diff --git a/.codex/superpowers/plans/2026-07-19-sdc-combat-exchange.md b/.codex/superpowers/plans/2026-07-19-sdc-combat-exchange.md
new file mode 100644
index 0000000..c5ec05e
--- /dev/null
+++ b/.codex/superpowers/plans/2026-07-19-sdc-combat-exchange.md
@@ -0,0 +1,3179 @@
+# S.D.C. Combat Exchange Implementation Plan
+
+> **For agentic workers:** REQUIRED SUB-SKILL: Use superpowers:subagent-driven-development (recommended) or superpowers:executing-plans to implement this plan task-by-task. Steps use checkbox (`- [ ]`) syntax for tracking.
+
+**Goal:** Deliver issue #44 as a rules-faithful, persisted, two-phase S.D.C. combat exchange: the server rolls a declared strike, the defender/GM chooses an authorized response after seeing it, and Convex resolves and applies the result atomically.
+
+**Architecture:** Add a page-stamped pure `combat-exchange` layer above the existing `resolveStrike` primitive, then expose it through a discriminated Convex exchange ledger and a focused SolidJS command-rail panel. The client submits choices and context only; the server reloads and re-derives both characters, owns all dice, verifies combat-state tokens, routes damage, and persists the character write plus immutable outcome in one mutation.
+
+**Tech Stack:** TypeScript, Zod, JSON rules content, Convex 1.42, SolidJS 1.9, Tailwind CSS 4, Vite+ (`vp`), Vite+ Test, pnpm 11.
+
+## Global Constraints
+
+- Work directly in `D:\Projects\riftforge` on branch `feat/sdc-combat-exchange`; do not create a worktree.
+- Treat `.codex/superpowers/specs/2026-07-19-sdc-combat-exchange-design.md` as the approved product and rules contract.
+- Treat rendered RUE pages 287, 288, 339-341, 344-346, 355, and 360-361 as the rules authority. Do not add a Natural A.R. branch: rendered p.339 explicitly says Natural A.R. does not apply in Rifts.
+- Keep this slice S.D.C.-only. Refuse M.D. weapons and nondepleted M.D.C. protection before rolling dice or inserting an exchange. Full M.D.C. resolution is a separate issue.
+- Preserve the production item catalog as transcribed. It currently contains no S.D.C. armor, so exercise that generic route with validated pure fixtures instead of inventing content.
+- Keep `resolveStrike(input)` as the low-level opposed-roll primitive. New orchestration belongs in `engine/combat-exchange.ts`.
+- Keep rules functions pure and deterministic. They consume derived sheets, explicit context, completed rolls, and completed damage rolls; only Convex calls `Math.random` and writes state.
+- Do not add initiative, rounds, action-budget enforcement, authentication/ownership, VTT geometry, cover, bursts, called shots, hit locations, thrown modes, unarmed attacks, or generic spell attacks.
+- Keep the current `characters.applyDamage` mutation as a manual GM utility. The hostile exchange path must never accept a client-selected damage route or delegate to that public mutation.
+- Use `ConvexError` data with stable codes for expected backend refusals. Do not make the web client parse English error strings to decide behavior.
+- Query through indexes and hard limits. Use 50 for target discovery and 20 for each pending/recent ledger feed.
+- Parameterized character routes do not remount. Reset all combat drafts on route-ID change and accept an async result only when its captured route epoch and exchange ID still own it.
+- Use Vite+ commands, not plain Vite. In `packages/backend`, use `pnpm exec`, never `npx`.
+- Follow red -> green -> refactor for each production change. Observe every named focused test fail before implementing it.
+- Checkpoint-commit after every task. Do not add AI attribution to commits, issues, comments, or PRs. Never commit to `main`, merge the PR, or close #44 manually.
+- Run affected-package gates before root gates. Root `vp check` does not replace the per-package CI gates.
+
+### Frontend direction
+
+- **Visual thesis:** A compact hostile-action console embedded in the existing Ley Terminal right rail: amber for unresolved machine prompts, blood red for applied harm, green for a legal defense or settled safe state, and no ley cyan because combat is not magic.
+- **Content plan:** `DECLARE ATTACK` is the primary work surface, `INCOMING` is the response queue, `OUTGOING` is the cancel/awaiting queue, and `RECENT` is the bounded persisted audit trail. Each section has one action and uses dividers rather than a dashboard-card mosaic.
+- **Interaction thesis:** Reuse the existing short strike-flash for newly resolved results, preserve the telemetry cursor for ambient live state, and keep form/route transitions immediate and restrained. Add no animation library and no decorative motion.
+- Follow `DESIGN.md`: notched geometry, current type system, compact 4px spacing rhythm, native labels, amber focus, no rounded corners, no painted imagery, and no cyan in this feature.
+
+---
+
+## File Map
+
+### New files
+
+- `packages/rules/src/schema/combat-exchange.ts` - attack/context/response enums, reasoned-modifier validation, error-code vocabulary, and page-stamped exchange-rule schema.
+- `packages/rules/src/content/combat/combat-exchange.json` - rendered-page citations, melee/ranged target totals, and ranged dodge penalties.
+- `packages/rules/src/engine/combat-exchange.ts` - attack profiles, authorized defenses, protection classification, pure resolution/routing, and deterministic combat-state tokens.
+- `packages/rules/tests/combat-exchange.test.ts` - the full pure truth table, including future-ready S.D.C. armor fixtures.
+- `packages/backend/convex/character_state.ts` - shared character load/validate/patch and expected-item helpers extracted without behavior changes.
+- `packages/backend/convex/combat_values.ts` - reusable Convex validators for contexts, rolls, response options, and the discriminated ledger document.
+- `packages/backend/convex/combat.ts` - bounded combat queries plus declare/respond/cancel mutations.
+- `packages/backend/tests/combat.test.ts` - Convex ledger, mutation, atomicity, stale-token, and boundary tests.
+- `apps/web/src/lib/combat-exchange.ts` - pure selector/presentation helpers and async ownership-token helpers.
+- `apps/web/tests/combat-exchange.test.ts` - weapon/target presentation, history formatting, tones, and ownership tests.
+- `apps/web/src/components/combat-exchange-panel.tsx` - the declare/incoming/outgoing/recent command-rail workflow.
+
+### Modified files
+
+- `packages/rules/src/engine/combat.ts` - expose explicit Hand-to-Hand and automatic-dodge capability plus ranged-defense totals that exclude ordinary H2H dodge.
+- `packages/rules/src/engine/character.ts` - project the additive combat-profile fields onto the sheet.
+- `packages/rules/src/index.ts` - export the new schema, content boundary, engine types, and helpers.
+- `packages/rules/tests/combat.test.ts` - pin capability and ranged-defense derivation.
+- `packages/rules/tests/character.test.ts` - update the complete sheet projection.
+- `packages/backend/convex/characters.ts` - consume the extracted shared state helpers.
+- `packages/backend/convex/schema.ts` - register `combatExchanges` and its four indexes.
+- `packages/backend/convex/_generated/api.d.ts` - generated `combat` module reference.
+- `packages/backend/convex/_generated/dataModel.d.ts` - regenerated model derived from the expanded schema.
+- `apps/web/src/components/ui.tsx` - add a design-system-consistent native select primitive.
+- `apps/web/src/components/telemetry-rail.tsx` - make the telemetry body a section inside the new single right-rail landmark.
+- `apps/web/src/pages/character-sheet.tsx` - mount the combat panel above telemetry actions and forward concise telemetry lines.
+- `README.md` - replace the now-stale statement that A.R./hostile persistence remain entirely future work, while retaining the explicit M.D.C. boundary.
+- `.codex/superpowers/specs/2026-07-19-sdc-combat-exchange-design.md` - record implementation and verification outcome after all gates and live checks pass.
+- `.codex/superpowers/plans/2026-07-19-sdc-combat-exchange.md` - check completed steps and add final time-scoped evidence during execution.
+
+---
+
+### Task 1: Page-Stamped Exchange Constants and Explicit Combat Capabilities
+
+**Files:**
+
+- Create: `packages/rules/src/schema/combat-exchange.ts`
+- Create: `packages/rules/src/content/combat/combat-exchange.json`
+- Modify: `packages/rules/src/engine/combat.ts`
+- Modify: `packages/rules/src/engine/character.ts`
+- Modify: `packages/rules/src/index.ts`
+- Modify: `packages/rules/tests/combat.test.ts`
+- Modify: `packages/rules/tests/character.test.ts`
+- Create: `packages/rules/tests/combat-exchange.test.ts`
+
+**Interfaces:**
+
+```ts
+export const attackKindSchema = z.enum(["melee", "ranged"]);
+export type AttackKind = z.infer<typeof attackKindSchema>;
+
+export const rangeBandSchema = z.enum(["pointBlank", "close", "normal"]);
+export type RangeBand = z.infer<typeof rangeBandSchema>;
+
+export const parryModeSchema = z.enum(["unavailable", "standard", "bareHanded"]);
+export type ParryMode = z.infer<typeof parryModeSchema>;
+
+export const combatResponseKindSchema = z.enum(["parry", "dodge", "autoDodge", "none"]);
+export type CombatResponseKind = z.infer<typeof combatResponseKindSchema>;
+
+export const combatExchangeErrorCodeSchema = z.enum([
+  "selfTarget",
+  "attackerNotReady",
+  "defenderNotReady",
+  "weaponMissingOrChanged",
+  "unsupportedWeaponMode",
+  "unsupportedMdWeapon",
+  "unsupportedMdcProtection",
+  "invalidContext",
+  "modifierReasonRequired",
+  "illegalDefense",
+  "exchangeNotPending",
+  "combatStateChanged",
+  "characterMissing",
+]);
+export type CombatExchangeErrorCode = z.infer<typeof combatExchangeErrorCodeSchema>;
+
+export const combatExchangeRulesSchema = z.object({
+  book: z.string().min(1),
+  pages: z.object({
+    armorAndVitals: z.literal(287),
+    sdcCombat: z.literal(339),
+    defense: z.literal(340),
+    damage: z.literal(341),
+    automaticDodge: z.literal(344),
+    modernWeapons: z.literal(360),
+    rangedDodging: z.literal(361),
+  }),
+  minimumStrikeTotal: z.object({ melee: z.literal(5), ranged: z.literal(8) }),
+  rangedDodgeModifier: z.object({
+    pointBlank: z.literal(-10),
+    close: z.literal(-5),
+    normal: z.literal(0),
+  }),
+});
+export type CombatExchangeRules = z.infer<typeof combatExchangeRulesSchema>;
+```
+
+Extend `CombatProfile` additively with:
+
+```ts
+handToHandType: string;
+hasHandToHandTraining: boolean;
+hasAutoDodge: boolean;
+rangedDodge: number;
+rangedAutoDodge: number;
+```
+
+`rangedDodge` is the P.P. dodge bonus only. `rangedAutoDodge` is that same P.P. bonus when the character has automatic-dodge capability, otherwise zero. Neither includes ordinary H2H dodge nor the H2H `autoDodge` modifier; this preserves the p.361 ranged restriction. Future structured O.C.C. bonuses can be added at this named seam.
+
+- [x] **Step 1: Add failing constants and combat-profile assertions**
+
+Create `packages/rules/tests/combat-exchange.test.ts` with the constants assertion:
+
+```ts
+import { describe, expect, test } from "vite-plus/test";
+import { combatExchangeRules } from "../src/index.ts";
+
+describe("combat exchange constants", () => {
+  test("loads rendered-page S.D.C. combat values", () => {
+    expect(combatExchangeRules).toEqual({
+      book: "Rifts Ultimate Edition",
+      pages: {
+        armorAndVitals: 287,
+        sdcCombat: 339,
+        defense: 340,
+        damage: 341,
+        automaticDodge: 344,
+        modernWeapons: 360,
+        rangedDodging: 361,
+      },
+      minimumStrikeTotal: { melee: 5, ranged: 8 },
+      rangedDodgeModifier: { pointBlank: -10, close: -5, normal: 0 },
+    });
+  });
+});
+```
+
+Append to `packages/rules/tests/combat.test.ts`:
+
+```ts
+test("makes training and ranged-defense capability explicit", () => {
+  const untrained = combatProfile({ attributes: { PP: 20 }, hthType: "none", level: 1 });
+  expect(untrained).toMatchObject({
+    handToHandType: "none",
+    hasHandToHandTraining: false,
+    hasAutoDodge: false,
+    rangedDodge: 3,
+    rangedAutoDodge: 0,
+  });
+
+  const commando = combatProfile({ attributes: { PP: 20 }, hthType: "commando", level: 15 });
+  expect(commando).toMatchObject({
+    handToHandType: "commando",
+    hasHandToHandTraining: true,
+    hasAutoDodge: true,
+    dodge: 7,
+    autoDodge: 8,
+    rangedDodge: 3,
+    rangedAutoDodge: 3,
+  });
+});
+```
+
+Update the exact object assertion in `packages/rules/tests/character.test.ts` to require the five new fields for the level-1 Basic H2H sheet.
+
+- [x] **Step 2: Run the focused tests and observe the missing exports/fields**
+
+Run:
+
+```text
+vp test packages/rules/tests/combat-exchange.test.ts packages/rules/tests/combat.test.ts packages/rules/tests/character.test.ts
+```
+
+Expected: FAIL because `combatExchangeRules` and the five profile fields do not exist.
+
+- [x] **Step 3: Add the schema and page-stamped content**
+
+Create `packages/rules/src/content/combat/combat-exchange.json` exactly as asserted above. Add the enums and `combatExchangeRulesSchema` to `packages/rules/src/schema/combat-exchange.ts`. Parse the JSON at module load in the initial `packages/rules/src/engine/combat-exchange.ts`:
+
+```ts
+import combatExchangeRaw from "../content/combat/combat-exchange.json" with { type: "json" };
+import { combatExchangeRulesSchema } from "../schema/combat-exchange.ts";
+
+export const combatExchangeRules = combatExchangeRulesSchema.parse(combatExchangeRaw);
+```
+
+- [x] **Step 4: Derive the explicit profile fields**
+
+In `combatProfile`, calculate the capability booleans from the H2H ID/raw bonus and return:
+
+```ts
+const hasAutoDodge = hth.autoDodge !== undefined;
+const rangedDodge = attr.dodge ?? 0;
+```
+
+Add `handToHandType: input.hthType`, `hasHandToHandTraining`, `hasAutoDodge`,
+`rangedDodge`, and `rangedAutoDodge: hasAutoDodge ? rangedDodge : 0` to the
+existing returned object without removing or redefining any current field.
+
+Do not remove or redefine the existing `dodge` and `autoDodge` totals.
+
+- [x] **Step 5: Export the new public surface and pass the focused tests**
+
+Add to `packages/rules/src/index.ts`:
+
+```ts
+export * from "./schema/combat-exchange.ts";
+export * from "./engine/combat-exchange.ts";
+```
+
+Run the Step 2 command again. Expected: PASS.
+
+- [x] **Step 6: Run the rules gate and commit**
+
+Run:
+
+```text
+vp run @riftforge/rules#check
+vp run @riftforge/rules#test
+```
+
+Expected: PASS.
+
+Commit:
+
+```text
+git add -- packages/rules/src/schema/combat-exchange.ts packages/rules/src/content/combat/combat-exchange.json packages/rules/src/engine/combat-exchange.ts packages/rules/src/engine/combat.ts packages/rules/src/engine/character.ts packages/rules/src/index.ts packages/rules/tests/combat-exchange.test.ts packages/rules/tests/combat.test.ts packages/rules/tests/character.test.ts
+git commit -m "feat(rules): model S.D.C. combat capabilities"
+```
+
+---
+
+### Task 2: Reasoned Context Validation and Weapon Attack Profiles
+
+**Files:**
+
+- Modify: `packages/rules/src/schema/combat-exchange.ts`
+- Modify: `packages/rules/src/engine/combat-exchange.ts`
+- Modify: `packages/rules/tests/combat-exchange.test.ts`
+
+**Interfaces:**
+
+```ts
+export type CombatContext =
+  | {
+      kind: "melee";
+      defenderAware: boolean;
+      parryMode: ParryMode;
+      strikeModifier?: number;
+      strikeModifierReason?: string;
+    }
+  | {
+      kind: "ranged";
+      defenderAware: boolean;
+      rangeBand: RangeBand;
+      strikeModifier?: number;
+      strikeModifierReason?: string;
+    };
+
+export interface ModifierSource {
+  source: "attribute" | "handToHand" | "proficiency";
+  label: string;
+  value: number;
+}
+
+export interface WeaponInstanceSnapshot {
+  index: number;
+  itemId: string;
+  worn?: boolean;
+  rolledMdc?: number;
+}
+
+export type AttackProfile =
+  | {
+      supported: false;
+      reason: "weaponMissingOrChanged" | "unsupportedWeaponMode" | "unsupportedMdWeapon";
+      weapon?: WeaponInstanceSnapshot & { name: string };
+    }
+  | {
+      supported: true;
+      kind: AttackKind;
+      minimumStrikeTotal: number;
+      strikeBonus: number;
+      strikeBonusSources: ModifierSource[];
+      proficiencyBonus: number;
+      damageFormula: string;
+      damageBonus: number;
+      criticalOn: number;
+      damageType: "sdc";
+      weapon: WeaponInstanceSnapshot & { name: string; category: WeaponCategory };
+    };
+
+export function deriveAttackProfile(sheet: CharacterSheet, weaponIndex: number): AttackProfile;
+export function validateCombatContext(
+  profile: Extract<AttackProfile, { supported: true }>,
+  input: unknown,
+): CombatContext;
+```
+
+`combatContextSchema` is a discriminated Zod union. `strikeModifier` is optional and defaults semantically to zero; when nonzero it must be a safe integer from -100 through +100 and `strikeModifierReason` must contain non-whitespace text. Context kind must equal the server-derived attack kind.
+
+- [x] **Step 1: Add failing profile and validation tests**
+
+Build sheets with `deriveSheet` and real catalog entries. Cover these exact cases:
+
+```ts
+test("classifies real S.D.C. melee and firearm instances", () => {
+  const sheet = combatSheet({
+    items: [{ itemId: "survival-knife" }, { itemId: "automatic-pistol" }],
+  });
+  expect(deriveAttackProfile(sheet, 0)).toMatchObject({
+    supported: true,
+    kind: "melee",
+    minimumStrikeTotal: 5,
+    strikeBonus: 3,
+    damageFormula: "1D6",
+    damageBonus: 1,
+    criticalOn: 20,
+    damageType: "sdc",
+  });
+  expect(deriveAttackProfile(sheet, 1)).toMatchObject({
+    supported: true,
+    kind: "ranged",
+    minimumStrikeTotal: 8,
+    strikeBonus: 0,
+    proficiencyBonus: 0,
+    damageFormula: "4D6",
+    damageBonus: 0,
+    criticalOn: 20,
+    damageType: "sdc",
+  });
+});
+
+test("refuses M.D. weapons and non-weapons without inventing modes", () => {
+  const sheet = combatSheet({
+    items: [{ itemId: "wilks-320-laser-pistol" }, { itemId: "canteen" }],
+  });
+  expect(deriveAttackProfile(sheet, 0)).toMatchObject({
+    supported: false,
+    reason: "unsupportedMdWeapon",
+  });
+  expect(deriveAttackProfile(sheet, 1)).toMatchObject({
+    supported: false,
+    reason: "unsupportedWeaponMode",
+  });
+  expect(deriveAttackProfile(sheet, 99)).toEqual({
+    supported: false,
+    reason: "weaponMissingOrChanged",
+  });
+});
+
+test("requires reasons for nonzero GM modifiers and rejects kind mismatch", () => {
+  const profile = requireSupported(
+    deriveAttackProfile(combatSheet({ items: [{ itemId: "survival-knife" }] }), 0),
+  );
+  expect(() =>
+    validateCombatContext(profile, {
+      kind: "melee",
+      defenderAware: true,
+      parryMode: "standard",
+      strikeModifier: 1,
+    }),
+  ).toThrow(/reason/i);
+  expect(() =>
+    validateCombatContext(profile, {
+      kind: "ranged",
+      defenderAware: true,
+      rangeBand: "normal",
+    }),
+  ).toThrow(/kind/i);
+});
+```
+
+The test-local `combatSheet` helper must use a complete valid level-1 Ley Line Walker input with rolled H.P./S.D.C.; it must not cast an arbitrary object to `CharacterSheet`.
+
+- [x] **Step 2: Run the focused test and observe missing functions**
+
+Run: `vp test packages/rules/tests/combat-exchange.test.ts`
+
+Expected: FAIL because attack-profile and context functions are missing.
+
+- [x] **Step 3: Implement schemas and the category/tier classifier**
+
+Map `knife` and `axe` to `melee`; map `handgun`, `submachineGun`, `energyPistol`, and `energyRifle` to `ranged`; then refuse any weapon whose damage type is `md`. Do not infer a thrown mode from a knife or axe.
+
+For melee sources, record P.P. strike and ordinary H2H strike separately from `sheet.attributeBonuses` and `sheet.combat.handToHandBonuses`. For ranged sources, include only the specifically named `strikeGuns` H2H value plus a typed proficiency source fixed at zero. Sum the sources to the returned `strikeBonus`.
+
+Add this implementation to `engine/combat-exchange.ts` (with the interface
+definitions from this task):
+
+```ts
+const meleeCategories = new Set<WeaponCategory>(["knife", "axe"]);
+
+function weaponSnapshot(
+  entry: SheetEquipmentEntry,
+  index: number,
+): WeaponInstanceSnapshot & { name: string } {
+  return {
+    index,
+    itemId: entry.item.id,
+    name: entry.item.name,
+    ...(entry.worn === true ? { worn: true } : {}),
+    ...(entry.rolledMdc === undefined ? {} : { rolledMdc: entry.rolledMdc }),
+  };
+}
+
+export function deriveAttackProfile(sheet: CharacterSheet, weaponIndex: number): AttackProfile {
+  const entry = Number.isInteger(weaponIndex) ? sheet.equipment[weaponIndex] : undefined;
+  if (entry === undefined) return { supported: false, reason: "weaponMissingOrChanged" };
+  const snapshot = weaponSnapshot(entry, weaponIndex);
+  if (entry.item.kind !== "weapon") {
+    return { supported: false, reason: "unsupportedWeaponMode", weapon: snapshot };
+  }
+  if (entry.item.damage.type === "md") {
+    return { supported: false, reason: "unsupportedMdWeapon", weapon: snapshot };
+  }
+
+  const kind: AttackKind = meleeCategories.has(entry.item.category) ? "melee" : "ranged";
+  const strikeBonusSources: ModifierSource[] =
+    kind === "melee"
+      ? [
+          { source: "attribute", label: "P.P.", value: sheet.attributeBonuses.strike ?? 0 },
+          {
+            source: "handToHand",
+            label: "Hand-to-Hand",
+            value: sheet.combat.handToHandBonuses.strike ?? 0,
+          },
+        ]
+      : [
+          {
+            source: "handToHand",
+            label: "Gun-specific Hand-to-Hand",
+            value: sheet.combat.handToHandBonuses.strikeGuns ?? 0,
+          },
+          { source: "proficiency", label: "Modern W.P.", value: 0 },
+        ];
+  return {
+    supported: true,
+    kind,
+    minimumStrikeTotal: combatExchangeRules.minimumStrikeTotal[kind],
+    strikeBonus: strikeBonusSources.reduce((sum, source) => sum + source.value, 0),
+    strikeBonusSources,
+    proficiencyBonus: 0,
+    damageFormula: entry.item.damage.formula,
+    damageBonus: kind === "melee" ? sheet.combat.damageBonus : 0,
+    criticalOn: kind === "melee" ? sheet.combat.criticalStrikeOn : 20,
+    damageType: "sdc",
+    weapon: { ...snapshot, category: entry.item.category },
+  };
+}
+```
+
+- [x] **Step 4: Implement context normalization**
+
+Parse with the discriminated schema, compare `context.kind` to `profile.kind`, normalize omitted modifiers to zero at use sites, and keep the submitted reason for history. Reject non-safe integers, values outside -100..100, and blank required reasons.
+
+Add to `schema/combat-exchange.ts`:
+
+```ts
+const safeModifierSchema = z.number().int().safe().min(-100).max(100).optional();
+const modifierReasonSchema = z.string().trim().min(1).optional();
+const rawCombatContextSchema = z.discriminatedUnion("kind", [
+  z.object({
+    kind: z.literal("melee"),
+    defenderAware: z.boolean(),
+    parryMode: parryModeSchema,
+    strikeModifier: safeModifierSchema,
+    strikeModifierReason: modifierReasonSchema,
+  }),
+  z.object({
+    kind: z.literal("ranged"),
+    defenderAware: z.boolean(),
+    rangeBand: rangeBandSchema,
+    strikeModifier: safeModifierSchema,
+    strikeModifierReason: modifierReasonSchema,
+  }),
+]);
+
+export const combatContextSchema = rawCombatContextSchema.superRefine((context, check) => {
+  if ((context.strikeModifier ?? 0) !== 0 && context.strikeModifierReason === undefined) {
+    check.addIssue({
+      code: "custom",
+      path: ["strikeModifierReason"],
+      message: "A reason is required for a nonzero strike modifier.",
+    });
+  }
+});
+export type CombatContext = z.infer<typeof combatContextSchema>;
+```
+
+Add to `engine/combat-exchange.ts`:
+
+```ts
+export function validateCombatContext(
+  profile: Extract<AttackProfile, { supported: true }>,
+  input: unknown,
+): CombatContext {
+  const context = combatContextSchema.parse(input);
+  if (context.kind !== profile.kind) {
+    throw new Error(
+      `invalidContext: ${context.kind} context cannot resolve ${profile.kind} attack.`,
+    );
+  }
+  return context;
+}
+```
+
+- [x] **Step 5: Pass focused/package tests and commit**
+
+Run:
+
+```text
+vp test packages/rules/tests/combat-exchange.test.ts
+vp run @riftforge/rules#check
+vp run @riftforge/rules#test
+```
+
+Expected: PASS.
+
+Commit:
+
+```text
+git add -- packages/rules/src/schema/combat-exchange.ts packages/rules/src/engine/combat-exchange.ts packages/rules/tests/combat-exchange.test.ts
+git commit -m "feat(rules): derive supported S.D.C. attacks"
+```
+
+---
+
+### Task 3: Engine-Authorized Defense Options
+
+**Files:**
+
+- Modify: `packages/rules/src/schema/combat-exchange.ts`
+- Modify: `packages/rules/src/engine/combat-exchange.ts`
+- Modify: `packages/rules/tests/combat-exchange.test.ts`
+
+**Interfaces:**
+
+```ts
+export interface DefenseOption {
+  kind: CombatResponseKind;
+  bonus: number;
+  actionCost: 0 | 1;
+  explanation: string;
+}
+
+export interface CombatResponseInput {
+  kind: CombatResponseKind;
+  defenseModifier?: number;
+  defenseModifierReason?: string;
+}
+
+export interface AuthorizedCombatResponse extends DefenseOption {
+  defenseModifier: number;
+  defenseModifierReason?: string;
+  totalBonus: number;
+}
+
+export function deriveDefenseOptions(
+  defender: CharacterSheet,
+  attack: Extract<AttackProfile, { supported: true }>,
+  context: CombatContext,
+): DefenseOption[];
+
+export function authorizeCombatResponse(
+  options: readonly DefenseOption[],
+  input: unknown,
+): AuthorizedCombatResponse;
+```
+
+- [x] **Step 1: Add the failing defense truth table**
+
+Cover all approved rules in `packages/rules/tests/combat-exchange.test.ts`:
+
+- aware melee + standard parry: `parry`, `dodge`, and `none`;
+- Basic H2H parry action cost 0; `hthType: "none"` parry action cost 1;
+- bare-handed weapon parry bonus 0;
+- unaware melee: no ordinary parry/dodge, but a Commando with explicit capability retains `autoDodge` plus `none`;
+- aware ranged: `dodge`, capability-gated `autoDodge`, and `none`, never parry;
+- unaware ranged: `none` only;
+- point-blank/close/normal penalties are -10/-5/0 and apply to ranged dodge-family options;
+- ranged defense uses `rangedDodge`/`rangedAutoDodge`, never ordinary H2H dodge/autoDodge;
+- `none` is always last, has bonus 0/action cost 0, and is never an implicit default;
+- response modifiers obey the same safe-integer/reason rule;
+- submitting an option not present in the derived list throws `illegalDefense`.
+
+- [x] **Step 2: Run the focused test and observe missing defense functions**
+
+Run: `vp test packages/rules/tests/combat-exchange.test.ts`
+
+Expected: FAIL on missing exports.
+
+- [x] **Step 3: Implement deterministic option enumeration**
+
+Use this ordering so UI and persisted history remain stable:
+
+```ts
+const options: DefenseOption[] = [];
+// melee: parry, dodge, autoDodge when authorized
+// ranged: dodge, autoDodge when authorized
+options.push({ kind: "none", bonus: 0, actionCost: 0, explanation: "Take the hit." });
+return options;
+```
+
+Implement the complete branch between initialization and the final push as:
+
+```ts
+if (attack.kind === "melee") {
+  if (context.kind !== "melee")
+    throw new Error("invalidContext: melee attack requires melee context.");
+  if (context.defenderAware && context.parryMode !== "unavailable") {
+    options.push({
+      kind: "parry",
+      bonus: context.parryMode === "bareHanded" ? 0 : defender.combat.parry,
+      actionCost: defender.combat.hasHandToHandTraining ? 0 : 1,
+      explanation:
+        context.parryMode === "bareHanded"
+          ? "Bare-handed weapon parry; no ordinary parry bonus."
+          : "Parry the melee weapon.",
+    });
+  }
+  if (context.defenderAware) {
+    options.push({
+      kind: "dodge",
+      bonus: defender.combat.dodge,
+      actionCost: 1,
+      explanation: "Dodge; costs one action for table tracking.",
+    });
+  }
+  if (defender.combat.hasAutoDodge) {
+    options.push({
+      kind: "autoDodge",
+      bonus: defender.combat.autoDodge,
+      actionCost: 0,
+      explanation: "Automatic dodge; no action cost.",
+    });
+  }
+} else {
+  if (context.kind !== "ranged")
+    throw new Error("invalidContext: ranged attack requires ranged context.");
+  if (context.defenderAware) {
+    const rangeModifier = combatExchangeRules.rangedDodgeModifier[context.rangeBand];
+    options.push({
+      kind: "dodge",
+      bonus: defender.combat.rangedDodge + rangeModifier,
+      actionCost: 1,
+      explanation: `Ranged dodge (${rangeModifier} range-band modifier).`,
+    });
+    if (defender.combat.hasAutoDodge) {
+      options.push({
+        kind: "autoDodge",
+        bonus: defender.combat.rangedAutoDodge + rangeModifier,
+        actionCost: 0,
+        explanation: `Automatic ranged dodge (${rangeModifier} range-band modifier).`,
+      });
+    }
+  }
+}
+```
+
+Melee automatic dodge does not require `defenderAware`; ranged dodge-family options do. Standard parry uses `sheet.combat.parry`; bare-handed parry uses zero. Ordinary dodge costs one action, automatic dodge costs zero, and a trained standard parry costs zero while an untrained standard parry records one.
+
+- [x] **Step 4: Authorize the submitted response against the derived list**
+
+Parse the response schema, find the exact `kind` in the server-derived options, then return its server-owned bonus/action metadata plus the normalized situational modifier. Never accept a bonus or action cost from the caller.
+
+Add the schema and implementation:
+
+```ts
+const rawCombatResponseInputSchema = z.object({
+  kind: combatResponseKindSchema,
+  defenseModifier: safeModifierSchema,
+  defenseModifierReason: modifierReasonSchema,
+});
+export const combatResponseInputSchema = rawCombatResponseInputSchema.superRefine(
+  (response, check) => {
+    if ((response.defenseModifier ?? 0) !== 0 && response.defenseModifierReason === undefined) {
+      check.addIssue({
+        code: "custom",
+        path: ["defenseModifierReason"],
+        message: "A reason is required for a nonzero defense modifier.",
+      });
+    }
+  },
+);
+export type CombatResponseInput = z.infer<typeof combatResponseInputSchema>;
+```
+
+```ts
+export function authorizeCombatResponse(
+  options: readonly DefenseOption[],
+  input: unknown,
+): AuthorizedCombatResponse {
+  const response = combatResponseInputSchema.parse(input);
+  const option = options.find((candidate) => candidate.kind === response.kind);
+  if (option === undefined) throw new Error(`illegalDefense: ${response.kind} is not authorized.`);
+  const defenseModifier = response.defenseModifier ?? 0;
+  return {
+    ...option,
+    defenseModifier,
+    ...(response.defenseModifierReason === undefined
+      ? {}
+      : { defenseModifierReason: response.defenseModifierReason }),
+    totalBonus: option.bonus + defenseModifier,
+  };
+}
+```
+
+- [x] **Step 5: Pass focused/package tests and commit**
+
+Run:
+
+```text
+vp test packages/rules/tests/combat-exchange.test.ts
+vp run @riftforge/rules#check
+vp run @riftforge/rules#test
+```
+
+Commit:
+
+```text
+git add -- packages/rules/src/schema/combat-exchange.ts packages/rules/src/engine/combat-exchange.ts packages/rules/tests/combat-exchange.test.ts
+git commit -m "feat(rules): derive combat defense choices"
+```
+
+---
+
+### Task 4: Pure Strike Completion, S.D.C. Routing, and Damage Results
+
+**Files:**
+
+- Modify: `packages/rules/src/engine/combat-exchange.ts`
+- Modify: `packages/rules/tests/combat-exchange.test.ts`
+
+**Interfaces:**
+
+```ts
+export type ProtectionState =
+  | { kind: "none" }
+  | { kind: "sdcArmor"; itemId: string; name: string; ar: number; max: number; current: number }
+  | { kind: "mdcArmor"; itemId: string; name: string; max?: number; current?: number };
+
+export type DeclarationResult =
+  | { status: "miss"; reason: "naturalOne" | "belowMinimum" }
+  | { status: "pendingDefense" };
+
+export type SdcDamageRoute =
+  | {
+      kind: "armor";
+      armor: { before: number; after: number };
+      body: { before: VitalsPool; after: VitalsPool };
+    }
+  | {
+      kind: "body";
+      armor?: { before: number; after: number };
+      body: { before: VitalsPool; after: VitalsPool };
+    }
+  | { kind: "unsupportedMdcProtection" };
+
+export type CombatExchangeResolution =
+  | { outcome: "miss"; reason: "naturalOne" | "belowMinimum"; critical: false; damageMultiplier: 1 }
+  | {
+      outcome: "defended";
+      reason: "parried" | "dodged";
+      response: AuthorizedCombatResponse;
+      defenseRoll: D20Roll;
+      critical: false;
+      damageMultiplier: 1;
+    }
+  | {
+      outcome: "hit";
+      reason: "unopposed" | "strikeWon";
+      response: AuthorizedCombatResponse;
+      defenseRoll?: D20Roll;
+      critical: boolean;
+      damageMultiplier: 1 | 2;
+      damageRoll: DamageRoll;
+      totalDamage: number;
+      route: Exclude<SdcDamageRoute, { kind: "unsupportedMdcProtection" }>;
+    };
+
+export function deriveProtection(sheet: CharacterSheet): ProtectionState;
+export function evaluateDeclaration(strike: D20Roll, minimumStrikeTotal: number): DeclarationResult;
+export function routeSdcHit(input: {
+  strikeTotal: number;
+  damage: number;
+  protection: ProtectionState;
+  body: VitalsPool;
+  comaDeathFloor: number;
+}): SdcDamageRoute;
+export interface ResolveCombatExchangeInput {
+  attack: Extract<AttackProfile, { supported: true }>;
+  context: CombatContext;
+  strikeRoll: D20Roll;
+  response: AuthorizedCombatResponse;
+  defenseRoll?: D20Roll;
+  damageRoll?: DamageRoll;
+  protection: ProtectionState;
+  body: VitalsPool;
+  comaDeathFloor: number;
+}
+export function resolveCombatExchange(input: ResolveCombatExchangeInput): CombatExchangeResolution;
+```
+
+- [x] **Step 1: Add failing declaration and protection tests**
+
+Assert melee total 4 misses/5 proceeds, ranged total 7 misses/8 proceeds, natural 1 misses, and invalid completed rolls are rejected through the existing resolver validation path.
+
+Derive `none` for an unarmored sheet and `mdcArmor` for a worn production suit.
+The M.D.C. variant keeps `max`/`current` optional so a legacy dice-capacity suit
+whose per-instance capacity has not been rolled is still safely classified and
+refused. Directly test a validated S.D.C. armor fixture:
+
+```ts
+const fixture = armorSchema.parse({
+  kind: "armor",
+  id: "test-sdc-armor",
+  name: "Validated S.D.C. Armor Fixture",
+  ar: 12,
+  sdc: 30,
+  page: 287,
+});
+const armor: ProtectionState = {
+  kind: "sdcArmor",
+  itemId: fixture.id,
+  name: fixture.name,
+  ar: fixture.ar!,
+  max: fixture.sdc!,
+  current: 5,
+};
+
+expect(
+  routeSdcHit({
+    strikeTotal: 12,
+    damage: 9,
+    protection: armor,
+    body: { sdc: 10, hitPoints: 20 },
+    comaDeathFloor: -10,
+  }),
+).toEqual({
+  kind: "armor",
+  armor: { before: 5, after: 0 },
+  body: { before: { sdc: 10, hitPoints: 20 }, after: { sdc: 10, hitPoints: 20 } },
+});
+```
+
+Also assert strike 13 routes the full hit to the body without changing armor, depleted armor routes future hits to the body, armor destruction never spills, body S.D.C. depletes before H.P., and `mdcArmor` returns `unsupportedMdcProtection` without conversion.
+
+- [x] **Step 2: Run the focused test and observe missing routing exports**
+
+Run: `vp test packages/rules/tests/combat-exchange.test.ts`
+
+Expected: FAIL.
+
+- [x] **Step 3: Implement protection classification and routing**
+
+For worn S.D.C. armor, require its schema-guaranteed `ar` and `sdc`; use its derived current pool. Treat current zero as `none`. For worn M.D.C. armor, return `mdcArmor` while current is positive and `none` when depleted.
+
+Use `damageArmor` for the armor pool and existing `applyDamage` for the body. Never carry armor overflow into the body.
+
+```ts
+export function deriveProtection(sheet: CharacterSheet): ProtectionState {
+  const armor = sheet.armor;
+  if (armor === undefined) return { kind: "none" };
+  if (armor.item.mdc !== undefined) {
+    if (armor.current === 0) return { kind: "none" };
+    return {
+      kind: "mdcArmor",
+      itemId: armor.item.id,
+      name: armor.item.name,
+      ...(armor.max === undefined ? {} : { max: armor.max }),
+      ...(armor.current === undefined ? {} : { current: armor.current }),
+    };
+  }
+  const max = armor.item.sdc!;
+  const current = armor.current ?? max;
+  return current === 0
+    ? { kind: "none" }
+    : {
+        kind: "sdcArmor",
+        itemId: armor.item.id,
+        name: armor.item.name,
+        ar: armor.item.ar!,
+        max,
+        current,
+      };
+}
+
+export function evaluateDeclaration(
+  strike: D20Roll,
+  minimumStrikeTotal: number,
+): DeclarationResult {
+  const base = resolveStrike({ strike, allowedDefenses: [], damageType: "sdc" });
+  if (base.outcome === "miss") {
+    return { status: "miss", reason: base.reason as "naturalOne" | "belowMinimum" };
+  }
+  return strike.total < minimumStrikeTotal
+    ? { status: "miss", reason: "belowMinimum" }
+    : { status: "pendingDefense" };
+}
+
+export function routeSdcHit(input: {
+  strikeTotal: number;
+  damage: number;
+  protection: ProtectionState;
+  body: VitalsPool;
+  comaDeathFloor: number;
+}): SdcDamageRoute {
+  if (input.protection.kind === "mdcArmor") return { kind: "unsupportedMdcProtection" };
+  const before = { ...input.body };
+  if (
+    input.protection.kind === "sdcArmor" &&
+    input.protection.current > 0 &&
+    input.strikeTotal <= input.protection.ar
+  ) {
+    return {
+      kind: "armor",
+      armor: {
+        before: input.protection.current,
+        after: damageArmor(input.protection.current, input.damage),
+      },
+      body: { before, after: { ...before } },
+    };
+  }
+  const after = applyDamage(input.body, input.damage, input.comaDeathFloor);
+  return {
+    kind: "body",
+    ...(input.protection.kind === "sdcArmor"
+      ? { armor: { before: input.protection.current, after: input.protection.current } }
+      : {}),
+    body: { before, after },
+  };
+}
+```
+
+- [x] **Step 4: Add failing end-to-end pure resolution tests**
+
+Use completed `D20Roll` and `DamageRoll` objects to cover:
+
+- declaration miss creates no defense/damage branch;
+- parry/dodge tie favors the defender;
+- natural-20 defense beats natural-20 strike through `resolveStrike`;
+- `none` resolves an unopposed hit;
+- melee damage is `(formula total + melee damage bonus) * critical multiplier`;
+- firearm damage has no P.S./H2H flat bonus;
+- missing defense roll for a defense choice and extra defense roll for `none` are rejected;
+- missing damage roll on a hit and supplied damage on a miss/defense are rejected;
+- the supplied damage roll bonus must equal `attack.damageBonus`, its die count
+  and faces must match `attack.damageFormula`, and its total must be internally
+  consistent;
+- M.D.C. protection is rejected before any S.D.C. route result.
+
+- [x] **Step 5: Implement `resolveCombatExchange` over `resolveStrike`**
+
+Call `evaluateDeclaration` first. For a selected defense, require the completed defense roll and pass only its server-authorized kind to `resolveStrike`. For `none`, omit defense. Require the completed damage roll only after a hit. Multiply `damageRoll.total` after its flat bonus, then call `routeSdcHit`.
+
+Add this private validator, then implement the resolver:
+
+```ts
+function assertDamageRoll(
+  attack: Extract<AttackProfile, { supported: true }>,
+  roll: DamageRoll,
+): void {
+  const formula = parseDice(attack.damageFormula);
+  if (roll.bonus !== attack.damageBonus) {
+    throw new Error(`Damage bonus must be ${attack.damageBonus}.`);
+  }
+  if (roll.dice.length !== formula.count) {
+    throw new Error(`Damage roll requires ${formula.count} dice.`);
+  }
+  if (roll.dice.some((die) => !Number.isInteger(die) || die < 1 || die > formula.sides)) {
+    throw new Error(`Damage dice must be integers from 1 to ${formula.sides}.`);
+  }
+  const expected =
+    roll.dice.reduce((sum, die) => sum + die, 0) * formula.multiplier +
+    formula.modifier +
+    roll.bonus;
+  if (roll.total !== expected) throw new Error(`Damage total must be ${expected}.`);
+}
+```
+
+```ts
+export function resolveCombatExchange(input: ResolveCombatExchangeInput): CombatExchangeResolution {
+  validateCombatContext(input.attack, input.context);
+  if (input.protection.kind === "mdcArmor") {
+    throw new Error("unsupportedMdcProtection: full M.D.C. resolution is out of scope.");
+  }
+  const expectedStrikeBonus = input.attack.strikeBonus + (input.context.strikeModifier ?? 0);
+  if (input.strikeRoll.bonus !== expectedStrikeBonus) {
+    throw new Error(`Strike bonus must be ${expectedStrikeBonus}.`);
+  }
+  const declaration = evaluateDeclaration(input.strikeRoll, input.attack.minimumStrikeTotal);
+  if (declaration.status === "miss") {
+    if (input.defenseRoll !== undefined || input.damageRoll !== undefined) {
+      throw new Error("A missed declaration cannot contain defense or damage rolls.");
+    }
+    return {
+      outcome: "miss",
+      reason: declaration.reason,
+      critical: false,
+      damageMultiplier: 1,
+    };
+  }
+
+  const takesHit = input.response.kind === "none";
+  if (takesHit && input.defenseRoll !== undefined) {
+    throw new Error("Take-the-hit cannot contain a defense roll.");
+  }
+  if (!takesHit && input.defenseRoll === undefined) {
+    throw new Error(`${input.response.kind} requires a completed defense roll.`);
+  }
+  if (input.defenseRoll !== undefined && input.defenseRoll.bonus !== input.response.totalBonus) {
+    throw new Error(`Defense bonus must be ${input.response.totalBonus}.`);
+  }
+
+  const strike = resolveStrike({
+    strike: input.strikeRoll,
+    ...(takesHit
+      ? {}
+      : {
+          defense: {
+            kind: input.response.kind as DefenseKind,
+            roll: input.defenseRoll!,
+          },
+        }),
+    allowedDefenses: takesHit ? [] : [input.response.kind as DefenseKind],
+    damageType: "sdc",
+    criticalOn: input.attack.criticalOn,
+  });
+  if (strike.outcome !== "hit") {
+    if (input.damageRoll !== undefined) throw new Error("A defended attack cannot contain damage.");
+    return {
+      outcome: "defended",
+      reason: strike.reason as "parried" | "dodged",
+      response: input.response,
+      defenseRoll: input.defenseRoll!,
+      critical: false,
+      damageMultiplier: 1,
+    };
+  }
+  if (input.damageRoll === undefined) throw new Error("A hit requires a completed damage roll.");
+  assertDamageRoll(input.attack, input.damageRoll);
+  const totalDamage = input.damageRoll.total * strike.damageMultiplier;
+  const route = routeSdcHit({
+    strikeTotal: input.strikeRoll.total,
+    damage: totalDamage,
+    protection: input.protection,
+    body: input.body,
+    comaDeathFloor: input.comaDeathFloor,
+  });
+  if (route.kind === "unsupportedMdcProtection") {
+    throw new Error("unsupportedMdcProtection: full M.D.C. resolution is out of scope.");
+  }
+  return {
+    outcome: "hit",
+    reason: strike.reason as "unopposed" | "strikeWon",
+    response: input.response,
+    ...(input.defenseRoll === undefined ? {} : { defenseRoll: input.defenseRoll }),
+    critical: strike.critical,
+    damageMultiplier: strike.damageMultiplier,
+    damageRoll: input.damageRoll,
+    totalDamage,
+    route,
+  };
+}
+```
+
+- [x] **Step 6: Pass focused/package tests and commit**
+
+Run:
+
+```text
+vp test packages/rules/tests/combat-exchange.test.ts packages/rules/tests/strike-resolution.test.ts packages/rules/tests/items.test.ts packages/rules/tests/combat.test.ts
+vp run @riftforge/rules#check
+vp run @riftforge/rules#test
+```
+
+Commit:
+
+```text
+git add -- packages/rules/src/engine/combat-exchange.ts packages/rules/tests/combat-exchange.test.ts
+git commit -m "feat(rules): resolve and route S.D.C. exchanges"
+```
+
+---
+
+### Task 5: Deterministic Combat-State Tokens
+
+**Files:**
+
+- Modify: `packages/rules/src/engine/combat-exchange.ts`
+- Modify: `packages/rules/tests/combat-exchange.test.ts`
+
+**Interfaces:**
+
+```ts
+export function attackerCombatStateToken(sheet: CharacterSheet, weaponIndex: number): string;
+export function defenderCombatStateToken(sheet: CharacterSheet): string;
+```
+
+Tokens are stable JSON serialization of explicit ordered arrays, not arbitrary object serialization and not a security hash.
+
+- [x] **Step 1: Add failing token-scope tests**
+
+Create two independently derived equivalent sheets and assert identical attacker/defender tokens. Then assert:
+
+- narrative edits, P.P.E. changes, and unrelated inventory additions do not change either relevant token;
+- attacker level, attributes, H2H type/derived profile, selected weapon index, selected item ID, or selected instance state changes the attacker token;
+- defender level, attributes, H2H type/defense profile, rolled/current S.D.C., rolled/current H.P., worn armor identity, maximum/current pool, tier, or A.R. changes the defender token;
+- an unrelated attacker inventory entry does not stale the selected attack;
+- token strings do not contain narrative/backstory text.
+
+- [x] **Step 2: Run the focused test and observe missing token exports**
+
+Run: `vp test packages/rules/tests/combat-exchange.test.ts`
+
+Expected: FAIL.
+
+- [x] **Step 3: Implement explicit ordered serialization**
+
+Use fixed attribute order `IQ, ME, MA, PS, PP, PE, PB, Spd`. The attacker tuple must contain level, attributes, the combat fields consumed by `deriveAttackProfile`, selected index, and selected instance snapshot. The defender tuple must contain level, attributes, the fields consumed by `deriveDefenseOptions`, rolled/current body pools, coma floor, and the complete derived worn-protection tuple.
+
+Do not serialize the whole sheet; doing so would make narrative and unrelated catalog growth stale live attacks.
+
+```ts
+const attributeOrder = ["IQ", "ME", "MA", "PS", "PP", "PE", "PB", "Spd"] as const;
+const orderedAttributes = (sheet: CharacterSheet) =>
+  attributeOrder.map((code) => sheet.attributes[code]);
+
+export function attackerCombatStateToken(sheet: CharacterSheet, weaponIndex: number): string {
+  const entry = sheet.equipment[weaponIndex];
+  return JSON.stringify([
+    "attacker-v1",
+    sheet.level,
+    orderedAttributes(sheet),
+    [
+      sheet.combat.handToHandType,
+      sheet.combat.strike,
+      sheet.combat.damageBonus,
+      sheet.combat.strikeGuns,
+      sheet.combat.criticalStrikeOn,
+    ],
+    weaponIndex,
+    entry === undefined ? null : [entry.item.id, entry.worn === true, entry.rolledMdc ?? null],
+  ]);
+}
+
+export function defenderCombatStateToken(sheet: CharacterSheet): string {
+  return JSON.stringify([
+    "defender-v1",
+    sheet.level,
+    orderedAttributes(sheet),
+    [
+      sheet.combat.handToHandType,
+      sheet.combat.hasHandToHandTraining,
+      sheet.combat.hasAutoDodge,
+      sheet.combat.parry,
+      sheet.combat.dodge,
+      sheet.combat.autoDodge,
+      sheet.combat.rangedDodge,
+      sheet.combat.rangedAutoDodge,
+    ],
+    [
+      sheet.vitals.sdc.rolled ?? null,
+      sheet.vitals.sdc.current ?? null,
+      sheet.vitals.hitPoints.rolled ?? null,
+      sheet.vitals.hitPoints.current ?? null,
+      sheet.vitals.comaDeathFloor,
+    ],
+    sheet.armor === undefined
+      ? null
+      : [
+          sheet.armor.item.id,
+          sheet.armor.item.mdc === undefined ? "sdc" : "mdc",
+          sheet.armor.item.ar ?? null,
+          sheet.armor.max ?? null,
+          sheet.armor.current ?? null,
+        ],
+  ]);
+}
+```
+
+- [x] **Step 4: Pass focused/package tests and commit**
+
+Run:
+
+```text
+vp test packages/rules/tests/combat-exchange.test.ts
+vp run @riftforge/rules#check
+vp run @riftforge/rules#test
+```
+
+Commit:
+
+```text
+git add -- packages/rules/src/engine/combat-exchange.ts packages/rules/tests/combat-exchange.test.ts
+git commit -m "feat(rules): add combat state tokens"
+```
+
+---
+
+### Task 6: Extract Shared Backend Character-State Helpers
+
+**Files:**
+
+- Create: `packages/backend/convex/character_state.ts`
+- Modify: `packages/backend/convex/characters.ts`
+- Modify: `packages/backend/tests/characters.test.ts`
+
+**Interfaces:**
+
+Move, without semantic changes:
+
+```ts
+export function validateCharacter(input: unknown): Character;
+export async function loadCharacter(ctx: MutationCtx, id: Id<"characters">): Promise<Character>;
+export async function patchCurrent(
+  ctx: MutationCtx,
+  id: Id<"characters">,
+  character: Character,
+  current: Character["current"],
+): Promise<void>;
+export const expectedItemValidator = v.object({
+  itemId: v.string(),
+  worn: v.optional(v.boolean()),
+  rolledMdc: v.optional(v.number()),
+});
+export interface ExpectedItem {
+  itemId: string;
+  worn?: boolean;
+  rolledMdc?: number;
+}
+export function requireItemAt(
+  character: Character,
+  index: number,
+  expect: ExpectedItem,
+): NonNullable<Character["items"]>[number];
+```
+
+- [x] **Step 1: Strengthen the stale-index regression before moving code**
+
+In `packages/backend/tests/characters.test.ts`, add an assertion that `requireItemAt` behavior exposed through `removeItem`/`equipArmor` rejects when the same index now contains a different `itemId`, even if the index remains valid.
+
+- [x] **Step 2: Run the focused backend test before refactoring**
+
+Run: `vp test packages/backend/tests/characters.test.ts`
+
+Expected: PASS, proving the behavior being preserved.
+
+- [x] **Step 3: Move helpers and update imports**
+
+Create `character_state.ts`, move the five helpers/types, and import them into `characters.ts`. Keep validation through `characterSchema`/`deriveSheet` and all current error messages unchanged. Do not export public Convex functions from the helper file.
+
+The new helper file is:
+
+```ts
+import { characterSchema, deriveSheet, type Character } from "@riftforge/rules";
+import { v } from "convex/values";
+import type { Id } from "./_generated/dataModel";
+import type { MutationCtx } from "./_generated/server";
+
+export function validateCharacter(input: unknown): Character {
+  const character = characterSchema.parse(input);
+  deriveSheet(character);
+  return character;
+}
+
+export async function loadCharacter(ctx: MutationCtx, id: Id<"characters">): Promise<Character> {
