security-game/PLAN.md

# Game Plan: Gig Line

## Premise

You are a private security guard working the entrance of a stylized reconstruction of the real El Capitan Entertainment Centre on Hollywood Boulevard. You keep the steps and doors clear, check who is allowed in, and deal with tourists, performers, influencers, confused visitors, intoxicated pedestrians, trespassers, people in mental-health crisis, and rare determined threats.

The game is about **judgment, communication, access verification, and proportionate escalation**, not about attacking everyone who approaches.

## Design Pillars

- **Lowest effective response wins.** Observation, a gesture, or a clear direction should solve most situations.
- **People are not labels.** Clothes, props, credentials, and behavior tell the player what they need; internal NPC types stay in the debug overlay.
- **Every decision has a record.** Incidents, evidence, radio reports, and outcomes feed the shift review.
- **Emergency help is a last resort.** Responders handle crises the guard cannot safely manage; calling them has costs.
- **Readability beats raw fidelity.** The GL Compatibility renderer, clear silhouettes, the focus ring, and the HUD stay legible.

## Development Priorities

The active task order is in [`TODO.md`](TODO.md); the gap analysis and the release roadmap are
below. The current order is:

1. **0.9.9–0.9.12 patches.** Finish the character base (the accepted Quaternius 62-joint runtime),
   roll it out to the 12 roles, close the scheduled venue/prop/lighting polish, and verify
   performance, Web and accessibility.
2. **0.10.0 minor.** Public readiness: external playtests, balance acceptance, legal/storefront
   approval, the platform matrix and the documentation/picture lock.
3. **0.10.x patches → 0.11.0.** Content and systems depth: live body-camera replay, a fourth
   venue and the localization foundation.
4. **0.12.0 → 1.0.0.** Platform/distribution, content complete, release candidates and the stable
   release.

Versions are assigned only when a track's scope is accepted into a release (see
[Release Roadmap](#release-roadmap)). Unversioned tracks — the 3D review evidence base,
maintenance and the Gaussian-splatting study — do not receive a placeholder version.

## Plan Evaluation (2026-11-05)

The game plan itself is sound and largely built: three venues, the escalation ladder, access
artifacts, the radio/report system, the shift review and the campaign loop all exist and are
tested. What needed fixing was the **delivery plan**, not the design.

- **Character sourcing churned.** The project moved procedural → MakeHuman → Quaternius, and the
  Quaternius Stage-1 warp failed its own gate. That leaves a correct decision (ADR-0018) with a
  half-finished implementation. The plan now makes the rig correction one small version, gates the
  roster behind a face/readability decision, and keeps exactly one fallback.
- **One milestone carried too much.** The old 0.10.0 mixed character work, map work and every
  public-release gate, so one blocked export blocked the release. Character and venue polish are
  now patches; 0.10.0 is only the release gate.
- **Unversioned work had no deadline.** The 3D review backlog could grow without bound. It is now
  capped: the ranked venue/prop/lighting items are scheduled into 0.9.11, the budget checks into
  0.9.12, and everything else is an explicit accept or deferred. Gaussian splatting stays
  unscheduled because no product need justifies its risk yet.
- **Legal, signing and storefront work is release work, not polish.** It now has named checkboxes
  in 0.10.0 and 1.0.0 instead of living in prose.
- **What is deliberately not planned:** new genres or mechanics, a live-service model, or a
  runtime splat renderer. The de-escalation-first, rare-emergency design stays frozen.

Feasibility: the remaining character work is small in geometry terms (6.2k triangles against a
24k cap) and larger in rig/export terms; the venue work is polish; most release gates are
evidence gathering rather than engineering. The main schedule risk is external review and
approval, not code.

## Character Creation Re-Evaluation (2026-11-05)

**Where it stands.** The shipped library is 12 procedural Blender variants (4.7k–5.8k triangles
each) with a sculpted face, five tint slots and 18 gear pieces. The owner then chose the CC0
**Quaternius Ultimate Modular Characters** as the primary source. Stage 1 (warp the Quaternius
mesh onto the 13-core contract) failed its silhouette gate — arm ×1.63, leg ×0.74, torso ×1.61,
judged distorted. [ADR-0018](docs/adr/0018-quaternius-stage2-runtime-rig.md) therefore adopts the
source **62-joint rig at runtime**: no warp, source LOD (3,199 verts / 6,206 tris), source
Idle/Walk clips, and gear pivots re-derived from the Quaternius skeleton.

