Authoritative source: `AGENTS.md` (Release Procedure), `docs/RELEASING.md`.
+This runbook is the operational checklist; if it conflicts with those, they win.
+
+## 0. Decide the release
+
+Determine whether this is a major, minor, patch, or release-candidate checkpoint.
+Do not assign a version to an unversioned development track until its scope is
+accepted into a release.
+
+Check the current release constraints in `TODO.md`:
+
+- external playtest evidence
+- legal/AI-provider/storefront review
+- macOS signing/notarization policy
+- target hardware matrix
+- any manual QA gaps
+
+If a final release would ship with unresolved blockers, prepare an RC or stop;
+do not create a final tag.
+
+## 1. Prepare the version
+
+Files to update:
+
+| File | Change |
+| --- | --- |
+| `project.godot` | `config/version="X.Y.Z"` |
+| `CHANGELOG.md` | dated `## [X.Y.Z] — YYYY-MM-DD` entry |
+| `README.md` | latest/current version and summary |
+| `PLAN.md` / `docs/architecture.md` | current version reference |
+| `docs/development-status.md` | shipped capability/release result |
+| `TODO.md` / `DONE.md` | close/move milestone when complete |
+| `MEMORY.md` | release state and gotchas |
+
+Then commit the preparation before building.
+
+## 2. Run gates
+
+Use `qa-gates.md` as the command matrix. The minimum release gate is:
+
+- Godot suite
+- Python tooling tests
+- documentation gate
+- asset audits/fit/proportions
+- 24-NPC budget
+- 14 smoke scripts
+- screenshot compare
+- optional screen/realism judge with recorded model/attempts
+- clean build and artifact checks
+
+Any skipped check must be written into `MEMORY.md` or `TODO.md` with a reason.
+
+## 3. Build in a clean worktree
+
+Why: Godot can pack ignored `tmp/` captures and `build/` outputs into the export.
+A dirty build can produce 1.6–3.1 GB artifacts instead of ~160–240 MB.
+
+```bash
+git worktree add --detach /tmp/gig-line-release HEAD
+cd /tmp/gig-line-release
+./tools/build_releases.sh
+```
+
+Expected local artifacts:
+
+```text
+build/gig-line-linux-<version>.x86_64
+build/gig-line-windows-<version>.exe
+build/gig-line-macos-<version>.zip
+build/gig-line-web-<version>.zip
+build/gig-line-desktop-hq-<version>.zip
+```
+
+CI additionally produces the NSIS setup and AppImage, for seven release assets.
+
+## 4. Preflight and checksum
+
+```bash
+PUBLISH_DRY_RUN=1 ./tools/publish_release.sh <version>
+sha256sum -c build/SHA256SUMS-<version>.txt
+```
+
+`publish_release.sh` checks non-empty artifacts and local free space before any
+API call. It writes checksums under `build/` and does not upload them by default.
+
+Inspect packages:
+
+```bash
+unzip -l build/gig-line-web-<version>.zip | head -20
+unzip -l build/gig-line-desktop-hq-<version>.zip | head -20
+unzip -p build/gig-line-desktop-hq-<version>.zip override.cfg
+```
+
+Web must contain `index.html`, `index.wasm`, `index.pck`, and player docs.
+Desktop HQ must contain the Linux/Windows executables, `override.cfg`,
+`README.txt`, `CREDITS.md`, `PRIVACY.md`, `accessibility.md` and
+`known-limitations.md`.
+
+## 5. Runtime launch smoke
+
+```bash
+./build/gig-line-linux-<version>.x86_64 --headless --quit-after 60
+unzip -q build/gig-line-desktop-hq-<version>.zip -d /tmp/gig-line-hq
+/tmp/gig-line-hq/gig-line-linux-<version>.x86_64 --headless --quit-after 60
+```
+
+For Web, serve `build/web` and check HTTP 200 for `index.html`, `index.wasm`,
+`index.pck` and docs. Do not claim browser interaction from a curl check.
+
+Remove the temporary worktree after checks:
+
+```bash
+git worktree remove --force /tmp/gig-line-release
+```
+
+## 6. Tag and CI
+
+From the real repository, on the release commit:
+
+```bash
+git tag -a "v<version>" -m "Gig Line <version>"
+git push origin main "v<version>"
+```
+
+The tag triggers `.gitea/workflows/build.yml`: checks, export, installer,
+AppImage, release publish. Verify the run and assets:
+
+- check job success
+- build job success
+- seven assets present
+- tag/version/artifact names equal
+- download links respond
+
+Do not reuse a published tag. If a fix is needed, bump patch and repeat.
+
+## 7. Manual publish fallback
+
+Only if CI cannot publish:
+
+```bash
+RETAIN_RELEASES=7 ./tools/publish_release.sh <version>
+```
+
+The script reuses or creates the release, uploads present artifacts, verifies the
+asset count, and rolls back newly uploaded assets/new release on failure. The
+default retention is `0` (no deletion). Never delete older releases implicitly.
+
+## 8. Post-release record
+
+Commit a release record that includes:
+
+- tag and commit
+- CI run/result
+- seven assets
+- checksums or size evidence
+- skipped checks
+- known limitations
+- release URL
+
+Update `DONE.md`/`TODO.md` and `MEMORY.md`; keep the changelog and README
+consistent. Push the record commit.
+
+## Versioning pitfalls
+
+- A `vX.Y.Z` tag is immutable in practice; do not move/replace it.
+- A release candidate is not a final release. Do not label it as such in the
+  README or release page if blockers remain.
+- `config/version` must match the tag and artifact filenames.
+- The clean-worktree build is a release requirement, not an optimization.
@@ -58,6 +58,20 @@ assets/models/generated/npc_base_*_normal.png

 # Local AppImage extraction
 squashfs-root/
+
+# Local agent skills. The third-party Blender pack is installed per machine and
+# stays ignored; the two project-authored skills are tracked so the workflow can
+# be shared and reviewed.
+.agents/
+!.agents/
+.agents/*
+!.agents/.gdignore
+!.agents/skills/
+.agents/skills/*
+!.agents/skills/gig-line-blender-asset-contract/
+!.agents/skills/gig-line-blender-asset-contract/**
+!.agents/skills/gig-line-release-qa/
+!.agents/skills/gig-line-release-qa/**
 # Blender asset library: per-asset Cycles renders are local review output (the
 # committed review artefacts are docs/blender_previews/sheet_*.jpg), and Godot
 # extracts the GLB-embedded textures next to the models on import.
@@ -74,3 +88,7 @@ assets/models/blender_src/*.blend
 assets/textures/ai/game_ready/v2/*
 !assets/textures/ai/game_ready/v2/picks/
 docs/screens/realism/
+
+## Local pi agent session data
+pi-session-*.html
+pi-session-*.jsonl
@@ -17,12 +17,99 @@ The project should be developed in small, reviewable steps. Agents must keep pla
 - `CHANGELOG.md` — The version history of user-facing changes. Keep an entry for each patch, minor, and major version.
 - `docs/development-status.md` — The implemented-features list and what is not yet implemented. Update it whenever a feature lands, is renamed, or is removed.
 - `docs/architecture.md` — The arc42-style architecture documentation (goals, constraints, building blocks, runtime views, decisions, risks).
- `docs/gameplay.md` — Gameplay systems, venues, and the escalation model.
- `docs/asset-tooling.md` — Asset pipelines, model tools, and screenshot gates.
+- `docs/gameplay.md` — Gameplay systems, tutorial, venues and the escalation model.
+- `docs/venues.md` — Real-site evidence, game mapping and venue simplifications.
+- `docs/asset-tooling.md` — Asset pipelines, model tools, optional Blender MCP and screenshot gates.
+- `docs/blender-assets.md` — Blender library operation and asset roles.
+- `docs/npc-model-sourcing.md` — Character-source evaluation, licence rules and the character-development plan.
 - `docs/getting-started.md` — Setup, run/test commands, and the controls table.
- `docs/smoke-checklist.md` — The manual smoke-test checklist.
+- `docs/release-qa.md` — The manual smoke checklist and balance-acceptance protocol.
 - `docs/adr/` — Architecture Decision Records.

+## Priority and Versioning
+
+`TODO.md` is the priority source. The active order is:
+
+1. unversioned development tracks;
+2. versioned release milestones, in version order;
+3. future/unversioned candidates and deferred work.
+
+Do not assign a version number to an unversioned track until its scope is accepted into a
+release. When a version is assigned, it must be the next semantic version that matches the
+scope (major/minor/patch), not a placeholder.
+
+## Local Blender skills (development aid)
+
+The MIT `blender-skills` pack is installed locally at `.agents/skills/blender-skills/`
+(94 skills plus a shared `references/` folder). It is **gitignored on purpose**: it is not
+game content, not part of the build, tests, CI or release packages, and every contributor
+may or may not have it. The agent runtime (Pi) gates project `.agents/skills` behind project
+trust, so the trust prompt must be accepted before the skills load; `/skill:blender-director`
+forces one.
+
+Use them when a task touches `tools/blender_assets.py`, `tools/npc_pipeline.py`,
+`tools/bake_ao.py`, `assets/models/blender/**`, or Blender-authored venue/prop geometry.
+
+### Project-authored skills (tracked)
+
+Two project skills are committed under `.agents/skills/` and are guidance for
+any agent, not only Pi:
+
+- `gig-line-blender-asset-contract` — the NPC/gear/prop contract, build order,
+  headless Blender commands, failure playbook and verification gates.
+- `gig-line-release-qa` — the test/smoke matrix, visual judges, clean-worktree
+  build, checksum/tag/publish sequence and release records.
+
+They are not runtime dependencies and do not move tool implementations into
+`.agents/`. The third-party `blender-skills` pack stays local/gitignored.
+
+### Routing
+
+Start with `blender-director` for anything multi-discipline, then load only the
+specialists the task needs:
+
+| Work | Skills |
+| --- | --- |
+| Plan/route a Blender task, reference photo match | `blender-director` |
+| Character mesh, face, hands, proportions | `character-artist`, `character-archetypes`, `retopology` |
+| Skeleton, weights, pose/contract rigging | `rigging` |
+| UV layout, texel density, UDIM | `uv-workflow` |
+| Bakery, atlas, normal/AO/ORM maps | `texture-workflow` |
+| PBR materials and shading | `materials` |
+| Screenshot-driven material/light iteration | `lookdev` |
+| Triangle/vertex budgets, naming, scene hygiene | `asset-optimization` |
+| LOD tiers and impostors | `lod-pipeline` |
+| Collision shapes and proxies | `collision-proxy` |
+| GLB export for Godot | `godot-export`, `export-pipeline` |
+| Gear, props, street furniture | `prop-artist`, `hard-surface` |
+| Trees, hedges, foliage cards | `vegetation-artist` |
+| Facades, venues, modular kits, dressing | `environment-artist`, `archviz`, `set-dressing`, `geometry-nodes` |
+| Lighting, framing, final render/composite | `lighting`, `camera-cinematography`, `rendering`, `compositing` |
+| Style direction (stylized / low-poly / realistic) | `stylized-style`, `lowpoly-style`, `realistic-style` |
+| Ship/no-ship review | `qa-review` |
+
+### Project rules that override a skill
+
+1. **The project contract wins.** `npc_base` mesh node, the 13 required core bones at their rest
+   positions, five tint slots, front on Blender −Y / Godot +Z, grounded feet, 16,000
+   triangles / 16,000 glTF vertices per character, 1,500 per gear, 4,000 per prop. Optional
+   extra bones (fingers, face, toes) are allowed if they do not move the core rest positions. A skill
+   may recommend another topology, naming or budget scheme; do not adopt it unless the
+   change is explicitly planned and the contract, tests and docs are updated together.
+2. **Blender MCP is optional interactive tooling.** The headless flatpak scripts
+   (`tools/blender_assets.py`, `tools/npc_pipeline.py`) remain authoritative. MCP may be used
+   for local part exploration; setup and safety are in [`docs/asset-tooling.md#optional-interactive-blender-mcp`](docs/asset-tooling.md#optional-interactive-blender-mcp).
+   Never add an MCP dependency to the build, CI, tests or runtime, and always re-run the CLI
+   audit/fit gates on anything MCP touched.
+3. **CI stays offline and skill-free.** Skills are local guidance only; every gate must still
+   work from a fresh checkout with committed `.glb`/`.png`/`.tres` files and Godot.
+4. **No new asset source without the licence gate.** Skills may suggest reference packs or
+   generated meshes; ADR-0015 (CC0, or CC-BY with attribution in `CREDITS.md`) and the
+   provenance rules in `docs/npc-model-sourcing.md` still apply.
+5. **Evidence, not vibes.** After a skill-informed change, run `blender_assets.py inspect`,
+   `audit` and `fit` plus the relevant capture/smoke gates, and say in the handoff which
+   skills informed the change and what the measurements were.
+
 ## Required Workflow

 ### 1. Start by Inspecting the Repository
@@ -47,8 +134,11 @@ All planned implementation work must be represented in `TODO.md`.
 - Use level-2 headings (`##`) for milestones or stable themes. A milestone should state its goal
  and an explicit exit criterion; a theme groups small related work that does not need a
  milestone.
- Use level-3 headings (`###`) for workstreams inside a milestone (for example, `0.8.1
-  First-shift tutorial`). Keep the hierarchy to three levels: milestone → workstream → checkbox.
+- Order level-2 sections by current priority: unversioned development tracks first, then
+  versioned release milestones in version order, then future/deferred work. Do not assign a
+  version number to an unversioned track until it is scheduled for a release.
+- Use level-3 headings (`###`) for workstreams inside a milestone. Keep the hierarchy to three
+  levels: milestone → workstream → checkbox.
 - Use checkbox items for each concrete task, normally under a level-3 workstream. Direct
  checkboxes under a level-2 section are acceptable for small, single-workstream sections.
 - Keep tasks small enough to complete and review independently.
@@ -67,26 +157,31 @@ Recommended format:
 ```md
 # TODO

-## Milestone 0.8.0 — First hour and content depth
+## Milestone X.Y.Z — goal and exit criterion

-### 0.8.1 First-shift tutorial
+### Workstream A

- [x] Write the tutorial beat sheet.
- [-] Implement the tutorial state machine. (claimed; implementation/verification in progress)
- [ ] Add the tutorial smoke test.
+- [x] Completed task.
+- [-] Task in progress. (claimed; implementation/verification in progress)
+- [ ] Open task.

-### 0.8.2 Campaign shell
+### Workstream B

- [ ] Define campaign data.
- [ ] Persist campaign progress.
+- [ ] Another task.

-**Exit:** a first-time player completes a shift without external documentation.
+**Exit:** a verifiable statement of what "done" means for the milestone.

-## Documentation
+## Theme

- [ ] Document the test procedure in `README.md`.
+- [ ] A small housekeeping task with no milestone.
 ```

+Recommended `DONE.md` format: a `# DONE` heading, followed by each moved level-2 section
+unchanged, with a completion date line under each section heading.
+
+Order the actual file as described in "Priority and Versioning": unversioned development tracks
+first, then versioned milestones in version order, then future/deferred work.
+
 ### 3. Move Completed Sections to `DONE.md`

 `TODO.md` uses nested sections. Apply these completion rules:
@@ -174,10 +269,12 @@ Update `README.md` whenever setup instructions, commands, project structure, or
 The root-level `CHANGELOG.md` records the user-facing changes for every release. It exists so players and contributors can see what changed between versions without reading the commit log.

 - Add an entry for every patch, minor, and major version change.
- Follow Semantic Versioning (`major.minor.patch`): bump major for breaking or vision-level changes, minor for new features, and patch for fixes and small polish.
+- Follow Semantic Versioning (`major.minor.patch`): bump major only for changes that remove or break an existing player-facing feature, save format, or config contract, or that replace a system listed as a core pillar in PLAN.md; bump minor for new user-facing features; bump patch for fixes and small polish.
+- A version increment is not complete until its `CHANGELOG.md` entry, `config/version` update and
+  matching local release build have all been produced and verified.
 - Group each entry under `Added`, `Changed`, `Fixed`, and `Removed` headings, and date every entry.
 - Describe changes in user-facing terms, not as raw commit messages.
- Add the entry when its work ships. If the version number is not yet known, record it under `Unreleased` and move it into a numbered version when the version is tagged.
+- Add the entry when its work ships. If the version number is not yet known, record it under `Unreleased` as a staging entry; moving it into a numbered version is a version increment and is complete only when the `config/version` update and matching local release build have also been produced and verified (see "Commit, Build and Version Discipline").

 When a full executable level-2 milestone/theme in `TODO.md` is implemented, completed, and moved to `DONE.md`:

@@ -198,13 +295,41 @@ For each task:
 5. Update documentation if the change creates lasting context: add features to `docs/development-status.md`, adjust the README links or other `docs/` files as needed, and record decisions/gotchas in `MEMORY.md`.
 6. Mark the task complete.
 7. Keep completed level-3 workstreams in place until the parent milestone is complete; then move the entire level-2 milestone to `DONE.md` after recording its `CHANGELOG.md` entry.
-8. Commit the changes to the version control system with a descriptive message.
-9. If a level-2 milestone from `TODO.md` has been fully completed, ensure its `CHANGELOG.md` entry is in place, then create a new version or tag in the version control system to mark the milestone.
-10. Push the committed changes to the shared repository if applicable.
-11. Note the new version or tag created in the version control system in any relevant documentation or handoff summary.
+8. Commit each coherent, verified change as it is completed. Do not wait until a whole
+   milestone is finished; keep commits small and descriptive and push them when the branch is
+   shareable.
+9. If the change is a release (a major, minor, or patch version increment), follow the Release
+   Procedure in "Commit, Build and Version Discipline".
+10. Push committed changes to the shared repository if applicable.
+11. Note the new version, build artifacts or tag in the relevant documentation and handoff
+    summary.

 Avoid unrelated refactors unless they are required for the task or explicitly approved.

+### 9. Commit, Build and Version Discipline
+
+- **Commit often.** Make a commit after each coherent change or verified task, not only when a
+  milestone or release is finished. Keep the working tree clean between tasks where possible.
+- **Push regularly.** Push shareable commits to the shared repository; do not accumulate a long
+  local-only history.
+- **Build every version.** Every major, minor and patch increment follows the Release Procedure
+  below; a changelog entry alone is not a release.
+- **CI is a second gate, not a substitute.** Tag builds remain automated, but the local build is
+  the required pre-tag check for every version.
+- **Unversioned tracks stay unversioned.** A development track does not get a placeholder
+  version; the version is assigned when the work is scoped into a release.
+
+**Release Procedure** — follow these steps in order for every major, minor, or patch version
+increment:
+
+1. Update `config/version`.
+2. Write the `CHANGELOG.md` entry for the version.
+3. Run the local release build (`tools/build_releases.sh`).
+4. Verify the build artifacts and checksums.
+5. Commit the changes.
+6. Tag the version.
+7. Push the commit and tag.
+
 ## Collaboration Rules

 - Prefer clear, reversible changes over broad rewrites.
@@ -213,6 +338,8 @@ Avoid unrelated refactors unless they are required for the task or explicitly ap
 - Do not claim a task is complete without verification.
 - Keep documentation synchronized with the implementation.
 - Mention files changed and checks run in handoff summaries.
+- Commit coherent increments as you go; do not wait until the end of a milestone.
+- Follow the Release Procedure in "Commit, Build and Version Discipline" whenever a major, minor or patch version is incremented.
 - Leave follow-up work as checkbox items in `TODO.md` rather than hiding it in prose.
 - If blocked, document the blocker in `MEMORY.md` and add a corresponding task to `TODO.md`.
 - Avoid overwriting another contributor’s work; inspect recent changes before editing shared files.
@@ -224,6 +351,10 @@ Before handing off work, an agent must run every check below that applies to the
 - Run automated tests.
 - Run formatting, linting, or type checks.
 - Start the game or application and perform a basic smoke test.
+- For 3D/Blender changes: `blender_assets.py inspect`, `audit` and `fit`, the relevant capture
+  gate, and a note of which local skills informed the change.
+- If the local Blender skills are not installed, state "no local skills used" in the handoff
+  and list the skill-free checks that were run instead.
 - Check that documentation and task status reflect the actual state.
 - Review the final diff for accidental changes or unfinished markers.

@@ -4,6 +4,46 @@ All notable user-facing changes to Gig Line. The format follows
 [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and versions use
 Semantic Versioning.

+## [0.9.8] — 2026-11-04
+
+### Fixed
+
+- Characters no longer detach at the wrist: the wrist and hand now track the same
+  bone, the hand was raised to meet the forearm, and the sleeve cuff follows the
+  hand instead of the elbow.
+- Seated and walking poses no longer collapse the hip/thigh or pinch the knee:
+  the thigh and shin are rigid to their bones with a short blend at the knee.
+
+## [0.9.7] — 2026-11-04
+
+### Added
+
+- Character development: a more realistic face on all eight library characters
+  (higher head subdivision, brow ridge, both eyelids, fuller lower lip) and four
+  crowd-variety characters (`npc_crowd_a`–`d`) with deterministic per-role pools
+  so the routine crowd no longer clones a single look.
+
+### Fixed
+
+- The NPC pose harness now captures seated, walking and idle deformation (the
+  harness froze the avatar's process so the FSM could no longer revert the pose).
+
+## [0.10.0-rc.1] — 2026-11-03
+
+### Changed
+
+- Prepared the release-candidate packages for Linux, Windows, macOS, Web and the
+  optional Desktop HQ zip. The Web/HQ archives now include the credits, privacy,
+  accessibility and known-limitations pages, and release publishing writes
+  SHA-256 checksums and rolls back partial uploads.
+
+### Fixed
+
+- Corrupt or partial save files now fall back to safe defaults without logging a
+  parse error, and a failed atomic replace leaves the previous valid settings
+  intact. Added migration coverage for 0.8-era profiles and 0.9.0 checkpoints
+  across all three venues.
+
 ## [0.9.6] — 2026-11-02

 ### Changed
@@ -262,12 +302,6 @@ Semantic Versioning.

 ## [0.7.0] — 2026-11-01

-### Changed
-
- Agent workflow now requires maintaining this changelog for every patch, minor, and major version.
-
-## [Unreleased]
-
 ### Added

 - Distinct venue geometry: the Joke Shop is now a narrow brick alley with a
@@ -0,0 +1,117 @@
+# Credits and Provenance
+
+Gig Line is a local, single-player security-shift game built with Godot 4 and
+GDScript. This file records the asset provenance needed for the release review;
+it is not a legal opinion or a claim that every provider licence has already
+been cleared for public distribution.
+
+## Game, code and design
+
+- Game design, systems, scenarios, dialogue and UI code: the Gig Line project.
+- Engine: [Godot Engine 4.7.2](https://godotengine.org/), MIT licence.
+- The game bundles no third-party fonts; it uses Godot's default theme font.
+- No third-party music, sound effects or voice recordings are bundled. Crowd
+  ambience and radio cues are generated procedurally at runtime.
+
+## 3D characters, gear and props
+
+The local MakeHuman head prototype uses the CC0 MakeHuman/MPFB base mesh
+(see [`docs/makehuman-head-review.md`](docs/makehuman-head-review.md)); it is a
+development prototype, not a shipped character.
+
+The character, gear and prop library is generated by project-owned scripts
+(`tools/blender_assets.py`, `tools/npc_pipeline.py`, `tools/model_pipeline.py`)
+using Blender. The `.blend` working sources are developer artifacts and are not
+shipped. The exported `.glb` files and baked AO maps are project assets; they do
+not embed third-party models or purchased asset packs.
+
+### Development-only research previews
+
+Two review sheets under `docs/blender_previews/` compare source candidates for
+the future NPC variety work. They are development documentation and are not
+bundled with the game or its release packages. The underlying source models are
+kept outside version control.
+
+- [`sheet_npc_sources_research.jpg`](docs/blender_previews/sheet_npc_sources_research.jpg)
+  includes renders of **Quaternius Ultimate Modular Characters** (CC0 1.0,
+  <https://quaternius.com/>), **Kenney Blocky Characters 2.0** (CC0 1.0,
+  <https://kenney.nl/assets/blocky-characters>), and **CesiumMan** and
+  **RiggedFigure** (CC BY 4.0, © 2017 Cesium,
+  <https://github.com/KhronosGroup/glTF-Sample-Assets>).
+- [`sheet_npc_crowd_prototypes.jpg`](docs/blender_previews/sheet_npc_crowd_prototypes.jpg)
+  contains renders of project-owned generator prototypes.
+
+The CC-BY preview images are included only as development evidence. Any future
+shipped derivative of CesiumMan or RiggedFigure must keep the attribution above.
+
+### MakeHuman head source
+
+The standalone MakeHuman head prototype is derived from the MakeHuman / MPFB base
+mesh, **CC0** (`assets/models/blender_src/makehuman_head.glb`; source
+`tmp/npc-research/makehuman/base.obj` with its bundled
+`LICENSE.md`/`LICENSE.ASSETS.md`). It is cut, retopologised and re-weighted by
+project scripts; the exported character GLBs remain project assets. See ADR-0015
+and `docs/npc-model-sourcing.md`.
+
+The venue geometry is authored procedurally in `src/game/world_builder.gd` as a
+stylized reconstruction. The Joke Shop is a fictional stand-in for the real
+Sunset Strip block; the game does not claim endorsement by, or an exact replica
+of, any real venue or tenant.
+
+### Development-only reference images
+
+The venue reference boards under `docs/screens/refs/` are development documentation and are not
+bundled with the game or its release packages. Files under CC BY are attributed here as well as in
+their folder sidecar:
+
+- `docs/screens/refs/hollywood/el-capitan-facade-day-wikimedia-2009-10-27.jpg` — "woo (Irvine, CA,
+  USA)", CC BY 2.0, via Wikimedia Commons.
+- `docs/screens/refs/hollywood/el-capitan-theatre-blade-sign-day-wikimedia-2008-10.jpg` — Andreas
+  Praefcke, CC BY 3.0, via Wikimedia Commons.
+- `docs/screens/refs/hollywood/premiere-staging-street-day-wikimedia-2006-02-12.jpg` — John
+  Barreiros, CC BY 2.0, via Wikimedia Commons.
+- Public-domain files in the same folder: Charles W. Beam (1922) and Gary Minnaert (2006).
+- `docs/screens/refs/hollywood/el-capitan-theatre-marquee-neighbour-day-wikimedia-2009-07-11.jpg` —
+  Alan Light, CC BY 2.0, via Wikimedia Commons.
+- `docs/screens/refs/hollywood/hollywood-boulevard-night-context-ccbysa.jpg` — Downtowngal,
+  CC BY-SA 3.0, via Wikimedia Commons; used unmodified for colour/lighting study only, no derivative
+  asset is made from it.
+- CC0 files in the Hollywood folder need no attribution: Luijtenphotos (2019) and Benoît Prieur
+  (2022).
+
+## AI-assisted images
+
+Surface textures, skyline panoramas, UI art and concept references were produced
+with image-generation calls from the project's tooling. The default model slugs
+recorded in the source are:
+
+- `bytedance-seed/seedream-4.5` — `tools/generate_textures.py`
+- `openai/gpt-5-image-mini` — `tools/asset_pipeline.py`,
+  `tools/model_pipeline.py`, `tools/scene_concepts.py` and
+  `tools/screen_designs.py`
+- Judging/review calls use the model selected by `tools/openrouter_judge.py` and
+  are development-only; they do not ship in the game.
+
+The prompts and generation workflow live in those tools. Per-file generation
+metadata is not stored with every image, so the exact provider, model version and
+generation date of each committed bitmap cannot be reconstructed from the
+repository alone. Before a public 0.10.0 release, the provider terms and
+commercial-use/redistribution rights for those generated outputs must be
+reviewed and recorded. **This is a release blocker, not an assumed clearance.**
+
+Reference photographs linked from the venue documents are hosted on Wikimedia
+Commons and were used for proportion/material study only. They are not included
+in the game or its release packages. If any future derivative asset copies a
+reference more directly, its attribution and licence must be added here.
+
+## Audio
+
+All runtime audio is procedural (crowd bed, radio crackle and interface cues).
+There are no external audio files, so there is no separate music/SFX licence to
+clear. See `docs/accessibility.md` for caption and volume behaviour.
+
+## Third-party names
+
+The game is a work of fiction. Real place names and public references are used
+for orientation and satire/stand-in geography; no real person, venue or brand
+endorses the game. Review the storefront and trademark language before release.
@@ -1109,7 +1109,6 @@ Completed 2026-11-01. The follow-ups left over after the texture/skyline adoptio

 Completed 2026-11-01.

-
 ### Storage restructure

 - [x] Decide the canonical runtime image root (`assets/images/` for UI/scene art): recorded in
@@ -1119,21 +1118,18 @@ Completed 2026-11-01.
 - [x] Re-run `godot --headless --path . --import` to regenerate `.import` sidecars after any move.
 - [x] Confirm `.gitignore` still excludes development-only outputs (concepts, Blender sources, raw AI fabrics) under the new layout; Blender `.blend` sources are now untracked and ignored.

-
 ### Documentation path updates

 - [x] Update `README.md` paths (screen-designs section, confirmed-assets links, the `assets/images/scenes` resize example).
 - [x] Update `docs/architecture.md`, `PLAN.md`, and ADR references: docs/screens/designs/ is now explicitly the reference-only snapshot; runtime art lives in assets/images/ (ADR-0014).
 - [x] Update `tools/screen_designs.py` docstrings and mark the old paths in `DONE.md` as historical.

-
 ### Code path updates

 - [x] Point `tools/screen_designs.py generate` at the new design output path and keep `compare`/`judge` reading the right locations.
 - [x] Update GDScript `preload()` paths if game textures move (no runtime material/model textures moved; UI art added under assets/images/).
 - [x] Update capture output directories if captures relocate (none did; QA captures stay in docs/screenshots/).

-
 ### Load proposed interfaces + scene art from disk

 - [x] Add a central UI/scene art loader (e.g. `src/game/ui/art.gd`) that loads the mockup-derived images from the new runtime root, with a procedural fallback when a file is missing.
@@ -1144,19 +1140,16 @@ Completed 2026-11-01.
 - [x] Wire the wand popup to `wand_screening` art.
 - [x] Style the radial menu and finish the remaining HUD chrome against their reference images.

-
 ### Verify against the mockups

 - [x] Regenerate the staged captures and run `screen_designs.py compare` (11 good, 0 bad; verified in a clean HEAD worktree).
 - [x] Run `screen_designs.py judge` and clear every `diff` verdict (7 match, 4 review, 0 diff).
 - [x] Add the capture + compare step as a repeatable smoke so drift is caught early (`tools/check_screenshots.sh`).

-
 ## Fix mouse movement bug

 - [x] Investigate why mouse input is not being captured or processed correctly in the game window (fixed: `_start_shift()` now calls `_refresh_freeze()`).

-
 ## Improve in-game pop-ups

 - [x] Improve the visual appearance of in-game pop-ups (start/pause/settings/review/radio/wand/inspection art, buttons, palette, icons, text).
@@ -1350,7 +1343,7 @@ venues, and see enough authored variety that a second shift does not feel like a
 - [x] Write the tutorial beat sheet: menu → movement/look → focus and target cycling → action
      wheel → access inspection → polite direction → formal warning/body camera → radio →
      shift review. Eight beats and a safe compliant visitor are specified in
-      [`docs/tutorial.md`](docs/tutorial.md).
+      [`docs/gameplay.md#first-shift-tutorial`](docs/gameplay.md#first-shift-tutorial).
 - [x] Add a tutorial state machine independent of the normal shift FSM. `Tutorial` in
      `src/game/tutorial.gd` owns the eight beats, accepts only the current beat's action,
      supports skip/restart and has deterministic headless tests. GameManager/UI wiring starts
@@ -1551,7 +1544,7 @@ and supported by a stable CI/release baseline.

 - [x] Existing scenario-content, tutorial and campaign smokes cover the venue/action/review paths;
      the 0.9.5 release candidate adds the external first-hour pass.
- [x] `docs/getting-started.md` and `docs/smoke-checklist.md` list tutorial, campaign/checkpoint,
+- [x] `docs/getting-started.md` and `docs/release-qa.md#manual-smoke-checklist` list tutorial, campaign/checkpoint,
      session, scenario, audio, crowd, emergency, movement and performance smokes.
 - [x] Current gallery/judge baselines are green; the 0.9.5 release candidate refreshes the final
      gallery after content lock.
@@ -1596,7 +1589,7 @@ Goal: streamline the maps, refactor geometry to match the images in `docs/screen
 - [x] Remove unnecessary or hidden geometry to improve performance.
 - [x] Ensure texture and material consistency across the map.

-Completed: the Hollywood venue is rebuilt from the real 6840 Hollywood Blvd references (six-column Masonic/El Capitan facade, eight steps, neighbours, Ovation arcade, Walk of Fame, four-lane street). The map-budget test measures 58,884 triangles across 409 meshes; Day/Night menu variants start in `EARLY`/`LATE`; the realism judge gaps are 0.148 (day) and 0.278 (late). See `docs/hollywood-boulevard-map.md`.
+Completed: the Hollywood venue is rebuilt from the real 6840 Hollywood Blvd references (six-column Masonic/El Capitan facade, eight steps, neighbours, Ovation arcade, Walk of Fame, four-lane street). The map-budget test measures 58,884 triangles across 409 meshes; Day/Night menu variants start in `EARLY`/`LATE`; the realism judge gaps are 0.148 (day) and 0.278 (late). See `docs/venues.md#hollywood-boulevard`.

 ### Map 2 — Joke Shop

@@ -1608,7 +1601,7 @@ Completed: the Hollywood venue is rebuilt from the real 6840 Hollywood Blvd refe
 - [x] Remove unnecessary or hidden geometry to improve performance.
 - [x] Ensure texture and material consistency across the map.

-Completed 2026-11-02: the Joke Shop is rebuilt from the real Comedy Store block at 8433 Sunset Blvd (27 m black hall, signature canopy, circular blade sign, red curtains, west entrance, low-rise neighbours, dry hillside and opposite frontage). The map-budget test measures 22,680 triangles across 454 meshes. The day/late captures and real-site notes are in `docs/joke-shop-map.md` and `docs/screens/concepts/joke_shop/`; the final gallery passed 13 good / 0 bad and the screen-design judge (13/13 match, 0 diff), with a 0.454 realism gap on the photoreal night reference.
+Completed 2026-11-02: the Joke Shop is rebuilt from the real Comedy Store block at 8433 Sunset Blvd (27 m black hall, signature canopy, circular blade sign, red curtains, west entrance, low-rise neighbours, dry hillside and opposite frontage). The map-budget test measures 22,680 triangles across 454 meshes. The day/late captures and real-site notes are in `docs/venues.md#the-joke-shop` and `docs/screens/concepts/joke_shop/`; the final gallery passed 13 good / 0 bad and the screen-design judge (13/13 match, 0 diff), with a 0.454 realism gap on the photoreal night reference.

 ### Scenery Change (Day/Night) for Hollywood Boulevard

@@ -1727,9 +1720,9 @@ screen-design judge before any model/texture changes. No gameplay rules change.
 - [x] Ran `tools/check_screenshots.sh` and `screen_designs.py compare`: 21 good,
      0 bad.
 - [x] Ran the judge with automatic model selection: 21/21 match, 0 review, 0 diff.
- [x] Recorded the judge model and result in `docs/screen-design-report.md`; the
+- [x] Recorded the judge model and result in `docs/ui-copy.md#screen-design-judge-report`; the
      generated captures remain local/gitignored.
- [x] Add a short UI copy/button checklist to `docs/smoke-checklist.md`.
+- [x] Add a short UI copy/button checklist to `docs/release-qa.md#manual-smoke-checklist`.
 - [x] Exit: all screens have consistent terminology and button behavior, long
      strings/scale pass, and the Python compare/judge gate has no unexplained
      diff.
@@ -1775,7 +1768,7 @@ and equipment fit.

 - [x] Audit all variants against a shared human proportion guide (head height, shoulder width,
      torso length, hip width, limb length, foot length) and correct the worst outliers.
-      (`tools/npc_proportions.py` + `docs/npc-proportion-audit.md`: all eight pass; no skeleton or
+      (`tools/npc_proportions.py` + `docs/npc-visual-review.md#proportion-audit`: all eight pass; no skeleton or
      mesh rescue was needed. Head and broad-build silhouettes are nearest their upper bounds.)
 - [x] Improve the neck and shoulder transition so the silhouette reads as one body rather than a
      thin post on a hanger. (Fuller neck base/top, lower shoulder root, degenerate-face cleanup;
@@ -1943,7 +1936,6 @@ Compatibility/Web parity, deterministic assets and offline CI.
      carry the texture results; the 0.9.5 section moved to `DONE.md` after the
      release build.)