+  const doc = await ctx.db.get(id);
+  if (doc === null) throw new Error(`Character ${id} not found.`);
+  const { _id, _creationTime, ...stored } = doc;
+  return characterSchema.parse(stored);
+}
+
+export async function patchCurrent(
+  ctx: MutationCtx,
+  id: Id<"characters">,
+  character: Character,
+  current: Character["current"],
+): Promise<void> {
+  validateCharacter({ ...character, current });
+  await ctx.db.patch(id, { current });
+}
+
+export const expectedItemValidator = v.object({
+  itemId: v.string(),
+  worn: v.optional(v.boolean()),
+  rolledMdc: v.optional(v.number()),
+});
+export type ExpectedItem = { itemId: string; worn?: boolean; rolledMdc?: number };
+
+export function requireItemAt(
+  character: Character,
+  index: number,
+  expect: ExpectedItem,
+): Character["items"][number] {
+  const entry = Number.isInteger(index) ? character.items[index] : undefined;
+  if (entry === undefined) throw new Error(`No item at index ${index}.`);
+  if (
+    entry.itemId !== expect.itemId ||
+    (entry.worn === true) !== (expect.worn === true) ||
+    entry.rolledMdc !== expect.rolledMdc
+  ) {
+    throw new Error("The manifest changed while the request was in flight — try again.");
+  }
+  return entry;
+}
+```
+
+Delete these definitions from `characters.ts` and import exactly:
+
+```ts
+import {
+  expectedItemValidator,
+  loadCharacter,
+  patchCurrent,
+  requireItemAt,
+  validateCharacter,
+} from "./character_state";
+```
+
+- [x] **Step 4: Run backend regression gates**
+
+Run:
+
+```text
+vp test packages/backend/tests/characters.test.ts packages/backend/tests/healing-cast.test.ts
+vp run @riftforge/backend#check
+vp run @riftforge/backend#test
+```
+
+Expected: PASS with no behavior change.
+
+- [x] **Step 5: Commit the extraction**
+
+```text
+git add -- packages/backend/convex/character_state.ts packages/backend/convex/characters.ts packages/backend/tests/characters.test.ts
+git commit -m "refactor(backend): share character state helpers"
+```
+
+---
+
+### Task 7: Discriminated Exchange Ledger and Bounded Read Queries
+
+**Files:**
+
+- Create: `packages/backend/convex/combat_values.ts`
+- Create: `packages/backend/convex/combat.ts`
+- Modify: `packages/backend/convex/schema.ts`
+- Modify: `packages/backend/convex/_generated/api.d.ts`
+- Modify: `packages/backend/convex/_generated/dataModel.d.ts`
+- Create: `packages/backend/tests/combat.test.ts`
+
+**Ledger contract:**
+
+Every variant repeats these shared top-level fields so `status` remains indexable and the document remains a true discriminated union:
+
+```ts
+const exchangeBase = {
+  attackerId: v.id("characters"),
+  defenderId: v.id("characters"),
+  attackerName: v.string(),
+  defenderName: v.string(),
+  weapon: weaponSnapshotValidator,
+  attack: attackSnapshotValidator,
+  context: combatContextValidator,
+  attackerStateToken: v.string(),
+  defenderStateToken: v.string(),
+  strikeRoll: d20RollValidator,
+};
+
+export const combatExchangeValidator = v.union(
+  v.object({
+    ...exchangeBase,
+    status: v.literal("pendingDefense"),
+    defenseOptions: v.array(defenseOptionValidator),
+  }),
+  v.object({
+    ...exchangeBase,
+    status: v.literal("resolved"),
+    resolution: resolvedResultValidator,
+  }),
+  v.object({
+    ...exchangeBase,
+    status: v.literal("cancelled"),
+    cancelledAt: v.number(),
+  }),
+  v.object({
+    ...exchangeBase,
+    status: v.literal("stale"),
+    staleAt: v.number(),
+    reason: v.literal("combatStateChanged"),
+  }),
+);
+```
+
+`resolvedResultValidator` must itself be a union of `miss`, `defended`, and `hit` objects. Only the hit variant may contain damage/route data; only the defended variant requires a defense roll; the miss variant contains neither. The hit route is a union of armor and body snapshots, matching the pure rules result.
+
+Register:
+
+```ts
+combatExchanges: defineTable(combatExchangeValidator)
+  .index("by_defender_and_status", ["defenderId", "status"])
+  .index("by_attacker_and_status", ["attackerId", "status"])
+  .index("by_defender", ["defenderId"])
+  .index("by_attacker", ["attackerId"]),
+```
+
+**Public queries:**
+
+```ts
+export const targets = query({ args: { attackerId: v.id("characters") }, handler });
+export const incoming = query({ args: { defenderId: v.id("characters") }, handler });
+export const outgoing = query({ args: { attackerId: v.id("characters") }, handler });
+export const recent = query({ args: { characterId: v.id("characters") }, handler });
+```
+
+- [x] **Step 1: Add failing target/query tests**
+
+Create `packages/backend/tests/combat.test.ts` using the established `convexTest(schema, modules)` pattern. Assert:
+
+- `targets` excludes the attacker and returns at most 50 entries;
+- each target contains ID/name, `ready`, protection kind, and a stable disabled reason;
+- unrolled vitals report `defenderNotReady`;
+- nondepleted worn production armor reports `mdcArmor`/`unsupportedMdcProtection`;
+- depleted worn M.D.C. armor reports `none` and is not disabled for protection;
+- incoming/outgoing/recent are empty initially and bounded at 20.
+
+- [x] **Step 2: Run the focused test and observe the missing API/schema failure**
+
+Run: `vp test packages/backend/tests/combat.test.ts`
+
+Expected: FAIL because `api.combat` and `combatExchanges` do not exist.
+
+- [x] **Step 3: Add the validators, table, and read-only query module**
+
+Mirror rule-layer unions with Convex validators; do not use `v.any()`. In `targets`, take 50 characters, exclude self, derive each sheet, and map only the selector-safe summary. In the ledger queries, use the matching index plus `.take(20)`. For `recent`, take 20 from `by_attacker` and 20 from `by_defender`, merge/deduplicate by `_id`, sort by `_creationTime` descending, and slice to 20.
+
+Define these primitives in `combat_values.ts`; compose every ledger variant from
+them rather than weakening the schema:
+
+```ts
+import { v } from "convex/values";
+
+export const d20RollValidator = v.object({
+  die: v.number(),
+  bonus: v.number(),
+  total: v.number(),
+  target: v.optional(v.number()),
+  success: v.optional(v.boolean()),
+  naturalTwenty: v.boolean(),
+  naturalOne: v.boolean(),
+});
+export const damageRollValidator = v.object({
+  dice: v.array(v.number()),
+  total: v.number(),
+  bonus: v.number(),
+});
+export const combatContextValidator = v.union(
+  v.object({
+    kind: v.literal("melee"),
+    defenderAware: v.boolean(),
+    parryMode: v.union(v.literal("unavailable"), v.literal("standard"), v.literal("bareHanded")),
+    strikeModifier: v.optional(v.number()),
+    strikeModifierReason: v.optional(v.string()),
+  }),
+  v.object({
+    kind: v.literal("ranged"),
+    defenderAware: v.boolean(),
+    rangeBand: v.union(v.literal("pointBlank"), v.literal("close"), v.literal("normal")),
+    strikeModifier: v.optional(v.number()),
+    strikeModifierReason: v.optional(v.string()),
+  }),
+);
+export const combatResponseInputValidator = v.object({
+  kind: v.union(v.literal("parry"), v.literal("dodge"), v.literal("autoDodge"), v.literal("none")),
+  defenseModifier: v.optional(v.number()),
+  defenseModifierReason: v.optional(v.string()),
+});
+export const defenseOptionValidator = v.object({
+  kind: v.union(v.literal("parry"), v.literal("dodge"), v.literal("autoDodge"), v.literal("none")),
+  bonus: v.number(),
+  actionCost: v.union(v.literal(0), v.literal(1)),
+  explanation: v.string(),
+});
+const authorizedResponseValidator = v.object({
+  kind: v.union(v.literal("parry"), v.literal("dodge"), v.literal("autoDodge"), v.literal("none")),
+  bonus: v.number(),
+  actionCost: v.union(v.literal(0), v.literal(1)),
+  explanation: v.string(),
+  defenseModifier: v.number(),
+  defenseModifierReason: v.optional(v.string()),
+  totalBonus: v.number(),
+});
+const weaponCategoryValidator = v.union(
+  v.literal("knife"),
+  v.literal("axe"),
+  v.literal("handgun"),
+  v.literal("submachineGun"),
+  v.literal("energyPistol"),
+  v.literal("energyRifle"),
+);
+const modifierSourceValidator = v.object({
+  source: v.union(v.literal("attribute"), v.literal("handToHand"), v.literal("proficiency")),
+  label: v.string(),
+  value: v.number(),
+});
+const exchangeBase = {
+  attackerId: v.id("characters"),
+  defenderId: v.id("characters"),
+  attackerName: v.string(),
+  defenderName: v.string(),
+  weapon: v.object({
+    index: v.number(),
+    itemId: v.string(),
+    name: v.string(),
+    category: weaponCategoryValidator,
+    worn: v.optional(v.boolean()),
+    rolledMdc: v.optional(v.number()),
+  }),
+  attack: v.object({
+    kind: v.union(v.literal("melee"), v.literal("ranged")),
+    minimumStrikeTotal: v.number(),
+    strikeBonus: v.number(),
+    strikeBonusSources: v.array(modifierSourceValidator),
+    proficiencyBonus: v.number(),
+    damageFormula: v.string(),
+    damageBonus: v.number(),
+    criticalOn: v.number(),
+    damageType: v.literal("sdc"),
+  }),
+  context: combatContextValidator,
+  attackerStateToken: v.string(),
+  defenderStateToken: v.string(),
+  strikeRoll: d20RollValidator,
+};
+const routeValidator = v.union(
+  v.object({
+    kind: v.literal("armor"),
+    armor: v.object({ before: v.number(), after: v.number() }),
+    body: v.object({
+      before: v.object({ sdc: v.number(), hitPoints: v.number() }),
+      after: v.object({ sdc: v.number(), hitPoints: v.number() }),
+    }),
+  }),
+  v.object({
+    kind: v.literal("body"),
+    armor: v.optional(v.object({ before: v.number(), after: v.number() })),
+    body: v.object({
+      before: v.object({ sdc: v.number(), hitPoints: v.number() }),
+      after: v.object({ sdc: v.number(), hitPoints: v.number() }),
+    }),
+  }),
+);
+export const resolvedResultValidator = v.union(
+  v.object({
+    outcome: v.literal("miss"),
+    reason: v.union(v.literal("naturalOne"), v.literal("belowMinimum")),
+    critical: v.literal(false),
+    damageMultiplier: v.literal(1),
+  }),
+  v.object({
+    outcome: v.literal("defended"),
+    reason: v.union(v.literal("parried"), v.literal("dodged")),
+    response: authorizedResponseValidator,
+    defenseRoll: d20RollValidator,
+    critical: v.literal(false),
+    damageMultiplier: v.literal(1),
+  }),
+  v.object({
+    outcome: v.literal("hit"),
+    reason: v.union(v.literal("unopposed"), v.literal("strikeWon")),
+    response: authorizedResponseValidator,
+    defenseRoll: v.optional(d20RollValidator),
+    critical: v.boolean(),
+    damageMultiplier: v.union(v.literal(1), v.literal(2)),
+    damageRoll: damageRollValidator,
+    totalDamage: v.number(),
+    route: routeValidator,
+  }),
+);
+export const combatExchangeValidator = v.union(
+  v.object({
+    ...exchangeBase,
+    status: v.literal("pendingDefense"),
+    defenseOptions: v.array(defenseOptionValidator),
+  }),
+  v.object({
+    ...exchangeBase,
+    status: v.literal("resolved"),
+    resolution: resolvedResultValidator,
+  }),
+  v.object({
+    ...exchangeBase,
+    status: v.literal("cancelled"),
+    cancelledAt: v.number(),
+  }),
+  v.object({
+    ...exchangeBase,
+    status: v.literal("stale"),
+    staleAt: v.number(),
+    reason: v.literal("combatStateChanged"),
+  }),
+);
+```
+
+Register the table in `schema.ts` with the exact four indexes shown in the
+ledger contract. Add these read handlers to `combat.ts`:
+
+```ts
+const TARGET_LIMIT = 50;
+const FEED_LIMIT = 20;
+
+export const targets = query({
+  args: { attackerId: v.id("characters") },
+  handler: async (ctx, { attackerId }) => {
+    const docs = await ctx.db.query("characters").order("desc").take(TARGET_LIMIT);
+    return docs
+      .filter((doc) => doc._id !== attackerId)
+      .map((doc) => {
+        const sheet = deriveSheet(doc);
+        const ready =
+          sheet.vitals.sdc.rolled !== undefined && sheet.vitals.hitPoints.rolled !== undefined;
+        const protection = deriveProtection(sheet);
+        return {
+          id: doc._id,
+          name: sheet.name,
+          ready,
+          protection: protection.kind,
+          ...(ready
+            ? protection.kind === "mdcArmor"
+              ? { disabledReason: "unsupportedMdcProtection" as const }
+              : {}
+            : { disabledReason: "defenderNotReady" as const }),
+        };
+      });
+  },
+});
+
+export const incoming = query({
+  args: { defenderId: v.id("characters") },
+  handler: (ctx, { defenderId }) =>
+    ctx.db
+      .query("combatExchanges")
+      .withIndex("by_defender_and_status", (q) =>
+        q.eq("defenderId", defenderId).eq("status", "pendingDefense"),
+      )
+      .order("desc")
+      .take(FEED_LIMIT),
+});
+
+export const outgoing = query({
+  args: { attackerId: v.id("characters") },
+  handler: (ctx, { attackerId }) =>
+    ctx.db
+      .query("combatExchanges")
+      .withIndex("by_attacker_and_status", (q) =>
+        q.eq("attackerId", attackerId).eq("status", "pendingDefense"),
+      )
+      .order("desc")
+      .take(FEED_LIMIT),
+});
+
+export const recent = query({
+  args: { characterId: v.id("characters") },
+  handler: async (ctx, { characterId }) => {
+    const [attacks, defenses] = await Promise.all([
+      ctx.db
+        .query("combatExchanges")
+        .withIndex("by_attacker", (q) => q.eq("attackerId", characterId))
+        .order("desc")
+        .take(FEED_LIMIT),
+      ctx.db
+        .query("combatExchanges")
+        .withIndex("by_defender", (q) => q.eq("defenderId", characterId))
+        .order("desc")
+        .take(FEED_LIMIT),
+    ]);
+    return [...new Map([...attacks, ...defenses].map((doc) => [doc._id, doc])).values()]
+      .sort((a, b) => b._creationTime - a._creationTime)
+      .slice(0, FEED_LIMIT);
+  },
+});
+```
+
+- [x] **Step 4: Regenerate Convex types with pnpm**
+
+From `packages/backend`, run:
+
+```text
+pnpm exec convex codegen
+```
+
+Expected: `api.d.ts` imports `../combat.js`; `dataModel.d.ts` remains generated from `schema.ts`. Do not follow the generated comment's `npx` wording.
+
+- [x] **Step 5: Pass focused/package tests and commit**
+
+Run:
+
+```text
+vp test packages/backend/tests/combat.test.ts
+vp run @riftforge/backend#check
+vp run @riftforge/backend#test
+```
+
+Commit:
+
+```text
+git add -- packages/backend/convex/combat_values.ts packages/backend/convex/combat.ts packages/backend/convex/schema.ts packages/backend/convex/_generated/api.d.ts packages/backend/convex/_generated/dataModel.d.ts packages/backend/tests/combat.test.ts
+git commit -m "feat(backend): add combat exchange ledger"
+```
+
+---
+
+### Task 8: Server-Owned Attack Declaration
+
+**Files:**
+
+- Modify: `packages/backend/convex/combat.ts`
+- Modify: `packages/backend/tests/combat.test.ts`
+
+**Mutation contract:**
+
+```ts
+export const declareAttack = mutation({
+  args: {
+    attackerId: v.id("characters"),
+    defenderId: v.id("characters"),
+    weaponIndex: v.number(),
+    expect: expectedItemValidator,
+    context: combatContextValidator,
+  },
+  handler,
+});
+```
+
+Expected failures use:
+
+```ts
+throw new ConvexError({
+  code: "unsupportedMdWeapon",
+  message: "M.D. weapons require the full M.D.C. combat follow-up.",
+});
+```
+
+Use the complete approved code set: `selfTarget`, `attackerNotReady`, `defenderNotReady`, `weaponMissingOrChanged`, `unsupportedWeaponMode`, `unsupportedMdWeapon`, `unsupportedMdcProtection`, `invalidContext`, `modifierReasonRequired`, `illegalDefense`, `exchangeNotPending`, `combatStateChanged`, and `characterMissing`.
+
+- [x] **Step 1: Add failing declaration tests**
+
+Assert:
+
+- self-targeting returns `selfTarget` and inserts nothing;
+- attacker/defender must have rolled H.P. and S.D.C.;
+- indexed weapon instance must match `expect`;
+- gear/nonweapon returns `unsupportedWeaponMode`;
+- M.D. weapon returns `unsupportedMdWeapon` before dice/insert;
+- nondepleted M.D.C. target returns `unsupportedMdcProtection` before dice/insert;
+- kind mismatch/invalid modifier/refusal inserts nothing;
+- melee `strikeModifier: -100` with a reason guarantees an immediate persisted `resolved` miss;
+- melee `strikeModifier: 100` with a reason guarantees `pendingDefense`;
+- stored roll fields are internally consistent and no die/result is accepted from client args;
+- a pending record captures names, exact weapon instance, attack/context snapshots, both tokens, and server-derived options including explicit `none`.
+
+- [x] **Step 2: Run the focused test and observe the missing mutation**
+
+Run: `vp test packages/backend/tests/combat.test.ts`
+
+Expected: FAIL because `declareAttack` is missing.
+
+- [x] **Step 3: Implement pre-roll validation in the approved order**
+
+1. Reject equal IDs.
+2. Load and derive both characters.
+3. Require rolled H.P./S.D.C. on both.
+4. Verify the indexed item against `expect`.
+5. Derive the attack profile and parse matching context.
+6. Derive defender protection.
+7. Reject M.D. weapon/M.D.C. protection.
+8. Derive defense options and both state tokens.
+9. Only now call `rollD20(attack.strikeBonus + contextModifier, attack.minimumStrikeTotal)`.
+10. Insert a resolved miss or pending record and return it.
+
+Convert rules validation errors into stable `ConvexError` data at the backend boundary; do not expose raw Zod issue arrays to the UI.
+
+Implement the mutation with these helpers (imports come from
+`@riftforge/rules`, `convex/values`, `./character_state`, and
+`./combat_values`):
+
+```ts
+function combatFailure(code: CombatExchangeErrorCode, message: string): never {
+  throw new ConvexError({ code, message });
+}
+
+function requireCombatReady(
+  sheet: CharacterSheet,
+  code: "attackerNotReady" | "defenderNotReady",
+): void {
+  if (sheet.vitals.sdc.rolled === undefined || sheet.vitals.hitPoints.rolled === undefined) {
+    combatFailure(code, "Roll both S.D.C. and Hit Points before entering combat.");
+  }
+}
+
+function parseDeclaredContext(
+  attack: Extract<AttackProfile, { supported: true }>,
+  input: unknown,
+): CombatContext {
+  const parsed = combatContextSchema.safeParse(input);
+  if (!parsed.success) {
+    const missingReason = parsed.error.issues.some((issue) =>
+      issue.path.includes("strikeModifierReason"),
+    );
+    combatFailure(
+      missingReason ? "modifierReasonRequired" : "invalidContext",
+      missingReason
+        ? "A reason is required for a nonzero strike modifier."
+        : "The declared combat context is invalid.",
+    );
+  }
+  if (parsed.data.kind !== attack.kind) {
+    combatFailure("invalidContext", "The declared context does not match the weapon mode.");
+  }
+  return parsed.data;
+}
+```
+
+```ts
+export const declareAttack = mutation({
+  args: {
+    attackerId: v.id("characters"),
+    defenderId: v.id("characters"),
+    weaponIndex: v.number(),
+    expect: expectedItemValidator,
+    context: combatContextValidator,
+  },
+  handler: async (ctx, args) => {
+    if (args.attackerId === args.defenderId) {
+      combatFailure("selfTarget", "A character cannot target itself with a hostile exchange.");
+    }
+    let attacker: Character;
+    let defender: Character;
+    try {
+      [attacker, defender] = await Promise.all([
+        loadCharacter(ctx, args.attackerId),
+        loadCharacter(ctx, args.defenderId),
+      ]);
+    } catch {
+      combatFailure("characterMissing", "The attacker or defender no longer exists.");
+    }
+    const attackerSheet = deriveSheet(attacker);
+    const defenderSheet = deriveSheet(defender);
+    requireCombatReady(attackerSheet, "attackerNotReady");
+    requireCombatReady(defenderSheet, "defenderNotReady");
+    try {
+      requireItemAt(attacker, args.weaponIndex, args.expect);
+    } catch {
+      combatFailure("weaponMissingOrChanged", "The selected weapon instance changed.");
+    }
+    const attack = deriveAttackProfile(attackerSheet, args.weaponIndex);
+    if (!attack.supported) {
+      combatFailure(
+        attack.reason,
+        attack.reason === "unsupportedMdWeapon"
+          ? "M.D. weapons require the full M.D.C. combat follow-up."
+          : "The selected item is not a supported weapon mode.",
+      );
+    }
+    const context = parseDeclaredContext(attack, args.context);
+    const protection = deriveProtection(defenderSheet);
+    if (protection.kind === "mdcArmor") {
+      combatFailure(
+        "unsupportedMdcProtection",
+        "M.D.C. protection requires the full M.D.C. combat follow-up.",
+      );
+    }
+    const defenseOptions = deriveDefenseOptions(defenderSheet, attack, context);
+    const strikeModifier = context.strikeModifier ?? 0;
+    const strikeRoll = rollD20(attack.strikeBonus + strikeModifier, attack.minimumStrikeTotal);
+    const declaration = evaluateDeclaration(strikeRoll, attack.minimumStrikeTotal);
+    const { supported: _supported, weapon, ...attackSnapshot } = attack;
+    const base = {
+      attackerId: args.attackerId,
+      defenderId: args.defenderId,
+      attackerName: attackerSheet.name,
+      defenderName: defenderSheet.name,
+      weapon,
+      attack: attackSnapshot,
+      context,
+      attackerStateToken: attackerCombatStateToken(attackerSheet, args.weaponIndex),
+      defenderStateToken: defenderCombatStateToken(defenderSheet),
+      strikeRoll,
+    };
+    const exchangeId = await ctx.db.insert(
+      "combatExchanges",
+      declaration.status === "miss"
+        ? {
+            ...base,
+            status: "resolved" as const,
+            resolution: {
+              outcome: "miss" as const,
+              reason: declaration.reason,
+              critical: false as const,
+              damageMultiplier: 1 as const,
+            },
+          }
+        : { ...base, status: "pendingDefense" as const, defenseOptions },
+    );
+    return (await ctx.db.get(exchangeId))!;
+  },
+});
+```
+
+- [x] **Step 4: Pass focused/backend gates and commit**
+
+Run:
+
+```text
+vp test packages/backend/tests/combat.test.ts
+vp run @riftforge/backend#check
+vp run @riftforge/backend#test
+```
+
+Commit:
+
+```text
+git add -- packages/backend/convex/combat.ts packages/backend/tests/combat.test.ts
+git commit -m "feat(backend): declare server-rolled attacks"
+```
+
+---
+
+### Task 9: Atomic Response, Cancellation, and Stale-State Finalization
+
+**Files:**
+
+- Modify: `packages/backend/convex/combat.ts`
+- Modify: `packages/backend/tests/combat.test.ts`
+
+**Mutation contracts:**
+
+```ts
+export const respondToAttack = mutation({
+  args: {
+    exchangeId: v.id("combatExchanges"),
+    response: combatResponseInputValidator,
+  },
+  handler,
+});
+
+export const cancelAttack = mutation({
+  args: { exchangeId: v.id("combatExchanges") },
+  handler,
+});
+```
+
+- [x] **Step 1: Add failing response/cancellation tests**
+
+Use `strikeModifier: 100` to guarantee pending declarations and assert:
+
+- `none` rolls damage server-side, resolves once, applies body S.D.C. before H.P., and stores matching before/after pools atomically;
+- a melee defense with `defenseModifier: 100` guarantees a defended result and changes no pools;
+- standard parry, bare-handed parry, dodge, and capability-gated auto dodge are accepted only when rederived options contain them;
+- an illegal defense or missing modifier reason changes neither ledger nor character;
+- `cancelAttack` changes pending to cancelled and no finalized state can respond/cancel again;
+- two concurrent responses yield exactly one successful finalization and one `exchangeNotPending`, with damage applied once;
+- changing attacker level/profile or selected weapon after declaration finalizes `stale` with no damage;
+- changing defender body pools, defense profile, worn armor, or armor pool finalizes `stale` with no additional damage;
+- updating either narrative does not stale; the response still resolves;
+- unrelated P.P.E. or inventory state excluded by the token does not stale;
+- resolving one hit intentionally stales a second pending hit made against the prior defender pools;
+- response/cancel/query paths reject a missing character/exchange with the appropriate stable code.
+
+- [x] **Step 2: Run the focused test and observe missing mutations**
+
+Run: `vp test packages/backend/tests/combat.test.ts`
+
+Expected: FAIL.
+
+- [x] **Step 3: Implement stale check and response authorization before dice**
+
+Load the pending record, reload/rederive both characters, and compare both tokens. On mismatch, patch only the exchange to:
+
+```ts
+{ ...exchange, status: "stale", staleAt: Date.now(), reason: "combatStateChanged" }
+```
+
+Return that record without rolling defense/damage or touching the defender. Otherwise rederive the attack profile, context, protection, and defense options, then authorize the submitted response. A client cannot replay the stored option bonus as authority.
+
+Use replacement, not patching, when changing the discriminated variant; otherwise
+`defenseOptions` from the pending variant would survive as a contradictory field:
+
+```ts
+function pendingBase(exchange: Doc<"combatExchanges">) {
+  if (exchange.status !== "pendingDefense") {
+    combatFailure("exchangeNotPending", "The combat exchange is no longer pending.");
+  }
+  const { _id, _creationTime, status: _status, defenseOptions: _options, ...base } = exchange;
+  return { id: _id, base };
+}
+
+function parseResponse(input: unknown): CombatResponseInput {
+  const parsed = combatResponseInputSchema.safeParse(input);
+  if (!parsed.success) {
+    const missingReason = parsed.error.issues.some((issue) =>
+      issue.path.includes("defenseModifierReason"),
+    );
+    combatFailure(
+      missingReason ? "modifierReasonRequired" : "illegalDefense",
+      missingReason
+        ? "A reason is required for a nonzero defense modifier."
+        : "The combat response is invalid.",
+    );
+  }
+  return parsed.data;
+}
+```
+
+- [x] **Step 4: Implement server dice and the atomic character/result write**
+
+Roll defense only for `parry`/`dodge`/`autoDodge`, with target equal to the stored strike total. Run the pure resolver. Roll damage only if the result can hit, using `rollDamage(attack.damageFormula, attack.damageBonus)`; the pure resolver applies critical multiplication and routing.
+
+For a body route, patch current S.D.C./H.P.; for an armor route, patch only current armor. Re-run `deriveSheet` on the complete candidate character before `ctx.db.patch`. Finalize the exchange in the same mutation after the validated candidate is known. Convex transaction rollback must leave neither half committed if any later validation throws.
+
+```ts
+export const respondToAttack = mutation({
+  args: {
+    exchangeId: v.id("combatExchanges"),
+    response: combatResponseInputValidator,
+  },
+  handler: async (ctx, args) => {
+    const stored = await ctx.db.get(args.exchangeId);
+    if (stored === null) {
+      combatFailure("exchangeNotPending", "The combat exchange no longer exists.");
+    }
+    const { id, base } = pendingBase(stored);
+    let attacker: Character;
+    let defender: Character;
+    try {
+      [attacker, defender] = await Promise.all([
+        loadCharacter(ctx, stored.attackerId),
+        loadCharacter(ctx, stored.defenderId),
+      ]);
+    } catch {
+      combatFailure("characterMissing", "The attacker or defender no longer exists.");
+    }
+    const attackerSheet = deriveSheet(attacker);
+    const defenderSheet = deriveSheet(defender);
+    const tokensMatch =
+      attackerCombatStateToken(attackerSheet, stored.weapon.index) === stored.attackerStateToken &&
+      defenderCombatStateToken(defenderSheet) === stored.defenderStateToken;
+    if (!tokensMatch) {
+      await ctx.db.replace(id, {
+        ...base,
+        status: "stale",
+        staleAt: Date.now(),
+        reason: "combatStateChanged",
+      });
+      return (await ctx.db.get(id))!;
+    }
+
+    const attack = deriveAttackProfile(attackerSheet, stored.weapon.index);
+    if (!attack.supported) {
+      combatFailure("combatStateChanged", "The stored attack profile can no longer be derived.");
+    }
+    const context = validateCombatContext(attack, stored.context);
+    const protection = deriveProtection(defenderSheet);
+    if (protection.kind === "mdcArmor") {
+      combatFailure("combatStateChanged", "The defender's protection changed.");
+    }
+    const options = deriveDefenseOptions(defenderSheet, attack, context);
+    const responseInput = parseResponse(args.response);
+    let response: AuthorizedCombatResponse;
+    try {
+      response = authorizeCombatResponse(options, responseInput);
+    } catch {
+      combatFailure("illegalDefense", "That defense is not legal for this exchange.");
+    }
+    const defenseRoll =
+      response.kind === "none" ? undefined : rollD20(response.totalBonus, stored.strikeRoll.total);
+    const opposed = resolveStrike({
+      strike: stored.strikeRoll,
+      ...(defenseRoll === undefined
+        ? {}
+        : { defense: { kind: response.kind as DefenseKind, roll: defenseRoll } }),
+      allowedDefenses: defenseRoll === undefined ? [] : [response.kind as DefenseKind],
+      damageType: "sdc",
+      criticalOn: attack.criticalOn,
+    });
+    const damageRoll =
+      opposed.outcome === "hit" ? rollDamage(attack.damageFormula, attack.damageBonus) : undefined;
+    const resolution = resolveCombatExchange({
+      attack,
+      context,
+      strikeRoll: stored.strikeRoll,
+      response,
+      ...(defenseRoll === undefined ? {} : { defenseRoll }),
+      ...(damageRoll === undefined ? {} : { damageRoll }),
+      protection,
+      body: {
+        sdc: defenderSheet.vitals.sdc.current!,
+        hitPoints: defenderSheet.vitals.hitPoints.current!,
+      },
+      comaDeathFloor: defenderSheet.vitals.comaDeathFloor,
+    });
+
+    if (resolution.outcome === "hit") {
+      const current =
+        resolution.route.kind === "armor"
+          ? { ...defender.current, armor: resolution.route.armor.after }
+          : {
+              ...defender.current,
+              sdc: resolution.route.body.after.sdc,
+              hitPoints: resolution.route.body.after.hitPoints,
+            };
+      await patchCurrent(ctx, stored.defenderId, defender, current);
+    }
+    await ctx.db.replace(id, { ...base, status: "resolved", resolution });
+    return (await ctx.db.get(id))!;
+  },
+});
+```
+
+- [x] **Step 5: Implement pending-only cancellation**
+
+Reload by exchange ID, require `pendingDefense`, and patch the discriminated cancelled variant. Note in code that authorization is intentionally unavailable in this slice; do not simulate ownership with attacker/defender IDs supplied by the client.
+
+```ts
+export const cancelAttack = mutation({
+  args: { exchangeId: v.id("combatExchanges") },
+  handler: async (ctx, { exchangeId }) => {
+    const stored = await ctx.db.get(exchangeId);
+    if (stored === null) {
+      combatFailure("exchangeNotPending", "The combat exchange no longer exists.");
+    }
+    const { id, base } = pendingBase(stored);
+    // Accounts/roles are not modeled yet; do not pretend an actor ID is authorization.
+    await ctx.db.replace(id, { ...base, status: "cancelled", cancelledAt: Date.now() });
+    return (await ctx.db.get(id))!;
+  },
+});
+```
+
+- [x] **Step 6: Pass focused/backend gates and commit**
+
+Run:
+
+```text
+vp test packages/backend/tests/combat.test.ts packages/backend/tests/characters.test.ts packages/backend/tests/healing-cast.test.ts
+vp run @riftforge/backend#check
+vp run @riftforge/backend#test
+```
+
+Commit:
+
+```text
+git add -- packages/backend/convex/combat.ts packages/backend/tests/combat.test.ts
+git commit -m "feat(backend): resolve combat exchanges atomically"
+```
+
+---
+
+### Task 10: Pure Web Presentation and Ownership Guards
+
+**Files:**
+
+- Create: `apps/web/src/lib/combat-exchange.ts`
+- Create: `apps/web/tests/combat-exchange.test.ts`
+
+**Interfaces:**
+
+```ts
+export interface AsyncOwner {
+  routeId: string;
+  routeEpoch: number;
+  exchangeId?: string;
+}
+
+export function ownsAsyncResult(
+  owner: AsyncOwner,
+  current: { routeId: string; routeEpoch: number; exchangeId?: string },
+): boolean;
+
+export function combatWeaponChoices(sheet: CharacterSheet): Array<{
+  index: number;
+  itemId: string;
+  label: string;
+  supported: boolean;
+  disabledReason?: string;
+}>;
+
+export function combatTargetDisabledReason(target: CombatTargetSummary): string | undefined;
+export function exchangeTone(exchange: ExchangeSummary): "dim" | "warn" | "bad" | "good";
+export function formatExchangeSummary(exchange: ExchangeSummary): string;
+export function combatErrorMessage(error: unknown): string;
+```
+
+Define the backend-return types without hand-copying them:
+
+```ts
+type CombatTargets = FunctionReturnType<typeof api.combat.targets>;
+export type CombatTargetSummary = CombatTargets[number];
+type CombatRecent = FunctionReturnType<typeof api.combat.recent>;
+export type ExchangeSummary = CombatRecent[number];
+```
+
+- [x] **Step 1: Add failing pure web tests**
+
+Assert:
+
+- only owned weapons appear; all four S.D.C. weapons are enabled and M.D. weapons remain visible/disabled with full-M.D.C. copy;
+- unready and M.D.C.-protected targets expose precise disabled copy;
+- pending/stale/cancelled/miss/defended/hit tones map to amber/amber/muted/muted/green/red semantics without cyan;
+- summaries include attacker/defender, weapon, strike, defense when present, critical, detailed damage, route, and remaining pool without fabricating absent fields;
+- a result with a different route ID, epoch, or expected exchange ID is rejected;
+- a current owner with all fields equal is accepted.
+
+- [x] **Step 2: Run the focused test and observe missing module failure**
+
+Run: `vp test apps/web/tests/combat-exchange.test.ts`
+
+Expected: FAIL.
+
+- [x] **Step 3: Implement structural helpers without duplicating rules math**
+
+`combatWeaponChoices` may call `deriveAttackProfile` for preview/support labels, but it must not calculate bonuses, thresholds, defenses, criticals, or A.R. itself. Formatting consumes server result fields verbatim. Keep helpers DOM-free so the current Node test environment remains sufficient.
+
+```ts
+import { api } from "@riftforge/backend/api";
+import { deriveAttackProfile, type CharacterSheet } from "@riftforge/rules";
+import { ConvexError } from "convex/values";
+import type { FunctionReturnType } from "convex/server";
+
+type CombatTargets = FunctionReturnType<typeof api.combat.targets>;
+export type CombatTargetSummary = CombatTargets[number];
+type CombatRecent = FunctionReturnType<typeof api.combat.recent>;
+export type ExchangeSummary = CombatRecent[number];
+
+export interface AsyncOwner {
+  routeId: string;
+  routeEpoch: number;
+  exchangeId?: string;
+}
+
+export function ownsAsyncResult(owner: AsyncOwner, current: AsyncOwner): boolean {
+  return (
+    owner.routeId === current.routeId &&
+    owner.routeEpoch === current.routeEpoch &&
+    owner.exchangeId === current.exchangeId
+  );
+}
+
+export function combatWeaponChoices(sheet: CharacterSheet) {
+  return sheet.equipment.flatMap((entry, index) => {
+    if (entry.item.kind !== "weapon") return [];
+    const profile = deriveAttackProfile(sheet, index);
+    return [
+      {
+        index,
+        itemId: entry.item.id,
+        label: `${entry.item.name} — ${entry.item.damage.formula} ${
+          entry.item.damage.type === "md" ? "M.D." : "S.D.C."
+        }`,
+        supported: profile.supported,
+        ...(profile.supported
+          ? {}
+          : {
+              disabledReason:
+                profile.reason === "unsupportedMdWeapon"
+                  ? "Full M.D.C. combat is follow-up work."
+                  : "This weapon mode is not supported.",
+            }),
+      },
+    ];
+  });
+}
+
+export function combatTargetDisabledReason(target: CombatTargetSummary): string | undefined {
+  if (!target.ready) return "Roll this target's H.P. and S.D.C. first.";
+  if (target.protection === "mdcArmor") return "Full M.D.C. combat is follow-up work.";
+  return undefined;
+}
+
+export function exchangeTone(exchange: ExchangeSummary): "dim" | "warn" | "bad" | "good" {
+  if (exchange.status === "pendingDefense" || exchange.status === "stale") return "warn";
+  if (exchange.status === "cancelled") return "dim";
+  if (exchange.resolution.outcome === "defended") return "good";
+  if (exchange.resolution.outcome === "hit") return "bad";
+  return "dim";
+}
+
+const signed = (value: number) => (value >= 0 ? `+${value}` : String(value));
+
+export function formatExchangeSummary(exchange: ExchangeSummary): string {
+  const strike = `d20[${exchange.strikeRoll.die}]${signed(exchange.strikeRoll.bonus)} = ${exchange.strikeRoll.total}`;
+  const lead = `${exchange.attackerName} → ${exchange.defenderName} :: ${exchange.weapon.name} :: ${strike}`;
+  if (exchange.status === "pendingDefense") return `${lead} :: AWAITING DEFENSE`;
+  if (exchange.status === "cancelled") return `${lead} :: CANCELLED`;
+  if (exchange.status === "stale") return `${lead} :: STALE — COMBAT STATE CHANGED`;
+  const result = exchange.resolution;
+  if (result.outcome === "miss") return `${lead} :: MISS (${result.reason})`;
+  if (result.outcome === "defended") {
+    return `${lead} :: ${result.response.kind.toUpperCase()} d20[${result.defenseRoll.die}]${signed(result.defenseRoll.bonus)} = ${result.defenseRoll.total} :: DEFENDED`;
+  }
+  const damage = `[${result.damageRoll.dice.join("][")}]${signed(result.damageRoll.bonus)} = ${result.totalDamage} S.D.C.`;
+  const critical = result.critical ? " :: CRITICAL" : "";
+  const remaining =
+    result.route.kind === "armor"
+      ? `ARMOR ${result.route.armor.after}`
+      : `BODY S.D.C. ${result.route.body.after.sdc} / H.P. ${result.route.body.after.hitPoints}`;
+  return `${lead}${critical} :: ${damage} → ${remaining}`;
+}
+
+export function combatErrorMessage(error: unknown): string {
+  if (
+    error instanceof ConvexError &&
+    typeof error.data === "object" &&
+    error.data !== null &&
+    "message" in error.data &&
+    typeof error.data.message === "string"
+  ) {
+    return error.data.message;
+  }
+  return error instanceof Error ? error.message : String(error);
+}
+```
+
+- [x] **Step 4: Pass focused/web gates and commit**
+
+Run:
+
+```text
+vp test apps/web/tests/combat-exchange.test.ts apps/web/tests/convex.test.ts
+vp run @riftforge/web#check
+vp run @riftforge/web#test
+```
+
+Commit:
+
+```text
+git add -- apps/web/src/lib/combat-exchange.ts apps/web/tests/combat-exchange.test.ts
+git commit -m "test(web): define combat exchange presentation"
+```
+
+---
+
+### Task 11: SolidJS Combat Exchange Command Panel
+
+**Files:**
+
+- Create: `apps/web/src/components/combat-exchange-panel.tsx`
+- Modify: `apps/web/src/components/ui.tsx`
+- Modify: `apps/web/src/components/telemetry-rail.tsx`
+- Modify: `apps/web/src/pages/character-sheet.tsx`
+- Modify: `apps/web/tests/combat-exchange.test.ts`
+
+**Component contract:**
+
+```ts
+export interface CombatExchangePanelProps {
+  characterId: Id<"characters">;
+  sheet: CharacterSheet;
+  onTelemetry: (text: string, tone?: TelemetryTone) => void;
+}
+
+export function CombatExchangePanel(props: CombatExchangePanelProps): JSX.Element;
+```
+
+- [x] **Step 1: Add the native select primitive**
+
+Add `SelectInput` beside `TextInput` in `components/ui.tsx` using the same `notch-8`, border, noir background, mono text, amber focus, disabled-dead styling, and `ComponentProps<"select">` forwarding. No rounded corners and no new color tokens.
+
+```tsx
+export function SelectInput(props: ComponentProps<"select">) {
+  const [own, rest] = splitProps(props, ["class", "children"]);
+  return (
+    <select
+      class={`notch-8 border border-line bg-noir px-3 py-2 font-mono text-[13px] text-fg focus:border-amber disabled:text-dead ${own.class ?? ""}`}
+      {...rest}
+    >
+      {own.children}
+    </select>
+  );
+}
+```
+
+Move `ToggleChip` from `character-sheet.tsx` to `components/ui.tsx`, export it,
+and import it back into the page as well as the new panel:
+
+```tsx
+export function ToggleChip(props: {
+  pressed: boolean;
+  onToggle: () => void;
+  tone?: "ley" | "amber";
+  children: JSX.Element;
+}) {
+  return (
+    <button
+      type="button"
+      aria-pressed={props.pressed}
+      class={`notch-6 cursor-pointer border bg-inset px-2 font-hud text-[11.5px] font-semibold tracking-[0.08em] uppercase ${
+        props.pressed
+          ? props.tone === "ley"
+            ? "border-ley/60 text-ley [text-shadow:0_0_8px_rgb(79_216_255/0.5)]"
+            : "border-amber/60 text-amber"
+          : "border-line text-dead hover:border-muted"
+      }`}
+      onClick={() => props.onToggle()}
+    >
+      {props.children}
+    </button>
+  );
+}
+```
+
+- [x] **Step 2: Build the declaration section**
+
+In `CombatExchangePanel`:
+
+- subscribe to `api.combat.targets`, `incoming`, `outgoing`, and `recent` with reactive character IDs;
+- bind `declareAttack`, `respondToAttack`, and `cancelAttack` mutations;
+- show target and owned-weapon native selects with visible disabled reasons;
+- derive whether melee/ranged context controls render from the selected supported profile;
+- provide an awareness toggle, melee parry-mode select or ranged range-band select, optional signed modifier, and reason input required by the form when nonzero;
+- disable `DECLARE ATTACK` until both selector and context requirements are satisfied;
+- submit attacker/defender IDs, index, exact item snapshot, and context only;
+- never roll strike/damage client-side and never submit a damage route;
+- announce success/failure through a visible `Alert` live region and one concise telemetry line.
+
+Use this state/query skeleton in the component; the selector data and profile math
+come from the pure helper/rules package:
+
+```tsx
+const targets = createQuery(convex, api.combat.targets, () => ({
+  attackerId: props.characterId,
+}));
+const incoming = createQuery(convex, api.combat.incoming, () => ({
+  defenderId: props.characterId,
+}));
+const outgoing = createQuery(convex, api.combat.outgoing, () => ({
+  attackerId: props.characterId,
+}));
+const recent = createQuery(convex, api.combat.recent, () => ({
+  characterId: props.characterId,
+}));
+const declareAttack = createMutation(convex, api.combat.declareAttack);
+const [targetId, setTargetId] = createSignal("");
+const [weaponIndex, setWeaponIndex] = createSignal("");
+const [aware, setAware] = createSignal(true);
+const [parryMode, setParryMode] = createSignal<ParryMode>("standard");
+const [rangeBand, setRangeBand] = createSignal<RangeBand>("normal");
+const [strikeModifier, setStrikeModifier] = createSignal("");
+const [strikeReason, setStrikeReason] = createSignal("");
+const [busy, setBusy] = createSignal(false);
+const [error, setError] = createSignal<string>();
+const [historyExpanded, setHistoryExpanded] = createSignal(false);
+const choices = createMemo(() => combatWeaponChoices(props.sheet));
+const selectedIndex = createMemo(() => {
+  const value = Number(weaponIndex());
+  return Number.isInteger(value) ? value : undefined;
+});
+const selectedAttack = createMemo(() => {
+  const index = selectedIndex();
+  return index === undefined ? undefined : deriveAttackProfile(props.sheet, index);
+});
+const modifierValue = createMemo(() => {
+  const raw = strikeModifier().trim();
+  if (raw === "") return 0;
+  const value = Number(raw);
+  return Number.isSafeInteger(value) && value >= -100 && value <= 100 ? value : undefined;
+});
+const canDeclare = createMemo(() => {
+  const target = targets.data()?.find((candidate) => candidate.id === targetId());
+  const attack = selectedAttack();
+  const modifier = modifierValue();
+  return (
+    !busy() &&
+    target !== undefined &&
+    combatTargetDisabledReason(target) === undefined &&
+    attack?.supported === true &&
+    modifier !== undefined &&
+    (modifier === 0 || strikeReason().trim() !== "")
+  );
+});
+```
+
+The submit handler is:
+
+```tsx
+const submitDeclaration = async () => {
+  const index = selectedIndex();
+  const attack = selectedAttack();
+  const modifier = modifierValue();
+  const target = targetId() as Id<"characters">;
+  const entry = index === undefined ? undefined : props.sheet.equipment[index];
+  if (
+    !canDeclare() ||
+    index === undefined ||
+    !attack?.supported ||
+    modifier === undefined ||
+    !entry
+  ) {
+    return;
+  }
+  const owner = { routeId: props.characterId, routeEpoch };
+  setBusy(true);
+  setError(undefined);
+  try {
+    const result = await declareAttack({
+      attackerId: props.characterId,
+      defenderId: target,
+      weaponIndex: index,
+      expect: {
+        itemId: entry.item.id,
+        ...(entry.worn === true ? { worn: true } : {}),
+        ...(entry.rolledMdc === undefined ? {} : { rolledMdc: entry.rolledMdc }),
+      },
+      context:
+        attack.kind === "melee"
+          ? {
+              kind: "melee",
+              defenderAware: aware(),
+              parryMode: parryMode(),
+              ...(modifier === 0 ? {} : { strikeModifier: modifier }),
+              ...(strikeReason().trim() === ""
+                ? {}
+                : { strikeModifierReason: strikeReason().trim() }),
+            }
+          : {
+              kind: "ranged",
+              defenderAware: aware(),
+              rangeBand: rangeBand(),
+              ...(modifier === 0 ? {} : { strikeModifier: modifier }),
+              ...(strikeReason().trim() === ""
+                ? {}
+                : { strikeModifierReason: strikeReason().trim() }),
+            },
+    });
+    if (!ownsAsyncResult(owner, { routeId: props.characterId, routeEpoch })) return;
+    props.onTelemetry(
+      `> COMBAT :: ${result.weapon.name.toUpperCase()} — ${result.status.toUpperCase()}`,
+      result.status === "resolved" ? "dim" : "machine",
+    );
+    setStrikeModifier("");
+    setStrikeReason("");
+  } catch (caught) {
+    if (!ownsAsyncResult(owner, { routeId: props.characterId, routeEpoch })) return;
+    const message = combatErrorMessage(caught);
+    setError(message);
+    props.onTelemetry(`> COMBAT :: DECLARATION REFUSED — ${message}`, "bad");
+  } finally {
+    if (ownsAsyncResult(owner, { routeId: props.characterId, routeEpoch })) setBusy(false);
+  }
+};
+```
+
+Render it inside a single `Panel` headed `// COMBAT EXCHANGE`. This is the exact
+declaration form structure; keep the compact utility classes and do not add cards
+around individual rows:
+
+```tsx
+<Panel class="space-y-3 p-3">
+  <SectionTitle>COMBAT EXCHANGE</SectionTitle>
+  <div class="space-y-2 border-t border-line pt-2">
+    <label class="block space-y-1">
+      <MonoLabel class="block">TARGET</MonoLabel>
+      <SelectInput
+        class="w-full"
+        value={targetId()}
+        onChange={(event) => setTargetId(event.currentTarget.value)}
+      >
+        <option value="">SELECT DOSSIER</option>
+        <For each={targets.data()}>
+          {(target) => (
+            <option value={target.id} disabled={combatTargetDisabledReason(target) !== undefined}>
+              {target.name}
+              {combatTargetDisabledReason(target) ? ` — ${combatTargetDisabledReason(target)}` : ""}
+            </option>
+          )}
+        </For>
+      </SelectInput>
+    </label>
+    <label class="block space-y-1">
+      <MonoLabel class="block">WEAPON</MonoLabel>
+      <SelectInput
+        class="w-full"
+        value={weaponIndex()}
+        onChange={(event) => setWeaponIndex(event.currentTarget.value)}
+      >
+        <option value="">SELECT WEAPON</option>
+        <For each={choices()}>
+          {(choice) => (
+            <option value={choice.index} disabled={!choice.supported}>
+              {choice.label}
+              {choice.disabledReason ? ` — ${choice.disabledReason}` : ""}
+            </option>
+          )}
+        </For>
+      </SelectInput>
+    </label>
+    <div class="flex items-end gap-2">
+      <ToggleChip pressed={aware()} onToggle={() => setAware((value) => !value)}>
+        AWARE
+      </ToggleChip>
+      <Show when={selectedAttack()?.supported === true && selectedAttack()!.kind === "melee"}>
+        <label class="min-w-0 flex-1 space-y-1">
+          <MonoLabel class="block">PARRY MODE</MonoLabel>
+          <SelectInput
+            class="w-full"
+            value={parryMode()}
+            onChange={(event) => setParryMode(event.currentTarget.value as ParryMode)}
+          >
+            <option value="unavailable">UNAVAILABLE</option>
+            <option value="standard">STANDARD</option>
+            <option value="bareHanded">BARE-HANDED</option>
+          </SelectInput>
+        </label>
+      </Show>
+      <Show when={selectedAttack()?.supported === true && selectedAttack()!.kind === "ranged"}>
+        <label class="min-w-0 flex-1 space-y-1">
+          <MonoLabel class="block">RANGE BAND</MonoLabel>
+          <SelectInput
+            class="w-full"
+            value={rangeBand()}
+            onChange={(event) => setRangeBand(event.currentTarget.value as RangeBand)}
+          >
+            <option value="pointBlank">POINT-BLANK</option>
+            <option value="close">CLOSE</option>
+            <option value="normal">NORMAL</option>
+          </SelectInput>
+        </label>
+      </Show>
+    </div>
+    <div class="grid grid-cols-[72px_minmax(0,1fr)] gap-2">
+      <label class="space-y-1">
+        <MonoLabel class="block">MOD</MonoLabel>
+        <TextInput
+          aria-label="Strike modifier"
+          inputmode="numeric"
+          value={strikeModifier()}
+          onInput={(event) => setStrikeModifier(event.currentTarget.value)}
+        />
+      </label>
+      <label class="space-y-1">
+        <MonoLabel class="block">REASON</MonoLabel>
+        <TextInput
+          aria-label="Strike modifier reason"
+          class="w-full"
+          value={strikeReason()}
+          onInput={(event) => setStrikeReason(event.currentTarget.value)}
+        />
+      </label>
+    </div>
+    <Button
+      variant="primary"
+      class="w-full text-left"
+      disabled={!canDeclare()}
+      onClick={() => void submitDeclaration()}
+    >
+      {busy() ? "> TRANSMITTING…" : "> DECLARE ATTACK"}
+    </Button>
+    <Show when={error()}>{(message) => <Alert tone="danger">{message()}</Alert>}</Show>
+  </div>
+</Panel>
+```
+
+- [x] **Step 3: Build incoming and outgoing queues**