**What is already built.** The canonical `quaternius_base.glb` (welded, grounded, arm-down rest),
the 62→13 joint map, the material→five-slot map, the clip inventory (24 clips; Idle and Walk in
scope) and the `NpcAvatar` joint-name mapping with rest-derived gear pivots.

**What actually blocks it.** Two technical items about the export and the pose math, not the art:

1. the arm-down GLB renders in A-pose in Godot because the bake writes wrong inverse bind
   matrices; and
2. `_pose_bone()` composes rotations as `rest * Quaternion(axis, angle)`, which only cancels for
   the old 180° rest, not the Quaternius ~76° rest.

**Re-evaluation findings.**

- Triangle budget is not the problem (6.2k against a 24k cap). Do not decimate the source.
- **Face fidelity is the real risk.** The 0.9.7 library has a sculpted realistic face; the
  Quaternius head is low-poly. A blanket swap would regress every close-up. The plan therefore
  makes the owner choose at 0.9.9 between (a) a full swap, (b) Quaternius for crowd roles with the
  procedural library for named roles, or (c) extra head subdivision/hair cards on the Quaternius
  head.
- **Animation** becomes clip-driven, which removes the hand-built pose composition as the main
  path. Poses the clips do not cover (seated, raise-hand, head turn) must be decided explicitly
  rather than patched per scene.
- **One fallback, no third source.** The procedural `npc_base` and the MakeHuman head stay tested
  until the new base passes the gate. MPFB body work stays closed and the Stage-1 warp is not
  reopened. A new character source needs a new ADR.
- **Sequence matters.** Fix the rig first (0.9.9), then the roster (0.9.10). Rolling a broken rig
  across 12 variants would waste the whole pass.

**Reversal condition.** If the skin cannot be exported correctly without a new exporter path, or
if the owner rejects the low-poly face in every option, the plan falls back to the procedural
library and retires Quaternius with a recorded ADR. That decision is made at 0.9.9, not later.

## Core Gameplay Loop

1. Watch the entrance, steps, queue, and sidewalk.
2. Work out why each person is approaching.
3. Use a gesture or short direction before escalating.
4. Verify authorized access when the venue requires it.
5. Escalate only when the person refuses, forces entry, or presents a genuine threat.
6. Record the incident and call for help when it is justified.
7. Review the shift: safety, judgment, accuracy, crowd reaction, and reputation.

A shift lasts roughly 10–15 minutes. Most people comply when approached calmly.

## Access and Verification

Some people are authorized to enter. The guard may admit them by:

- recognizing a person the guard already knows; or
- verifying a venue-appropriate artifact: wristband, ID, ticket, credential, or guest list.

Artifacts can be valid, expired, counterfeit, mismatched, missing, or ambiguous. The player inspects the details the venue asks for instead of judging by appearance.

Decisions are admit, redirect, hold, or refuse. Incorrectly denying an authorized person hurts reputation; admitting an unauthorized person is a security failure. Recognition is a player decision and is recorded as evidence.

## Escalation Model

| Level | Player response | Intent |
| --- | --- | --- |
| 0 | Observation | Watch harmless behavior; intervene only when needed. |
| 1 | Simple deterrence / polite direction | Raise a hand, make eye contact, point to the sidewalk or check-in area, shake the head, give a short instruction. |
| 2 | Formal warning | State the rule and ask for compliance; optionally arm the body camera. |
| 3 | Blocking and positioning | Stand between the person and the door, secure the entrance, keep distance and an escape route, ask for their reason. |
| 4 | Radio for security assistance | Request a second guard, supervisor, building management, or other support. |
| 5 | Emergency response | Hold and confirm the emergency call only for an immediate threat such as a weapon, assault, forced entry, or serious threat to occupants. |

At Level 2 an NPC may leave, argue, pretend not to understand, record the guard, call someone, or move closer. At Level 3 the goal is to deny access **without starting a fight**. Physical contact creates legal, employment, and public-relations consequences.

At Level 4 the report matters: location, description, behavior, weapons seen, and immediate danger. Exaggerated reports damage credibility. At Level 5 the call may evacuate the building, close the street, trigger a review, cost reputation, or open an investigation if unjustified. Responders may command, restrain, evacuate, or arrest; they are not a routine stronger attack.