-
 Completed 2026-11-02: all 0.9.5 texture and material checks are closed. The NPC
 base and eight library characters use 256² maps, cloth/pants use the 4× fabric
 weave without baked-AO blotches, the Walk of Fame band uses the paver/terrazzo
@@ -1957,3 +1949,197 @@ screen-design judge is 21/21 match. The optional realism judge ran with
 local; the committed comparison sheet is
 `docs/blender_previews/sheet_texture_refinement_0.9.5.jpg`. Tagged `v0.9.5`;
 Gitea run 922 passed checks and the full build and published seven assets.
+
+## Patch 0.9.6 — Integration, performance and judge gate
+
+Goal: integrate the UI/model/texture patches, prove the combined build on the
+target paths and leave a clean release-candidate handoff.
+
+### Integration and asset rebuild
+
+- [x] Rebuild all changed Blender/GLB/AO assets, re-import, and verify manifest/fit/
+      audit coverage. (The v0.9.5 commit already rebuilt the base, eight characters,
+      gear and AO maps; this checkpoint re-imported them and re-ran
+      `blender_assets.py audit`/`fit` and `npc_pipeline.py audit`, all exit 0.)
+- [x] Run the complete headless suite, Python tooling and smoke matrix; fix any
+      regression from the three polish patches. (Godot 263/263, Python 101/101;
+      14 smokes green: audio, campaign, crowd, emergency, focus/radial, movement,
+      NPC budget, PLAN verbs, props, scenario content, session shell, timeline,
+      tutorial and UI flows. Campaign/tutorial used isolated `XDG_DATA_HOME`.)
+- [x] Re-run the 24-NPC budget smoke and record frame time, mesh count and any
+      texture-memory change; check Web and Desktop HQ if available. (24 avatars,
+      168 meshes, 131,616 triangles, 6.90 ms of 50 ms headless; NPC maps remain
+      0.48 MB. A clean detached worktree at `f5b8ef2` built Linux/Windows/macOS/
+      Web/HQ (`161.5/197.1/148.0/97.8/241.5 MB`); the Web zip has index.html,
+      wasm and pck, the HQ zip has `override.cfg`, and the HQ binary launches
+      headless with the Forward+ override.)
+- [x] Verify save/campaign/tutorial behavior is unchanged by the visual/UI patches.
+      (Persistence/session tests remain in the 263-test suite; campaign and tutorial
+      smokes passed with isolated `XDG_DATA_HOME`.)
+
+### Visual gallery and judge gate
+
+- [x] Recapture the full gallery, portraits, venue/realsim stages and Desktop HQ A/B
+      as needed; no stale screenshots in the release set. (Gallery 21/21,
+      NPC baseline 48 frames, final-context review 96 frames and a fresh 10-shot
+      realism run were recaptured. No Forward+ code changed since 0.7.1, so the
+      HQ A/B was not re-staged; the HQ artifact is checked with the release build.)
+- [x] Run `tools/check_screenshots.sh`, `screen_designs.py compare` and
+      `screen_designs.py judge` on the final captures. (21 good / 0 bad; compare
+      21 good / 0 bad; judge 21/21 match, 0 review, 0 diff.)
+- [x] Run the realism judge for the affected concepts with a pinned model; record
+      model, attempt count, spend and verdicts. (`z-ai/glm-5.3-flash`, 1 pass per
+      shot, 10 shots, no fallback/retry: mean overall 2.1, lighting 2.4, materials
+      2.1, texture 1.7, backdrop 2.3, characters 1.8, Pillow gap 0.291. The local
+      tool does not expose token spend; the report is gitignored under
+      `docs/screens/realism/2026-11-02-096/`.)
+- [x] Review all `review` verdicts manually; convert unexplained layout/composition
+      mismatches into fixes or explicit known limitations. (Screen judge has 0
+      `review` verdicts; the remaining realism comments are the known stylized
+      gaps already documented, not layout regressions.)
+- [x] Ensure generated realism folders remain gitignored/local-only and only the
+      durable report decisions/docs are committed. (`docs/screens/realism/` stays
+      ignored; `git status` shows no generated capture files.)
+
+### Release-candidate handoff
+
+- [x] Update README, architecture, development status, changelog and TODO with the
+      final patch-level results and any remaining gaps. (README/PLAN/architecture
+      now point at 0.9.6; the changelog and development status record the
+      integration build, performance numbers, judge results and the clean-worktree
+      export rule; `docs/RELEASING.md` documents the ignored-folder trap.)
+- [x] Tag/version or otherwise freeze `0.9.6` as the integration checkpoint before
+      the `0.10.0` release candidate. (Tag `v0.9.6` on `4bb2896`; Gitea run 1296
+      passed checks and the full build and published seven assets.)
+- [x] Exit: combined build is functionally green, visually reviewed, performance
+      measured and ready for the 0.10.0 content-lock/playtest phase.
+
+Completed 2026-11-03: the 0.9.6 integration checkpoint is closed. The current
+asset set re-imported and passed `blender_assets.py audit`/`fit` and
+`npc_pipeline.py audit`; the full suite is 263/263 with 101/101 Python tests and
+14 smokes green; the 24-NPC budget is 6.90 ms with 168 meshes and 131,616
+triangles; the gallery and screen-design gate are 21 good / 0 bad and 21/21
+match; the pinned realism judge (`z-ai/glm-5.3-flash`) scored mean overall 2.1
+with a 0.291 Pillow gap. A clean worktree built Linux/Windows/macOS/Web/HQ at
+161.5/197.1/148.0/97.8/241.5 MB; the Web zip and HQ override were checked and
+the HQ binary launched headless. Tagged `v0.9.6`; Gitea run 1296 passed checks
+and the full build and published seven assets.
+
+## Character development
+
+Completed 2026-11-04. The procedural crowd-variety roster (four new variants, per-role pools)
+shipped with the realistic face; the external-asset intake and the MakeHuman body pipeline were
+promoted to the active **MakeHuman character pipeline** track in `TODO.md`.
+
+## Character development
+
+Goal: break the eight-character clone effect with four licence-cleared crowd-variety looks while
+keeping the frozen `npc_base` bone, tint-slot and gear-attach contract. The procedural generator is
+the primary path; Quaternius is a reviewed reference and MakeHuman is deferred to a separate local
+development pipeline.
+
+The roster build is deliberately sequenced **after** the 3D model and local map re-evaluation: the new variants
+must inherit the reviewed face/hand/gear baseline instead of multiplying whatever it finds.
+
+*Skill route: `character-artist`, `retopology`, `rigging`, `uv-workflow`, `materials`,
+`asset-optimization`, `lowpoly-style`, `godot-export`, `qa-review`.*
+
+### Source review and decision
+
+- [x] Research free/open-source character sources and evaluate at least three downloads against
+      the existing Blender contract. (Measured Quaternius CC0, Kenney CC0, Khronos
+      CesiumMan/RiggedFigure CC-BY and the MakeHuman CC0 base mesh; none is a drop-in.
+      Results, local preview sheet and SHA-256 provenance are in
+      `docs/npc-model-sourcing.md`.)
+- [x] Review the sourcing research with the project owner and choose Option A (procedural),
+      Option B (Quaternius CC0 intake) or Option C (MakeHuman/MPFB body pipeline); record the
+      decision in an ADR and in `MEMORY.md`. (2026-11-03: extend the procedural generator as the
+      primary path, keep Quaternius as a reviewed prototype/reference, defer MakeHuman to a
+      separate local pipeline. Recorded in ADR-0015 and `MEMORY.md`.)
+- [x] Add a source licence allow-list and provenance rule: CC0 preferred, CC-BY only with
+      attribution in `CREDITS.md`, and no service assets whose terms restrict redistribution.
+      (ADR-0015; the CC-BY research previews are attributed in `CREDITS.md`.)
+- [x] Decide whether the external preview sheet stays local under `tmp/` or is committed with
+      the required CC-BY attribution. (Committed as
+      `docs/blender_previews/sheet_npc_sources_research.jpg` with Cesium CC-BY attribution;
+      the project-owned crowd prototype sheet is also committed.)
+
+### Intake and validation
+
+- [x] Add a Blender `inspect` path that imports a GLB, applies node transforms, reports
+      tris/verts, bounds, bones, materials, UVs and skinning, and lists contract failures.
+      (`blender_assets.py inspect --file ...` applies parent/object transforms, converts to
+      Godot Y-up, ignores the importer's bone-shape helper and prints budgets, bones, slots,
+      UVs, skinning and animations with issues/warnings; `--json` and `--category` supported.
+      Seven synthetic contract tests added; all 46 library GLBs inspect clean. `audit` remains
+      the final gate.)
+- [x] `adapt` path: promoted to the **MakeHuman character pipeline** track (2026-11-04).: scale/ground, weld seams, decimate, map the
+      five tint slots, and either rebuild the contract armature or record an explicit second-rig
+      contract. Use `retopology`/`rigging`/`uv-workflow` guidance for the manual steps, but keep
+      the Quaternius no-go: a contract rebuild needs a proportion warp, so this is not on the
+      character critical path.
+- [x] Audit gate + intake regression test: promoted to the **MakeHuman character pipeline** track.
+- [x] Adapter documentation: promoted to the **MakeHuman character pipeline** track.
+
+### Quaternius prototype
+
+- [x] Prototype one Quaternius CC0 variant: weld/decimate to budget and capture Idle/Walk
+      renders. (12,518 imported verts -> 3,199 after weld -> 2,423 / 4,654 tris after a 0.75
+      decimate; Idle/Walk quality is good. Preview in
+      `docs/blender_previews/sheet_npc_sources_research.jpg`.)
+- [x] Measure the prototype against the `npc_casual` controls: silhouette, rest pose, body
+      proportions and gear fit. (No-go for a contract rebuild: T-pose 62-bone realistic rig,
+      ~0.96 m hip, ~1.68 m arm span and ~0.153 m shoulder joint do not match the arm-down
+      13-bone contract. Keep as reference; a second rig/animation path needs its own ADR.)
+- [x] Make a go/no-go decision on Option B. (No-go for the current pass; proceed with the procedural
+      generator and keep Quaternius as a visual/style reference.)
+
+### Roster and runtime
+
+- [x] Approve four crowd-variety looks (build, head silhouette, hair/beard, outer layer and
+      accessory; no clothing that labels the NPC's behaviour). (`npc_crowd_a` bun/slim/sunglasses,
+      `npc_crowd_b` bald/broad/beard/shoulder bag, `npc_crowd_c` coat/umbrella, `npc_crowd_d`
+      hood/cup; prototype sheet committed.)
+- [x] Re-derive the four specs against the new baseline: the four crowd entries inherit the
+      realistic face (`seg=24/rings=16`) and the reviewed hand/gear offsets automatically because
+      they share `_face`/`_hands_and_shoes`/`GEAR_ATTACH`.
+- [x] Generate the four variants: built via `blender_assets.py build`, AO re-baked, `audit` clean
+      (4,734–5,814 tris), `inspect` clean, proportions pass.
+- [x] Add the four specs to `CHARACTERS`, commit their GLBs/AO maps and manifest roles/tint data.
+      (Note: this adds ~2 MB to the next release build via `export_filter=all_resources` — accepted
+      for the crowd-variety roster.)
+- [x] Per-role pools: `character_model_for()` now picks from `CHARACTER_POOLS` by seed — the
+      routine crowd roles gain the crowd variants (tourist → casual/crowd_a/crowd_d,
+      confused_visitor → casual/crowd_b, intoxicated → casual/crowd_c) while the special roles
+      keep their existing alternation (guest ⅓ jacket, trespasser/threat ½ hoodie). The test
+      now checks seed-stability plus that every pool entry resolves to a committed GLB
+      (277/277).
+- [x] Gear fit + inspect for the four new variants: `fit` is clean (sunglasses band=inside,
+      shoulder bag clear; cup/umbrella are hand gear with the forward offset), `inspect` clean,
+      proportions pass.
+- [x] Crowd-variety reference: five licence-cleared Commons photos fetched to
+      `tmp/research/crowd-variety/`; the AI proposal set stays the next step for detail.
+- [x] Baseline + portrait rows: the four variants are in `capture_npc_baseline.gd` and
+      `sheet_npc_baseline.jpg` (12 variants × 6 views); review-doc rows added.
+
+### QA and release
+
+- [x] Gates with the expanded library: 24-NPC budget smoke 152,464 tris / 168 meshes / 6.94 ms
+      (under 50 ms), portrait baseline 12 variants × 6 views, `fit` clean, Godot 277/277, Python
+      160/160. No release build is created for this unversioned track.
+- [x] Docs: `docs/development-status.md`, `docs/3d-model-review.md` and the baseline sheet updated;
+      `CREDITS.md` needs no change (the crowd variants are procedural, no new source). Accepted
+      visual limits: the crowd accessories (umbrella canopy, cup, sunglasses, beard) read at
+      full-body distance but not in the head-only portrait framing.
+- [x] Exit: the 12-character library passes contract audit, portrait/gear acceptance, the 24-NPC
+      budget and licence/provenance review; the runtime contract (13 bones, five tint slots,
+      `npc_base` fallback) is unchanged.
+
+### Deferred MakeHuman local pipeline
+
+- [x] Evaluate the MakeHuman CC0 base mesh for a later separate local development pipeline.
+      (19,158 verts / 36,972 tris; scaled to 1.82 m; decimate 0.35 -> 3,780 verts / 6,468 tris;
+      UVs present, no normals/material groups/rig. Feasible only with retopology, a custom rig and
+      project-owned clothing; keep out of CI/build.)
+- [x] Body-shape diversity decision (2026-11-04, owner): **yes** — use MakeHuman for the next
+      character pass. Promoted to the **MakeHuman character pipeline** track.
@@ -14,6 +14,23 @@ The game is about **judgment, communication, access verification, and proportion
 - **Emergency help is a last resort.** Responders handle crises the guard cannot safely manage; calling them has costs.
 - **Readability beats raw fidelity.** The GL Compatibility renderer, clear silhouettes, the focus ring, and the HUD stay legible.

+## Development Priorities
+
+The active planning order is set in [`TODO.md`](TODO.md) and in `AGENTS.md`:
+
+1. **Character development (unversioned).** Expand the owned procedural character library with
+   crowd, age, build, hair and outfit variety. Keep the frozen bone/tint/gear contract; see
+   [ADR-0015](docs/adr/0015-npc-model-variety-sourcing.md) and
+   [`docs/npc-model-sourcing.md`](docs/npc-model-sourcing.md). Quaternius is a reference;
+   MakeHuman is deferred to a separate local pipeline.
+2. **Local map development (unversioned).** Move beyond stylized venue reconstruction with
+   licensed OpenStreetMap and 3D building data, downloaded reference imagery for photoreal
+   facades, AI-assisted composition, and a Gaussian-splatting evaluation that stays in the
+   development pipeline unless it proves runtime-safe.
+3. **Versioned release hardening.** The 0.10.0 release candidate and later semantic versions come
+   after the unversioned development tracks in planning order. Versions are assigned only when a
+   track's scope is accepted into a release.
+
 ## Core Gameplay Loop

 1. Watch the entrance, steps, queue, and sidewalk.
@@ -127,7 +144,7 @@ Joke Shop escalation follows the common ladder: direction, explanation, repeat r

 ### Hollywood Boulevard Late Night TV Studio

-A busy studio entrance with audience members, production staff, performers, guests, deliveries, celebrity arrivals, tourists, influencers, and the same range of street behavior as the building scenario.
+A busy studio entrance at the same real El Capitan Entertainment Centre block as the Hollywood day shift, restaged for a late-night arrival: the same stone facade and steps with a bulb-lit canopy, a black car at the kerb and a barrier line. It has audience members, production staff, performers, guests, deliveries, celebrity arrivals, tourists, influencers, and the same range of street behavior as the building scenario.

 Staff and guests are recognized or present a wristband, credential, ticket, guest-list confirmation, or other approved marker. The player keeps the steps clear, protects arrivals and equipment, manages filming boundaries, watches for tailgating, and calls for help only when there is immediate danger.

@@ -152,14 +169,15 @@ The action wheel prioritizes de-escalation: Stop, Look, Point, No, Ask, Inspect,

 The visual direction is readable stylized realism:

- **Blender library:** 8 skinned NPC variants, 18 gear pieces, and 20 street/venue props, with baked albedo/normal/AO/ORM maps, a manifest, and procedural fallbacks. `Rig/Head` stays the focus anchor.
- **Realism pass:** AI-assisted per-phase skyline panoramas, v2 surface tiles with normal maps, wet asphalt at night, a warm day haze, phase-specific sun/exposure/fog, a visible flashlight beam, and denser foliage.
+- **Character direction:** 8 skinned NPC variants, 18 gear pieces and 20 street/venue props, with four crowd-variety variants prototyped. The generator-first expansion is the active character track ([ADR-0015](docs/adr/0015-npc-model-variety-sourcing.md)); Quaternius is a reference and MakeHuman is deferred to a local pipeline.
+- **Realism pass:** AI-assisted per-phase skyline panoramas, v2 surface tiles with normal maps, wet asphalt at night, a warm day haze, phase-specific sun/exposure/fog, a tight flashlight spot (no beam geometry), and denser foliage.
+- **Local map direction:** the venues are currently stylized reconstructions. The local-map track evaluates licensed OpenStreetMap/3D building data, licensed reference photography, AI-assisted composition and Gaussian splatting as a development tool; online data and splat rendering are not runtime dependencies.
 - **References and QA:** runtime UI art lives in `assets/images/ui/`; reference/art-direction sets live in `docs/screens/designs/` and `docs/screens/concepts/`; captures live in `docs/screenshots/`; realism runs live in `docs/screens/realism/`. `screen_designs.py compare/judge` and `tools/check_screenshots.sh` guard drift.
 - **Storage convention:** see [ADR-0014](docs/adr/0014-runtime-image-root.md). Never overwrite an existing image; new outputs get a new path or `-vN` suffix.

-The path from the current vertical slice to the 0.10.0 release candidate — content depth, onboarding, accessibility, platform QA and release readiness — is tracked in [`TODO.md`](TODO.md); this plan stays at the product/design level.
+The active planning order — unversioned character and local-map development first, then the versioned 0.10.0 release-candidate hardening and later releases — is tracked in [`TODO.md`](TODO.md); this plan stays at the product/design level.

-Primary decisions: [ADR-0007](docs/adr/0007-locomotion-and-input-layers.md), [ADR-0008](docs/adr/0008-cone-focus-and-head-ring.md), [ADR-0009](docs/adr/0009-radial-action-menu.md), [ADR-0010](docs/adr/0010-procedural-npc-presentation.md), [ADR-0011](docs/adr/0011-aim-free-selection-and-precision-walk.md), [ADR-0012](docs/adr/0012-surface-materials-and-generated-props.md), [ADR-0013](docs/adr/0013-blender-authored-npc-characters.md).
+Primary decisions: [ADR-0007](docs/adr/0007-locomotion-and-input-layers.md), [ADR-0008](docs/adr/0008-cone-focus-and-head-ring.md), [ADR-0009](docs/adr/0009-radial-action-menu.md), [ADR-0010](docs/adr/0010-procedural-npc-presentation.md), [ADR-0011](docs/adr/0011-aim-free-selection-and-precision-walk.md), [ADR-0012](docs/adr/0012-surface-materials-and-generated-props.md), [ADR-0013](docs/adr/0013-blender-authored-npc-characters.md), [ADR-0015](docs/adr/0015-npc-model-variety-sourcing.md).

 ## Tech Stack

@@ -176,7 +194,7 @@ Primary decisions: [ADR-0007](docs/adr/0007-locomotion-and-input-layers.md), [AD

 ## Versioning and Delivery

-`config/version` in `project.godot` is the single version source (currently `0.9.6`). Releases are tagged `v<version>`; the CI pipeline builds and publishes the standard artifacts plus the optional Desktop HQ zip. Version bumps follow [Semantic Versioning](https://semver.org/). See [`docs/RELEASING.md`](docs/RELEASING.md) and [`README.md`](README.md) for commands.
+`config/version` in `project.godot` is the single version source (currently `0.9.8`). Releases are tagged `v<version>`; the CI pipeline builds and publishes the standard artifacts plus the optional Desktop HQ zip. Version bumps follow [Semantic Versioning](https://semver.org/): every major, minor and patch increment needs a changelog entry, a local `tools/build_releases.sh` build, and artifact/checksum verification before tagging. Unversioned development tracks do not receive a version until their scope enters a release. See [`docs/RELEASING.md`](docs/RELEASING.md) and [`README.md`](README.md) for commands.

 ## Design Direction

@@ -0,0 +1,27 @@
+# Privacy Note
+
+Gig Line runs locally. The game itself does not include telemetry, analytics,
+accounts, advertising, cloud saves or network requests. It does not access the
+camera, microphone, contacts or location, and the body-camera feature is a
+simulated overlay, not a real recording device.
+
+Player data is written only to Godot's local `user://` directory:
+
+- `settings.json`
+- `campaign.json`
+- `shift_results.json`
+- `shift_state.json`
+
+Those files stay on the player's machine unless the player copies them. Deleting
+the files (or the `Gig Line` user directory) resets the profile. See
+[`docs/getting-started.md`](docs/getting-started.md#save-data-and-migration) for
+locations, migration and rollback instructions.
+
+The repository's development tools can call OpenRouter when a developer supplies
+`OPENROUTER_API_KEY`; those calls generate or judge development assets and are
+not part of the shipped game. The key and generated review artifacts remain
+local/gitignored.
+
+Questions about a storefront release should be checked against the final package
+and the provider terms recorded in [`CREDITS.md`](CREDITS.md); external legal and
+storefront approval is still pending for 0.10.0.
@@ -6,20 +6,15 @@ The central design goal is simple:

 > The player wins by choosing the lowest level of escalation that keeps everyone safe.

-## Screenshots
+## Development Priorities

-| | |
-| --- | --- |
-| ![Venue overview: the El Capitan Entertainment Centre facade with six Ionic columns, red banners and stone steps](docs/screenshots/01-venue-overview.png) | ![Targeting an approaching NPC with the interaction HUD](docs/screenshots/02-targeting-npc.png) |
-| ![Access inspection: wristband/credential check with allow/deny prompt](docs/screenshots/03-access-inspection.png) | ![Radio report form: emergency dispatch panel](docs/screenshots/04-radio-report.png) |
-| ![Late night: street lamps lit, marquee glowing, dark Hollywood Boulevard](docs/screenshots/05-late-night-avenue.png) | ![Night shift: guard flashlight cutting through the dark](docs/screenshots/06-night-flashlight.png) |
-| ![Wand screening at The Joke Shop: false alarm on keys](docs/screenshots/07-wand-screening.png) | ![Escalation HUD at L3 with body camera armed and reaction log](docs/screenshots/08-escalation-hud.png) |
-| ![Body-camera timeline: formal warning, body camera on, blocking](docs/screenshots/09-body-camera-timeline.png) | ![Prop gallery: the six generated street-furniture models on a studio backdrop](docs/screenshots/10-prop-gallery.png) |
-| ![Precision walk at the venue steps with the HUD chip visible](docs/screenshots/11-precision-walk.png) | ![The Joke Shop: a black Sunset Strip club under its signature canopy at night](docs/screenshots/12-joke-shop.png) |
-| ![Late-night TV studio arrival: stone facade, bulb canopy, black car and barriers](docs/screenshots/13-studio-arrival.png) | |
+The active planning order lives in [`TODO.md`](TODO.md) and [`AGENTS.md`](AGENTS.md):

-*Screenshots are generated by [`src/test/capture_screenshots.gd`](src/test/capture_screenshots.gd) and [`src/test/capture_prop_gallery.gd`](src/test/capture_prop_gallery.gd) from the current build — day, late-night, wand screening, escalation, shift-review timeline,
-precision walk, the Joke Shop's Sunset Strip frontage, the TV Studio arrival, and the prop lineup.*
+1. **3D model and local map re-evaluation** — score every shipped asset, then evaluate licensed OpenStreetMap/3D data, reference-derived photoreal facades, AI-assisted composition and a Gaussian-splatting development evaluation.
+2. **Character development** — crowd, age, build, hair and outfit variety on the owned procedural library, keeping the frozen NPC contract. Source evaluation and the licence decision are in [`docs/npc-model-sourcing.md`](docs/npc-model-sourcing.md).
+3. **Versioned release hardening** — the 0.10.0 release candidate and later semantic versions follow the unversioned development tracks.
+
+Versions are assigned only when a track's scope is accepted into a release. Every major, minor and patch version requires a changelog entry, a local release build and artifact verification before tagging.

 ## ⬇️ Downloads

@@ -38,13 +33,15 @@ precision walk, the Joke Shop's Sunset Strip frontage, the TV Studio arrival, an
 > Downloads are public (no sign-in required) since the host's instance-wide
 > `REQUIRE_SIGNIN_VIEW` was disabled on 2026-10-31.
 >
-> **Latest published: v0.9.5** — the texture and material refinement pass:
-> 256² NPC maps, a four-times fabric weave without baked AO blotches, repair of
-> the Walk of Fame terrazzo band and awning stripe, and per-phase skyline haze,
-> on top of the v0.9.4 NPC visual optimization, the Hollywood/Joke Shop maps and
-> the v0.9.3 UI/accessibility polish.
+> **Latest published: v0.9.8** — the character-development patch: the
+> 12-character library, realistic face pass, four crowd-variety variants and the
+> wrist/hip/knee deformation fixes. Previous 0.9.x patches added the
+> Hollywood/Joke Shop maps, UI/accessibility polish, NPC visual optimization,
+> texture/material refinement and integration checkpoint.
 >
-> **Current source: v0.9.6** — tagged and built from the same commit.
+> **Current source: v0.9.8** — tagged from the same commit. The 0.10.0
+> development track remains gated on the NPC overhaul, MakeHuman/local-map work
+> and release approvals.
 > Releases are built automatically when a `vX.Y.Z` tag is pushed
 > (see [`docs/RELEASING.md`](docs/RELEASING.md)); manual builds use
 > `./tools/build_releases.sh`. Installer/AppImage packaging runs in the same pipeline
@@ -59,6 +56,59 @@ If you are here to develop or test locally instead of downloading, jump to

 The project is under active development. The design and architecture are documented, and a playable prototype vertical slice exists (Godot 4 + GDScript): a stylized El Capitan Entertainment Centre block, a first-person guard, simulated NPCs with intents and reactions, the six-level escalation model, access inspection and admission decisions, radio calls with credibility checks, reputation, crowd mood, and an end-of-shift review.

+## Screenshots
+
+Every capture is rendered from the current build by [`tools/check_screenshots.sh`](tools/check_screenshots.sh)
+(21 captures, compared against the runtime art). The full gallery, including every UI state, is in
+[`docs/screenshots/`](docs/screenshots/README.md).
+
+### Venues
+
+| | |
+| --- | --- |
+| ![Hollywood Boulevard day shift](docs/screenshots/01-venue-overview.png) | **Hollywood Boulevard — day.** The El Capitan Entertainment Centre block: six Ionic columns, Masonic parapet, event banners, eight stone steps and the Walk of Fame terrazzo. |
+| ![Hollywood Boulevard at night](docs/screenshots/05-late-night-avenue.png) | **Hollywood Boulevard — late.** Sconces pool on the limestone, street lamps light the boulevard and the skyline fades into night haze. |
+| ![Flashlight on the entrance at night](docs/screenshots/06-night-flashlight.png) | **Night patrol.** A tight flashlight spot picks out the door and the person in front of it; movement and awareness change at night. |
+| ![The Joke Shop at night](docs/screenshots/12-joke-shop.png) | **The Joke Shop.** A black Sunset Strip club under its signature-covered canopy, circular blade sign, red curtains and the dry hillside behind. |
+| ![Late-night TV studio arrival](docs/screenshots/13-studio-arrival.png) | **TV Studio arrival.** Stone facade, bulb canopy, black car and crowd barriers for a late celebrity arrival. |
+
+### Interaction and systems
+
+| | |
+| --- | --- |
+| ![Targeting an NPC](docs/screenshots/02-targeting-npc.png) | **Focus and targeting.** The cone focus ring, name tag and target chip; `Tab`/wheel cycles nearby people without aiming. |
+| ![Access inspection](docs/screenshots/03-access-inspection.png) | **Access inspection.** A venue-correct wristband check with evidence shown before the admit/refuse decision. |
+| ![Radio report](docs/screenshots/04-radio-report.png) | **Radio report.** Security assistance with location, behaviour and what was actually seen. |
+| ![Wand screening](docs/screenshots/07-wand-screening.png) | **Wand screening.** A false alarm on keys: ask the guest to identify the item before choosing a response. |
+| ![Escalation HUD](docs/screenshots/08-escalation-hud.png) | **Escalation.** Level 3 blocking with the shape meter, body camera armed and the reaction log. |
+| ![Body-camera timeline](docs/screenshots/09-body-camera-timeline.png) | **Body-camera timeline.** Every recorded event, step by step, in the shift review. |
+| ![Precision walk](docs/screenshots/11-precision-walk.png) | **Precision walk.** Half-speed close work on the steps, with the HUD state chip visible. |
+
+### Shell and UI
+
+| | |
+| --- | --- |
+| ![Start menu](docs/screenshots/14-start-menu.png) | **Venue menu.** Day and night rows for Hollywood, the Joke Shop and the TV Studio, campaign continue and review links. |
+| ![Settings](docs/screenshots/16-settings-panel.png) | **Settings.** Difficulty, volumes, HUD scale, reduce motion, captions and key/button remapping, all persisted. |
+| ![Shift review](docs/screenshots/17-shift-review.png) | **Shift review.** Grade, policy outcome, incidents, responder results and campaign Continue. |
+| ![Action wheel](docs/screenshots/19-radial-menu.png) | **Action wheel.** De-escalation first: stop, look, point, no, ask, inspect, warn, block, reason, recognize, radio. |
+
+### 3D asset progress
+
+The character, gear and prop libraries are authored procedurally in Blender and audited before use;
+the sheets below track their visual progress.
+
+| | |
+| --- | --- |
+| ![Eight NPC characters](docs/blender_previews/sheet_npc.jpg) | **Character library.** Eight skinned variants (4.5–5.5k triangles each) with five tint slots, attach-point gear and baked maps. |
+| ![Prop library](docs/blender_previews/sheet_props.jpg) | **Street and venue props.** Twenty library props with colliders, navigation avoidance and colour atlases. |
+| ![Neutral NPC baseline](docs/blender_previews/sheet_npc_baseline.jpg) | **Neutral baseline.** 8 characters × 6 views (front, three-quarter, profile, back, full body, crowd) used for the 0.9.4 pass and the current re-evaluation. |
+| ![Texture refinement comparison](docs/blender_previews/sheet_texture_refinement_0.9.5.jpg) | **Texture refinement.** 128 → 256 px NPC maps and a 4× fabric weave, shown before/after on the same camera. |
+| ![Crowd-variety prototypes](docs/blender_previews/sheet_npc_crowd_prototypes.jpg) | **Crowd variety prototypes.** Four approved looks (bun/slim, bald/broad, coat/umbrella, hood/cup) queued for the roster build. |
+
+More sheets and the review criteria are in [`docs/blender_previews/`](docs/blender_previews/README.md)
+and [`docs/3d-model-review.md`](docs/3d-model-review.md).
+
 ## Game Overview

 A typical shift lasts 10–15 minutes: watch the entrance and sidewalk, judge why
@@ -106,38 +156,56 @@ Full setup, every run/test/smoke command, and the controls table are in

 ## Project Documentation

- [`PLAN.md`](PLAN.md) — Game design plan and scenario details.
- [`AGENTS.md`](AGENTS.md) — Development and collaboration workflow.
+- [`PLAN.md`](PLAN.md) — Game design plan, development priorities and scenario details.
+- [`TODO.md`](TODO.md) — Priority-ordered tasks: character and local-map development, release milestones, and future work.
+- [`docs/README.md`](docs/README.md) — Documentation index, current priorities and visual previews.
+- [`docs/npc-model-sourcing.md`](docs/npc-model-sourcing.md) — Character-source evaluation, licence rules and the character-development plan.
+- [`docs/makehuman-head-review.md`](docs/makehuman-head-review.md) — Local MakeHuman head prototype, provenance and review verdict.
+- [`AGENTS.md`](AGENTS.md) — Development, commit, build and collaboration workflow.
 - [`DONE.md`](DONE.md) — Completed task sections.
 - [`MEMORY.md`](MEMORY.md) — Persistent session notes.
 - [`CHANGELOG.md`](CHANGELOG.md) — User-facing changes by version.
- [`docs/README.md`](docs/README.md) — Documentation index and visual previews.
 - [`docs/architecture.md`](docs/architecture.md) — arc42-style architecture documentation.
 - [`docs/gameplay.md`](docs/gameplay.md) — Gameplay systems, venues, and the escalation model.
- [`docs/hollywood-boulevard-map.md`](docs/hollywood-boulevard-map.md) — Real-site references, game mapping and limitations for the Hollywood venue.
- [`docs/joke-shop-map.md`](docs/joke-shop-map.md) — Real-site references, game mapping and limitations for the Joke Shop / Sunset Strip venue.
- [`docs/tutorial.md`](docs/tutorial.md) — First-shift tutorial beats and rules.
+- [`docs/venues.md`](docs/venues.md) — Real-site references, game mapping and limitations for Hollywood, the Joke Shop and the TV Studio.
 - [`docs/asset-tooling.md`](docs/asset-tooling.md) — Asset pipelines, model tools, and screenshot gates.
+- [`tools/README.md`](tools/README.md) — Tool inventory, categories, test commands and AI-skill evaluation.
+- [`.agents/skills/gig-line-blender-asset-contract`](.agents/skills/gig-line-blender-asset-contract/SKILL.md) — tracked AI skill for Blender/NPC/gear asset work.
+- [`.agents/skills/gig-line-release-qa`](.agents/skills/gig-line-release-qa/SKILL.md) — tracked AI skill for release and visual-QA work.
 - [`docs/getting-started.md`](docs/getting-started.md) — Setup, run/test commands, and controls.
 - [`docs/development-status.md`](docs/development-status.md) — Implemented features and what's next.
- [`docs/smoke-checklist.md`](docs/smoke-checklist.md) — Manual smoke-test checklist.
+- [`docs/accessibility.md`](docs/accessibility.md) — Accessibility features, known gaps and statement.
+- [`docs/known-limitations.md`](docs/known-limitations.md) — Release-candidate blockers and accepted limitations.
+- [`docs/release-qa.md`](docs/release-qa.md) — Manual smoke checklist and release-candidate balance protocol.
+- [`CREDITS.md`](CREDITS.md) — Credits, AI/reference provenance and licensing notes.
+- [`PRIVACY.md`](PRIVACY.md) — Local-only data, save files and development API use.
 - [`docs/blender-assets.md`](docs/blender-assets.md) — Blender asset library: characters, gear, props, attach points.
 - [`docs/npc-visual-review.md`](docs/npc-visual-review.md) — 0.9.4 NPC baseline, acceptance criteria and ranked visual gaps; 0.9.5 texture comparison is in [`docs/blender_previews/sheet_texture_refinement_0.9.5.jpg`](docs/blender_previews/sheet_texture_refinement_0.9.5.jpg).
- [`docs/npc-proportion-audit.md`](docs/npc-proportion-audit.md) — NPC proportion measurements against the shared stylized guide.
 - [`docs/adr/`](docs/adr/) — Architecture Decision Records.
- [`TODO.md`](TODO.md) — Active tasks plus the 0.x gap analysis and milestone roadmap.

 ## Development Status

-v0.9.6 is the current source version: the integrated texture/material and UI
-checkpoint on top of the 0.9.5 texture refinement (256² NPC maps, a 4× fabric weave with baked-AO removal, repaired
-Walk of Fame/awning surfaces and per-phase skyline haze), on top of the v0.9.4
-NPC visual optimization and the v0.9.3 UI/accessibility polish pass. It builds on
-v0.9.2's Hollywood/Joke Shop map rebuilds, v0.9.1's Godot 4.7.2 baseline,
-v0.9.0's production-quality pass, v0.8's
-tutorial/campaign/resume work and the v0.7.x venue/gear/judge work. See [`docs/development-status.md`](docs/development-status.md)
-for the implemented list and [`TODO.md`](TODO.md) for the 0.x roadmap. Manual
-verification uses the [`docs/smoke-checklist.md`](docs/smoke-checklist.md).
+v0.9.8 is the current source version: the character-development patch with the
+12-character library, realistic face and crowd variants, pose/deformation fixes
+and save-migration/release hardening. It sits on the 0.9.6 integration
+checkpoint, 0.9.5 texture refinement, 0.9.4 NPC visual optimization, 0.9.3
+UI/accessibility polish, 0.9.2 Hollywood/Joke Shop maps and the 0.9.x engine
+baseline. The active priorities are the Blender NPC head/face/hand overhaul,
+MakeHuman body intake and the 3D model/map re-evaluation; the 0.10.0 release
+candidate follows those tracks. See
+[`docs/development-status.md`](docs/development-status.md) for the implemented list
+and [`TODO.md`](TODO.md) for the priority-ordered roadmap. Manual verification uses
+[`docs/release-qa.md`](docs/release-qa.md).
+
+## Credits, Privacy and Accessibility
+
+Gig Line is a local-only single-player game: there is no runtime telemetry or
+network service, and saves stay in Godot's local `user://` folder. The
+body-camera overlay is simulated. Asset provenance, AI-assisted image usage and
+credits are recorded in [`CREDITS.md`](CREDITS.md); the local-data policy is in
+[`PRIVACY.md`](PRIVACY.md); accessibility features and gaps are in
+[`docs/accessibility.md`](docs/accessibility.md); and release-candidate blockers
+are listed in [`docs/known-limitations.md`](docs/known-limitations.md).