+
+Incoming rows show attacker, weapon, natural strike die, bonus, total, and stored context before any response action. Render only the stored server-derived response options as buttons, with modifier and `0 ACTION`/`1 ACTION` metadata. Render “TAKE THE HIT” explicitly for `none`.
+
+Each response form owns an optional modifier/reason. On submit, capture `{routeId, routeEpoch, exchangeId}` and ignore completion unless it still owns all three. Outgoing pending rows show target/weapon/strike and an explicit `CANCEL` command.
+
+Use keyed row components so draft state is scoped to an exchange. The response
+handler must have this ownership and payload shape:
+
+```ts
+type IncomingExchange = FunctionReturnType<typeof api.combat.incoming>[number];
+type OutgoingExchange = FunctionReturnType<typeof api.combat.outgoing>[number];
+```
+
+`IncomingExchangeRow` receives `exchange: IncomingExchange`, `characterId`,
+`routeEpoch: Accessor<number>`, and `onTelemetry`. It creates its own
+`respondToAttack` mutation plus `defenseModifier`, `defenseReason`, `busy`, and
+`error` signals. Its `defenseModifierValue` uses the same safe-integer -100..100
+parser as the declaration modifier.
+
+```tsx
+const submitResponse = async (kind: CombatResponseKind) => {
+  const modifier = defenseModifierValue();
+  if (modifier === undefined || (modifier !== 0 && defenseReason().trim() === "")) return;
+  const owner = {
+    routeId: props.characterId,
+    routeEpoch: props.routeEpoch(),
+    exchangeId: props.exchange._id,
+  };
+  setBusy(true);
+  setError(undefined);
+  try {
+    const result = await respondToAttack({
+      exchangeId: props.exchange._id,
+      response: {
+        kind,
+        ...(modifier === 0 ? {} : { defenseModifier: modifier }),
+        ...(defenseReason().trim() === "" ? {} : { defenseModifierReason: defenseReason().trim() }),
+      },
+    });
+    const current = {
+      routeId: props.characterId,
+      routeEpoch: props.routeEpoch(),
+      exchangeId: props.exchange._id,
+    };
+    if (!ownsAsyncResult(owner, current)) return;
+    props.onTelemetry(
+      `> COMBAT :: ${result.status === "stale" ? "STALE" : "RESPONSE LOCKED"}`,
+      result.status === "stale" ? "dim" : "machine",
+    );
+  } catch (caught) {
+    const current = {
+      routeId: props.characterId,
+      routeEpoch: props.routeEpoch(),
+      exchangeId: props.exchange._id,
+    };
+    if (!ownsAsyncResult(owner, current)) return;
+    setError(combatErrorMessage(caught));
+  } finally {
+    const current = {
+      routeId: props.characterId,
+      routeEpoch: props.routeEpoch(),
+      exchangeId: props.exchange._id,
+    };
+    if (ownsAsyncResult(owner, current)) setBusy(false);
+  }
+};
+```
+
+Render options directly from `props.exchange.defenseOptions`:
+
+```tsx
+<For each={props.exchange.defenseOptions}>
+  {(option) => (
+    <Button disabled={busy()} onClick={() => void submitResponse(option.kind)}>
+      {option.kind === "none" ? "> TAKE THE HIT" : `> ${option.kind.toUpperCase()}`} ·
+      {option.bonus >= 0 ? "+" : ""}
+      {option.bonus} · {option.actionCost} ACTION
+    </Button>
+  )}
+</For>
+```
+
+The outgoing cancel handler captures the same owner triple, calls
+`cancelAttack({ exchangeId })`, and emits `> COMBAT :: ATTACK CANCELLED` only if
+the owner still matches. Render the strike die/bonus/total before both incoming
+and outgoing actions.
+
+- [x] **Step 4: Build recent persisted history**
+
+Use `formatExchangeSummary` and `exchangeTone`. Show at most 20 entries; include miss, defended, hit, cancelled, and stale states. Newly observed resolved IDs may receive the existing `strike-flash` class once, but do not animate the whole rail or add an animation dependency.
+
+```tsx
+<section class="border-t border-line pt-2" aria-labelledby="combat-recent-title">
+  <MonoLabel class="block text-dead" id="combat-recent-title">
+    RECENT
+  </MonoLabel>
+  <Show
+    when={(recent.data()?.length ?? 0) > 0}
+    fallback={<p class="font-mono text-[11.5px] text-dead">// NO EXCHANGES</p>}
+  >
+    <ol class="mt-2 space-y-2">
+      <For each={recent.data()}>
+        {(exchange) => (
+          <li class={`border-l-2 px-2 font-mono text-[11px] ${toneClass[exchangeTone(exchange)]}`}>
+            {formatExchangeSummary(exchange)}
+          </li>
+        )}
+      </For>
+    </ol>
+  </Show>
+</section>
+```
+
+Define `toneClass` locally as dim -> `border-dead text-muted`, warn ->
+`border-amber text-amber`, bad -> `border-blood text-blood-text`, and good ->
+`border-ok text-ok`. There is intentionally no cyan mapping.
+
+```ts
+const toneClass = {
+  dim: "border-dead text-muted",
+  warn: "border-amber text-amber",
+  bad: "border-blood text-blood-text",
+  good: "border-ok text-ok",
+} as const;
+```
+
+- [x] **Step 5: Implement route reset and async ownership**
+
+Implement a named `resetRouteState` callback and wire it with
+`createEffect(on(() => props.characterId, resetRouteState, { defer: true }))`.
+The callback increments a monotonic route epoch and resets target, weapon,
+context, modifiers, response draft/error state, and expanded history. Mutation
+completion handlers must check the captured route ID and epoch; response
+handlers also check exchange ID. A boolean `busy` may control button affordance,
+but it is never sufficient for ownership.
+
+```tsx
+let routeEpoch = 0;
+const resetRouteState = () => {
+  routeEpoch += 1;
+  setTargetId("");
+  setWeaponIndex("");
+  setAware(true);
+  setParryMode("standard");
+  setRangeBand("normal");
+  setStrikeModifier("");
+  setStrikeReason("");
+  setBusy(false);
+  setError(undefined);
+  setHistoryExpanded(false);
+};
+createEffect(on(() => props.characterId, resetRouteState, { defer: true }));
+```
+
+- [x] **Step 6: Mount the panel at the top of the right rail**
+
+Change `TelemetryRail`'s root from `<aside>` to `<section>` so the new outer rail
+is the sole complementary landmark. Preserve its `aria-label`, log role,
+auto-scroll, and current action controls. Keep the existing manual `Damage`
+utility visibly separate from `DECLARE ATTACK`.
+
+Insert this opening markup immediately before the existing `TelemetryRail` call,
+leave that call and its complete `actions` expression unchanged as the next child,
+then close the `aside` immediately after it:
+
+```tsx
+<aside class="min-w-0 space-y-3" aria-label="Dossier command rail">
+  <CombatExchangePanel
+    characterId={id()}
+    sheet={sheet()!}
+    onTelemetry={telemetry.log}
+  />
+```
+
+The exact closing markup after the current `TelemetryRail` call is `</aside>`.
+
+Change the root element returned by `TelemetryRail` from `aside` to `section`
+and keep `aria-label="Field telemetry"`. Update the page's gameplay comment to
+distinguish ephemeral client-side utility rolls from persisted server-owned
+hostile combat exchanges.
+
+- [x] **Step 7: Run web and affected package gates**
+
+Run:
+
+```text
+vp test apps/web/tests/combat-exchange.test.ts apps/web/tests/convex.test.ts
+vp run @riftforge/web#check
+vp run @riftforge/web#test
+vp run @riftforge/backend#check
+```
+
+Expected: PASS.
+
+- [x] **Step 8: Commit the panel**
+
+```text
+git add -- apps/web/src/components/combat-exchange-panel.tsx apps/web/src/components/ui.tsx apps/web/src/pages/character-sheet.tsx apps/web/src/lib/combat-exchange.ts apps/web/tests/combat-exchange.test.ts
+git commit -m "feat(web): add S.D.C. combat exchange panel"
+```
+
+---
+
+### Task 12: Full Automated Verification and Review Hardening
+
+**Files:**
+
+- Modify as needed: only files already in the approved file map
+
+- [x] **Step 1: Run all affected package gates in CI order**
+
+```text
+vp run @riftforge/rules#check
+vp run @riftforge/rules#test
+vp run @riftforge/backend#check
+vp run @riftforge/backend#test
+vp run @riftforge/web#check
+vp run @riftforge/web#test
+```
+
+Expected: all PASS. Record the actual test counts; do not reuse historical counts.
+
+- [x] **Step 2: Run root gates and whitespace validation**
+
+```text
+vp check
+vp test
+git diff --check
+```
+
+Expected: all PASS.
+
+- [x] **Step 3: Review the full diff against the approved design**
+
+Run:
+
+```text
+git diff --stat main...HEAD
+git diff --check main...HEAD
+git status --short --branch
+```
+
+Manually verify every stable error code is produced, no Natural A.R. branch exists, no M.D.C. arithmetic/conversion exists, every public query is bounded/indexed, every random roll is server-owned, final character state is revalidated, and the web never computes/routs damage.
+
+- [x] **Step 4: Fix only evidence-backed findings with new regression tests**
+
+For every real defect found, add the smallest failing test that demonstrates the bug class, run it red, fix the root cause, rerun the focused test and affected package gates, then checkpoint-commit:
+
+```text
+git commit -m "fix(combat): harden exchange invariants"
+```
+
+Skip this commit if no change is needed.
+
+---
+
+### Task 13: Live Convex and Browser Acceptance
+
+**Files:**
+
+- No required source files; fix only reproducible defects with tests.
+
+- [x] **Step 1: Start from a known live-backend state**
+
+Check port 3210 and identify its owning process. If an orphaned `convex-local-backend` is serving stale functions, stop that exact process only. From `packages/backend`, run `pnpm exec convex dev`; from `apps/web`, run `vp dev`. Keep both processes available while testing `http://localhost:5173`.
+
+- [x] **Step 2: Prepare two combat-ready characters**
+
+Use existing local characters or seed two valid characters. Roll both characters' vitals. Give the attacker `survival-knife` and `automatic-pistol`. Keep the defender unarmored for the supported path. Open both dossier URLs in separate tabs/windows so Convex live subscriptions are exercised across clients.
+
+- [x] **Step 3: Verify the complete supported flow**
+
+Repeat real declarations as needed to observe and capture:
+
+1. a server-rolled immediate miss;
+2. a pending melee strike followed by parry, dodge, or take-the-hit;
+3. a pending firearm strike with range-band copy and no parry option;
+4. a successful defense with unchanged pools/history finalized together;
+5. a hit with body S.D.C. then H.P. change and matching persisted history in both dossiers;
+6. action-cost metadata and strike/defense/damage details;
+7. concise telemetry lines without telemetry becoming the source of truth.
+
+- [x] **Step 4: Verify boundaries and navigation ownership**
+
+Equip a nondepleted production M.D.C. suit on the defender and verify target/declaration disable copy. Keep backend tests as the direct-call proof that the server also refuses it before insertion. Verify M.D. weapons remain visible but disabled.
+
+Navigate from one character ID to another while a declaration/response is in flight. Verify target/weapon/context/error/history drafts reset and no late result or telemetry line crosses into the new dossier. Verify keyboard operation, visible focus, native labels, and screen-reader live regions. Check the rail at desktop and narrow/mobile widths for overflow.
+
+- [x] **Step 5: Stop only the processes started for this check**
+
+Terminate the captured Convex CLI/local-backend and web-dev process IDs. Do not kill unrelated Node processes.
+
+- [x] **Step 6: Re-run affected gates after any live fix**
+
+If live verification caused code changes, rerun Task 12 completely and commit the tested fix. If no changes were needed, record the live scenarios and timestamp in the design outcome without creating an empty commit.
+
+---
+
+### Task 14: Documentation, Tracker Boundary, and Draft PR
+
+**Files:**
+
+- Modify: `README.md`
+- Modify: `.codex/superpowers/specs/2026-07-19-sdc-combat-exchange-design.md`
+- Modify: `.codex/superpowers/plans/2026-07-19-sdc-combat-exchange.md`
+
+- [x] **Step 1: Update repository documentation with verified current state**
+
+Replace README language saying A.R./hostile persistence are wholly future work with a concise statement that S.D.C. weapon exchanges, defense choice, body routing, and future-ready artificial S.D.C. armor routing exist; explicitly state that full M.D.C. interaction remains follow-up work.
+
+Append an implementation-outcome section to the approved design with commit(s), actual package/root test counts, live scenarios, and the date/time scope. Check completed plan boxes only when their evidence exists.
+
+- [x] **Step 2: Run documentation gates and commit**
+
+```text
+vp check
+vp test
+git diff --check
+git status --short --branch
+```
+
+Commit:
+
+```text
+git add -- README.md .codex/superpowers/specs/2026-07-19-sdc-combat-exchange-design.md .codex/superpowers/plans/2026-07-19-sdc-combat-exchange.md
+git commit -m "docs: record S.D.C. combat delivery"
+```
+
+- [x] **Step 3: Correct and align issue #44**
+
+Refresh the issue first:
+
+```text
+gh issue view 44 --json number,title,body,state,labels,url
+```
+
+Edit the body so it no longer claims Natural A.R. needs implementation. Preserve the foundation context, then state with rendered p.339 evidence that Natural A.R. does not apply in Rifts; describe the delivered S.D.C.-tier exchange/armor-routing scope; list full M.D.C. as an explicit follow-up; and include time-scoped package/root/live verification. Do not close #44 from the branch.
+
+- [x] **Step 4: Create the dedicated full-M.D.C. follow-up**
+
+Before creating, search again to prevent a duplicate:
+
+```text
+gh issue list --state all --limit 100 --search "M.D.C. combat" --json number,title,state,url
+```
+
+If no equivalent issue exists, create one titled:
+
+```text
+Full M.D.C. combat: tier interaction, armor ablation, and unprotected outcomes
+```
+
+The body must cover: M.D.-to-M.D.C. damage, S.D.C.-to-M.D.C. imperviousness/conversion rules, final-point/final-blast armor absorption, depleted protection, M.D. against an unprotected mortal, required injury/death-state modeling, page verification from rendered RUE pp.288 and 355-359, and explicit dependency on #44's ledger. Apply `area:rules`; do not mark it `next-up` unless the maintainer explicitly chooses that ordering.
+
+Use this reviewed body and capture the returned URL:
+
+```text
+$mdcBody = @'
+Issue #44 deliberately stops at the S.D.C. tier. This follow-up extends its persisted exchange ledger with the complete Mega-Damage rules after re-verifying the rendered Rifts Ultimate Edition pages.
+
+Scope:
+- M.D. weapon damage against M.D.C. protection.
+- S.D.C./Hit Point attacks against M.D.C. protection, including imperviousness and any printed conversion exceptions.
+- The final armor point/final-blast absorption rule and behavior after protection reaches zero.
+- M.D. against an unprotected mortal, including any injury, coma, or death state the current character schema cannot represent.
+- Pure deterministic rules, atomic Convex persistence, UI result presentation, and migration/compatibility with #44 history.
+
+Rendered sources to reverify before design: RUE pp.288 and 355-359. Do not implement from remembered Palladium rules.
+
+Depends on #44.
+'@
+$mdcIssueUrl = gh issue create --title "Full M.D.C. combat: tier interaction, armor ablation, and unprotected outcomes" --body $mdcBody --label "area:rules"
+```
+
+- [x] **Step 5: Perform final verification immediately before publication**
+
+Run:
+
+```text
+vp run @riftforge/rules#check
+vp run @riftforge/rules#test
+vp run @riftforge/backend#check
+vp run @riftforge/backend#test
+vp run @riftforge/web#check
+vp run @riftforge/web#test
+vp check
+vp test
+git diff --check
+git status --short --branch
+```
+
+Expected: clean gates and only intentional committed history.
+
+- [x] **Step 6: Push and open a draft PR for Cubic review**
+
+```text
+git push -u origin feat/sdc-combat-exchange
+```
+
+Then construct a reviewed PowerShell body using the full-M.D.C. issue URL captured
+in Step 4. If publication runs in a fresh shell, recover it first with:
+
+```text
+$mdcIssueUrl = gh issue list --state open --limit 100 --search "Full M.D.C. combat: tier interaction" --json url --jq '.[0].url'
+```
+
+```text
+$prBody = @"
+Closes #44
+
+## Summary
+- Add a persisted two-phase S.D.C. attack/defense exchange with server-owned dice.
+- Derive legal melee/ranged defenses and route hits through body pools or artificial S.D.C. armor.
+- Add the Ley Terminal command-rail UI with route-safe live Convex feeds.
+
+## Rules boundary
+- Natural A.R. is not implemented because rendered RUE p.339 says it does not apply in Rifts.
+- M.D. weapons and nondepleted M.D.C. protection are refused before rolls or writes.
+- Full M.D.C. resolution remains tracked at $mdcIssueUrl.
+
+## Verification
+- Affected rules, backend, and web package check/test gates pass.
+- Root vp check, vp test, and git diff --check pass.
+- Live two-dossier miss, defense, hit, M.D.C. refusal, and route-change ownership scenarios pass.
+
+## Tracker
+- Issue #44 is aligned to the delivered S.D.C. scope and rendered-page evidence.
+"@
+gh pr create --draft --title "feat: add persisted S.D.C. combat exchanges" --body $prBody
+```
+
+The body must contain no AI attribution. Review the rendered PR body immediately
+with `gh pr view --json body,url`; if shell interpolation damaged it, correct it
+before requesting review. Put the actual numeric test counts in the design outcome
+and issue update; the PR verification section intentionally names the gates rather
+than copying counts that can change during review hardening.
+
+- [ ] **Step 7: Address Cubic findings honestly**
+
+For every finding, reproduce/validate first. If real, add a regression test and fix the entire bug class; if invalid, reply with evidence. After each push, wait for the new Cubic review and rerun the affected gates. Leave the PR unmerged for the human maintainer.
+
+Review pass evidence on 2026-07-20: both P3 findings were valid. The web disclosure
+now associates its state with the recent-history list, and take-the-hit rejects a
+nonzero defense modifier at the shared schema while the web omits modifier fields
+for that response. Red-green coverage spans rules, backend, and web. Fresh package
+gates pass at 309 rules, 83 backend, and 29 web tests; root `vp check` and the
+421-test root suite pass. Live acceptance covered both fixes against local Convex.
+Commit `a9a0fde` was published, CI passed, and both inline threads received
+evidence-backed replies. The requested Cubic re-review could not start because the
+workspace had consumed 40,345 of its 40,000 monthly review lines; Cubic reported
+that reviews resume on 2026-08-01. This step remains open and the PR remains
+unmerged until that external review gate can run.
+
+---
+
+## Final Success Checklist
+
+- [x] Attacker selects another ready character and a supported owned S.D.C. weapon.
+- [x] Server validates context and owns strike, defense, and damage dice.
+- [x] Immediate misses persist; potential hits pause for an explicit defender/GM choice.
+- [x] Only engine-authorized parry/dodge/automatic-dodge/none choices appear and validate.
+- [x] Melee and firearm thresholds/bonuses remain distinct; firearm math gets no P.P./general H2H leakage.
+- [x] Artificial S.D.C. armor equality, penetration, depletion, and no-spill behavior are pure-tested against printed values.
+- [x] Live unarmored hits atomically update body pools and immutable history exactly once.
+- [x] Relevant state drift finalizes stale with no damage; narrative/unrelated state does not.
+- [x] M.D. weapons and M.D.C.-protected targets fail before dice and persistence.
+- [x] No Natural A.R., rounds/actions enforcement, auth, geometry, or other excluded system was added.
+- [x] Route changes cannot leak drafts, feeds, telemetry, or late mutation results.
+- [x] Rules, backend, web, and root gates pass with current counts; live browser acceptance passes.
+- [x] README, approved design, issue #44, full-M.D.C. follow-up, and draft PR all reflect the same verified scope.
+- [x] The human maintainer, not the agent, retains merge authority.
diff --git a/.codex/superpowers/specs/2026-07-19-sdc-combat-exchange-design.md b/.codex/superpowers/specs/2026-07-19-sdc-combat-exchange-design.md
new file mode 100644
index 0000000..9121583
--- /dev/null
+++ b/.codex/superpowers/specs/2026-07-19-sdc-combat-exchange-design.md
@@ -0,0 +1,656 @@
+# S.D.C. Combat Exchange Design
+
+**Date:** 2026-07-19
+**Status:** Approved in conversation
+**Branch:** `feat/sdc-combat-exchange`
+**Primary issue:** [#44 — A.R. and armor damage in combat](https://github.com/StreamDemon/RiftForge/issues/44)
+
+## Goal
+
+Deliver a rules-faithful, multiplayer-safe S.D.C. hostile-combat vertical slice
+without prematurely building the complete VTT encounter system or inventing
+Mega-Damage outcomes the current character model cannot represent.
+
+This slice will:
+
+- classify an owned weapon attack as melee or ranged and derive its legal bonuses;
+- let the attacker declare a target and GM-adjudicated combat context;
+- roll the strike on the server and persist a pending defense when appropriate;
+- let the defender or GM choose an engine-authorized parry, dodge, automatic
+  dodge, or no defense;
+- revalidate the exchange against current attacker and defender state;
+- roll defense and damage on the server;
+- route S.D.C. damage to artificial S.D.C. armor or the defender's body;
+- apply the result atomically to the correct persisted pool; and
+- surface incoming, outgoing, and recent exchanges on the live dossier.
+
+The rules engine enumerates and validates choices. It never chooses how a player
+role-plays a character and never substitutes for the Game Master's situational
+judgment.
+
+## Approved decisions
+
+1. **S.D.C. tier only.** Full M.D.C. resolution is a separate follow-up.
+2. **Persisted two-phase exchange.** The attacker declares and rolls first; a
+   potential hit waits for a defender/GM response.
+3. **No full encounter model.** Initiative, rounds, action budgets, ownership,
+   and map positioning remain future work.
+4. **No natural A.R. path.** Rendered RUE p.339 explicitly says Natural A.R. does
+   not apply in Rifts. Issue #44's contrary wording is stale and will be corrected.
+5. **M.D.C. fails safely.** M.D. weapons and M.D.C.-protected targets are visible
+   but cannot enter this resolver. Refusal happens before dice or state changes.
+6. **GM context is explicit and recorded.** Situational facts and modifiers are
+   inputs, not hidden assumptions or client-side arithmetic.
+7. **State drift invalidates the exchange.** A response never lands against a
+   changed weapon, build, armor layer, or damage pool.
+
+## Printed rules evidence
+
+All facts were checked visually against rendered pages of the scanned local Rifts
+Ultimate Edition rulebook. The PDF has no usable text layer.
+
+| Printed page | Rule used in this design                                                                                                                                                                                                                    |
+| ------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| 287          | Physical S.D.C. is depleted before Hit Points. Artificial S.D.C. armor has A.R. plus an ablative S.D.C. pool. A strike at or below A.R. damages armor; a strike above A.R. damages the wearer. Depleted armor stops protecting future hits. |
+| 288          | One M.D. equals 100 S.D.C.; M.D.C. armor is generally impervious to S.D.C./Hit Point damage and has no A.R. Full interaction is outside this slice.                                                                                         |
+| 339          | The attacker rolls first. A total of 1-4 misses in ordinary combat. Artificial S.D.C. armor routing uses the completed strike total. The page explicitly says Natural A.R. does not apply in Rifts.                                         |
+| 340          | A natural 20 is a critical unless met by a natural-20 defense. Defenders may choose parry or dodge. Trained parry is action-free; untrained parry costs the next action. Bare-handed weapon parries receive no normal parry bonus.          |
+| 341          | Handheld melee weapons add applicable P.S./Hand-to-Hand damage bonuses. Add bonuses before critical multiplication. Dodging costs an action; automatic dodge does not.                                                                      |
+| 344          | Automatic dodge is an explicit ability, not an automatic success, and uses only bonuses that specifically apply to it.                                                                                                                      |
+| 345-346      | Dodge ties favor the defender. A roll of 1 always misses. A natural 20 can only be beaten by a natural-20 defense.                                                                                                                          |
+| 355          | The last point of armor absorbs the entire destroying hit. Subsequent attacks reach the wearer. This supports the same no-spill rule used for S.D.C. armor.                                                                                 |
+| 360-361      | Modern firearms do not use P.P. or general Hand-to-Hand strike bonuses. Ranged attacks normally require 8+ to strike. Gunfire may be dodged only when seen/anticipated, with point-blank and close-range penalties.                         |
+
+The existing p.346 constants remain page-stamped content. New ranged-target and
+range-penalty constants must also live in page-stamped, load-validated content
+rather than source-code literals.
+
+## Scope
+
+### In scope
+
+- Owned knife and axe attacks as melee S.D.C. weapon attacks.
+- Owned handgun and submachine-gun attacks as ranged S.D.C. weapon attacks.
+- Current untrained firearm behavior plus any already-modeled, specifically named
+  gun bonus such as `strikeGuns`.
+- Server-controlled strike, defense, and damage dice.
+- Parry, dodge, automatic dodge, and taking the hit.
+- GM-declared awareness, parry mode, range band, and situational modifiers.
+- Artificial S.D.C. armor A.R. and ablation in the pure rules layer.
+- Unarmored S.D.C./Hit Point application in the live backend.
+- S.D.C. armor persistence automatically when page-stamped S.D.C. armor content
+  becomes available.
+- M.D.C. boundary messages and a dedicated follow-up tracker.
+- Persisted incoming/outgoing/recent exchange UI.
+
+### Out of scope
+
+- M.D.-to-M.D.C. damage, S.D.C.-to-M.D.C. conversion, impervious armor, and the
+  usually-lethal result of M.D. against an unprotected mortal.
+- Natural A.R.; it does not apply in this rulebook's Rifts combat rules.
+- Initiative, melee rounds, attacks-per-melee expenditure, or turn enforcement.
+- Authentication, player ownership, GM roles, permissions, and adversarial clients.
+- VTT maps, measured distance, line-of-sight geometry, or cover geometry.
+- Called/aimed shots, bursts, payload tracking, thrown weapon modes, hit locations,
+  paired weapons, entangle, disarm, roll with impact, and weapon breakage.
+- Unarmed strikes and special Hand-to-Hand moves.
+- Long-term combat-log retention or encounter archival policy.
+- A generic spell attack/effect interpreter.
+
+## Architecture
+
+The feature has three boundaries with one-directional authority:
+
+```text
+page-stamped content + pure rules
+             |
+             v
+Convex exchange ledger + atomic mutations
+             |
+             v
+SolidJS declaration/response/history UI
+```
+
+### Rules package
+
+The existing `resolveStrike(input)` remains the low-level opposed-roll primitive.
+A new pure combat-exchange layer sits above it and owns:
+
+- attack classification;
+- melee versus ranged minimum strike totals;
+- attacker and defender bonus selection;
+- legal defense enumeration and action-cost metadata;
+- critical damage multiplication;
+- protection classification;
+- artificial S.D.C. armor routing; and
+- pure body/armor result calculation.
+
+The layer accepts already-derived sheets, explicit GM context, completed rolls, and
+damage input. It never reads Convex, generates identifiers, or mutates a character.
+Random rolls remain injectable at the function boundary.
+
+### Backend
+
+Convex owns exchange identity, synchronization, dice, immutable outcome records,
+and the character write. The response mutation reloads and re-derives both
+characters before it applies anything.
+
+### Web
+
+SolidJS presents server-derived options and results. It does not reproduce bonus,
+A.R., critical, or routing calculations. Client state is limited to an unsubmitted
+declaration/response form and in-flight ownership tokens.
+
+## Pure rules model
+
+### Attack classification
+
+Weapon category defines attack kind; damage type defines tier support.
+
+| Weapon category               | Attack kind | #44 support                                    |
+| ----------------------------- | ----------- | ---------------------------------------------- |
+| `knife`, `axe`                | melee       | Supported when damage type is `sdc`            |
+| `handgun`, `submachineGun`    | ranged      | Supported when damage type is `sdc`            |
+| `energyPistol`, `energyRifle` | ranged      | Refused because current catalog damage is `md` |
+
+Thrown use of a knife or axe is not inferred from category. It requires a future
+explicit attack mode and is outside this slice.
+
+### Attack profile
+
+The engine derives a profile containing at least:
+
+- attack kind;
+- minimum successful strike total;
+- base strike bonus and named sources;
+- damage formula;
+- applicable flat damage bonus;
+- critical threshold;
+- damage type;
+- weapon index and instance snapshot; and
+- a supported/refused result with a stable reason code.
+
+Melee uses the normal derived strike and damage bonuses. Ranged uses only bonuses
+that specifically apply to guns. P.P. and general Hand-to-Hand strike or damage
+bonuses never leak into firearms.
+
+The current skill catalog contains no structured modern W.P. entries. Current
+characters therefore fire as untrained shooters except for a separately modeled,
+specifically named gun bonus already present in the combat profile. The design
+leaves a typed proficiency-bonus seam but does not invent missing content.
+
+### GM context
+
+The declaration stores explicit situational context:
+
+- `defenderAware`: whether the defender sees and knows the attack is coming;
+- melee `parryMode`: `unavailable`, `standard`, or `bareHanded`;
+- ranged `rangeBand`: `pointBlank`, `close`, or `normal`;
+- optional `strikeModifier`; and
+- `strikeModifierReason`, required when the modifier is nonzero.
+
+A situational modifier must be a safe integer from -100 through +100 inclusive.
+That application bound prevents corrupt or accidental extreme values; it does not
+purport to be a printed rule. Book-defined modifiers such as ranged dodge penalties
+are derived by the engine and are not re-entered as situational modifiers.
+
+### Defense options
+
+Each legal option includes its kind, derived bonus, action-cost metadata, and a
+short explanation for the UI and persisted result.
+
+#### Melee
+
+- `parry` is offered only when `parryMode` is not `unavailable` and the defender
+  is aware of the attack.
+  - `standard` uses the derived parry bonus.
+  - `bareHanded` uses no ordinary parry bonus against the weapon.
+  - formal Hand-to-Hand training makes the parry action-free; otherwise the
+    metadata records a one-action cost.
+- `dodge` is offered when the defender is aware and records a one-action cost.
+- `autoDodge` is offered only when the sheet explicitly grants that capability;
+  it records zero action cost and uses only the automatic-dodge bonus.
+- `none` is always available as “take the hit.”
+
+#### Ranged
+
+- Only dodge-family defense is available, and only when the defender is aware.
+- The bonus excludes general Hand-to-Hand dodge bonuses.
+- The engine applies the printed point-blank or close-range penalty from content.
+- Automatic dodge is offered only if the sheet explicitly grants the capability;
+  any bonus still obeys the ranged-defense bonus restrictions.
+- `none` is always available.
+
+An actual defense response may include a safe-integer `defenseModifier` with a
+required reason when nonzero. A `none` response cannot carry a nonzero defense
+modifier, and the client omits both defense-modifier fields when taking the hit so
+immutable history cannot imply that a bonus affected an unopposed strike. The
+engine revalidates the selected option; the client cannot submit an arbitrary
+defense kind or bonus.
+
+### Resolution order
+
+1. Validate the completed strike roll.
+2. Apply natural-one and attack-kind minimum-total rules.
+3. Resolve an authorized opposed defense with `resolveStrike`.
+4. Determine critical state and multiplier.
+5. Roll damage and add only the applicable flat damage bonus.
+6. Apply the multiplier after the flat bonus.
+7. Route a hit against current protection.
+8. Return new pool values without mutating input.
+
+### S.D.C. routing
+
+Protection is classified as:
+
+- `none` — damage personal S.D.C., then Hit Points;
+- `sdcArmor` — compare completed strike total to A.R.; or
+- `mdcArmor` — return `unsupportedMdcProtection` before rolling.
+
+For nondepleted S.D.C. armor:
+
+- strike total at or below A.R. routes the entire hit to armor;
+- strike total above A.R. routes the entire hit to the wearer;
+- armor floors at zero;
+- a destroying hit never spills to the wearer; and
+- a future attack treats zero-point armor as no protection.
+
+The current production catalog contains no page-stamped S.D.C. armor suit. Pure
+rules tests therefore exercise this branch with validated fixtures. The backend
+uses the same generic path and will activate it without redesign when real content
+exists.
+
+## Persisted exchange model
+
+A new `combatExchanges` table stores a queryable ledger. Its validator mirrors a
+discriminated status model rather than a loose object with contradictory optional
+fields.
+
+Shared fields include:
+
+- attacker and defender character IDs;
+- attacker/defender display names captured for history;
+- weapon index, item ID, display name, and expected instance snapshot;
+- attack kind and damage type;
+- GM context;
+- attacker and defender combat-state tokens;
+- completed server strike roll;
+- status; and
+- Convex creation time.
+
+Statuses are:
+
+- `pendingDefense` — a potential hit awaits a response;
+- `resolved` — miss, defended attack, or applied hit with immutable details;
+- `cancelled` — withdrawn before response; and
+- `stale` — relevant character state changed before response.
+
+Resolved details include the chosen defense, completed defense roll when present,
+critical state, detailed damage roll, total damage, routed pool, previous and next
+pool values, and a stable outcome/reason code.
+
+Indexes support bounded queries for:
+
+- pending exchanges by defender;
+- pending/outgoing exchanges by attacker; and
+- recent exchanges involving a character.
+
+Queries always use hard limits. Records are not automatically deleted in this
+slice; long-term retention belongs to the future encounter/history design.
+
+## Combat-state tokens
+
+The declaration stores deterministic tokens made from only combat-relevant state.
+They are stale-state guards, not hashes for authorization or secrecy.
+
+The attacker token covers:
+
+- level, attributes, Hand-to-Hand type, and derived combat profile;
+- selected weapon index and expected item instance; and
+- any future structured proficiency data consumed by the attack profile.
+
+The defender token covers:
+
+- level, attributes, Hand-to-Hand type, and relevant defensive profile;
+- rolled/current S.D.C. and Hit Points;
+- worn armor identity, instance state, maximum, current pool, tier, and A.R.; and
+- any future structured defensive data consumed by option derivation.
+
+Tokens use a stable serialization of an explicitly ordered value. Narrative,
+P.P.E., unrelated inventory entries, and other noncombat changes do not stale an
+exchange.
+
+If either token differs at response time, the mutation records `stale` and returns
+without applying damage. Resolving one hit may intentionally stale another pending
+hit against the same old pools.
+
+## Backend operations
+
+### `combatTargets`
+
+A bounded query returns other characters with only target-selection data:
+
+- ID and display name;
+- whether vitals are rolled and combat-ready; and
+- protection tier (`none`, `sdcArmor`, or `mdcArmor`).
+
+The query supports good disabled-state copy, but the declaration mutation repeats
+all validation. Self-targeting is refused.
+
+### `declareAttack`
+
+1. Load and derive attacker and defender.
+2. Resolve and verify the indexed weapon against the client's expected instance.
+3. Derive the attack profile and defender protection.
+4. Validate GM context and modifier reason.
+5. Refuse unsupported M.D. or M.D.C. state before dice or inserts.
+6. Compute combat-state tokens.
+7. Roll the strike with Convex's replay-safe mutation randomness.
+8. Record an immediate resolved miss or a pending defense.
+9. Return the persisted exchange.
+
+Even a successful strike with no active defense option remains pending with “take
+the hit” as the only response. This preserves defender/GM acknowledgement and keeps
+all successful strikes on the same two-phase path.
+
+### `respondToAttack`
+
+1. Load the pending exchange; reject resolved/cancelled/stale state.
+2. Reload and re-derive both characters.
+3. Recompute tokens and mark stale on mismatch.
+4. Recompute legal defenses and validate the selected response.
+5. Roll the defense when selected.
+6. Resolve the opposed strike.
+7. On a hit, roll damage and route it through the pure engine.
+8. Revalidate the new defender through `deriveSheet`.
+9. Patch the defender and finalize the exchange in the same transaction.
+
+Convex mutation serialization ensures that only one concurrent response can win.
+No mutation path leaves a finalized exchange without its matching pool update or a
+pool update without its matching finalized exchange.
+
+### `cancelAttack`
+
+A pending exchange can be cancelled. Authentication is not yet present, so the
+backend cannot enforce player-versus-GM ownership; that limitation is explicit and
+belongs to the accounts/VTT authorization work.
+
+### Existing direct damage
+
+The current manual damage mutation remains a GM pool-adjustment utility and is not
+called by hostile combat. The new exchange path never accepts client-routed damage.
+Automated M.D.C. interaction remains refused even though a GM may continue to track
+a displayed armor pool manually.
+
+## Web experience
+
+A new focused `CombatExchangePanel` lives at the top of the dossier's right-hand
+command rail. It is separate from `SheetView` so the sheet component does not absorb
+workflow, query, and mutation state.
+
+### Declare attack
+
+- Target selector excludes the current character.
+- Weapon selector lists owned weapons and allows only supported S.D.C. weapons.
+- M.D. weapons remain visible with a disabled follow-up explanation.
+- Target readiness and M.D.C. protection appear before submission.
+- Context controls are conditional: melee parry mode versus ranged range band,
+  plus awareness and optional reasoned modifier.
+- The primary command reads `DECLARE ATTACK`, not `DEAL DAMAGE`.
+
+### Incoming attacks
+
+- Pending attacks show attacker, weapon, natural die, bonus, total, and context.
+- The defender sees the completed strike before choosing, matching the printed
+  sequence.
+- Only server-derived response options render as enabled commands.
+- Each option shows its modifier and whether it consumes an action for manual
+  table tracking.
+- “Take the hit” is explicit and never represented as an accidental default.
+
+### Recent exchanges
+
+A bounded persisted list shows:
+
+- miss, defended, hit, cancelled, or stale;
+- strike and defense totals;
+- critical state;
+- damage formula/roll/total;
+- armor/body routing; and
+- the affected pool's remaining value.
+
+Local telemetry also receives concise machine-voice lines, but persisted history is
+the cross-client source of truth.
+
+### Visual language and accessibility
+
+- Amber: prompts and unresolved machine state.
+- Red: hostile hits and damage.
+- Green: successful defense or safe completion.
+- No cyan: this workflow is not magic.
+- Existing notched panels, HUD typography, focus treatment, and compact density.
+- Native labels for every selector/input, keyboard-operable defense commands, clear
+  disabled reasons, and live status/error announcements.
+
+## Navigation and asynchronous ownership
+
+Parameterized character routes do not remount. On route ID change, the combat panel
+must:
+
+- reset target, weapon, context, response draft, errors, and expanded history;
+- re-key incoming/outgoing/history queries;
+- advance a monotonic ownership token; and
+- ignore late mutation results unless both route ID and exchange ID still match.
+
+This follows the existing dossier rule: IDs and tokens own asynchronous work;
+booleans do not.
+
+## Error handling
+
+Expected refusals use stable reason codes plus readable messages:
+
+- `selfTarget`
+- `attackerNotReady`
+- `defenderNotReady`
+- `weaponMissingOrChanged`
+- `unsupportedWeaponMode`
+- `unsupportedMdWeapon`
+- `unsupportedMdcProtection`
+- `invalidContext`
+- `modifierReasonRequired`
+- `illegalDefense`
+- `exchangeNotPending`
+- `combatStateChanged`
+- `characterMissing`
+
+Invalid declarations create no exchange. Invalid responses change neither exchange
+nor character. State-token mismatch is different: it deliberately finalizes the
+pending record as `stale` so every participant can see why it cannot resolve.
+
+## Testing strategy
+
+### Rules package
+
+Tests pin printed values and exercise:
+
+- melee 5+ and ranged 8+ strike thresholds;
+- natural 1/natural 20 and defense tie behavior;
+- weapon category and damage-tier classification;
+- no P.P./general H2H leakage into firearm strike or damage;
+- standard and bare-handed parry bonuses/action metadata;
+- dodge and automatic-dodge capability/action metadata;
+- ranged awareness and distance penalties;
+- optional reasoned situational modifiers;
+- critical multiplication after applicable melee damage bonus;
+- A.R. equality, penetration, depleted armor, and no-spill destruction;
+- pure body S.D.C.-then-Hit-Point damage; and
+- refusal of M.D. weapons and M.D.C. protection.
+
+Pure exchange tests use injected RNG sequences so every branch has deterministic
+strike, defense, and detailed damage assertions.
+
+### Backend
+
+Convex tests cover:
+
+- target summaries and self-exclusion;
+- declaration validation and server rolls;
+- immediate resolved misses;
+- pending strikes and all legal response kinds;
+- atomic hit plus exchange finalization;
+- cancellation and immutable final states;
+- concurrent responses where only one wins;
+- attacker and defender token drift;
+- unrelated narrative changes that do not stale combat;
+- M.D.C. and unrolled-vitals refusal with no insert or pool change; and
+- bounded incoming/outgoing/recent queries.
+
+Backend tests assert invariants from returned server rolls instead of accepting
+client-supplied dice. Specific roll ordering remains proven in the pure injected-RNG
+tests.
+
+### Web and live browser
+
+Automated web checks cover form filtering, disabled reasons, option presentation,
+route resets, and stale/late-result guards where practical in the current web test
+setup.
+
+Live verification uses at least two seeded characters and two dossiers:
+
+1. Roll both characters' vitals.
+2. Give the attacker an S.D.C. melee weapon and firearm.
+3. Declare a melee attack and respond from the defender dossier.
+4. Repeat until miss, defense, and hit result presentation have been observed.
+5. Verify the body pools and persisted history update together.
+6. Navigate between dossiers while a request is in flight and verify no state/log
+   crosses ownership.
+7. Equip M.D.C. armor on the defender and verify the declaration is disabled and
+   server-refused if called directly.
+
+The production catalog has no S.D.C. armor suit, so that routing branch is verified
+in pure engine tests until valid page-stamped content activates it live.
+
+## Validation gates
+
+Before publication:
+
+```text
+vp run @riftforge/rules#check
+vp run @riftforge/rules#test
+vp run @riftforge/backend#check
+vp run @riftforge/backend#test
+vp run @riftforge/web#check
+vp run @riftforge/web#test
+vp check
+vp test
+git diff --check
+```
+
+The exact task aliases must be confirmed against repository configuration before
+execution. Root gates do not replace affected-package gates.
+
+## Tracker and documentation delivery
+
+Implementation delivery includes:
+
+- correcting issue #44's natural-A.R. statement with rendered p.339 evidence;
+- updating issue #44 with the approved S.D.C.-tier and persisted-exchange scope;
+- creating a dedicated full-M.D.C. follow-up for conversion, impervious armor,
+  final-blast absorption, depleted protection, unarmored lethal outcomes, and any
+  required injury/death state;
+- recording evidence-backed progress and verification totals; and
+- opening a PR for Cubic review and human merge.
+
+Issue #44 is not complete merely because local code exists. It is complete only
+when implementation, package/root gates, live browser verification, tracker state,
+and the PR review are genuinely aligned. The human maintainer remains the merger.
+
+## Success criteria
+
+- An attacker can declare a supported S.D.C. weapon attack against another ready,
+  unprotected S.D.C. character.
+- The strike is server-rolled and visible before the defender chooses.
+- The defender sees only rules- and context-authorized responses and retains the
+  choice to take the hit.
+- A valid response resolves exactly once and atomically updates history and the
+  correct target pool.
+- Relevant state changes safely stale pending attacks; unrelated narrative edits do
+  not.
+- Artificial S.D.C. armor routing is pure, tested, and ready for future page-stamped
+  content.
+- M.D. weapons and M.D.C.-protected targets never enter S.D.C. arithmetic.
+- No natural-A.R. behavior is added contrary to RUE p.339.
+- Navigation cannot leak combat drafts, logs, or late results between characters.
+- All affected package gates, root gates, and live-browser checks pass.
+
+## Implementation outcome
+
+Implemented and verified on `feat/sdc-combat-exchange` through commit `a44f193`
+on 2026-07-20 (Asia/Singapore). The implementation history is grouped as:
+
+- rules and combat-state derivation: `57b2c64` through `032c487`;
+- backend helpers, ledger, declaration, and atomic resolution: `3737f33` through
+  `0e20bf1`;
+- web presentation, route ownership, and live-found hardening: `e8cf9af` through
+  `94443ea`; and
+- final mechanical attack/rules snapshot hardening: `a44f193`.
+
+Fresh post-final-review automated evidence at `a44f193` was:
+
+- rules package: 17/17 files and 308/308 tests passed;
+- backend package: 3/3 files and 82/82 tests passed;
+- web package: 2/2 files and 27/27 tests passed; and
+- root workspace: 22/22 files and 417/417 tests passed.
+
+All six package gates ran with task caches disabled; root `vp check` and both
+branch/working-tree diff checks were clean. The final hardening makes attacker
+tokens explicitly versioned over selected weapon mechanics, full derived attack
+sources/profile, and page-stamped exchange constants. Response finalization now
+stales incompatible stored weapon, attack, context, or ordered defense-option
+snapshots before authorization, random rolls, or pool writes.
+
+Live Convex/browser acceptance at `94443ea` used two dossiers and covered an
+immediate miss; a melee defense with unchanged pools; a ranged exchange with no
+parry option; body S.D.C. depletion followed by a critical Hit Point hit; detailed
+persisted history in both dossiers; M.D. weapon and nondepleted M.D.C.-protection
+refusal; and A-to-B route isolation for drafts, feeds, telemetry, and late results.
+Native labels, keyboard focus, live-region semantics, and clean consoles were also
+verified. The new command rail had no internal overflow at the narrow probe; the
+page-level 500 px minimum was proven to predate this branch and remains outside this
+feature's scope.
+
+Artificial S.D.C. armor equality, penetration, depletion, and no-spill behavior
+are covered by pure rules tests because the production catalog still has no
+page-stamped S.D.C. armor suit. Full M.D.C. resolution remains deliberately outside
+this delivery and requires its own tracker and rendered-page design pass.
+
+## Cubic review hardening
+
+Two findings from the first ready-for-review Cubic pass were reproduced and fixed
+on 2026-07-20 (Asia/Singapore):
+
+- the recent-history disclosure now points through `aria-controls` to the exact
+  ordered list whose visible length it changes; and
+- take-the-hit responses reject nonzero defense modifiers at the authoritative
+  response schema, while the web submission path omits any draft modifier and
+  reason for that response kind.
+
+Regression coverage proves the schema rejection before backend randomness or
+writes, modifier-free take-the-hit submission, and the disclosure/list association.
+Live two-dossier acceptance additionally proved that a draft modifier and reason
+are ignored when taking the hit, the immutable record carries a canonical zero
+modifier with no reason, the disclosure expands to its controlled list, and the
+restored target dossier finishes with no console errors or warnings.
+
+Fresh automated evidence after this hardening was:
+
+- rules package: 17/17 files and 309/309 tests passed;
+- backend package: 3/3 files and 83/83 tests passed;
+- web package: 2/2 files and 29/29 tests passed; and
+- root workspace: 22/22 files and 421/421 tests passed.
+
+All six package gates ran with task caches disabled and root `vp check` passed.
+The root test configuration caps cross-workspace workers at 50% because two
+unchanged Convex edge-runtime tests reproducibly exceeded their five-second
+timeouts under full local saturation but passed both focused and in the complete
+421-test run at the capped concurrency.
diff --git a/README.md b/README.md
index 8e41579..ad3fa5f 100644
--- a/README.md
+++ b/README.md
@@ -29,10 +29,13 @@ apps/web/
 