## NPC Behavior Types

- **Tourists:** take photos, sit on steps, drift toward restricted doors; usually respond well to polite directions.
- **Street performers:** may block stairs or argue when moved; can be redirected to a permitted area.
- **Influencers and filmmakers:** film the guard, test boundaries, and create public-relations risk.
- **Confused visitors:** may have appointments or genuinely believe the building is public; reward patient explanation.
- **Intoxicated pedestrians:** move unpredictably, ignore instructions, and need extra distance or assistance.
- **Trespassers:** test entrances, use distractions, and may return after being told to leave.
- **Violent threats:** rare, escalate quickly, and justify emergency response only when behavior shows immediate danger.
- **People in mental-health crisis:** may loiter, behave unpredictably, and respond poorly to aggression; require patience and careful de-escalation. The setting may refer to a 51/50 hold, but the game should present the person respectfully, not as an automatic threat.

## Special Systems

### Reputation

The shift evaluates peaceful resolutions, response time, radio accuracy, unnecessary confrontations, public complaints, property damage, entrance security, and whether assistance was justified. Calling armed help too often scores poorly even when no one is hurt.

### Evidence and Body Camera

Interactions are recorded automatically. The body camera is a real state the player can toggle; a formal warning also arms it. The shift review uses the recorded events and evidence to show whether the response was justified.

### Crowd Reaction

Nearby pedestrians react to the guard. Calm professionalism attracts little attention; aggression draws a crowd; visible weapons or responders can cause panic. Good de-escalation keeps the boulevard moving.

### Radio Limits

The emergency radio has a cooldown, and the call requires a short report. Assistance takes time to arrive, so the guard must keep monitoring the situation.

## Shift Structure

- **Early:** harmless tourists, delivery workers, people resting on the steps.
- **Midday:** heavier crowds, more entry attempts, more filming.
- **Evening:** lower light, more intoxicated pedestrians and aggressive groups.
- **Late:** a rare serious incident may test whether the player recognizes a real threat without overreacting to ordinary behavior.

## Outcomes

A successful shift keeps the building secure, resolves most incidents without force, keeps public access clear, makes justified emergency calls, avoids bystander injuries, and follows policy.

A poor shift involves excessive force, confronting innocent people, ignoring a real threat, false reports, allowing unauthorized entry, causing a crowd or panic, or behaving recklessly even if the door stayed locked.

## Venues

### El Capitan Entertainment Centre (6840 Hollywood Blvd)

The original scenario: the historic Masonic Temple / El Capitan Entertainment Centre, with six Ionic columns, eight stone steps, the Hollywood Walk of Fame sidewalk, neighbouring theatre and retail frontage, and the four-lane boulevard. Tourists, performers, influencers, confused visitors, intoxicated pedestrians, trespassers, people in crisis, and rare violent threats approach from the street.

Authorized people are recognized or present a valid wristband. Wristbands vary by color, pattern, date, and event marking, and may be valid, expired, counterfeit, or missing.

### The Joke Shop

A Sunset Strip comedy club inspired by The Comedy Store at 8433 Sunset Blvd: a
low black hall under a deep, signature-covered canopy, a circular blade sign,
red velvet curtains and the dry hillside rising behind it. The door person
checks IDs, tickets, reservations, guest-list status, and screens guests with a
handheld wand under venue policy.

The wand does **not** identify a weapon automatically. Keys, belts, and phones can trigger false alarms; the player must ask the guest to identify the item and apply procedure. A guest with valid credentials can still require assistance if they threaten staff or patrons.

Typical events:

- a busy weekend show creates a long line;
- a performer arrives through the guest entrance;
- a guest has a reservation but no ID;
- a fake or borrowed ID appears;
- a wand alert comes from keys or a belt;
- a guest refuses screening but insists on entering;
- someone tries to follow an authorized person through the door;
- a late audience member arrives during the performance.

Joke Shop escalation follows the common ladder: direction, explanation, repeat request, refusal, manager/security assistance, emergency only for immediate danger.

### Hollywood Boulevard Late Night TV Studio

A busy studio entrance at the same real El Capitan Entertainment Centre block as the Hollywood day shift, restaged for a late-night arrival: the same stone facade and steps with a bulb-lit canopy, a black car at the kerb and a barrier line. It has audience members, production staff, performers, guests, deliveries, celebrity arrivals, tourists, influencers, and the same range of street behavior as the building scenario.

Staff and guests are recognized or present a wristband, credential, ticket, guest-list confirmation, or other approved marker. The player keeps the steps clear, protects arrivals and equipment, manages filming boundaries, watches for tailgating, and calls for help only when there is immediate danger.