 ## Development Workflow

@@ -48,28 +48,6 @@
      "triangles": 380,
      "vertices": 408
    },
-    "beanie": {
-      "attach": "head",
-      "bounds_godot": {
-        "max": [
-          0.193,
-          0.215,
-          0.183
-        ],
-        "min": [
-          -0.193,
-          0.014,
-          -0.203
-        ]
-      },
-      "category": "npc_gear",
-      "materials": [
-        "plastic_grey"
-      ],
-      "path": "assets/models/blender/npc_gear/beanie.glb",
-      "triangles": 460,
-      "vertices": 403
-    },
    "bench": {
      "bounds_godot": {
        "max": [
@@ -96,14 +74,14 @@
    "bollard": {
      "bounds_godot": {
        "max": [
-          0.105,
+          0.125,
          0.975,
-          0.105
+          0.125
        ],
        "min": [
-          -0.105,
+          -0.125,
          0,
-          -0.105
+          -0.125
        ]
      },
      "category": "props",
@@ -114,7 +92,7 @@
      "path": "assets/models/blender/props/bollard.glb",
      "replaces": "generated/bollard.glb",
      "triangles": 138,
-      "vertices": 225
+      "vertices": 221
    },
    "camera": {
      "attach": "hand",
@@ -262,14 +240,14 @@
    "fire_hydrant": {
      "bounds_godot": {
        "max": [
-          0.24,
-          0.76,
-          0.19
+          0.265,
+          0.815,
+          0.235
        ],
        "min": [
-          -0.24,
+          -0.265,
          0,
-          -0.19
+          -0.235
        ]
      },
      "category": "props",
@@ -279,8 +257,8 @@
      ],
      "path": "assets/models/blender/props/fire_hydrant.glb",
      "replaces": "generated/fire_hydrant.glb",
-      "triangles": 466,
-      "vertices": 725
+      "triangles": 610,
+      "vertices": 902
    },
    "firefighter_helmet": {
      "attach": "head",
@@ -439,14 +417,15 @@
      "category": "props",
      "materials": [
        "news_blue",
+        "dark_metal",
        "glass",
        "paper",
        "steel"
      ],
      "path": "assets/models/blender/props/newspaper_box.glb",
      "replaces": "generated/newspaper_box.glb",
-      "triangles": 244,
-      "vertices": 528
+      "triangles": 300,
+      "vertices": 648
    },
    "npc_casual": {
      "bounds_godot": {
@@ -487,8 +466,8 @@
        "accessory",
        "hair"
      ],
-      "triangles": 4482,
-      "vertices": 4260
+      "triangles": 5034,
+      "vertices": 4607
    },
    "npc_coat": {
      "bounds_godot": {
@@ -528,8 +507,168 @@
        "accessory",
        "hair"
      ],
-      "triangles": 5474,
-      "vertices": 5264
+      "triangles": 6046,
+      "vertices": 5645
+    },
+    "npc_crowd_a": {
+      "bounds_godot": {
+        "max": [
+          0.288,
+          1.825,
+          0.189
+        ],
+        "min": [
+          -0.288,
+          0,
+          -0.195
+        ]
+      },
+      "category": "npc",
+      "layer": "none",
+      "materials": [
+        "skin",
+        "cloth",
+        "pants",
+        "accessory",
+        "eye_white",
+        "hair",
+        "rubber"
+      ],
+      "mesh_node": "npc_base",
+      "path": "assets/models/blender/npc/npc_crowd_a.glb",
+      "roles": [
+        "tourist",
+        "guest"
+      ],
+      "tint_slots": [
+        "skin",
+        "cloth",
+        "pants",
+        "accessory",
+        "hair"
+      ],
+      "triangles": 5284,
+      "vertices": 4908
+    },
+    "npc_crowd_b": {
+      "bounds_godot": {
+        "max": [
+          0.358,
+          1.809,
+          0.189
+        ],
+        "min": [
+          -0.358,
+          0,
+          -0.155
+        ]
+      },
+      "category": "npc",
+      "layer": "none",
+      "materials": [
+        "skin",
+        "cloth",
+        "pants",
+        "accessory",
+        "eye_white",
+        "hair",
+        "rubber"
+      ],
+      "mesh_node": "npc_base",
+      "path": "assets/models/blender/npc/npc_crowd_b.glb",
+      "roles": [
+        "confused_visitor",
+        "guest"
+      ],
+      "tint_slots": [
+        "skin",
+        "cloth",
+        "pants",
+        "accessory",
+        "hair"
+      ],
+      "triangles": 4812,
+      "vertices": 4550
+    },
+    "npc_crowd_c": {
+      "bounds_godot": {
+        "max": [
+          0.332,
+          1.824,
+          0.189
+        ],
+        "min": [
+          -0.332,
+          0,
+          -0.18
+        ]
+      },
+      "category": "npc",
+      "layer": "coat",
+      "materials": [
+        "skin",
+        "cloth",
+        "pants",
+        "accessory",
+        "eye_white",
+        "hair",
+        "rubber"
+      ],
+      "mesh_node": "npc_base",
+      "path": "assets/models/blender/npc/npc_crowd_c.glb",
+      "roles": [
+        "intoxicated",
+        "guest"
+      ],
+      "tint_slots": [
+        "skin",
+        "cloth",
+        "pants",
+        "accessory",
+        "hair"
+      ],
+      "triangles": 5690,
+      "vertices": 5510
+    },
+    "npc_crowd_d": {
+      "bounds_godot": {
+        "max": [
+          0.293,
+          1.856,
+          0.189
+        ],
+        "min": [
+          -0.293,
+          0,
+          -0.225
+        ]
+      },
+      "category": "npc",
+      "layer": "hood",
+      "materials": [
+        "skin",
+        "cloth",
+        "pants",
+        "accessory",
+        "eye_white",
+        "hair",
+        "rubber"
+      ],
+      "mesh_node": "npc_base",
+      "path": "assets/models/blender/npc/npc_crowd_d.glb",
+      "roles": [
+        "tourist",
+        "guest"
+      ],
+      "tint_slots": [
+        "skin",
+        "cloth",
+        "pants",
+        "accessory",
+        "hair"
+      ],
+      "triangles": 5810,
+      "vertices": 5444
    },
    "npc_dress": {
      "bounds_godot": {
@@ -567,8 +706,8 @@
        "accessory",
        "hair"
      ],
-      "triangles": 4900,
-      "vertices": 4719
+      "triangles": 5540,
+      "vertices": 5073
    },
    "npc_firefighter": {
      "bounds_godot": {
@@ -608,8 +747,8 @@
        "accessory",
        "hair"
      ],
-      "triangles": 5344,
-      "vertices": 5494
+      "triangles": 5888,
+      "vertices": 5785
    },
    "npc_guard": {
      "bounds_godot": {
@@ -652,8 +791,8 @@
        "accessory",
        "hair"
      ],
-      "triangles": 5046,
-      "vertices": 5096
+      "triangles": 5670,
+      "vertices": 5671
    },
    "npc_hoodie": {
      "bounds_godot": {
@@ -693,8 +832,8 @@
        "accessory",
        "hair"
      ],
-      "triangles": 5304,
-      "vertices": 4950
+      "triangles": 5864,
+      "vertices": 5325
    },
    "npc_jacket": {
      "bounds_godot": {
@@ -734,8 +873,8 @@
        "accessory",
        "hair"
      ],
-      "triangles": 4872,
-      "vertices": 4661
+      "triangles": 5432,
+      "vertices": 5225
    },
    "npc_vest": {
      "bounds_godot": {
@@ -775,8 +914,8 @@
        "accessory",
        "hair"
      ],
-      "triangles": 4980,
-      "vertices": 4879
+      "triangles": 5532,
+      "vertices": 5195
    },
    "palm_tree": {
      "bounds_godot": {
@@ -794,7 +933,8 @@
      "category": "props",
      "materials": [
        "palm_bark",
-        "palm_leaf"
+        "palm_leaf",
+        "palm_leaf_dark"
      ],
      "path": "assets/models/blender/props/palm_tree.glb",
      "triangles": 400,
@@ -840,7 +980,8 @@
      "materials": [
        "stone_pot",
        "soil",
-        "foliage"
+        "foliage",
+        "foliage_dark"
      ],
      "path": "assets/models/blender/props/planter_box.glb",
      "replaces": "generated/planter_box.glb",
@@ -913,7 +1054,8 @@
      "category": "props",
      "materials": [
        "stone_pot",
-        "foliage"
+        "foliage",
+        "foliage_dark"
      ],
      "path": "assets/models/blender/props/round_planter.glb",
      "triangles": 1240,
@@ -0,0 +1,503 @@
+# 3D model review (2026-11-03)
+
+Status: **baseline measured; scorecard open.** This is the working document for the unversioned
+`3D model re-evaluation` track in [`TODO.md`](../TODO.md). It records what was measured, what the
+Blender skill guidance says the targets are, the ranked candidate gaps, and the decisions that
+still need the project owner. Nothing here re-opens the accepted 0.9.4 limits by itself.
+
+Related documents: [`npc-visual-review.md`](npc-visual-review.md) (accepted 0.9.4 limits and
+before/after sheets), [`npc-visual-review.md`](npc-visual-review.md#proportion-audit) (proportion guide),
+[`blender-assets.md`](blender-assets.md) (asset contract), [`asset-tooling.md`](asset-tooling.md)
+(commands).
+
+## Method and skill routing
+
+The review is screenshot- and measurement-backed, following `qa-review` (screenshot set, defect
+severity, explicit verdict) rather than an opinion pass:
+
+| Family | Skills loaded | Criteria taken from them |
+| --- | --- | --- |
+| Routing and pipeline | `blender-director` | Plan → blockout → detail → validate → export; MCP steps translated to headless flatpak runs |
+| Characters | `character-artist`, `retopology`, `rigging` | Eye/mouth/jaw/shoulder loops, quad-dominant deformation surfaces, 3-loop joints, no triangles on primary deformers |
+| UVs and textures | `uv-workflow`, `texture-workflow`, `materials` | Texel-density tiers (hero 512–1024, standard 256–512, background 128–256 px/m), consistent density, no overlapping UVs |
+| Budgets and structure | `asset-optimization`, `lod-pipeline` | Triangle/vertex budgets, naming, LOD tiers |
+| Props, gear, foliage | `prop-artist`, `hard-surface`, `vegetation-artist` | Silhouette read, bevel/chamfer language, collision proxies, carded foliage |
+| Look and verdict | `lookdev`, `qa-review` | Day/night beauty captures, ship / ship-with-notes / no-ship verdict |
+
+Project contract and gates stay authoritative; see `AGENTS.md` §Local Blender skills. Blender MCP
+is optional interactive tooling (see [`asset-tooling.md#optional-interactive-blender-mcp`](asset-tooling.md#optional-interactive-blender-mcp)); this review's evidence
+came from the headless `tools/blender_assets.py` / `tools/npc_pipeline.py` pipelines plus the
+Godot capture harnesses, so it remains reproducible without MCP.
+
+## What was captured and measured (2026-11-03)
+
+| Evidence | Command | Result |
+| --- | --- | --- |
+| Contract audit | `python3 tools/blender_assets.py audit --json` | 46/46 assets clean; library 59,012 tris |
+| Imported-GLB inspection | `blender_assets.py inspect` (all 46) | All clean; transforms applied, helpers ignored |
+| Gear fit | `python3 tools/blender_assets.py fit --json` | Head width 0.315 m on all eight; clothing radius 0.190–0.260 m |
+| Proportions | `python3 tools/npc_proportions.py report --json` | All eight inside the stylized guide |
+| Texel density | `python3 tools/blender_assets.py texels --json` | New measurement, table below |
+| Neutral baseline | `capture_npc_baseline.gd` → `tmp/model-baseline` (48 frames) + `npc_baseline.py sheet` | 48 frames, none blank; sheet in `tmp/` only |
+| Final context | `capture_npc_review.gd` → `tmp/model-review` (96 frames) | 96 frames, none blank; raw frames stay local |
+| Performance | `smoke_npc_budget.gd` | 24 avatars, 168 meshes, 152,464 tris, 6.94 ms of 50 ms |
+
+Raw captures and JSON stay in the gitignored `tmp/`; committed review images remain the
+`docs/blender_previews/sheet_*.jpg` set from 0.9.4/0.9.5 until a fix actually lands.
+
+## Character measurements
+
+Contract numbers from `audit` + `inspect`; density from `texels` (256² slot maps, authored and
+with the runtime 4× fabric repeat).
+
+| Character | Tris / verts | Height / feet | Materials | Authored td (px/m) | Fabric effective (px/m) | Verdict |
+| --- | --- | --- | --- | --- | --- | --- |
+| `npc_casual` | 5,038 / 4,756 | 1.824 / +0.000 | 7 | 106.8–122.2 | 429–440 | Contract pass; face prototype |
+| `npc_jacket` | 5,428 / 5,071 | 1.824 / +0.000 | 7 | 100.3–113.7 | 409–413 | Contract pass; face prototype |
+| `npc_coat` | 6,030 / 5,802 | 1.824 / +0.000 | 7 | 75.3–81.4 | 307–310 | Contract pass; face prototype |
+| `npc_vest` | 5,536 / 5,375 | 1.819 / +0.000 | 9 | 85.5–99.3 | 362–366 | Contract pass; face prototype |
+| `npc_dress` | 5,456 / 5,128 | 1.825 / +0.000 | 7 | 81.9–89.0 | 338–339 | Contract pass; face prototype |
+| `npc_hoodie` | 5,860 / 5,492 | 1.856 / +0.000 | 7 | 89.5–98.6 | 359–364 | Contract pass; face prototype |
+| `npc_firefighter` | 5,900 / 5,902 | 1.819 / +0.000 | 9 | 64.0–75.1 | 287–290 | Contract pass; face prototype (helmet shadow hides the lower lip) |
+| `npc_guard` | 5,602 / 5,684 | 1.819 / +0.000 | 11 | 90.0–100.8 | 374–374 | Contract pass; face prototype |
+| `npc_crowd_a` | 5,200 / 4,734 | 1.825 / +0.000 | 7 | 107–120 | 431–435 | Contract pass; crowd prototype |
+| `npc_crowd_b` | 4,734 / 4,353 | 1.809 / +0.000 | 7 | 107–118 | 434–439 | Contract pass; crowd prototype |
+| `npc_crowd_c` | 5,674 / 5,440 | 1.824 / +0.000 | 7 | 76–83 | 317 | Contract pass; crowd prototype |
+| `npc_crowd_d` | 5,814 / 5,300 | 1.856 / +0.000 | 7 | 92–106 | 377–381 | Contract pass; crowd prototype |
+| `npc_base` (fallback) | 1,204 / 2,488 | 1.836 / +0.000 | 5 | 70.1–72.9 | 4× on fabric | Contract pass; compact fallback under the 16,000/16,000 cap |
+
+Blender-side `inspect` counts can differ by ±1 vertex from the glTF accessor count in `audit`
+(normal-split rounding); both are recorded and neither changes a verdict.
+
+Readings:
+
+- Every character is inside 16,000/16,000 with the farthest well below the new cap and 5,494
+  verts (69%), so there is headroom for targeted topology detail without a cap change.
+- Surface area tracks clothing volume: the firefighter coat is the largest body (4.28 m²) and has
+  the lowest authored density; `npc_casual` is the smallest (2.44 m²) and the highest.
+- **Authored density (64–122 px/m) sits below the skill's background tier (128–256 px/m).** The
+  runtime tint controls most of the look: `skin`, `hair`, `accessory` and the fixed detail slots
+  are neutral maps tinted at runtime, not painted skin, so density mostly controls subtle
+  weave/noise. Fabric is effective 287–440 px/m (standard tier) because of the 4× repeat. This is
+  a recorded note, not a defect, until a portrait shows texture starvation.
+- Material counts 7–11 per character are fixed detail slots (eyes, rubber, hivis, reflective,
+  leather, metal), not extra tint slots.
+
+## Baseline inventory (2026-11-04)
+
+Recorded for the Blender NPC model overhaul track: the exact starting point before the local
+part pipeline is built. `npc_base.blend` is the frozen fallback; the 12 characters are assembled
+procedurally by `tools/blender_assets.py`; the MakeHuman prototypes live under `tmp/npc-research/`
+and are not the shipped path.
+
+### `assets/models/npc/npc_base.blend` (frozen fallback)
+
+- Mesh `npc_base`: **652 verts / 642 tris**, five material slots in order
+  `pants, cloth, skin, hair, accessory`.
+- Armature: **14 bones** — `Hips, Spine, Neck, Head, ShoulderL/R, ElbowL/R, HandL/R, HipL/R, KneeL/R`
+  (the required 13 core bones plus the `Hips` root).
+- It is the compact fallback, not the prototype host; the overhaul must not absorb prototype
+  detail into it unless a separate contract decision approves it.
+
+### 12 generated character GLBs
+
+`audit` counts (glTF accessor; Blender `inspect` can differ ±1 on normal-split rounding):
+
+| Character | Tris | Verts | | Character | Tris | Verts |
+| --- | ---: | ---: | --- | --- | ---: | ---: |
+| `npc_casual` | 5,034 | 4,607 | | `npc_firefighter` | 5,888 | 5,785 |
+| `npc_jacket` | 5,432 | 5,225 | | `npc_guard` | 5,670 | 5,671 |
+| `npc_coat` | 6,046 | 5,645 | | `npc_crowd_a` | 5,284 | 4,908 |
+| `npc_vest` | 5,532 | 5,195 | | `npc_crowd_b` | 4,812 | 4,550 |
+| `npc_dress` | 5,540 | 5,073 | | `npc_crowd_c` | 5,690 | 5,510 |
+| `npc_hoodie` | 5,864 | 5,325 | | `npc_crowd_d` | 5,810 | 5,444 |
+
+All well under the 16,000/16,000 cap; the largest is `npc_coat` at 38% of the tri budget, so
+head/face/hand detail has ample headroom.
+
+### Procedural builders (current geometry locations)
+
+Coordinates are Blender metres, Z-up; face front is −Y / Godot +Z; `s` = ±1 side, `w` = build
+width scale.
+
+- **Head** — `_face` + `_shape_head_mesh`: `sphere(Head, 0.155, (0, 0, 1.635), seg=24, rings=16,
+  scale=(0.92, 1.0, 1.12))`. Forward-only sculpt (brow at z 1.695, cheek at z 1.612, jaw/chin at
+  z 1.565); recessed creases rejected because they bake as dark AO patches.
+- **Eyes** — sclera `sphere(0.019, (0.052s, −0.134, 1.664), scale=(1.25, 0.62, 0.85))`;
+  iris `sphere(0.0105, (0.052s, −0.141, 1.664), scale=(1.0, 0.55, 1.0))`; upper lid at z +0.014,
+  lower lid at z −0.012; brow box at (0.052s, −0.143, 1.699).
+- **Nose** — bridge `cyl(0.016→0.022, (0, −0.145, 1.652))`, tip `sphere(0.022, (0, −0.162, 1.615))`,
+  wings `sphere(0.012, (0.016s, −0.160, 1.606))`.
+- **Mouth** — slot `sphere(0.028, (0, −0.158, 1.583), scale=(1.0, 0.28, 0.12))`, lower lip
+  `sphere(0.012, (0, −0.156, 1.578))`.
+- **Ears** — `sphere(0.036, (0.143s, 0.008, 1.63), scale=(0.42, 1.0, 1.35))` + lobe + inner concha.
+- **Hands** — `_hands_and_shoes`: palm `sphere(0.046, (0.275·s·w, −0.012, 0.762),
+  scale=(0.80, 0.62, 0.88))`; four fingers base (…, 0.778) → tips z 0.701–0.714; thumb
+  (…, 0.778 → 0.760 → 0.738). No finger bones; open palm + `HAND_ITEM_FORWARD` only.
+
+### UV layout
+
+- Five tint slots (`skin, hair, accessory, cloth, pants`) at 256² each; fixed detail slots
+  (`eye_white`, rubber, hivis, reflective, leather, metal) are the extra material slots.
+- Authored texel density 64–122 px/m (below the background tier 128–256), fabric effective
+  287–440 px/m via the 4× repeat; runtime tint carries the look. This is a recorded note until a
+  portrait shows texture starvation.
+
+### MakeHuman prototypes (not shipped; `tmp/npc-research/makehuman/`)
+
+| File | Verts / tris | Bones | Slots | Note |
+| --- | ---: | ---: | --- | --- |
+| `makehuman_body.glb` | 19,320 / 6,444 | 0 | `skin_proto` | CC0 intake, unskinned, 1.82 m grounded |
+| `makehuman_retargeted.glb` | 7,062 / 6,444 | 14 | 5 tint | arm-down + contract rig, deltoid warp remains |
+| `makehuman_final.glb` | 6,651 / 6,407 | 14 | 8 (incl. `skin.001`, `eye_white`, `rubber`) | project head/hands/shoes swapped; duplicate `skin.001` |
+
+The "Icosphere" the inspector lists alongside these GLBs is the glTF importer's
+bone-display helper (a `pose_bone.custom_shape`), not part of the asset; `inspect_glb` already
+excludes it from measurements. The real cleanup for `makehuman_final.glb` is the duplicate
+`skin.001` material and the manual deltoid retopology.
+
+## Overhaul acceptance criteria (measurable)
+
+Defined 2026-11-04 for the local part pipeline. A prototype must pass every applicable item
+before it is rolled out to the other variants; the bar is the stylized low-poly target, not
+photorealism.
+
+### Face (one-variant prototype first)
+
+Capture `front` (yaw 0°), `three_quarter` (yaw 35°) and `profile` (yaw 90°) at **1.5 m** and
+**1.85 m** (32° FOV), matching `capture_npc_baseline.gd` (a new 1.5 m portrait capture is added
+for this). Pass conditions:
+
+- **Eyes** — sclera + iris + both lids distinct at 1.85 m; at 1.5 m the iris is a readable dark
+  dot against the white sclera, not a floating oval; no socket ring or lid seam.
+- **Mouth** — the mouth line and lower-lip volume read at both distances; no moustache-like
+  shadow from a floating dark slot.
+- **Nose** — bridge, tip and ala planes read in three-quarter and profile; no nose-wing seam or
+  inverted normal at the base.
+- **Ears** — concha depth + lobe read in profile; not a flat disc.
+- **Jaw/cheek/chin** — front and profile show a jaw transition and cheek/chin planes; no faceted
+  plane seams, inverted normals or z-fighting.
+- **Silhouette** — front/three-quarter/profile agree; face direction is unambiguous.
+- **AO** — the 256² bake stays clean: no recessed crease baking into a dark patch.
+
+### Hands (one-variant prototype first)
+
+Capture an **open palm** and a **relaxed grip** at **0.8 m** (`--view=hand` plus a new grip
+capture). Pass conditions:
+
+- **Open palm** — four fingers and a thumb read as a hand, not a mitten; at least two of the four
+  finger gaps are readable.
+- **Grip** — the palm plus curled fingers silhouette reads; no finger-through-palm clipping.
+- **Gear contact** — phone, cup, clipboard, camera, flashlight, wand and radio contact the palm
+  at 0.8 m with `HAND_ITEM_FORWARD` unchanged; no floating or hand-through-item clipping.
+
+### Contract (both, every prototype)
+
+- 16,000 triangles / 16,000 glTF vertices per character; gear stays at 1,500.
+- Optional extra bones are allowed; the required 13 core bones and their rest positions must not
+  move; the `npc_base` mesh node name and the five tint slots stay unchanged.
+
+### Measurement gates
+
+`blender_assets.py inspect`/`audit`/`fit`, `npc_proportions.py`, the 24-NPC budget, Godot + Python
+tests, the 48-frame baseline and the 96-frame pose/context review all stay authoritative; the new
+face/hands captures are the visual bar for this track.
+
+### Working-set layout
+
+Part sources and preview GLBs live under `tmp/npc-parts/<variant>/` (gitignored by the root
+`tmp/` rule); only the assembled character GLBs, AO/maps, the manifest and the review sheets are
+committed. No new committed `.blend` source tree is added without a docs/ADR decision — the
+frozen `npc_base.blend` stays the only tracked `.blend`.
+
+### Head prototype (in progress 2026-11-04)
+
+`tools/npc_parts.py build --part head_proto` is the first connected-shell attempt: a seg-48
+head sphere is displaced (not floating spheres) into eye sockets with an orbital rim, a nose
+bridge/tip/ala, upper/lower lip volumes, and extruded ears with a concha recess; the eyeballs
+stay separate. Local renders live under `tmp/npc-parts/npc_casual/head_proto_*.png`.
+
+Iteration log (vision-judged, profile view):
+
+1. Initial displacement too subtle — read as a "ball with props".
+2. Nose + ear visible in profile but the cranium still read as a "ball with a nose".
+3. Added face-plane flatten + jaw/chin taper; taper read, but "~90% sphere".
+4. Stronger flatten + nose + chin; nose now reads, jawline still dissolves into the skull.
+5. Fixed an ear-displacement sign bug (the ± side loop cancelled the helix); the ear now
+   protrudes (x ±0.155 vs the ±0.139 shell) but reads as a soft blob.
+
+Current state (prototype built, ~3/5 vision read): the nose, mouth notch, chin bump and ear bulge
+all read; the centre-profile measurement confirms the relief is objective — nose tip −0.192,
+brow −0.150, chin −0.149, jaw step −0.11, forehead −0.126→−0.078. The remaining polish (a flatter
+forehead, a defined ear helix/lobe, a jawline that steps to the neck) is folded into the §3.2
+variant comparison; the neck is part of `_skin_body`, so the standalone head always lacks it.
+
+### AI-driven head rework (2026-11-04)
+
+The head was reworked against an AI-generated target concept (front + profile, saved under
+`tmp/npc-parts/head_concept_*.png`) and judged with `describe_image.py` across several iterations.
+The displacement-on-sphere approach oscillates between "decorated egg" (too subtle) and
+"spiky wedges" (too aggressive) and settles at ~3/5 — the coarse s48 sphere cannot resolve the
+nose/lip/chin relief cleanly.
+
+The judge then compared the displacement head against the **decimated MakeHuman head**
+(extracted from `makehuman_retargeted.glb`, 2,009 verts / 1,573 tris, saved as
+`tmp/npc-parts/makehuman_head.glb`) and returned a decisive result: **ship the MakeHuman head** —
+it keeps the nose/chin/jaw landmarks at a fraction of the cost, while the procedural head's
+"clean ellipse outline instantly screams procedural sphere".
+
+**Conclusion:** the next head asset is the MakeHuman head shape (1,573 tris) plus the project's
+separate eye/mouth/brow pieces for readability, not the displacement shell. The displacement
+`_head_proto` stays local as a rejected variant.
+
+**Built (2026-11-04):** `_makehuman_head` in `blender_assets.py` imports the committed
+`assets/models/blender_src/makehuman_head.glb` (CC0, attributed in `CREDITS.md`), collapses it to
+one skin slot, bisects + caps the ragged neck, and adds the project sclera/iris/lids/brows/mouth
+at the MakeHuman landmarks. `build_character(name, head="mh")` assembles it; the result passes
+`inspect` (14 bones, skinned, no issues). The judge reads the face ~3.5/5; remaining polish is
+welding the added eye/brow pieces into the head shell and a skull-conforming hair cap.
+
+**Standalone head re-review (2026-11-04):** the separate
+`assets/models/blender_src/makehuman_head.glb` prototype (12,641 tris / 7,690 split verts,
+with a skin eyelid mask, recessed globes, flat iris/pupil discs and surface-anchored brows)
+was **accepted by the owner** as a basic human head. The automated vision gate still returns
+REJECT on the eye/lid region (globe depth, lid overlap, iris at three-quarter) as deferred
+polish. The assembled `npc_casual --head mh` now adds a skull-conforming hair cap, a hidden
+scalp trim and a narrowed neck/shoulder body: 14,753 tris / 12,823 seam-split verts /
+14 bones / 9 materials, `inspect` clean. All 12 variants count 14,693–15,987 tris. See
+[`makehuman-head-review.md`](makehuman-head-review.md).
+
+### Head subdivision comparison (2026-11-04)
+
+Three `head_proto` variants at UV-sphere segments 24/48/64 were rendered at 1.85 m and 1.5 m in
+front/three-quarter/profile and judged side by side:
+
+| Variant | Verts / tris | 1.85 m | 1.5 m | Verdict |
+| --- | ---: | --- | --- | --- |
+| s24 | 670 / 1,168 | lumpy, nose/lips melt into the chin | jagged silhouette, no mouth | reject |
+| s48 | 1,558 / 2,944 | eyes/brows/nose/lips read cleanly | features resolve cleanly | **pick** |
+| s64 | 2,470 / 4,768 | visually identical to s48 | indistinguishable from s48 | reject (wasted verts) |
+
+The chosen s48 is the `head_proto` default; the rejected s24/s64 stay local under
+`tmp/npc-parts/`. A before/after sign-off sheet (current `_face` vs s48, 1.85 m
+front/three-quarter/profile) is
+[`blender_previews/sheet_head_proto_before_after.jpg`](blender_previews/sheet_head_proto_before_after.jpg).
+
+## Scorecard skeleton
+
+Verdicts use `qa-review` semantics: **P0** (blocker: wrong scale, broken normals, budget fail),
+**P1** (major: silhouette/readability), **P2** (minor), **accept** (recorded limit). `—` means not
+yet reviewed; this document is the place to fill it.
+
+### Characters
+
+| Character | Silhouette | Face @1.85 m | Hands/grip | Weights/pose | Cloth/hair | LOD | Verdict |
+| --- | --- | --- | --- | --- | --- | --- | --- |
+| *(pose captured 2026-11-04: see "Pose evidence" below)* | | | | | | | |
+| `npc_casual` | accept (0.9.4) | accept (face prototype) | accept (open palm) | fixed (wrist/hand + hip/knee) | accept | accept (two-quad impostor) | pending owner |
+| `npc_jacket` | accept | accept (face prototype) | accept | fixed (wrist/hand + hip/knee) | accept | accept | pending owner |
+| `npc_coat` | accept | accept (face prototype) | accept | fixed (wrist/hand + hip/knee) | accept (hem 0.76 stride) | accept | pending owner |
+| `npc_vest` | accept | accept (face prototype) | accept | fixed (wrist/hand + hip/knee) | accept | accept | pending owner |
+| `npc_dress` | accept; performer props dominate | accept (face prototype) | accept | fixed (wrist/hand + hip/knee) | accept | accept | pending owner |
+| `npc_hoodie` | accept (hooded criterion) | accept (lower face only) | accept | fixed (wrist/hand + hip/knee) | accept | accept | pending owner |
+| `npc_firefighter` | accept | accept (face prototype) | accept | fixed (wrist/hand + hip/knee) | accept | accept | pending owner |
+| `npc_guard` | accept | accept (face prototype) | accept | fixed (wrist/hand + hip/knee) | accept | accept | pending owner |
+| `npc_crowd_a` | accept | accept (face prototype) | accept | fixed (wrist/hand + hip/knee) | accept | accept | crowd prototype |
+| `npc_crowd_b` | accept | accept (face prototype) | accept | fixed (wrist/hand + hip/knee) | accept (beard) | accept | crowd prototype |
+| `npc_crowd_c` | accept | accept (face prototype) | accept | fixed (wrist/hand + hip/knee) | accept (coat hem) | accept | crowd prototype |
+| `npc_crowd_d` | accept | accept (face prototype) | accept | fixed (wrist/hand + hip/knee) | accept | accept | crowd prototype |
+
+### Gear (18)
+
+| Gear | Attach | Tris | Verdict |
+| --- | --- | --- | --- |
+| `cap` | head | 328 | — (fit measured, visual pending) |
+| `hood` | head | 804 | — |
+| `sunglasses` | head | 164 | accept (0.9.4 clearance) |
+| `firefighter_helmet` | head | 672 | accept (0.9.4 + 3 cm runtime offset) |
+| `backpack` | back | 380 | accept (0.9.4 strap refit) |
+| `shoulder_bag` | back | 188 | — |
+| `scba_tank` | back | 362 | — |
+| `lanyard` | chest | 100 | accept (0.9.4 + 4 cm runtime offset) |
+| `phone` | hand | 96 | accept (forward offset) |
+| `cup` | hand | 188 | accept |
+| `clipboard` | hand | 84 | accept |
+| `umbrella` | hand | 134 | accept |
+| `camera` | hand | 318 | accept |
+| `protest_sign` | hand | 92 | accept (performer/protester read) |
+| `flashlight` | hand | 168 | accept |
+| `wand` | hand | 244 | accept |
+| `radio` | hand | 220 | accept |
+
+Gear total: 5,002 tris across 18 pieces (all far below the 1,500-per-piece cap).
+
+`blender_assets.py fit` readings (2026-11-03): `shoulder_bag` is clear on both `npc_coat` and
+`npc_dress` (the only back-gear clearance the fit test asserts); `sunglasses` sits inside the
+head band at 0.64× head width. Three caveats worth recording, none of which changes a verdict:
+`backpack` (npc_casual) and `scba_tank` (npc_firefighter) report `CLIP` because back gear is
+measured against the **hip/skirt** radius, which is wider than the upper back where the bags
+actually sit; `cap` and `firefighter_helmet` report `band=OUTSIDE` because they sit on the crown
+above the 1.55–1.81 face/head band (expected); and the `lanyard` clip is corrected at runtime by
+`GEAR_OFFSETS` (+4 cm forward). The unused `beanie` was retired on 2026-11-03 (removed from
+`GEAR`, its builder, `npc_avatar.gd` and the manifest).
+
+### Props (20 library + 6 generated fallbacks)
+
+Library total 13,608 tris; `marquee` (2,804) and `street_tree` (2,592) are the two heaviest and are
+the first candidates for a `vegetation-artist`/lookdev pass.
+
+| Prop | Tris | Verdict |
+| --- | --- | --- |
+| `bollard` | 138 | accept (2026-11-03 flared base collar) |
+| `bench` | 560 | — |
+| `trash_bin` | 228 | — |
+| `planter_box` | 1,324 | — |
+| `newspaper_box` | 300 | accept (2026-11-03 recessed slot + door seam) |
+| `fire_hydrant` | 610 | accept (2026-11-03 rebuild: bolted flange, bonnet cap nut, larger side + front outlets) |
+| `street_lamp` | 428 | — |
+| `street_tree` | 2,592 | P1 candidate (flat-shaded clumps) |
+| `palm_tree` | 400 | P1 candidate (same foliage language) |
+| `round_planter` | 1,240 | — |
+| `a_frame_sign` | 212 | — |
+| `wall_lantern` | 180 | — |
+| `traffic_cone` | 210 | — |
+| `crowd_barrier` | 388 | — |
+| `stanchion` | 434 | — |
+| `handrail` | 268 | — |
+| `security_podium` | 184 | — |
+| `double_door` | 380 | — |
+| `marquee` | 2,804 | — (emissive check pending) |
+| `sedan` | 928 | — |
+
+Vision review 2026-11-03 (`tools/describe_image.py` on the prop gallery): `bench` and `trash_bin`
+are ship-ready (minor chamfer polish only); `bollard` passes but leans on its reflective band
+(add a base collar); `planter_box`/`round_planter` fail on the foliage — the `_shrub()` clumps
+read as rocks, not plants (same foliage language gap, gated on the owner); `newspaper_box` is
+borderline (the slot is a flat decal, wants a recessed inset + door seam); `fire_hydrant` is now
+rebuilt (see row). No prop floats or sinks; shadow direction is consistent.
+
+Generated fallbacks (`assets/models/generated/`): bench, bollard, fire_hydrant, newspaper_box,
+planter_box, trash_bin. They are only used when the library prop is missing, so they are audited
+for presence, not re-reviewed for art quality.
+
+### Venues
+
+| Venue | Measured (map-budget test) | Status |
+| --- | --- | --- |
+| Hollywood Boulevard | 58,884 tris / 409 meshes | shape-language review pending |
+| The Joke Shop | 26,828 tris / 580 meshes | facade review landed: 6.0 m low hall, white signature band, tied-back curtains, west hotel tower; remaining gap = rounded west corner |
+| TV Studio | — | shape-language review pending |
+
+## Pose evidence (fixed 2026-11-04)
+
+The weights/pose column can now be filled. The root cause was the harness: it never disabled the
+avatar's `_physics_process`, so `_advance_fsm` + `_move_toward_target` reset `arrived`/velocity
+every tick and `theater_pose()` reverted to idle. `capture_npc_pose.gd` now calls
+`set_physics_process(false)`/`set_process(false)` after staging, and the pose sticks (sit vs idle
+diff 5.63, walk vs idle 2.29, vision-judged as crouched). The earlier "moving the `Rig` child does
+not render" probe was a red herring: it set the position in `_shoot()` in the same frame as
+`root.get_texture().get_image()`.
+
+`src/test/capture_npc_pose.gd` stages idle / walk-contact / walk-pass / seated for all twelve
+variants (full-body + shoulder views).
+
+| Check | Result |
+| --- | --- |
+| Pose reaches proxies | Seated pose logs `rig_y=-0.339`, `leg0=-1.357` |
+| Pose reaches skeleton bones | `HipL`/`KneeL` bone rotations differ from rest; headless test `test_pose_reaches_the_skeleton_bones` locks it (suite 273/273) |
+| Idle restores rest | Same test asserts the hip returns to its rest orientation |
+| Skinning bound | One `Skeleton3D`, mesh bound to it (`same=true`); hiding `npc_base` removes the body |
+| Bone rotations deform the mesh | Direct writes change rendered pixels: Spine 1,719 / HipL 1,052 / KneeL 810 / ElbowL 745 / Head 671 / ShoulderL 640 sampled pixels |
+| Bone translation deforms the mesh | A +0.5 m Head offset moves the head in frame |
+| Standalone window probes render the pose | Three variants (avatar under `root`, under a `Node3D` stage, created mid-`_process`) render the seated crouch (diff ~2,200-2,360 samples) |
+| Offscreen capture renders the pose | A `SubViewport` + `RenderingServer.force_draw()` probe renders the crouch reliably (diff 602 at +2/+6/+12 frames), including a re-created second avatar |
+| The harness renders the pose | **No** in its current form: same stage, same pose, rest frames. One ordering (`_frame_view()` immediately before `force_draw()`) produced posed walk frames once, then regressed to rest/garbage on the next run |
+
+The rig, the animation math and the offscreen render path are all sound. A 2026-11-03 re-attempt
+with the recipe (SubViewport + `force_draw()` + `force_update_all_bone_transforms()` + disabled
+process/physics) still produced byte-identical rest frames, and a decisive probe narrowed the
+failure further: teleporting the **avatar** changes the render (diff 10), but moving the **`Rig`
+child** (the GLB model's parent) does not (diff 0). The skinned mesh therefore does not follow its
+`Rig` Node3D transform, so the rig lowering never reaches the rendered model — the defect is
+upstream of camera/`force_draw()` ordering. Next attempt must answer why the skinned model ignores
+the `Rig` node, or stage poses via the known-good `capture_npc_review.gd` fallback.
+
+Working recipe (verified by the probes; keep it when rebuilding):
+
+1. Create a `SubViewport` (1280x720, `own_world_3d = true`, `UPDATE_ALWAYS`) in `_initialize`.
+2. Build the studio (environment, key/fill light, ground, camera) and one avatar inside it.
+3. Wait 2-3 frames so the skinned mesh binds.
+4. Apply the pose with `_animate()` ticks, with the avatar's process/physics disabled.
+5. Call `RenderingServer.force_draw()`, then `viewport.get_texture().get_image()`.
+6. Free the avatar and repeat for the next pose; a re-created avatar also rendered correctly in a probe.
+
+## Ranked candidate gaps
+
+Ordered by expected player-visible gain per unit of work. None is approved for fixing yet; the
+owner review decides.
+
+1. **Face plane structure at portrait distance (P1, all eight).** The neutral sheet shows flat,
+   faceted cheek/brow planes and slit-like eyes at 1.85 m. `character-artist`/`retopology` guidance
+   asks for concentric eye loops and a 3-loop mouth. This is the largest readability gap and also
+   the most expensive (head rebuild + re-UV + re-AO per variant). Needs a targeted single-variant
+   prototype before committing to eight.
+
+   The eight library characters already carry the 0.9.4 face detail in
+   `tools/blender_assets.py._face()`: sculpted chin plate + cheekbones (`_shape_head_mesh`),
+   socketed sclera + thin upper lid, nose bridge/tip/wings, a rounded mouth and ear concha
+   (the plain sphere head in `tools/npc_pipeline.py` is the frozen `npc_base` fallback only).
+   So this gap is a readability/scale question on the existing sculpt — the head is
+   `seg=18/rings=12` with small offsets — not missing geometry. Concrete next step, if funded:
+   a single-variant `npc_casual` prototype that raises head subdivision and deepens the
+   cheek/brow offsets, then re-bakes AO and captures the portrait before touching the other seven.
+
+   **Prototype landed 2026-11-03/04:** `npc_casual` now has `seg=24/rings=16` (smoother), a subtle
+   brow ridge, a fuller lower lip and both eyelids (upper + lower); recessed creases (nasolabial,
+   temple, chin cleft) were rejected because they bake as dark AO patches. Vision-reviewed: the new
+   face reads cleaner and more realistic than the old (set-in eyes, brow break, lip volume, no
+   faceting); tris 4,482 → 5,038 (still under 16,000). The other seven variants keep the old face
+   until this prototype is approved.
+2. **No pose/weight evidence (unknown).** Idle, walk, sit, block and turn deformation has never been
+   captured as a review set, so shoulder/hip/neck collapse is unmeasured. Cheap to add and it
+   gates any claim that the rig is acceptable.
+3. **Foliage language (P1, `street_tree`, `palm_tree`, `planter_box`, `round_planter`).** Flat-shaded
+   clumps against an otherwise readable set, already deferred once. `vegetation-artist` carded
+   clusters would fix it inside the existing triangle budget.
+4. **Texel density below the background tier (note).** 64–122 px/m authored vs the skill's 128–256
+   background tier. Fabric is already standard-tier at runtime. Decide: accept because the maps are
+   neutral tinted detail, or raise only `skin`/`hair` to 512² for portrait distance.
+5. **`npc_firefighter` density floor (P2).** 64 px/m with the largest coat area; split the coat UV
+   shell or raise the map size before the next character pass, whichever the density decision says.
+6. **Hands at conversation distance (accept, revisit only if face work opens the budget).** Open
+   palm with `HAND_ITEM_FORWARD`; no finger bones exist, so a curl rig is a contract decision, not
+   a modelling tidy-up.
+7. **Gear never reviewed as silhouette language (P2).** 18 pieces pass fit/contract but have no
+   prop-artist verdict (the unused `beanie` was retired 2026-11-03).
+8. **Venue shape language (P2).** Hollywood and the Joke Shop have budget data but no
+   `environment-artist`/`archviz` review; the TV Studio has no recorded map-budget number in this
+   document yet.
+
+## qa-review sign-off (2026-11-04)
+
+All eight library characters **ship with notes**. Face realism landed on all eight (`seg=24/rings=16`,
+brow ridge, both eyelids, fuller lower lip), hands/grip and cloth/hair are accepted as recorded, gear
+fit is measured with its caveats, and the props are reviewed (hydrant/bollard/newspaper_box rebuilt,
+foliage two-toned). The only unresolved column is **weights/pose** (blocked on the capture harness),
+and the full carded-cluster foliage pass is the one remaining owner-gated P1. No P0 remains.
+
+## Decisions needed from the owner
+
+- Accept the measured texel density as a stylized limitation, or fund a skin/hair resolution pass.
+- Approve or reject a single-variant face/eye-loop prototype (and pick which variant to prototype
+  on) before any eight-character rebuild.
+- Decide whether the pose/weight capture is required before the crowd-variant roster.
+- Confirm foliage rebuild priority versus the map track (both touch the same street trees).
+
+## Next actions
+
+- Review the assembled [`makehuman-head-review.md`](makehuman-head-review.md) prototype (hair cap and full-body silhouette) before rebuilding the 12 shipped character GLBs.
+
+
+Tracked in [`TODO.md`](../TODO.md) `3D model re-evaluation`: the remaining `A. Baseline…` item is
+this owner review; `B`/`C`/`D` carry the per-family work, and `E` adds the pose/weight,
+collider-coverage and scorecard-coverage gates this document found missing.
@@ -2,19 +2,32 @@

 This folder holds the project documentation, visual references and generated QA evidence.