 The engine is isomorphic: the Convex backend derives sheets at query time, and the
 client imports the same package for ephemeral rolls. The runtime never parses the
-source book. Combat APIs expose page-stamped strike constants and deterministic
-opposed-roll resolution; spell APIs expose load-validated structured damage,
-derivation, and injected-RNG rolling. Equipment-aware A.R. selection, armor-first
-routing, M.D.C. application, and hostile-target persistence remain follow-on work.
+source book. Combat APIs now support persisted, server-rolled S.D.C. weapon
+exchanges with engine-authorized defense choices, immutable history, and atomic
+body S.D.C.-then-Hit-Point routing. Artificial S.D.C. armor A.R. and ablation
+routing are pure-tested and ready for page-stamped production content. Natural
+A.R. is intentionally absent per RUE p.339; full M.D.C. interaction remains
+follow-up work. Spell APIs expose load-validated structured damage, derivation,
+and injected-RNG rolling.
 
 ### Current status
 
diff --git a/apps/web/src/components/combat-exchange-panel.tsx b/apps/web/src/components/combat-exchange-panel.tsx
new file mode 100644
index 0000000..bbe4660
--- /dev/null
+++ b/apps/web/src/components/combat-exchange-panel.tsx
@@ -0,0 +1,740 @@
+import { api } from "@riftforge/backend/api";
+import type { Id } from "@riftforge/backend/dataModel";
+import {
+  deriveAttackProfile,
+  type CharacterSheet,
+  type CombatResponseKind,
+  type ParryMode,
+  type RangeBand,
+} from "@riftforge/rules";
+import type { FunctionReturnType } from "convex/server";
+import {
+  createEffect,
+  createMemo,
+  createSignal,
+  For,
+  on,
+  onCleanup,
+  Show,
+  type Accessor,
+  type JSX,
+} from "solid-js";
+import { convex } from "../lib/client.ts";
+import {
+  combatErrorMessage,
+  combatTargetDisabledReason,
+  combatWeaponChoices,
+  exchangeTone,
+  formatExchangeSummary,
+  ownsAsyncResult,
+} from "../lib/combat-exchange.ts";
+import { createMutation, createQuery } from "../lib/convex.ts";
+import type { TelemetryTone } from "../lib/telemetry.ts";
+import {
+  Alert,
+  Button,
+  MonoLabel,
+  Panel,
+  SectionTitle,
+  SelectInput,
+  TextInput,
+  ToggleChip,
+} from "./ui.tsx";
+
+type IncomingExchange = Extract<
+  FunctionReturnType<typeof api.combat.incoming>[number],
+  { status: "pendingDefense" }
+>;
+type OutgoingExchange = Extract<
+  FunctionReturnType<typeof api.combat.outgoing>[number],
+  { status: "pendingDefense" }
+>;
+type DeclarationNotice = {
+  tone: "ok" | "warn";
+  text: string;
+  exchangeId?: Id<"combatExchanges">;
+};
+
+const toneClass = {
+  dim: "border-dead text-muted",
+  warn: "border-amber text-amber",
+  bad: "border-blood text-blood-text",
+  good: "border-ok text-ok",
+} as const;
+
+const signed = (value: number) => (value >= 0 ? `+${value}` : String(value));
+
+function parseModifier(raw: string): number | undefined {
+  const trimmed = raw.trim();
+  if (trimmed === "") return 0;
+  const value = Number(trimmed);
+  return Number.isSafeInteger(value) && value >= -100 && value <= 100 ? value : undefined;
+}
+
+function strikeSummary(exchange: {
+  strikeRoll: { die: number; bonus: number; total: number };
+}): string {
+  return `d20[${exchange.strikeRoll.die}]${signed(exchange.strikeRoll.bonus)} = ${exchange.strikeRoll.total}`;
+}
+
+function storedContextMode(context: IncomingExchange["context"]): string {
+  return context.kind === "melee"
+    ? `PARRY ${context.parryMode.toUpperCase()}`
+    : `RANGE ${context.rangeBand.toUpperCase()}`;
+}
+
+function storedStrikeModifier(context: IncomingExchange["context"]): string {
+  const modifier = context.strikeModifier;
+  return modifier === undefined
+    ? ""
+    : ` · STRIKE ${signed(modifier)} — ${context.strikeModifierReason}`;
+}
+
+function IncomingExchangeRow(props: {
+  exchangeId: IncomingExchange["_id"];
+  exchange: Accessor<IncomingExchange | undefined>;
+  characterId: Id<"characters">;
+  routeEpoch: Accessor<number>;
+  onTelemetry: (text: string, tone?: TelemetryTone) => void;
+}) {
+  const respondToAttack = createMutation(convex, api.combat.respondToAttack);
+  const [defenseModifier, setDefenseModifier] = createSignal("");
+  const [defenseReason, setDefenseReason] = createSignal("");
+  const [busy, setBusy] = createSignal(false);
+  const [error, setError] = createSignal<string>();
+  const defenseModifierValue = createMemo(() => parseModifier(defenseModifier()));
+  const responseReady = createMemo(() => {
+    const modifier = defenseModifierValue();
+    return modifier !== undefined && (modifier === 0 || defenseReason().trim() !== "");
+  });
+
+  const submitResponse = async (kind: CombatResponseKind) => {
+    if (props.exchange() === undefined) return;
+    const modifier = defenseModifierValue();
+    const usesDefense = kind !== "none";
+    if (
+      usesDefense &&
+      (modifier === undefined || (modifier !== 0 && defenseReason().trim() === ""))
+    )
+      return;
+    const owner = {
+      routeId: props.characterId,
+      routeEpoch: props.routeEpoch(),
+      exchangeId: props.exchangeId,
+    };
+    setBusy(true);
+    setError(undefined);
+    try {
+      const result = await respondToAttack({
+        exchangeId: props.exchangeId,
+        response: {
+          kind,
+          ...(usesDefense && modifier !== 0 ? { defenseModifier: modifier } : {}),
+          ...(usesDefense && defenseReason().trim() !== ""
+            ? { defenseModifierReason: defenseReason().trim() }
+            : {}),
+        },
+      });
+      const current = {
+        routeId: props.characterId,
+        routeEpoch: props.routeEpoch(),
+        exchangeId: props.exchangeId,
+      };
+      if (!ownsAsyncResult(owner, current)) return;
+      props.onTelemetry(
+        `> COMBAT :: ${result.status === "stale" ? "STALE" : "RESPONSE LOCKED"}`,
+        result.status === "stale" ? "dim" : "machine",
+      );
+    } catch (caught) {
+      const current = {
+        routeId: props.characterId,
+        routeEpoch: props.routeEpoch(),
+        exchangeId: props.exchangeId,
+      };
+      if (!ownsAsyncResult(owner, current)) return;
+      const message = combatErrorMessage(caught);
+      setError(message);
+      props.onTelemetry(`> COMBAT :: RESPONSE REFUSED — ${message}`, "bad");
+    } finally {
+      const current = {
+        routeId: props.characterId,
+        routeEpoch: props.routeEpoch(),
+        exchangeId: props.exchangeId,
+      };
+      if (ownsAsyncResult(owner, current)) setBusy(false);
+    }
+  };
+
+  return (
+    <Show when={props.exchange()}>
+      {(exchange) => (
+        <li class="space-y-2 border-t border-line pt-2">
+          <div class="font-hud text-[12px] font-semibold tracking-[0.06em] text-fg uppercase">
+            {exchange().attackerName} · {exchange().weapon.name}
+          </div>
+          <div class="font-data text-[11.5px] text-amber">{strikeSummary(exchange())}</div>
+          <div class="space-y-1 border-l-2 border-dead pl-2 font-mono text-[10.5px] text-muted">
+            <span class="block text-dead">STORED CONTEXT</span>
+            <span class="block">
+              {exchange().context.kind.toUpperCase()} ·{" "}
+              {exchange().context.defenderAware ? "AWARE" : "UNAWARE"}
+            </span>
+            <span class="block">
+              {storedContextMode(exchange().context)}
+              {storedStrikeModifier(exchange().context)}
+            </span>
+          </div>
+          <div class="grid grid-cols-[72px_minmax(0,1fr)] gap-2">
+            <label class="space-y-1">
+              <MonoLabel class="block">DEF MOD</MonoLabel>
+              <TextInput
+                aria-label="Defense modifier"
+                inputmode="numeric"
+                class="w-full"
+                value={defenseModifier()}
+                onInput={(event) => setDefenseModifier(event.currentTarget.value)}
+              />
+            </label>
+            <label class="space-y-1">
+              <MonoLabel class="block">REASON</MonoLabel>
+              <TextInput
+                aria-label="Defense modifier reason"
+                class="w-full"
+                value={defenseReason()}
+                onInput={(event) => setDefenseReason(event.currentTarget.value)}
+              />
+            </label>
+          </div>
+          <div class="space-y-1">
+            <For each={exchange().defenseOptions}>
+              {(option) => (
+                <Button
+                  class="w-full px-2 text-left text-[11.5px]"
+                  disabled={busy() || (option.kind !== "none" && !responseReady())}
+                  title={option.explanation}
+                  onClick={() => void submitResponse(option.kind)}
+                >
+                  {option.kind === "none" ? "> TAKE THE HIT" : `> ${option.kind.toUpperCase()}`} ·
+                  {option.bonus >= 0 ? "+" : ""}
+                  {option.bonus} · {option.actionCost} ACTION
+                </Button>
+              )}
+            </For>
+          </div>
+          <Show when={error()}>{(message) => <Alert tone="danger">{message()}</Alert>}</Show>
+        </li>
+      )}
+    </Show>
+  );
+}
+
+function OutgoingExchangeRow(props: {
+  exchangeId: OutgoingExchange["_id"];
+  exchange: Accessor<OutgoingExchange | undefined>;
+  characterId: Id<"characters">;
+  routeEpoch: Accessor<number>;
+  onTelemetry: (text: string, tone?: TelemetryTone) => void;
+}) {
+  const cancelAttack = createMutation(convex, api.combat.cancelAttack);
+  const [busy, setBusy] = createSignal(false);
+  const [error, setError] = createSignal<string>();
+
+  const cancel = async () => {
+    if (props.exchange() === undefined) return;
+    const owner = {
+      routeId: props.characterId,
+      routeEpoch: props.routeEpoch(),
+      exchangeId: props.exchangeId,
+    };
+    setBusy(true);
+    setError(undefined);
+    try {
+      await cancelAttack({ exchangeId: props.exchangeId });
+      const current = {
+        routeId: props.characterId,
+        routeEpoch: props.routeEpoch(),
+        exchangeId: props.exchangeId,
+      };
+      if (!ownsAsyncResult(owner, current)) return;
+      props.onTelemetry("> COMBAT :: ATTACK CANCELLED", "dim");
+    } catch (caught) {
+      const current = {
+        routeId: props.characterId,
+        routeEpoch: props.routeEpoch(),
+        exchangeId: props.exchangeId,
+      };
+      if (!ownsAsyncResult(owner, current)) return;
+      const message = combatErrorMessage(caught);
+      setError(message);
+      props.onTelemetry(`> COMBAT :: CANCELLATION REFUSED — ${message}`, "bad");
+    } finally {
+      const current = {
+        routeId: props.characterId,
+        routeEpoch: props.routeEpoch(),
+        exchangeId: props.exchangeId,
+      };
+      if (ownsAsyncResult(owner, current)) setBusy(false);
+    }
+  };
+
+  return (
+    <Show when={props.exchange()}>
+      {(exchange) => (
+        <li class="space-y-2 border-t border-line pt-2">
+          <div class="font-hud text-[12px] font-semibold tracking-[0.06em] text-fg uppercase">
+            {exchange().defenderName} · {exchange().weapon.name}
+          </div>
+          <div class="font-data text-[11.5px] text-amber">{strikeSummary(exchange())}</div>
+          <Button
+            class="w-full px-2 text-left text-[11.5px]"
+            disabled={busy()}
+            onClick={() => void cancel()}
+          >
+            {busy() ? "> CANCELLING…" : "> CANCEL"}
+          </Button>
+          <Show when={error()}>{(message) => <Alert tone="danger">{message()}</Alert>}</Show>
+        </li>
+      )}
+    </Show>
+  );
+}
+
+export interface CombatExchangePanelProps {
+  characterId: Id<"characters">;
+  sheet: CharacterSheet;
+  onTelemetry: (text: string, tone?: TelemetryTone) => void;
+}
+
+export function CombatExchangePanel(props: CombatExchangePanelProps): JSX.Element {
+  const targets = createQuery(convex, api.combat.targets, () => ({
+    attackerId: props.characterId,
+  }));
+  const incoming = createQuery(convex, api.combat.incoming, () => ({
+    defenderId: props.characterId,
+  }));
+  const outgoing = createQuery(convex, api.combat.outgoing, () => ({
+    attackerId: props.characterId,
+  }));
+  const recent = createQuery(convex, api.combat.recent, () => ({
+    characterId: props.characterId,
+  }));
+  const declareAttack = createMutation(convex, api.combat.declareAttack);
+  const [targetId, setTargetId] = createSignal("");
+  const [weaponIndex, setWeaponIndex] = createSignal("");
+  const [aware, setAware] = createSignal(true);
+  const [parryMode, setParryMode] = createSignal<ParryMode>("standard");
+  const [rangeBand, setRangeBand] = createSignal<RangeBand>("normal");
+  const [strikeModifier, setStrikeModifier] = createSignal("");
+  const [strikeReason, setStrikeReason] = createSignal("");
+  const [busy, setBusy] = createSignal(false);
+  const [error, setError] = createSignal<string>();
+  const [notice, setNotice] = createSignal<DeclarationNotice>();
+  const [historyExpanded, setHistoryExpanded] = createSignal(false);
+  const [flashingIds, setFlashingIds] = createSignal<ReadonlySet<string>>(new Set());
+  const choices = createMemo(() => combatWeaponChoices(props.sheet));
+  const selectedIndex = createMemo(() => {
+    const raw = weaponIndex();
+    if (raw === "") return undefined;
+    const value = Number(raw);
+    return Number.isInteger(value) ? value : undefined;
+  });
+  const selectedAttack = createMemo(() => {
+    const index = selectedIndex();
+    return index === undefined ? undefined : deriveAttackProfile(props.sheet, index);
+  });
+  const selectedSupportedAttack = createMemo(() => {
+    const attack = selectedAttack();
+    return attack?.supported === true ? attack : undefined;
+  });
+  const modifierValue = createMemo(() => parseModifier(strikeModifier()));
+  const canDeclare = createMemo(() => {
+    const target = targets.data()?.find((candidate) => candidate.id === targetId());
+    const attack = selectedSupportedAttack();
+    const modifier = modifierValue();
+    return (
+      !busy() &&
+      target !== undefined &&
+      combatTargetDisabledReason(target) === undefined &&
+      attack !== undefined &&
+      modifier !== undefined &&
+      (modifier === 0 || strikeReason().trim() !== "")
+    );
+  });
+  const pendingIncoming = createMemo(
+    () =>
+      incoming
+        .data()
+        ?.filter(
+          (exchange): exchange is IncomingExchange => exchange.status === "pendingDefense",
+        ) ?? [],
+  );
+  const pendingOutgoing = createMemo(
+    () =>
+      outgoing
+        .data()
+        ?.filter(
+          (exchange): exchange is OutgoingExchange => exchange.status === "pendingDefense",
+        ) ?? [],
+  );
+  const incomingIds = createMemo(() => pendingIncoming().map((exchange) => exchange._id));
+  const outgoingIds = createMemo(() => pendingOutgoing().map((exchange) => exchange._id));
+  const incomingById = (exchangeId: IncomingExchange["_id"]) =>
+    pendingIncoming().find((exchange) => exchange._id === exchangeId);
+  const outgoingById = (exchangeId: OutgoingExchange["_id"]) =>
+    pendingOutgoing().find((exchange) => exchange._id === exchangeId);
+  const boundedRecent = createMemo(() => recent.data()?.slice(0, 20) ?? []);
+  const visibleRecent = createMemo(() => boundedRecent().slice(0, historyExpanded() ? 20 : 5));
+
+  let routeEpoch = 0;
+  let historyInitialized = false;
+  let flashTimer: ReturnType<typeof setTimeout> | undefined;
+  const seenResolvedIds = new Set<string>();
+  const resetRouteState = () => {
+    routeEpoch += 1;
+    setTargetId("");
+    setWeaponIndex("");
+    setAware(true);
+    setParryMode("standard");
+    setRangeBand("normal");
+    setStrikeModifier("");
+    setStrikeReason("");
+    setBusy(false);
+    setError(undefined);
+    setNotice(undefined);
+    setHistoryExpanded(false);
+    setFlashingIds(new Set<string>());
+    seenResolvedIds.clear();
+    historyInitialized = false;
+    if (flashTimer !== undefined) clearTimeout(flashTimer);
+  };
+  createEffect(on(() => props.characterId, resetRouteState, { defer: true }));
+  onCleanup(() => {
+    routeEpoch += 1;
+    if (flashTimer !== undefined) clearTimeout(flashTimer);
+  });
+
+  createEffect(() => {
+    const entries = recent.data();
+    if (entries === undefined) return;
+    const resolvedIds = entries
+      .filter((entry) => entry.status === "resolved")
+      .map((entry) => String(entry._id));
+    if (!historyInitialized) {
+      for (const exchangeId of resolvedIds) seenResolvedIds.add(exchangeId);
+      historyInitialized = true;
+      return;
+    }
+    const newlyResolved = resolvedIds.filter((exchangeId) => !seenResolvedIds.has(exchangeId));
+    for (const exchangeId of newlyResolved) seenResolvedIds.add(exchangeId);
+    if (newlyResolved.length === 0) return;
+    setFlashingIds(new Set(newlyResolved));
+    if (flashTimer !== undefined) clearTimeout(flashTimer);
+    const owner = { routeId: props.characterId, routeEpoch };
+    flashTimer = setTimeout(() => {
+      if (ownsAsyncResult(owner, { routeId: props.characterId, routeEpoch })) {
+        setFlashingIds(new Set<string>());
+      }
+    }, 650);
+  });
+
+  createEffect(() => {
+    const currentNotice = notice();
+    if (currentNotice?.exchangeId === undefined) return;
+    const matchingExchange = recent
+      .data()
+      ?.find((exchange) => exchange._id === currentNotice.exchangeId);
+    if (matchingExchange !== undefined && matchingExchange.status !== "pendingDefense") {
+      setNotice(undefined);
+    }
+  });
+
+  const submitDeclaration = async () => {
+    const index = selectedIndex();
+    const attack = selectedSupportedAttack();
+    const modifier = modifierValue();
+    const target = targetId() as Id<"characters">;
+    const entry = index === undefined ? undefined : props.sheet.equipment[index];
+    if (!canDeclare() || index === undefined || !attack || modifier === undefined || !entry) {
+      return;
+    }
+    const owner = { routeId: props.characterId, routeEpoch };
+    setBusy(true);
+    setError(undefined);
+    setNotice(undefined);
+    try {
+      const result = await declareAttack({
+        attackerId: props.characterId,
+        defenderId: target,
+        weaponIndex: index,
+        expect: {
+          itemId: entry.item.id,
+          ...(entry.worn === true ? { worn: true } : {}),
+          ...(entry.rolledMdc === undefined ? {} : { rolledMdc: entry.rolledMdc }),
+        },
+        context:
+          attack.kind === "melee"
+            ? {
+                kind: "melee",
+                defenderAware: aware(),
+                parryMode: parryMode(),
+                ...(modifier === 0 ? {} : { strikeModifier: modifier }),
+                ...(strikeReason().trim() === ""
+                  ? {}
+                  : { strikeModifierReason: strikeReason().trim() }),
+              }
+            : {
+                kind: "ranged",
+                defenderAware: aware(),
+                rangeBand: rangeBand(),
+                ...(modifier === 0 ? {} : { strikeModifier: modifier }),
+                ...(strikeReason().trim() === ""
+                  ? {}
+                  : { strikeModifierReason: strikeReason().trim() }),
+              },
+      });
+      if (!ownsAsyncResult(owner, { routeId: props.characterId, routeEpoch })) return;
+      props.onTelemetry(
+        `> COMBAT :: ${result.weapon.name.toUpperCase()} — ${result.status.toUpperCase()}`,
+        result.status === "resolved" ? "dim" : "machine",
+      );
+      setNotice(
+        result.status === "resolved"
+          ? { tone: "ok", text: `${result.weapon.name.toUpperCase()} — MISS RECORDED` }
+          : {
+              tone: "warn",
+              text: `${result.weapon.name.toUpperCase()} — AWAITING DEFENSE`,
+              exchangeId: result._id,
+            },
+      );
+      setStrikeModifier("");
+      setStrikeReason("");
+    } catch (caught) {
+      if (!ownsAsyncResult(owner, { routeId: props.characterId, routeEpoch })) return;
+      const message = combatErrorMessage(caught);
+      setError(message);
+      props.onTelemetry(`> COMBAT :: DECLARATION REFUSED — ${message}`, "bad");
+    } finally {
+      if (ownsAsyncResult(owner, { routeId: props.characterId, routeEpoch })) setBusy(false);
+    }
+  };
+
+  return (
+    <Panel class="space-y-3 p-3">
+      <SectionTitle>COMBAT EXCHANGE</SectionTitle>
+      <div class="space-y-2 border-t border-line pt-2">
+        <label class="block space-y-1">
+          <MonoLabel class="block">TARGET</MonoLabel>
+          <SelectInput
+            class="w-full"
+            value={targetId()}
+            onChange={(event) => setTargetId(event.currentTarget.value)}
+          >
+            <option value="">SELECT DOSSIER</option>
+            <For each={targets.data()}>
+              {(target) => (
+                <option
+                  value={target.id}
+                  disabled={combatTargetDisabledReason(target) !== undefined}
+                >
+                  {target.name}
+                  {combatTargetDisabledReason(target)
+                    ? ` — ${combatTargetDisabledReason(target)}`
+                    : ""}
+                </option>
+              )}
+            </For>
+          </SelectInput>
+        </label>
+        <label class="block space-y-1">
+          <MonoLabel class="block">WEAPON</MonoLabel>
+          <SelectInput
+            class="w-full"
+            value={weaponIndex()}
+            onChange={(event) => setWeaponIndex(event.currentTarget.value)}
+          >
+            <option value="">SELECT WEAPON</option>
+            <For each={choices()}>
+              {(choice) => (
+                <option value={choice.index} disabled={!choice.supported}>
+                  {choice.label}
+                  {choice.disabledReason ? ` — ${choice.disabledReason}` : ""}
+                </option>
+              )}
+            </For>
+          </SelectInput>
+        </label>
+        <div class="flex items-end gap-2">
+          <ToggleChip pressed={aware()} onToggle={() => setAware((value) => !value)}>
+            AWARE
+          </ToggleChip>
+          <Show when={selectedSupportedAttack()?.kind === "melee"}>
+            <label class="min-w-0 flex-1 space-y-1">
+              <MonoLabel class="block">PARRY MODE</MonoLabel>
+              <SelectInput
+                class="w-full"
+                value={parryMode()}
+                onChange={(event) => setParryMode(event.currentTarget.value as ParryMode)}
+              >
+                <option value="unavailable">UNAVAILABLE</option>
+                <option value="standard">STANDARD</option>
+                <option value="bareHanded">BARE-HANDED</option>
+              </SelectInput>
+            </label>
+          </Show>
+          <Show when={selectedSupportedAttack()?.kind === "ranged"}>
+            <label class="min-w-0 flex-1 space-y-1">
+              <MonoLabel class="block">RANGE BAND</MonoLabel>
+              <SelectInput
+                class="w-full"
+                value={rangeBand()}
+                onChange={(event) => setRangeBand(event.currentTarget.value as RangeBand)}
+              >
+                <option value="pointBlank">POINT-BLANK</option>
+                <option value="close">CLOSE</option>
+                <option value="normal">NORMAL</option>
+              </SelectInput>
+            </label>
+          </Show>
+        </div>
+        <div class="grid grid-cols-[72px_minmax(0,1fr)] gap-2">
+          <label class="space-y-1">
+            <MonoLabel class="block">MOD</MonoLabel>
+            <TextInput
+              aria-label="Strike modifier"
+              inputmode="numeric"
+              class="w-full"
+              value={strikeModifier()}
+              onInput={(event) => setStrikeModifier(event.currentTarget.value)}
+            />
+          </label>
+          <label class="space-y-1">
+            <MonoLabel class="block">REASON</MonoLabel>
+            <TextInput
+              aria-label="Strike modifier reason"
+              class="w-full"
+              value={strikeReason()}
+              onInput={(event) => setStrikeReason(event.currentTarget.value)}
+            />
+          </label>
+        </div>
+        <Button
+          variant="primary"
+          class="w-full text-left"
+          disabled={!canDeclare()}
+          onClick={() => void submitDeclaration()}
+        >
+          {busy() ? "> TRANSMITTING…" : "> DECLARE ATTACK"}
+        </Button>
+        <Show when={notice()}>
+          {(message) => <Alert tone={message().tone}>{message().text}</Alert>}
+        </Show>
+        <Show when={error()}>{(message) => <Alert tone="danger">{message()}</Alert>}</Show>
+        <Show when={targets.error()}>
+          {(queryError) => <Alert tone="danger">TARGET LINK FAILED — {queryError().message}</Alert>}
+        </Show>
+      </div>
+
+      <section class="border-t border-line pt-2" aria-labelledby="combat-incoming-title">
+        <MonoLabel class="block text-dead" id="combat-incoming-title">
+          INCOMING
+        </MonoLabel>
+        <Show
+          when={incomingIds().length > 0}
+          fallback={<p class="mt-1 font-mono text-[11.5px] text-dead">// NO PENDING STRIKES</p>}
+        >
+          <ol class="mt-2 space-y-2">
+            <For each={incomingIds()}>
+              {(exchangeId) => (
+                <IncomingExchangeRow
+                  exchangeId={exchangeId}
+                  exchange={() => incomingById(exchangeId)}
+                  characterId={props.characterId}
+                  routeEpoch={() => routeEpoch}
+                  onTelemetry={props.onTelemetry}
+                />
+              )}
+            </For>
+          </ol>
+        </Show>
+        <Show when={incoming.error()}>
+          {(queryError) => (
+            <Alert tone="danger">INCOMING LINK FAILED — {queryError().message}</Alert>
+          )}
+        </Show>
+      </section>
+
+      <section class="border-t border-line pt-2" aria-labelledby="combat-outgoing-title">
+        <MonoLabel class="block text-dead" id="combat-outgoing-title">
+          OUTGOING
+        </MonoLabel>
+        <Show
+          when={outgoingIds().length > 0}
+          fallback={<p class="mt-1 font-mono text-[11.5px] text-dead">// NO OPEN ATTACKS</p>}
+        >
+          <ol class="mt-2 space-y-2">
+            <For each={outgoingIds()}>
+              {(exchangeId) => (
+                <OutgoingExchangeRow
+                  exchangeId={exchangeId}
+                  exchange={() => outgoingById(exchangeId)}
+                  characterId={props.characterId}
+                  routeEpoch={() => routeEpoch}
+                  onTelemetry={props.onTelemetry}
+                />
+              )}
+            </For>
+          </ol>
+        </Show>
+        <Show when={outgoing.error()}>
+          {(queryError) => (
+            <Alert tone="danger">OUTGOING LINK FAILED — {queryError().message}</Alert>
+          )}
+        </Show>
+      </section>
+
+      <section class="border-t border-line pt-2" aria-labelledby="combat-recent-title">
+        <div class="flex items-baseline gap-2">
+          <MonoLabel class="block text-dead" id="combat-recent-title">
+            RECENT
+          </MonoLabel>
+          <Show when={boundedRecent().length > 5}>
+            <Button
+              variant="ghost"
+              class="ml-auto px-0 py-0 text-[11px]"
+              aria-expanded={historyExpanded()}
+              aria-controls="combat-recent-history"
+              onClick={() => setHistoryExpanded((value) => !value)}
+            >
+              {historyExpanded() ? "SHOW 5" : "SHOW 20"}
+            </Button>
+          </Show>
+        </div>
+        <Show
+          when={visibleRecent().length > 0}
+          fallback={<p class="mt-1 font-mono text-[11.5px] text-dead">// NO EXCHANGES</p>}
+        >
+          <ol id="combat-recent-history" class="mt-2 space-y-2">
+            <For each={visibleRecent()}>
+              {(exchange) => (
+                <li
+                  class={`border-l-2 px-2 font-mono text-[11px] ${toneClass[exchangeTone(exchange)]}`}
+                  classList={{
+                    "strike-flash":
+                      exchange.status === "resolved" && flashingIds().has(String(exchange._id)),
+                  }}
+                >
+                  {formatExchangeSummary(exchange)}
+                </li>
+              )}
+            </For>
+          </ol>
+        </Show>
+        <Show when={recent.error()}>
+          {(queryError) => (
+            <Alert tone="danger">HISTORY LINK FAILED — {queryError().message}</Alert>
+          )}
+        </Show>
+      </section>
+    </Panel>
+  );
+}
diff --git a/apps/web/src/components/telemetry-rail.tsx b/apps/web/src/components/telemetry-rail.tsx
index 22f8a6e..bdb52c6 100644
--- a/apps/web/src/components/telemetry-rail.tsx
+++ b/apps/web/src/components/telemetry-rail.tsx
@@ -26,7 +26,7 @@ export function TelemetryRail(props: { entries: TelemetryEntry[]; actions?: JSX.
   );
 
   return (
-    <aside class="flex min-h-0 flex-col gap-2.5" aria-label="Field telemetry">
+    <section class="flex min-h-0 flex-col gap-2.5" aria-label="Field telemetry">
       <h2 class="font-display text-[15px] tracking-[0.12em] text-muted">
         <span class="text-dead">// </span>FIELD TELEMETRY
       </h2>
@@ -43,6 +43,6 @@ export function TelemetryRail(props: { entries: TelemetryEntry[]; actions?: JSX.
         </div>
       </div>
       {props.actions}
-    </aside>
+    </section>
   );
 }
diff --git a/apps/web/src/components/ui.tsx b/apps/web/src/components/ui.tsx
index 51082d1..b382ec8 100644
--- a/apps/web/src/components/ui.tsx
+++ b/apps/web/src/components/ui.tsx
@@ -62,6 +62,43 @@ export function TextInput(props: ComponentProps<"input">) {
   );
 }
 
+export function SelectInput(props: ComponentProps<"select">) {
+  const [own, rest] = splitProps(props, ["class", "children"]);
+  return (
+    <select
+      class={`notch-8 border border-line bg-noir px-3 py-2 font-mono text-[13px] text-fg focus:border-amber disabled:text-dead ${own.class ?? ""}`}
+      {...rest}
+    >
+      {own.children}
+    </select>
+  );
+}
+
+/** A pressed/unpressed mode chip. Ley tone is reserved for arcane context. */
+export function ToggleChip(props: {
+  pressed: boolean;
+  onToggle: () => void;
+  tone?: "ley" | "amber";
+  children: JSX.Element;
+}) {
+  return (
+    <button
+      type="button"
+      aria-pressed={props.pressed}
+      class={`notch-6 cursor-pointer border bg-inset px-2 font-hud text-[11.5px] font-semibold tracking-[0.08em] uppercase ${
+        props.pressed
+          ? props.tone === "ley"
+            ? "border-ley/60 text-ley [text-shadow:0_0_8px_rgb(79_216_255/0.5)]"
+            : "border-amber/60 text-amber"
+          : "border-line text-dead hover:border-muted"
+      }`}
+      onClick={() => props.onToggle()}
+    >
+      {props.children}
+    </button>
+  );
+}
+
 type AlertTone = "ok" | "warn" | "danger" | "info";
 
 const alertClass: Record<AlertTone, string> = {
@@ -111,12 +148,14 @@ export function Chip(props: ParentProps<{ tone?: "default" | "ley" | "warn"; cla
 }
 
 /** Mono machine-voice caption (labels, kickers, file numbers). */
-export function MonoLabel(props: ParentProps<{ class?: string }>) {
+export function MonoLabel(props: ComponentProps<"span">) {
+  const [own, rest] = splitProps(props, ["class", "children"]);
   return (
     <span
-      class={`font-mono text-[11.5px] tracking-[0.14em] text-muted uppercase ${props.class ?? ""}`}
+      class={`font-mono text-[11.5px] tracking-[0.14em] text-muted uppercase ${own.class ?? ""}`}
+      {...rest}
     >
-      {props.children}
+      {own.children}
     </span>
   );
 }
diff --git a/apps/web/src/lib/combat-exchange.ts b/apps/web/src/lib/combat-exchange.ts
new file mode 100644
index 0000000..91c645e
--- /dev/null
+++ b/apps/web/src/lib/combat-exchange.ts
@@ -0,0 +1,109 @@
+import { api } from "@riftforge/backend/api";
+import { deriveAttackProfile, type CharacterSheet } from "@riftforge/rules";
+import type { FunctionReturnType } from "convex/server";
+import { ConvexError } from "convex/values";
+
+type CombatTargets = FunctionReturnType<typeof api.combat.targets>;
+export type CombatTargetSummary = CombatTargets[number];
+type CombatRecent = FunctionReturnType<typeof api.combat.recent>;
+export type ExchangeSummary = CombatRecent[number];
+
+export interface AsyncOwner {
+  routeId: string;
+  routeEpoch: number;
+  exchangeId?: string;
+}
+
+export function ownsAsyncResult(owner: AsyncOwner, current: AsyncOwner): boolean {
+  return (
+    owner.routeId === current.routeId &&
+    owner.routeEpoch === current.routeEpoch &&
+    owner.exchangeId === current.exchangeId
+  );
+}
+
+export function combatWeaponChoices(sheet: CharacterSheet): Array<{
+  index: number;
+  itemId: string;
+  label: string;
+  supported: boolean;
+  disabledReason?: string;
+}> {
+  return sheet.equipment.flatMap((entry, index) => {
+    if (entry.item.kind !== "weapon") return [];
+    const profile = deriveAttackProfile(sheet, index);
+    return [
+      {
+        index,
+        itemId: entry.item.id,
+        label: `${entry.item.name} — ${entry.item.damage.formula} ${
+          entry.item.damage.type === "md" ? "M.D." : "S.D.C."
+        }`,
+        supported: profile.supported,
+        ...(profile.supported
+          ? {}
+          : {
+              disabledReason:
+                profile.reason === "unsupportedMdWeapon"
+                  ? "Full M.D.C. combat is follow-up work."
+                  : "This weapon mode is not supported.",
+            }),
+      },
+    ];
+  });
+}
+
+export function combatTargetDisabledReason(target: CombatTargetSummary): string | undefined {
+  if (!target.ready) return "Roll this target's H.P. and S.D.C. first.";
+  if (target.protection === "mdcArmor") return "Full M.D.C. combat is follow-up work.";
+  return undefined;
+}
+
+export function exchangeTone(exchange: ExchangeSummary): "dim" | "warn" | "bad" | "good" {
+  if (exchange.status === "pendingDefense" || exchange.status === "stale") return "warn";
+  if (exchange.status === "cancelled") return "dim";
+  if (exchange.resolution.outcome === "defended") return "good";
+  if (exchange.resolution.outcome === "hit") return "bad";
+  return "dim";
+}
+
+const signed = (value: number) => (value >= 0 ? `+${value}` : String(value));
+
+export function formatExchangeSummary(exchange: ExchangeSummary): string {
+  const strike = `d20[${exchange.strikeRoll.die}]${signed(exchange.strikeRoll.bonus)} = ${exchange.strikeRoll.total}`;
+  const lead = `${exchange.attackerName} → ${exchange.defenderName} :: ${exchange.weapon.name} :: ${strike}`;
+  if (exchange.status === "pendingDefense") return `${lead} :: AWAITING DEFENSE`;
+  if (exchange.status === "cancelled") return `${lead} :: CANCELLED`;
+  if (exchange.status === "stale") return `${lead} :: STALE — COMBAT STATE CHANGED`;
+  const result = exchange.resolution;
+  if (result.outcome === "miss") return `${lead} :: MISS (${result.reason})`;
+  if (result.outcome === "defended") {
+    return `${lead} :: ${result.response.kind.toUpperCase()} d20[${result.defenseRoll.die}]${signed(result.defenseRoll.bonus)} = ${result.defenseRoll.total} :: DEFENDED`;
+  }
+  const defense =
+    result.defenseRoll === undefined
+      ? ""
+      : ` :: ${result.response.kind.toUpperCase()} d20[${result.defenseRoll.die}]${signed(result.defenseRoll.bonus)} = ${result.defenseRoll.total}`;
+  const damage = `${exchange.attack.damageFormula} [${result.damageRoll.dice.join("][")}]${signed(result.damageRoll.bonus)} = ${result.damageRoll.total} RAW`;
+  const multiplier = result.critical
+    ? `CRITICAL ×${result.damageMultiplier}`
+    : `×${result.damageMultiplier}`;
+  const remaining =
+    result.route.kind === "armor"
+      ? `ARMOR ${result.route.armor.after}`
+      : `BODY S.D.C. ${result.route.body.after.sdc} / H.P. ${result.route.body.after.hitPoints}`;
+  return `${lead}${defense} :: ${damage} :: ${multiplier} :: ${result.totalDamage} S.D.C. FINAL → ${remaining}`;
+}
+
+export function combatErrorMessage(error: unknown): string {
+  if (
+    error instanceof ConvexError &&
+    typeof error.data === "object" &&
+    error.data !== null &&
+    "message" in error.data &&
+    typeof error.data.message === "string"
+  ) {
+    return error.data.message;
+  }
+  return error instanceof Error ? error.message : String(error);
+}
diff --git a/apps/web/src/pages/character-sheet.tsx b/apps/web/src/pages/character-sheet.tsx
index 16edc3a..de9d1f3 100644
--- a/apps/web/src/pages/character-sheet.tsx
+++ b/apps/web/src/pages/character-sheet.tsx
@@ -13,21 +13,13 @@ import {
   type Weapon,
 } from "@riftforge/rules";
 import { useParams } from "@solidjs/router";
-import {
-  createEffect,
-  createSignal,
-  Match,
-  on,
-  Show,
-  Switch,
-  type Accessor,
-  type JSX,
-} from "solid-js";
+import { createEffect, createSignal, Match, on, Show, Switch, type Accessor } from "solid-js";
 import { createStore, reconcile } from "solid-js/store";
+import { CombatExchangePanel } from "../components/combat-exchange-panel.tsx";
 import { NarrativeFields } from "../components/narrative-fields.tsx";
 import { SheetView, type SheetActions } from "../components/sheet-view.tsx";
 import { TelemetryRail } from "../components/telemetry-rail.tsx";
-import { Alert, Button, MonoLabel, Panel, TextInput } from "../components/ui.tsx";
+import { Alert, Button, MonoLabel, Panel, TextInput, ToggleChip } from "../components/ui.tsx";
 import { convex } from "../lib/client.ts";
 import { createMutation, createQuery } from "../lib/convex.ts";
 import { fromNarrative, toNarrative } from "../lib/narrative.ts";
@@ -103,37 +95,11 @@ function NarrativeEditor(props: { id: Id<"characters">; narrative: Narrative | u
   );
 }
 