Typical events:

- a crowd gathers for a celebrity arrival;
- tourists block the entrance for photographs;
- a performer sets up in the audience queue;
- an influencer ignores the filming boundary;
- a confused visitor believes the studio is open;
- an intoxicated pedestrian approaches the stage door;
- a trespasser blends into an audience group;
- an authorized guest arrives without a wristband;
- someone presents a counterfeit credential;
- a violent threat appears during a crowded arrival.

## Presentation and Controls

The game is first-person: WASD and mouse look, a focus cone on nearby people, a billboarded focus circle, `Tab`/mouse-wheel cycling for aim-free selection, and a radial action menu opened with left click or `Space`. `Shift` is precision walk. Gamepad input is supported, and keys/buttons can be remapped in Settings.

The action wheel prioritizes de-escalation: Stop, Look, Point, No, Ask, Inspect, Wand, Warn, Block, Reason, Recognize, Radio. Emergency stays on `R` and is not a wheel slice. `W` is walk, never the wand; `C` is the optional wand shortcut.

The visual direction is readable stylized realism:

- **Character direction:** 12 skinned NPC variants, 18 gear pieces and 20 street/venue props. The active character track is the Quaternius base at runtime ([ADR-0018](docs/adr/0018-quaternius-stage2-runtime-rig.md)): the CC0 source mesh keeps its proportions on the 62-joint rig, Idle/Walk run as clips, and the procedural library stays as the tested fallback until the face/silhouette gate passes. See [Character Creation Re-Evaluation](#character-creation-re-evaluation-2026-11-05).
- **Realism pass:** AI-assisted per-phase skyline panoramas, v2 surface tiles with normal maps, wet asphalt at night, a warm day haze, phase-specific sun/exposure/fog, a tight flashlight spot (no beam geometry), and denser foliage.
- **Local map direction:** the venues are currently stylized reconstructions. The local-map track evaluates licensed OpenStreetMap/3D building data, licensed reference photography, AI-assisted composition and Gaussian splatting as a development tool; online data and splat rendering are not runtime dependencies.
- **References and QA:** runtime UI art lives in `assets/images/ui/`; reference/art-direction sets live in `docs/screens/designs/` and `docs/screens/concepts/`; captures live in `docs/screenshots/`; realism runs live in `docs/screens/realism/`. `screen_designs.py compare/judge` and `tools/check_screenshots.sh` guard drift.
- **Storage convention:** see [ADR-0014](docs/adr/0014-runtime-image-root.md). Never overwrite an existing image; new outputs get a new path or `-vN` suffix.

The active planning order — unversioned character and local-map development first, then the versioned 0.10.0 release-candidate hardening and later releases — is tracked in [`TODO.md`](TODO.md); this plan stays at the product/design level.

Primary decisions: [ADR-0007](docs/adr/0007-locomotion-and-input-layers.md), [ADR-0008](docs/adr/0008-cone-focus-and-head-ring.md), [ADR-0009](docs/adr/0009-radial-action-menu.md), [ADR-0010](docs/adr/0010-procedural-npc-presentation.md), [ADR-0011](docs/adr/0011-aim-free-selection-and-precision-walk.md), [ADR-0012](docs/adr/0012-surface-materials-and-generated-props.md), [ADR-0013](docs/adr/0013-blender-authored-npc-characters.md), [ADR-0015](docs/adr/0015-npc-model-variety-sourcing.md), [ADR-0017](docs/adr/0017-quaternius-npc-base.md).

## Tech Stack

- **Engine:** Godot 4.7.2, GL Compatibility renderer (Web parity); optional Forward+ Desktop HQ build.
- **Language:** GDScript.
- **Architecture:** venue-driven simulation; shared systems plus `Resource`-based scenario data.
- **Navigation:** `NavigationRegion3D` / `NavigationAgent3D`.
- **NPC behavior:** lightweight custom finite state machines driven by `NpcProfile` resources.
- **UI/audio:** Godot `Control` nodes, themes, procedural audio, and JSON-backed localized strings.
- **Persistence:** JSON in `user://` for settings and shift history.
- **Testing:** custom headless runner (`src/test/test_runner.gd`); GUT was evaluated and not adopted. Python tooling tests cover the asset/screenshot pipelines.
- **Source control/CI:** git on Gitea; `.gitea/workflows/build.yml` runs headless checks and builds/publishes releases on tags.
- **Targets:** Windows, Linux, macOS, and Web. Release artifacts include portables, an NSIS installer, an AppImage, a Web zip, and an optional Desktop HQ zip (Forward+ volumetric lighting; Vulkan required).