+## Current priorities
+
+1. [Blender NPC model overhaul](../TODO.md#blender-npc-model-overhaul-top-priority) — part-based head/face/hands pipeline and 16,000-budget contract.
+2. [MakeHuman and 3D model/map improvements](../TODO.md#makehuman-character-pipeline) — body intake, asset re-evaluation and local map reconstruction.
+3. [0.10.0 release candidate](../TODO.md#milestone-0100--3d-model-and-map-improvements-minor) — versioned release hardening after the unversioned development tracks.
+
 ## Start here

- [`../PLAN.md`](../PLAN.md) — product and game-design plan
- [`gameplay.md`](gameplay.md) — controls, venues and escalation
- [`joke-shop-map.md`](joke-shop-map.md) — Sunset Strip real-site mapping
- [`tutorial.md`](tutorial.md) — first-shift tutorial beats
+- [`../PLAN.md`](../PLAN.md) — product, design intent and development priorities
+- [`../TODO.md`](../TODO.md) — priority-ordered active tasks and roadmap
+- [`npc-model-sourcing.md`](npc-model-sourcing.md) — character-source evaluation, licence rules and the character-development plan
+- [`makehuman-head-review.md`](makehuman-head-review.md) — local MakeHuman head prototype, provenance and review verdict
 - [`architecture.md`](architecture.md) — arc42 system architecture
 - [`getting-started.md`](getting-started.md) — setup, run/test commands and controls
 - [`asset-tooling.md`](asset-tooling.md) — image/model pipelines and screenshot gates
+- [`../tools/README.md`](../tools/README.md) — tool inventory, categories and test runner
+- [`gameplay.md`](gameplay.md) — controls, venues and escalation
+- [`venues.md`](venues.md) — Hollywood, Joke Shop and TV Studio real-site mapping
 - [`npc-visual-review.md`](npc-visual-review.md) — NPC visual baseline, acceptance criteria and ranked gaps
- [`npc-proportion-audit.md`](npc-proportion-audit.md) — NPC proportion ratios and stylized guide results
- [`development-status.md`](development-status.md) — implemented features and current gaps
- [`smoke-checklist.md`](smoke-checklist.md) — manual verification
+- [`3d-model-review.md`](3d-model-review.md) — 3D model re-evaluation: measurements, scorecard and ranked gaps
+- [`development-status.md`](development-status.md) — implemented features, current gaps and active planning
+- [`accessibility.md`](accessibility.md) — accessibility statement and known gaps
+- [`known-limitations.md`](known-limitations.md) — release-candidate blockers and accepted limits
+- [`release-qa.md`](release-qa.md) — manual smoke checklist and balance-acceptance protocol
+- [`../CREDITS.md`](../CREDITS.md) — credits and asset provenance
+- [`../PRIVACY.md`](../PRIVACY.md) — privacy note
 - [`ui-copy.md`](ui-copy.md) — screen, copy and button inventory
 - [`RELEASING.md`](RELEASING.md) — export, CI and publishing workflow
 - [`adr/README.md`](adr/README.md) — architecture decisions
@@ -24,13 +37,17 @@ This folder holds the project documentation, visual references and generated QA
 - [`screens/README.md`](screens/README.md) — concepts, designs, screenshots and realism runs
 - [`blender_previews/README.md`](blender_previews/README.md) — character/gear/prop previews
 - [`screenshots/README.md`](screenshots/README.md) — committed game gallery
- [`screen-design-report.md`](screen-design-report.md) — latest screen-design judge result
+- [`ui-copy.md`](ui-copy.md#screen-design-judge-report) — screen/button inventory and latest judge result

 ## Quick preview

-| Reference | Screenshot |
+| Reference | Capture |
 | --- | --- |
 | Venue design | <img src="screens/designs/venue_overview.png" width="320" alt="Venue overview design"> |
-| Current entrance | <img src="screenshots/01-venue-overview.png" width="320" alt="In-game venue overview"> |
+| Current entrance (day) | <img src="screenshots/01-venue-overview.png" width="320" alt="In-game venue overview"> |
+| Current entrance (late) | <img src="screenshots/05-late-night-avenue.png" width="320" alt="Late-night boulevard"> |
+| Joke Shop | <img src="screenshots/12-joke-shop.png" width="320" alt="Joke Shop at night"> |
 | Character sheet | <img src="blender_previews/sheet_npc.jpg" width="320" alt="NPC character sheet"> |
+| Neutral NPC baseline | <img src="blender_previews/sheet_npc_baseline.jpg" width="320" alt="Neutral NPC baseline sheet"> |
+| Texture refinement | <img src="blender_previews/sheet_texture_refinement_0.9.5.jpg" width="320" alt="Texture refinement comparison"> |
 | Prop sheet | <img src="blender_previews/sheet_props.jpg" width="320" alt="Prop asset sheet"> |
@@ -27,6 +27,12 @@ godot --headless --export-release "Linux" build/gig-line-smoke.x86_64
 `project.godot` sets `config/version`. Keep it in sync with the release tag
 (e.g. `v0.3.0` → `config/version="0.3.0"`, plus a git tag `v0.3.0`).

+Every major, minor and patch increment is a version in its own right: add the
+`CHANGELOG.md` entry, run the local build (`tools/build_releases.sh`), verify the
+artifact names/sizes/checksums, and only then commit and tag. A changelog entry
+without a matching build is not a completed version. Unversioned development tracks
+do not get a placeholder version; assign one when the scope enters a release.
+
 ## 3. CI (Gitea Actions)

 The repository ships a Gitea Actions workflow (`.gitea/workflows/build.yml`):
@@ -103,6 +109,26 @@ The optional Desktop HQ zip is assembled by `tools/build_releases.sh` from
 `packaging/desktop_hq/`; keep `override.cfg` next to the extracted executable.
 It is not part of the default Compatibility/Web build.

+`tools/publish_release.sh` preflights every artifact for existence and non-zero
+size, checks free space in `build/`, writes `build/SHA256SUMS-<version>.txt`, and
+uploads only after those checks pass. If an upload or the final asset-count check
+fails, it removes the assets it just uploaded (and removes a newly created
+release) so the host never keeps a partial release. Use
+`PUBLISH_DRY_RUN=1 ./tools/publish_release.sh` to run the preflight and checksum
+steps without touching the API. Set `RETAIN_RELEASES=7` to prune older releases
+after a successful publish; the default `0` disables pruning and never deletes
+history implicitly. A retention of seven keeps the newest seven releases,
+including the latest 0.8/0.9 line.
+
+### 0.10.0 macOS signing decision
+
+The 0.10.0 release candidate will continue to ship an **unsigned** macOS zip with
+the documented right-click/`xattr` quarantine instructions. Signing and
+notarization remain a public-release blocker until an Apple Developer account and
+a reproducible signing/notarization job are available; they are not silently
+claimed as complete. The same limitation is recorded in
+[`known-limitations.md`](known-limitations.md).
+
 Always run the release build from a clean checkout or detached worktree. Godot
 can pack files from ignored `tmp/` and old `build/` folders into the PCK; the
 0.9.6 dirty-tree build produced 1.6–3.1 GB artifacts, while the clean worktree
@@ -0,0 +1,32 @@
+# Accessibility Statement
+
+Gig Line is a keyboard/mouse-first first-person game with gamepad support. The
+current build includes the following accessibility features:
+
+- Remappable keyboard and gamepad bindings, persisted in `settings.json`.
+- Keyboard focus rings and explicit default focus in every modal, with A/B
+  accept/cancel on a gamepad and wrapped Tab/arrow navigation.
+- Adjustable HUD font scale up to 1.75× with clipped/ellipsized long labels.
+- Reduced-motion mode that disables head bob and motion-sensitive presentation.
+- Captions in the HUD log for radio, interaction and event messages.
+- Master, SFX and ambience volume controls.
+- Shape plus number escalation meter, so escalation is readable without colour.
+- Hold-to-confirm emergency action and guarded destructive actions.
+- Searchable Help generated from the live input bindings.
+- Mouse-transparent HUD, right-click/Esc modal handling, and a predictable
+  top-panel close path.
+
+Known gaps:
+
+- There is no screen-reader integration or text-to-speech narration.
+- The game is English-only; no pseudo-locale or full localization review has
+  been completed.
+- The visual style is stylized and some small environmental detail may be hard
+  to read at low resolution; a full low-vision/high-contrast audit is pending.
+- Audio captions cover gameplay messages, not every ambient sound.
+- A formal WCAG conformance claim has **not** been made. External accessibility
+  review is still a 0.10.0 release-review item.
+
+Test evidence and the manual checklist live in
+[`release-qa.md`](release-qa.md#manual-smoke-checklist); settings and save behaviour are
+documented in [`getting-started.md`](getting-started.md).
@@ -0,0 +1,83 @@
+# ADR-0015: NPC model variety sourcing
+
+- **Status:** Accepted (planning)
+- **Date:** 2026-11-03
+
+## Context
+
+The library has eight skinned characters, and role/seed selection reuses them
+across the three venues. Crowds therefore repeat the same faces, builds and
+outfits. The existing contract is strict: `npc_base` mesh node, 13 named bones at
+fixed rest positions, five tint slots, front on Blender −Y and an 8,000
+triangle/vertex budget.
+
+A review compared free/open-source sources against that contract. Quaternius
+Ultimate Modular (CC0), Kenney Blocky Characters (CC0), Khronos CesiumMan and
+RiggedFigure (CC BY 4.0) and the MakeHuman base mesh (CC0) were imported and
+measured. None was a drop-in; the full results are in
+[`docs/npc-model-sourcing.md`](../npc-model-sourcing.md).
+
+## Decision
+
+1. **Ship only CC0, or CC BY with recorded attribution.** No service asset whose
+   terms restrict redistribution may be used.
+2. **Extend the project-owned procedural generator as the primary path** for
+   shipped NPC variety. The first target is four crowd-variety looks, bringing
+   the library to twelve characters.
+3. **Keep Quaternius as a reviewed reference/prototype, not a shipped base.** A
+   contract retarget is a no-go because the source is a T-pose 62-bone realistic
+   rig with substantially different proportions from the arm-down 13-bone
+   contract. A future external-rig path would need its own ADR covering its
+   skeleton, animation source and per-model gear offsets.
+4. **MakeHuman is deferred to a separate local development pipeline.** Its CC0
+   base mesh can be decimated into budget, but it needs retopology, a custom rig
+   and project-owned clothing before it is usable. It must not become a CI or
+   build dependency.
+5. **Commit research previews with attribution.** CC-BY preview images are
+   development-only and are not bundled with the game or its release packages.
+
+## Consequences
+
+### Positive
+
+- The shipped library keeps one art direction, one skeleton and one audit gate.
+- Crowd variety lands without a new runtime dependency or a second animation
+  system.
+- The licence position is simple: project-owned assets plus explicit CC-BY
+  attribution where a preview or future asset requires it.
+- The Quaternius evaluation removes a tempting but high-risk retarget from the
+  critical path.
+
+### Negative
+
+- Procedural variation is still limited by the existing face and clothing
+  vocabulary; four variants do not provide full age/body diversity.
+- Quaternius' animation set remains unused unless a second rig path is approved.
+- MakeHuman body-shape diversity is postponed.
+- External previews add a small documentation footprint that must stay out of
+  release packages.
+
+## Alternatives considered
+
+- **Retarget Quaternius onto the `npc_base` contract.** Rejected for now:
+  welding brings the geometry inside budget, but the rest pose and body
+  proportions differ enough that a contract rebuild would either distort the
+  model or require a full proportion warp.
+- **Use Quaternius' own rig and animations directly.** Deferred: attractive
+  animation quality, but it adds a second skeleton/animation path and per-model
+  gear offsets to `NpcAvatar`.
+- **Use MakeHuman as the primary body source.** Rejected for this milestone: high
+  polygon count, no rig in the base mesh and a separate authoring dependency.
+- **Use Mixamo or Ready Player Me.** Rejected: service terms are not a simple
+  free/open-source redistribution basis for shipped meshes.
+
+## Amendment 2026-11-04
+
+- The character budget is raised to **16,000 triangles / 16,000 glTF vertices** per character.
+  The required 13 core bones remain; optional extra bones (fingers, face, toes) are allowed if
+  they do not move the core rest positions. The low-poly fallback remains the fallback, not a
+  second contract.
+- MakeHuman is now an active local development pipeline (body retarget plus project-owned
+  head/hands), while the procedural library remains the shipped path and CI fallback.
+- Blender MCP is optional interactive tooling only; it is not a build, CI, test or runtime
+  dependency. Setup is in [`docs/asset-tooling.md#optional-interactive-blender-mcp`](../asset-tooling.md#optional-interactive-blender-mcp).
@@ -18,3 +18,4 @@ Each ADR records the context, decision, consequences and alternatives for a dura
 - [0012-surface-materials-and-generated-props](0012-surface-materials-and-generated-props.md)
 - [0013-blender-authored-npc-characters](0013-blender-authored-npc-characters.md)
 - [0014-runtime-image-root](0014-runtime-image-root.md)
+- [0015-npc-model-variety-sourcing](0015-npc-model-variety-sourcing.md)
@@ -37,7 +37,7 @@ This document follows the structure of the arc42 architecture documentation temp
 - **MINOR** — new venues, NPC archetypes, systems, or features that are backward compatible.
 - **PATCH** — bug fixes and small polish that do not change behavior.

-The single source of truth for the version is `config/version` in `project.godot` (currently `0.9.6`). Each release is tagged in git as `v<version>` (e.g. `v0.6.0`). The `0.x` series is pre-stable, so MINOR bumps may introduce breaking changes while the prototype is still stabilizing. `tools/build_releases.sh` and `tools/publish_release.sh` read the version from `project.godot`, so bumping it there is the only required step before a release. The full bump checklist lives in [`RELEASING.md`](RELEASING.md).
+The single source of truth for the version is `config/version` in `project.godot` (currently `0.9.8`). Each release is tagged in git as `v<version>` (e.g. `v0.6.0`). The `0.x` series is pre-stable, so MINOR bumps may introduce breaking changes while the prototype is still stabilizing. `tools/build_releases.sh` and `tools/publish_release.sh` read the version from `project.godot`, so bumping it there is the only required step before a release. The full bump checklist lives in [`RELEASING.md`](RELEASING.md).

 ## 3. Context and Scope

@@ -117,6 +117,7 @@ The asset/content pipeline is part of the architecture, not an external build de
 | Gear/props | Blender flatpak + tool + bake | `npc_gear/*.glb`, `props/*.glb`, `*_ao.png` | `NpcAvatar`, `WorldBuilder` | primitive assets / generated props |
 | Surface/UI art | Python pipelines / AI-assisted references | `assets/textures/ai/game_ready/`, `assets/images/` | `SurfaceMaterials`, `UiArt` | neutral material / procedural UI |
 | Screenshots/QA | capture scripts + `scene_concepts`/`screen_designs` | `docs/screenshots/`, `docs/screens/realism/` | reviewers and CI gates | regenerate; never runtime input |
+| Local map data (planned) | OSM/3D building extract + licensed reference photos + AI/splat evaluation | derived map assets with provenance sidecars | `WorldBuilder` venue specs | current stylized venue geometry |
 | Release | Gitea workflow + build/publish scripts | platform binaries, Web zip, Desktop HQ zip | players | source build |

 Contracts that keep the pipeline replaceable:
@@ -127,6 +128,156 @@ Contracts that keep the pipeline replaceable:
 - UI/scene art is loaded through `UiArt` with a null/neutral fallback; composed images live in `assets/images/`, not in the docs reference tree (ADR-0014).
 - CI stays offline: only committed `.glb`/`.png`/`.tres` and Godot are needed; optional AI/Blender steps are reproducible development tools.

+### Character and gear asset contract
+
+The runtime NPC contract is intentionally narrow. It is enforced by
+`tools/blender_assets.py audit`, the GLB `inspect` path and the GDScript tests:
+
+| Contract | Rule |
+| --- | --- |
+| Mesh node | `npc_base`, skinned under an armature imported as `Skeleton3D`. |
+| Core bones | `Head`, `HipL/R`, `KneeL/R`, `ShoulderL/R`, `ElbowL/R`, `HandL/R`, `Spine`, `Neck` at the frozen rest positions. Optional extra bones (fingers, face, toes) are allowed if they do not move the core rest positions or break `NpcAvatar` proxies. |
+| Tint slots | `skin`, `cloth`, `pants`, `accessory`, `hair`; fixed detail materials keep their authored colours. |
+| Orientation | Blender −Y / Godot +Z front, feet grounded near `y = 0`, metre scale. |
+| Budget | 16,000 triangles / 16,000 glTF vertices per character; 1,500 per gear piece; 4,000 per prop. The low-poly `npc_base` remains a fallback, not a second contract. |
+| Textures | 256² albedo + normal + packed ORM per slot; cloth/pants use the 4× `NPC_FABRIC_UV_SCALE` and skip per-character baked AO, while skin/hair/gear keep AO. |
+| Gear attach | Authored in attach-point space: head `Rig/Head` (0, 1.62, 0), back (0, 1.10, 0), chest (0, 1.30, 0), hand (±0.27, 0.78, 0.02); grip 5 cm below the origin. `GEAR_OFFSETS` and `HAND_ITEM_FORWARD` are runtime fit corrections, not authored-geometry changes. |
+| Fallback chain | Library variant → `npc_base.glb` → procedural `NpcAvatar` mesh. Committed GLBs and maps must keep CI offline and Blender-free. |
+
+Asset types and their consumers:
+
+- Library characters, gear and props: `assets/models/blender/**`, generated by
+  `tools/blender_assets.py`; loaded by `NpcAvatar`/`WorldBuilder` with
+  generated/procedural fallbacks.
+- Frozen base: `assets/models/generated/npc_base.glb`, generated by
+  `tools/npc_pipeline.py`; the procedural avatar remains the last-resort path.
+- Maps: `assets/textures/npc/*_{albedo,normal,orm}.png` and baked AO maps; the
+  mesh budgets and material wiring are checked by `audit`/`fit`/`texels` and the
+  headless suite.
+- Editable `.blend` sources are development-only; only exported GLBs, AO/maps,
+  manifests and committed review sheets are runtime/repository assets.
+
+### Venue implementation contract
+
+The three venues are authored by `WorldBuilder.VENUE_SPECS` and rebuilt through
+the `World` container when the venue changes; the guard, UI and checkpoint state
+survive. Venue data is content, while the following runtime rules are fixed:
+
+| Venue | Real reference | Game implementation | Budget |
+| --- | --- | --- | --- |
+| Hollywood Boulevard | 6840 Hollywood Blvd / 1921 Masonic Temple | Six-column Masonic facade, eight steps, Walk of Fame, boulevard, Ovation arcade and neighbours | 58,884 tris / 409 meshes |
+| The Joke Shop | Fictional stand-in for 8433 Sunset Blvd | 27 m black hall, signature canopy, circular blade sign, red curtain bays, west entrance, hillside and neighbours | 25,828 tris / 518 meshes |
+| Late Night TV Studio | Same El Capitan block as Hollywood | Reuses the Masonic facade and steps with bulb canopy, car, barriers and studio-arrival staging | shares the Hollywood block; TV spec is a 30.0 m variant |
+
+Venue rules:
+
+- Coordinates are Godot metres; the guard's front is +Z. `VENUE_SPECS` owns
+  facade dimensions, street/nav bounds, guard spawn, feature flags and prop
+  placements; tests enforce the map budgets.
+- Collision and navigation remain mesh-based. Props that block walking need a
+  `StaticBody3D` plus `NavigationObstacle3D`; the marquee, handrail, lantern and
+  door are documented non-blocking exceptions.
+- Day/night is a phase offset on one geometry/scenario, not a second baked map.
+  The venue menu's Night row starts in `LATE` while the checkpoint stores the
+  offset.
+- Real-site references are evidence for shape/materials, not shipped assets.
+  Licensed boards live under `docs/screens/refs/` with sidecars; local-only
+  research stays in `tmp/research/` and is never committed.
+- The stylized geometry remains the runtime fallback if a future data-backed
+  block or facade kit fails budget, navigation, visual or provenance gates.
+
+### Persistence and save contract
+
+Persistence is local-only under Godot's `user://` directory. The architecture
+owns the schema; operational locations and reset/rollback steps live in
+[`getting-started.md`](getting-started.md#save-data-and-migration).
+
+| File | Contents | Compatibility |
+| --- | --- | --- |
+| `settings.json` | Camera/HUD/bindings/difficulty/audio/accessibility/tutorial flags | Schema-less compatible growth; missing keys merge from `Save.DEFAULT_SETTINGS`. |
+| `campaign.json` | Campaign index, completed venues, difficulty, shift number, last grade | Missing fields fall back to safe campaign defaults. |
+| `shift_results.json` | Completed-shift review history (array) | Append-only; unknown fields are ignored by readers. |
+| `shift_state.json` | Resumable checkpoint: version `1`, venue, guard/door/flashlight/body-camera state, coordinator snapshot, NPC rows | Versioned; unknown/missing state falls back rather than blocking boot. |
+
+Writes go to a `.tmp` file and are renamed after the complete JSON is written.
+Corrupt or partial files are ignored on load; a failed replace leaves the prior
+valid file intact. The checkpoint deliberately excludes the tutorial overlay and
+transient input state.
+
+### Character development tooling
+
+Characters have two authored sources and one procedural fallback. The eight-variant
+Blender library (`assets/models/blender/npc/`) is the normal presentation path; the
+older skinned `npc_base` (`assets/models/generated/npc_base.glb`) remains a frozen
+contract and fallback; `NpcAvatar`'s procedural rig is the offline last resort.
+Four crowd-variety prototypes have been built and audited locally but are not yet in
+the shipped catalogue; generator-first expansion is the active character track
+(ADR-0015). Blender is a developer tool only — runtime, tests and CI consume committed
+GLBs and maps.
+
+| Tool | Role | Committed artifact | Verification gate |
+| --- | --- | --- | --- |
+| `tools/npc_pipeline.py` | Builds the skinned base avatar, five-slot material maps, palette and AI-fabric preparation (`prepare`/`palette`) | `npc_base.glb`, `assets/textures/npc/*_{albedo,normal,orm}.png`, `palette.json` | `audit_glb` against the 16,000-triangle / 16,000-vertex base contract (13 core bones required; extras allowed) |
+| `tools/blender_assets.py` | Builds/renders the library: 8 characters, 18 gear pieces, 20 props, plus `manifest.json`; stdlib `audit`/`fit`/`sheet`/`list` | `assets/models/blender/{npc,npc_gear,props}/*.glb` | Character cap 16,000 tris / 16,000 verts, 1,500 per gear, 4,000 per prop; grounding, UV, degenerate-triangle, attach-fit and manifest coverage checks |
+| `tools/bake_ao.py` | Bakes per-asset AO maps | `<asset>_ao.png` (256²) | Wired through `Materials.apply_ao()`/`SurfaceMaterials`; cloth/pants opt out (see below) |
+| `tools/npc_proportions.py` | Measures exported GLB rest pose (height, head, shoulders, hips, torso, limbs, feet) against the stylized guide | report / JSON in `docs/npc-visual-review.md#proportion-audit` | All eight variants must stay inside the guide after a body change |
+| `tools/npc_baseline.py` | Assembles neutral-baseline sheets and before/after comparisons | `docs/blender_previews/sheet_npc_baseline*.jpg` | Human review against `docs/npc-visual-review.md` |
+| `src/test/capture_npc_baseline.gd` | Fixed-camera studio baseline, 8 variants × 6 views | local `tmp/` frames | Neutral silhouette/face/gear review |
+| `src/test/capture_npc_review.gd` | Final-context gate: 8 variants × 2 venues × day/night × 3 distances = 96 frames, crowd hidden, review-only `character_override` for the guard | local `tmp/` frames | Pre-build acceptance gate for gear fit and venue lighting |
+| `src/test/capture_realism.gd` | Venue realism stages plus a frozen portrait and surface close-ups | `docs/screens/realism/<run>/` | Optional vision judge; portrait is the only avatar-detail capture |
+
+Runtime contracts that must survive any character change:
+
+- `NpcAvatar.character_model_for(role, seed)` selects the library variant; `character_override`
+  exists only to stage roles without a spawned model (for example the guard).
+- The armature node names, `Rig/Head`, the Hip/Knee/Shoulder/Elbow/Hand proxies and the
+  **+Z visual front** are frozen; animation and `yaw_towards()` depend on them.
+- Only the five contract slots are tinted. Fixed detail materials (eyes, reflective bands,
+  rubber) stay untouched, gear is placed by `GEAR_ATTACH`, and `GEAR_OFFSETS` plus
+  `HAND_ITEM_FORWARD` are runtime attach-space corrections, not authoring changes.
+- Cloth/pants use `Materials.NPC_FABRIC_UV_SCALE` (4×) and skip the baked per-character AO;
+  skin/hair/gear keep AO. Do not reintroduce the blotchy cloth AO.
+- `apply_lod()` swaps to an impostor at 26 m; the 24-NPC budget smoke (6.94 ms, 168 meshes,
+  152,464 triangles) is the performance gate. Changing either triangle cap requires
+  re-measuring that smoke and the Web/Compatibility path.
+- Rebuild only the assets whose geometry changed (Blender GLB export is byte-nondeterministic),
+  then run `godot --headless --path . --import`; never commit a no-op full rebuild.
+
+Evidence and detailed contracts live in [`blender-assets.md`](blender-assets.md),
+[`npc-visual-review.md`](npc-visual-review.md) and
+[`npc-visual-review.md#proportion-audit`](npc-visual-review.md#proportion-audit); command-level usage is in
+[`asset-tooling.md`](asset-tooling.md).
+
+### Local map development tooling (planned)
+
+The current venues are hand-authored procedural reconstructions in
+`src/game/world_builder.gd`. The local map workstreams (**H–M**) in
+[`TODO.md`](../TODO.md#3d-model-re-evaluation) are unversioned and planned: they will
+test whether licensed data and reference photography can replace or supplement the
+stylized geometry without moving map data, AI composition or splat rendering into
+the runtime.
+
+Planned stages and gates:
+
+| Stage | Source | Output | Gate |
+| --- | --- | --- | --- |
+| Footprints and massing | Offline OpenStreetMap extract + licence-compatible 3D building data (OSM Buildings, Overture, CityGML/LOD1–2) | Local footprint/massing scenes, extract date and query pinned | ODbL attribution/share-alike review; scale/orientation and venue-footprint comparison |
+| Reference imagery | Wikimedia Commons, own/team photos or other clearly licensed images | Reference boards and material candidates | Written author/licence/attribution, privacy redaction, no unlicensed Street View or scraped commercial imagery |
+| AI-assisted composition | Project image tooling | Palette/facade-rhythm boards and material candidates | Model/prompt/output recorded; human review; never treated as licensed map data |
+| Photoreal facade kit | Project-authored geometry and derived materials | Committed facade modules and PBR maps | WorldBuilder budget, collider/nav coverage, Compatibility-readability and screenshot review |
+| Gaussian splatting | Licensed/permissioned photo sets + pinned offline toolchain | Development-only splat, texture or proxy experiments | Per-path ADR; runtime only if performance, collision/navigation and provenance are proven |
+
+Contracts for any future map source:
+
+- Runtime consumes committed, derived assets only; no online OSM, photo or splat
+  service is a build or play dependency.
+- OSM ODbL, photo licences, capture permissions and privacy redaction are recorded
+  in a provenance sidecar before an asset enters the repository.
+- Collision and navigation stay mesh-based; a splat may never become the playable
+  floor or the access/occlusion authority.
+- The stylized venue geometry remains the fallback until a data-backed block passes
+  the venue budget, navigation, visual and provenance gates.
+
 ### Content authoring and runtime data flow

 `ScenarioFactory` is the source of truth for the three authored venues. `tools/export_venues.gd`
@@ -272,6 +423,8 @@ Architecture decisions are recorded as ADRs:
 - Accessibility and localization coverage is partial; a public release needs subtitles/captions, colour-independent cues, remapping, text expansion tests and at least a documented localization workflow.
 - Unsigned macOS builds, AI asset provenance and any storefront/legal requirements are release blockers for a public release.
 - Documentation drift has already occurred (release version, implemented status and obsolete plan docs); the ownership map and roadmap must be kept current in the same change as the implementation.
+- Character quality is only partly automatable: proportions, budgets and gear fit are measured, but face realism and venue-lighting readability still need the baseline/review sheets and human sign-off after any mesh, map or material change.
+- Local-map data and photo-derived assets add a second provenance and privacy risk: OSM share-alike, photo rights, faces/plates, property permission and rapidly churning splat tooling must be resolved before any derived asset ships.

 ## 12. Documentation Consolidation and Ownership

@@ -282,16 +435,23 @@ architecture document.
 | Document | Canonical role | Relationship to this architecture |
 | --- | --- | --- |
 | [`PLAN.md`](../PLAN.md) | Product/design intent, pillars, venues and success criteria | Design source; architecture realizes it |
-| [`docs/gameplay.md`](gameplay.md) | Playable loop, escalation, venue mechanics | Runtime/behavioral view |
+| [`docs/gameplay.md`](gameplay.md) | Playable loop, escalation, tutorial, venue mechanics | Runtime/behavioral view |
+| [`docs/venues.md`](venues.md) | Real-site evidence, mapping decisions and deliberate simplifications | Runtime venues' evidence companion to §5 |
 | [`docs/architecture.md`](architecture.md) | System boundaries, data flow, constraints, deployment, cross-cutting decisions, quality risks | Single architecture source |
 | [`docs/adr/`](adr/) | Immutable decision records with context and consequences | Decision history linked from §9 |
-| [`docs/asset-tooling.md`](asset-tooling.md) | Build/audit/capture commands and pipeline usage | Operational appendix to the pipeline section |
-| [`docs/blender-assets.md`](blender-assets.md) | Blender character/gear/prop contracts and attach points | Detailed asset contract appendix |
+| [`docs/asset-tooling.md`](asset-tooling.md) | Build/audit/capture commands, optional Blender MCP and pipeline usage | Operational appendix to the pipeline section |
+| [`docs/blender-assets.md`](blender-assets.md) | Blender library art direction, roles, layout and checks | Operational asset appendix; contract lives here in §5 |
+| [`docs/npc-visual-review.md`](npc-visual-review.md) | NPC baseline views, acceptance criteria, visual gaps and proportion audit | Visual-QA appendix to the character tooling section |
+| [`docs/3d-model-review.md`](3d-model-review.md) | Scorecard, measurements and ranked asset gaps | Working review companion to §5 |
+| [`docs/npc-model-sourcing.md`](npc-model-sourcing.md) | Character-source evaluation and licence/prototype outcome | Supports the character tooling section and ADR-0015 |
 | [`docs/getting-started.md`](getting-started.md) | Setup, commands, controls | Developer onboarding |
 | [`docs/RELEASING.md`](RELEASING.md) | Release checklist and CI/publishing steps | Deployment appendix to §7 |
-| [`docs/smoke-checklist.md`](smoke-checklist.md) | Manual verification script | QA appendix to §10 |
+| [`docs/release-qa.md`](release-qa.md) | Manual smoke checklist and balance protocol | QA appendix to §10 |
+| [`docs/accessibility.md`](accessibility.md) | Accessibility features, statement and known gaps | Player-facing quality statement |
+| [`docs/known-limitations.md`](known-limitations.md) | Release blockers and accepted limitations | Player/release-facing risk statement |
+| [`docs/ui-copy.md`](ui-copy.md) | Screen/button inventory, copy audit and screen-judge report | Presentation appendix |
 | [`docs/development-status.md`](development-status.md) | Implemented features and current gaps | Status companion to the roadmap |
-| [`TODO.md`](../TODO.md) | Active tasks and 0.x roadmap | Planning source; no architecture duplication |
+| [`TODO.md`](../TODO.md) | Priority-ordered active tasks, unversioned development tracks and versioned roadmap | Planning source; no architecture duplication |
 | [`CHANGELOG.md`](../CHANGELOG.md) | User-facing release history | Release/version companion |

 Consolidation decisions:
@@ -299,7 +459,7 @@ Consolidation decisions:
 - **Architecture owns the "how"** (components, contracts, data flow, constraints, quality gates); **PLAN/gameplay own the "what"**; **ADRs own the "why"**. Links replace duplicated prose.
 - **Asset and release documents remain separate** because they are command-heavy operational procedures; their architecture-relevant contracts and failure modes are summarized in §5 and §7.
 - **Completed plans are removed, not kept as competing roadmaps.** Historical graphics work is summarized by ADR-0013, the asset pipeline section and the v0.6.0 changelog; new work belongs in TODO.
- **Status and roadmap are separate from architecture.** `docs/development-status.md` records what exists; `TODO.md` records what remains, including the 0.x gap analysis and milestone exit criteria.
+- **Status and roadmap are separate from architecture.** `docs/development-status.md` records what exists; `TODO.md` records what remains, ordered as unversioned development tracks, versioned milestones and deferred work.
 - **Documentation drift is a tracked risk:** release/version, test counts, renderer status, and stale plans must be corrected in the same commit as the change that invalidates them.