-/** A pressed/unpressed mode chip (nexus, professional care). Cyan tone is
- * for arcane context only, per the color rules. */
-function ToggleChip(props: {
-  pressed: boolean;
-  onToggle: () => void;
-  tone?: "ley" | "amber";
-  children: JSX.Element;
-}) {
-  return (
-    <button
-      type="button"
-      aria-pressed={props.pressed}
-      class={`notch-6 cursor-pointer border bg-inset px-2 font-hud text-[11.5px] font-semibold tracking-[0.08em] uppercase ${
-        props.pressed
-          ? props.tone === "ley"
-            ? "border-ley/60 text-ley [text-shadow:0_0_8px_rgb(79_216_255/0.5)]"
-            : "border-amber/60 text-amber"
-          : "border-line text-dead hover:border-muted"
-      }`}
-      onClick={() => props.onToggle()}
-    >
-      {props.children}
-    </button>
-  );
-}
-
 /**
  * The dossier: the live sheet plus the field-telemetry rail. Gameplay rolls
- * (saves, skills, strikes, casts) run CLIENT-SIDE through the isomorphic
- * engine and print to the log — moments at the table, not records. Only
- * `rollVitals` persists, via its mutation.
+ * (saves, skills, manual strikes, and weapon damage) are ephemeral client-side
+ * utility telemetry. Hostile combat exchanges are server-owned and persisted;
+ * resource and inventory commands also write through their mutations.
  */
 export function CharacterSheetPage() {
   const params = useParams<{ id: string }>();
@@ -507,105 +473,112 @@ export function CharacterSheetPage() {
               <SheetView sheet={sheet()!} actions={actions} />
               <NarrativeEditor id={id()} narrative={sheet()?.narrative} />
             </div>
-            <TelemetryRail
-              entries={telemetry.entries()}
-              actions={
-                <div class="space-y-2">
-                  <Button variant="primary" class="w-full text-left" onClick={() => void roll()}>
-                    {"> Roll Vitals"}
-                  </Button>
-                  <Show when={rollError()}>
-                    {(err) => <Alert tone="danger">ROLL FAILED — {err().message}</Alert>}
-                  </Show>
-                  <div class="flex gap-2">
-                    <TextInput
-                      aria-label="Damage amount"
-                      inputmode="numeric"
-                      placeholder="DMG"
-                      class="w-16 min-w-0 px-2 py-1.5 text-center"
-                      value={damageInput()}
-                      onInput={(e) => setDamageInput(e.currentTarget.value)}
-                      onKeyDown={(e) => {
-                        if (e.key === "Enter") void damage();
-                      }}
-                    />
-                    <Button class="flex-1 px-2 text-left" onClick={() => void damage()}>
-                      {"> Damage"}
+            <aside class="min-w-0 space-y-3" aria-label="Dossier command rail">
+              <CombatExchangePanel
+                characterId={id()}
+                sheet={sheet()!}
+                onTelemetry={telemetry.log}
+              />
+              <TelemetryRail
+                entries={telemetry.entries()}
+                actions={
+                  <div class="space-y-2">
+                    <Button variant="primary" class="w-full text-left" onClick={() => void roll()}>
+                      {"> Roll Vitals"}
                     </Button>
-                    <ToggleChip pressed={toArmor()} onToggle={() => setToArmor((v) => !v)}>
-                      Armor
-                    </ToggleChip>
-                  </div>
-                  <Button class="w-full text-left" onClick={() => void restore()}>
-                    {"> Full Restore"}
-                  </Button>
-                  <div class="space-y-2 border-t border-line pt-2">
-                    <MonoLabel class="block text-dead">RECOVERY</MonoLabel>
-                    <Show when={sheet()?.ppe}>
+                    <Show when={rollError()}>
+                      {(err) => <Alert tone="danger">ROLL FAILED — {err().message}</Alert>}
+                    </Show>
+                    <div class="flex gap-2">
+                      <TextInput
+                        aria-label="Damage amount"
+                        inputmode="numeric"
+                        placeholder="DMG"
+                        class="w-16 min-w-0 px-2 py-1.5 text-center"
+                        value={damageInput()}
+                        onInput={(e) => setDamageInput(e.currentTarget.value)}
+                        onKeyDown={(e) => {
+                          if (e.key === "Enter") void damage();
+                        }}
+                      />
+                      <Button class="flex-1 px-2 text-left" onClick={() => void damage()}>
+                        {"> Damage"}
+                      </Button>
+                      <ToggleChip pressed={toArmor()} onToggle={() => setToArmor((v) => !v)}>
+                        Armor
+                      </ToggleChip>
+                    </div>
+                    <Button class="w-full text-left" onClick={() => void restore()}>
+                      {"> Full Restore"}
+                    </Button>
+                    <div class="space-y-2 border-t border-line pt-2">
+                      <MonoLabel class="block text-dead">RECOVERY</MonoLabel>
+                      <Show when={sheet()?.ppe}>
+                        <div class="flex gap-2">
+                          <TextInput
+                            aria-label="Hours of rest"
+                            inputmode="numeric"
+                            placeholder="HRS"
+                            class="w-14 min-w-0 px-2 py-1.5 text-center"
+                            value={restHours()}
+                            onInput={(e) => setRestHours(e.currentTarget.value)}
+                            onKeyDown={(e) => {
+                              if (e.key === "Enter") void rest("rest");
+                            }}
+                          />
+                          <Button class="flex-1 px-2 text-left" onClick={() => void rest("rest")}>
+                            {"> Rest"}
+                          </Button>
+                          <Button
+                            class="shrink-0 px-2 text-left whitespace-nowrap"
+                            onClick={() => void rest("meditation")}
+                          >
+                            {"> Meditate"}
+                          </Button>
+                        </div>
+                        <div class="flex gap-2">
+                          <Button class="flex-1 px-2 text-left" onClick={() => void leyDraw()}>
+                            {"> Ley Draw"}
+                          </Button>
+                          <ToggleChip
+                            pressed={atNexus()}
+                            onToggle={() => setAtNexus((v) => !v)}
+                            tone="ley"
+                          >
+                            Nexus
+                          </ToggleChip>
+                        </div>
+                      </Show>
                       <div class="flex gap-2">
                         <TextInput
-                          aria-label="Hours of rest"
+                          aria-label="Treatment day"
                           inputmode="numeric"
-                          placeholder="HRS"
                           class="w-14 min-w-0 px-2 py-1.5 text-center"
-                          value={restHours()}
-                          onInput={(e) => setRestHours(e.currentTarget.value)}
+                          value={
+                            dayInput() !== ""
+                              ? dayInput()
+                              : String((sheet()?.vitals.treatmentDays ?? 0) + 1)
+                          }
+                          onInput={(e) => setDayInput(e.currentTarget.value)}
                           onKeyDown={(e) => {
-                            if (e.key === "Enter") void rest("rest");
+                            if (e.key === "Enter") void treatDay();
                           }}
                         />
-                        <Button class="flex-1 px-2 text-left" onClick={() => void rest("rest")}>
-                          {"> Rest"}
-                        </Button>
-                        <Button
-                          class="shrink-0 px-2 text-left whitespace-nowrap"
-                          onClick={() => void rest("meditation")}
-                        >
-                          {"> Meditate"}
-                        </Button>
-                      </div>
-                      <div class="flex gap-2">
-                        <Button class="flex-1 px-2 text-left" onClick={() => void leyDraw()}>
-                          {"> Ley Draw"}
+                        <Button class="flex-1 px-2 text-left" onClick={() => void treatDay()}>
+                          {"> Treatment Day"}
                         </Button>
                         <ToggleChip
-                          pressed={atNexus()}
-                          onToggle={() => setAtNexus((v) => !v)}
-                          tone="ley"
+                          pressed={professional()}
+                          onToggle={() => setProfessional((v) => !v)}
                         >
-                          Nexus
+                          Pro
                         </ToggleChip>
                       </div>
-                    </Show>
-                    <div class="flex gap-2">
-                      <TextInput
-                        aria-label="Treatment day"
-                        inputmode="numeric"
-                        class="w-14 min-w-0 px-2 py-1.5 text-center"
-                        value={
-                          dayInput() !== ""
-                            ? dayInput()
-                            : String((sheet()?.vitals.treatmentDays ?? 0) + 1)
-                        }
-                        onInput={(e) => setDayInput(e.currentTarget.value)}
-                        onKeyDown={(e) => {
-                          if (e.key === "Enter") void treatDay();
-                        }}
-                      />
-                      <Button class="flex-1 px-2 text-left" onClick={() => void treatDay()}>
-                        {"> Treatment Day"}
-                      </Button>
-                      <ToggleChip
-                        pressed={professional()}
-                        onToggle={() => setProfessional((v) => !v)}
-                      >
-                        Pro
-                      </ToggleChip>
                     </div>
                   </div>
-                </div>
-              }
-            />
+                }
+              />
+            </aside>
           </div>
         </Match>
       </Switch>
diff --git a/apps/web/tests/combat-exchange.test.ts b/apps/web/tests/combat-exchange.test.ts
new file mode 100644
index 0000000..847922f
--- /dev/null
+++ b/apps/web/tests/combat-exchange.test.ts
@@ -0,0 +1,528 @@
+/// <reference types="node" />
+
+import { deriveSheet, type CharacterInput } from "@riftforge/rules";
+import { ConvexError } from "convex/values";
+import { existsSync, readFileSync } from "node:fs";
+import { describe, expect, test } from "vite-plus/test";
+import {
+  combatErrorMessage,
+  combatTargetDisabledReason,
+  combatWeaponChoices,
+  exchangeTone,
+  formatExchangeSummary,
+  ownsAsyncResult,
+  type CombatTargetSummary,
+  type ExchangeSummary,
+} from "../src/lib/combat-exchange.ts";
+
+function source(relative: string): string {
+  const url = new URL(relative, import.meta.url);
+  return existsSync(url) ? readFileSync(url, "utf8") : "";
+}
+
+const panelSource = source("../src/components/combat-exchange-panel.tsx");
+const uiSource = source("../src/components/ui.tsx");
+const telemetryRailSource = source("../src/components/telemetry-rail.tsx");
+const characterSheetSource = source("../src/pages/character-sheet.tsx");
+
+const combatant: CharacterInput = {
+  name: "Vesper",
+  occId: "ley-line-walker",
+  level: 1,
+  attributes: { IQ: 18, ME: 16, MA: 12, PS: 16, PP: 20, PE: 14, PB: 11, Spd: 12 },
+  hthType: "basic",
+  skills: [
+    { skillId: "wilderness-survival", occBonus: 10 },
+    { skillId: "math-basic", occBonus: 10 },
+    { skillId: "land-navigation", occBonus: 4 },
+  ],
+  spellIds: ["globe-of-daylight", "energy-bolt", "armor-of-ithan"],
+  rolled: { hitPoints: 18, sdc: 20 },
+};
+
+const exchangeBase = {
+  _id: "exchange-1" as ExchangeSummary["_id"],
+  _creationTime: 1,
+  attackerId: "attacker-1" as ExchangeSummary["attackerId"],
+  defenderId: "defender-1" as ExchangeSummary["defenderId"],
+  attackerName: "Vesper",
+  defenderName: "Deadboy",
+  weapon: {
+    index: 0,
+    itemId: "survival-knife",
+    name: "Survival Knife",
+    category: "knife" as const,
+  },
+  attack: {
+    kind: "melee" as const,
+    minimumStrikeTotal: 5,
+    strikeBonus: 3,
+    strikeBonusSources: [{ source: "attribute" as const, label: "P.P.", value: 3 }],
+    proficiencyBonus: 0,
+    damageFormula: "1D6",
+    damageBonus: 1,
+    criticalOn: 20,
+    damageType: "sdc" as const,
+  },
+  context: {
+    kind: "melee" as const,
+    defenderAware: true,
+    parryMode: "standard" as const,
+  },
+  attackerStateToken: "attacker-state",
+  defenderStateToken: "defender-state",
+  strikeRoll: {
+    die: 12,
+    bonus: 3,
+    total: 15,
+    target: 5,
+    success: true,
+    naturalTwenty: false,
+    naturalOne: false,
+  },
+};
+
+function pendingExchange(): Extract<ExchangeSummary, { status: "pendingDefense" }> {
+  return {
+    ...exchangeBase,
+    status: "pendingDefense",
+    defenseOptions: [
+      { kind: "parry", bonus: 4, actionCost: 0, explanation: "Parry the melee weapon." },
+    ],
+  };
+}
+
+function cancelledExchange(): Extract<ExchangeSummary, { status: "cancelled" }> {
+  return { ...exchangeBase, status: "cancelled", cancelledAt: 2 };
+}
+
+function staleExchange(): Extract<ExchangeSummary, { status: "stale" }> {
+  return { ...exchangeBase, status: "stale", staleAt: 2, reason: "combatStateChanged" };
+}
+
+function missedExchange(): Extract<ExchangeSummary, { status: "resolved" }> {
+  return {
+    ...exchangeBase,
+    status: "resolved",
+    resolution: {
+      outcome: "miss",
+      reason: "belowMinimum",
+      critical: false,
+      damageMultiplier: 1,
+    },
+  };
+}
+
+function defendedExchange(): Extract<ExchangeSummary, { status: "resolved" }> {
+  return {
+    ...exchangeBase,
+    status: "resolved",
+    resolution: {
+      outcome: "defended",
+      reason: "parried",
+      response: {
+        kind: "parry",
+        bonus: 4,
+        actionCost: 0,
+        explanation: "Parry the melee weapon.",
+        defenseModifier: 0,
+        totalBonus: 4,
+      },
+      defenseRoll: {
+        die: 16,
+        bonus: 4,
+        total: 20,
+        target: 15,
+        success: true,
+        naturalTwenty: false,
+        naturalOne: false,
+      },
+      critical: false,
+      damageMultiplier: 1,
+    },
+  };
+}
+
+function bodyHitExchange(): Extract<ExchangeSummary, { status: "resolved" }> {
+  return {
+    ...exchangeBase,
+    status: "resolved",
+    resolution: {
+      outcome: "hit",
+      reason: "unopposed",
+      response: {
+        kind: "none",
+        bonus: 0,
+        actionCost: 0,
+        explanation: "Take the hit.",
+        defenseModifier: 0,
+        totalBonus: 0,
+      },
+      critical: true,
+      damageMultiplier: 2,
+      damageRoll: { dice: [5], bonus: 1, total: 6 },
+      totalDamage: 12,
+      route: {
+        kind: "body",
+        body: {
+          before: { sdc: 5, hitPoints: 18 },
+          after: { sdc: 0, hitPoints: 11 },
+        },
+      },
+    },
+  };
+}
+
+function armorHitExchange(): Extract<ExchangeSummary, { status: "resolved" }> {
+  return {
+    ...exchangeBase,
+    status: "resolved",
+    resolution: {
+      outcome: "hit",
+      reason: "strikeWon",
+      response: {
+        kind: "parry",
+        bonus: 4,
+        actionCost: 0,
+        explanation: "Parry the melee weapon.",
+        defenseModifier: -2,
+        defenseModifierReason: "Bad footing",
+        totalBonus: 2,
+      },
+      defenseRoll: {
+        die: 7,
+        bonus: 2,
+        total: 9,
+        target: 15,
+        success: false,
+        naturalTwenty: false,
+        naturalOne: false,
+      },
+      critical: false,
+      damageMultiplier: 1,
+      damageRoll: { dice: [4], bonus: 1, total: 5 },
+      totalDamage: 5,
+      route: {
+        kind: "armor",
+        armor: { before: 20, after: 15 },
+        body: {
+          before: { sdc: 20, hitPoints: 18 },
+          after: { sdc: 20, hitPoints: 18 },
+        },
+      },
+    },
+  };
+}
+
+describe("combat weapon choices", () => {
+  test("shows only owned weapons and keeps the full M.D.C. boundary visible", () => {
+    const sheet = deriveSheet({
+      ...combatant,
+      items: [
+        { itemId: "survival-knife" },
+        { itemId: "canteen" },
+        { itemId: "hand-axe" },
+        { itemId: "automatic-pistol" },
+        { itemId: "submachine-gun" },
+        { itemId: "wilks-320-laser-pistol" },
+        { itemId: "wilks-447-laser-rifle" },
+      ],
+    });
+
+    expect(combatWeaponChoices(sheet)).toEqual([
+      {
+        index: 0,
+        itemId: "survival-knife",
+        label: "Survival Knife — 1D6 S.D.C.",
+        supported: true,
+      },
+      { index: 2, itemId: "hand-axe", label: "Hand Axe — 1D6 S.D.C.", supported: true },
+      {
+        index: 3,
+        itemId: "automatic-pistol",
+        label: ".45 Automatic Pistol — 4D6 S.D.C.",
+        supported: true,
+      },
+      {
+        index: 4,
+        itemId: "submachine-gun",
+        label: "Submachine-Gun — 4D6 S.D.C.",
+        supported: true,
+      },
+      {
+        index: 5,
+        itemId: "wilks-320-laser-pistol",
+        label: "Wilk's 320 Laser Pistol — 1D6 M.D.",
+        supported: false,
+        disabledReason: "Full M.D.C. combat is follow-up work.",
+      },
+      {
+        index: 6,
+        itemId: "wilks-447-laser-rifle",
+        label: "Wilk's 447 Laser Rifle — 3D6 M.D.",
+        supported: false,
+        disabledReason: "Full M.D.C. combat is follow-up work.",
+      },
+    ]);
+  });
+});
+
+describe("combat target choices", () => {
+  const targetId = "target-1" as CombatTargetSummary["id"];
+
+  test("explains unready and M.D.C.-protected targets precisely", () => {
+    expect(
+      combatTargetDisabledReason({
+        id: targetId,
+        name: "Unready",
+        ready: false,
+        protection: "none",
+        disabledReason: "defenderNotReady",
+      }),
+    ).toBe("Roll this target's H.P. and S.D.C. first.");
+    expect(
+      combatTargetDisabledReason({
+        id: targetId,
+        name: "M.D.C. Target",
+        ready: true,
+        protection: "mdcArmor",
+        disabledReason: "unsupportedMdcProtection",
+      }),
+    ).toBe("Full M.D.C. combat is follow-up work.");
+    expect(
+      combatTargetDisabledReason({
+        id: targetId,
+        name: "Ready",
+        ready: true,
+        protection: "sdcArmor",
+      }),
+    ).toBeUndefined();
+  });
+});
+
+describe("combat exchange presentation", () => {
+  test("maps combat state to Ley Terminal tones without a cyan state", () => {
+    const tones = [
+      exchangeTone(pendingExchange()),
+      exchangeTone(staleExchange()),
+      exchangeTone(cancelledExchange()),
+      exchangeTone(missedExchange()),
+      exchangeTone(defendedExchange()),
+      exchangeTone(bodyHitExchange()),
+    ];
+
+    expect(tones).toEqual(["warn", "warn", "dim", "dim", "good", "bad"]);
+    expect(tones).not.toContain("cyan");
+  });
+
+  test("formats pending, stale, cancelled, and miss summaries without invented result fields", () => {
+    const lead = "Vesper → Deadboy :: Survival Knife :: d20[12]+3 = 15";
+    expect(formatExchangeSummary(pendingExchange())).toBe(`${lead} :: AWAITING DEFENSE`);
+    expect(formatExchangeSummary(staleExchange())).toBe(`${lead} :: STALE — COMBAT STATE CHANGED`);
+    expect(formatExchangeSummary(cancelledExchange())).toBe(`${lead} :: CANCELLED`);
+    expect(formatExchangeSummary(missedExchange())).toBe(`${lead} :: MISS (belowMinimum)`);
+
+    for (const exchange of [
+      pendingExchange(),
+      staleExchange(),
+      cancelledExchange(),
+      missedExchange(),
+    ]) {
+      const summary = formatExchangeSummary(exchange);
+      expect(summary).not.toContain("CRITICAL");
+      expect(summary).not.toContain("ARMOR");
+      expect(summary).not.toContain("BODY S.D.C.");
+    }
+  });
+
+  test("includes a server-returned defense in a defended summary", () => {
+    expect(formatExchangeSummary(defendedExchange())).toBe(
+      "Vesper → Deadboy :: Survival Knife :: d20[12]+3 = 15 :: PARRY d20[16]+4 = 20 :: DEFENDED",
+    );
+  });
+
+  test("includes critical, detailed damage, and the routed remaining body pools", () => {
+    expect(formatExchangeSummary(bodyHitExchange())).toBe(
+      "Vesper → Deadboy :: Survival Knife :: d20[12]+3 = 15 :: 1D6 [5]+1 = 6 RAW :: CRITICAL ×2 :: 12 S.D.C. FINAL → BODY S.D.C. 0 / H.P. 11",
+    );
+  });
+
+  test("includes a failed defense and the remaining armor pool without fabricating body damage", () => {
+    const summary = formatExchangeSummary(armorHitExchange());
+    expect(summary).toBe(
+      "Vesper → Deadboy :: Survival Knife :: d20[12]+3 = 15 :: PARRY d20[7]+2 = 9 :: 1D6 [4]+1 = 5 RAW :: ×1 :: 5 S.D.C. FINAL → ARMOR 15",
+    );
+    expect(summary).not.toContain("BODY S.D.C.");
+    expect(summary).not.toContain("CRITICAL");
+  });
+});
+
+describe("async result ownership", () => {
+  const owner = { routeId: "alpha", routeEpoch: 3, exchangeId: "exchange-1" };
+
+  test("rejects a result from a different route, epoch, or expected exchange", () => {
+    expect(ownsAsyncResult(owner, { ...owner, routeId: "beta" })).toBe(false);
+    expect(ownsAsyncResult(owner, { ...owner, routeEpoch: 4 })).toBe(false);
+    expect(ownsAsyncResult(owner, { ...owner, exchangeId: "exchange-2" })).toBe(false);
+  });
+
+  test("accepts a current owner only when every field is equal", () => {
+    expect(ownsAsyncResult(owner, { ...owner })).toBe(true);
+    expect(
+      ownsAsyncResult({ routeId: "alpha", routeEpoch: 3 }, { routeId: "alpha", routeEpoch: 3 }),
+    ).toBe(true);
+  });
+});
+
+describe("combat errors", () => {
+  test("prefers structured Convex messages and safely falls back", () => {
+    expect(combatErrorMessage(new ConvexError({ code: "badCombat", message: "Not legal." }))).toBe(
+      "Not legal.",
+    );
+    expect(combatErrorMessage(new Error("Network unavailable."))).toBe("Network unavailable.");
+    expect(combatErrorMessage("Unknown combat error.")).toBe("Unknown combat error.");
+  });
+});
+
+describe("combat exchange component contract", () => {
+  test("shares native select and toggle primitives without rounded or decorative styling", () => {
+    expect(uiSource).toContain('export function SelectInput(props: ComponentProps<"select">)');
+    expect(uiSource).toContain("notch-8 border border-line bg-noir");
+    expect(uiSource).toContain("focus:border-amber disabled:text-dead");
+    expect(uiSource).toContain("export function ToggleChip");
+    expect(characterSheetSource).not.toContain("function ToggleChip(");
+  });
+
+  test("keeps declaration and response modifier inputs inside their fixed grid tracks", () => {
+    expect(panelSource).toMatch(
+      /aria-label="Defense modifier"\s*inputmode="numeric"\s*class="w-full"/,
+    );
+    expect(panelSource).toMatch(
+      /aria-label="Strike modifier"\s*inputmode="numeric"\s*class="w-full"/,
+    );
+  });
+
+  test("subscribes every queue reactively and keeps strike, damage, and routing server-owned", () => {
+    expect(panelSource).toContain("api.combat.targets");
+    expect(panelSource).toContain("api.combat.incoming");
+    expect(panelSource).toContain("api.combat.outgoing");
+    expect(panelSource).toContain("api.combat.recent");
+    expect(panelSource).toContain("api.combat.declareAttack");
+    expect(panelSource).toContain("api.combat.respondToAttack");
+    expect(panelSource).toContain("api.combat.cancelAttack");
+    expect(panelSource).not.toMatch(/\brollD20\b|\brollDamage\b|\bresolveCombatExchange\b/);
+    const declarationStart = panelSource.indexOf("const result = await declareAttack({");
+    const declarationEnd = panelSource.indexOf("\n      });", declarationStart);
+    expect(declarationStart).toBeGreaterThanOrEqual(0);
+    expect(declarationEnd).toBeGreaterThan(declarationStart);
+    expect(panelSource.slice(declarationStart, declarationEnd)).not.toMatch(
+      /strikeRoll\s*:|damageRoll\s*:|route\s*:/,
+    );
+  });
+
+  test("renders stored context before only the stored server response options", () => {
+    expect(panelSource).toContain("STORED CONTEXT");
+    expect(panelSource).toContain("exchange().context.defenderAware");
+    expect(panelSource).toContain("exchange().defenseOptions");
+    expect(panelSource.indexOf("STORED CONTEXT")).toBeLessThan(
+      panelSource.indexOf("exchange().defenseOptions"),
+    );
+    expect(panelSource).toContain('option.kind === "none" ? "> TAKE THE HIT"');
+    expect(panelSource).toContain("option.actionCost} ACTION");
+  });
+
+  test("keeps take-the-hit independent from draft defense modifiers", () => {
+    expect(panelSource).toContain('const usesDefense = kind !== "none";');
+    expect(panelSource).toMatch(
+      /if \(\s*usesDefense &&\s*\(modifier === undefined \|\| \(modifier !== 0 && defenseReason\(\)\.trim\(\) === ""\)\)\s*\)\s*return;/,
+    );
+    expect(panelSource).toContain(
+      'disabled={busy() || (option.kind !== "none" && !responseReady())}',
+    );
+    expect(panelSource).toContain("...(usesDefense && modifier !== 0");
+    expect(panelSource).toContain('...(usesDefense && defenseReason().trim() !== ""');
+  });
+
+  test("resets route state and gates declaration, response, and cancellation by ownership", () => {
+    expect(panelSource).toContain("const resetRouteState = () => {");
+    expect(panelSource).toContain("routeEpoch += 1");
+    expect(panelSource).toContain(
+      "createEffect(on(() => props.characterId, resetRouteState, { defer: true }))",
+    );
+    expect(panelSource).toContain("routeId: props.characterId");
+    expect(panelSource).toContain("routeEpoch: props.routeEpoch()");
+    expect(panelSource).toContain("exchangeId: props.exchangeId");
+    expect(panelSource).toContain("ownsAsyncResult(owner, current)");
+  });
+
+  test("invalidates the component lifetime when cleanup runs", () => {
+    const cleanupStart = panelSource.indexOf("onCleanup(() => {");
+    const cleanupEnd = panelSource.indexOf("\n  });", cleanupStart);
+    expect(cleanupStart).toBeGreaterThanOrEqual(0);
+    expect(cleanupEnd).toBeGreaterThan(cleanupStart);
+    expect(panelSource.slice(cleanupStart, cleanupEnd)).toContain("routeEpoch += 1");
+  });
+
+  test("keys queue row state by stable exchange ids instead of refreshed object identity", () => {
+    expect(panelSource).toMatch(
+      /const incomingIds = createMemo\(\(\) =>\s*pendingIncoming\(\)\.map\(\(exchange\) => exchange\._id\)/,
+    );
+    expect(panelSource).toMatch(
+      /const outgoingIds = createMemo\(\(\) =>\s*pendingOutgoing\(\)\.map\(\(exchange\) => exchange\._id\)/,
+    );
+    expect(panelSource).toContain("<For each={incomingIds()}>");
+    expect(panelSource).toContain("<For each={outgoingIds()}>");
+    expect(panelSource).toContain("exchange={() => incomingById(exchangeId)}");
+    expect(panelSource).toContain("exchange={() => outgoingById(exchangeId)}");
+    expect(panelSource).not.toContain("<For each={pendingIncoming()}>");
+    expect(panelSource).not.toContain("<For each={outgoing.data()}>");
+  });
+
+  test("uses green for an immediate miss and amber for a pending defense", () => {
+    const declarationStart = panelSource.indexOf("const submitDeclaration = async () => {");
+    const noticeStart = panelSource.indexOf("setNotice(\n        result.status", declarationStart);
+    const noticeEnd = panelSource.indexOf("\n      );", noticeStart);
+    expect(noticeStart).toBeGreaterThanOrEqual(0);
+    expect(noticeEnd).toBeGreaterThan(noticeStart);
+    const notice = panelSource.slice(noticeStart, noticeEnd);
+    expect(notice).toMatch(/result\.status === "resolved"\s*\? \{ tone: "ok"/s);
+    expect(notice).toMatch(/: \{\s*tone: "warn".*AWAITING DEFENSE/s);
+  });
+
+  test("clears a pending declaration notice after that exchange resolves", () => {
+    expect(panelSource).toContain("exchangeId: result._id");
+    expect(panelSource).toMatch(
+      /const currentNotice = notice\(\);[\s\S]*recent\s*\.data\(\)\s*\?\.find\([\s\S]*currentNotice\.exchangeId[\s\S]*matchingExchange\.status !== "pendingDefense"[\s\S]*setNotice\(undefined\)/,
+    );
+  });
+
+  test("keeps persisted combat history bounded and uses no magic signal tone", () => {
+    expect(panelSource).toContain("formatExchangeSummary(exchange)");
+    expect(panelSource).toContain("exchangeTone(exchange)");
+    expect(panelSource).toContain("recent.data()?.slice(0, 20)");
+    expect(panelSource).toContain('dim: "border-dead text-muted"');
+    expect(panelSource).toContain('warn: "border-amber text-amber"');
+    expect(panelSource).toContain('bad: "border-blood text-blood-text"');
+    expect(panelSource).toContain('good: "border-ok text-ok"');
+    expect(panelSource).not.toMatch(/border-ley|text-ley/);
+  });
+
+  test("associates the recent-history disclosure with its controlled list", () => {
+    expect(panelSource).toContain('aria-controls="combat-recent-history"');
+    expect(panelSource).toContain('<ol id="combat-recent-history"');
+  });
+
+  test("mounts combat above telemetry under one complementary rail landmark", () => {
+    expect(characterSheetSource).toContain('aria-label="Dossier command rail"');
+    expect(characterSheetSource).toContain("<CombatExchangePanel");
+    expect(characterSheetSource.indexOf("<CombatExchangePanel")).toBeLessThan(
+      characterSheetSource.indexOf("<TelemetryRail"),
+    );
+    expect(telemetryRailSource).toContain(
+      '<section class="flex min-h-0 flex-col gap-2.5" aria-label="Field telemetry">',
+    );
+    expect(telemetryRailSource).not.toContain(
+      '<aside class="flex min-h-0 flex-col gap-2.5" aria-label="Field telemetry">',
+    );
+  });
+});
diff --git a/packages/backend/convex/_generated/api.d.ts b/packages/backend/convex/_generated/api.d.ts
index cbbd213..979dc56 100644
--- a/packages/backend/convex/_generated/api.d.ts
+++ b/packages/backend/convex/_generated/api.d.ts
@@ -8,7 +8,10 @@
  * @module
  */
 
+import type * as character_state from "../character_state.js";
 import type * as characters from "../characters.js";
+import type * as combat from "../combat.js";
+import type * as combat_values from "../combat_values.js";
 
 import type {
   ApiFromModules,
@@ -17,7 +20,10 @@ import type {
 } from "convex/server";
 
 declare const fullApi: ApiFromModules<{
+  character_state: typeof character_state;
   characters: typeof characters;
+  combat: typeof combat;
+  combat_values: typeof combat_values;
 }>;
 
 /**
diff --git a/packages/backend/convex/character_state.ts b/packages/backend/convex/character_state.ts
new file mode 100644
index 0000000..f848ca8
--- /dev/null
+++ b/packages/backend/convex/character_state.ts
@@ -0,0 +1,55 @@
+import { characterSchema, deriveSheet, type Character } from "@riftforge/rules";
+import { v } from "convex/values";
+import type { Id } from "./_generated/dataModel";
+import type { MutationCtx } from "./_generated/server";
+
+export function validateCharacter(input: unknown): Character {
+  const character = characterSchema.parse(input);
+  deriveSheet(character);
+  return character;
+}
+
+export async function loadCharacter(ctx: MutationCtx, id: Id<"characters">): Promise<Character> {
+  const doc = await ctx.db.get(id);
+  if (doc === null) throw new Error(`Character ${id} not found.`);
+  const { _id, _creationTime, ...stored } = doc;
+  return characterSchema.parse(stored);
+}
+
+export async function patchCurrent(
+  ctx: MutationCtx,
+  id: Id<"characters">,
+  character: Character,
+  current: Character["current"],
+): Promise<void> {
+  validateCharacter({ ...character, current });
+  await ctx.db.patch(id, { current });
+}
+
+export const expectedItemValidator = v.object({
+  itemId: v.string(),
+  worn: v.optional(v.boolean()),
+  rolledMdc: v.optional(v.number()),
+});
+export type ExpectedItem = {
+  itemId: string;
+  worn?: boolean;
+  rolledMdc?: number;
+};
+
+export function requireItemAt(
+  character: Character,
+  index: number,
+  expect: ExpectedItem,
+): Character["items"][number] {
+  const entry = Number.isInteger(index) ? character.items[index] : undefined;
+  if (entry === undefined) throw new Error(`No item at index ${index}.`);
+  if (
+    entry.itemId !== expect.itemId ||
+    (entry.worn === true) !== (expect.worn === true) ||
+    entry.rolledMdc !== expect.rolledMdc
+  ) {
+    throw new Error("The manifest changed while the request was in flight — try again.");
+  }
+  return entry;
+}
diff --git a/packages/backend/convex/characters.ts b/packages/backend/convex/characters.ts
index 229d590..8a7302b 100644
--- a/packages/backend/convex/characters.ts
+++ b/packages/backend/convex/characters.ts
@@ -2,7 +2,6 @@ import {
   applyDamage as damagePools,
   armorMaxPool,
   armorNeedsRoll,
-  characterSchema,
   comaDeathFloor,
   damageArmor,
   deriveSheet,
@@ -20,8 +19,14 @@ import {
   type Character,
 } from "@riftforge/rules";
 import { v } from "convex/values";
-import { mutation, query, type MutationCtx } from "./_generated/server";
-import type { Id } from "./_generated/dataModel";
+import { mutation, query } from "./_generated/server";
+import {
+  expectedItemValidator,
+  loadCharacter,
+  patchCurrent,
+  requireItemAt,
+  validateCharacter,
+} from "./character_state";
 import { characterFields } from "./schema";
 
 /** A stored character document: the fields plus Convex's system columns. */
@@ -39,44 +44,6 @@ const characterInputFields = {
   spellIds: v.optional(characterFields.spellIds),
 };
 
-/**
- * Validate raw input through the rules layer before it can be stored.
- * `characterSchema.parse` rejects bad shapes/values and applies defaults
- * (psychicClass, skills, spellIds); the throwaway `deriveSheet` call then
- * proves the character actually derives — rejecting unknown O.C.C./skill/
- * spell/H2H ids and illegal duplicates — so every stored doc is a
- * fully-resolved `Character` that the sheet query cannot fail on.
- */
-function validateCharacter(input: unknown): Character {
-  const character = characterSchema.parse(input);
-  deriveSheet(character);
-  return character;
-}
-
-/** Load a stored character or throw; returns the parsed choices sans system columns. */
-async function loadCharacter(ctx: MutationCtx, id: Id<"characters">): Promise<Character> {
-  const doc = await ctx.db.get(id);
-  if (doc === null) throw new Error(`Character ${id} not found.`);
-  const { _id, _creationTime, ...stored } = doc;
-  return characterSchema.parse(stored);
-}
-
-/**
- * Write a new live-vitals state. Round-trips through the rules layer first
- * (like every write), so a `current` that exceeds its maximum or sinks below
- * the coma/death floor can never be stored — mutations compute legal values,
- * this is the backstop.
- */
-async function patchCurrent(
-  ctx: MutationCtx,
-  id: Id<"characters">,
-  character: Character,
-  current: Character["current"],
-): Promise<void> {
-  validateCharacter({ ...character, current });
-  await ctx.db.patch(id, { current });
-}
-
 export const create = mutation({
   args: characterInputFields,
   returns: v.id("characters"),
@@ -315,37 +282,6 @@ function withoutArmorPool(current: Character["current"]): Character["current"] {
   return Object.keys(rest).length > 0 ? rest : undefined;
 }
 