## Versioning and Delivery

`config/version` in `project.godot` is the single version source (currently `0.9.9`). Releases are tagged `v<version>`; the CI pipeline builds and publishes the standard artifacts plus the optional Desktop HQ zip. Version bumps follow [Semantic Versioning](https://semver.org/): every major, minor and patch increment needs a changelog entry, a local `tools/build_releases.sh` build, and artifact/checksum verification before tagging. Unversioned development tracks do not receive a version until their scope enters a release. See [`docs/process/RELEASING.md`](docs/process/RELEASING.md) and [`README.md`](README.md) for commands.

## Gap Analysis

**Published baseline:** v0.9.8 (2026-11-04) — three playable venues, tutorial/campaign/checkpoint
resume, the access/radio/escalation loop, shift review, the 12-character Blender library, 277
Godot + 162 Python tests, a 21/21 screen-design judge and Compatibility/Web/Desktop HQ builds.

**Current source:** 0.9.8. The 0.10.0-rc.1 package built on 2026-11-03 is stale and is superseded
by the patch sequence below; it is not a published release.

| Area | Remaining gap | Milestone |
| --- | --- | --- |
| Character base | Quaternius arm-down skin export, rest-relative pose composition, face/silhouette acceptance | 0.9.9 |
| Character roster | 12-role mapping, modular outfits, gear fit, AO/texels, budget evidence | 0.9.10 |
| Venue and asset polish | Ranked prop/foliage/lighting/set-dressing fixes, collider verification | 0.9.11 |
| Performance and Web | Frame/memory/load evidence after the content changes, LOD/impostor verification | 0.9.12 |
| Onboarding and balance | External first-time-player evidence, balance sweeps/tuning, content lock | 0.10.0 |
| Accessibility and localization | Acceptance pass, caption coverage, pseudo-locale/length checks | 0.9.12 / 0.10.0 |
| QA and release engineering | Full smoke matrix, clean build/checksum verification, target-matrix launches | 0.10.0 |
| Legal, signing, storefront | macOS signing/notarization, AI-provider rights, storefront/rating approval, privacy sign-off | 0.10.0 / 0.12.0 |
| Systems and content depth | Live incident replay, fourth venue, localization foundation | 0.11.0 |
| Distribution | Signed storefront builds, frozen save contract, launch languages, hardware matrix | 0.12.0 |
| Stable release | Content complete, accessibility audit, release candidates, 1.0.0 decision | 0.13.0 / 1.0.0 |
| Future | More venues/seasonal content, image-to-mesh props, other deferred ideas | Unscheduled |

The 0.9.3 UI, 0.9.4 animation, 0.9.5 texture, 0.9.6 integration, 0.9.7 character development and
0.9.8 deformation fixes are complete in [`DONE.md`](DONE.md); they are not remaining gaps. The
2026-11-01 documentation audit is also closed.

## Release Roadmap

Every version below follows the release procedure in `AGENTS.md`. Patch versions contain fixes and
polish; minor versions add user-facing features; the major version is the stable release with a
compatibility promise. Each version's executable checklist is in [`TODO.md`](TODO.md).

### Roadmap to 0.10.0

The goal of this line is to finish the character and venue work and clear every public-release
gate. The character track is versioned rather than unversioned so a blocked rig cannot hold the
whole release.

| Version | Type | Scope | Exit criterion |
| --- | --- | --- | --- |
| 0.9.9 | patch | Quaternius pilot: correct skin export, rest-relative pose math, Idle/Walk verification, owner face/silhouette gate, one-role (or crowd-only) rollout | A Quaternius NPC renders and animates correctly and ships behind a tested procedural fallback |
| 0.9.10 | patch | 12-role roster, modular outfits, five slots, AO/texels, gear fit, 12×6 baseline | The full roster passes contract, gear, budget and owner-baseline gates |
| 0.9.11 | patch | Scheduled 3D review fixes: props/foliage, gear silhouette, venue shape language, lighting, set dressing, colliders | Every scheduled P1/P2 item is fixed or accepted with a measurement |
| 0.9.12 | patch | Performance/Web/LOD/memory verification plus accessibility and pseudo-locale checks | No regression against the pre-character baselines |
| 0.10.0 | minor | Public readiness: external playtests, balance acceptance, legal/storefront/signing decisions, platform matrix, docs and picture lock | 0.10.0 is content-locked, externally played, legally reviewed, documented and reproducibly built |

### Roadmap to 0.11.0

This line turns a stable 0.10.x into a deeper game: the incident timeline becomes a live replay, a
fourth venue enters the campaign, and the text catalogue becomes a real localization pipeline.