 ## 13. Glossary
@@ -38,7 +38,7 @@ Audit accepts image files or directories. `--role auto` infers common roles from
 ```bash
 python3 tools/asset_pipeline.py audit assets/textures
 python3 tools/asset_pipeline.py audit assets/images/scenes --role background --json
-python3 -m unittest discover -s tools -p 'test_*.py'
+python3 -m unittest discover -s tools/tests -t tools -p 'test_*.py'
 ```

 The audit classifies measurable fit issues as `good` or `bad` based on role-specific dimensions, aspect ratio, alpha requirements, and tile-edge continuity. It lists perspective/projection as a visual review item because image semantics cannot be judged reliably by these deterministic checks.
@@ -129,18 +129,185 @@ with colliders/avoidance and drives their emissive parts from the day/night
 cycle. The single `npc_base.glb` and primitive props remain offline fallbacks.
 Contract and integration notes: [`blender-assets.md`](blender-assets.md).

+Sourcing and expansion research (no external model is shipped yet):
+[`npc-model-sourcing.md`](npc-model-sourcing.md) compares Quaternius, Kenney, Khronos and
+MakeHuman sources against the character contract and records the 2026-11-03 direction
+(procedural generator first, Quaternius reference, MakeHuman deferred).
+
 | Characters | Props |
 | --- | --- |
 | ![characters](../docs/blender_previews/sheet_npc.jpg) | ![props](../docs/blender_previews/sheet_props.jpg) |

 ```bash
 flatpak run org.blender.Blender --background --python "$PWD/tools/blender_assets.py" -- build
+flatpak run org.blender.Blender --background --python "$PWD/tools/blender_assets.py" -- build --head mh
 flatpak run org.blender.Blender --background --python "$PWD/tools/blender_assets.py" -- render
 python3 tools/blender_assets.py sheet   # docs/blender_previews/sheet_*.jpg
 python3 tools/blender_assets.py audit   # no Blender needed
+python3 tools/blender_assets.py fit     # gear-vs-body fit report
+python3 tools/blender_assets.py texels  # per-slot texel density (px/m) of the characters
+# `build --head mh` selects the MakeHuman head; the default stays `face` until rollout.
 godot --headless --path . --import
 ```

+### Intake inspection (`inspect`)
+
+`audit` reads accessor-local bounds and ignores node transforms, so it is the right
+release gate but a poor first look at a downloaded or newly authored GLB. `inspect`
+imports the file into Blender, clears parents and applies object transforms, then
+reports what the scene actually contains:
+
+```bash
+# one asset, a batch, or an external download; repeat --file as needed
+flatpak run org.blender.Blender --background \
+  --python "$PWD/tools/blender_assets.py" -- inspect \
+  --file "$PWD/assets/models/blender/npc/npc_casual.glb" \
+  --file "$PWD/tmp/downloads/SomeCharacter.glb"
+# machine-readable, for intake scripts (write to a file: Blender prints a banner first)
+... -- inspect --file "$PWD/tmp/x.glb" --json --out "$PWD/tmp/x.json"
+# force a contract family instead of inferring it from the path
+... -- inspect --file "$PWD/tmp/x.glb" --category npc
+```
+
+It prints triangles (with the category budget), raw and seam-split vertex counts,
+Godot-space bounds with height/feet for characters, whether transforms had to be
+applied, mesh nodes and armatures, bone names, materials, UV layers, skinning and
+animation count. Hard contract failures (`issues`) fail the command; advisory
+findings (`warnings`) do not. The category is inferred from the path:
+`blender/npc` → `npc`, `blender/npc_gear` → `npc_gear`, `blender/props` and
+`generated` → `props`, anything else → `external` (measured but with no project
+budget or rig contract).
+
+Caveats:
+
+- The glTF importer adds a bone-display mesh (`Icosphere`, used as
+  `pose_bone.custom_shape`). `inspect` excludes custom-shape helpers so they never
+  pollute bounds or the unskinned list.
+- Bounds and bone rests are converted from Blender Z-up to Godot Y-up (`x, z, -y`),
+  matching the contract bands and the audit's coordinate space.
+
+### Intake adaptation (`adapt`)
+
+`adapt` is the mechanical first half of an external-mesh intake (MakeHuman,
+MPFB, downloaded GLB): import, apply transforms, ground the feet, weld seam
+splits, decimate to the character budget, and export a GLB. It does **not** map
+the five tint slots or rebuild the 13-core-bone `npc_base` armature (optional extra bones are allowed) — those stay a
+manual `retopology`/`rigging` step with a recorded second-rig contract if the
+source rig cannot be retargeted:
+
+```bash
+flatpak run org.blender.Blender --background \
+  --python "$PWD/tools/blender_assets.py" -- adapt \
+  --file "$PWD/tmp/npc-research/makehuman_base.glb" \
+  --out "$PWD/tmp/npc-research/makehuman_adapted.glb" \
+  --target-tris 16000
+# prints: adapted makehuman_adapted.glb: 36972 -> 16000 tris (bones=N, meshes=1)
+```
+
+Run `inspect` on the adapted GLB before and after, and keep the procedural
+generator as the fallback until a MakeHuman variant passes `audit`/`fit` and the
+24-NPC budget.
+- Numbers are Blender-side measurements. Triangles match `audit` on project assets; the seam-split
+  vertex count can differ by ±1 because the importer rounds normals. `audit` stays the single final
+  gate: it is stdlib-only, runs in CI, and matches what the engine imports.
+- `inspect` never writes or adapts the file; scale/grounding/weld/retarget work is the
+  separate (not yet built) `adapt` step.
+- `--json` also captures the importer's INFO log in `stats.import_log` instead of printing it.
+  Blender still prints its own version banner before the script runs, so intake scripts should use
+  `--json --out <file>` rather than parsing stdout.
+
+### Reference-anchored concept generation
+
+`tools/scene_concepts.py generate --reference <photo>` anchors a concept frame on a real
+photograph: the photo is sent to the OpenRouter multimodal chat endpoint as a base64 data URL
+(`generate_textures.generate_image(reference_path=...)`) with a prompt suffix that pins the
+photographed geometry (column rhythm, band heights, signage placement, camera angle) while the
+prompt restages lighting, weather and people.
+
+Licence gate: the reference must be listed in its `docs/screens/refs/<venue>/SIDECAR.md` row
+(which also supplies the licence and Commons page for provenance). A photo from anywhere else
+requires `--reference-unchecked`, which records `unchecked` in the provenance. Each anchored
+generation writes a `.refgen.json` sidecar next to the frame (`model`, reference file/licence/page,
+geometry suffix) so a concept frame can always be traced back to its evidence photo. Where a
+generated frame and its reference photo disagree, the photo wins for shape.
+
+### Photo-anchored variant pass
+
+`tools/scene_concepts.py anchor --reference <photo> --context "..." --treatments day,night,weathered
+--out-dir docs/screens/concepts/<block>` generates several restaged conditions (day, night,
+weathered) of one reference photo's framing, each with its `.refgen.json` provenance sidecar, so a
+concept board stays comparable with its photo board. The reference passes the same SIDECAR licence
+gate as `--reference` on `generate`.
+
+### Local-only reference collection (`refcollect`)
+
+`tools/refcollect.py` downloads images from DuckDuckGo image search into `tmp/research/<slug>/` for
+development reference only. It applies **no licence gate** (rows are marked `local_only` /
+`unchecked-local`); everything it fetches must never be committed or promoted into
+[`screens/refs/`](screens/refs/README.md) without the normal sidecar licence + privacy gate. This
+is the owner-authorised local-only override (TODO.md §3D model re-evaluation → A).
+
+```bash
+python3 tools/refcollect.py search "Comedy Store Sunset Boulevard" --slug comedy-store --limit 20
+python3 tools/refcollect.py sheet --slug comedy-store   # local contact sheet (never committed)
+```
+
+Requires `pip install duckduckgo-search` (renamed `ddgs` upstream). DuckDuckGo rate-limits by IP
+(HTTP 202), so every request — the search itself and each image download — passes through a shared
+token bucket (`--rate`, default 0.5 req/s, and `--burst`, default 3) and a polite retry routine:
+transient statuses (408/425/429/5xx/52x) and network errors back off exponentially with full
+jitter, `Retry-After` is honoured, permanent failures fail fast, and the loop gives up after six
+attempts. Requests carry a full, coherent Firefox header set (`--user-agent` overrides the UA
+string); the UA alone is no longer enough to look like a browser.
+
+### Reference-board research (`refboard`)
+
+`tools/refboard.py` searches, fetches and documents Wikimedia Commons photos of a real location for
+the [`screens/refs/`](screens/refs/README.md) boards. It is stdlib-only and never commits anything
+itself: downloads land in `tmp/`, and moving a file into a board folder is a deliberate manual step
+that goes through the sidecar licence gate.
+
+```bash
+# search: keyword, geosearch (the reliable "photos of this exact place"), or category
+python3 tools/refboard.py search --source geo "34.10118|-118.34009" --limit 60 --months 12
+python3 tools/refboard.py search "El Capitan Entertainment Centre" --source search
+python3 tools/refboard.py search "Hollywood Masonic Temple" --source category --json
+# fetch the usable rows into tmp/ (review-only rows need --include-review)
+python3 tools/refboard.py search ... --json > /tmp/manifest.json
+python3 tools/refboard.py fetch --from /tmp/manifest.json --dir tmp/research/<block> --max 12
+# emit SIDECAR + README table rows from the fetched manifest
+python3 tools/refboard.py rows --from tmp/research/<block>/meta.json
+```
+
+Licence gate: `Public domain`, `CC0` and `CC BY` are committable with attribution; `CC BY-SA` rows
+are flagged `review` and stay research-only until the share-alike decision is written into the
+sidecar (`--allow-ccbysa` marks them committable after that review); anything else is skipped.
+`--months 12` flags recent captures so a "current reality" photo can be distinguished from the
+older geometry evidence. Network gotchas baked in: a descriptive User-Agent, batched `titles=`
+metadata queries and ~3 s download spacing to avoid Commons HTTP 429s.
+
+### Texel density (`texels`)
+
+`texel_density()` and the `texels` command compute `resolution * sqrt(UV area / world area)` per
+material slot straight from the GLB, so the number does not depend on island packing. The NPC slot
+maps are 256², and cloth/pants are reported twice: authored density and effective density with the
+runtime 4× repeat from `Materials.NPC_FABRIC_UV_SCALE`. Current values and interpretation are in
+[`3d-model-review.md`](3d-model-review.md).
+
+```bash
+python3 tools/blender_assets.py texels            # all eight characters
+python3 tools/blender_assets.py texels --json     # machine-readable
+python3 tools/blender_assets.py texels --only npc_coat
+```
+
+## Local map development (planned)
+
+The local map workstreams (H–M) in [`TODO.md`](../TODO.md#3d-model-re-evaluation) are
+planned, not implemented; there are no map-generation commands yet. The runtime
+contract, provenance rules, budget/navigation gates and fallback are in
+[`architecture.md#venue-implementation-contract`](architecture.md#venue-implementation-contract).
+The detailed pipeline/task list lives in `TODO.md`.
+
 ## Confirmed game assets

 Everything below is audited and shipped in the game; development-only outputs
@@ -165,6 +332,162 @@ python3 tools/model_pipeline.py audit
 python3 tools/npc_pipeline.py audit
 ```

+## Optional interactive Blender MCP
+
+Status: **optional interactive tooling, not a build dependency.** Blender MCP is
+useful for exploring a local part scene, moving the viewport and iterating on a
+head/hand mesh without a manual UI walkthrough. The authoritative asset
+pipeline remains the headless CLI plus `audit`/`fit`/`inspect`; CI, tests and
+release builds must continue to work with no Blender process and no MCP server.
+
+This project does not vend the third-party addon or pin a runtime MCP
+dependency. Install it outside the repository and keep generated scenes under
+`tmp/`.
+
+### What it adds
+
+With Blender MCP connected, an agent can:
+
+- query the current scene and object data;
+- run small `bpy` snippets through the MCP bridge;
+- capture a viewport screenshot for visual checks;
+- inspect or modify a local part scene before exporting a GLB.
+
+It does **not** replace:
+
+- `python3 tools/blender_assets.py audit/fit/inspect`;
+- `python3 tools/npc_proportions.py`;
+- the Godot capture and smoke gates;
+- the project's licence/provenance review.
+
+### Prerequisites
+
+- Blender 5.2 LTS, installed as the `org.blender.Blender` flatpak (the project
+  standard).
+- An MCP-capable client.
+- The upstream [BlenderMCP addon](https://github.com/ahujasid/blender-mcp)
+  (`addon.py`) and its MCP server.
+- `uv`/`uvx` if you use the server's `uvx blender-mcp` launcher; a local install
+  of the server package is equally valid.
+
+Check the upstream README for the current package/addon version and any command
+changes before installing. Do not copy the addon into this repository.
+
+### Setup
+
+#### 1. Install the Blender addon
+
+1. Download or clone the upstream BlenderMCP project.
+2. In Blender: **Edit → Preferences → Add-ons → Install from Disk**, select
+   `addon.py` from that checkout.
+3. Enable **Interface: Blender MCP**.
+4. Open the 3D View sidebar (N panel), find the **BlenderMCP** tab, and click
+   **Connect to MCP server**. The default server listens on
+   `localhost:9876`.
+
+The addon must be running inside the Blender process that has the scene open.
+Starting a second Blender instance does not connect the first one.
+
+#### 2. Configure the MCP client
+
+For Pi, add the server at user scope so it is not committed into the project:
+
+```bash
+pi mcp add blender -- uvx blender-mcp
+pi mcp list
+```
+
+Then start/reload Pi and use `/mcp` to inspect the connection. Other clients
+use their normal MCP server configuration. A generic JSON example:
+
+```json
+{
+  "mcpServers": {
+    "blender": {
+      "command": "uvx",
+      "args": ["blender-mcp"]
+    }
+  }
+}
+```
+
+For a client with a different config schema, use the equivalent server command
+and keep the server name `blender`. Restart/reload the client after adding it,
+then request the tool list and run a harmless `get_scene_info` before editing.
+
+#### 3. Connect through the flatpak
+
+Start Blender through the project's normal flatpak command, open the local part
+scene, and connect from the sidebar. If the client cannot reach the addon:
+
+- confirm the addon panel says connected;
+- confirm the client is launching the MCP server, not just a shell;
+- check port `9876` is not occupied;
+- if the flatpak sandbox is blocking localhost networking, grant network
+  permission only for this interactive use, for example:
+  `flatpak override --user --share=network org.blender.Blender`
+  (review the permission change afterwards; do not add it to CI or build
+  scripts).
+- restart both the MCP client and Blender after changing the addon or config.
+
+### Recommended part-workflow
+
+The headless part pipeline is `tools/npc_parts.py` (see
+[`blender-assets.md#local-part-pipeline`](blender-assets.md#local-part-pipeline)). It builds,
+extracts, assembles, inspects and sheets the reusable head/face and hand parts and reuses the
+`blender_assets.py` builders, so there is no second face/hand implementation. The MCP steps below
+remain optional interactive exploration; the headless commands stay the build and audit path.
+
+1. Create a local scene, for example
+   `tmp/npc-parts/npc_casual/head.blend`, or open a copy of an exported part GLB.
+   Never save over the tracked `assets/models/npc/npc_base.blend`.
+2. Ask the MCP client for `get_scene_info`, then inspect the object/bone/mesh
+   names it reports.
+3. Use `execute_blender_code` for small, reversible edits. Prefer adding a new
+   object or modifier over deleting existing geometry; keep a backup copy.
+4. Use `get_viewport_screenshot` after camera/material changes to check the
+   head/face/hand before exporting.
+5. Export a **local** GLB under `tmp/npc-parts/`, not directly into
+   `assets/models/`.
+6. Run the normal gates on the exported file:
+
+   ```bash
+   flatpak run org.blender.Blender --background \
+     --python "$PWD/tools/blender_assets.py" -- \
+     inspect --file "$PWD/tmp/npc-parts/head.glb" --category npc --json
+   python3 tools/blender_assets.py audit
+   python3 tools/blender_assets.py fit
+   python3 tools/npc_proportions.py report
+   ```
+
+7. Only after the part is reviewed and the contract passes should it be
+   assembled into a character and rebuilt through the headless pipeline.
+
+### Safety and project rules
+
+- MCP is **not** part of `project.godot`, the build, CI, tests, release packages
+  or runtime.
+- Do not commit `.blend` part scenes, MCP configuration, API keys or generated
+  previews. The working set stays in `tmp/`; a part GLB is not a shipped asset.
+- Do not use MCP to bypass the contract, budgets, AO/UV rules or licence gate.
+- The 13 core bones must remain at their rest positions; extra optional bones
+  are allowed only if `NpcAvatar` and the audit/tests still pass.
+- Prefer scripted headless changes for reproducible work; MCP is for the
+  interactive exploration and review that is awkward in a one-shot script.
+- If MCP is unavailable, use the headless CLI and document the manual step; never
+  make the project depend on MCP being present.
+
+### Troubleshooting
+
+| Symptom | Check |
+| --- | --- |
+| Client cannot find `blender` | MCP client config path/schema; restart client; confirm server command exists |
+| `Connection refused` | Addon **Connect to MCP server** pressed; Blender still running; port 9876 |
+| Tools return stale scene data | Refresh scene/object query after edits; restart the connection if needed |
+| Flatpak cannot reach localhost | Check flatpak network permission; grant only for interactive use |
+| Changes look wrong in export | Re-import the GLB with `inspect`; check transforms, scale, UVs and materials |
+| Contract audit fails | Fix the mesh/bones first; do not edit the audit expectations around a broken asset |
+
 ## Realism pass: scene concepts, skylines and textures

 The skyline, surface tiles and phase lighting were rebuilt against AI concept frames. The
@@ -199,6 +522,16 @@ and ranks them by advertised token/image price. The run falls through the list
 on provider/model errors and aborts on an invalid key. Use
 `GIG_LINE_JUDGE_MODEL` or `--model <id>` for a pinned comparison.

+For an open-ended review of a single capture/reference (no structured verdict),
+`tools/describe_image.py` sends the image plus a question to a vision model and
+prints the answer. It is how the 2026-11-03 re-evaluation read the local-only
+reference frames and the prop/venue captures:
+
+```bash
+python3 tools/describe_image.py docs/screenshots/12-joke-shop.png \
+  --question "Do the red curtain bays read as tied-back fabric or flat slabs?"
+```
+
 `capture_npc_review.gd` is the pre-build NPC gate: it stages all eight
 library character models at portrait, conversation and crowd distance on both
 promoted maps in day and night lighting, with the normal crowd hidden. It uses
@@ -218,9 +551,25 @@ contract.

 `tools/npc_proportions.py` checks the eight character GLBs against the shared
 height/head/shoulder/hip/torso/leg/arm/foot guide; the current results are in
-[`npc-proportion-audit.md`](npc-proportion-audit.md). It reads the exported GLBs
+[`npc-visual-review.md`](npc-visual-review.md#proportion-audit). It reads the exported GLBs
 and does not require Blender.

+`capture_npc_pose.gd` is the pose/deformation harness for the 3D re-evaluation: idle,
+walk-contact, walk-pass and seated poses of all eight variants, full-body plus shoulder
+close-ups. **It is currently blocked**: the applied pose is visible in the rig and bone values
+but not in the captured frames, so do not use its sheets as pose evidence. The reproduction and
+what was ruled out are in [`3d-model-review.md`](3d-model-review.md) §"Pose evidence is blocked".
+
+The baseline sheet tool accepts a custom view list, which is also how pose sheets are tiled:
+
+```bash
+# baseline set (six views, eight variants)
+python3 tools/npc_baseline.py sheet --dir tmp/npc-baseline
+# pose set produced by capture_npc_pose.gd
+python3 tools/npc_baseline.py sheet --dir tmp/npc-pose \
+  --views idle,walk_contact,walk_pass,sit --out tmp/npc-pose/sheet_pose.jpg
+```
+
 `capture_npc_baseline.gd` is the 0.9.4 neutral baseline: eight characters ×
 front/three-quarter/profile/back/full-body/crowd = 48 frames with a fixed
 camera, studio lighting and no venue/HUD/animation. The raw PNGs stay in
@@ -21,7 +21,7 @@ captures in `docs/screenshots/`.

 - **People** (`targeting_npc`, `joke_shop_queue`, `studio_arrival`,
  `crowd_panic`, `responder_arrival`): ordinary adults in sweaters, jackets,
-  long coats, hoodies and beanies; a security guard in a dark uniform with a cap
+  long coats and hoodies; a security guard in a dark uniform with a cap
  and belt; a firefighter in a dark turnout coat with yellow reflective bands,
  a helmet and an SCBA tank. The current skinned `npc_base` is a set of boxes
  and cylinders with a flat face, so silhouette was the main gap.
@@ -35,6 +35,60 @@ captures in `docs/screenshots/`.
  doors, stair handrails and a dark sedan. Today's in-game props are primitive
  boxes, and the trees are cones.

+## Frozen fallback boundary
+
+`assets/models/npc/npc_base.blend` is the tracked, frozen plain-primitive
+fallback. Prototype head/face/hand detail from the local part pipeline must not
+be saved into it; a separate contract decision (ADR or owner sign-off) is
+required before any prototype detail is absorbed. Working scenes live under
+`tmp/npc-parts/` (gitignored) and are exported as local GLBs for review, never
+directly over the tracked `.blend`. The same rule already appears in
+[`asset-tooling.md#recommended-part-workflow`](asset-tooling.md#recommended-part-workflow).
+
+## Local part pipeline
+
+The overhaul uses `tools/npc_parts.py` to build, extract, assemble, inspect and sheet the
+reusable head/face and hand parts before they are rolled into the 12 characters. It reuses the
+`blender_assets.py` builders (no second face/hand implementation) and stays local-only/headless.
+Part sources and preview GLBs live under `tmp/npc-parts/<variant>/`; they are **not shipped
+assets** — only the assembled character GLBs, AO/maps, the manifest and the review sheets are
+committed.
+
+```bash
+# Build one part fresh from the current builders (head|face|hand_l|hand_r)
+flatpak run org.blender.Blender --background \
+  --python "$PWD/tools/npc_parts.py" -- build --part face --variant npc_casual \
+  --out "$PWD/tmp/npc-parts/npc_casual/face.glb"
+# Pull the current shipped head/hands out of the built character GLB (comparison)
+flatpak run org.blender.Blender --background \
+  --python "$PWD/tools/npc_parts.py" -- extract --part hand_l --variant npc_casual \
+  --out "$PWD/tmp/npc-parts/npc_casual/hand_l.glb"
+# Assemble a variant (currently rebuilds the procedural character)
+flatpak run org.blender.Blender --background \
+  --python "$PWD/tools/npc_parts.py" -- assemble --variant npc_casual \
+  --out "$PWD/tmp/npc-parts/npc_casual/assembled.glb"
+# Inspect a part or assembled GLB (Blender import view)
+flatpak run org.blender.Blender --background \
+  --python "$PWD/tools/npc_parts.py" -- inspect --file "$PWD/tmp/npc-parts/npc_casual/face.glb"
+# Contact sheet / before-after comparison (outside Blender; stdlib + Pillow)
+python3 tools/npc_parts.py sheet --dir tmp/npc-parts/npc_casual \
+  --out docs/blender_previews/sheet_parts.jpg
+python3 tools/npc_parts.py compare --before DIR --after DIR --out sheet.jpg
+```
+
+`build --part head` produces the bare head shell; `build --part face` is the shell plus
+nose/eyes/mouth/ears; `build --part hand_l|hand_r` are the left/right hand geometry. `extract`
+pulls the current shipped geometry out of the built character GLB by vertex group (`Head` for
+`head`/`face`, `HandL`/`HandR` for the hands), so it shows what is actually shipped rather than
+what the builders would emit fresh. The assembled GLB must still pass
+`blender_assets.py inspect`/`audit`/`fit` before any part is accepted.
+
+## Optional MCP
+
+Blender MCP can be used for interactive head/face/hand part exploration, but it
+is not required. The headless commands below remain the build and audit path;
+see [`asset-tooling.md#optional-interactive-blender-mcp`](asset-tooling.md#optional-interactive-blender-mcp) for installation, connection and safety.
+
 ## Running it