-/** Client's snapshot of the item instance it targeted (index + this state). */
-const expectedItemValidator = v.object({
-  itemId: v.string(),
-  worn: v.optional(v.boolean()),
-  rolledMdc: v.optional(v.number()),
-});
-type ExpectedItem = { itemId: string; worn?: boolean; rolledMdc?: number };
-
-/**
- * Resolve the item instance an index-based inventory mutation targets. The
- * index alone can go stale — the manifest may have changed while the click
- * was in flight — so the client also names the instance state it saw, and a
- * mismatch is refused instead of landing on whatever now sits at that slot.
- */
-function requireItemAt(
-  character: Character,
-  index: number,
-  expect: ExpectedItem,
-): Character["items"][number] {
-  const entry = Number.isInteger(index) ? character.items[index] : undefined;
-  if (entry === undefined) throw new Error(`No item at index ${index}.`);
-  if (
-    entry.itemId !== expect.itemId ||
-    (entry.worn === true) !== (expect.worn === true) ||
-    entry.rolledMdc !== expect.rolledMdc
-  ) {
-    throw new Error("The manifest changed while the request was in flight — try again.");
-  }
-  return entry;
-}
-
 /**
  * Add an item to the inventory. Dice-capacity armor (the Ley Line Walker's
  * concealed suit prints "2D6+32 M.D.C. main body", RUE p.113) rolls its
diff --git a/packages/backend/convex/combat.ts b/packages/backend/convex/combat.ts
new file mode 100644
index 0000000..3d373fe
--- /dev/null
+++ b/packages/backend/convex/combat.ts
@@ -0,0 +1,479 @@
+import {
+  attackerCombatStateToken,
+  authorizeCombatResponse,
+  combatContextSchema,
+  combatResponseInputSchema,
+  defenderCombatStateToken,
+  deriveAttackProfile,
+  deriveDefenseOptions,
+  deriveProtection,
+  deriveSheet,
+  evaluateDeclaration,
+  rollD20,
+  rollDamage,
+  resolveCombatExchange,
+  resolveStrike,
+  validateCombatContext,
+  type AttackProfile,
+  type AuthorizedCombatResponse,
+  type Character,
+  type CharacterSheet,
+  type CombatContext,
+  type CombatExchangeErrorCode,
+  type CombatResponseInput,
+  type DefenseKind,
+  type DefenseOption,
+} from "@riftforge/rules";
+import { ConvexError, v } from "convex/values";
+import type { Doc } from "./_generated/dataModel";
+import { mutation, query, type MutationCtx } from "./_generated/server";
+import {
+  expectedItemValidator,
+  loadCharacter,
+  patchCurrent,
+  requireItemAt,
+} from "./character_state";
+import { combatContextValidator, combatResponseInputValidator } from "./combat_values";
+
+const TARGET_LIMIT = 50;
+const FEED_LIMIT = 20;
+
+function combatFailure(code: CombatExchangeErrorCode, message: string): never {
+  throw new ConvexError({ code, message });
+}
+
+function requireCombatReady(
+  sheet: CharacterSheet,
+  code: "attackerNotReady" | "defenderNotReady",
+): void {
+  if (sheet.vitals.sdc.rolled === undefined || sheet.vitals.hitPoints.rolled === undefined) {
+    combatFailure(code, "Roll both S.D.C. and Hit Points before entering combat.");
+  }
+}
+
+function parseDeclaredContext(
+  attack: Extract<AttackProfile, { supported: true }>,
+  input: unknown,
+): CombatContext {
+  const parsed = combatContextSchema.safeParse(input);
+  if (!parsed.success) {
+    const missingReason = parsed.error.issues.some((issue) =>
+      issue.path.includes("strikeModifierReason"),
+    );
+    combatFailure(
+      missingReason ? "modifierReasonRequired" : "invalidContext",
+      missingReason
+        ? "A reason is required for a nonzero strike modifier."
+        : "The declared combat context is invalid.",
+    );
+  }
+  if (parsed.data.kind !== attack.kind) {
+    combatFailure("invalidContext", "The declared context does not match the weapon mode.");
+  }
+  return parsed.data;
+}
+
+function pendingBase(exchange: Doc<"combatExchanges">) {
+  if (exchange.status !== "pendingDefense") {
+    combatFailure("exchangeNotPending", "The combat exchange is no longer pending.");
+  }
+  const {
+    _id,
+    _creationTime,
+    status: _status,
+    defenseOptions: _defenseOptions,
+    ...base
+  } = exchange;
+  return { id: _id, base, defenseOptions: _defenseOptions };
+}
+
+async function finalizeStale(ctx: MutationCtx, pending: ReturnType<typeof pendingBase>) {
+  await ctx.db.replace(pending.id, {
+    ...pending.base,
+    status: "stale",
+    staleAt: Date.now(),
+    reason: "combatStateChanged",
+  });
+  return (await ctx.db.get(pending.id))!;
+}
+
+type SupportedAttack = Extract<AttackProfile, { supported: true }>;
+type StoredWeapon = Doc<"combatExchanges">["weapon"];
+type StoredAttack = Doc<"combatExchanges">["attack"];
+
+function weaponSnapshotsMatch(current: SupportedAttack["weapon"], stored: StoredWeapon): boolean {
+  return (
+    current.index === stored.index &&
+    current.itemId === stored.itemId &&
+    current.name === stored.name &&
+    current.category === stored.category &&
+    current.worn === stored.worn &&
+    current.rolledMdc === stored.rolledMdc
+  );
+}
+
+function attackSnapshotsMatch(current: SupportedAttack, stored: StoredAttack): boolean {
+  return (
+    current.kind === stored.kind &&
+    current.minimumStrikeTotal === stored.minimumStrikeTotal &&
+    current.strikeBonus === stored.strikeBonus &&
+    current.proficiencyBonus === stored.proficiencyBonus &&
+    current.damageFormula === stored.damageFormula &&
+    current.damageBonus === stored.damageBonus &&
+    current.criticalOn === stored.criticalOn &&
+    current.damageType === stored.damageType &&
+    current.strikeBonusSources.length === stored.strikeBonusSources.length &&
+    current.strikeBonusSources.every((source, index) => {
+      const prior = stored.strikeBonusSources[index];
+      return (
+        prior !== undefined &&
+        source.source === prior.source &&
+        source.label === prior.label &&
+        source.value === prior.value
+      );
+    })
+  );
+}
+
+function defenseOptionSnapshotsMatch(
+  current: readonly DefenseOption[],
+  stored: readonly DefenseOption[],
+): boolean {
+  return (
+    current.length === stored.length &&
+    current.every((option, index) => {
+      const prior = stored[index];
+      return (
+        prior !== undefined &&
+        option.kind === prior.kind &&
+        option.bonus === prior.bonus &&
+        option.actionCost === prior.actionCost &&
+        option.explanation === prior.explanation
+      );
+    })
+  );
+}
+
+function parseResponse(input: unknown): CombatResponseInput {
+  const parsed = combatResponseInputSchema.safeParse(input);
+  if (!parsed.success) {
+    const missingReason = parsed.error.issues.some((issue) =>
+      issue.path.includes("defenseModifierReason"),
+    );
+    combatFailure(
+      missingReason ? "modifierReasonRequired" : "illegalDefense",
+      missingReason
+        ? "A reason is required for a nonzero defense modifier."
+        : "The combat response is invalid.",
+    );
+  }
+  return parsed.data;
+}
+
+export const declareAttack = mutation({
+  args: {
+    attackerId: v.id("characters"),
+    defenderId: v.id("characters"),
+    weaponIndex: v.number(),
+    expect: expectedItemValidator,
+    context: combatContextValidator,
+  },
+  handler: async (ctx, args) => {
+    if (args.attackerId === args.defenderId) {
+      combatFailure("selfTarget", "A character cannot target itself with a hostile exchange.");
+    }
+
+    let attacker: Character;
+    let defender: Character;
+    try {
+      [attacker, defender] = await Promise.all([
+        loadCharacter(ctx, args.attackerId),
+        loadCharacter(ctx, args.defenderId),
+      ]);
+    } catch {
+      combatFailure("characterMissing", "The attacker or defender no longer exists.");
+    }
+
+    const attackerSheet = deriveSheet(attacker);
+    const defenderSheet = deriveSheet(defender);
+    requireCombatReady(attackerSheet, "attackerNotReady");
+    requireCombatReady(defenderSheet, "defenderNotReady");
+
+    try {
+      requireItemAt(attacker, args.weaponIndex, args.expect);
+    } catch {
+      combatFailure("weaponMissingOrChanged", "The selected weapon instance changed.");
+    }
+
+    const attack = deriveAttackProfile(attackerSheet, args.weaponIndex);
+    if (!attack.supported) {
+      combatFailure(
+        attack.reason,
+        attack.reason === "unsupportedMdWeapon"
+          ? "M.D. weapons require the full M.D.C. combat follow-up."
+          : "The selected item is not a supported weapon mode.",
+      );
+    }
+    const context = parseDeclaredContext(attack, args.context);
+    const protection = deriveProtection(defenderSheet);
+    if (protection.kind === "mdcArmor") {
+      combatFailure(
+        "unsupportedMdcProtection",
+        "M.D.C. protection requires the full M.D.C. combat follow-up.",
+      );
+    }
+
+    const defenseOptions = deriveDefenseOptions(defenderSheet, attack, context);
+    const attackerStateToken = attackerCombatStateToken(attackerSheet, args.weaponIndex);
+    const defenderStateToken = defenderCombatStateToken(defenderSheet);
+
+    const strikeModifier = context.strikeModifier ?? 0;
+    const strikeRoll = rollD20(attack.strikeBonus + strikeModifier, attack.minimumStrikeTotal);
+    const declaration = evaluateDeclaration(strikeRoll, attack.minimumStrikeTotal);
+    const { supported: _supported, weapon, ...attackSnapshot } = attack;
+    const base = {
+      attackerId: args.attackerId,
+      defenderId: args.defenderId,
+      attackerName: attackerSheet.name,
+      defenderName: defenderSheet.name,
+      weapon,
+      attack: attackSnapshot,
+      context,
+      attackerStateToken,
+      defenderStateToken,
+      strikeRoll,
+    };
+    const exchangeId = await ctx.db.insert(
+      "combatExchanges",
+      declaration.status === "miss"
+        ? {
+            ...base,
+            status: "resolved" as const,
+            resolution: {
+              outcome: "miss" as const,
+              reason: declaration.reason,
+              critical: false as const,
+              damageMultiplier: 1 as const,
+            },
+          }
+        : { ...base, status: "pendingDefense" as const, defenseOptions },
+    );
+    return (await ctx.db.get(exchangeId))!;
+  },
+});
+
+export const respondToAttack = mutation({
+  args: {
+    exchangeId: v.id("combatExchanges"),
+    response: combatResponseInputValidator,
+  },
+  handler: async (ctx, args) => {
+    const stored = await ctx.db.get(args.exchangeId);
+    if (stored === null) {
+      combatFailure("exchangeNotPending", "The combat exchange no longer exists.");
+    }
+    const pending = pendingBase(stored);
+
+    let attacker: Character;
+    let defender: Character;
+    try {
+      [attacker, defender] = await Promise.all([
+        loadCharacter(ctx, stored.attackerId),
+        loadCharacter(ctx, stored.defenderId),
+      ]);
+    } catch {
+      combatFailure("characterMissing", "The attacker or defender no longer exists.");
+    }
+
+    const attackerSheet = deriveSheet(attacker);
+    const defenderSheet = deriveSheet(defender);
+    const tokensMatch =
+      attackerCombatStateToken(attackerSheet, stored.weapon.index) === stored.attackerStateToken &&
+      defenderCombatStateToken(defenderSheet) === stored.defenderStateToken;
+    if (!tokensMatch) {
+      return finalizeStale(ctx, pending);
+    }
+
+    const attack = deriveAttackProfile(attackerSheet, stored.weapon.index);
+    if (!attack.supported) {
+      return finalizeStale(ctx, pending);
+    }
+    if (
+      !weaponSnapshotsMatch(attack.weapon, stored.weapon) ||
+      !attackSnapshotsMatch(attack, stored.attack)
+    ) {
+      return finalizeStale(ctx, pending);
+    }
+    let context: CombatContext;
+    try {
+      context = validateCombatContext(attack, stored.context);
+    } catch {
+      return finalizeStale(ctx, pending);
+    }
+    const protection = deriveProtection(defenderSheet);
+    if (protection.kind === "mdcArmor") {
+      return finalizeStale(ctx, pending);
+    }
+    let options: DefenseOption[];
+    try {
+      options = deriveDefenseOptions(defenderSheet, attack, context);
+    } catch {
+      return finalizeStale(ctx, pending);
+    }
+    if (!defenseOptionSnapshotsMatch(options, pending.defenseOptions)) {
+      return finalizeStale(ctx, pending);
+    }
+    const responseInput = parseResponse(args.response);
+    let response: AuthorizedCombatResponse;
+    try {
+      response = authorizeCombatResponse(options, responseInput);
+    } catch {
+      combatFailure("illegalDefense", "That defense is not legal for this exchange.");
+    }
+
+    const defenseRoll =
+      response.kind === "none" ? undefined : rollD20(response.totalBonus, stored.strikeRoll.total);
+    const opposed = resolveStrike({
+      strike: stored.strikeRoll,
+      ...(defenseRoll === undefined
+        ? {}
+        : { defense: { kind: response.kind as DefenseKind, roll: defenseRoll } }),
+      allowedDefenses: defenseRoll === undefined ? [] : [response.kind as DefenseKind],
+      damageType: "sdc",
+      criticalOn: attack.criticalOn,
+    });
+    const damageRoll =
+      opposed.outcome === "hit" ? rollDamage(attack.damageFormula, attack.damageBonus) : undefined;
+    const resolution = resolveCombatExchange({
+      attack,
+      context,
+      strikeRoll: stored.strikeRoll,
+      response,
+      ...(defenseRoll === undefined ? {} : { defenseRoll }),
+      ...(damageRoll === undefined ? {} : { damageRoll }),
+      protection,
+      body: {
+        sdc: defenderSheet.vitals.sdc.current!,
+        hitPoints: defenderSheet.vitals.hitPoints.current!,
+      },
+      comaDeathFloor: defenderSheet.vitals.comaDeathFloor,
+    });
+
+    if (resolution.outcome === "hit") {
+      const current =
+        resolution.route.kind === "armor"
+          ? { ...defender.current, armor: resolution.route.armor.after }
+          : {
+              ...defender.current,
+              sdc: resolution.route.body.after.sdc,
+              hitPoints: resolution.route.body.after.hitPoints,
+            };
+      await patchCurrent(ctx, stored.defenderId, defender, current);
+    }
+    await ctx.db.replace(pending.id, { ...pending.base, status: "resolved", resolution });
+    return (await ctx.db.get(pending.id))!;
+  },
+});
+
+export const cancelAttack = mutation({
+  args: { exchangeId: v.id("combatExchanges") },
+  handler: async (ctx, { exchangeId }) => {
+    const stored = await ctx.db.get(exchangeId);
+    if (stored === null) {
+      combatFailure("exchangeNotPending", "The combat exchange no longer exists.");
+    }
+    const pending = pendingBase(stored);
+    // Accounts/roles are not modeled yet; do not pretend an actor ID is authorization.
+    await ctx.db.replace(pending.id, {
+      ...pending.base,
+      status: "cancelled",
+      cancelledAt: Date.now(),
+    });
+    return (await ctx.db.get(pending.id))!;
+  },
+});
+
+export const targets = query({
+  args: { attackerId: v.id("characters") },
+  handler: async (ctx, { attackerId }) => {
+    if ((await ctx.db.get(attackerId)) === null) {
+      combatFailure("characterMissing", "The character no longer exists.");
+    }
+    const docs = await ctx.db.query("characters").order("desc").take(TARGET_LIMIT);
+    return docs
+      .filter((doc) => doc._id !== attackerId)
+      .map((doc) => {
+        const sheet = deriveSheet(doc);
+        const ready =
+          sheet.vitals.sdc.rolled !== undefined && sheet.vitals.hitPoints.rolled !== undefined;
+        const protection = deriveProtection(sheet);
+        return {
+          id: doc._id,
+          name: sheet.name,
+          ready,
+          protection: protection.kind,
+          ...(ready
+            ? protection.kind === "mdcArmor"
+              ? { disabledReason: "unsupportedMdcProtection" as const }
+              : {}
+            : { disabledReason: "defenderNotReady" as const }),
+        };
+      });
+  },
+});
+
+export const incoming = query({
+  args: { defenderId: v.id("characters") },
+  handler: async (ctx, { defenderId }) => {
+    if ((await ctx.db.get(defenderId)) === null) {
+      combatFailure("characterMissing", "The character no longer exists.");
+    }
+    return ctx.db
+      .query("combatExchanges")
+      .withIndex("by_defender_and_status", (q) =>
+        q.eq("defenderId", defenderId).eq("status", "pendingDefense"),
+      )
+      .order("desc")
+      .take(FEED_LIMIT);
+  },
+});
+
+export const outgoing = query({
+  args: { attackerId: v.id("characters") },
+  handler: async (ctx, { attackerId }) => {
+    if ((await ctx.db.get(attackerId)) === null) {
+      combatFailure("characterMissing", "The character no longer exists.");
+    }
+    return ctx.db
+      .query("combatExchanges")
+      .withIndex("by_attacker_and_status", (q) =>
+        q.eq("attackerId", attackerId).eq("status", "pendingDefense"),
+      )
+      .order("desc")
+      .take(FEED_LIMIT);
+  },
+});
+
+export const recent = query({
+  args: { characterId: v.id("characters") },
+  handler: async (ctx, { characterId }) => {
+    if ((await ctx.db.get(characterId)) === null) {
+      combatFailure("characterMissing", "The character no longer exists.");
+    }
+    const [attacks, defenses] = await Promise.all([
+      ctx.db
+        .query("combatExchanges")
+        .withIndex("by_attacker", (q) => q.eq("attackerId", characterId))
+        .order("desc")
+        .take(FEED_LIMIT),
+      ctx.db
+        .query("combatExchanges")
+        .withIndex("by_defender", (q) => q.eq("defenderId", characterId))
+        .order("desc")
+        .take(FEED_LIMIT),
+    ]);
+    return [...new Map([...attacks, ...defenses].map((doc) => [doc._id, doc])).values()]
+      .sort((a, b) => b._creationTime - a._creationTime)
+      .slice(0, FEED_LIMIT);
+  },
+});
diff --git a/packages/backend/convex/combat_values.ts b/packages/backend/convex/combat_values.ts
new file mode 100644
index 0000000..45ccea8
--- /dev/null
+++ b/packages/backend/convex/combat_values.ts
@@ -0,0 +1,173 @@
+import { v } from "convex/values";
+
+export const d20RollValidator = v.object({
+  die: v.number(),
+  bonus: v.number(),
+  total: v.number(),
+  target: v.optional(v.number()),
+  success: v.optional(v.boolean()),
+  naturalTwenty: v.boolean(),
+  naturalOne: v.boolean(),
+});
+
+export const damageRollValidator = v.object({
+  dice: v.array(v.number()),
+  total: v.number(),
+  bonus: v.number(),
+});
+
+export const combatContextValidator = v.union(
+  v.object({
+    kind: v.literal("melee"),
+    defenderAware: v.boolean(),
+    parryMode: v.union(v.literal("unavailable"), v.literal("standard"), v.literal("bareHanded")),
+    strikeModifier: v.optional(v.number()),
+    strikeModifierReason: v.optional(v.string()),
+  }),
+  v.object({
+    kind: v.literal("ranged"),
+    defenderAware: v.boolean(),
+    rangeBand: v.union(v.literal("pointBlank"), v.literal("close"), v.literal("normal")),
+    strikeModifier: v.optional(v.number()),
+    strikeModifierReason: v.optional(v.string()),
+  }),
+);
+
+export const combatResponseInputValidator = v.object({
+  kind: v.union(v.literal("parry"), v.literal("dodge"), v.literal("autoDodge"), v.literal("none")),
+  defenseModifier: v.optional(v.number()),
+  defenseModifierReason: v.optional(v.string()),
+});
+
+export const defenseOptionValidator = v.object({
+  kind: v.union(v.literal("parry"), v.literal("dodge"), v.literal("autoDodge"), v.literal("none")),
+  bonus: v.number(),
+  actionCost: v.union(v.literal(0), v.literal(1)),
+  explanation: v.string(),
+});
+
+const authorizedResponseValidator = v.object({
+  kind: v.union(v.literal("parry"), v.literal("dodge"), v.literal("autoDodge"), v.literal("none")),
+  bonus: v.number(),
+  actionCost: v.union(v.literal(0), v.literal(1)),
+  explanation: v.string(),
+  defenseModifier: v.number(),
+  defenseModifierReason: v.optional(v.string()),
+  totalBonus: v.number(),
+});
+
+const weaponCategoryValidator = v.union(
+  v.literal("knife"),
+  v.literal("axe"),
+  v.literal("handgun"),
+  v.literal("submachineGun"),
+  v.literal("energyPistol"),
+  v.literal("energyRifle"),
+);
+
+const modifierSourceValidator = v.object({
+  source: v.union(v.literal("attribute"), v.literal("handToHand"), v.literal("proficiency")),
+  label: v.string(),
+  value: v.number(),
+});
+
+const exchangeBase = {
+  attackerId: v.id("characters"),
+  defenderId: v.id("characters"),
+  attackerName: v.string(),
+  defenderName: v.string(),
+  weapon: v.object({
+    index: v.number(),
+    itemId: v.string(),
+    name: v.string(),
+    category: weaponCategoryValidator,
+    worn: v.optional(v.boolean()),
+    rolledMdc: v.optional(v.number()),
+  }),
+  attack: v.object({
+    kind: v.union(v.literal("melee"), v.literal("ranged")),
+    minimumStrikeTotal: v.number(),
+    strikeBonus: v.number(),
+    strikeBonusSources: v.array(modifierSourceValidator),
+    proficiencyBonus: v.number(),
+    damageFormula: v.string(),
+    damageBonus: v.number(),
+    criticalOn: v.number(),
+    damageType: v.literal("sdc"),
+  }),
+  context: combatContextValidator,
+  attackerStateToken: v.string(),
+  defenderStateToken: v.string(),
+  strikeRoll: d20RollValidator,
+};
+
+const routeValidator = v.union(
+  v.object({
+    kind: v.literal("armor"),
+    armor: v.object({ before: v.number(), after: v.number() }),
+    body: v.object({
+      before: v.object({ sdc: v.number(), hitPoints: v.number() }),
+      after: v.object({ sdc: v.number(), hitPoints: v.number() }),
+    }),
+  }),
+  v.object({
+    kind: v.literal("body"),
+    armor: v.optional(v.object({ before: v.number(), after: v.number() })),
+    body: v.object({
+      before: v.object({ sdc: v.number(), hitPoints: v.number() }),
+      after: v.object({ sdc: v.number(), hitPoints: v.number() }),
+    }),
+  }),
+);
+
+export const resolvedResultValidator = v.union(
+  v.object({
+    outcome: v.literal("miss"),
+    reason: v.union(v.literal("naturalOne"), v.literal("belowMinimum")),
+    critical: v.literal(false),
+    damageMultiplier: v.literal(1),
+  }),
+  v.object({
+    outcome: v.literal("defended"),
+    reason: v.union(v.literal("parried"), v.literal("dodged")),
+    response: authorizedResponseValidator,
+    defenseRoll: d20RollValidator,
+    critical: v.literal(false),
+    damageMultiplier: v.literal(1),
+  }),
+  v.object({
+    outcome: v.literal("hit"),
+    reason: v.union(v.literal("unopposed"), v.literal("strikeWon")),
+    response: authorizedResponseValidator,
+    defenseRoll: v.optional(d20RollValidator),
+    critical: v.boolean(),
+    damageMultiplier: v.union(v.literal(1), v.literal(2)),
+    damageRoll: damageRollValidator,
+    totalDamage: v.number(),
+    route: routeValidator,
+  }),
+);
+
+export const combatExchangeValidator = v.union(
+  v.object({
+    ...exchangeBase,
+    status: v.literal("pendingDefense"),
+    defenseOptions: v.array(defenseOptionValidator),
+  }),
+  v.object({
+    ...exchangeBase,
+    status: v.literal("resolved"),
+    resolution: resolvedResultValidator,
+  }),
+  v.object({
+    ...exchangeBase,
+    status: v.literal("cancelled"),
+    cancelledAt: v.number(),
+  }),
+  v.object({
+    ...exchangeBase,
+    status: v.literal("stale"),
+    staleAt: v.number(),
+    reason: v.literal("combatStateChanged"),
+  }),
+);
diff --git a/packages/backend/convex/schema.ts b/packages/backend/convex/schema.ts
index fcd5356..8940618 100644
--- a/packages/backend/convex/schema.ts
+++ b/packages/backend/convex/schema.ts
@@ -1,5 +1,6 @@
 import { defineSchema, defineTable } from "convex/server";
 import { v } from "convex/values";
+import { combatExchangeValidator } from "./combat_values";
 
 /**
  * Convex validators mirroring `characterSchema` from @riftforge/rules.
@@ -90,4 +91,9 @@ export const characterFields = {
 
 export default defineSchema({
   characters: defineTable(characterFields),
+  combatExchanges: defineTable(combatExchangeValidator)
+    .index("by_defender_and_status", ["defenderId", "status"])
+    .index("by_attacker_and_status", ["attackerId", "status"])
+    .index("by_defender", ["defenderId"])
+    .index("by_attacker", ["attackerId"]),
 });
diff --git a/packages/backend/tests/characters.test.ts b/packages/backend/tests/characters.test.ts
index dfe2fe8..7556886 100644
--- a/packages/backend/tests/characters.test.ts
+++ b/packages/backend/tests/characters.test.ts
@@ -629,10 +629,26 @@ describe("living vitals — current vs. max (#38)", () => {
     await expect(t.mutation(api.characters.equipArmor, { id, index: 1 })).rejects.toThrow(
       /expected item snapshot/,
     );
-    // Nothing was written by the refused calls.
+    // A real manifest shift can leave the stale index valid but occupied by a
+    // different instance: removing slot 0 shifts the Gladiator to 0, then the
+    // pistol takes its old slot 1. The stale Gladiator click must not remove it.
+    await t.mutation(api.characters.removeItem, {
+      id,
+      index: 0,
+      expect: { itemId: "canteen" },
+    });
+    await t.mutation(api.characters.addItem, { id, itemId: "wilks-320-laser-pistol" });
+    await expect(
+      t.mutation(api.characters.removeItem, {
+        id,
+        index: 1,
+        expect: { itemId: "gladiator" },
+      }),
+    ).rejects.toThrow(/manifest changed/);
+    // Nothing was written by the refused stale click.
     expect((await t.query(api.characters.get, { id }))?.items).toEqual([
-      { itemId: "canteen" },
       { itemId: "gladiator" },
+      { itemId: "wilks-320-laser-pistol" },
     ]);
   });
 