| Version | Type | Scope | Exit criterion |
| --- | --- | --- | --- |
| 0.10.1 | patch | Onboarding and accessibility issues deferred from the 0.10.0 playtests | First-hour and accessibility defects closed |
| 0.10.2 | patch | Balance/fairness sweeps, review-text and difficulty-progression tuning | Every balance-acceptance cell is in target or explicitly accepted |
| 0.10.3 | patch | Save/checkpoint edge cases, gamepad/remap, pause/resume, small quality-of-life fixes | No known P1 stability defect remains |
| 0.11.0 | minor | Live body-camera replay, fourth venue (candidate: TCL Chinese Theatre forecourt), localization foundation with one secondary language | The new systems ship without regressing performance, accessibility or balance |

### Roadmap to 1.0.0

This line is about distribution, contracts and completeness: signed builds on the launch stores, a
frozen save format, finished content and release candidates.

| Version | Type | Scope | Exit criterion |
| --- | --- | --- | --- |
| 0.11.1 | patch | Replay/venue/localization fixes from wider play | No P1 defect in the 0.11.0 feature set |
| 0.11.2 | patch | New-venue balance, campaign pacing and content readability | The 0.11.x line is stable enough to freeze its contracts |
| 0.12.0 | minor | macOS signing/notarization, storefront packages/metadata/ratings, save-format v2 freeze, hardware matrix, launch languages | Signed, storefront-ready builds exist on every launch platform |
| 0.12.1 | patch | Signing, installer, metadata and save-migration fixes from storefront dry runs | Every storefront build installs, launches and migrates cleanly |
| 0.13.0 | minor | Content complete: all planned venues/events/dialogue, audio decision, final tutorial, accessibility audit, balance freeze | All planned content is implemented and frozen |
| 0.13.1 | patch | Release candidate 1: full smoke/performance/save/accessibility matrix | A candidate passes every gate except final approval |
| 0.13.2 | patch | Release candidate 2: verify fixes, freeze release notes/credits/privacy/known limitations | The final candidate is reproducible and documented |
| 1.0.0 | major | Stable release: legal/storefront/rating approval, hardware/accessibility/localization sign-off, no P0/P1, publish on every platform | 1.0.0 is published with verified checksums and no open blocker |

## Roadmap Dependencies and Risks

- Content volume is the largest schedule risk; tutorial and campaign work must not outrun the
  event/dialogue matrix.
- The vision judge is a dev-time aid with an external key and budget; CI must never make it a hard
  gate.
- Godot engine changes can alter lighting and imports; do not combine an engine baseline move with
  a content or feature milestone.
- Signed macOS builds, AI provenance and storefront approval are release blockers, not polish.
- The character pipeline is the current critical path. The rig/export fix must be proven on one
  variant before the roster rollout; otherwise 0.9.10 multiplies a defect.
- Photo-derived map assets add a provenance risk: downloaded or user-supplied photos can carry
  unclear licences, identifiable people, plates and property restrictions. No photo- or
  splat-derived asset ships without a completed sidecar, consent/licence review and redaction.
- Gaussian-splat training is GPU/disk-heavy and the toolchain churns; keep it offline,
  version-pinned and outside CI, and never make a runtime splat renderer a release dependency.
- The Blender skill pack is local, unversioned guidance; it can drift from the project contract or
  assume Blender MCP. Re-verify every adopted technique with `inspect`/`audit`/`fit` and never make
  a skill, asset pack or tool version a build or CI dependency.
- The 3D re-evaluation can expand without bound. Cap it with the scorecard ranking: P0/P1 only, one
  asset family per commit, and an explicit accept for everything else.
- Keep the de-escalation-first rules and rare-emergency design unchanged while adding progression,
  difficulty and feedback.

## Design Direction

The game should feel like a tense workplace simulation with occasional crisis moments. The most satisfying outcome is not overpowering an NPC; it is recognizing the situation early and resolving it calmly.

> **The player wins by choosing the lowest level of escalation that keeps everyone safe.**

## Future Ideas

- A rare Bob Dobbs cameo (Easter-egg appearance; placement note in `MEMORY.md`).
- Specific unusual NPC behaviors, such as slapping their own face, using hands as scissors, or interacting with props unexpectedly.
- A fifth venue or seasonal events after the 0.11.0 fourth venue proves the venue pipeline.
- Real voice/dialogue audio if the 0.13.0 audio decision does not fund it; an image-to-mesh prop pipeline remains unscheduled.