 ```bash
@@ -47,7 +101,11 @@ flatpak run org.blender.Blender --background \
 python3 tools/blender_assets.py sheet   # -> docs/blender_previews/sheet_<category>.jpg
 python3 tools/blender_assets.py audit   # stdlib only; exit 1 on any issue
 python3 tools/blender_assets.py fit     # head/clothing fit + bag-body clearance, per character
+python3 tools/blender_assets.py texels  # 256² slot-map density (authored + 4× fabric), per character
 python3 tools/blender_assets.py list
+# import a GLB, apply node transforms, report geometry/bones/UVs/skinning + contract failures
+flatpak run org.blender.Blender --background \
+  --python "$PWD/tools/blender_assets.py" -- inspect --file "$PWD/tmp/downloads/x.glb"
 godot --headless --path . --import      # after any rebuild
 ```

@@ -81,35 +139,10 @@ render about 2.5 min.

 ## Characters

-All eight use the `npc_base` contract, so each one can replace
-`npc_base.glb` without code changes:
-
- mesh node `npc_base` under an armature that imports as `Skeleton3D`
- bones `Head`, `HipL/R`, `KneeL/R`, `ShoulderL/R`, `ElbowL/R`, `HandL/R`
-  (plus `Hips`, `Spine`, `Neck`) at the **same rest positions as `npc_base`**.
-  `test_character_joints_line_up_with_npc_base` checks this within 1 cm, so the
-  animation proxies in `_build_skinned_body()` stay valid.
- material slots `skin`, `cloth`, `pants`, `accessory`, `hair` carry the same
-  neutral `assets/textures/npc/<slot>_{albedo,normal}.png` maps at 256², so
-  `Materials.npc_slot()` tints them the same way it tints `npc_base`. Cloth and
-  pants repeat the weave 4× (`NPC_FABRIC_UV_SCALE`) and intentionally skip the
-  per-character baked AO; skin, hair and fixed gear keep it.
- budget ≤ **8,000 triangles and ≤ 8,000 glTF vertices** for the eight library
-  variants (vertex count after seam splits; `CHAR_MAX_TRIS`/`CHAR_MAX_VERTS` in
-  `tools/blender_assets.py`, raised from 6,000/5,000 on 2026-11-02). The frozen
-  `npc_base` fallback keeps its original 6,000/4,000 contract. The current range
-  is 4,482–5,474 triangles and 4,260–5,494 vertices, leaving room for the
-  remaining grip and clothing detail.
-
-Construction: the torso and limbs are one continuous Skin-modifier mesh,
-subdivided twice, decimated to 26 % with X symmetry, and cut at the waist, cuffs,
-sleeves and neck so the material borders are clean edge loops. The head is a
-separate part carrying the face detail: brow ridge, sclera/iris/upper-lid per eye,
-cheekbones, a nose with a bridge and tip, ears with lobes, and upper and lower
-lips. Hands have four fingers plus a thumb; sleeves end in a cuff ring.
-Hair, shoes and clothing layers are separate parts. Weights come from distance to
-the bone segments, limited by body region. Parts that should stay rigid (head,
-hands, shoes) get a single bone.
+All library variants share the [character and gear asset contract](architecture.md#character-and-gear-asset-contract):
+`npc_base` mesh node, required 13 core bones (optional extras allowed), five
+tint slots, +Z visual front, 16,000/16,000 character budget and the same 256²
+slot-map/AO rules. Role selection and look notes:

 | Character | `layer_for()` / look | Suggested roles | Preview gear |
 | --- | --- | --- | --- |
@@ -136,22 +169,8 @@ the role's `TYPE_COLORS`.

 ## Gear attach points

-Gear is authored in attach-point space, so the origin of each GLB is its
-attach point:
-
-| Attach | Godot parent / position | Gear |
-| --- | --- | --- |
-| `head` | `Rig/Head` marker (0, 1.62, 0) | cap, beanie, hood, sunglasses, firefighter_helmet |
-| `back` | `Rig` at (0, 1.10, 0), spine centre; items sit behind the body (Blender +Y = Godot −Z) | backpack, shoulder_bag, scba_tank |
-| `chest` | `Rig` at (0, 1.30, 0), sternum | lanyard |
-| `hand` | Hand proxy (±0.27, 0.78, 0.02); grip 5 cm below the origin | phone, cup, clipboard, umbrella, camera, protest_sign, flashlight, wand, radio |
-
-The character previews in `sheet_npc.jpg` are built by importing the gear at
-exactly these points, which gives a quick visual check of the convention.
-`NpcAvatar.GEAR_OFFSETS` applies two final-context nudges after attachment:
-the lanyard moves 4 cm forward so its badge clears the jacket, and the
-firefighter helmet moves 3 cm up so its brim sits above the eyes. The
-`fit` report remains an asset-space measurement of the untouched GLBs.
+Gear is authored in attach-point space; the exact contract and runtime fit offsets are in
+[`architecture.md#character-and-gear-asset-contract`](architecture.md#character-and-gear-asset-contract).

 ## Props

@@ -181,16 +200,22 @@ carry baked AO and the shared neutral material maps described above.

 - `python3 tools/blender_assets.py audit`: container, `POSITION`/`NORMAL`/
  `TEXCOORD_0`, UVs in [0, 1], no zero-area triangles (Godot warns about them
-  during LOD generation), budgets (library characters 8000/8000, base fallback 6000/4000, gear 1500, props 4000
+  during LOD generation), budgets (characters 16000/16000, gear 1500, props 4000
  triangles), grounding, and an editable `.blend`. For characters it also
  checks skinning, bones, slots, the `npc_base` mesh node and the height.
- `tools/test_blender_assets.py`: catalogue and contract consistency with
-  `npc_pipeline.py`, plus a clean audit and full manifest coverage when the
-  library is built.
+- `tools/tests/test_blender_assets.py`: catalogue and contract consistency with
+  `npc_pipeline.py`, plus a clean audit, a texel-density gate (all five slots,
+  40–400 px/m authored, 250 px/m fabric floor) and full manifest coverage when
+  the library is built.
 - `src/test/tests/test_blender_assets.gd`: every asset imports as a scene
  with geometry, characters keep their bones and slots, joints match
  `npc_base`, the bones accept `NpcAvatar`'s pose composition, and props are
  grounded.
+- `tools/test_model_review.py`: every `CHARACTERS`/`GEAR`/`PROPS` entry has a
+  scorecard row and verdict in `docs/3d-model-review.md` (coverage gate).
+- `src/test/tests/test_world.gd`: every library prop that blocks walking has a
+  `StaticBody3D` + `NavigationObstacle3D`, checked against the catalogue
+  (collider/proxy gate).

 ## Known limitations

@@ -206,6 +231,8 @@ carry baked AO and the shared neutral material maps described above.
  stay neutral.
 - The 0.9.4 baseline found three P1 portrait issues. The tourist's photo prop
  now only appears in photo/film poses and the backpack straps were refit as
-  flattened chest bands; the face is still shallow/faceted at portrait range.
-  The full ranked list, measurements and before/after sheet are in
-  [`npc-visual-review.md`](npc-visual-review.md).
+  flattened chest bands. The face carries the 0.9.4 sculpt (socketed sclera,
+  chin/cheekbone, nose, lips) but its `seg=18/rings=12` head still reads
+  somewhat faceted at portrait range; a subdivision/deeper-sculpt prototype is
+  gated on the owner scorecard review. The full ranked list and measurements are
+  in [`npc-visual-review.md`](npc-visual-review.md).
@@ -1,69 +1,33 @@
-# Blender Previews
+# Blender previews

-Committed contact sheets and local Blender renders for the character, gear and prop library. Individual PNGs are development previews and are gitignored; the sheets are tracked.
+Committed contact sheets for the character, gear and prop library. Per-asset Cycles renders
+(`*.png`) are local development output and gitignored; the sheets below are the review artefacts
+and are built with `blender_assets.py render` + `sheet`, `npc_baseline.py sheet/compare`, or the
+capture harnesses.

-## Image previews
-
-| Preview | File |
+| Sheet | What it records |
 | --- | --- |
-| <img src="a_frame_sign.png" width="280" alt="a_frame_sign.png"> | [`a_frame_sign.png`](a_frame_sign.png) |
-| <img src="backpack.png" width="280" alt="backpack.png"> | [`backpack.png`](backpack.png) |
-| <img src="beanie.png" width="280" alt="beanie.png"> | [`beanie.png`](beanie.png) |
-| <img src="bench.png" width="280" alt="bench.png"> | [`bench.png`](bench.png) |
-| <img src="bollard.png" width="280" alt="bollard.png"> | [`bollard.png`](bollard.png) |
-| <img src="camera.png" width="280" alt="camera.png"> | [`camera.png`](camera.png) |
-| <img src="cap.png" width="280" alt="cap.png"> | [`cap.png`](cap.png) |
-| <img src="clipboard.png" width="280" alt="clipboard.png"> | [`clipboard.png`](clipboard.png) |
-| <img src="crowd_barrier.png" width="280" alt="crowd_barrier.png"> | [`crowd_barrier.png`](crowd_barrier.png) |
-| <img src="cup.png" width="280" alt="cup.png"> | [`cup.png`](cup.png) |
-| <img src="double_door.png" width="280" alt="double_door.png"> | [`double_door.png`](double_door.png) |
-| <img src="fire_hydrant.png" width="280" alt="fire_hydrant.png"> | [`fire_hydrant.png`](fire_hydrant.png) |
-| <img src="firefighter_helmet.png" width="280" alt="firefighter_helmet.png"> | [`firefighter_helmet.png`](firefighter_helmet.png) |
-| <img src="flashlight.png" width="280" alt="flashlight.png"> | [`flashlight.png`](flashlight.png) |
-| <img src="handrail.png" width="280" alt="handrail.png"> | [`handrail.png`](handrail.png) |
-| <img src="hood.png" width="280" alt="hood.png"> | [`hood.png`](hood.png) |
-| <img src="lanyard.png" width="280" alt="lanyard.png"> | [`lanyard.png`](lanyard.png) |
-| <img src="marquee.png" width="280" alt="marquee.png"> | [`marquee.png`](marquee.png) |
-| <img src="newspaper_box.png" width="280" alt="newspaper_box.png"> | [`newspaper_box.png`](newspaper_box.png) |
-| <img src="npc_casual.png" width="280" alt="npc_casual.png"> | [`npc_casual.png`](npc_casual.png) |
-| <img src="npc_coat.png" width="280" alt="npc_coat.png"> | [`npc_coat.png`](npc_coat.png) |
-| <img src="npc_dress.png" width="280" alt="npc_dress.png"> | [`npc_dress.png`](npc_dress.png) |
-| <img src="npc_firefighter.png" width="280" alt="npc_firefighter.png"> | [`npc_firefighter.png`](npc_firefighter.png) |
-| <img src="npc_guard.png" width="280" alt="npc_guard.png"> | [`npc_guard.png`](npc_guard.png) |
-| <img src="npc_hoodie.png" width="280" alt="npc_hoodie.png"> | [`npc_hoodie.png`](npc_hoodie.png) |
-| <img src="npc_jacket.png" width="280" alt="npc_jacket.png"> | [`npc_jacket.png`](npc_jacket.png) |
-| <img src="npc_vest.png" width="280" alt="npc_vest.png"> | [`npc_vest.png`](npc_vest.png) |
-| <img src="palm_tree.png" width="280" alt="palm_tree.png"> | [`palm_tree.png`](palm_tree.png) |
-| <img src="phone.png" width="280" alt="phone.png"> | [`phone.png`](phone.png) |
-| <img src="planter_box.png" width="280" alt="planter_box.png"> | [`planter_box.png`](planter_box.png) |
-| <img src="protest_sign.png" width="280" alt="protest_sign.png"> | [`protest_sign.png`](protest_sign.png) |
-| <img src="radio.png" width="280" alt="radio.png"> | [`radio.png`](radio.png) |
-| <img src="round_planter.png" width="280" alt="round_planter.png"> | [`round_planter.png`](round_planter.png) |
-| <img src="scba_tank.png" width="280" alt="scba_tank.png"> | [`scba_tank.png`](scba_tank.png) |
-| <img src="security_podium.png" width="280" alt="security_podium.png"> | [`security_podium.png`](security_podium.png) |
-| <img src="sedan.png" width="280" alt="sedan.png"> | [`sedan.png`](sedan.png) |
-| <img src="sheet_npc.jpg" width="280" alt="sheet_npc.jpg"> | [`sheet_npc.jpg`](sheet_npc.jpg) |
-| <img src="sheet_npc_baseline.jpg" width="280" alt="sheet_npc_baseline.jpg"> | [`sheet_npc_baseline.jpg`](sheet_npc_baseline.jpg) |
-| <img src="sheet_npc_baseline_compare-p1.jpg" width="280" alt="sheet_npc_baseline_compare-p1.jpg"> | [`sheet_npc_baseline_compare-p1.jpg`](sheet_npc_baseline_compare-p1.jpg) |
-| <img src="sheet_npc_baseline_compare-body.jpg" width="280" alt="sheet_npc_baseline_compare-body.jpg"> | [`sheet_npc_baseline_compare-body.jpg`](sheet_npc_baseline_compare-body.jpg) |
-| <img src="sheet_npc_baseline_compare-face.jpg" width="280" alt="sheet_npc_baseline_compare-face.jpg"> | [`sheet_npc_baseline_compare-face.jpg`](sheet_npc_baseline_compare-face.jpg) |
-| <img src="sheet_npc_baseline_compare-torso.jpg" width="280" alt="sheet_npc_baseline_compare-torso.jpg"> | [`sheet_npc_baseline_compare-torso.jpg`](sheet_npc_baseline_compare-torso.jpg) |
-| <img src="sheet_npc_baseline_compare-face-detail.jpg" width="280" alt="sheet_npc_baseline_compare-face-detail.jpg"> | [`sheet_npc_baseline_compare-face-detail.jpg`](sheet_npc_baseline_compare-face-detail.jpg) |
-| <img src="sheet_npc_hands_compare.jpg" width="280" alt="sheet_npc_hands_compare.jpg"> | [`sheet_npc_hands_compare.jpg`](sheet_npc_hands_compare.jpg) |
-| <img src="sheet_npc_hands_grip_compare.jpg" width="280" alt="sheet_npc_hands_grip_compare.jpg"> | [`sheet_npc_hands_grip_compare.jpg`](sheet_npc_hands_grip_compare.jpg) |
-| <img src="sheet_npc_baseline_compare-shoes.jpg" width="280" alt="sheet_npc_baseline_compare-shoes.jpg"> | [`sheet_npc_baseline_compare-shoes.jpg`](sheet_npc_baseline_compare-shoes.jpg) |
-| <img src="sheet_npc_baseline_compare-tex256.jpg" width="280" alt="sheet_npc_baseline_compare-tex256.jpg"> | [`sheet_npc_baseline_compare-tex256.jpg`](sheet_npc_baseline_compare-tex256.jpg) |
-| <img src="sheet_npc_baseline_compare-texuv.jpg" width="280" alt="sheet_npc_baseline_compare-texuv.jpg"> | [`sheet_npc_baseline_compare-texuv.jpg`](sheet_npc_baseline_compare-texuv.jpg) |
-| <img src="sheet_texture_refinement_0.9.5.jpg" width="280" alt="sheet_texture_refinement_0.9.5.jpg"> | [`sheet_texture_refinement_0.9.5.jpg`](sheet_texture_refinement_0.9.5.jpg) |
-| <img src="sheet_npc_gear.jpg" width="280" alt="sheet_npc_gear.jpg"> | [`sheet_npc_gear.jpg`](sheet_npc_gear.jpg) |
-| <img src="sheet_props.jpg" width="280" alt="sheet_props.jpg"> | [`sheet_props.jpg`](sheet_props.jpg) |
-| <img src="shoulder_bag.png" width="280" alt="shoulder_bag.png"> | [`shoulder_bag.png`](shoulder_bag.png) |
-| <img src="stanchion.png" width="280" alt="stanchion.png"> | [`stanchion.png`](stanchion.png) |
-| <img src="street_lamp.png" width="280" alt="street_lamp.png"> | [`street_lamp.png`](street_lamp.png) |
-| <img src="street_tree.png" width="280" alt="street_tree.png"> | [`street_tree.png`](street_tree.png) |
-| <img src="sunglasses.png" width="280" alt="sunglasses.png"> | [`sunglasses.png`](sunglasses.png) |
-| <img src="traffic_cone.png" width="280" alt="traffic_cone.png"> | [`traffic_cone.png`](traffic_cone.png) |
-| <img src="trash_bin.png" width="280" alt="trash_bin.png"> | [`trash_bin.png`](trash_bin.png) |
-| <img src="umbrella.png" width="280" alt="umbrella.png"> | [`umbrella.png`](umbrella.png) |
-| <img src="wall_lantern.png" width="280" alt="wall_lantern.png"> | [`wall_lantern.png`](wall_lantern.png) |
-| <img src="wand.png" width="280" alt="wand.png"> | [`wand.png`](wand.png) |
+| [![sheet_npc.jpg](sheet_npc.jpg)](sheet_npc.jpg) <br> `sheet_npc.jpg` | Eight skinned character variants (casual, jacket, coat, hi-vis vest, dress, hoodie, firefighter, guard) with their gear attach points. |
+| [![sheet_npc_baseline.jpg](sheet_npc_baseline.jpg)](sheet_npc_baseline.jpg) <br> `sheet_npc_baseline.jpg` | Neutral studio baseline: 8 characters x front, three-quarter, profile, back, full body and crowd views. |
+| [![sheet_makehuman_head.jpg](sheet_makehuman_head.jpg)](sheet_makehuman_head.jpg) <br> `sheet_makehuman_head.jpg` | MakeHuman head: front, three-quarter and profile review views. The owner accepted the basic head; the automated vision gate still rejects the eye/lid region as deferred polish. See [`../makehuman-head-review.md`](../makehuman-head-review.md). |
+| [![sheet_npc_baseline_compare-body.jpg](sheet_npc_baseline_compare-body.jpg)](sheet_npc_baseline_compare-body.jpg) <br> `sheet_npc_baseline_compare-body.jpg` | Neck/shoulder transition: fuller neck base and a lower shoulder root. |
+| [![sheet_npc_baseline_compare-face-detail.jpg](sheet_npc_baseline_compare-face-detail.jpg)](sheet_npc_baseline_compare-face-detail.jpg) <br> `sheet_npc_baseline_compare-face-detail.jpg` | Face detail: nose ala wings, a single rounded mouth and a darker ear concha. |
+| [![sheet_npc_baseline_compare-face.jpg](sheet_npc_baseline_compare-face.jpg)](sheet_npc_baseline_compare-face.jpg) <br> `sheet_npc_baseline_compare-face.jpg` | Face-depth pass: recessed sclera, upper lid and sculpted chin/cheek planes. |
+| [![sheet_npc_baseline_compare-p1.jpg](sheet_npc_baseline_compare-p1.jpg)](sheet_npc_baseline_compare-p1.jpg) <br> `sheet_npc_baseline_compare-p1.jpg` | 0.9.4 P1 pass: tourist photo-prop visibility and the refit backpack straps. |
+| [![sheet_npc_baseline_compare-shoes.jpg](sheet_npc_baseline_compare-shoes.jpg)](sheet_npc_baseline_compare-shoes.jpg) <br> `sheet_npc_baseline_compare-shoes.jpg` | Footwear: rounded toe/heel caps on shoes and responder boots. |
+| [![sheet_npc_baseline_compare-tex256.jpg](sheet_npc_baseline_compare-tex256.jpg)](sheet_npc_baseline_compare-tex256.jpg) <br> `sheet_npc_baseline_compare-tex256.jpg` | 128 -> 256 px NPC slot maps on the same camera. |
+| [![sheet_npc_baseline_compare-texuv.jpg](sheet_npc_baseline_compare-texuv.jpg)](sheet_npc_baseline_compare-texuv.jpg) <br> `sheet_npc_baseline_compare-texuv.jpg` | 4x fabric weave with the baked per-character AO removed. |
+| [![sheet_npc_baseline_compare-torso.jpg](sheet_npc_baseline_compare-torso.jpg)](sheet_npc_baseline_compare-torso.jpg) <br> `sheet_npc_baseline_compare-torso.jpg` | Torso/hip taper without changing the skeleton or build multipliers. |
+| [![sheet_npc_crowd_prototypes.jpg](sheet_npc_crowd_prototypes.jpg)](sheet_npc_crowd_prototypes.jpg) <br> `sheet_npc_crowd_prototypes.jpg` | Four approved crowd-variety looks queued for the 12-character roster. |
+| [![sheet_npc_gear.jpg](sheet_npc_gear.jpg)](sheet_npc_gear.jpg) <br> `sheet_npc_gear.jpg` | Eighteen gear pieces authored in attach space: caps, hood, helmet, bags, tanks, lanyards and handheld items. |
+| [![sheet_npc_hands_compare.jpg](sheet_npc_hands_compare.jpg)](sheet_npc_hands_compare.jpg) <br> `sheet_npc_hands_compare.jpg` | Hand pass: wider palms, segmented fingers and a separate thumb. |
+| [![sheet_npc_hands_grip_compare.jpg](sheet_npc_hands_grip_compare.jpg)](sheet_npc_hands_grip_compare.jpg) <br> `sheet_npc_hands_grip_compare.jpg` | Grip pass: the forward hand-item offset that puts props in the palm. |
+| [![sheet_head_proto_before_after.jpg](sheet_head_proto_before_after.jpg)](sheet_head_proto_before_after.jpg) <br> `sheet_head_proto_before_after.jpg` | Head overhaul sign-off: current `_face` vs the s48 connected-shell prototype at 1.85 m front/three-quarter/profile. |
+| [![sheet_npc_sources_research.jpg](sheet_npc_sources_research.jpg)](sheet_npc_sources_research.jpg) <br> `sheet_npc_sources_research.jpg` | External character-source evaluation (CC0/CC-BY) for the roster research. |
+| [![sheet_props.jpg](sheet_props.jpg)](sheet_props.jpg) <br> `sheet_props.jpg` | Twenty street and venue props with baked maps, ground contact and collider footprints. |
+| [![sheet_texture_refinement_0.9.5.jpg](sheet_texture_refinement_0.9.5.jpg)](sheet_texture_refinement_0.9.5.jpg) <br> `sheet_texture_refinement_0.9.5.jpg` | 0.9.5 texture refinement before/after: pavers, awning stripes and NPC fabric. |
+
+The acceptance criteria for these sheets are in [`../npc-visual-review.md`](../npc-visual-review.md),
+the measurements in [`../npc-visual-review.md#proportion-audit`](../npc-visual-review.md#proportion-audit) and
+[`../3d-model-review.md`](../3d-model-review.md), and the asset contract in
+[`../blender-assets.md`](../blender-assets.md).
@@ -1,83 +1,46 @@
 # Development Status

-Implemented so far:
+Baseline: **v0.9.8** (2026-11-04). This page lists what the build currently
+supports and what remains; it is not a release history. Completed work lives in
+[`DONE.md`](../DONE.md), user-facing changes in [`CHANGELOG.md`](../CHANGELOG.md),
+and the active order/gaps in [`TODO.md`](../TODO.md).

- Godot 4.7.2 project scaffold, input map, procedural world builder (CI/local/release unified)
- Venue-driven simulation core: `ShiftCoordinator`, `VenueScenario`, `EventScheduler`, `NPCController` + FSM, `AccessVerifier`, `EscalationManager`, `RadioSystem`, `IncidentRecorder`, `ReputationEvaluator`, `CrowdSystem`
- Three authored scenarios (El Capitan Entertainment Centre / Hollywood Boulevard, The Joke Shop, Late Night TV Studio) with access policies, NPC archetypes, and event pools
- Headless unit tests: **263 passing** (access rules and venue-correct access loadout, escalation, radio cooldown/battery, NPC reaction determinism, door lock, flashlight perception, persistence round-trip, settings round-trip, input remaps, navmesh, step colliders, skyline alpha, scenario data, full-shift simulation, wand screening, responder dispatch, localization strings, focus cone, action wheel, session shell, PLAN verbs and incident recording, crowd presentation, emergency aftermath, body-camera timeline, NPC theater poses, audio, accessibility, authored scenario content, string formatting, `.tres` venue round-trip, surface materials and environment, focus ranking and outfit/gait helpers, generated prop models, web export preset, prop atlas material, player movement, NPC character layers/LOD/queue, input bindings)
- Simulation extras: protester archetype, CALL_SOMEONE reaction, door lock/secure mechanic (visual indicator), flashlight with night perception bonus, LATE shift phase reaching the violent-threat event
- First-person prototype with interaction HUD, access inspection, wand screening, radio report form (incl. emergency hold-to-confirm), dispatched responder avatars, aim-free targeting, venue cycling between all three scenarios, color-coded escalation feedback, procedural audio cues, navigation-mesh NPC paths, JSON-backed localized strings, persisted shift history, debug overlay, and shift review
- Control pass: focus cone on NPC heads with a billboarded blue circle in front of the face and name, action wheel (LMB/Space) with de-escalation-first slices, mouse-look freeze while a panel is open, acceleration-based walking, and named input actions (`action_menu`, `confirm`, `cancel`, `inspect`, `wand`)
- Session shell: venue start menu (keyboard + mouse), Esc pause overlay (resume / restart / settings / quit to menu), settings panel with mouse-look sensitivity and HUD font scale persisted to `user://settings.json`, and "Run another shift" returning to the venue menu
- World presentation: skyline backdrop rendered with an alpha material, walkable step and landing colliders, larger marquee text, and larger focus circle / name tag
- Routine traffic despawns after a while at its waypoint so the crowd cap no longer fills with idle standers
- PLAN verbs: eye contact (distinct Level 1 cue), recognizing a person as a player decision recorded as access evidence, a body-camera flag that a formal warning arms (and `B` toggles), blocking that physically stations the guard between the person and the door, and a Level 3 request-reason ask answered from the NPC's `dialogue_lines`
- Incidents are now actually opened on focus and closed at shift end, so player actions, access evidence, escalation levels, and unresolved interactions reach the review (previously every recorded event was dropped)
- Crowd presentation: aggressive behavior and responder arrivals make idle bystanders stop and face the incident; panic sends people away from the door (and they leave the scene). A busy 16-NPC entrance measured ~1.2 ms/frame, so no LOD/culling was needed at the current cap
- Distant skyline ring: four alpha-scissored planes at 200 m read as a hazy city on the horizon (the baked backdrop used to show as a black slab), with a larger ground plane so the buildings meet the street
- Flashlight aims straight ahead and lights the person/door being checked instead of the ground in front of the guard
- Emergency aftermath: the `evacuation` outcome locks the door and clears the entrance, an emergency call that the situation did not justify opens an investigation and applies the false-report hit, and the shift review names the responder outcome and any investigations
- Body-camera timeline: the shift review opens a text timeline of every recorded incident event (time, person, action/outcome) that you step through with the arrow keys or buttons. No live 3D replay yet
- NPC theater: seated guests sit on the steps with bent legs, influencers and tourists raise a camera prop while photographing, performers sway their sign, and filming visitors pan slowly — all once they reach their intent's waypoint
- Audio: a looping procedural crowd bed (filtered murmur) whose volume follows `CrowdSystem.mood`, plus radio open/close crackle. All generated at runtime, no audio assets, and safe with a dummy audio server
- Accessibility: the escalation cue shows a shape meter plus the numeric level (`Escalation: Blocking [###--] L3/5`) so it reads in grayscale, and the HUD font scale from settings is applied at boot by resizing fonts (not Control.scale, which broke the right-aligned layout)
- Editor-ready venues: `tools/export_venues.gd` writes `content/venues/<id>.tres` from `ScenarioFactory`, and the `.tres` files load back with events, profiles, policy, phases, door lines, and locations intact (the factory stays the source of truth)
- Localization safety: `Strings.fmt` validates the placeholder count before formatting and fails safe (warns, returns the template) instead of raising an engine error, `Strings.placeholder_count` ignores `%%`, and `Strings.validate()` lints the table for trailing `%`, unsupported conversions, and mixed positional/sequential placeholders
- Authored scenario content: Joke Shop reservation-without-ID, borrowed/mismatched ID, a guest who refuses the wand screen, and a late arrival during a performance; Studio filming-boundary repeats and a celebrity arrival that draws a small crowd; Building events that point the player at the body camera and request-reason verbs
- Visual polish pass (v0.2.0): phase-based lighting (sun/sky/ambient per shift phase), street lamps with night-mode bulbs and omni lights, glowing marquee signage, crosswalk, planters and low-poly street trees, NPC height/brightness variety, denser routine traffic — day and late-night screenshot sets
- Assets pass: authored textures in `assets/textures/` (brick facade, concrete, asphalt, awning, skyline, vignette, HUD icons, access-card art) generated by `tools/generate_textures.py`, soft sun shadows, humanoid NPC rigs with archetype props + procedural walk bob and attention head-turn, inspection artifact cards, escalation vignette, mode icons, and a body-camera overlay (REC + shift clock)
- Rendering pass (v0.3.0 work, [ADR-0012](adr/0012-surface-materials-and-generated-props.md)): one material module with roughness/metallic profiles per surface, ACES tonemapping, glow, aerial fog and colour grading driven by the shift phase, correctly scaled brick, framed facade windows that light up at night, door trim and handles, a curb and lane dashes, and the glowing marquee/lamp bulbs. NPCs gained per-role clothing palettes, caps/hoods/backpacks/sunglasses/lanyards, hands and shoes, and an arm/leg walk swing
- NPC characters (v0.5.0): articulated limb rigs, layered outfits, hand items, face/hair variety, idle behaviour (phone, clipboard, crossed arms, look-around), escalation gestures, readable reaction symbols, door-queue offsets, and three LOD tiers with a billboard impostor
- Player movement (v0.5.0): separate acceleration/braking, step-up assist, head bob and landing dip (toggleable), precision-walk FOV/chip/tick, surface-aware footsteps, gamepad support, and persistent key/button remapping in settings
- Prop collision and placement (v0.4.0): every prop fits a static collider from its mesh bounds and publishes a navigation obstacle, so the guard and guests cannot walk through benches, bins, or bollards; placements are grouped into zones with a validator, and deterministic variants add rotation, scale, and small clutter
- Prop atlas (v0.3.1): `tools/model_pipeline.py` packs each prop's palette into one power-of-two colour atlas plus a metallic/roughness atlas and emits a single material with per-vertex UVs, so a prop is one draw material rather than one per part; `audit` enforces the contract
- Generated prop models (v0.3.0 work): `tools/model_pipeline.py` builds bollards, benches, bins, planters, newspaper boxes and a hydrant as `.glb` props with per-part materials, loaded by `WorldBuilder` with a procedural fallback; the optional AI concept step (`model_pipeline.py concept`) supplies per-prop colour palettes
- Environment pass (v0.6.0): 1024² brick/concrete/asphalt with derived tangent normal maps, 256² baked AO maps for every Blender character/gear/prop, and library props whose bulbs/LEDs/sign faces follow the day/night phase
- NPC characters + library (v0.6.0): `NpcAvatar` loads one of 8 Blender-authored skinned variants (role/seed selected) with five tintable material slots, `Rig/Head` focus anchor, and attach-point gear; `npc_base.glb` and the procedural rig remain fallbacks. `tools/blender_assets.py` builds/audits the character, gear, and 20-prop library; `WorldBuilder` loads the replacements and new street dressing (lamp, trees, palms, planters, barriers, podium, doors, marquee, sedan, handrail) with colliders, navigation obstacles, and phase-driven emissives
- Web build: `build/gig-line-web-<version>.zip` (Godot's non-threaded web template, no COOP/COEP headers needed) built by `tools/build_releases.sh` and published with the desktop artifacts; serve the unzipped folder from any static host
- Aim-free selection pass (v0.3.0 work, [ADR-0011](adr/0011-aim-free-selection-and-precision-walk.md)): the focus cone ranks candidates by angle then distance, `Tab` and the mouse wheel cycle nearby people nearest-first and pin the selection, right click clears focus with a short re-acquire grace, the HUD reports how many people are in the ring, and holding `Shift` walks at half speed for close work
+## Implemented

- Visual alignment: start/venue menu, pause, settings, shift review, radio, wand, inspection, timeline, HUD target chip/escalation bar, and radial menu now use or match their AI references in `assets/images/ui/`. The runtime art loader (`src/game/ui/art.gd`) falls back cleanly when a file is missing. The wand panel lists the guest's carried items, and multiline HUD/wand strings render real line breaks.
- NPC neck/shoulder transition (0.9.4 work): the body graph now uses a fuller neck base, a slightly tapered neck top and a lower shoulder root, giving the head/neck/shoulder line a trapezius slope instead of a thin post. The full character library was rebuilt with a final degenerate-face cleanup; the baseline comparison is `sheet_npc_baseline_compare-body.jpg`.
- NPC face-depth pass (0.9.4 work): sclera are recessed and capped by a thin upper lid, and the separate jaw/cheek spheres are replaced by a chin plate and cheekbones sculpted into the head mesh. The full library was rebuilt; the comparison is `sheet_npc_baseline_compare-face.jpg`.
- NPC torso/hip transition (0.9.4 work): the pelvis and chest are slightly wider than the waist, giving shirts and jackets a readable taper into the hips without changing the build multipliers or the skeleton. The comparison is `sheet_npc_baseline_compare-torso.jpg`.
- Integration checkpoint (0.9.6 work): the clean worktree at `f5b8ef2` rebuilt all five release packages and the Desktop HQ zip without ignored `tmp/`/`build/` content (Linux 161.5 MB, Windows 197.1 MB, macOS 148.0 MB, Web 97.8 MB, HQ 241.5 MB). The Web zip contains `index.html`, `index.wasm` and `index.pck`; the HQ zip contains `override.cfg` and launches headless with the Forward+ override. Current verification: Godot 263/263, Python 101/101, 14 smokes green, 24-NPC budget 6.90 ms / 168 meshes / 131,616 triangles, gallery 21 good / 0 bad, screen judge 21/21 match with 0 review/diff, and a pinned realism judge (`z-ai/glm-5.3-flash`, one pass per shot) at mean overall 2.1 and Pillow gap 0.291. No new gameplay or content changes.
- Release v0.9.5 (2026-11-02): the tagged commit `4bc6390` passed Gitea Actions run 922 (checks + full build) and published seven artifacts (Linux, Windows, macOS, NSIS setup, AppImage, Web and Desktop HQ). Release page: <https://git.allucanget.biz/zwitschi/security-game/releases/tag/v0.9.5>.
- Release v0.9.4 (2026-11-02): the tagged commit `a57b86c` passed the Gitea checks and full build and published seven artifacts (Linux, Windows, macOS, NSIS setup, AppImage, Web and Desktop HQ). Release page: <https://git.allucanget.biz/zwitschi/security-game/releases/tag/v0.9.4>.
- Environment texture pass (0.9.5 work): `capture_realism.gd` now has hidden-HUD `surfaces`/`surfaces_joke` close-up stages. The Walk of Fame band uses the paver texture as dark terrazzo, the neighbour awning keeps its cream stripe, and the skyline shader blends its lower 42 m toward a per-phase haze colour. Brick, asphalt, limestone and paver UV scales/profiles passed without replacement.
- Texture/prop audit (0.9.5 work): all 21 screen-art textures are 1280×720 and referenced; access cards are 256×128 and HUD icons 64×64. No oversized or unused runtime texture was found; the legacy root textures remain only as the texture-generator/asset-test fallback. The 24-NPC smoke now reports 168 meshes, 131,616 triangles and 6.94 ms (50 ms budget); compressed payload is 24.55 MB of surface picks, 22.67 MB of screen art and 0.48 MB of NPC maps.
- NPC texture pass (0.9.5 work): the NPC base and all eight library characters now use 256² albedo/normal/ORM maps instead of 128². Cloth and pants use `NPC_FABRIC_UV_SCALE` (4× weave) and skip the baked per-character AO, removing the large blotchy patches in portraits; skin, hair and gear keep baked AO. The base and eight GLBs plus AO maps were rebuilt; the 24-NPC smoke remains green.
- Texture visual verification (0.9.5 work): the nine-stage realism run used `z-ai/glm-5.3-flash` once per shot; mean `after` scores were overall 1.8, lighting 2.3, materials 1.8, texture detail 1.2, backdrop 2.0 and characters 1.2, with a Pillow metric gap of 0.306. The judge remains an optional review aid, not a CI gate. The committed before/after close-up sheet is [`blender_previews/sheet_texture_refinement_0.9.5.jpg`](blender_previews/sheet_texture_refinement_0.9.5.jpg); it records that the paver/Walk of Fame and NPC fabric repairs are visible, while asphalt, limestone and skyline picks held without a replacement. `tools/check_screenshots.sh` passed 21 good / 0 bad and the screen-design judge passed 21/21 match with 0 review.
- NPC visual optimization (0.9.4, complete 2026-11-02): all eight variants passed the portrait/readability, proportion, gear, foot/shoe, headgear and final-context gates. The library uses an 8,000-triangle / 8,000-glTF-vertex cap (up from 6,000/5,000; `npc_base` fallback remains 6,000/4,000); current characters measure 4,482–5,474 triangles and 4,260–5,494 vertices. The 48-frame baseline and 96-frame final-context review pass, the hand/gear offset and shoes are in, and the accepted stylized limits are documented in `npc-visual-review.md`.
- NPC face-detail pass (0.9.4 work): ala wings and a smaller nose bridge/tip, one rounded mouth slot, and a darker ear concha; all eight rebuilt. The comparison is `sheet_npc_baseline_compare-face-detail.jpg`.
- NPC headgear clearance (0.9.4 work): the 96-frame final-context review after the face-detail pass confirms the cap, firefighter helmet, hood and sunglasses clear the refined brow and eyes; no gear rebuild was needed.
- NPC footwear pass (0.9.4 work): casual shoes gained rounded toe and heel caps; responder/firefighter boots gained matching toe/heel volumes while retaining the black rubber boot language. All eight rebuilt; comparison `sheet_npc_baseline_compare-shoes.jpg`.
- NPC hand-item grip (0.9.4 work): runtime `HAND_ITEM_FORWARD` moves every hand gear 4 cm forward from the wrist proxy, so phone, cup, clipboard, camera, flashlight, wand and radio sit in the open palm instead of partly inside it. The open-hand/no-finger-rig limit is accepted for this stylized release; the comparison is `sheet_npc_hands_grip_compare.jpg`.
- NPC hand pass (0.9.4 work): wider, shallower palms; four two-segment bent fingers with rounded tips and a separate bent thumb; optional `--view=hand` capture at 0.80 m. The hand comparison is `sheet_npc_hands_compare.jpg`; the forward offset is in and the open-palm limit is accepted.
- NPC proportion audit (0.9.4 work): `tools/npc_proportions.py` measures all eight GLBs against a stylized height/head/shoulder/hip/torso/leg/arm/foot guide. All variants pass; the head and broad-build silhouettes are the nearest upper bounds. Results are in [`npc-proportion-audit.md`](npc-proportion-audit.md).
- NPC P1 portrait fixes (0.9.4 work): tourists now hide their photo-pose camera bag outside `photo`/`film` poses, removing the duplicate-backpack silhouette; the backpack gear was rebuilt with flattened, forward chest straps and a fresh AO map. The before/after sheet is [`blender_previews/sheet_npc_baseline_compare-p1.jpg`](blender_previews/sheet_npc_baseline_compare-p1.jpg); the remaining face/hand work was closed under the 0.9.4 acceptance limits.
- NPC visual baseline (0.9.4 work): `src/test/capture_npc_baseline.gd` captures all eight library characters from front, three-quarter, profile, back, full-body and crowd views in a neutral studio (48 frames). The criteria, measurements and ranked gaps are in [`npc-visual-review.md`](npc-visual-review.md); the committed sheet is [`blender_previews/sheet_npc_baseline.jpg`](blender_previews/sheet_npc_baseline.jpg). No model changes were made in this baseline step.
- UI-state capture pass (0.9.3 work): `src/test/capture_ui_states.gd` adds committed captures 14–21 for the start menu, pause, settings, shift review, emergency radio, action wheel, crowd panic and responder arrival. Every one of the 21 catalogue entries now has a current-build capture; `tools/check_screenshots.sh` reports 21 good / 0 bad and the automatic judge reports 21/21 match, 0 diff. Crowd panic and responder arrival are staged presentation frames, not gameplay changes.
- Realism adoption (post-v0.6.0): v2 per-phase skylines and surface tiles with normal maps, retuned sun/exposure/fog, wet asphalt, denser foliage, a visible additive flashlight beam, and refreshed staging captures. `tools/check_screenshots.sh` is the repeatable capture/compare gate; judge is clean of `diff` verdicts.
- Input/reliability fixes: selecting a venue releases the start-menu input lock and recaptures the mouse; the body-camera overlay no longer covers the shift status. Mouse look now reads at `_input`, restores capture on window focus/click-back, and the HUD is mouse-transparent. Normal radio reports submit on click; emergency calls still require the hold-to-confirm path.
- Production-quality pass (v0.9.0): mixer/accessibility settings, audio volume clamping, 24-NPC budget smoke, shortened coat/dress stride, and a unified Godot 4.7.2 CI/local support baseline with documented upgrade/rollback requirements.
- Campaign and first-hour pass (v0.8.0): campaign progression, checkpoint resume, difficulty presets, a searchable Help overlay, recovery events, contextual dialogue, policy/debrief lines and tutorial/replay/skip. Scripted QA bypasses the tutorial unless `--tutorial` is passed.
- Tutorial pass (0.8.0 work): the eight-beat first shift is wired through a non-blocking prompt overlay, a safe compliant visitor, real wheel/inspection/warning/radio panels, persisted completion/skip and a Settings replay action. Scripted tests/captures bypass it unless `--tutorial` is passed; `smoke_tutorial.gd` covers the full flow.
- Vision judge (v0.7.2): discovers the cheapest current OpenRouter image+JSON model, reports the model/fallbacks used, and clears the full screen-design judge (13/13 match, 0 diff).
- Desktop HQ (v0.7.1): optional Forward+ Windows/Linux zip with volumetric fog, SDFGI and a volumetric flashlight; the default Compatibility/Web builds and headless tests gate the effect off. A/B captures are generated locally under `docs/screens/realism/` (gitignored).
- Hollywood landmark map (map optimization): the default venue is now a stylized reconstruction of 6840 Hollywood Blvd (the 1921 Masonic Temple / El Capitan Entertainment Centre) with a six-column Ionic portico, eight stone steps, Masonic parapet motto and medallions, three red event banners, central and side entrances, the El Capitan Theatre and east retail neighbours, the Ovation Hollywood arcade opposite, the Walk of Fame terrazzo and a four-lane boulevard with red kerb paint. The facade uses the shared limestone/stone material; the whole venue measures **58,884 triangles across 409 meshes** in the map-budget test. The venue menu exposes separate **Day** and **Night** Hollywood rows; the night row resolves to the same scenario with a late-phase offset, so its whole shift stays after dark. Real-site references and the geometry mapping are in [`hollywood-boulevard-map.md`](hollywood-boulevard-map.md).
- Day/night scenery variants (map optimization): the Hollywood row in the venue menu is split into Day and Night entries, with localized names/blurbs. The night entry uses `ShiftCoordinator.phase_offset_s` to start a full-length shift in `LATE` while the clock still starts at 00:00; the scheduler reads the offset time so late-night routine traffic and the late violent-threat event still fire, and the offset round-trips through checkpoints. Three `LATE` routine events keep the night street populated. Local lights were retuned from constant falloff to linear attenuation so sconces pool instead of flooding the stone.
- Joke Shop / Sunset Strip map (map optimization): the second venue is now a stylized reconstruction of The Comedy Store block at 8433 Sunset Blvd, with a 27 m black hall, signature-covered sloping canopy, circular **THE JOKE SHOP** blade sign, red velvet curtain bays, a west-end entrance, cream and white low-rise neighbours, a dry hillside with stucco houses and palms behind the roofline, and a low retail/billboard frontage across Sunset. The same geometry serves day and late lighting through the phase system. Real-site references and limits are in [`joke-shop-map.md`](joke-shop-map.md); the map measures **22,680 triangles across 454 meshes** in the budget test.
- Venue geometry (v0.7.0, Joke Shop frontage superseded by the map-optimization pass): the TV Studio builds a stone facade, bulb canopy, glossy black car and barrier line. `WorldBuilder.VENUE_SPECS` drives facade/street/nav dimensions, and `GameManager` rebuilds only the world container when the venue changes.
- Gear fit (post-v0.6.0): Blender gear is measured against the avatar head/skirt silhouette and the checks run in both the Python tooling and the headless suite. Sunglasses, the shoulder bag and the firefighter helmet were fitted to the new faces; the Influencer portrait and gallery were recaptured with a before/after report.