diff --git a/packages/backend/tests/combat.test.ts b/packages/backend/tests/combat.test.ts
new file mode 100644
index 0000000..cce4b5c
--- /dev/null
+++ b/packages/backend/tests/combat.test.ts
@@ -0,0 +1,1380 @@
+import {
+  attackerCombatStateToken,
+  defenderCombatStateToken,
+  deriveSheet,
+  type Character,
+  type CombatExchangeErrorCode,
+} from "@riftforge/rules";
+import { convexTest } from "convex-test";
+import { describe, expect, test, vi } from "vite-plus/test";
+import { api } from "../convex/_generated/api";
+import type { Id } from "../convex/_generated/dataModel";
+import schema from "../convex/schema";
+
+const modules = {
+  ...import.meta.glob("../convex/*.ts"),
+  ...import.meta.glob("../convex/_generated/*.js"),
+};
+
+const character: Character = {
+  name: "Vesper",
+  occId: "ley-line-walker",
+  level: 1,
+  attributes: { IQ: 18, ME: 16, MA: 12, PS: 16, PP: 20, PE: 14, PB: 11, Spd: 12 },
+  hthType: "basic",
+  psychicClass: "ordinary" as const,
+  skills: [],
+  spellIds: [],
+  items: [],
+};
+
+const ready = { hitPoints: 18, sdc: 20 };
+const meleeContext = {
+  kind: "melee" as const,
+  defenderAware: true,
+  parryMode: "standard" as const,
+};
+
+function testDb() {
+  return convexTest(schema, modules);
+}
+
+type TestDb = ReturnType<typeof testDb>;
+
+async function createCharacter(t: TestDb, overrides: Partial<Character> = {}) {
+  return t.mutation(api.characters.create, { ...character, ...overrides });
+}
+
+async function exchangeCount(t: TestDb): Promise<number> {
+  return t.run(async (ctx) => (await ctx.db.query("combatExchanges").collect()).length);
+}
+
+async function getCharacter(t: TestDb, id: Id<"characters">) {
+  return t.run((ctx) => ctx.db.get(id));
+}
+
+async function declarePending(
+  t: TestDb,
+  attackerId: Id<"characters">,
+  defenderId: Id<"characters">,
+  context: {
+    kind: "melee";
+    defenderAware: boolean;
+    parryMode: "unavailable" | "standard" | "bareHanded";
+  } = meleeContext,
+) {
+  for (let attempt = 0; attempt < 40; attempt += 1) {
+    const exchange = await t.mutation(api.combat.declareAttack, {
+      attackerId,
+      defenderId,
+      weaponIndex: 0,
+      expect: { itemId: "survival-knife" },
+      context: {
+        ...context,
+        strikeModifier: 100,
+        strikeModifierReason: "Guaranteed test declaration",
+      },
+    });
+    if (exchange.status === "pendingDefense") return exchange;
+  }
+  throw new Error("Could not obtain a pending combat declaration.");
+}
+
+async function expectCombatFailure(
+  promise: Promise<unknown>,
+  code: CombatExchangeErrorCode,
+  message: string,
+): Promise<void> {
+  const error = await promise.then(
+    () => undefined,
+    (reason: unknown) => reason,
+  );
+  expect(error).toMatchObject({ name: "ConvexError" });
+  const rawData = (error as { data: unknown }).data;
+  const data = typeof rawData === "string" ? JSON.parse(rawData) : rawData;
+  expect(data).toEqual({ code, message });
+}
+
+async function combatFailureData(promise: Promise<unknown>) {
+  const error = await promise.then(
+    () => undefined,
+    (reason: unknown) => reason,
+  );
+  expect(error).toMatchObject({ name: "ConvexError" });
+  const rawData = (error as { data: unknown }).data;
+  return (typeof rawData === "string" ? JSON.parse(rawData) : rawData) as {
+    code: CombatExchangeErrorCode;
+    message: string;
+  };
+}
+
+function exchangeBase(attackerId: Id<"characters">, defenderId: Id<"characters">, serial: number) {
+  return {
+    attackerId,
+    defenderId,
+    attackerName: `Attacker ${serial}`,
+    defenderName: `Defender ${serial}`,
+    weapon: {
+      index: 0,
+      itemId: "survival-knife",
+      name: "Survival Knife",
+      category: "knife" as const,
+    },
+    attack: {
+      kind: "melee" as const,
+      minimumStrikeTotal: 5,
+      strikeBonus: 3,
+      strikeBonusSources: [{ source: "attribute" as const, label: "P.P.", value: 3 }],
+      proficiencyBonus: 0,
+      damageFormula: "1D6",
+      damageBonus: 1,
+      criticalOn: 20,
+      damageType: "sdc" as const,
+    },
+    context: {
+      kind: "melee" as const,
+      defenderAware: true,
+      parryMode: "standard" as const,
+    },
+    attackerStateToken: `attacker-${serial}`,
+    defenderStateToken: `defender-${serial}`,
+    strikeRoll: {
+      die: 10,
+      bonus: 3,
+      total: 13,
+      naturalTwenty: false,
+      naturalOne: false,
+    },
+  };
+}
+
+describe("combat target selector", () => {
+  test("excludes self, stays bounded, and safely classifies readiness and protection", async () => {
+    const t = convexTest(schema, modules);
+
+    for (let index = 0; index < 52; index += 1) {
+      await t.mutation(api.characters.create, {
+        ...character,
+        name: `Filler ${index}`,
+        rolled: { hitPoints: 18, sdc: 20 },
+      });
+    }
+    const unreadyId = await t.mutation(api.characters.create, {
+      ...character,
+      name: "Unready",
+    });
+    const armoredId = await t.mutation(api.characters.create, {
+      ...character,
+      name: "Armored",
+      rolled: { hitPoints: 18, sdc: 20 },
+      items: [{ itemId: "gladiator", worn: true }],
+    });
+    const depletedId = await t.mutation(api.characters.create, {
+      ...character,
+      name: "Depleted",
+      rolled: { hitPoints: 18, sdc: 20 },
+      items: [{ itemId: "gladiator", worn: true }],
+      current: { armor: 0 },
+    });
+    const attackerId = await t.mutation(api.characters.create, {
+      ...character,
+      name: "Attacker",
+      rolled: { hitPoints: 18, sdc: 20 },
+    });
+
+    const targets = await t.query(api.combat.targets, { attackerId });
+
+    expect(targets).toHaveLength(49);
+    expect(targets).not.toContainEqual(expect.objectContaining({ id: attackerId }));
+    expect(targets).toContainEqual({
+      id: unreadyId,
+      name: "Unready",
+      ready: false,
+      protection: "none",
+      disabledReason: "defenderNotReady",
+    });
+    expect(targets).toContainEqual({
+      id: armoredId,
+      name: "Armored",
+      ready: true,
+      protection: "mdcArmor",
+      disabledReason: "unsupportedMdcProtection",
+    });
+    expect(targets).toContainEqual({
+      id: depletedId,
+      name: "Depleted",
+      ready: true,
+      protection: "none",
+    });
+  });
+});
+
+describe("combat exchange feeds", () => {
+  test("start empty", async () => {
+    const t = convexTest(schema, modules);
+    const characterId = await t.mutation(api.characters.create, character);
+
+    expect(await t.query(api.combat.incoming, { defenderId: characterId })).toEqual([]);
+    expect(await t.query(api.combat.outgoing, { attackerId: characterId })).toEqual([]);
+    expect(await t.query(api.combat.recent, { characterId })).toEqual([]);
+  });
+
+  test("return at most 20 newest pending or recent exchanges without duplicates", async () => {
+    const t = convexTest(schema, modules);
+    const characterId = await t.mutation(api.characters.create, character);
+
+    await t.run(async (ctx) => {
+      for (let index = 0; index < 25; index += 1) {
+        await ctx.db.insert("combatExchanges", {
+          ...exchangeBase(characterId, characterId, index),
+          status: "pendingDefense",
+          defenseOptions: [{ kind: "none", bonus: 0, actionCost: 0, explanation: "No defense." }],
+        });
+      }
+      await ctx.db.insert("combatExchanges", {
+        ...exchangeBase(characterId, characterId, 25),
+        status: "cancelled",
+        cancelledAt: Date.now(),
+      });
+    });
+
+    const incoming = await t.query(api.combat.incoming, { defenderId: characterId });
+    const outgoing = await t.query(api.combat.outgoing, { attackerId: characterId });
+    const recent = await t.query(api.combat.recent, { characterId });
+
+    expect(incoming).toHaveLength(20);
+    expect(outgoing).toHaveLength(20);
+    expect(incoming.every((exchange) => exchange.status === "pendingDefense")).toBe(true);
+    expect(outgoing.every((exchange) => exchange.status === "pendingDefense")).toBe(true);
+    expect(recent).toHaveLength(20);
+    expect(new Set(recent.map((exchange) => exchange._id)).size).toBe(20);
+    expect(recent[0]?.status).toBe("cancelled");
+    expect(recent.map((exchange) => exchange._creationTime)).toEqual(
+      recent.map((exchange) => exchange._creationTime).toSorted((a, b) => b - a),
+    );
+  });
+});
+
+describe("combat attack declaration", () => {
+  test("rejects self-targeting with stable error data and inserts nothing", async () => {
+    const t = testDb();
+    const attackerId = await createCharacter(t, {
+      rolled: ready,
+      items: [{ itemId: "survival-knife" }],
+    });
+
+    await expectCombatFailure(
+      t.mutation(api.combat.declareAttack, {
+        attackerId,
+        defenderId: attackerId,
+        weaponIndex: 0,
+        expect: { itemId: "survival-knife" },
+        context: meleeContext,
+      }),
+      "selfTarget",
+      "A character cannot target itself with a hostile exchange.",
+    );
+    expect(await exchangeCount(t)).toBe(0);
+  });
+
+  test("requires both attacker and defender to have rolled Hit Points and S.D.C.", async () => {
+    const t = testDb();
+    const unreadyAttackerId = await createCharacter(t, {
+      name: "Unready attacker",
+      items: [{ itemId: "survival-knife" }],
+    });
+    const readyDefenderId = await createCharacter(t, {
+      name: "Ready defender",
+      rolled: ready,
+    });
+
+    await expectCombatFailure(
+      t.mutation(api.combat.declareAttack, {
+        attackerId: unreadyAttackerId,
+        defenderId: readyDefenderId,
+        weaponIndex: 0,
+        expect: { itemId: "survival-knife" },
+        context: meleeContext,
+      }),
+      "attackerNotReady",
+      "Roll both S.D.C. and Hit Points before entering combat.",
+    );
+
+    const readyAttackerId = await createCharacter(t, {
+      name: "Ready attacker",
+      rolled: ready,
+      items: [{ itemId: "survival-knife" }],
+    });
+    const unreadyDefenderId = await createCharacter(t, { name: "Unready defender" });
+    await expectCombatFailure(
+      t.mutation(api.combat.declareAttack, {
+        attackerId: readyAttackerId,
+        defenderId: unreadyDefenderId,
+        weaponIndex: 0,
+        expect: { itemId: "survival-knife" },
+        context: meleeContext,
+      }),
+      "defenderNotReady",
+      "Roll both S.D.C. and Hit Points before entering combat.",
+    );
+    expect(await exchangeCount(t)).toBe(0);
+  });
+
+  test("requires the indexed weapon instance to match the expected manifest entry", async () => {
+    const t = testDb();
+    const attackerId = await createCharacter(t, {
+      rolled: ready,
+      items: [{ itemId: "survival-knife" }],
+    });
+    const defenderId = await createCharacter(t, { rolled: ready });
+
+    await expectCombatFailure(
+      t.mutation(api.combat.declareAttack, {
+        attackerId,
+        defenderId,
+        weaponIndex: 0,
+        expect: { itemId: "hand-axe" },
+        context: meleeContext,
+      }),
+      "weaponMissingOrChanged",
+      "The selected weapon instance changed.",
+    );
+    expect(await exchangeCount(t)).toBe(0);
+  });
+
+  test("refuses nonweapons as unsupported weapon modes without inserting", async () => {
+    const t = testDb();
+    const attackerId = await createCharacter(t, {
+      rolled: ready,
+      items: [{ itemId: "canteen" }],
+    });
+    const defenderId = await createCharacter(t, { rolled: ready });
+
+    await expectCombatFailure(
+      t.mutation(api.combat.declareAttack, {
+        attackerId,
+        defenderId,
+        weaponIndex: 0,
+        expect: { itemId: "canteen" },
+        context: meleeContext,
+      }),
+      "unsupportedWeaponMode",
+      "The selected item is not a supported weapon mode.",
+    );
+    expect(await exchangeCount(t)).toBe(0);
+  });
+
+  test("refuses M.D. weapons before any exchange is inserted", async () => {
+    const t = testDb();
+    const attackerId = await createCharacter(t, {
+      rolled: ready,
+      items: [{ itemId: "wilks-320-laser-pistol" }],
+    });
+    const defenderId = await createCharacter(t, { rolled: ready });
+    const random = vi.spyOn(Math, "random");
+
+    await expectCombatFailure(
+      t.mutation(api.combat.declareAttack, {
+        attackerId,
+        defenderId,
+        weaponIndex: 0,
+        expect: { itemId: "wilks-320-laser-pistol" },
+        context: {
+          kind: "ranged",
+          defenderAware: true,
+          rangeBand: "normal",
+        },
+      }),
+      "unsupportedMdWeapon",
+      "M.D. weapons require the full M.D.C. combat follow-up.",
+    );
+    expect(random).not.toHaveBeenCalled();
+    random.mockRestore();
+    expect(await exchangeCount(t)).toBe(0);
+  });
+
+  test("refuses nondepleted M.D.C. protection before any exchange is inserted", async () => {
+    const t = testDb();
+    const attackerId = await createCharacter(t, {
+      rolled: ready,
+      items: [{ itemId: "survival-knife" }],
+    });
+    const defenderId = await createCharacter(t, {
+      rolled: ready,
+      items: [{ itemId: "gladiator", worn: true }],
+    });
+    const random = vi.spyOn(Math, "random");
+
+    await expectCombatFailure(
+      t.mutation(api.combat.declareAttack, {
+        attackerId,
+        defenderId,
+        weaponIndex: 0,
+        expect: { itemId: "survival-knife" },
+        context: meleeContext,
+      }),
+      "unsupportedMdcProtection",
+      "M.D.C. protection requires the full M.D.C. combat follow-up.",
+    );
+    expect(random).not.toHaveBeenCalled();
+    random.mockRestore();
+    expect(await exchangeCount(t)).toBe(0);
+  });
+
+  test("maps context kind mismatches and invalid modifiers to stable errors without inserting", async () => {
+    const t = testDb();
+    const attackerId = await createCharacter(t, {
+      rolled: ready,
+      items: [{ itemId: "survival-knife" }],
+    });
+    const defenderId = await createCharacter(t, { rolled: ready });
+
+    await expectCombatFailure(
+      t.mutation(api.combat.declareAttack, {
+        attackerId,
+        defenderId,
+        weaponIndex: 0,
+        expect: { itemId: "survival-knife" },
+        context: {
+          kind: "ranged",
+          defenderAware: true,
+          rangeBand: "normal",
+        },
+      }),
+      "invalidContext",
+      "The declared context does not match the weapon mode.",
+    );
+    await expectCombatFailure(
+      t.mutation(api.combat.declareAttack, {
+        attackerId,
+        defenderId,
+        weaponIndex: 0,
+        expect: { itemId: "survival-knife" },
+        context: {
+          ...meleeContext,
+          strikeModifier: 101,
+          strikeModifierReason: "Outside the allowed range",
+        },
+      }),
+      "invalidContext",
+      "The declared combat context is invalid.",
+    );
+    await expectCombatFailure(
+      t.mutation(api.combat.declareAttack, {
+        attackerId,
+        defenderId,
+        weaponIndex: 0,
+        expect: { itemId: "survival-knife" },
+        context: { ...meleeContext, strikeModifier: 1 },
+      }),
+      "modifierReasonRequired",
+      "A reason is required for a nonzero strike modifier.",
+    );
+    expect(await exchangeCount(t)).toBe(0);
+  });
+
+  test("persists an immediate resolved miss from a server-owned roll", async () => {
+    const t = testDb();
+    const attackerId = await createCharacter(t, {
+      name: "Attacker",
+      rolled: ready,
+      items: [{ itemId: "survival-knife" }],
+    });
+    const defenderId = await createCharacter(t, { name: "Defender", rolled: ready });
+
+    const exchange = await t.mutation(api.combat.declareAttack, {
+      attackerId,
+      defenderId,
+      weaponIndex: 0,
+      expect: { itemId: "survival-knife" },
+      context: {
+        ...meleeContext,
+        strikeModifier: -100,
+        strikeModifierReason: "Guaranteed test miss",
+      },
+    });
+
+    expect(exchange.status).toBe("resolved");
+    if (exchange.status !== "resolved") throw new Error("Expected a resolved declaration.");
+    expect(exchange.resolution).toEqual({
+      outcome: "miss",
+      reason: exchange.strikeRoll.die === 1 ? "naturalOne" : "belowMinimum",
+      critical: false,
+      damageMultiplier: 1,
+    });
+    expect(exchange.strikeRoll.die).toBeGreaterThanOrEqual(1);
+    expect(exchange.strikeRoll.die).toBeLessThanOrEqual(20);
+    expect(Number.isInteger(exchange.strikeRoll.die)).toBe(true);
+    expect(exchange.strikeRoll).toMatchObject({
+      bonus: -97,
+      total: exchange.strikeRoll.die - 97,
+      target: 5,
+      success: false,
+      naturalTwenty: exchange.strikeRoll.die === 20,
+      naturalOne: exchange.strikeRoll.die === 1,
+    });
+    expect(await t.run((ctx) => ctx.db.get(exchange._id))).toEqual(exchange);
+  });
+
+  test("persists a pending declaration with exact snapshots, tokens, and explicit no-defense", async () => {
+    const t = testDb();
+    const attacker: Character = {
+      ...character,
+      name: "Attacker",
+      rolled: ready,
+      items: [{ itemId: "survival-knife" }],
+    };
+    const defender: Character = { ...character, name: "Defender", rolled: ready };
+    const attackerId = await createCharacter(t, attacker);
+    const defenderId = await createCharacter(t, defender);
+    const context = {
+      ...meleeContext,
+      strikeModifier: 100,
+      strikeModifierReason: "Guaranteed test declaration",
+    };
+
+    const exchange = await declarePending(t, attackerId, defenderId);
+
+    const { _id, _creationTime, strikeRoll, ...snapshot } = exchange;
+    expect(_id).toBeTruthy();
+    expect(_creationTime).toBeGreaterThan(0);
+    expect(snapshot).toEqual({
+      attackerId,
+      defenderId,
+      attackerName: "Attacker",
+      defenderName: "Defender",
+      weapon: {
+        index: 0,
+        itemId: "survival-knife",
+        name: "Survival Knife",
+        category: "knife",
+      },
+      attack: {
+        kind: "melee",
+        minimumStrikeTotal: 5,
+        strikeBonus: 3,
+        strikeBonusSources: [
+          { source: "attribute", label: "P.P.", value: 3 },
+          { source: "handToHand", label: "Hand-to-Hand", value: 0 },
+        ],
+        proficiencyBonus: 0,
+        damageFormula: "1D6",
+        damageBonus: 1,
+        criticalOn: 20,
+        damageType: "sdc",
+      },
+      context,
+      attackerStateToken: attackerCombatStateToken(deriveSheet(attacker), 0),
+      defenderStateToken: defenderCombatStateToken(deriveSheet(defender)),
+      status: "pendingDefense",
+      defenseOptions: [
+        { kind: "parry", bonus: 3, actionCost: 0, explanation: "Parry the melee weapon." },
+        {
+          kind: "dodge",
+          bonus: 3,
+          actionCost: 1,
+          explanation: "Dodge; costs one action for table tracking.",
+        },
+        { kind: "none", bonus: 0, actionCost: 0, explanation: "Take the hit." },
+      ],
+    });
+    expect(strikeRoll.die).toBeGreaterThanOrEqual(1);
+    expect(strikeRoll.die).toBeLessThanOrEqual(20);
+    expect(Number.isInteger(strikeRoll.die)).toBe(true);
+    expect(strikeRoll).toEqual({
+      die: strikeRoll.die,
+      bonus: 103,
+      total: strikeRoll.die + 103,
+      target: 5,
+      success: true,
+      naturalTwenty: strikeRoll.die === 20,
+      naturalOne: strikeRoll.die === 1,
+    });
+  });
+
+  test("does not accept client-authored roll or result fields", async () => {
+    const t = testDb();
+    const attackerId = await createCharacter(t, {
+      rolled: ready,
+      items: [{ itemId: "survival-knife" }],
+    });
+    const defenderId = await createCharacter(t, { rolled: ready });
+
+    await expect(
+      t.mutation(api.combat.declareAttack, {
+        attackerId,
+        defenderId,
+        weaponIndex: 0,
+        expect: { itemId: "survival-knife" },
+        context: meleeContext,
+        // @ts-expect-error Client-authored rolls are intentionally absent from declareAttack args.
+        strikeRoll: {
+          die: 20,
+          bonus: 1000,
+          total: 1020,
+          target: 5,
+          success: true,
+          naturalTwenty: true,
+          naturalOne: false,
+        },
+      }),
+    ).rejects.toThrow(/strikeRoll|extra/i);
+    await expect(
+      t.mutation(api.combat.declareAttack, {
+        attackerId,
+        defenderId,
+        weaponIndex: 0,
+        expect: { itemId: "survival-knife" },
+        context: meleeContext,
+        // @ts-expect-error Client-authored results are intentionally absent from declareAttack args.
+        result: { status: "pendingDefense" },
+      }),
+    ).rejects.toThrow(/result|extra/i);
+    expect(await exchangeCount(t)).toBe(0);
+  });
+});
+
+describe("combat response and cancellation", () => {
+  test("take-the-hit rolls damage server-side and atomically records body pool changes", async () => {
+    const t = testDb();
+    const attackerId = await createCharacter(t, {
+      name: "Attacker",
+      rolled: ready,
+      items: [{ itemId: "survival-knife" }],
+    });
+    const defenderId = await createCharacter(t, {
+      name: "Defender",
+      rolled: ready,
+      current: { sdc: 1, hitPoints: 18 },
+    });
+    const pending = await declarePending(t, attackerId, defenderId);
+
+    const resolved = await t.mutation(api.combat.respondToAttack, {
+      exchangeId: pending._id,
+      response: { kind: "none" },
+    });
+
+    expect(resolved.status).toBe("resolved");
+    if (resolved.status !== "resolved" || resolved.resolution.outcome !== "hit") {
+      throw new Error("Expected an unopposed hit.");
+    }
+    expect(resolved.resolution).toMatchObject({
+      outcome: "hit",
+      reason: "unopposed",
+      response: { kind: "none", totalBonus: 0 },
+      damageRoll: { bonus: 1 },
+      route: {
+        kind: "body",
+        body: { before: { sdc: 1, hitPoints: 18 } },
+      },
+    });
+    expect(resolved.resolution.damageRoll.dice).toHaveLength(1);
+    expect(resolved.resolution.damageRoll.dice[0]).toBeGreaterThanOrEqual(1);
+    expect(resolved.resolution.damageRoll.dice[0]).toBeLessThanOrEqual(6);
+    expect(resolved.resolution.damageRoll.total).toBe(resolved.resolution.damageRoll.dice[0]! + 1);
+    expect(resolved.resolution.route.body.after.sdc).toBe(0);
+    expect(resolved.resolution.route.body.after.hitPoints).toBeLessThan(18);
+    expect((await getCharacter(t, defenderId))?.current).toMatchObject(
+      resolved.resolution.route.body.after,
+    );
+    expect(await t.run((ctx) => ctx.db.get(pending._id))).toEqual(resolved);
+    expect("defenseOptions" in resolved).toBe(false);
+  });
+
+  test("rejects a nonzero take-the-hit modifier before dice or writes", async () => {
+    const t = testDb();
+    const attackerId = await createCharacter(t, {
+      name: "Attacker",
+      rolled: ready,
+      items: [{ itemId: "survival-knife" }],
+    });
+    const defenderId = await createCharacter(t, { name: "Defender", rolled: ready });
+    const pending = await declarePending(t, attackerId, defenderId);
+    const defenderBefore = await getCharacter(t, defenderId);
+    const exchangeBefore = await t.run((ctx) => ctx.db.get(pending._id));
+    const random = vi.spyOn(Math, "random");
+
+    try {
+      await expectCombatFailure(
+        t.mutation(api.combat.respondToAttack, {
+          exchangeId: pending._id,
+          response: {
+            kind: "none",
+            defenseModifier: 1,
+            defenseModifierReason: "GM ruling",
+          },
+        }),
+        "illegalDefense",
+        "The combat response is invalid.",
+      );
+      expect(random).not.toHaveBeenCalled();
+    } finally {
+      random.mockRestore();
+    }
+
+    expect(await getCharacter(t, defenderId)).toEqual(defenderBefore);
+    expect(await t.run((ctx) => ctx.db.get(pending._id))).toEqual(exchangeBefore);
+  });
+
+  test("a server-rolled natural-20 defense changes no pools", async () => {
+    const random = vi.spyOn(Math, "random").mockReturnValue(0.999_999);
+    try {
+      const t = testDb();
+      const attackerId = await createCharacter(t, {
+        rolled: ready,
+        items: [{ itemId: "survival-knife" }],
+      });
+      const defenderId = await createCharacter(t, {
+        rolled: ready,
+        current: { sdc: 17, hitPoints: 16 },
+      });
+      const pending = await declarePending(t, attackerId, defenderId);
+      const before = await getCharacter(t, defenderId);
+
+      const resolved = await t.mutation(api.combat.respondToAttack, {
+        exchangeId: pending._id,
+        response: {
+          kind: "parry",
+          defenseModifier: 100,
+          defenseModifierReason: "Guaranteed test defense",
+        },
+      });
+
+      expect(resolved.status).toBe("resolved");
+      if (resolved.status !== "resolved") throw new Error("Expected a resolved exchange.");
+      expect(resolved.resolution).toMatchObject({
+        outcome: "defended",
+        reason: "parried",
+        response: { kind: "parry", defenseModifier: 100 },
+        defenseRoll: { die: 20, target: pending.strikeRoll.total, success: true },
+      });
+      expect(await getCharacter(t, defenderId)).toEqual(before);
+      expect("defenseOptions" in resolved).toBe(false);
+    } finally {
+      random.mockRestore();
+    }
+  });
+
+  test.each([
+    ["standard parry", "basic", 1, "standard", "parry", 3],
+    ["bare-handed parry", "basic", 1, "bareHanded", "parry", 0],
+    ["dodge", "basic", 1, "standard", "dodge", 3],
+    ["automatic dodge", "commando", 15, "standard", "autoDodge", 8],
+  ] as const)(
+    "authorizes %s only from freshly derived defense options",
+    async (_label, hthType, level, parryMode, kind, bonus) => {
+      const random = vi.spyOn(Math, "random").mockReturnValue(0.999_999);
+      try {
+        const t = testDb();
+        const attackerId = await createCharacter(t, {
+          rolled: ready,
+          items: [{ itemId: "survival-knife" }],
+        });
+        const defenderId = await createCharacter(t, { rolled: ready, hthType, level });
+        const pending = await declarePending(t, attackerId, defenderId, {
+          kind: "melee",
+          defenderAware: true,
+          parryMode,
+        });
+
+        const resolved = await t.mutation(api.combat.respondToAttack, {
+          exchangeId: pending._id,
+          response: {
+            kind,
+            defenseModifier: 100,
+            defenseModifierReason: "Guaranteed test defense",
+          },
+        });
+
+        expect(resolved.status).toBe("resolved");
+        if (resolved.status !== "resolved") throw new Error("Expected a resolved exchange.");
+        expect(resolved.resolution).toMatchObject({
+          outcome: "defended",
+          response: { kind, bonus, defenseModifier: 100, totalBonus: bonus + 100 },
+        });
+      } finally {
+        random.mockRestore();
+      }
+    },
+  );
+
+  test("stales changed stored options and rejects missing modifier reasons without dice or writes", async () => {
+    const t = testDb();
+    const attackerId = await createCharacter(t, {
+      rolled: ready,
+      items: [{ itemId: "survival-knife" }],
+    });
+    const defenderId = await createCharacter(t, { rolled: ready });
+    const unavailable = await declarePending(t, attackerId, defenderId, {
+      kind: "melee",
+      defenderAware: false,
+      parryMode: "unavailable",
+    });
+    const missingReason = await declarePending(t, attackerId, defenderId);
+    await t.run(async (ctx) => {
+      await ctx.db.patch(unavailable._id, {
+        defenseOptions: [
+          {
+            kind: "autoDodge",
+            bonus: 999,
+            actionCost: 0,
+            explanation: "Client-replayed stored option that is not authoritative.",
+          },
+          ...unavailable.defenseOptions,
+        ],
+      });
+    });
+    const characterBefore = await getCharacter(t, defenderId);
+    const unavailableBefore = await t.run((ctx) => ctx.db.get(unavailable._id));
+    const missingBefore = await t.run((ctx) => ctx.db.get(missingReason._id));
+    const random = vi.spyOn(Math, "random");
+
+    let stale;
+    try {
+      stale = await t.mutation(api.combat.respondToAttack, {
+        exchangeId: unavailable._id,
+        response: { kind: "autoDodge" },
+      });
+      await expectCombatFailure(
+        t.mutation(api.combat.respondToAttack, {
+          exchangeId: missingReason._id,
+          response: { kind: "dodge", defenseModifier: 1 },
+        }),
+        "modifierReasonRequired",
+        "A reason is required for a nonzero defense modifier.",
+      );
+      expect(random).not.toHaveBeenCalled();
+    } finally {
+      random.mockRestore();
+    }
+    if (stale === undefined) throw new Error("Expected changed stored options to finalize stale.");
+    expect(stale).toMatchObject({ status: "stale", reason: "combatStateChanged" });
+    expect("defenseOptions" in stale).toBe(false);
+    expect(await getCharacter(t, defenderId)).toEqual(characterBefore);
+    expect(await t.run((ctx) => ctx.db.get(unavailable._id))).toEqual(stale);
+    expect(await t.run((ctx) => ctx.db.get(unavailable._id))).not.toEqual(unavailableBefore);
+    expect(await t.run((ctx) => ctx.db.get(missingReason._id))).toEqual(missingBefore);
+  });
+
+  test("cancellation replaces only a pending variant and every finalized variant is pending-only", async () => {
+    const t = testDb();
+    const attackerId = await createCharacter(t, {
+      rolled: ready,
+      items: [{ itemId: "survival-knife" }],
+    });
+    const defenderId = await createCharacter(t, { rolled: ready });
+    const cancelledPending = await declarePending(t, attackerId, defenderId);
+    const resolvedPending = await declarePending(t, attackerId, defenderId);
+
+    const cancelled = await t.mutation(api.combat.cancelAttack, {
+      exchangeId: cancelledPending._id,
+    });
+    expect(cancelled).toMatchObject({ status: "cancelled" });
+    expect("defenseOptions" in cancelled).toBe(false);
+
+    await expectCombatFailure(
+      t.mutation(api.combat.respondToAttack, {
+        exchangeId: cancelledPending._id,
+        response: { kind: "none" },
+      }),
+      "exchangeNotPending",
+      "The combat exchange is no longer pending.",
+    );
+    await expectCombatFailure(
+      t.mutation(api.combat.cancelAttack, { exchangeId: cancelledPending._id }),
+      "exchangeNotPending",
+      "The combat exchange is no longer pending.",
+    );
+
+    const resolved = await t.mutation(api.combat.respondToAttack, {
+      exchangeId: resolvedPending._id,
+      response: { kind: "none" },
+    });
+    expect(resolved.status).toBe("resolved");
+    await expectCombatFailure(
+      t.mutation(api.combat.respondToAttack, {
+        exchangeId: resolvedPending._id,
+        response: { kind: "none" },
+      }),
+      "exchangeNotPending",
+      "The combat exchange is no longer pending.",
+    );
+    await expectCombatFailure(
+      t.mutation(api.combat.cancelAttack, { exchangeId: resolvedPending._id }),
+      "exchangeNotPending",
+      "The combat exchange is no longer pending.",
+    );
+  });
+
+  test("two concurrent responses have one winner and apply damage exactly once", async () => {
+    const t = testDb();
+    const attackerId = await createCharacter(t, {
+      rolled: ready,
+      items: [{ itemId: "survival-knife" }],
+    });
+    const defenderId = await createCharacter(t, { rolled: ready });
+    const pending = await declarePending(t, attackerId, defenderId);
+
+    const results = await Promise.allSettled([
+      t.mutation(api.combat.respondToAttack, {
+        exchangeId: pending._id,
+        response: { kind: "none" },
+      }),
+      t.mutation(api.combat.respondToAttack, {
+        exchangeId: pending._id,
+        response: { kind: "none" },
+      }),
+    ]);
+
+    const fulfilled = results.filter((result) => result.status === "fulfilled");
+    const rejected = results.filter((result) => result.status === "rejected");
+    expect(fulfilled).toHaveLength(1);
+    expect(rejected).toHaveLength(1);
+    const failure = await combatFailureData(Promise.reject(rejected[0]!.reason));
+    expect(failure).toEqual({
+      code: "exchangeNotPending",
+      message: "The combat exchange is no longer pending.",
+    });
+    const winner = fulfilled[0]!.value;
+    expect(winner.status).toBe("resolved");
+    if (winner.status !== "resolved" || winner.resolution.outcome !== "hit") {
+      throw new Error("Expected the winning response to hit.");
+    }
+    expect((await getCharacter(t, defenderId))?.current).toMatchObject(
+      winner.resolution.route.body.after,
+    );
+    expect(await t.run((ctx) => ctx.db.get(pending._id))).toEqual(winner);
+  });
+});
+
+describe("combat response stale-state finalization", () => {
+  test("stales a legacy attack snapshot that differs from the current weapon profile", async () => {
+    const t = testDb();
+    const attackerId = await createCharacter(t, {
+      rolled: ready,
+      items: [{ itemId: "survival-knife" }],
+    });
+    const defenderId = await createCharacter(t, { rolled: ready });
+    const pending = await declarePending(t, attackerId, defenderId);
+    await t.run((ctx) =>
+      ctx.db.patch(pending._id, {
+        attack: { ...pending.attack, damageFormula: "2D6", criticalOn: 19 },
+      }),
+    );
+    const defenderBefore = await getCharacter(t, defenderId);
+    const random = vi.spyOn(Math, "random");
+
+    const outcome = await t
+      .mutation(api.combat.respondToAttack, {
+        exchangeId: pending._id,
+        response: { kind: "none" },
+      })
+      .then(
+        (value) => ({ status: "fulfilled" as const, value }),
+        (reason: unknown) => ({ status: "rejected" as const, reason }),
+      );
+    const randomCalls = random.mock.calls.length;
+    random.mockRestore();
+    if (outcome.status === "rejected") throw outcome.reason;
+    const stale = outcome.value;
+
+    expect(randomCalls).toBe(0);
+    expect(stale).toMatchObject({
+      status: "stale",
+      reason: "combatStateChanged",
+      attack: { damageFormula: "2D6", criticalOn: 19 },
+    });
+    expect("defenseOptions" in stale).toBe(false);
+    expect(await getCharacter(t, defenderId)).toEqual(defenderBefore);
+  });
+
+  test("stales changed ordered defense options before response authorization", async () => {
+    const t = testDb();
+    const attackerId = await createCharacter(t, {
+      rolled: ready,
+      items: [{ itemId: "survival-knife" }],
+    });
+    const defenderId = await createCharacter(t, { rolled: ready });
+    const pending = await declarePending(t, attackerId, defenderId);
+    await t.run((ctx) =>
+      ctx.db.patch(pending._id, {
+        defenseOptions: [...pending.defenseOptions].reverse(),
+      }),
+    );
+    const defenderBefore = await getCharacter(t, defenderId);
+    const random = vi.spyOn(Math, "random");
+
+    const outcome = await t
+      .mutation(api.combat.respondToAttack, {
+        exchangeId: pending._id,
+        response: { kind: "autoDodge" },
+      })
+      .then(
+        (value) => ({ status: "fulfilled" as const, value }),
+        (reason: unknown) => ({ status: "rejected" as const, reason }),
+      );
+    const randomCalls = random.mock.calls.length;
+    random.mockRestore();
+    if (outcome.status === "rejected") throw outcome.reason;
+    const stale = outcome.value;
+
+    expect(randomCalls).toBe(0);
+    expect(stale).toMatchObject({ status: "stale", reason: "combatStateChanged" });
+    expect("defenseOptions" in stale).toBe(false);
+    expect(await getCharacter(t, defenderId)).toEqual(defenderBefore);
+  });
+
+  test("stales a legacy context that no longer validates for the derived attack", async () => {
+    const t = testDb();
+    const attackerId = await createCharacter(t, {
+      rolled: ready,
+      items: [{ itemId: "survival-knife" }],
+    });
+    const defenderId = await createCharacter(t, { rolled: ready });
+    const pending = await declarePending(t, attackerId, defenderId);
+    await t.run((ctx) =>
+      ctx.db.patch(pending._id, {
+        context: { kind: "ranged", defenderAware: true, rangeBand: "normal" },
+      }),
+    );
+    const defenderBefore = await getCharacter(t, defenderId);
+    const random = vi.spyOn(Math, "random");
+
+    const outcome = await t
+      .mutation(api.combat.respondToAttack, {
+        exchangeId: pending._id,
+        response: { kind: "none" },
+      })
+      .then(
+        (value) => ({ status: "fulfilled" as const, value }),
+        (reason: unknown) => ({ status: "rejected" as const, reason }),
+      );
+    const randomCalls = random.mock.calls.length;
+    random.mockRestore();
+    if (outcome.status === "rejected") throw outcome.reason;
+    const stale = outcome.value;
+
+    expect(randomCalls).toBe(0);
+    expect(stale).toMatchObject({ status: "stale", reason: "combatStateChanged" });
+    expect("defenseOptions" in stale).toBe(false);
+    expect(await getCharacter(t, defenderId)).toEqual(defenderBefore);
+  });
+
+  test("stales an attack that can no longer derive a supported profile", async () => {
+    const t = testDb();
+    const attackerId = await createCharacter(t, {
+      rolled: ready,
+      items: [{ itemId: "survival-knife" }],
+    });
+    const defenderId = await createCharacter(t, { rolled: ready });
+    const pending = await declarePending(t, attackerId, defenderId);
+    await t.run(async (ctx) => {
+      await ctx.db.patch(attackerId, { items: [{ itemId: "wilks-320-laser-pistol" }] });
+      const changed = await ctx.db.get(attackerId);
+      if (changed === null) throw new Error("Expected the changed attacker to exist.");
+      await ctx.db.patch(pending._id, {
+        attackerStateToken: attackerCombatStateToken(deriveSheet(changed), 0),
+      });
+    });
+    const defenderBefore = await getCharacter(t, defenderId);
+    const random = vi.spyOn(Math, "random");
+
+    const outcome = await t
+      .mutation(api.combat.respondToAttack, {
+        exchangeId: pending._id,
+        response: { kind: "none" },
+      })
+      .then(
+        (value) => ({ status: "fulfilled" as const, value }),
+        (reason: unknown) => ({ status: "rejected" as const, reason }),
+      );
+    const randomCalls = random.mock.calls.length;
+    random.mockRestore();
+    if (outcome.status === "rejected") throw outcome.reason;
+    const stale = outcome.value;
+
+    expect(randomCalls).toBe(0);
+    expect(stale).toMatchObject({ status: "stale", reason: "combatStateChanged" });
+    expect("defenseOptions" in stale).toBe(false);
+    expect(await getCharacter(t, defenderId)).toEqual(defenderBefore);
+  });
+
+  test.each([
+    [
+      "level",
+      async (t: TestDb, id: Id<"characters">) => t.run((ctx) => ctx.db.patch(id, { level: 2 })),
+    ],
+    [
+      "Hand-to-Hand profile",
+      async (t: TestDb, id: Id<"characters">) =>
+        t.run((ctx) => ctx.db.patch(id, { hthType: "none" })),
+    ],
+    [
+      "selected weapon",
+      async (t: TestDb, id: Id<"characters">) =>
+        t.run((ctx) => ctx.db.patch(id, { items: [{ itemId: "hand-axe" }] })),
+    ],
+  ] as const)("marks a changed attacker %s stale before response dice", async (_label, change) => {
+    const t = testDb();
+    const attackerId = await createCharacter(t, {
+      rolled: ready,
+      items: [{ itemId: "survival-knife" }],
+    });
+    const defenderId = await createCharacter(t, { rolled: ready });
+    const pending = await declarePending(t, attackerId, defenderId);
+    const defenderBefore = await getCharacter(t, defenderId);
+    await change(t, attackerId);
+    const random = vi.spyOn(Math, "random");
+
+    const stale = await t.mutation(api.combat.respondToAttack, {
+      exchangeId: pending._id,
+      response: { kind: "dodge" },
+    });
+
+    expect(random).not.toHaveBeenCalled();
+    random.mockRestore();
+    expect(stale).toMatchObject({ status: "stale", reason: "combatStateChanged" });
+    expect("defenseOptions" in stale).toBe(false);
+    expect(await getCharacter(t, defenderId)).toEqual(defenderBefore);
+    await expectCombatFailure(
+      t.mutation(api.combat.respondToAttack, {
+        exchangeId: pending._id,
+        response: { kind: "none" },
+      }),
+      "exchangeNotPending",
+      "The combat exchange is no longer pending.",
+    );
+    await expectCombatFailure(
+      t.mutation(api.combat.cancelAttack, { exchangeId: pending._id }),
+      "exchangeNotPending",
+      "The combat exchange is no longer pending.",
+    );
+  });
+
+  test.each([
+    [
+      "body pools",
+      async (t: TestDb, id: Id<"characters">) =>
+        t.run((ctx) => ctx.db.patch(id, { current: { sdc: 19, hitPoints: 18 } })),
+    ],
+    [
+      "defense profile",
+      async (t: TestDb, id: Id<"characters">) =>
+        t.run((ctx) => ctx.db.patch(id, { hthType: "none" })),
+    ],
+    [
+      "worn armor",
+      async (t: TestDb, id: Id<"characters">) =>
+        t.run((ctx) =>
+          ctx.db.patch(id, {
+            items: [{ itemId: "gladiator", worn: true }],
+            current: { armor: 0 },
+          }),
+        ),
+    ],
+  ] as const)(
+    "marks changed defender %s stale without additional damage",
+    async (_label, change) => {
+      const t = testDb();
+      const attackerId = await createCharacter(t, {
+        rolled: ready,
+        items: [{ itemId: "survival-knife" }],
+      });
+      const defenderId = await createCharacter(t, { rolled: ready });
+      const pending = await declarePending(t, attackerId, defenderId);
+      await change(t, defenderId);
+      const defenderAfterChange = await getCharacter(t, defenderId);
+      const random = vi.spyOn(Math, "random");
+
+      const stale = await t.mutation(api.combat.respondToAttack, {
+        exchangeId: pending._id,
+        response: { kind: "none" },
+      });
+
+      expect(random).not.toHaveBeenCalled();
+      random.mockRestore();
+      expect(stale).toMatchObject({ status: "stale", reason: "combatStateChanged" });
+      expect(await getCharacter(t, defenderId)).toEqual(defenderAfterChange);
+    },
+  );
+
+  test("marks a changed worn-armor pool stale before protection revalidation", async () => {
+    const t = testDb();
+    const attackerId = await createCharacter(t, {
+      rolled: ready,
+      items: [{ itemId: "survival-knife" }],
+    });
+    const defenderId = await createCharacter(t, {
+      rolled: ready,
+      items: [{ itemId: "gladiator", worn: true }],
+      current: { armor: 0 },
+    });
+    const pending = await declarePending(t, attackerId, defenderId);
+    await t.run((ctx) => ctx.db.patch(defenderId, { current: { armor: 1 } }));
+    const defenderAfterChange = await getCharacter(t, defenderId);
+    const random = vi.spyOn(Math, "random");
+
+    const stale = await t.mutation(api.combat.respondToAttack, {
+      exchangeId: pending._id,
+      response: { kind: "none" },
+    });
+
+    expect(random).not.toHaveBeenCalled();
+    random.mockRestore();
+    expect(stale).toMatchObject({ status: "stale", reason: "combatStateChanged" });
+    expect(await getCharacter(t, defenderId)).toEqual(defenderAfterChange);
+  });
+
+  test("narrative changes on either character do not stale a valid response", async () => {
+    const t = testDb();
+    const attackerId = await createCharacter(t, {
+      rolled: ready,
+      items: [{ itemId: "survival-knife" }],
+    });
+    const defenderId = await createCharacter(t, { rolled: ready });
+    const pending = await declarePending(t, attackerId, defenderId);
+    await t.run(async (ctx) => {
+      await ctx.db.patch(attackerId, { narrative: { epithet: "The Declarant" } });
+      await ctx.db.patch(defenderId, { narrative: { backstory: "Changed after declaration." } });
+    });
+
+    const resolved = await t.mutation(api.combat.respondToAttack, {
+      exchangeId: pending._id,
+      response: { kind: "none" },
+    });
+
+    expect(resolved.status).toBe("resolved");
+    expect((await getCharacter(t, attackerId))?.narrative).toEqual({ epithet: "The Declarant" });
+    expect((await getCharacter(t, defenderId))?.narrative).toEqual({
+      backstory: "Changed after declaration.",
+    });
+  });
+
+  test("unrelated P.P.E. and inventory changes survive a valid response", async () => {
+    const t = testDb();
+    const attackerId = await createCharacter(t, {
+      rolled: { ...ready, ppe: 100 },
+      current: { ppe: 90 },
+      items: [{ itemId: "survival-knife" }],
+    });
+    const defenderId = await createCharacter(t, {
+      rolled: { ...ready, ppe: 100 },
+      current: { ppe: 80 },
+    });
+    const pending = await declarePending(t, attackerId, defenderId);
+    await t.run(async (ctx) => {
+      await ctx.db.patch(attackerId, {
+        current: { ppe: 89 },
+        items: [{ itemId: "survival-knife" }, { itemId: "canteen" }],
+      });
+      await ctx.db.patch(defenderId, {
+        current: { ppe: 79 },
+        items: [{ itemId: "canteen" }],
+      });
+    });
+
+    const resolved = await t.mutation(api.combat.respondToAttack, {
+      exchangeId: pending._id,
+      response: { kind: "none" },
+    });
+
+    expect(resolved.status).toBe("resolved");
+    expect((await getCharacter(t, attackerId))?.current?.ppe).toBe(89);
+    expect((await getCharacter(t, attackerId))?.items?.at(-1)?.itemId).toBe("canteen");
+    expect((await getCharacter(t, defenderId))?.current?.ppe).toBe(79);
+    expect((await getCharacter(t, defenderId))?.items).toEqual([{ itemId: "canteen" }]);
+  });
+
+  test("one resolved hit stales a second exchange declared against the prior body pools", async () => {
+    const t = testDb();
+    const attackerId = await createCharacter(t, {
+      rolled: ready,
+      items: [{ itemId: "survival-knife" }],
+    });
+    const defenderId = await createCharacter(t, { rolled: ready });
+    const first = await declarePending(t, attackerId, defenderId);
+    const second = await declarePending(t, attackerId, defenderId);
+
+    const resolved = await t.mutation(api.combat.respondToAttack, {
+      exchangeId: first._id,
+      response: { kind: "none" },
+    });
+    expect(resolved.status).toBe("resolved");
+    const afterFirst = await getCharacter(t, defenderId);
+    const random = vi.spyOn(Math, "random");
+
+    const stale = await t.mutation(api.combat.respondToAttack, {
+      exchangeId: second._id,
+      response: { kind: "none" },
+    });
+
+    expect(random).not.toHaveBeenCalled();
+    random.mockRestore();
+    expect(stale).toMatchObject({ status: "stale", reason: "combatStateChanged" });
+    expect(await getCharacter(t, defenderId)).toEqual(afterFirst);
+  });
+});
+
+describe("combat missing-state errors", () => {
+  test("response and cancellation use a stable code for a deleted exchange", async () => {
+    const t = testDb();
+    const attackerId = await createCharacter(t, {
+      rolled: ready,
+      items: [{ itemId: "survival-knife" }],
+    });
+    const defenderId = await createCharacter(t, { rolled: ready });
+    const pending = await declarePending(t, attackerId, defenderId);
+    await t.run((ctx) => ctx.db.delete(pending._id));
+
+    await expectCombatFailure(
+      t.mutation(api.combat.respondToAttack, {
+        exchangeId: pending._id,
+        response: { kind: "none" },
+      }),
+      "exchangeNotPending",
+      "The combat exchange no longer exists.",
+    );
+    await expectCombatFailure(
+      t.mutation(api.combat.cancelAttack, { exchangeId: pending._id }),
+      "exchangeNotPending",
+      "The combat exchange no longer exists.",
+    );
+  });
+
+  test("response uses a stable code and preserves pending state when a combatant is missing", async () => {
+    const t = testDb();
+    const attackerId = await createCharacter(t, {
+      rolled: ready,
+      items: [{ itemId: "survival-knife" }],
+    });
+    const defenderId = await createCharacter(t, { rolled: ready });
+    const pending = await declarePending(t, attackerId, defenderId);
+    await t.run((ctx) => ctx.db.delete(attackerId));
+
+    await expectCombatFailure(
+      t.mutation(api.combat.respondToAttack, {
+        exchangeId: pending._id,
+        response: { kind: "none" },
+      }),
+      "characterMissing",
+      "The attacker or defender no longer exists.",
+    );
+    expect(await t.run((ctx) => ctx.db.get(pending._id))).toEqual(pending);
+    expect(await getCharacter(t, defenderId)).not.toBeNull();
+  });
+
+  test("all character-scoped combat queries reject a deleted character with stable data", async () => {
+    const t = testDb();
+    const characterId = await createCharacter(t);
+    await t.run((ctx) => ctx.db.delete(characterId));
+
+    for (const query of [
+      t.query(api.combat.targets, { attackerId: characterId }),
+      t.query(api.combat.incoming, { defenderId: characterId }),
+      t.query(api.combat.outgoing, { attackerId: characterId }),
+      t.query(api.combat.recent, { characterId }),
+    ]) {
+      await expectCombatFailure(query, "characterMissing", "The character no longer exists.");
+    }
+  });
+});
diff --git a/packages/rules/src/content/combat/combat-exchange.json b/packages/rules/src/content/combat/combat-exchange.json
new file mode 100644
index 0000000..56c7206
--- /dev/null
+++ b/packages/rules/src/content/combat/combat-exchange.json
@@ -0,0 +1,14 @@
+{
+  "book": "Rifts Ultimate Edition",
+  "pages": {
+    "armorAndVitals": 287,
+    "sdcCombat": 339,
+    "defense": 340,
+    "damage": 341,
+    "automaticDodge": 344,
+    "modernWeapons": 360,
+    "rangedDodging": 361
+  },
+  "minimumStrikeTotal": { "melee": 5, "ranged": 8 },
+  "rangedDodgeModifier": { "pointBlank": -10, "close": -5, "normal": 0 }
+}
diff --git a/packages/rules/src/engine/combat-exchange.ts b/packages/rules/src/engine/combat-exchange.ts
new file mode 100644
index 0000000..7557643
--- /dev/null
+++ b/packages/rules/src/engine/combat-exchange.ts
@@ -0,0 +1,619 @@
+import combatExchangeRaw from "../content/combat/combat-exchange.json" with { type: "json" };
+import {
+  combatContextSchema,
+  combatExchangeRulesSchema,
+  combatResponseInputSchema,
+  type AttackKind,
+  type CombatContext,
+  type CombatResponseKind,
+} from "../schema/combat-exchange.ts";
+import type { WeaponCategory } from "../schema/items.ts";
+import type { DefenseKind } from "../schema/strike-resolution.ts";
+import type { CharacterSheet, SheetEquipmentEntry } from "./character.ts";
+import { applyDamage, type VitalsPool } from "./combat.ts";
+import { parseDice } from "./dice.ts";
+import { damageArmor } from "./items.ts";
+import type { D20Roll, DamageRoll } from "./rolls.ts";
+import { resolveStrike } from "./strike-resolution.ts";
+
+export const combatExchangeRules = combatExchangeRulesSchema.parse(combatExchangeRaw);
+
+const attributeOrder = ["IQ", "ME", "MA", "PS", "PP", "PE", "PB", "Spd"] as const;
+const orderedAttributes = (sheet: CharacterSheet) =>
+  attributeOrder.map((code) => sheet.attributes[code]);
+
+function orderedCombatExchangeRules(rules: typeof combatExchangeRules) {
+  return [
+    rules.book,
+    [
+      rules.pages.armorAndVitals,
+      rules.pages.sdcCombat,
+      rules.pages.defense,
+      rules.pages.damage,
+      rules.pages.automaticDodge,
+      rules.pages.modernWeapons,
+      rules.pages.rangedDodging,
+    ],
+    [rules.minimumStrikeTotal.melee, rules.minimumStrikeTotal.ranged],
+    [
+      rules.rangedDodgeModifier.pointBlank,
+      rules.rangedDodgeModifier.close,
+      rules.rangedDodgeModifier.normal,
+    ],
+  ];
+}
+
+function orderedSelectedItem(sheet: CharacterSheet, weaponIndex: number) {
+  const entry = sheet.equipment[weaponIndex];
+  if (entry === undefined) return null;
+  const instance = [entry.worn === true, entry.rolledMdc ?? null];
+  return entry.item.kind === "weapon"
+    ? [
+        "weapon",
+        entry.item.id,
+        entry.item.category,
+        entry.item.damage.formula,
+        entry.item.damage.type,
+        entry.item.page,
+        instance,
+      ]
+    : ["nonWeapon", entry.item.id, entry.item.kind, entry.item.page, instance];
+}
+
+function orderedAttackProfile(profile: AttackProfile) {
+  if (!profile.supported) {
+    return [
+      "refused",
+      profile.reason,
+      profile.weapon === undefined
+        ? null
+        : [
+            profile.weapon.index,
+            profile.weapon.itemId,
+            profile.weapon.name,
+            profile.weapon.worn === true,
+            profile.weapon.rolledMdc ?? null,
+          ],
+    ];
+  }
+  return [
+    "supported",
+    profile.kind,
+    profile.minimumStrikeTotal,
+    profile.strikeBonus,
+    profile.strikeBonusSources.map((source) => [source.source, source.label, source.value]),
+    profile.proficiencyBonus,
+    profile.damageFormula,
+    profile.damageBonus,
+    profile.criticalOn,
+    profile.damageType,
+    [
+      profile.weapon.index,
+      profile.weapon.itemId,
+      profile.weapon.name,
+      profile.weapon.category,
+      profile.weapon.worn === true,
+      profile.weapon.rolledMdc ?? null,
+    ],
+  ];
+}
+
+export function attackerCombatStateToken(
+  sheet: CharacterSheet,
+  weaponIndex: number,
+  rules: typeof combatExchangeRules = combatExchangeRules,
+): string {
+  const attack = deriveAttackProfile(sheet, weaponIndex);
+  return JSON.stringify([
+    "attacker-v2",
+    sheet.level,
+    orderedAttributes(sheet),
+    [
+      sheet.combat.handToHandType,
+      sheet.combat.strike,
+      sheet.combat.damageBonus,
+      sheet.combat.strikeGuns,
+      sheet.combat.criticalStrikeOn,
+    ],
+    orderedCombatExchangeRules(rules),
+    weaponIndex,
+    orderedSelectedItem(sheet, weaponIndex),
+    orderedAttackProfile(attack),
+  ]);
+}
+
+export function defenderCombatStateToken(sheet: CharacterSheet): string {
+  return JSON.stringify([
+    "defender-v1",
+    sheet.level,
+    orderedAttributes(sheet),
+    [
+      sheet.combat.handToHandType,
+      sheet.combat.hasHandToHandTraining,
+      sheet.combat.hasAutoDodge,
+      sheet.combat.parry,
+      sheet.combat.dodge,
+      sheet.combat.autoDodge,
+      sheet.combat.rangedDodge,
+      sheet.combat.rangedAutoDodge,
+    ],
+    [
+      sheet.vitals.sdc.rolled ?? null,
+      sheet.vitals.sdc.current ?? null,
+      sheet.vitals.hitPoints.rolled ?? null,
+      sheet.vitals.hitPoints.current ?? null,
+      sheet.vitals.comaDeathFloor,
+    ],
+    sheet.armor === undefined
+      ? null
+      : [
+          sheet.armor.item.id,
+          sheet.armor.item.mdc === undefined ? "sdc" : "mdc",
+          sheet.armor.item.ar ?? null,
+          sheet.armor.max ?? null,
+          sheet.armor.current ?? null,
+        ],
+  ]);
+}
+
+export interface ModifierSource {
+  source: "attribute" | "handToHand" | "proficiency";
+  label: string;
+  value: number;
+}
+
+export interface WeaponInstanceSnapshot {
+  index: number;
+  itemId: string;
+  worn?: boolean;
+  rolledMdc?: number;
+}
+
+export type AttackProfile =
+  | {
+      supported: false;
+      reason: "weaponMissingOrChanged" | "unsupportedWeaponMode" | "unsupportedMdWeapon";
+      weapon?: WeaponInstanceSnapshot & { name: string };
+    }
+  | {
+      supported: true;
+      kind: AttackKind;
+      minimumStrikeTotal: number;
+      strikeBonus: number;
+      strikeBonusSources: ModifierSource[];
+      proficiencyBonus: number;
+      damageFormula: string;
+      damageBonus: number;
+      criticalOn: number;
+      damageType: "sdc";
+      weapon: WeaponInstanceSnapshot & { name: string; category: WeaponCategory };
+    };
+
+export interface DefenseOption {
+  kind: CombatResponseKind;
+  bonus: number;
+  actionCost: 0 | 1;
+  explanation: string;
+}
+
+export interface AuthorizedCombatResponse extends DefenseOption {
+  defenseModifier: number;
+  defenseModifierReason?: string;
+  totalBonus: number;
+}
+
+export type ProtectionState =
+  | { kind: "none" }
+  | {
+      kind: "sdcArmor";
+      itemId: string;
+      name: string;
+      ar: number;
+      max: number;
+      current: number;
+    }
+  | {
+      kind: "mdcArmor";
+      itemId: string;
+      name: string;
+      max?: number;
+      current?: number;
+    };
+
+export type DeclarationResult =
+  | { status: "miss"; reason: "naturalOne" | "belowMinimum" }
+  | { status: "pendingDefense" };
+
+export type SdcDamageRoute =
+  | {
+      kind: "armor";
+      armor: { before: number; after: number };
+      body: { before: VitalsPool; after: VitalsPool };
+    }
+  | {
+      kind: "body";
+      armor?: { before: number; after: number };
+      body: { before: VitalsPool; after: VitalsPool };
+    }
+  | { kind: "unsupportedMdcProtection" };
+
+export type CombatExchangeResolution =
+  | {
+      outcome: "miss";
+      reason: "naturalOne" | "belowMinimum";
+      critical: false;
+      damageMultiplier: 1;
+    }
+  | {
+      outcome: "defended";
+      reason: "parried" | "dodged";
+      response: AuthorizedCombatResponse;
+      defenseRoll: D20Roll;
+      critical: false;
+      damageMultiplier: 1;
+    }
+  | {
+      outcome: "hit";
+      reason: "unopposed" | "strikeWon";
+      response: AuthorizedCombatResponse;
+      defenseRoll?: D20Roll;
+      critical: boolean;
+      damageMultiplier: 1 | 2;
+      damageRoll: DamageRoll;
+      totalDamage: number;
+      route: Exclude<SdcDamageRoute, { kind: "unsupportedMdcProtection" }>;
+    };
+
+export interface ResolveCombatExchangeInput {
+  attack: Extract<AttackProfile, { supported: true }>;
+  context: CombatContext;
+  strikeRoll: D20Roll;
+  response: AuthorizedCombatResponse;
+  defenseRoll?: D20Roll;
+  damageRoll?: DamageRoll;
+  protection: ProtectionState;
+  body: VitalsPool;
+  comaDeathFloor: number;
+}
+
+const meleeCategories = new Set<WeaponCategory>(["knife", "axe"]);
+
+function weaponSnapshot(
+  entry: SheetEquipmentEntry,