- End-to-end interaction pass (0.9.3 work): `smoke_ui_flows.gd` drives inspection allow/deny, normal vs emergency radio, Help filtering, wand allow/deny and review return-to-menu in the real scene; campaign and timeline smokes cover review continue and timeline round-trips.
- Destructive-action pass (0.9.3 work): reset campaign and tutorial replay share a guarded confirmation dialog (one open instance, one emission, Cancel is inert); emergency send remains hold-to-confirm with no post-submit double-fire. Covered by session/radio tests and recorded in `docs/ui-copy.md`.
- Font/layout pass (0.9.3 work): HUD font scale was exercised at 0.75× and 1.75×; the target chip measures and caps scaled names, top labels clip, and shared action buttons ellipsize long 1.5–2× labels instead of overflowing. Covered by accessibility/button tests and recorded in `docs/ui-copy.md`.
- Modal-close pass (0.9.3 work): one top-modal close path handles Esc/right-click for every overlay, Settings opened from the menu restores the menu, Help no longer opens Pause behind it, and pointer/guard freeze state is recaptured after each close. The session smoke covers these paths.
- Keyboard/gamepad focus pass (0.9.3 work): `UiFocus` rings wrap through visible/enabled controls, hidden Continue and disabled timeline actions are skipped, each modal has a default focus, and A/B are bound to `ui_accept`/`ui_cancel` for pad-only navigation. Recorded in `docs/ui-copy.md`.
- Button-state pass (0.9.3 work): a shared `UiStyles` helper now gives every action button explicit normal, hover, pressed, focus and disabled styles; the timeline disables Previous/Next at its boundaries, while hidden continue states and the keyboard-only tutorial skip remain intentional. Recorded in `docs/ui-copy.md`.
- Dialogue pass (0.9.3 work): NPC reason answers now use the authored `reason` context, with an in-character answer for every shared archetype; Hollywood and Studio gained door-staff lines; radio cancellation, tutorial Ask terminology, help, start hints and campaign reset copy were clarified. Audit recorded in `docs/ui-copy.md`.
- Pre-build NPC review (2026-11-02): all eight library characters were staged at portrait, conversation and crowd distance on Hollywood and the Joke Shop, in day and night lighting, with the normal crowd hidden (`src/test/capture_npc_review.gd`). No P0 issues were found. Two P1 gear-fit issues were fixed with runtime attach offsets: the authorized-guest lanyard badge now clears the jacket and the firefighter helmet sits above the eyes. Backpack straps, caps, hands and the intentionally low-poly faces were accepted for the stylized target; close-range flashlight wash remains an optional-lighting follow-up. The 24-NPC budget stayed at 6.94 ms, the gallery passed 13 good / 0 bad and the screen-design judge stayed 13/13, and a clean portrait scored a 0.732 vision gap against the photoreal concept.
+| Area | Current capability |
+| --- | --- |
+| Core shift | Venue menu → 15-minute shift → events, incidents, review and campaign continuation. Pause/restart/settings/quit, checkpoint resume and campaign persistence are implemented. |
+| Venues | Hollywood Boulevard (Masonic Temple / El Capitan block), The Joke Shop (Sunset Strip stand-in), and the Late Night TV Studio (same El Capitan block, arrival staging). Day/Night is a phase offset on one map, not a second bake. |
+| NPCs | 12-character Blender library (8 variants + 4 crowd variants), five tint slots, 13 required core bones with optional extras, gear attach points, procedural fallback, LOD/impostor tier and a 24-NPC budget smoke. |
+| Interaction | Focus cone/aim-free cycling, action wheel, gestural deterrence, reason/recognize, inspection, wand screening, blocking, body camera, assistance/emergency radio, responder arrival and text timeline. |
+| Access and escalation | Six escalation levels, venue access policies, artifact validity/recognition, door lock, crowd reactions, investigation/false-report handling and shift review. |
+| UI/input | Keyboard/mouse and gamepad bindings, focus rings, default modal focus, single top-modal close path, shared button states, font scaling, long-string handling, searchable Help and 21 committed UI/game captures. |
+| Audio/accessibility | Procedural crowd bed and radio cues, master/SFX/ambience volumes, reduced motion, captions, colour-independent escalation cue, hold-to-confirm emergency and guarded destructive actions. |
+| Persistence | Separate settings, campaign, shift-history and versioned checkpoint files; default-filling migration, atomic writes and corrupt/partial-file fallback. Save locations and rollback are documented in [`getting-started.md`](getting-started.md#save-data-and-migration). |
+| Assets | Blender character/gear/prop library with AO and manifests; 256² NPC maps with 4× fabric weave; image/texture pipelines, reference boards and three-up boards; environment/realism capture tools. |
+| Build/release | Godot 4.7.2 Compatibility/Web default plus optional Forward+ Desktop HQ. Gitea checks/build/publish, seven release assets, checksums, preflight/rollback and clean-worktree release discipline. |

-Current gaps for the 0.x release line: deeper authored content/dialogue, animation and audio production, localization/accessibility expansion, 24-NPC/platform profiling, external playtesting, and signed/notarized release packaging. The full gap analysis and milestone plan live in [`TODO.md`](../TODO.md); the current architecture and documentation ownership map are in [`docs/architecture.md`](architecture.md).
+## Current verification baseline
+
+- Godot headless suite: **277 passing**
+- Python tooling tests: **162 passing**
+- Asset audits: `blender_assets.py audit` / `fit`, `npc_pipeline.py audit` and
+  `npc_proportions.py` pass for the committed library.
+- 24-NPC smoke: 168 meshes, 152,464 triangles, 6.94 ms (50 ms budget).
+- Screenshot gate: 21 good / 0 bad; screen-design judge 21/21 match.
+- Release baseline: v0.9.8 is published; the 0.10.0 release candidate remains
+  gated on external playtest, legal/storefront, signing and platform-matrix work.
+
+## Known gaps
+
+- External first-time-player sessions and balance sweeps are not completed.
+- The NPC head/face/hand overhaul and MakeHuman body pipeline are planned, not
+  shipped.
+- Accessibility/localization acceptance, target-hardware profiling, macOS
+  signing/notarization and AI/storefront legal approval remain open.
+- Live 3D replay, recorded VO/music, more venues and seasonal content are future
+  work.
+
+See [`TODO.md`](../TODO.md) for the ordered task list and
+[`known-limitations.md`](known-limitations.md) for the current release blockers.
+Architecture and ownership are in [`architecture.md`](architecture.md).
@@ -16,7 +16,7 @@ A typical shift lasts 10–15 minutes. The first-person camera stays at the game

 The game rewards calm resolutions rather than aggressive behavior. Emergency assistance and armed responders are rare last-resort systems with meaningful consequences.

-The first shift starts with an in-game tutorial covering movement/look, focus cycling, the action wheel, access inspection, polite direction, formal warning/body camera, radio and shift review. Its beat sheet is in [`tutorial.md`](tutorial.md). After that a short campaign runs Hollywood → Joke Shop → TV Studio; progress, difficulty and a pause-safe checkpoint are persisted locally. Help (from the venue menu) explains the controls and the current venue policy.
+The first shift starts with an in-game tutorial covering movement/look, focus cycling, the action wheel, access inspection, polite direction, formal warning/body camera, radio and shift review. See the tutorial section below. After that a short campaign runs Hollywood → Joke Shop → TV Studio; progress, difficulty and a pause-safe checkpoint are persisted locally. Help (from the venue menu) explains the controls and the current venue policy.

 ## Venues

@@ -24,22 +24,22 @@ The first shift starts with an in-game tutorial covering movement/look, focus cy

 The map is a stylized reconstruction of the real building and block; the
 reference notes and geometry mapping are in
-[`hollywood-boulevard-map.md`](hollywood-boulevard-map.md). The venue menu
+[`venues.md`](venues.md#hollywood-boulevard). The venue menu
 offers the same map as **Hollywood Boulevard — Day** and **Hollywood Boulevard
 — Night**; the night variant starts directly in the late phase instead of
 waiting for the shift clock.

-The original scenario places the guard at the top of the eight stone steps outside the historic Masonic Temple / El Capitan Entertainment Centre on Hollywood Boulevard. Tourists, street performers, influencers, confused visitors, intoxicated pedestrians, trespassers, people experiencing a mental-health crisis, and rare violent threats may approach the entrance.
+The original scenario — the starting point of the campaign — places the guard at the top of the eight stone steps outside the historic Masonic Temple / El Capitan Entertainment Centre on Hollywood Boulevard, the building that houses the *Jimmy Kimmel Live!* stage and studio. Tourists, street performers, influencers, confused visitors, intoxicated pedestrians, trespassers, people experiencing a mental-health crisis, and rare violent threats may approach the entrance.

 Authorized people must either be recognized by the guard or present a valid wristband. Wristbands can have different colors, patterns, dates, or event markings. They may be valid, expired, counterfeit, or missing.

 ### The Joke Shop

-The Joke Shop is a Sunset Strip comedy club inspired by the real Comedy Store at 8433 Sunset Blvd: a black hall under a deep signature-covered canopy, a circular blade sign, red velvet curtains, a west-end entrance, neighbouring low-rise frontage and a dry hillside of houses behind. The real-site mapping is in [`joke-shop-map.md`](joke-shop-map.md). The door person checks IDs, tickets, reservations, and guest-list status, then uses a handheld security wand according to venue policy. The player must interpret wand alerts rather than treating every alert as proof of a weapon; keys, belts, phones, and other harmless objects can trigger false alarms.
+The Joke Shop is a Sunset Strip comedy club inspired by the real Comedy Store at 8433 Sunset Blvd: a black hall under a deep signature-covered canopy, a circular blade sign, red velvet curtains, a west-end entrance, neighbouring low-rise frontage and a dry hillside of houses behind. The real-site mapping is in [`venues.md`](venues.md#the-joke-shop). The door person checks IDs, tickets, reservations, and guest-list status, then uses a handheld security wand according to venue policy. The player must interpret wand alerts rather than treating every alert as proof of a weapon; keys, belts, phones, and other harmless objects can trigger false alarms.

 ### Hollywood Boulevard Late Night TV Studio

-This scenario combines the previously defined NPC types with a busy television-studio entrance: a stone facade, a bulb-lit canopy, a glossy black car at the curb, and stanchions/barriers holding the arrival line. The player manages audience members, production staff, performers, guests, deliveries, celebrity arrivals, tourists, street performers, influencers, confused visitors, intoxicated pedestrians, trespassers, people experiencing a mental-health crisis, and rare violent threats.
+This scenario combines the previously defined NPC types with a busy television-studio entrance: the same El Capitan Entertainment Centre block as the Hollywood day shift, restaged as a late-night studio arrival — the stone facade and steps, a bulb-lit canopy, a glossy black car at the curb, and stanchions/barriers holding the arrival line. The player manages audience members, production staff, performers, guests, deliveries, celebrity arrivals, tourists, street performers, influencers, confused visitors, intoxicated pedestrians, trespassers, people experiencing a mental-health crisis, and rare violent threats.

 The studio uses wristbands, credentials, tickets, guest-list confirmation, and personal recognition to authorize entry. Crowd control, filming boundaries, following authorized guests through the door, and counterfeit credentials are key events.

@@ -68,3 +68,51 @@ An off-duty law-enforcement officer or armed emergency responder may arrive duri
 - **Crowd reaction:** Aggressive behavior, visible weapons, and emergency response can create panic or attract a crowd.
 - **Reputation:** Peaceful resolutions, accurate reports, low property damage, and justified calls improve performance; unnecessary confrontations and false reports reduce it.
 - **Shift review:** The player receives feedback on access decisions, escalation choices, public complaints, injuries, and security outcomes.
+
+## First-shift tutorial
+
+Status: implemented for v0.8.0. The tutorial teaches the real controls and the real
+inspection/wheel/radio panels; it is not a fake UI or a separate combat mode.
+Scripted test/capture runs bypass it unless `--tutorial` is passed; a windowed
+smoke covers completion, replay and skip.
+
+### Rules
+
+- One short, safe, compliant visitor. No emergency, threat, crowd panic or random
+  event can interrupt the tutorial.
+- Prompts advance on the performed action, not on a timer. The player can keep
+  moving/looking while a prompt is visible.
+- The tutorial is skippable at any point (F1). Completion and skip are both
+  persisted separately; a skipped tutorial can be replayed from Settings.
+- The tutorial state machine is independent of the shift FSM. It observes the
+  same actions as normal play and must be deterministic for tests.
+
+### Beat sheet
+
+| # | Beat | Prompt | Advances when | Notes |
+| --- | --- | --- | --- | --- |
+| 1 | Arrive | "Walk forward and look around. The entrance is behind you." | The guard has moved at least 1 m and looked away/returned | Start at the normal guard post, facing the street. |
+| 2 | Focus | "Look at the visitor. Press Tab or the mouse wheel to cycle targets." | A target is acquired and explicitly cycled | The visitor waits at the foot of the steps; no other guest is required. |
+| 3 | Wheel | "Open the action wheel with Space or left click." | The radial wheel opens on the visitor | The wheel is the real de-escalation-first wheel. |
+| 4 | Inspect | "Choose Inspect and read the access evidence." | The inspection panel is opened and the policy result is visible | Use a valid wristband so the tutorial can teach both evidence and a safe admit/deny decision. |
+| 5 | Direction | "Close the panel and give a polite direction." | A Level 1 polite-direction action is applied | The visitor complies; there is no escalation requirement. |
+| 6 | Warning | "Give a formal warning if the visitor persists. It arms the body camera." | A Level 2 warning is applied or the body camera is switched on | Show the REC overlay and the escalation cue. |
+| 7 | Radio | "Open the assistance radio and submit a short report." | The assistance report is submitted successfully | A non-emergency assistance call; no responder is required to resolve the tutorial. |
+| 8 | Review | "Finish the shift and review what happened." | The shift review opens | The tutorial ends; the real review remains available for inspection. |
+
+### Visitor script
+
+- Display name: `Visitor`.
+- Intent: `enter` (approaches the door, then waits for interaction).
+- Access: valid wristband evidence; the policy result should be unambiguous.
+- Behavior: compliant at every escalation level; never becomes a threat, never
+  joins a crowd and never triggers an emergency.
+- Failure handling: if the player denies admission incorrectly, the tutorial
+  explains the evidence but does not fail the run; the visitor remains safe and
+  the review records the decision.
+
+### Persistence and replay
+
+Settings gain `tutorial_completed` and `tutorial_skipped`. A first launch starts
+the tutorial after venue selection. Skipping sets `tutorial_skipped`; Settings/
+Help offers "Replay tutorial", which clears both flags for the next shift.
@@ -74,6 +74,26 @@ XDG_DATA_HOME=/tmp/gigline-campaign godot --path . --fixed-fps 60 --script res:/

 The unit test runner is the project's own lightweight harness (no editor plugin required) so CI can run it without the editor.

+## Save Data
+
+The game writes four JSON files in Godot's `user://` directory:
+
+| Platform | Location |
+| --- | --- |
+| Linux | `~/.local/share/godot/app_userdata/Gig Line/` |
+| Windows | `%APPDATA%\Godot\app_userdata\Gig Line\` |
+| macOS | `~/Library/Application Support/Godot/app_userdata/Gig Line/` |
+
+Files: `settings.json`, `campaign.json`, `shift_results.json` and the versioned
+`shift_state.json` checkpoint. The schema, migration/default-filling rules,
+atomic-write behavior and checkpoint contents are in
+[`architecture.md#persistence-and-save-contract`](architecture.md#persistence-and-save-contract).
+
+For a clean first launch, delete the four files (or the whole `Gig Line` user
+directory). Settings' **Reset campaign** clears campaign progress separately.
+To back up or move a profile, copy the files while the game is closed; restore
+them to roll back. Shift history is diagnostic and not required to resume.
+
 ## Controls

 Keyboard and mouse are the default; a gamepad works without configuration (left stick moves,
@@ -1,82 +0,0 @@
-# Hollywood Boulevard map reference
-
-The Hollywood venue is a stylized reconstruction of the real block around the
-El Capitan Entertainment Centre. It is a game space, not a survey-accurate
-model: the landmark silhouette, street wall and approach read from the player's
-eye height, while side streets and interiors are simplified.
-
-## Real site
-
- **Address:** 6840 Hollywood Boulevard, Hollywood, Los Angeles, CA 90028.
- **Coordinates:** 34.10118 N, 118.34009 W (OSM way `424024147`).
- **Building:** the 1921 Hollywood Masonic Temple, designed by John C. Austin in
-  the Classical Revival style; now the El Capitan Entertainment Centre and the
-  home of *Jimmy Kimmel Live!*.
- **Facade:** a light stone/render Neoclassical front with six oversized Ionic
-  columns, a recessed main entrance reached by eight stone steps, ornamental
-  iron door grilles, a continuous crosscut-grille transom, two street-level side
-  entrances, and a parapet with the Masonic motto and circular medallions.
- **Neighbours:** the El Capitan Theatre (6838) immediately west, a modern
-  retail block east, and the Ovation Hollywood frontage (6801) across the
-  four-lane boulevard.
- **Sidewalk:** the Hollywood Walk of Fame terrazzo strip with brass stars runs
-  along the kerb; the kerb is painted red in the reference photographs.
-
-## Game mapping
-
-| Real feature | In-game representation |
-| --- | --- |
-| 29.6 m wide, 14.5 m high facade | `VENUE_SPECS["hollywood_building"]`: `facade_width` 29.6, `facade_height` 14.5, front at `z = -4` |
-| Eight stone steps | `stair_count` 8, `stair_height` 0.10, `stair_tread` 0.38, 12 m wide |
-| Six Ionic columns | `IonicColonnade` at x = -12.4 … 12.4, 4.96 m bay spacing |
-| Recessed main entrance + two side doors | central 4.2 m door and 2.5 m side doors with transoms |
-| Red event banners | three stylized `EL / CAPITAN / LIVE` banners in the central bays |
-| Masonic motto + medallions | `FriezeInscription` label and two stone discs |
-| El Capitan Theatre | `NeighbourBlocks/ElCapitanTheatre` with marquee, blade sign and practical light |
-| Retail block east | `NeighbourBlocks/EastRetailBlock` with glazed shopfront |
-| Ovation Hollywood | `OvationHollywood` arcade with seven arched openings, sign and south sidewalk |
-| Walk of Fame | `WalkOfFame` dark terrazzo band with ten stars |
-| Four-lane boulevard | double-yellow centre, broken white lane lines, red kerb paint and crosswalk |
-
-The generated AI references live in
-[`docs/screens/concepts/hollywood_boulevard/`](screens/concepts/hollywood_boulevard/README.md).
-They are art direction for lighting, material scale and composition; they are
-not texture or geometry sources.
-
-## Deliberate simplifications
-
- Show branding is replaced by the venue-neutral `EL / CAPITAN / LIVE` banner
-  text. The building name and address are retained.
- The opposite Ovation frontage is represented as a single arcade block rather
-  than its full mall plan. Interiors, the Metro entrance and side streets are
-  out of playable bounds.
- The AI concept frames are 1280×720 references. The in-game geometry is built
-  from boxes, cylinders and a small number of custom arch/star meshes so it
-  stays inside the Compatibility/Web budget.
- The venue menu offers Day and Night Hollywood rows. Night is the same
-  geometry and scenario with a late-phase offset, not a second baked map; the
-  phase still drives sun, sky, fog, windows, signage and practical lights.
- The landmark facade uses the shared smooth limestone/stone texture rather
-  than the noisier granite panel tile. The whole venue measures **58,884
-  triangles across 409 meshes** in `test_hollywood_geometry_stays_inside_the_map_budget`,
-  well inside the 150k/600 budget.
- Local lights use linear attenuation (`omni_attenuation = 1.0`). Godot treats
-  `0.0` as constant falloff, which previously turned the night facade into a
-  flat yellow wall; the sconces now pool light instead.
-
-## References
-
- [Hollywood Masonic Temple — Wikipedia](https://en.wikipedia.org/wiki/Hollywood_Masonic_Temple)
- [El Capitan Entertainment Centre — OpenStreetMap way 424024147](https://www.openstreetmap.org/way/424024147)
- [El Capitan Theatre — OpenStreetMap way 424024148](https://www.openstreetmap.org/way/424024148)
- [Ovation Hollywood — OpenStreetMap way 151485232](https://www.openstreetmap.org/way/151485232)
- [Hollywood Masonic Temple facade — Wikimedia Commons](https://commons.wikimedia.org/wiki/File:El_Capitan_Theater_frontal_fachade-The_Masonic_Temple.jpg)
- [Hollywood Masonic Temple and El Capitan Theatre, 2013 — Wikimedia Commons](https://commons.wikimedia.org/wiki/File:Hollywood_Masonic_Temple_2013-10-13_10-02-25.jpg)
-
-## Verification
-
-```bash
-godot --headless --path . --script res://src/test/test_runner.gd
-godot --path . --script res://src/test/capture_realism.gd -- --out=/tmp/gig-line-hollywood --stages=day,evening,late
-python3 tools/check_docs.py
-```
@@ -1,95 +0,0 @@
-# The Joke Shop — Sunset Strip map notes
-
-The game's second venue is a fictional comedy club called **The Joke Shop**. Its
-block, canopy, blade sign, entrance and hillside are based on the real Comedy
-Store at **8433 Sunset Blvd, West Hollywood, CA 90069**.
-
-The club name and the game's guest stories are invented. The building is a
-stylized reconstruction, not a survey-accurate model: the playable frontage is
-27 m, while the real parcel is much deeper and contains several rooms that the
-game does not enter.
-
-## Real site
-
-| Item | Reference |
-| --- | --- |
-| Address | 8433 Sunset Blvd, West Hollywood, CA 90069, United States |
-| Real venue | The Comedy Store (comedy club and theatre) |
-| OpenStreetMap | Way [`428854155`](https://www.openstreetmap.org/way/428854155), centroid 34.095265, -118.373965 |
-| OSM tags | `amenity=theatre`, `building=commercial`, `height=12.2`, `start_date=1940`, `wikidata=Q3520350` |
-| Footprint | OSM polygon bounding box about **47.1 m × 41.2 m** across the club and rear parcels |
-| Street | Sunset Boulevard, a major east–west arterial on the Sunset Strip |
-| Setting | Dry Hollywood Hills directly behind the club, with houses and palms rising above the roofline |
-
-The building began as **Ciro's**, a 1940 nightclub; it became The Comedy Store
-in the early 1970s. Its street front is a low black hall under a deep,
-signature-covered canopy, with the circular blade sign above the roof, red
-curtains along the frontage and the main entrance set toward the west end. The
-hillside houses behind it are part of the silhouette from the sidewalk.
-
-## How the map maps to the real site
-
-| Real element | Game implementation |
-| --- | --- |
-| Low black comedy hall | 27 m × 12 m footprint, 8.4 m street wall; matte black concrete surface with a low plinth and parapet |
-| Deep overhanging canopy | 4.9 m sloped slab dropping about 1 m to the outer fascia; the fascia carries white signature lettering and the club name |
-| Signature-covered front | Two `Label3D` signature bands on the fascia plus a smaller wall panel, so the handwriting reads at gameplay distance without dozens of decals |
-| Circular blade sign | 3.9 m white disc with a black rim on a roof pole; `THE JOKE SHOP` lettering faces the street |
-| Red curtains | Four three-fold velvet bays with tiebacks between the entrance and the east end; a red velvet entrance curtain |
-| West-end entrance | Recessed opening at x = -8.8 m with a low step, brass pulls and the door-lock indicator |
-| Warm practicals | Sconces along the wall, canopy downlights, entrance wash and three ground uplights; all off in daylight and switched by `set_night_mode()` |
-| Neighbouring low-rise frontage | Cream Mediterranean block west (balconies, red awning) and white commercial block east (ribbon windows, lobby) |
-| Hillside and houses | Fog-free unshaded 60° ramp behind the rear wall with stucco houses, shrubs and palms; its tint drops to a dark silhouette at night |
-| Opposite side of Sunset | Low retail row, rooftop billboard, neon and palms as background context beyond the far kerb |
-| Sidewalk furniture | Palms, queue barriers, stanchions, bins, planters, a-frame sign, hydrant and a parked sedan; prop placements pass the shared validator |
-
-## Scene composition
-
- **Frontage:** 27 m wide, façade centre at z = -8.0, front face at z = -2.0.
- **Sidewalk:** 38 m wide × 14 m deep, meeting the kerb at z = 11.9.
- **Street:** 90 m × 24 m, with the four-lane markings reused from the
-  Hollywood block and a crosswalk in front of the entrance.
- **Playable area:** x = -15…15, z = -0.6…14.0. The guard starts on the west
-  side of the entrance at (-4.8, 0.1, 1.4), facing the approach.
- **Map budget:** the headless audit measures **22,680 triangles across 454
-  meshes**, well inside the 150k/700 test budget.
-
-The same geometry serves the day and late-night looks. There is no second baked
-map: the phase lighting, skyline/fog tint, lit windows and practicals change,
-just as with the Hollywood day/night rows.
-
-## Simplifications and limits
-
- The real club's rear rooms, basement and roof plant are not modelled; the
-  playable area is the street frontage only.
- The 47 m OSM footprint includes rear parcels and does not match the 27 m
-  street frontage; the game keeps the frontage proportions rather than the full
-  lot.
- Neighbouring businesses are represented by generic low-rise blocks. Their
-  exact names and current tenants were not verified, so the docs do not claim
-  them.
- The hillside is a background ramp with simplified houses, not a terrain
-  heightfield; it exists to restore the real silhouette above the roofline.
- Signage uses the fictional **The Joke Shop** name, not the real Comedy Store
-  wordmark.
- The concept frames are photoreal; the game keeps its stylized, low-poly
-  material treatment. The vision judge therefore still scores material and
-  foliage detail below the reference. The remaining texture/realism work is
-  tracked with the postponed 0.9.5 pass, not treated as a map-geometry defect.
-
-## References
-
- OpenStreetMap way 428854155: <https://www.openstreetmap.org/way/428854155>
- Wikimedia Commons photographs used for proportion and material study:
-  - <https://commons.wikimedia.org/wiki/File:ComedyStore_01.jpg>
-  - <https://commons.wikimedia.org/wiki/File:ComedyStore_02.jpg>
-  - <https://commons.wikimedia.org/wiki/File:The_Comedy_Store.jpg>
-  - <https://commons.wikimedia.org/wiki/File:The_Comedy_Store_West_Hollywood_(51017780551).jpg>
- AI art-direction frames: [`screens/concepts/joke_shop/`](screens/concepts/joke_shop/README.md)
- Verification: `godot --headless --path . --script res://src/test/test_runner.gd`
-  (`test_joke_shop_uses_the_real_sunset_strip_layout`,
-  `test_joke_shop_geometry_stays_inside_the_map_budget`), and
-  `godot --path . --script res://src/test/capture_realism.gd -- --stages=joke_shop_day,joke_shop`.
-  The committed gallery passed `tools/check_screenshots.sh` (13 good / 0 bad)
-  and the screen-design judge (13/13 match, 0 diff). The latest local realism
-  run reports a reference gap of 0.454 for the night entrance.
@@ -0,0 +1,48 @@
+# Known Limitations
+
+This page records the limitations that remain at the 0.10.0 release-candidate
+stage. Items marked **blocker** must be cleared or explicitly accepted before a
+public release.
+
+## Release blockers
+
+- **External playtest:** at least five first-time-player sessions and the
+  resulting onboarding/accessibility triage have not been completed. The
+  tutorial/campaign evidence is currently automated smoke coverage, not player
+  observation.
+- **AI asset provenance:** the image-generation provider terms and commercial
+  redistribution rights for the committed AI-assisted textures/UI art still need
+  legal review. See [`../CREDITS.md`](../CREDITS.md).
+- **Storefront/legal approval:** age/content rating, storefront policy, trademark
+  language and the mental-health-crisis/body-camera representation have not been
+  externally approved.
+- **macOS signing/notarization:** the 0.10.0 release candidate ships unsigned
+  with right-click/`xattr` quarantine instructions. Signing and notarization are
+  required before a broad public/storefront release and remain blocked until an
+  Apple Developer account and signing job exist.
+- **Hardware matrix:** Web, Windows and Desktop HQ have been built and checked
+  structurally; a complete target-hardware performance/launch matrix is still
+  pending.
+
+## Content and presentation
+
+- The venues are stylized reconstructions, not survey-accurate models. The Joke
+  Shop is a fictional stand-in for the real Sunset Strip block.
+- Character faces, hands and fabric use a deliberately low-poly style; the
+  >26 m tier remains a two-quad impostor and there is no separate finger-curl
+  rig. The accepted limits are recorded in
+  [`npc-visual-review.md`](npc-visual-review.md).
+- There is no live 3D body-camera replay; the timeline is text-based.
+- There is no recorded voice/music track. Ambience and cues are procedural.
+- The game is English-only and does not yet have a translator workflow or
+  pseudo-locale layout sign-off.
+
+## Persistence and platform
+
+- Save migration is covered by synthetic 0.8/0.9 fixtures and failure-mode tests,
+  not by a real player profile collected from every earlier release.
+- Desktop HQ requires a Vulkan-capable GPU/driver; the default Compatibility and
+  Web builds remain the broad target.
+- The manual smoke checklist is completed by developers; external device
+  coverage (Windows installer, macOS launch, gamepad and Web hosts) is not yet a
+  complete evidence set.
@@ -0,0 +1,139 @@
+# MakeHuman head prototype
+
+Status: **owner-accepted head, assembled prototype, not yet shipped.**
+The owner accepted the basic human head on 2026-11-04. The automated vision gate
+still records REJECT on the eye/lid region as deferred polish. The asset is a
+standalone head/neck extracted from the CC0 MakeHuman base in
+`tmp/npc-research/makehuman/base.obj`; the assembled path now adds hair, a hidden
+scalp trim and the procedural body. The 12 shipped GLBs have not been rebuilt
+with it yet.
+
+## Asset
+
+- GLB: [`assets/models/blender_src/makehuman_head.glb`](../assets/models/blender_src/makehuman_head.glb)
+- Review sheet: [`blender_previews/sheet_makehuman_head.jpg`](blender_previews/sheet_makehuman_head.jpg)
+- Source workflow (development-only): `tmp/npc-research/build_makehuman_head.py`
+  — extracts the MakeHuman head, cuts it at the neck, keeps the head/eye/mouth
+  components, cuts an almond aperture through a skin eyelid mask, adds recessed
+  eyeballs with flat iris/pupil discs, anchors brows to the face surface, renders
+  front/three-quarter/profile and exports the standalone GLB.
+- Measurements (final standalone build, `inspect`): **12,641 triangles / 7,690
+  split vertices**; bounds approximately `x ±0.094 m`, `y -0.180…0.042 m`,
+  `z 1.530…1.803 m` in project Z-up space.
+- Assembled `npc_casual --head mh`: **14,753 triangles / 12,823 seam-split
+  vertices / 14 bones / 9 materials**, `inspect` clean. All 12 variants count
+  14,693–15,987 triangles with the same head.
+- Materials used: `skin`, `eye_white`, `iris`, `pupil`, `hair`. No textures are
+  baked into this prototype.
+
+![MakeHuman head review sheet](blender_previews/sheet_makehuman_head.jpg)
+
+## What was done
+
+1. Imported the CC0 MakeHuman base OBJ and cleared the importer axis rotation.
+2. Applied the project scale/axis transform: 1.82 m body, Z-up, metres,
+   front −Y.
+3. Cut the head at the neck (`z ≈ 1.53`) rather than keeping the cut shoulders;
+   capped the neck opening.
+4. Built an eyelid mask by subtracting an almond aperture from a skin sphere
+   centred on each eye (`solver = "EXACT"`), then recessed the globes so the
+   cornea sits behind the lid plane.
+5. Added flat iris/pupil discs on the globe axis; disabled backface culling so
+   the discs stay visible at three-quarter angles.
+6. Anchored brow strips to the skin with object-space ray casts and added a
+   shallow supraorbital ridge so they do not float, then reduced the crown
+   height to improve the profile silhouette.
+7. Fixed a material-remap bug introduced by joining the extra eye objects: the
+   joined head faces were pointing at the `eye_white` slot, making the whole
+   head render as white clay. The largest connected component is now forced
+   back onto `skin` after the join.
+8. Rendered front/three-quarter/profile views in a neutral review studio and
+   exported the standalone GLB.
+
+## Provenance
+
+- Base mesh: MakeHuman / MPFB base, CC0, from the local research set
+  `tmp/npc-research/makehuman/`; see [`CREDITS.md`](../CREDITS.md).
+- The head is a **derived prototype**, not a shipped NPC. It does not enter
+  `assets/models/blender/npc/`, `npc_base`, the runtime `NpcAvatar` path, CI, or
+  a release package until the NPC overhaul plan accepts it.
+- Source photographs/proportions are not used as textures here; this is a
+  geometry-only head built from the researched model data.
+
+## Review criteria
+
+Accept only if:
+
+- the head reads as human at front/three-quarter/profile and the neck is a
+  clean head/bust silhouette, not a shoulder cut;
+- eyes, brow, nose, mouth and ears are readable without spikes, holes or
+  floating shells;
+- the asset is inside the character budget and has no script/contract violation;
+- the prototype remains clearly local and un-integrated until the part pipeline
+  is approved.
+
+## Judge result
+
+**Owner verdict: ACCEPT (basic human head, 2026-11-04).**
+**Automated vision gate: REJECT** (vision judge `z-ai/glm-5.3-flash`, final
+standalone build render set above). The eye/lid findings below remain deferred
+polish; they are no longer a rollout blocker because the owner accepted the head.
+
+Blocking findings:
+
+- **P0 — globe depth is inconsistent across views.** The front/three-quarter
+  reads still show a bead-like iris with a pale sclera halo, while the profile
+  reduces the eye to a brown sliver. The judge reads this as a faked recess
+  rather than a socketed globe under a lid.
+- **P0 — no convincing lid overlap.** The iris remains nearly circular in front
+  and the upper lid does not visibly clip the globe; the skin lid mask reads as
+  a crater around a bead.
+- **P0 — iris orientation reads decal-locked** at three-quarter, so the gaze
+  appears to drift off the head axis.
+- **P0 — the aperture/lid mask is too circular** and lacks medial/lateral
+  canthi, so the eye still reads as a doll eye at portrait distance.
+
+Should-fix findings:
+
+- the brow tubes are better anchored but the medial ends still detach in
+  three-quarter/profile;
+- nose lacks a defined tip/wing and nostrils;
+- mouth is a faint geometric seam with no lip volume;
+- crown/back-of-skull is still faceted and egg-like in profile;
+- the catchlight is baked geometry and is not consistent between eyes.
+
+What passed: the skin/eye material remap is correct, the eye openings are
+closed, the standalone GLB reports **12,641 triangles / 7,690 split vertices**,
+and an assembled `npc_casual` with this head passes `inspect` at **14,753 /
+16,000 triangles, 12,823 seam-split vertices, 14 bones, no issues**.
+
+Known limits: bald mannequin-like presentation, stylized geometry-only
+iris/pupil, no rig, no UV texture pass, and the neck cap is a review cut rather
+than a body-welded seam.
+
+## Assembled prototype (2026-11-04)
+
+- `_makehuman_head` imports the GLB and adds a **skull-conforming hair cap**
+  derived from the closed head shell (scaled shell + boolean front-sphere
+  cut + decimate). Hair skips the old `hair_normal.png` because the skull UVs
+  produced large dark tangent patches.
+- Head faces fully covered by the cap are deleted to recover ~950 triangles;
+  boundary faces stay as a safety band, so the accepted face geometry is
+  untouched. The hidden neck plug uses 12 segments.
+- The procedural body was narrowed at the neck and shoulders (chest 0.158,
+  neck base 0.060, neck top 0.054, shoulder root z 1.345) and its skin decimate
+  dropped to 0.21 so all 12 variants fit the 16,000 cap.
+- Local review renders: `tmp/npc-parts/prototype_mh/renders/` (portrait
+  front/three-quarter/profile and full-body front/three-quarter).
+
+## Deferred polish
+
+- Replace the radial lid mask with real upper/lower lid masses that fold over
+  the globe, with pointed canthi, and pass the profile view.
+- Move the iris onto a curved cornea cap so its orientation follows the globe at
+  three-quarter angles, and use a lighting-driven catchlight instead of baked
+  white geometry.
+- Refine the hair cap silhouette (current short cap reads as a helmet) and
+  improve the full-body shoulder/arm shape before the 12-variant rollout.
+- Add a clean UV/material pass and a contract armature/weights when the head
+  becomes part of the shipped library characters.
@@ -0,0 +1,91 @@
+# NPC Model Sourcing
+
+This page records the source evaluation behind [ADR-0015](adr/0015-npc-model-variety-sourcing.md).
+The shipped path is the project-owned Blender/procedural library; external sources
+remain references or local prototypes unless a later ADR accepts them.
+
+## Evaluation
+
+The library needs variety beyond the original eight silhouettes while preserving
+the `npc_base` contract: mesh node, 13 required core bones (optional extras
+allowed), five tint slots, −Y/+Z front, grounded feet and the 16,000/16,000
+character budget.
+
+| Source | Licence | Result |
+| --- | --- | --- |
+| Quaternius Ultimate Modular | CC0 | Good silhouette/decimation material, but a 62-bone T-pose realistic rig and different proportions; not a drop-in. Kept as a reference/prototype. |
+| Kenney Blocky Characters | CC0 | No matching rig; style is much blockier than the project look. |
+| Khronos CesiumMan / RiggedFigure | CC BY 4.0 | Different bone names/rest pose and no five-slot materials; not a drop-in. |
+| MakeHuman / MPFB base | CC0 | Useful body-shape base, but requires retopology, a custom rig, clothing and part integration. Active local pipeline, not the shipped path. |
+
+The contract mismatch is the expensive part, not decimation: retargeting a
+different rig or rebuilding slots/weights can distort the body and invalidate
+gear placement. Any future second-rig path needs its own ADR and animation/gear
+offsets.
+
+## Decision and outcome
+
+- Extend the project-owned procedural generator as the primary shipped path
+  (12-character library, crowd variants, role pools).
+- Keep Quaternius as a studied reference, not a shipped base.
+- MakeHuman is a local development pipeline for body-shape diversity; it must
+  consume the same head/hand parts as the procedural library and never become a
+  CI/build dependency.
+- Record CC0/CC-BY provenance; CC-BY previews require attribution in
+  [`CREDITS.md`](../CREDITS.md).
+
+## MakeHuman prototype notes
+
+The local prototype (`tmp/npc-research/`, never committed) scaled the base to
+1.82 m, grounded it, triangulated/decimated it and retargeted it to the 13-core
+armature. The first retarget measured **6,444 / 16,000 tris and**
+**7,726 / 16,000 verts**, 14 bones, skinned, arm-down, five slots. It exposed
+the expected issues: a 1.63× arm-scale warp at the deltoid/shoulder, blocky
+decimated hands, rough slot boundaries and a head/neck shadow gap. The later
+project head/hands swap reduced this to **6,407 / 16,000 tris and**
+**6,651 / 16,000 verts**, but manual shoulder/neck retopology and part cleanup
+remain before it can be considered shippable.
+
+A standalone MakeHuman head is recorded in
+[`makehuman-head-review.md`](makehuman-head-review.md). The owner accepted the basic
+human head on 2026-11-04; the assembled path (`build_character(head="mh")`) adds a
+skull-conforming hair cap and hides the scalp under it. The 12 shipped GLBs still use
+the procedural head until the hair/body review and rollout in [`TODO.md`](../TODO.md).
+The MakeHuman body should reuse the approved local head/hand parts rather than forking
+a second face implementation.
+
+The current local MPFB full-body prototype (`tmp/npc-research/build_mpfb_npc.py`) assembles the
+accepted head on an MPFB 2.0.18 body at **15,317 / 16,000 tris**, 1.810 m, 14 bones and 10
+materials, with project hands, bevelled shoe shells with inset soles and tongues, pant cuffs,
+cloth sleeve cuffs and flat slot colours. The torso is radially inflated by 12% through z 0.72–1.40
+to loosen the shirt. It is a review candidate, not a shipped asset. The neck is a radial cut
+of the decimated column bridged by a four-ring, 20-segment lathe (lower rings painted cloth,
+reading as a crew neck); the ankles are hidden by 0.11 m shoe shells and 0.08 m pant cuffs, and a
+light smoothing pass softens the closed thigh/hip region. The neck skin test is guarded to z >
+1.35 so it cannot paint the crotch. Remaining polish: the crotch hollow still reads as a V under
+the shirt hem, a partly loosened shirt and angular thigh facets; a separate loose shirt shell is
+the fix. Lowering the hem to z 0.80, tilting it up at the front and a 13% hem flare were rejected
+as a unitard, high-cut swimwear and a peplum respectively. A quick open, flared solidified tube
+(0.150→0.196 m, z 1.05→0.80, 24 segments) read as a hanging apron/tabard; the shell needs a shaped
+torso, armholes and a curved hem.
+A torus collar, cloth cylinder collar, skin neck-blend sphere, destructive vertex-smoothing pass
+and untucked shirt-hem band were tried and removed because they read as a brace, shelf, donut or
+hanging flap, or tore a hole at the collar. Protruding flat sole plates read as skates or bricks,
+so the shoe detail is an inset sole and tongue under a rounded shell; laces were dropped for
+triangle budget. The production integration decision (bake a committed source GLB or keep the
+procedural body) and the owner review are tracked in `TODO.md`; MPFB itself must not become a
+CI/build dependency.
+
+## Provenance rules
+
+- CC0 preferred; CC-BY only with attribution in `CREDITS.md`; no service asset
+  whose terms restrict redistribution.
+- Downloaded research and generated previews stay in `tmp/`/gitignored folders;
+  only final audited assets and committed review sheets enter the repository.
+- Record source URL, licence, author, date and what decision the reference
+  informed. Never treat a generated concept as licensed map/model data.
+
+Measurements, visual decisions and accepted limits are in
+[`3d-model-review.md`](3d-model-review.md) and
+[`npc-visual-review.md`](npc-visual-review.md). Commands are in
+[`asset-tooling.md`](asset-tooling.md).
@@ -1,79 +0,0 @@
-# NPC proportion audit
-
-Status: audited 2026-11-02. All eight library variants are inside the stylized
-proportion guide; no geometry correction was required in this pass. The report
-is repeatable from the exported GLBs:
-
-```bash
-python3 tools/npc_proportions.py report
-python3 tools/npc_proportions.py report --json
-```
-
-## Method
-
-`tools/npc_proportions.py` reads the GLB meshes and rest-pose joint hierarchy:
-
- height from the full mesh bounds;
- head height, width and aspect from `Head`/`skin` vertices (hair excluded so
-  long hairstyles do not change the head measurement);
- shoulder silhouette from vertices in the upper-chest band around the
-  shoulder joint;
- hip width from `HipL`/`HipR` pants vertices;
- torso length from the Spine joint to the shoulder joint;
- leg length from the Spine joint to the lowest vertex;
- arm length from the shoulder joint to the Hand joint;
- foot length from the forward extent of the KneeL/KneeR shoe vertices.
-
-All ratios are divided by total standing height except `head_aspect`
-(width / head height).
-
-## Guide
-
-These are stylized-but-credible bands for the game's low-poly adults, not
-photoreal anatomy. The broad build is allowed a larger shoulder/hip silhouette
-than the slim build.
-
-| Ratio | Target | Notes |
-| --- | ---: | --- |
-| `head_height` | 0.16–0.22 | deliberately larger than a realistic 0.13–0.15 |
-| `head_aspect` | 0.70–1.00 | width / height; rounded heads are acceptable |
-| `shoulder_width` | 0.28–0.38 | silhouette includes sleeves and build scaling |
-| `hip_width` | 0.17–0.23 | pants-only width, not skirt/coat flare |
-| `torso_length` | 0.28–0.38 | Spine joint to shoulder |
-| `leg_length` | 0.40–0.48 | Spine joint to ground |
-| `arm_length` | 0.28–0.38 | shoulder to hand |
-| `foot_length` | 0.12–0.18 | shoe forward extent |
-
-## Result
-
-| Character | Height | Head | Aspect | Shoulder | Hip | Torso | Leg | Arm | Foot | Result |
-| --- | ---: | ---: | ---: | ---: | ---: | ---: | ---: | ---: | ---: | --- |
-| `npc_casual` | 1.824 m | 0.190 | 0.907 | 0.321 | 0.209 | 0.307 | 0.449 | 0.329 | 0.144 | PASS |
-| `npc_jacket` | 1.824 m | 0.190 | 0.907 | 0.333 | 0.209 | 0.307 | 0.449 | 0.329 | 0.144 | PASS |
-| `npc_coat` | 1.824 m | 0.190 | 0.907 | 0.328 | 0.209 | 0.307 | 0.449 | 0.329 | 0.144 | PASS |
-| `npc_vest` | 1.819 m | 0.191 | 0.907 | 0.322 | 0.209 | 0.308 | 0.451 | 0.330 | 0.144 | PASS |
-| `npc_dress` | 1.825 m | 0.190 | 0.907 | 0.289 | 0.191 | 0.307 | 0.449 | 0.329 | 0.144 | PASS |
-| `npc_hoodie` | 1.856 m | 0.187 | 0.907 | 0.328 | 0.206 | 0.302 | 0.442 | 0.323 | 0.141 | PASS |
-| `npc_firefighter` | 1.819 m | 0.191 | 0.907 | 0.358 | 0.223 | 0.308 | 0.451 | 0.330 | 0.148 | PASS |
-| `npc_guard` | 1.819 m | 0.191 | 0.907 | 0.369 | 0.219 | 0.308 | 0.451 | 0.330 | 0.144 | PASS |
-
-No variant is outside a band, so the body pass does not need a global skeleton
-or mesh rescale. The values closest to a boundary are:
-
- **head height 0.190** against the 0.22 upper bound, and **head aspect 0.907**
-  against 1.00 — the head is deliberately large. Any head-size change must be
-  coordinated with the face/headgear pass and its gear-fit measurements.
- **guard shoulder 0.369** and **firefighter hip 0.223** against the broad-build
-  upper bounds — these are the intended uniform/turnout silhouettes, not
-  outliers.
- **leg length 0.449** and **torso 0.307** sit inside the guide for all variants;
-  the earlier short-leg impression came from the hip joint position, not the
-  visible pelvis line.
-
-## Follow-up
-
-The proportion audit does not replace the visual criteria in
-[`npc-visual-review.md`](npc-visual-review.md): neck/shoulder/hip transitions,
-face depth, hand grips, clothing hems and shoes still need the appearance pass.
-Re-run the audit after any body mesh or skeleton change and record the new
-ratios here.
@@ -13,6 +13,14 @@ the conversation-distance hand pass
 [`sheet_npc_hands_compare.jpg`](blender_previews/sheet_npc_hands_compare.jpg), and the
 forward-grip pass [`sheet_npc_hands_grip_compare.jpg`](blender_previews/sheet_npc_hands_grip_compare.jpg).

+The 2026-11-03 skill-guided re-evaluation, its measurements (texel density, budgets, imported
+bounds) and the open scorecard live in [`3d-model-review.md`](3d-model-review.md). It does not
+change the accepted limits below.
+
+A single-variant face prototype (`npc_casual`) landed 2026-11-03/04: `seg=24/rings=16` head,
+subtle brow ridge, fuller lower lip and both eyelids. It reads cleaner than the 0.9.4 face and is
+a candidate for the remaining seven once the owner approves (see the review doc).
+
 ## What was captured

 `src/test/capture_npc_baseline.gd` stages all eight library characters in a
@@ -63,9 +71,9 @@ The criteria below are for the stylized target, not photorealism. A change must
 pass every applicable item before a library rebuild is accepted.

 1. **Asset contract:** `npc_base` mesh node, the required bones, five tint slots,
-   front +Z, feet within 3 cm of y=0, 1.6–2.1 m height, at most 8,000 triangles
-   and 8,000 glTF vertices per library character. The frozen `npc_base` fallback
-   keeps 6,000 triangles / 4,000 vertices. Gear remains at most 1,500 triangles.
+   front +Z, feet within 3 cm of y=0, 1.6–2.1 m height, at most 16,000 triangles
+   and 16,000 glTF vertices per character. The required 13 core bones stay fixed;
+   optional extra bones are allowed. Gear remains at most 1,500 triangles.
 2. **Proportion and silhouette:** head, neck, shoulders, torso, hips, limbs and
   feet read as one body; front/three-quarter/profile silhouettes agree with the
   rest of the eight-character library; broad/slim/average build variation is
@@ -74,7 +82,7 @@ pass every applicable item before a library rebuild is accepted.
   the head volume has a readable jaw/cheek/chin transition; no face-plane seams,
   inverted normals or z-fighting. The face direction must remain unambiguous.
 4. **Hair and headgear:** hair covers the scalp without gaps or scalp-through
-   seams; fringes, buns and beards keep their silhouette. Caps, beanies, hoods,
+   seams; fringes, buns and beards keep their silhouette. Caps, hoods,
   sunglasses and the firefighter helmet clear the brow, eyes and ears. Headgear
   may sit outside the 1.55–1.81 m face band, but its brim must not cover the
   eyes.
@@ -105,11 +113,83 @@ measurement.

 ## Proportion audit

-The separate [`npc-proportion-audit.md`](npc-proportion-audit.md) measures
-height, head size, shoulder/hip width, torso, leg, arm and foot ratios for every
-variant with `tools/npc_proportions.py`. All eight pass the stylized guide; the
-head and broad-build shoulders sit nearest their upper bounds. No skeleton or
-mesh proportion change was needed in this pass.
+Status: audited 2026-11-02. All eight library variants are inside the stylized
+proportion guide; no geometry correction was required in this pass. The report
+is repeatable from the exported GLBs:
+
+```bash
+python3 tools/npc_proportions.py report
+python3 tools/npc_proportions.py report --json
+```
+
+### Method
+
+`tools/npc_proportions.py` reads the GLB meshes and rest-pose joint hierarchy:
+
+- height from the full mesh bounds;
+- head height, width and aspect from `Head`/`skin` vertices (hair excluded so
+  long hairstyles do not change the head measurement);
+- shoulder silhouette from vertices in the upper-chest band around the
+  shoulder joint;
+- hip width from `HipL`/`HipR` pants vertices;
+- torso length from the Spine joint to the shoulder joint;
+- leg length from the Spine joint to the lowest vertex;
+- arm length from the shoulder joint to the Hand joint;
+- foot length from the forward extent of the KneeL/KneeR shoe vertices.
+
+All ratios are divided by total standing height except `head_aspect`
+(width / head height).
+
+### Guide
+
+These are stylized-but-credible bands for the game's low-poly adults, not
+photoreal anatomy. The broad build is allowed a larger shoulder/hip silhouette
+than the slim build.
+
+| Ratio | Target | Notes |
+| --- | ---: | --- |
+| `head_height` | 0.16–0.22 | deliberately larger than a realistic 0.13–0.15 |
+| `head_aspect` | 0.70–1.00 | width / height; rounded heads are acceptable |
+| `shoulder_width` | 0.28–0.38 | silhouette includes sleeves and build scaling |
+| `hip_width` | 0.17–0.23 | pants-only width, not skirt/coat flare |
+| `torso_length` | 0.28–0.38 | Spine joint to shoulder |
+| `leg_length` | 0.40–0.48 | Spine joint to ground |
+| `arm_length` | 0.28–0.38 | shoulder to hand |
+| `foot_length` | 0.12–0.18 | shoe forward extent |
+
+### Result
+
+| Character | Height | Head | Aspect | Shoulder | Hip | Torso | Leg | Arm | Foot | Result |
+| --- | ---: | ---: | ---: | ---: | ---: | ---: | ---: | ---: | ---: | --- |
+| `npc_casual` | 1.824 m | 0.190 | 0.907 | 0.321 | 0.209 | 0.307 | 0.449 | 0.329 | 0.144 | PASS |
+| `npc_jacket` | 1.824 m | 0.190 | 0.907 | 0.333 | 0.209 | 0.307 | 0.449 | 0.329 | 0.144 | PASS |
+| `npc_coat` | 1.824 m | 0.190 | 0.907 | 0.328 | 0.209 | 0.307 | 0.449 | 0.329 | 0.144 | PASS |
+| `npc_vest` | 1.819 m | 0.191 | 0.907 | 0.322 | 0.209 | 0.308 | 0.451 | 0.330 | 0.144 | PASS |
+| `npc_dress` | 1.825 m | 0.190 | 0.907 | 0.289 | 0.191 | 0.307 | 0.449 | 0.329 | 0.144 | PASS |
+| `npc_hoodie` | 1.856 m | 0.187 | 0.907 | 0.328 | 0.206 | 0.302 | 0.442 | 0.323 | 0.141 | PASS |
+| `npc_firefighter` | 1.819 m | 0.191 | 0.907 | 0.358 | 0.223 | 0.308 | 0.451 | 0.330 | 0.148 | PASS |
+| `npc_guard` | 1.819 m | 0.191 | 0.907 | 0.369 | 0.219 | 0.308 | 0.451 | 0.330 | 0.144 | PASS |
+
+No variant is outside a band, so the body pass does not need a global skeleton
+or mesh rescale. The values closest to a boundary are:
+
+- **head height 0.190** against the 0.22 upper bound, and **head aspect 0.907**
+  against 1.00 — the head is deliberately large. Any head-size change must be
+  coordinated with the face/headgear pass and its gear-fit measurements.
+- **guard shoulder 0.369** and **firefighter hip 0.223** against the broad-build
+  upper bounds — these are the intended uniform/turnout silhouettes, not
+  outliers.
+- **leg length 0.449** and **torso 0.307** sit inside the guide for all variants;
+  the earlier short-leg impression came from the hip joint position, not the
+  visible pelvis line.
+
+### Follow-up
+
+The proportion audit does not replace the visual criteria in
+[`npc-visual-review.md`](npc-visual-review.md): neck/shoulder/hip transitions,
+face depth, hand grips, clothing hems and shoes still need the appearance pass.
+Re-run the audit after any body mesh or skeleton change and record the new
+ratios here.

 ## Baseline measurements

@@ -126,8 +206,8 @@ From `python3 tools/blender_assets.py fit` and the manifest:
 | `npc_firefighter` | 5,344 | 5,494 | 0.315 m | 0.255 m (skirt) | helmet width ratio 1.651; SCBA x −0.105, radial −0.076 |
 | `npc_guard` | 5,046 | 5,096 | 0.315 m | 0.194 m (hip) | cap width ratio 1.067 |

-`npc_coat` is widest at 5,474 triangles (2,526 below the 8,000 cap);
-`npc_firefighter` is closest on vertices at 5,494 (2,506 below the 8,000 cap).
+`npc_coat` is widest at 5,474 triangles (well below the 16,000 cap);
+`npc_firefighter` is closest on vertices at 5,494 (well below the 16,000 cap).
 The refit backpack measures 380 triangles / 406 vertices.

 ## Baseline findings, ranked
@@ -0,0 +1,173 @@
+# Release QA and Balance
+
+Manual verification and the 0.10.0 balance protocol. The executable command
+matrix is in the release runbook/skill; this page owns the human smoke checks and
+the measurable balance targets. Architecture owns the gates themselves; gameplay
+owns the mechanics.
+
+## Manual smoke checklist
+
+1. `godot --path .` starts the game on the venue menu without script errors.
+2. Choosing a venue (click or ↑/↓ + Enter) starts that venue's shift and hides the menu.
+3. The guard moves and looks around; the building, steps, and sidewalk are visible.
+4. The guard's camera sits at eye height and the guard stands on the landing, not inside the building.
+5. Walking into the steps carries the guard up onto the landing (steps have colliders).
+6. The skyline backdrop shows silhouettes against the sky, not an opaque black slab.
+7. The `GIG LINE` marquee is readable from the sidewalk.
+8. NPCs spawn and approach the entrance during the first minutes.
+9. Looking at an NPC inside the focus cone shows a blue focus circle in front of the face, the person's name, and the HUD target line.
+10. `Space` or left click opens the action wheel; `A`/`D` highlight a slice, `Space` confirms it, `Esc`/right click cancels without a log entry.
+11. `E`/`C` open the inspection/wand panels from the wheel and freeze movement until they close; walking never fires the wand.
+12. Pressing `Q` produces a reaction log entry and reputation feedback.
+13. `E` opens access inspection showing venue-correct artifacts and policy result; `A`/`D` record a decision.
+14. `6` opens the assistance form; submitting shows dispatch feedback.
+15. `R` opens the emergency form; the button must be held ~1.6s or the call cancels.
+16. `G` toggles the flashlight (indicator appears in the HUD); `L` toggles the door lock (indicator turns red when locked).
+17. `F` toggles the debug overlay with NPC states and shift stats.
+18. The wheel's `Look` slice is eye contact (Level 1) and logs as its own action.
+19. `Reason` asks why the person is there and logs their `dialogue_lines` reply.
+20. `Recognize` records the guard's recognition as access evidence; pressing it twice says so.
+21. `Warn` turns the body camera on (REC overlay appears); `B` toggles it manually.
+22. `Block` moves the guard between the person and the door.
+23. The shift review reports the incident count, including interactions left unresolved.
+24. Escalating on someone (or a responder arriving) makes idle bystanders stop and face the incident.
+25. Repeated alarms panic the crowd and nearby people clear away from the door instead of standing around.
+26. `Esc` with nothing open pauses the shift; resume / restart / settings / quit-to-menu all work, and settings changes persist across a restart.
+27. NPCs route around the building using the navigation mesh (no stuck-at-wall behavior during a smoke run).
+28. An unjustified emergency call (calm person, no weapon) logs an investigation and costs reputation.
+29. After an evacuation outcome the door is locked and NPCs are leaving the entrance.
+30. The shift review's "Body camera timeline" button steps through the recorded events (Left/Right or the buttons) and Esc returns to the review.
+31. The escalation label shows a `[###--] L3/5` shape meter as well as the level name, and stays readable in grayscale.
+32. Changing "HUD font scale" in Settings resizes the HUD text and persists across a restart.
+33. When the shift timer reaches 0, the shift review screen shows grade, policy, incident summary, responder outcomes, investigations, and persisted shift history; campaign Continue starts the next venue.
+34. On a fresh profile the tutorial starts on Hollywood, advances through its eight beats, and F1 skips it; Settings Replay tutorial restarts it.
+35. Pausing saves a checkpoint: returning to the menu and choosing Continue resumes elapsed time, NPCs, incidents, door/flashlight state and campaign position.
+36. Settings difficulty changes spawn pacing/compliance/report strictness while escalation rules stay the same; Help filters controls and shows the venue policy.
+37. The F debug overlay lists the next eligible events; recovery events and recently played scripted events behave as authored.
+38. Master/SFX/ambience volume settings clamp at 0/1 and persist; Reduce motion disables head bob; the captions toggle persists.
+39. The 24-NPC budget smoke stays inside its frame budget; coats/dresses do not show obvious leg clipping in a normal walk.
+40. Help remains readable with the largest HUD font scale, and CI/local verification use the same Godot 4.7.2 baseline.
+41. UI copy: inspection/wand use "A = admit · D = refuse entry", review returns with "Return to menu", and application exit reads "Quit game".
+42. Button states remain readable on hover/focus/pressed; settings Apply/Cancel and radio normal-send/emergency-hold behave as labelled.
+43. The venue menu offers Hollywood Boulevard — Day and — Night; either starts the same map, and Night starts in the late phase with a full shift clock.
+44. The Joke Shop opens on the Sunset Strip club: the black hall, signature canopy, circular **THE JOKE SHOP** sign, red curtains, west entrance, palms, dry hillside with houses, neighbouring frontage and the opposite side of Sunset all read from the door camera. Day lighting and late lighting both look correct; the guard can walk the sidewalk without leaving the nav bounds.
+45. Esc and right-click close only the top panel (Help, Settings, Pause, Review, Radio, timeline, inspection/wand, action wheel); Settings opened from the venue menu returns to the menu, Help no longer opens Pause behind it, and closing a modal recaptures the mouse without leaving the guard frozen.
+46. At 0.75× and 1.75× HUD font scale, long target names stay inside the target chip, the chip grows/caps correctly, and long button labels ellipsize instead of pushing panels off-screen.
+47. Reset campaign and Replay tutorial both ask for confirmation; a second click reuses the open dialog, Cancel does nothing, and OK fires once. Emergency send requires the full hold, sends exactly once, and does not send again on release.
+48. UI copy/button sweep: every panel uses the canonical admit/refuse, warning/blocking, assistance/emergency and body-camera terms; the start menu, pause, settings, Help, inspection, wand, radio, wheel, timeline and shift review all show readable hover/focus/pressed/disabled states; Tab/arrow focus wraps without landing on hidden or disabled actions; Esc/right-click closes only the top panel; and destructive reset/replay plus emergency send still require their confirmation or hold.
+
+## Balance acceptance
+
+These are the acceptance targets for the 0.10.0 balance pass, not measured results.
+No reaction tables, event weights or scoring rules were changed to set them. The
+[roadmap](../TODO.md) tracks the sweeps and external playtests still needed.
+[Gameplay](gameplay.md) owns the mechanics; this page owns their balance-test protocol.
+
+### Test matrix and evidence
+
+Run Hollywood, Joke Shop and TV Studio on easy, normal and hard, in Early,
+Midday, Evening and Late: **36 cells**. Use seeds 1–100 for each cell and retain
+those seeds for before/after comparisons. Exercise each eligible authored event
+at least once as a separate coverage pass; a random schedule can miss rare events.
+Record scheduled event counts separately from forced coverage cases so the latter
+do not distort event-frequency estimates.
+
+For reaction measurements, use a fresh controller at the entrance for each sample.
+Routine cases are tourists, confused visitors and delivery workers obstructing the
+entrance without threatening behavior. Do not include authorized entry requests in
+this redirect cohort. For peaceful-resolution measurements, send one polite
+direction (L1), then one warning (L2) only if still unresolved. Do not reroll until
+success. Observe return behavior for 60 simulated seconds before closing the case.
+Do not issue emergency calls as part of this policy.
+
+For access cases, follow the venue's required inspection and screening steps before
+allow/deny. Include valid, expired, counterfeit, mismatched, missing and ambiguous
+artifacts, known recognition, age boundaries, screening refusal, benign wand alerts
+and prohibited items. Recognition must be independently justified by the fixture;
+calling a stranger recognized is not evidence of correct admission. An unresolved
+hold counts as unresolved, not as a correct refusal.
+
+Evidence must identify the commit, engine, venue, difficulty, phase, seed, event ID,
+cohort, visible evidence, policy action, reaction/state, return, access truth and
+decision, emergency truth and call, report fields, reputation modifiers, final grade
+and unresolved cases. Save raw rows plus numerator/denominator summaries for every
+cell. Use at least **100 eligible cases per metric per cell**; if the schedule
+provides fewer, add a separately labelled forced-case sample. Report zero eligible
+cases as **N/A**, never as 100% success. Keep scheduled and forced results separate.
+
+### Targets
+
+Percentages below apply to each matrix cell, not only a pooled average. Scripted
+access/report cases use complete evidence and are held to exact correctness;
+first-time-player results measure whether that evidence is understandable.
+
+| Metric | Numerator / denominator | Acceptance target |
+| --- | --- | --- |
+| First-direction routine compliance | First L1 reaction is `COMPLY` or `LEAVE` / eligible routine redirect cases | Easy ≥80%; normal ≥75%; hard ≥65% |
+| Routine peaceful resolution | Routine cases leaving after at most L1 then L2, with no return during 60 s and no L3–L5 / eligible routine redirect cases | Easy ≥90%; normal ≥85%; hard ≥80% |
+| Access accuracy | Correct final allow/deny decisions / all eligible access cases (including unresolved cases) | Scripted 100%; first-time players ≥90% pooled, with each error reviewed |
+| Access false positive | Unauthorized people allowed / unauthorized access cases | Scripted 0%; first-time players ≤5% pooled |
+| Access false negative | Authorized people denied / authorized access cases | Scripted 0%; first-time players ≤10% pooled |
+| Emergency precision | Calls supported by immediate-danger evidence / all emergency calls | Scripted 100%; first-time players ≥95% pooled; zero calls is N/A |
+| Emergency false positive | Routine/no-immediate-danger cases receiving an emergency call / all routine/no-immediate-danger cases | Scripted 0%; first-time players ≤5% pooled |
+| Emergency false negative | Immediate-danger cases without an accepted emergency call within 15 simulated seconds of visible danger / all immediate-danger cases with radio initially available | Scripted 0%; first-time players ≤10% pooled |
+| Report accuracy | Reports with correct weapon and danger fields / all submitted reports | Scripted 100%; first-time players ≥90% pooled |
+
+For access, authorized means entitled under the venue policy **after required
+screening**, without a prohibited item or an independent immediate-danger reason
+to refuse. Compare to a hand-labelled fixture expectation, not only to
+`AccessVerifier.verify()`: using the verifier as both decision and oracle would
+hide policy bugs. Report unresolved access cases separately; they cannot improve
+either error rate by being omitted from accuracy.
+
+Immediate danger means an observed weapon, assault, active forced entry or a
+credible immediate threat to occupants. Argument, filming, intoxication, a crisis,
+a refused screen or a benign wand alert alone is not immediate danger. A mental
+health label or clothing must never be used as the emergency oracle. The 15 s
+window is a test-response target, not the responder-arrival time (currently 15 s
+after an accepted emergency call). Separately test depleted battery and active
+cooldown cases for safe containment/assistance; do not silently drop them from the
+evidence or claim the initially-available-radio target covers them.
+
+### Scoring and emergency dominance
+
+Compare the calm policy with an emergency-first policy on the same routine events
+and seeds. Each comparison starts with fresh radio, crowd and reputation state.
+An accurate report about harmless behavior must not make its emergency call
+justified. Require an unjustified-call investigation and a strictly lower rating
+for emergency-first in every routine comparison. Inspect modifiers as well as the
+final rating: the 0–100 clamp can hide rewards/penalties. Emergency-first must not
+improve the campaign outcome or final grade. Grade boundaries remain A ≥90,
+B ≥75, C ≥60, D ≥40, otherwise F; these are existing rules, not new tuning.
+
+In genuine-danger cases, verify that the call is accepted, responders arrive,
+the incident remains answerable and the debrief explains the outcome without an
+unjustified-call investigation. Also compare assistance/containment routes where
+appropriate; emergency need not be mandatory for every difficult interaction.
+
+### Implementation cautions and sign-off
+
+- `NPCController.roll_reaction()` samples per-level weights. Difficulty adds
+  +12/0/−8 to the `COMPLY` weight before normalization; `base_compliance` alone
+  is not the observed compliance percentage. Measure `COMPLY` plus `LEAVE`.
+- `GameManager._read_npc_truth()` currently derives weapon/danger truth from the
+  NPC type (violent threat: weapon/3; everyone else: no weapon/1), rather than
+  observed behavior. This is a balance-review risk: test nonviolent profiles that
+  threaten or force entry, and violent profiles before visible danger. Do not
+  treat agreement with this helper as proof of fair emergency judgment.
+- `RadioSystem.credibility_hits()` checks weapon and danger fields only;
+  location, description and behavior still need human review. Difficulty scales
+  report penalties, not the oracle.
+- A terminal peaceful reaction is not sufficient evidence of an incident staying
+  resolved: returning NPCs and unresolved shift-review entries must be retained.
+
+Do not tune to a pooled average that hides a failing venue, phase or difficulty.
+Record each miss, its severity, the raw evidence and any approved exception before
+changing weights. Re-run the affected cells and tutorial/campaign smokes after a
+fix. Five first-time-player sessions must cover the tutorial and a complete venue
+shift; report pooled counts and per-session errors, not statistical confidence
+from five players. Scripted sweeps do not substitute for those sessions.
+
+**Status:** targets defined; sweeps, emergency fairness review, grade/campaign
+verification and external-player acceptance remain pending. No balance sign-off
+or release approval is implied by this document.
@@ -1,14 +0,0 @@
-# Screen-design judge report
-
-Date: 2026-11-02
-Model: automatic cheapest image+JSON selection (`z-ai/glm-5.3-flash` at run time)
-Command: `python3 tools/screen_designs.py judge`
-Result: **21/21 match, 0 review, 0 diff**
-
-The screenshot gallery was regenerated on the current build before judging, including the eight UI-state captures 14–21 added in `src/test/capture_ui_states.gd`.
-Accepted captures are in [`docs/screens/`](screens/README.md); the committed
-gallery is in [`docs/screenshots/`](screenshots/README.md).
-
-The automatic model selection and retry/spend behavior is documented in
-[`docs/asset-tooling.md`](asset-tooling.md). This report intentionally records
-the outcome rather than generated captures, which remain local/gitignored.
@@ -2,6 +2,7 @@

 Visual references and generated QA evidence for Gig Line.

+- [`refs/README.md`](refs/README.md) — licensed real-location photos, provenance sidecars and the licence/privacy rules
 - [`concepts/README.md`](concepts/README.md) — AI-assisted realism concept frames
 - [`designs/README.md`](designs/README.md) — screen-design mockups
 - [`../screenshots/README.md`](../screenshots/README.md) — committed game gallery
@@ -0,0 +1,18 @@
+# Three-up boards: photo | concept | capture
+
+Each strip lines up the three image sources for one venue state so the evidence
+chain stays visible: the licensed real photo is the **evidence**, the generated
+frame is the **proposal** (geometry anchored on the photo; see the
+[concepts board](../concepts/README.md) and each frame's `.refgen.json`), and
+the game capture is the **proof** of the current build. Where the concept and
+the photo disagree, the photo wins for shape; the capture shows the gap the
+facade-realism work has to close.
+
+Composed with `tools/three_up.py compose` (labels baked in; the photo panel's
+attribution lives in the caption and the [refs sidecars](../refs/README.md)).
+
+| Board | Caption |
+| --- | --- |
+| ![three-up board: elcapitan day](elcapitan-day-board.jpg) | El Capitan facade, day. Photo: [CC BY 2.0, woo, 2009](https://commons.wikimedia.org/wiki/File:El_Capitan_Theater_frontal_fachade-The_Masonic_Temple.jpg) via `refs/hollywood`. Concept: photo-anchored generation. Capture: current build with the ashlar limestone field (`limestone_ashlar`, anchored on the same photo). |
+| ![three-up board: elcapitan night](elcapitan-night-board.jpg) | El Capitan block, night. Photo: CC BY-SA 3.0 (reviewed; redistribution only, no derived assets) via `refs/hollywood`. Concept: photo-anchored night restage. Capture: current build. |
+| ![three-up board: jokeshop day](jokeshop-day-board.jpg) | Joke Shop frontage, day. Photo: local-only research frame (`tmp/research/comedy-store`, gitignored). Concept: photo-anchored (gemini + gpt). Capture: current build with the `dark_stucco` wall tile. |
@@ -0,0 +1,7 @@
+{
+  "board": "elcapitan-day-board.jpg",
+  "caption": "El Capitan facade, day. Photo: CC BY 2.0 2009 via refs/hollywood. Concept: photo-anchored. Capture: ashlar limestone pass (limestone_ashlar, 768 px tile, ~167 px/m).",
+  "photo": "docs/screens/refs/hollywood/el-capitan-facade-day-wikimedia-2009-10-27.jpg",
+  "concept": "docs/screens/concepts/hollywood_boulevard/hollywood_boulevard_entrance_day-v2.png",
+  "capture": "docs/screenshots/01-venue-overview.png"
+}
@@ -0,0 +1,7 @@
+{
+  "board": "elcapitan-night-board.jpg",
+  "caption": "El Capitan block, night: CC BY-SA photo (redistribution only) | photo-anchored concept | current capture (banner self-light + facade washes).",
+  "photo": "docs/screens/refs/hollywood/hollywood-boulevard-night-context-ccbysa.jpg",
+  "concept": "docs/screens/concepts/hollywood_boulevard/el_capitan_facade_night.png",
+  "capture": "docs/screenshots/05-late-night-avenue.png"
+}
@@ -0,0 +1,7 @@
+{
+  "board": "jokeshop-day-board.jpg",
+  "caption": "Joke Shop frontage, day. Photo: local-only research frame (tmp/research/comedy-store). Concept: photo-anchored (gemini + gpt). Capture: 6.0 m low hall, dark stucco, white signature band, tied-back curtains, west hotel tower.",
+  "photo": "tmp/research/comedy-store/01.jpg",
+  "concept": "docs/screens/concepts/joke_shop/joke_shop_entrance_day-v2.png",
+  "capture": "docs/screenshots/12-joke-shop.png"
+}
@@ -1,6 +1,13 @@
 # Scene concepts: the realistic target look

-These are AI-generated example frames (`python3 tools/scene_concepts.py generate --group scene`, `openai/gpt-5-image-mini`, 1280×720) for the realism pass. They are art direction, not assets. `tools/scene_concepts.py realism` pairs them with the in-game shots from `src/test/capture_realism.gd` (see `SHOTS` in the tool). New generations never overwrite a file here; they are saved as `<name>-vN.png`.
+These are AI-generated example frames for the realism pass. They are art direction, not assets.
+`tools/scene_concepts.py realism` pairs them with the in-game shots from `src/test/capture_realism.gd`
+(see `SHOTS` in the tool). New generations never overwrite a file here; they are saved as
+`<name>-vN.png`.
+
+Concepts are organised per venue in the two subfolders below. The older top-level single-frame
+concepts were removed on 2026-11-03 in favour of the per-venue boards, which carry photo-anchored
+generations with a `.refgen.json` provenance sidecar each (source photo, licence, model).

 ## Real-world Hollywood block

@@ -8,96 +15,28 @@ The map-optimization references for the El Capitan Entertainment Centre block
 (6840 Hollywood Blvd) are in
 [`hollywood_boulevard/README.md`](hollywood_boulevard/README.md). The real-site
 facts and game mapping are documented in
-[`../../hollywood-boulevard-map.md`](../../hollywood-boulevard-map.md).
+[`../../venues.md`](../../venues.md#hollywood-boulevard).

-## Concept list
-
-### Hollywood Entrance
-
-![hollywood entrance morning](hollywood_entrance_morning.png)
-warm low sun, long soft shadows, brick with visible mortar and wear, stone plinth, potted topiary, haze that fades the far street to beige
-
-### Hollywood Entrance Golden Hour
-
-![hollywood entrance golden hour](hollywood_entrance_golden_hour.png)
-strong back light and rim light on people, marquee bulbs reading even in daylight
-
-### Hollywood Entrance Rain Night
-
-![hollywood entrance rain night](hollywood_entrance_rain_night.png)
-dark scene lit by practical lights only (marquee, sodium lamps), wet glossy ground with reflections, fog
-
-### Boulevard Skyline
-
-![boulevard skyline day](boulevard_skyline_day.png)
-deep layered skyline with real towers and haze, palms lining the road, red curb paint, believable asphalt
-
-### Boulevard Skyline Dusk
-
-![boulevard skyline dusk](boulevard_skyline_dusk.png)
-purple/orange gradient sky, neon signs, lit windows, car light trails
-
-### The Joke Shop — Sunset Strip
+## The Joke Shop — Sunset Strip

 The current Joke Shop map is based on The Comedy Store at 8433 Sunset Blvd.
-The real-site mapping, simplifications and reference photographs are in
-[`../../joke-shop-map.md`](../../joke-shop-map.md); the frames are in
+The real-site mapping and simplifications are in
+[`../../venues.md`](../../venues.md#the-joke-shop); the frames are in
 [`joke_shop/README.md`](joke_shop/README.md).

 ![Joke Shop entrance in daylight](joke_shop/joke_shop_entrance_day.png)

 ![Joke Shop entrance at night](joke_shop/joke_shop_entrance_night.png)

-### Legacy Joke Shop Alley (pre-map optimization)
+## Cross-cutting targets

-![joke shop alley evening](joke_shop_alley_evening.png)
-narrow brick alley, one warm wall lantern as key light, deep shadows, people in dark jackets
+For comparison with locally generated realism runs (`docs/screens/realism/`, gitignored):

-![joke shop door closeup](joke_shop_door_closeup.png)
-close material detail: brick, mortar, aged wood door, brass
-
-These two frames describe the old alley layout and are retained for comparison;
-they are no longer the target for the Joke Shop map.
-
-### Studio Stage Door Night
-
-![studio stage door night](studio_stage_door_night.png)
-granite facade, a bright bulb canopy as the main light, a glossy black car, stanchions and a barrier
-
-### Sidewalk Material Closeup
-
-![sidewalk material closeup](sidewalk_material_closeup.png)
-paver joints, stains, granite curb, aggregate asphalt and a tree grate at grazing light
-
-### Entrance Steps Podium
-
-![entrance steps podium](entrance_steps_podium.png)
-granite steps, handrails, glass doors, the check-in podium
-
-### Crowd Barrier Line
-
-![crowd barrier line](crowd_barrier_line.png)
-steel barriers, a red carpet, a crowd with depth-of-field haze
-
-### Responder Arrival Wide
-
-![responder arrival wide](responder_arrival_wide.png)
-fire engine, turnout gear, red/blue light spill on wet pavement
-
-### NPC Portrait Day
-
-![npc portrait day](npc_portrait_day.png)
-close portrait of a pedestrian: skin with visible pores and stubble, fabric weave, shallow depth of field. The bar for an avatar close-up, not for the crowd shots
-
-The `npc_portrait` capture in `capture_realism.gd` is staged, not posed by the crowd: it freezes one NPC on an open patch of sidewalk, parks the rest of the crowd out of frame, turns the subject into the camera and stands the guard on the sunlit side. It is the only shot where a face fills the frame, so it is the one to eyeball after an avatar change (generate a local run under `docs/screens/realism/`).
-
-Cross-cutting targets, for comparison with locally generated realism runs:
-
- **Exposure.** The concepts keep the ground mid-grey. The game's sidewalk is close to white, so it is overexposed.
- **Night means dark.** The night/dusk concepts are lit by practical lights. The game's "Evening" phase is a bright pink-orange frame.
- **Depth.** The concepts show a layered skyline fading into haze. The new v2 skyline strips supply this; the old box skyline did not.
- **Geometry and foliage.** The facades have plinths, cornices and deep window reveals, and the trees and shrubs are organic. The game uses flat walls and blob trees.
-
-## Additional previews
-
-![npc_portrait_day-v2.png](npc_portrait_day-v2.png)
+- **Exposure.** The concepts keep the ground mid-grey; the game's sidewalk reads lighter, so it
+  overexposes against the reference.
+- **Night means dark.** The night/dusk concepts are lit by practical lights only (marquee,
+  signage, street lamps), with wet pavement reflections.
+- **Depth.** The concepts show a layered skyline fading into haze; the v2 skyline strips supply
+  this at the boulevard boundary.
+- **Geometry and foliage.** The facades have plinths, cornices and deep window reveals, and the
+  trees and shrubs are organic; the venue-realism passes close these gaps incrementally.
@@ -4,12 +4,39 @@ AI-generated art-direction frames for the real El Capitan Entertainment Centre
 block at 6840 Hollywood Boulevard. They are generated with
 `tools/scene_concepts.py generate --group scene --only ...` and are not shipped
 game textures. The geometry mapping and source links are in
-[`../../../hollywood-boulevard-map.md`](../../../hollywood-boulevard-map.md).
+[`../../../venues.md`](../../../venues.md#hollywood-boulevard).

 ## Entrance — day

 ![El Capitan Entertainment Centre entrance in daylight](hollywood_boulevard_entrance_day.png)

+## Entrance — day, photo-anchored
+
+![El Capitan Entertainment Centre entrance in daylight, anchored on the 2009 facade photo](hollywood_boulevard_entrance_day-v2.png)
+
+Generated with `generate --reference`, anchored on the licence-cleared
+[`el-capitan-facade-day-wikimedia-2009-10-27.jpg`](../../refs/hollywood/el-capitan-facade-day-wikimedia-2009-10-27.jpg)
+board photo (CC BY 2.0); provenance in
+[`hollywood_boulevard_entrance_day-v2.refgen.json`](hollywood_boulevard_entrance_day-v2.refgen.json).
+The facade geometry (motto band, column rhythm, lattice windows, banner slots,
+blade sign) follows the photograph; the street is restaged clean for art
+direction.
+
+## Facade — night (photo-anchored)
+
+![El Capitan facade at night, anchored on the facade photo](el_capitan_facade_night.png)
+
+Same facade photo as the day frame, restaged to night with practical lighting
+only (marquee, signage, street lamps) and wet pavement. The blade sign, banner
+slots and lattice windows follow the photograph.
+
+## Facade — overcast (photo-anchored)
+
+![El Capitan facade under flat overcast light](el_capitan_facade_weathered.png)
+
+Same framing under flat overcast light. The weathering requested came out
+mild — treat this as the overcast target, not a decay reference.
+
 ## Entrance — night

 ![El Capitan Entertainment Centre entrance at night](hollywood_boulevard_entrance_night.png)
@@ -17,3 +44,32 @@ game textures. The geometry mapping and source links are in
 ## Across the boulevard

 ![Ovation Hollywood frontage across the boulevard](hollywood_boulevard_across_street.png)
+
+## Jimmy Kimmel Live entrance — local-reference anchored, two models
+
+![Jimmy Kimmel Live entrance, day, Gemini](jimmy_kimmel_entrance_day_gemini.png)
+
+![Jimmy Kimmel Live entrance, day, GPT image](jimmy_kimmel_entrance_day_gpt.png)
+
+![Jimmy Kimmel Live entrance, night, Gemini](jimmy_kimmel_entrance_night_gemini.png)
+
+![Jimmy Kimmel Live entrance, night, GPT image](jimmy_kimmel_entrance_night_gpt.png)
+
+Four frames anchored on the same local-only research photo
+(`tmp/research/jimmy-kimmel-entrance/07.jpg`, gitignored) with `--reference-unchecked`, two
+treatments (day, night) × two models (`google/gemini-2.5-flash-image`, `openai/gpt-5-image-mini`).
+Provenance and model are in each frame's `.refgen.json` sidecar. The building is the starting-point
+venue: the El Capitan Entertainment Centre carrying the "Jimmy Kimmel Live!" marquee over the
+six-column Masonic Temple facade.
+
+## Facade — local-reference anchored, two models
+
+![El Capitan facade anchored on a local research frame, Gemini](el_capitan_facade_gemini_day.png)
+
+![El Capitan facade anchored on a local research frame, GPT image](el_capitan_facade_gpt_day.png)
+
+Both frames are anchored on the same local-only research photo
+(`tmp/research/elcapitan/01.jpg`, gitignored) with `--reference-unchecked`, one with
+`google/gemini-2.5-flash-image` and one with `openai/gpt-5-image-mini`. Provenance and model are
+in each frame's `.refgen.json` sidecar. Local reference only; the photo never enters the repo and
+these frames are art direction, not assets.
@@ -0,0 +1,12 @@
+{
+  "concept": "el_capitan_facade_gemini_day",
+  "generated": "el_capitan_facade_gemini_day.png",
+  "model": "google/gemini-2.5-flash-image",
+  "reference": {
+    "file": "tmp/research/elcapitan/01.jpg",
+    "licence": "unchecked",
+    "page": "",
+    "licence_checked": false
+  },
+  "suffix": "Use the attached reference photograph as the fixed source of geometry and composition: keep the building's proportions, column rhythm, band heights, signage placement and camera angle exactly as photographed. Only restage lighting, weather, people and surface condition where the prompt asks for it. Do not invent extra storeys, wings or ornaments that the photo does not show."
+}