+  index: number,
+): WeaponInstanceSnapshot & { name: string } {
+  return {
+    index,
+    itemId: entry.item.id,
+    name: entry.item.name,
+    ...(entry.worn === true ? { worn: true } : {}),
+    ...(entry.rolledMdc === undefined ? {} : { rolledMdc: entry.rolledMdc }),
+  };
+}
+
+export function deriveAttackProfile(sheet: CharacterSheet, weaponIndex: number): AttackProfile {
+  const entry = Number.isInteger(weaponIndex) ? sheet.equipment[weaponIndex] : undefined;
+  if (entry === undefined) return { supported: false, reason: "weaponMissingOrChanged" };
+  const snapshot = weaponSnapshot(entry, weaponIndex);
+  if (entry.item.kind !== "weapon") {
+    return { supported: false, reason: "unsupportedWeaponMode", weapon: snapshot };
+  }
+  if (entry.item.damage.type === "md") {
+    return { supported: false, reason: "unsupportedMdWeapon", weapon: snapshot };
+  }
+
+  const kind: AttackKind = meleeCategories.has(entry.item.category) ? "melee" : "ranged";
+  const strikeBonusSources: ModifierSource[] =
+    kind === "melee"
+      ? [
+          { source: "attribute", label: "P.P.", value: sheet.attributeBonuses.strike ?? 0 },
+          {
+            source: "handToHand",
+            label: "Hand-to-Hand",
+            value: sheet.combat.handToHandBonuses.strike ?? 0,
+          },
+        ]
+      : [
+          {
+            source: "handToHand",
+            label: "Gun-specific Hand-to-Hand",
+            value: sheet.combat.handToHandBonuses.strikeGuns ?? 0,
+          },
+          { source: "proficiency", label: "Modern W.P.", value: 0 },
+        ];
+  return {
+    supported: true,
+    kind,
+    minimumStrikeTotal: combatExchangeRules.minimumStrikeTotal[kind],
+    strikeBonus: strikeBonusSources.reduce((sum, source) => sum + source.value, 0),
+    strikeBonusSources,
+    proficiencyBonus: 0,
+    damageFormula: entry.item.damage.formula,
+    damageBonus: kind === "melee" ? sheet.combat.damageBonus : 0,
+    criticalOn: kind === "melee" ? sheet.combat.criticalStrikeOn : 20,
+    damageType: "sdc",
+    weapon: { ...snapshot, category: entry.item.category },
+  };
+}
+
+export function validateCombatContext(
+  profile: Extract<AttackProfile, { supported: true }>,
+  input: unknown,
+): CombatContext {
+  const context = combatContextSchema.parse(input);
+  if (context.kind !== profile.kind) {
+    throw new Error(
+      `invalidContext: ${context.kind} context kind cannot resolve ${profile.kind} attack.`,
+    );
+  }
+  return context;
+}
+
+export function deriveDefenseOptions(
+  defender: CharacterSheet,
+  attack: Extract<AttackProfile, { supported: true }>,
+  context: CombatContext,
+): DefenseOption[] {
+  const options: DefenseOption[] = [];
+  if (attack.kind === "melee") {
+    if (context.kind !== "melee") {
+      throw new Error("invalidContext: melee attack requires melee context.");
+    }
+    if (context.defenderAware && context.parryMode !== "unavailable") {
+      options.push({
+        kind: "parry",
+        bonus: context.parryMode === "bareHanded" ? 0 : defender.combat.parry,
+        actionCost: defender.combat.hasHandToHandTraining ? 0 : 1,
+        explanation:
+          context.parryMode === "bareHanded"
+            ? "Bare-handed weapon parry; no ordinary parry bonus."
+            : "Parry the melee weapon.",
+      });
+    }
+    if (context.defenderAware) {
+      options.push({
+        kind: "dodge",
+        bonus: defender.combat.dodge,
+        actionCost: 1,
+        explanation: "Dodge; costs one action for table tracking.",
+      });
+    }
+    if (defender.combat.hasAutoDodge) {
+      options.push({
+        kind: "autoDodge",
+        bonus: defender.combat.autoDodge,
+        actionCost: 0,
+        explanation: "Automatic dodge; no action cost.",
+      });
+    }
+  } else {
+    if (context.kind !== "ranged") {
+      throw new Error("invalidContext: ranged attack requires ranged context.");
+    }
+    if (context.defenderAware) {
+      const rangeModifier = combatExchangeRules.rangedDodgeModifier[context.rangeBand];
+      options.push({
+        kind: "dodge",
+        bonus: defender.combat.rangedDodge + rangeModifier,
+        actionCost: 1,
+        explanation: `Ranged dodge (${rangeModifier} range-band modifier).`,
+      });
+      if (defender.combat.hasAutoDodge) {
+        options.push({
+          kind: "autoDodge",
+          bonus: defender.combat.rangedAutoDodge + rangeModifier,
+          actionCost: 0,
+          explanation: `Automatic ranged dodge (${rangeModifier} range-band modifier).`,
+        });
+      }
+    }
+  }
+  options.push({ kind: "none", bonus: 0, actionCost: 0, explanation: "Take the hit." });
+  return options;
+}
+
+export function authorizeCombatResponse(
+  options: readonly DefenseOption[],
+  input: unknown,
+): AuthorizedCombatResponse {
+  const response = combatResponseInputSchema.parse(input);
+  const option = options.find((candidate) => candidate.kind === response.kind);
+  if (option === undefined) {
+    throw new Error(`illegalDefense: ${response.kind} is not authorized.`);
+  }
+  const defenseModifier = response.defenseModifier ?? 0;
+  return {
+    ...option,
+    defenseModifier,
+    ...(response.defenseModifierReason === undefined
+      ? {}
+      : { defenseModifierReason: response.defenseModifierReason }),
+    totalBonus: option.bonus + defenseModifier,
+  };
+}
+
+export function deriveProtection(sheet: CharacterSheet): ProtectionState {
+  const armor = sheet.armor;
+  if (armor === undefined) return { kind: "none" };
+  if (armor.item.mdc !== undefined) {
+    if (armor.current === 0) return { kind: "none" };
+    return {
+      kind: "mdcArmor",
+      itemId: armor.item.id,
+      name: armor.item.name,
+      ...(armor.max === undefined ? {} : { max: armor.max }),
+      ...(armor.current === undefined ? {} : { current: armor.current }),
+    };
+  }
+  const max = armor.item.sdc!;
+  const current = armor.current ?? max;
+  return current === 0
+    ? { kind: "none" }
+    : {
+        kind: "sdcArmor",
+        itemId: armor.item.id,
+        name: armor.item.name,
+        ar: armor.item.ar!,
+        max,
+        current,
+      };
+}
+
+export function evaluateDeclaration(
+  strike: D20Roll,
+  minimumStrikeTotal: number,
+): DeclarationResult {
+  const base = resolveStrike({ strike, allowedDefenses: [], damageType: "sdc" });
+  if (base.outcome === "miss") {
+    return { status: "miss", reason: base.reason as "naturalOne" | "belowMinimum" };
+  }
+  return strike.total < minimumStrikeTotal
+    ? { status: "miss", reason: "belowMinimum" }
+    : { status: "pendingDefense" };
+}
+
+export function routeSdcHit(input: {
+  strikeTotal: number;
+  damage: number;
+  protection: ProtectionState;
+  body: VitalsPool;
+  comaDeathFloor: number;
+}): SdcDamageRoute {
+  if (input.protection.kind === "mdcArmor") {
+    return { kind: "unsupportedMdcProtection" };
+  }
+  const before = { ...input.body };
+  if (
+    input.protection.kind === "sdcArmor" &&
+    input.protection.current > 0 &&
+    input.strikeTotal <= input.protection.ar
+  ) {
+    return {
+      kind: "armor",
+      armor: {
+        before: input.protection.current,
+        after: damageArmor(input.protection.current, input.damage),
+      },
+      body: { before, after: { ...before } },
+    };
+  }
+  const after = applyDamage(input.body, input.damage, input.comaDeathFloor);
+  return {
+    kind: "body",
+    ...(input.protection.kind === "sdcArmor"
+      ? { armor: { before: input.protection.current, after: input.protection.current } }
+      : {}),
+    body: { before, after },
+  };
+}
+
+function assertDamageRoll(
+  attack: Extract<AttackProfile, { supported: true }>,
+  roll: DamageRoll,
+): void {
+  const formula = parseDice(attack.damageFormula);
+  if (roll.bonus !== attack.damageBonus) {
+    throw new Error(`Damage bonus must be ${attack.damageBonus}.`);
+  }
+  if (roll.dice.length !== formula.count) {
+    throw new Error(`Damage roll requires ${formula.count} dice.`);
+  }
+  if (roll.dice.some((die) => !Number.isInteger(die) || die < 1 || die > formula.sides)) {
+    throw new Error(`Damage dice must be integers from 1 to ${formula.sides}.`);
+  }
+  const expected =
+    roll.dice.reduce((sum, die) => sum + die, 0) * formula.multiplier +
+    formula.modifier +
+    roll.bonus;
+  if (roll.total !== expected) {
+    throw new Error(`Damage total must be ${expected}.`);
+  }
+}
+
+export function resolveCombatExchange(input: ResolveCombatExchangeInput): CombatExchangeResolution {
+  validateCombatContext(input.attack, input.context);
+  if (input.protection.kind === "mdcArmor") {
+    throw new Error("unsupportedMdcProtection: full M.D.C. resolution is out of scope.");
+  }
+  const expectedStrikeBonus = input.attack.strikeBonus + (input.context.strikeModifier ?? 0);
+  if (input.strikeRoll.bonus !== expectedStrikeBonus) {
+    throw new Error(`Strike bonus must be ${expectedStrikeBonus}.`);
+  }
+  const declaration = evaluateDeclaration(input.strikeRoll, input.attack.minimumStrikeTotal);
+  if (declaration.status === "miss") {
+    if (input.defenseRoll !== undefined || input.damageRoll !== undefined) {
+      throw new Error("A missed declaration cannot contain defense or damage rolls.");
+    }
+    return {
+      outcome: "miss",
+      reason: declaration.reason,
+      critical: false,
+      damageMultiplier: 1,
+    };
+  }
+
+  const takesHit = input.response.kind === "none";
+  if (takesHit && input.defenseRoll !== undefined) {
+    throw new Error("Take-the-hit cannot contain a defense roll.");
+  }
+  if (!takesHit && input.defenseRoll === undefined) {
+    throw new Error(`${input.response.kind} requires a completed defense roll.`);
+  }
+  if (input.defenseRoll !== undefined && input.defenseRoll.bonus !== input.response.totalBonus) {
+    throw new Error(`Defense bonus must be ${input.response.totalBonus}.`);
+  }
+
+  const strike = resolveStrike({
+    strike: input.strikeRoll,
+    ...(takesHit
+      ? {}
+      : {
+          defense: {
+            kind: input.response.kind as DefenseKind,
+            roll: input.defenseRoll!,
+          },
+        }),
+    allowedDefenses: takesHit ? [] : [input.response.kind as DefenseKind],
+    damageType: "sdc",
+    criticalOn: input.attack.criticalOn,
+  });
+  if (strike.outcome !== "hit") {
+    if (input.damageRoll !== undefined) {
+      throw new Error("A defended attack cannot contain damage.");
+    }
+    return {
+      outcome: "defended",
+      reason: strike.reason as "parried" | "dodged",
+      response: input.response,
+      defenseRoll: input.defenseRoll!,
+      critical: false,
+      damageMultiplier: 1,
+    };
+  }
+  if (input.damageRoll === undefined) {
+    throw new Error("A hit requires a completed damage roll.");
+  }
+  assertDamageRoll(input.attack, input.damageRoll);
+  const totalDamage = input.damageRoll.total * strike.damageMultiplier;
+  const route = routeSdcHit({
+    strikeTotal: input.strikeRoll.total,
+    damage: totalDamage,
+    protection: input.protection,
+    body: input.body,
+    comaDeathFloor: input.comaDeathFloor,
+  });
+  if (route.kind === "unsupportedMdcProtection") {
+    throw new Error("unsupportedMdcProtection: full M.D.C. resolution is out of scope.");
+  }
+  return {
+    outcome: "hit",
+    reason: strike.reason as "unopposed" | "strikeWon",
+    response: input.response,
+    ...(input.defenseRoll === undefined ? {} : { defenseRoll: input.defenseRoll }),
+    critical: strike.critical,
+    damageMultiplier: strike.damageMultiplier,
+    damageRoll: input.damageRoll,
+    totalDamage,
+    route,
+  };
+}
diff --git a/packages/rules/src/engine/combat.ts b/packages/rules/src/engine/combat.ts
index d568848..cb7cd0f 100644
--- a/packages/rules/src/engine/combat.ts
+++ b/packages/rules/src/engine/combat.ts
@@ -146,9 +146,14 @@ export interface CombatProfileInput {
 export interface CombatProfile {
   attacksPerMelee: number;
   handToHandBonuses: CombatBonuses;
+  handToHandType: string;
+  hasHandToHandTraining: boolean;
+  hasAutoDodge: boolean;
   strike: number;
   parry: number;
   dodge: number;
+  rangedDodge: number;
+  rangedAutoDodge: number;
   damageBonus: number;
   initiative: number;
   autoDodge: number;
@@ -186,12 +191,19 @@ export function combatProfile(input: CombatProfileInput): CombatProfile {
   const hth = hthBonuses(input.hthType, input.level);
   const sum = (a: number | undefined, b: number | undefined): number => (a ?? 0) + (b ?? 0);
   const strike = sum(attr.strike, hth.strike);
+  const hasAutoDodge = hth.autoDodge !== undefined;
+  const rangedDodge = attr.dodge ?? 0;
   return {
     attacksPerMelee: attacksPerMelee(input.hthType, input.level),
     handToHandBonuses: hth,
+    handToHandType: input.hthType,
+    hasHandToHandTraining: input.hthType !== "none",
+    hasAutoDodge,
     strike,
     parry: sum(attr.parry, hth.parry),
     dodge: sum(attr.dodge, hth.dodge),
+    rangedDodge,
+    rangedAutoDodge: hasAutoDodge ? rangedDodge : 0,
     damageBonus: sum(attr.hthDamage, hth.damage),
     initiative: hth.initiative ?? 0,
     autoDodge: hth.autoDodge === undefined ? 0 : sum(attr.dodge, hth.autoDodge),
diff --git a/packages/rules/src/index.ts b/packages/rules/src/index.ts
index e6be9e6..1167dcf 100644
--- a/packages/rules/src/index.ts
+++ b/packages/rules/src/index.ts
@@ -8,6 +8,7 @@ export * from "./schema/skills.ts";
 export * from "./schema/spells.ts";
 export * from "./schema/items.ts";
 export * from "./schema/strike-resolution.ts";
+export * from "./schema/combat-exchange.ts";
 export * from "./schema/character.ts";
 export * from "./engine/alignments.ts";
 export * from "./engine/attributes.ts";
@@ -19,6 +20,7 @@ export * from "./engine/skills.ts";
 export * from "./engine/spells.ts";
 export * from "./engine/items.ts";
 export * from "./engine/strike-resolution.ts";
+export * from "./engine/combat-exchange.ts";
 export * from "./engine/character.ts";
 export * from "./engine/rolls.ts";
 export * from "./engine/builder.ts";
diff --git a/packages/rules/src/schema/combat-exchange.ts b/packages/rules/src/schema/combat-exchange.ts
new file mode 100644
index 0000000..cc564fb
--- /dev/null
+++ b/packages/rules/src/schema/combat-exchange.ts
@@ -0,0 +1,105 @@
+import { z } from "zod";
+
+export const attackKindSchema = z.enum(["melee", "ranged"]);
+export type AttackKind = z.infer<typeof attackKindSchema>;
+
+export const rangeBandSchema = z.enum(["pointBlank", "close", "normal"]);
+export type RangeBand = z.infer<typeof rangeBandSchema>;
+
+export const parryModeSchema = z.enum(["unavailable", "standard", "bareHanded"]);
+export type ParryMode = z.infer<typeof parryModeSchema>;
+
+const safeModifierSchema = z.number().int().safe().min(-100).max(100).optional();
+const modifierReasonSchema = z.string().trim().min(1).optional();
+const rawCombatContextSchema = z.discriminatedUnion("kind", [
+  z.object({
+    kind: z.literal("melee"),
+    defenderAware: z.boolean(),
+    parryMode: parryModeSchema,
+    strikeModifier: safeModifierSchema,
+    strikeModifierReason: modifierReasonSchema,
+  }),
+  z.object({
+    kind: z.literal("ranged"),
+    defenderAware: z.boolean(),
+    rangeBand: rangeBandSchema,
+    strikeModifier: safeModifierSchema,
+    strikeModifierReason: modifierReasonSchema,
+  }),
+]);
+
+export const combatContextSchema = rawCombatContextSchema.superRefine((context, check) => {
+  if ((context.strikeModifier ?? 0) !== 0 && context.strikeModifierReason === undefined) {
+    check.addIssue({
+      code: "custom",
+      path: ["strikeModifierReason"],
+      message: "A reason is required for a nonzero strike modifier.",
+    });
+  }
+});
+export type CombatContext = z.infer<typeof combatContextSchema>;
+
+export const combatResponseKindSchema = z.enum(["parry", "dodge", "autoDodge", "none"]);
+export type CombatResponseKind = z.infer<typeof combatResponseKindSchema>;
+
+const rawCombatResponseInputSchema = z.object({
+  kind: combatResponseKindSchema,
+  defenseModifier: safeModifierSchema,
+  defenseModifierReason: modifierReasonSchema,
+});
+export const combatResponseInputSchema = rawCombatResponseInputSchema.superRefine(
+  (response, check) => {
+    if (response.kind === "none" && (response.defenseModifier ?? 0) !== 0) {
+      check.addIssue({
+        code: "custom",
+        path: ["defenseModifier"],
+        message: "Take-the-hit cannot include a nonzero defense modifier.",
+      });
+    }
+    if ((response.defenseModifier ?? 0) !== 0 && response.defenseModifierReason === undefined) {
+      check.addIssue({
+        code: "custom",
+        path: ["defenseModifierReason"],
+        message: "A reason is required for a nonzero defense modifier.",
+      });
+    }
+  },
+);
+export type CombatResponseInput = z.infer<typeof combatResponseInputSchema>;
+
+export const combatExchangeErrorCodeSchema = z.enum([
+  "selfTarget",
+  "attackerNotReady",
+  "defenderNotReady",
+  "weaponMissingOrChanged",
+  "unsupportedWeaponMode",
+  "unsupportedMdWeapon",
+  "unsupportedMdcProtection",
+  "invalidContext",
+  "modifierReasonRequired",
+  "illegalDefense",
+  "exchangeNotPending",
+  "combatStateChanged",
+  "characterMissing",
+]);
+export type CombatExchangeErrorCode = z.infer<typeof combatExchangeErrorCodeSchema>;
+
+export const combatExchangeRulesSchema = z.object({
+  book: z.string().min(1),
+  pages: z.object({
+    armorAndVitals: z.literal(287),
+    sdcCombat: z.literal(339),
+    defense: z.literal(340),
+    damage: z.literal(341),
+    automaticDodge: z.literal(344),
+    modernWeapons: z.literal(360),
+    rangedDodging: z.literal(361),
+  }),
+  minimumStrikeTotal: z.object({ melee: z.literal(5), ranged: z.literal(8) }),
+  rangedDodgeModifier: z.object({
+    pointBlank: z.literal(-10),
+    close: z.literal(-5),
+    normal: z.literal(0),
+  }),
+});
+export type CombatExchangeRules = z.infer<typeof combatExchangeRulesSchema>;
diff --git a/packages/rules/tests/character.test.ts b/packages/rules/tests/character.test.ts
index 8d0da73..2696083 100644
--- a/packages/rules/tests/character.test.ts
+++ b/packages/rules/tests/character.test.ts
@@ -31,9 +31,14 @@ describe("deriveSheet — a level-1 Ley Line Walker", () => {
     expect(sheet.combat).toEqual({
       attacksPerMelee: 4,
       handToHandBonuses: { pullPunch: 2, rollWithImpact: 2 },
+      handToHandType: "basic",
+      hasHandToHandTraining: true,
+      hasAutoDodge: false,
       strike: 3,
       parry: 3,
       dodge: 3,
+      rangedDodge: 3,
+      rangedAutoDodge: 0,
       damageBonus: 1,
       initiative: 0,
       autoDodge: 0,
diff --git a/packages/rules/tests/combat-exchange.test.ts b/packages/rules/tests/combat-exchange.test.ts
new file mode 100644
index 0000000..fc33458
--- /dev/null
+++ b/packages/rules/tests/combat-exchange.test.ts
@@ -0,0 +1,1178 @@
+import { describe, expect, test } from "vite-plus/test";
+import {
+  attackerCombatStateToken,
+  armorSchema,
+  authorizeCombatResponse,
+  combatExchangeRules,
+  defenderCombatStateToken,
+  deriveAttackProfile,
+  deriveDefenseOptions,
+  deriveProtection,
+  deriveSheet,
+  evaluateDeclaration,
+  resolveCombatExchange,
+  routeSdcHit,
+  validateCombatContext,
+  type AttackProfile,
+  type CharacterInput,
+  type CharacterSheet,
+  type D20Roll,
+  type DamageRoll,
+  type ProtectionState,
+  type ResolveCombatExchangeInput,
+} from "../src/index.ts";
+
+const combatant: CharacterInput = {
+  name: "Vesper",
+  occId: "ley-line-walker",
+  level: 1,
+  attributes: { IQ: 18, ME: 16, MA: 12, PS: 16, PP: 20, PE: 14, PB: 11, Spd: 12 },
+  hthType: "basic",
+  skills: [
+    { skillId: "wilderness-survival", occBonus: 10 },
+    { skillId: "math-basic", occBonus: 10 },
+    { skillId: "land-navigation", occBonus: 4 },
+  ],
+  spellIds: ["globe-of-daylight", "energy-bolt", "armor-of-ithan"],
+  rolled: { hitPoints: 18, sdc: 20 },
+};
+
+const tokenBackstory = "TOKEN-SCOPE-SENTINEL: Vesper escaped the Ashwood rift.";
+const tokenItems = [
+  { itemId: "survival-knife" },
+  { itemId: "llw-concealed-light", worn: true, rolledMdc: 40 },
+] as const;
+const tokenCurrent = { hitPoints: 16, sdc: 18, ppe: 70, armor: 36 } as const;
+const tokenCombatant: CharacterInput = {
+  ...combatant,
+  narrative: { backstory: tokenBackstory },
+  items: [...tokenItems],
+  rolled: { hitPoints: 18, sdc: 20, ppe: 84 },
+  current: tokenCurrent,
+};
+
+function tokenSheet(overrides: Partial<CharacterInput> = {}): CharacterSheet {
+  return deriveSheet({ ...tokenCombatant, ...overrides });
+}
+
+function combatSheet(
+  overrides: Partial<Pick<CharacterInput, "items" | "hthType" | "level">>,
+): CharacterSheet {
+  return deriveSheet({ ...combatant, ...overrides });
+}
+
+function requireSupported(profile: AttackProfile): Extract<AttackProfile, { supported: true }> {
+  expect(profile.supported).toBe(true);
+  if (!profile.supported) throw new Error(`Expected a supported attack, got ${profile.reason}.`);
+  return profile;
+}
+
+function d20(die: number, bonus = 0, overrides: Partial<D20Roll> = {}): D20Roll {
+  return {
+    die,
+    bonus,
+    total: die + bonus,
+    naturalTwenty: die === 20,
+    naturalOne: die === 1,
+    ...overrides,
+  };
+}
+
+describe("combat exchange constants", () => {
+  test("loads rendered-page S.D.C. combat values", () => {
+    expect(combatExchangeRules).toEqual({
+      book: "Rifts Ultimate Edition",
+      pages: {
+        armorAndVitals: 287,
+        sdcCombat: 339,
+        defense: 340,
+        damage: 341,
+        automaticDodge: 344,
+        modernWeapons: 360,
+        rangedDodging: 361,
+      },
+      minimumStrikeTotal: { melee: 5, ranged: 8 },
+      rangedDodgeModifier: { pointBlank: -10, close: -5, normal: 0 },
+    });
+  });
+});
+
+describe("combat-state tokens", () => {
+  test("uses stable, explicitly ordered tuples for independently derived equivalent sheets", () => {
+    const first = tokenSheet();
+    const second = tokenSheet();
+    const entry = first.equipment[0]!;
+    const armor = first.armor!;
+    const attack = requireSupported(deriveAttackProfile(first, 0));
+    if (entry.item.kind !== "weapon") throw new Error("Expected the selected item to be a weapon.");
+
+    expect(first).not.toBe(second);
+    expect(attackerCombatStateToken(first, 0)).toBe(attackerCombatStateToken(second, 0));
+    expect(defenderCombatStateToken(first)).toBe(defenderCombatStateToken(second));
+    expect(JSON.parse(attackerCombatStateToken(first, 0))).toEqual([
+      "attacker-v2",
+      first.level,
+      [
+        first.attributes.IQ,
+        first.attributes.ME,
+        first.attributes.MA,
+        first.attributes.PS,
+        first.attributes.PP,
+        first.attributes.PE,
+        first.attributes.PB,
+        first.attributes.Spd,
+      ],
+      [
+        first.combat.handToHandType,
+        first.combat.strike,
+        first.combat.damageBonus,
+        first.combat.strikeGuns,
+        first.combat.criticalStrikeOn,
+      ],
+      [combatExchangeRules.book, [287, 339, 340, 341, 344, 360, 361], [5, 8], [-10, -5, 0]],
+      0,
+      [
+        "weapon",
+        entry.item.id,
+        entry.item.category,
+        entry.item.damage.formula,
+        entry.item.damage.type,
+        entry.item.page,
+        [false, null],
+      ],
+      [
+        "supported",
+        attack.kind,
+        attack.minimumStrikeTotal,
+        attack.strikeBonus,
+        attack.strikeBonusSources.map((source) => [source.source, source.label, source.value]),
+        attack.proficiencyBonus,
+        attack.damageFormula,
+        attack.damageBonus,
+        attack.criticalOn,
+        attack.damageType,
+        [
+          attack.weapon.index,
+          attack.weapon.itemId,
+          attack.weapon.name,
+          attack.weapon.category,
+          false,
+          null,
+        ],
+      ],
+    ]);
+    expect(JSON.parse(defenderCombatStateToken(first))).toEqual([
+      "defender-v1",
+      first.level,
+      [
+        first.attributes.IQ,
+        first.attributes.ME,
+        first.attributes.MA,
+        first.attributes.PS,
+        first.attributes.PP,
+        first.attributes.PE,
+        first.attributes.PB,
+        first.attributes.Spd,
+      ],
+      [
+        first.combat.handToHandType,
+        first.combat.hasHandToHandTraining,
+        first.combat.hasAutoDodge,
+        first.combat.parry,
+        first.combat.dodge,
+        first.combat.autoDodge,
+        first.combat.rangedDodge,
+        first.combat.rangedAutoDodge,
+      ],
+      [
+        first.vitals.sdc.rolled,
+        first.vitals.sdc.current,
+        first.vitals.hitPoints.rolled,
+        first.vitals.hitPoints.current,
+        first.vitals.comaDeathFloor,
+      ],
+      [armor.item.id, "mdc", null, armor.max, armor.current],
+    ]);
+  });
+
+  test("ignores narrative, P.P.E., and unrelated inventory without leaking backstory", () => {
+    const base = tokenSheet();
+    const baseAttacker = attackerCombatStateToken(base, 0);
+    const baseDefender = defenderCombatStateToken(base);
+    const irrelevantVariants = [
+      tokenSheet({ narrative: { backstory: "A completely different history." } }),
+      tokenSheet({ current: { ...tokenCurrent, ppe: 69 } }),
+      tokenSheet({ items: [...tokenItems, { itemId: "canteen" }] }),
+    ];
+
+    for (const variant of irrelevantVariants) {
+      expect(attackerCombatStateToken(variant, 0)).toBe(baseAttacker);
+      expect(defenderCombatStateToken(variant)).toBe(baseDefender);
+    }
+    expect(baseAttacker).not.toContain(tokenBackstory);
+    expect(baseDefender).not.toContain(tokenBackstory);
+  });
+
+  test("stales attacks for every attacker-derived dimension and selected weapon change", () => {
+    const base = tokenSheet();
+    const baseToken = attackerCombatStateToken(base, 0);
+    const attributeOrder = ["IQ", "ME", "MA", "PS", "PP", "PE", "PB", "Spd"] as const;
+
+    expect(attackerCombatStateToken(tokenSheet({ level: 2 }), 0)).not.toBe(baseToken);
+    for (const code of attributeOrder) {
+      const changed = tokenSheet({
+        attributes: { ...tokenCombatant.attributes, [code]: tokenCombatant.attributes[code] + 1 },
+      });
+      expect(attackerCombatStateToken(changed, 0)).not.toBe(baseToken);
+    }
+
+    expect(attackerCombatStateToken(tokenSheet({ hthType: "none" }), 0)).not.toBe(baseToken);
+    const changedCombatProfiles = [
+      { handToHandType: "none" },
+      { strike: base.combat.strike + 1 },
+      { damageBonus: base.combat.damageBonus + 1 },
+      { strikeGuns: base.combat.strikeGuns + 1 },
+      { criticalStrikeOn: base.combat.criticalStrikeOn - 1 },
+    ];
+    for (const combatChange of changedCombatProfiles) {
+      const changed = { ...base, combat: { ...base.combat, ...combatChange } };
+      expect(attackerCombatStateToken(changed, 0)).not.toBe(baseToken);
+    }
+
+    expect(attackerCombatStateToken(base, 1)).not.toBe(baseToken);
+    const changedWeapon = tokenSheet({
+      items: [{ itemId: "hand-axe" }, tokenItems[1]],
+    });
+    expect(attackerCombatStateToken(changedWeapon, 0)).not.toBe(baseToken);
+  });
+
+  test("stales attacks for selected instance state but not appended inventory", () => {
+    const bodyCurrent = { hitPoints: 16, sdc: 18, ppe: 70 } as const;
+    const selectedWorn = tokenSheet();
+    const selectedUnworn = tokenSheet({
+      items: [tokenItems[0], { itemId: "llw-concealed-light", rolledMdc: 40 }],
+      current: bodyCurrent,
+    });
+    const changedRoll = tokenSheet({
+      items: [tokenItems[0], { itemId: "llw-concealed-light", rolledMdc: 41 }],
+      current: bodyCurrent,
+    });
+    const appendedInventory = tokenSheet({ items: [...tokenItems, { itemId: "canteen" }] });
+
+    expect(attackerCombatStateToken(selectedWorn, 1)).not.toBe(
+      attackerCombatStateToken(selectedUnworn, 1),
+    );
+    expect(attackerCombatStateToken(selectedUnworn, 1)).not.toBe(
+      attackerCombatStateToken(changedRoll, 1),
+    );
+    expect(attackerCombatStateToken(appendedInventory, 0)).toBe(
+      attackerCombatStateToken(selectedWorn, 0),
+    );
+  });
+
+  test("fingerprints selected weapon mechanics, attack sources, and page-stamped rules", () => {
+    const base = tokenSheet();
+    const selected = base.equipment[0]!;
+    if (selected.item.kind !== "weapon")
+      throw new Error("Expected the selected test item to be a weapon.");
+    const baseToken = attackerCombatStateToken(base, 0);
+    const withWeapon = (item: typeof selected.item): CharacterSheet => ({
+      ...base,
+      equipment: [{ ...selected, item }, ...base.equipment.slice(1)],
+    });
+    const changedSources: CharacterSheet = {
+      ...base,
+      attributeBonuses: {
+        ...base.attributeBonuses,
+        strike: (base.attributeBonuses.strike ?? 0) + 1,
+      },
+      combat: {
+        ...base.combat,
+        handToHandBonuses: {
+          ...base.combat.handToHandBonuses,
+          strike: (base.combat.handToHandBonuses.strike ?? 0) - 1,
+        },
+      },
+    };
+    const changedRules = {
+      ...combatExchangeRules,
+      pages: { ...combatExchangeRules.pages, sdcCombat: 340 },
+      minimumStrikeTotal: { ...combatExchangeRules.minimumStrikeTotal, melee: 6 },
+    } as unknown as typeof combatExchangeRules;
+
+    expect(
+      attackerCombatStateToken(
+        withWeapon({
+          ...selected.item,
+          damage: { ...selected.item.damage, formula: "2D6" },
+        }),
+        0,
+      ),
+    ).not.toBe(baseToken);
+    expect(attackerCombatStateToken(withWeapon({ ...selected.item, category: "axe" }), 0)).not.toBe(
+      baseToken,
+    );
+    expect(
+      attackerCombatStateToken(
+        withWeapon({
+          ...selected.item,
+          damage: { ...selected.item.damage, type: "md" },
+        }),
+        0,
+      ),
+    ).not.toBe(baseToken);
+    expect(attackerCombatStateToken(changedSources, 0)).not.toBe(baseToken);
+    expect(attackerCombatStateToken(base, 0, changedRules)).not.toBe(baseToken);
+  });
+
+  test("stales defenses for level, every attribute, and every defense-profile dimension", () => {
+    const base = tokenSheet();
+    const baseToken = defenderCombatStateToken(base);
+    const attributeOrder = ["IQ", "ME", "MA", "PS", "PP", "PE", "PB", "Spd"] as const;
+
+    expect(defenderCombatStateToken(tokenSheet({ level: 2 }))).not.toBe(baseToken);
+    for (const code of attributeOrder) {
+      const changed = tokenSheet({
+        attributes: { ...tokenCombatant.attributes, [code]: tokenCombatant.attributes[code] + 1 },
+      });
+      expect(defenderCombatStateToken(changed)).not.toBe(baseToken);
+    }
+
+    expect(defenderCombatStateToken(tokenSheet({ hthType: "none" }))).not.toBe(baseToken);
+    const changedCombatProfiles = [
+      { handToHandType: "none" },
+      { hasHandToHandTraining: !base.combat.hasHandToHandTraining },
+      { hasAutoDodge: !base.combat.hasAutoDodge },
+      { parry: base.combat.parry + 1 },
+      { dodge: base.combat.dodge + 1 },
+      { autoDodge: base.combat.autoDodge + 1 },
+      { rangedDodge: base.combat.rangedDodge + 1 },
+      { rangedAutoDodge: base.combat.rangedAutoDodge + 1 },
+    ];
+    for (const combatChange of changedCombatProfiles) {
+      const changed = { ...base, combat: { ...base.combat, ...combatChange } };
+      expect(defenderCombatStateToken(changed)).not.toBe(baseToken);
+    }
+  });
+
+  test("stales defenses for every rolled/current body pool and the coma floor", () => {
+    const base = tokenSheet();
+    const baseToken = defenderCombatStateToken(base);
+    const changedVitals = [
+      { ...base.vitals, sdc: { ...base.vitals.sdc, rolled: base.vitals.sdc.rolled! + 1 } },
+      { ...base.vitals, sdc: { ...base.vitals.sdc, current: base.vitals.sdc.current! - 1 } },
+      {
+        ...base.vitals,
+        hitPoints: { ...base.vitals.hitPoints, rolled: base.vitals.hitPoints.rolled! + 1 },
+      },
+      {
+        ...base.vitals,
+        hitPoints: { ...base.vitals.hitPoints, current: base.vitals.hitPoints.current! - 1 },
+      },
+      { ...base.vitals, comaDeathFloor: base.vitals.comaDeathFloor - 1 },
+    ];
+
+    for (const vitals of changedVitals) {
+      expect(defenderCombatStateToken({ ...base, vitals })).not.toBe(baseToken);
+    }
+  });
+
+  test("stales defenses for complete worn-protection identity, tier, rating, and pools", () => {
+    const base = tokenSheet();
+    const sdcArmor = armorSchema.parse({
+      kind: "armor",
+      id: "token-sdc-armor",
+      name: "Token S.D.C. Armor",
+      ar: 12,
+      sdc: 30,
+      page: 287,
+    });
+    const baseArmor = { item: sdcArmor, max: 30, current: 25 };
+    const armored = { ...base, armor: baseArmor };
+    const baseToken = defenderCombatStateToken(armored);
+    const changedArmorStates: NonNullable<CharacterSheet["armor"]>[] = [
+      {
+        ...baseArmor,
+        item: armorSchema.parse({ ...sdcArmor, id: "token-sdc-armor-2" }),
+      },
+      {
+        item: armorSchema.parse({ ...sdcArmor, sdc: 31 }),
+        max: 31,
+        current: 25,
+      },
+      { ...baseArmor, current: 24 },
+      {
+        item: armorSchema.parse({
+          kind: "armor",
+          id: sdcArmor.id,
+          name: sdcArmor.name,
+          mdc: { mainBody: "30" },
+          page: 287,
+        }),
+        max: 30,
+        current: 25,
+      },
+      {
+        ...baseArmor,
+        item: armorSchema.parse({ ...sdcArmor, ar: 13 }),
+      },
+    ];
+
+    for (const armor of changedArmorStates) {
+      expect(defenderCombatStateToken({ ...armored, armor })).not.toBe(baseToken);
+    }
+  });
+});
+
+describe("weapon attack profiles", () => {
+  test("classifies real S.D.C. melee and firearm instances", () => {
+    const sheet = combatSheet({
+      items: [{ itemId: "survival-knife" }, { itemId: "automatic-pistol" }],
+    });
+    expect(deriveAttackProfile(sheet, 0)).toMatchObject({
+      supported: true,
+      kind: "melee",
+      minimumStrikeTotal: 5,
+      strikeBonus: 3,
+      damageFormula: "1D6",
+      damageBonus: 1,
+      criticalOn: 20,
+      damageType: "sdc",
+    });
+    expect(deriveAttackProfile(sheet, 1)).toMatchObject({
+      supported: true,
+      kind: "ranged",
+      minimumStrikeTotal: 8,
+      strikeBonus: 0,
+      proficiencyBonus: 0,
+      damageFormula: "4D6",
+      damageBonus: 0,
+      criticalOn: 20,
+      damageType: "sdc",
+    });
+  });
+
+  test("refuses M.D. weapons and non-weapons without inventing modes", () => {
+    const sheet = combatSheet({
+      items: [{ itemId: "wilks-320-laser-pistol" }, { itemId: "canteen" }],
+    });
+    expect(deriveAttackProfile(sheet, 0)).toMatchObject({
+      supported: false,
+      reason: "unsupportedMdWeapon",
+    });
+    expect(deriveAttackProfile(sheet, 1)).toMatchObject({
+      supported: false,
+      reason: "unsupportedWeaponMode",
+    });
+    expect(deriveAttackProfile(sheet, 99)).toEqual({
+      supported: false,
+      reason: "weaponMissingOrChanged",
+    });
+  });
+});
+
+describe("combat context validation", () => {
+  test("requires reasons for nonzero GM modifiers and rejects kind mismatch", () => {
+    const profile = requireSupported(
+      deriveAttackProfile(combatSheet({ items: [{ itemId: "survival-knife" }] }), 0),
+    );
+    expect(() =>
+      validateCombatContext(profile, {
+        kind: "melee",
+        defenderAware: true,
+        parryMode: "standard",
+        strikeModifier: 1,
+      }),
+    ).toThrow(/reason/i);
+    expect(() =>
+      validateCombatContext(profile, {
+        kind: "ranged",
+        defenderAware: true,
+        rangeBand: "normal",
+      }),
+    ).toThrow(/kind/i);
+  });
+
+  test("rejects unsafe, out-of-range, and unjustified modifiers", () => {
+    const profile = requireSupported(
+      deriveAttackProfile(combatSheet({ items: [{ itemId: "survival-knife" }] }), 0),
+    );
+    const context = {
+      kind: "melee",
+      defenderAware: true,
+      parryMode: "standard",
+      strikeModifierReason: "higher ground",
+    } as const;
+
+    expect(() =>
+      validateCombatContext(profile, { ...context, strikeModifier: Number.MAX_SAFE_INTEGER + 1 }),
+    ).toThrow();
+    expect(() => validateCombatContext(profile, { ...context, strikeModifier: 101 })).toThrow();
+    expect(() =>
+      validateCombatContext(profile, {
+        ...context,
+        strikeModifier: -1,
+        strikeModifierReason: "   ",
+      }),
+    ).toThrow(/string|reason/i);
+  });
+});
+
+describe("defense option derivation", () => {
+  const meleeAttack = requireSupported(
+    deriveAttackProfile(combatSheet({ items: [{ itemId: "survival-knife" }] }), 0),
+  );
+  const rangedAttack = requireSupported(
+    deriveAttackProfile(combatSheet({ items: [{ itemId: "automatic-pistol" }] }), 0),
+  );
+
+  test("offers aware trained melee defenders parry, dodge, then none", () => {
+    const defender = combatSheet({ items: [], hthType: "basic" });
+
+    expect(
+      deriveDefenseOptions(defender, meleeAttack, {
+        kind: "melee",
+        defenderAware: true,
+        parryMode: "standard",
+      }),
+    ).toEqual([
+      {
+        kind: "parry",
+        bonus: 3,
+        actionCost: 0,
+        explanation: "Parry the melee weapon.",
+      },
+      {
+        kind: "dodge",
+        bonus: 3,
+        actionCost: 1,
+        explanation: "Dodge; costs one action for table tracking.",
+      },
+      { kind: "none", bonus: 0, actionCost: 0, explanation: "Take the hit." },
+    ]);
+  });
+
+  test("charges an action for untrained standard parry but not trained standard parry", () => {
+    const context = {
+      kind: "melee",
+      defenderAware: true,
+      parryMode: "standard",
+    } as const;
+    const trained = combatSheet({ items: [], hthType: "basic" });
+    const untrained = combatSheet({ items: [], hthType: "none" });
+
+    expect(deriveDefenseOptions(trained, meleeAttack, context)[0]).toMatchObject({
+      kind: "parry",
+      actionCost: 0,
+    });
+    expect(deriveDefenseOptions(untrained, meleeAttack, context)[0]).toMatchObject({
+      kind: "parry",
+      actionCost: 1,
+    });
+  });
+
+  test("uses zero ordinary parry bonus for a bare-handed weapon parry", () => {
+    const defender = combatSheet({ items: [], hthType: "basic" });
+
+    expect(
+      deriveDefenseOptions(defender, meleeAttack, {
+        kind: "melee",
+        defenderAware: true,
+        parryMode: "bareHanded",
+      })[0],
+    ).toEqual({
+      kind: "parry",
+      bonus: 0,
+      actionCost: 0,
+      explanation: "Bare-handed weapon parry; no ordinary parry bonus.",
+    });
+  });
+
+  test("withholds ordinary defenses from unaware melee defenders but retains auto-dodge", () => {
+    const basic = combatSheet({ items: [], hthType: "basic" });
+    const commando = combatSheet({ items: [], hthType: "commando", level: 15 });
+    const context = {
+      kind: "melee",
+      defenderAware: false,
+      parryMode: "standard",
+    } as const;
+
+    expect(deriveDefenseOptions(basic, meleeAttack, context)).toEqual([
+      { kind: "none", bonus: 0, actionCost: 0, explanation: "Take the hit." },
+    ]);
+    expect(deriveDefenseOptions(commando, meleeAttack, context)).toEqual([
+      {
+        kind: "autoDodge",
+        bonus: 8,
+        actionCost: 0,
+        explanation: "Automatic dodge; no action cost.",
+      },
+      { kind: "none", bonus: 0, actionCost: 0, explanation: "Take the hit." },
+    ]);
+  });
+
+  test("offers aware ranged defenders only ranged dodge-family options and none", () => {
+    const basic = combatSheet({ items: [], hthType: "basic" });
+    const commando = combatSheet({ items: [], hthType: "commando", level: 15 });
+    const context = {
+      kind: "ranged",
+      defenderAware: true,
+      rangeBand: "normal",
+    } as const;
+
+    expect(deriveDefenseOptions(basic, rangedAttack, context)).toEqual([
+      {
+        kind: "dodge",
+        bonus: 3,
+        actionCost: 1,
+        explanation: "Ranged dodge (0 range-band modifier).",
+      },
+      { kind: "none", bonus: 0, actionCost: 0, explanation: "Take the hit." },
+    ]);
+    expect(deriveDefenseOptions(commando, rangedAttack, context)).toEqual([
+      {
+        kind: "dodge",
+        bonus: 3,
+        actionCost: 1,
+        explanation: "Ranged dodge (0 range-band modifier).",
+      },
+      {
+        kind: "autoDodge",
+        bonus: 3,
+        actionCost: 0,
+        explanation: "Automatic ranged dodge (0 range-band modifier).",
+      },
+      { kind: "none", bonus: 0, actionCost: 0, explanation: "Take the hit." },
+    ]);
+  });
+
+  test.each([
+    ["pointBlank", -10],
+    ["close", -5],
+    ["normal", 0],
+  ] as const)("applies the %s penalty to both ranged dodge families", (rangeBand, penalty) => {
+    const commando = combatSheet({ items: [], hthType: "commando", level: 15 });
+    const options = deriveDefenseOptions(commando, rangedAttack, {
+      kind: "ranged",
+      defenderAware: true,
+      rangeBand,
+    });
+
+    expect(options.slice(0, 2).map((option) => option.bonus)).toEqual([
+      commando.combat.rangedDodge + penalty,
+      commando.combat.rangedAutoDodge + penalty,
+    ]);
+  });
+
+  test("offers unaware ranged defenders none even when they have auto-dodge", () => {
+    const commando = combatSheet({ items: [], hthType: "commando", level: 15 });
+
+    expect(
+      deriveDefenseOptions(commando, rangedAttack, {
+        kind: "ranged",
+        defenderAware: false,
+        rangeBand: "normal",
+      }),
+    ).toEqual([{ kind: "none", bonus: 0, actionCost: 0, explanation: "Take the hit." }]);
+  });
+
+  test("rejects a context that does not match the attack kind", () => {
+    const defender = combatSheet({ items: [], hthType: "basic" });
+
+    expect(() =>
+      deriveDefenseOptions(defender, meleeAttack, {
+        kind: "ranged",
+        defenderAware: true,
+        rangeBand: "normal",
+      }),
+    ).toThrow(/invalidContext/);
+  });
+});
+
+describe("combat response authorization", () => {
+  const defender = combatSheet({ items: [], hthType: "basic" });
+  const meleeAttack = requireSupported(
+    deriveAttackProfile(combatSheet({ items: [{ itemId: "survival-knife" }] }), 0),
+  );
+  const options = deriveDefenseOptions(defender, meleeAttack, {
+    kind: "melee",
+    defenderAware: true,
+    parryMode: "standard",
+  });
+
+  test("uses server-derived option metadata and normalizes the situational modifier", () => {
+    expect(
+      authorizeCombatResponse(options, {
+        kind: "parry",
+        bonus: 99,
+        actionCost: 1,
+        defenseModifier: -2,
+        defenseModifierReason: "unstable footing",
+      }),
+    ).toEqual({
+      kind: "parry",
+      bonus: 3,
+      actionCost: 0,
+      explanation: "Parry the melee weapon.",
+      defenseModifier: -2,
+      defenseModifierReason: "unstable footing",
+      totalBonus: 1,
+    });
+    expect(authorizeCombatResponse(options, { kind: "none" })).toEqual({
+      kind: "none",
+      bonus: 0,
+      actionCost: 0,
+      explanation: "Take the hit.",
+      defenseModifier: 0,
+      totalBonus: 0,
+    });
+  });
+
+  test("requires a reason for every nonzero defense modifier", () => {
+    expect(() => authorizeCombatResponse(options, { kind: "dodge", defenseModifier: 1 })).toThrow(
+      /reason/i,
+    );
+    expect(() =>
+      authorizeCombatResponse(options, {
+        kind: "dodge",
+        defenseModifier: -1,
+        defenseModifierReason: "   ",
+      }),
+    ).toThrow(/string|reason/i);
+  });
+
+  test("rejects a nonzero defense modifier when taking the hit", () => {
+    expect(() =>
+      authorizeCombatResponse(options, {
+        kind: "none",
+        defenseModifier: 1,
+        defenseModifierReason: "GM ruling",
+      }),
+    ).toThrow(/take-the-hit.*defense modifier/i);
+  });
+
+  test("rejects unsafe, fractional, and out-of-range defense modifiers", () => {
+    const response = {
+      kind: "dodge",
+      defenseModifierReason: "situational ruling",
+    } as const;
+
+    expect(() =>
+      authorizeCombatResponse(options, {
+        ...response,
+        defenseModifier: Number.MAX_SAFE_INTEGER + 1,
+      }),
+    ).toThrow();
+    expect(() => authorizeCombatResponse(options, { ...response, defenseModifier: 1.5 })).toThrow();
+    expect(() => authorizeCombatResponse(options, { ...response, defenseModifier: 101 })).toThrow();
+  });
+
+  test("rejects defenses outside the derived list and never defaults to none", () => {
+    expect(() => authorizeCombatResponse(options, { kind: "autoDodge" })).toThrow(
+      /illegalDefense: autoDodge/,
+    );
+    expect(() => authorizeCombatResponse(options, {})).toThrow();
+  });
+});
+
+describe("declaration evaluation", () => {
+  test("applies the melee and ranged declaration minimums after bonuses", () => {
+    expect(evaluateDeclaration(d20(4), 5)).toEqual({
+      status: "miss",
+      reason: "belowMinimum",
+    });
+    expect(evaluateDeclaration(d20(5), 5)).toEqual({ status: "pendingDefense" });
+    expect(evaluateDeclaration(d20(7), 8)).toEqual({
+      status: "miss",
+      reason: "belowMinimum",
+    });
+    expect(evaluateDeclaration(d20(8), 8)).toEqual({ status: "pendingDefense" });
+  });
+
+  test("a natural 1 misses and malformed completed rolls use resolver validation", () => {
+    expect(evaluateDeclaration(d20(1, 100), 5)).toEqual({
+      status: "miss",
+      reason: "naturalOne",
+    });
+    expect(() => evaluateDeclaration(d20(5, 0, { total: 99 }), 5)).toThrow(/total.*die.*bonus/i);
+  });
+});
+
+describe("protection classification", () => {
+  test("derives no protection for an unarmored sheet", () => {
+    expect(deriveProtection(combatSheet({ items: [] }))).toEqual({ kind: "none" });
+  });
+
+  test("classifies fixed and unrolled dice-capacity M.D.C. suits without conversion", () => {
+    expect(deriveProtection(combatSheet({ items: [{ itemId: "gladiator", worn: true }] }))).toEqual(
+      {
+        kind: "mdcArmor",
+        itemId: "gladiator",
+        name: "Gladiator Full Environmental Body Armor",
+        max: 70,
+        current: 70,
+      },
+    );
+    expect(
+      deriveProtection(combatSheet({ items: [{ itemId: "llw-concealed-light", worn: true }] })),
+    ).toEqual({
+      kind: "mdcArmor",
+      itemId: "llw-concealed-light",
+      name: "Ley Line Walker Concealed Armor (Light)",
+    });
+  });
+});
+
+describe("S.D.C. hit routing", () => {
+  const fixture = armorSchema.parse({
+    kind: "armor",
+    id: "test-sdc-armor",
+    name: "Validated S.D.C. Armor Fixture",
+    ar: 12,
+    sdc: 30,
+    page: 287,
+  });
+  const armor: ProtectionState = {
+    kind: "sdcArmor",
+    itemId: fixture.id,
+    name: fixture.name,
+    ar: fixture.ar!,
+    max: fixture.sdc!,
+    current: 5,
+  };
+
+  test("a strike at A.R. ablates armor without spilling destruction damage", () => {
+    expect(
+      routeSdcHit({
+        strikeTotal: 12,
+        damage: 9,
+        protection: armor,
+        body: { sdc: 10, hitPoints: 20 },
+        comaDeathFloor: -10,
+      }),
+    ).toEqual({
+      kind: "armor",
+      armor: { before: 5, after: 0 },
+      body: {
+        before: { sdc: 10, hitPoints: 20 },
+        after: { sdc: 10, hitPoints: 20 },
+      },
+    });
+  });
+
+  test("a strike above A.R. routes the full hit to the body without changing armor", () => {
+    expect(
+      routeSdcHit({
+        strikeTotal: 13,
+        damage: 9,
+        protection: armor,
+        body: { sdc: 10, hitPoints: 20 },
+        comaDeathFloor: -10,
+      }),
+    ).toEqual({
+      kind: "body",
+      armor: { before: 5, after: 5 },
+      body: {
+        before: { sdc: 10, hitPoints: 20 },
+        after: { sdc: 1, hitPoints: 20 },
+      },
+    });
+  });
+
+  test("depleted armor routes future hits through body S.D.C. before Hit Points", () => {
+    expect(
+      routeSdcHit({
+        strikeTotal: 12,
+        damage: 5,
+        protection: { ...armor, current: 0 },
+        body: { sdc: 3, hitPoints: 20 },
+        comaDeathFloor: -10,
+      }),
+    ).toEqual({
+      kind: "body",
+      armor: { before: 0, after: 0 },
+      body: {
+        before: { sdc: 3, hitPoints: 20 },
+        after: { sdc: 0, hitPoints: 18 },
+      },
+    });
+  });
+
+  test("refuses M.D.C. protection instead of converting the hit", () => {
+    expect(
+      routeSdcHit({
+        strikeTotal: 20,
+        damage: 100,
+        protection: {
+          kind: "mdcArmor",
+          itemId: "gladiator",
+          name: "Gladiator Full Environmental Body Armor",
+          max: 70,
+          current: 70,
+        },
+        body: { sdc: 10, hitPoints: 20 },
+        comaDeathFloor: -10,
+      }),
+    ).toEqual({ kind: "unsupportedMdcProtection" });
+  });
+});
+
+describe("completed pure combat exchanges", () => {
+  const defender = combatSheet({ items: [], hthType: "basic" });
+  const meleeAttack = requireSupported(
+    deriveAttackProfile(combatSheet({ items: [{ itemId: "survival-knife" }] }), 0),
+  );
+  const meleeContext = {
+    kind: "melee",
+    defenderAware: true,
+    parryMode: "standard",
+  } as const;
+  const meleeOptions = deriveDefenseOptions(defender, meleeAttack, meleeContext);
+  const noneResponse = authorizeCombatResponse(meleeOptions, { kind: "none" });
+  const parryResponse = authorizeCombatResponse(meleeOptions, { kind: "parry" });
+  const dodgeResponse = authorizeCombatResponse(meleeOptions, { kind: "dodge" });
+  const damageRoll: DamageRoll = { dice: [4], bonus: 1, total: 5 };
+  const unopposedMelee = {
+    attack: meleeAttack,
+    context: meleeContext,
+    strikeRoll: d20(12, meleeAttack.strikeBonus),
+    response: noneResponse,
+    protection: { kind: "none" },
+    body: { sdc: 10, hitPoints: 20 },
+    comaDeathFloor: -10,
+  } satisfies Omit<ResolveCombatExchangeInput, "damageRoll">;
+
+  test("a declaration miss returns before defense or damage", () => {
+    expect(
+      resolveCombatExchange({
+        ...unopposedMelee,
+        context: {
+          ...meleeContext,
+          strikeModifier: -2,
+          strikeModifierReason: "poor footing",
+        },
+        strikeRoll: d20(3, 1),
+      }),
+    ).toEqual({
+      outcome: "miss",
+      reason: "belowMinimum",
+      critical: false,
+      damageMultiplier: 1,
+    });
+  });
+
+  test.each([
+    ["parry", parryResponse, "parried"],
+    ["dodge", dodgeResponse, "dodged"],
+  ] as const)("an equal-total %s favors the defender", (_kind, response, reason) => {
+    const defenseRoll = d20(12, response.totalBonus);
+    expect(
+      resolveCombatExchange({
+        ...unopposedMelee,
+        response,
+        defenseRoll,
+      }),
+    ).toEqual({
+      outcome: "defended",
+      reason,
+      response,
+      defenseRoll,
+      critical: false,
+      damageMultiplier: 1,
+    });
+  });
+
+  test("a natural-20 defense beats a natural-20 strike through resolveStrike", () => {
+    const strikeRoll = d20(20, meleeAttack.strikeBonus);
+    const defenseRoll = d20(20, dodgeResponse.totalBonus);
+    expect(
+      resolveCombatExchange({
+        ...unopposedMelee,
+        strikeRoll,
+        response: dodgeResponse,
+        defenseRoll,
+      }),
+    ).toMatchObject({
+      outcome: "defended",
+      reason: "dodged",
+      defenseRoll,
+      critical: false,
+      damageMultiplier: 1,
+    });
+  });
+
+  test("none resolves an ordinary unopposed hit and routes its damage", () => {
+    expect(resolveCombatExchange({ ...unopposedMelee, damageRoll })).toEqual({
+      outcome: "hit",
+      reason: "unopposed",
+      response: noneResponse,
+      critical: false,
+      damageMultiplier: 1,
+      damageRoll,
+      totalDamage: 5,
+      route: {
+        kind: "body",
+        body: {
+          before: { sdc: 10, hitPoints: 20 },
+          after: { sdc: 5, hitPoints: 20 },
+        },
+      },
+    });
+  });
+
+  test("melee damage applies its flat bonus before the critical multiplier", () => {
+    expect(
+      resolveCombatExchange({
+        ...unopposedMelee,
+        strikeRoll: d20(20, meleeAttack.strikeBonus),
+        damageRoll,
+      }),
+    ).toMatchObject({
+      outcome: "hit",
+      critical: true,
+      damageMultiplier: 2,
+      damageRoll: { dice: [4], bonus: 1, total: 5 },
+      totalDamage: 10,
+      route: {
+        kind: "body",
+        body: { after: { sdc: 0, hitPoints: 20 } },
+      },
+    });
+  });
+
+  test("firearm damage carries no P.S. or Hand-to-Hand flat bonus", () => {
+    const attack = requireSupported(
+      deriveAttackProfile(combatSheet({ items: [{ itemId: "automatic-pistol" }] }), 0),
+    );
+    const context = {
+      kind: "ranged",
+      defenderAware: false,
+      rangeBand: "normal",
+    } as const;
+    const response = authorizeCombatResponse(deriveDefenseOptions(defender, attack, context), {
+      kind: "none",
+    });
+    const firearmDamage: DamageRoll = { dice: [1, 2, 3, 4], bonus: 0, total: 10 };
+
+    expect(
+      resolveCombatExchange({
+        attack,
+        context,
+        strikeRoll: d20(10, attack.strikeBonus),
+        response,
+        damageRoll: firearmDamage,
+        protection: { kind: "none" },
+        body: { sdc: 20, hitPoints: 20 },
+        comaDeathFloor: -10,
+      }),
+    ).toMatchObject({
+      outcome: "hit",
+      damageRoll: { bonus: 0 },
+      totalDamage: 10,
+      route: { body: { after: { sdc: 10, hitPoints: 20 } } },
+    });
+  });
+
+  test("requires exactly the defense roll authorized by the response", () => {
+    expect(() => resolveCombatExchange({ ...unopposedMelee, response: parryResponse })).toThrow(
+      /parry requires a completed defense roll/i,
+    );
+    expect(() =>
+      resolveCombatExchange({
+        ...unopposedMelee,
+        defenseRoll: d20(12, parryResponse.totalBonus),
+      }),
+    ).toThrow(/Take-the-hit cannot contain a defense roll/i);
+    expect(() =>
+      resolveCombatExchange({
+        ...unopposedMelee,
+        response: parryResponse,
+        defenseRoll: d20(12, parryResponse.totalBonus + 1),
+      }),
+    ).toThrow(/Defense bonus must be 3/i);
+  });
+
+  test("requires the server-derived strike bonus", () => {
+    expect(() =>
+      resolveCombatExchange({
+        ...unopposedMelee,
+        strikeRoll: d20(12, meleeAttack.strikeBonus + 1),
+        damageRoll,
+      }),
+    ).toThrow(/Strike bonus must be 3/i);
+  });
+
+  test("requires damage only for a hit", () => {
+    expect(() => resolveCombatExchange(unopposedMelee)).toThrow(
+      /hit requires a completed damage roll/i,
+    );
+    expect(() =>
+      resolveCombatExchange({
+        ...unopposedMelee,
+        context: {
+          ...meleeContext,
+          strikeModifier: -2,
+          strikeModifierReason: "poor footing",
+        },
+        strikeRoll: d20(3, 1),
+        damageRoll,
+      }),
+    ).toThrow(/missed declaration cannot contain defense or damage rolls/i);
+    expect(() =>
+      resolveCombatExchange({
+        ...unopposedMelee,
+        response: parryResponse,
+        defenseRoll: d20(12, parryResponse.totalBonus),
+        damageRoll,
+      }),
+    ).toThrow(/defended attack cannot contain damage/i);
+  });
+
+  test("validates the completed damage bonus, dice, faces, and total", () => {
+    expect(() =>
+      resolveCombatExchange({
+        ...unopposedMelee,
+        damageRoll: { dice: [4], bonus: 0, total: 4 },
+      }),
+    ).toThrow(/Damage bonus must be 1/i);
+    expect(() =>
+      resolveCombatExchange({
+        ...unopposedMelee,
+        damageRoll: { dice: [2, 3], bonus: 1, total: 6 },
+      }),
+    ).toThrow(/Damage roll requires 1 dice/i);
+    expect(() =>
+      resolveCombatExchange({
+        ...unopposedMelee,
+        damageRoll: { dice: [7], bonus: 1, total: 8 },
+      }),
+    ).toThrow(/Damage dice must be integers from 1 to 6/i);
+    expect(() =>
+      resolveCombatExchange({
+        ...unopposedMelee,
+        damageRoll: { dice: [2.5], bonus: 1, total: 3.5 },
+      }),
+    ).toThrow(/Damage dice must be integers from 1 to 6/i);
+    expect(() =>
+      resolveCombatExchange({
+        ...unopposedMelee,
+        damageRoll: { dice: [4], bonus: 1, total: 99 },
+      }),
+    ).toThrow(/Damage total must be 5/i);
+  });
+
+  test("rejects M.D.C. protection before producing an S.D.C. route", () => {
+    expect(() =>
+      resolveCombatExchange({
+        ...unopposedMelee,
+        protection: {
+          kind: "mdcArmor",
+          itemId: "gladiator",
+          name: "Gladiator Full Environmental Body Armor",
+          max: 70,
+          current: 70,
+        },
+      }),
+    ).toThrow(/unsupportedMdcProtection.*out of scope/i);
+  });
+});
diff --git a/packages/rules/tests/combat.test.ts b/packages/rules/tests/combat.test.ts
index b998c8b..fa9242c 100644
--- a/packages/rules/tests/combat.test.ts
+++ b/packages/rules/tests/combat.test.ts
@@ -319,6 +319,28 @@ describe("combatProfile integrates attributes + Hand to Hand", () => {
     expect(p.criticalStrikeOn).toBe(17);
   });
 
+  test("makes training and ranged-defense capability explicit", () => {
+    const untrained = combatProfile({ attributes: { PP: 20 }, hthType: "none", level: 1 });
+    expect(untrained).toMatchObject({
+      handToHandType: "none",
+      hasHandToHandTraining: false,
+      hasAutoDodge: false,
+      rangedDodge: 3,
+      rangedAutoDodge: 0,
+    });
+
+    const commando = combatProfile({ attributes: { PP: 20 }, hthType: "commando", level: 15 });
+    expect(commando).toMatchObject({
+      handToHandType: "commando",
+      hasHandToHandTraining: true,
+      hasAutoDodge: true,
+      dodge: 7,
+      autoDodge: 8,
+      rangedDodge: 3,
+      rangedAutoDodge: 3,
+    });
+  });
+
   test("unconditional critical ranges unlock at their printed levels", () => {
     expect(combatProfile({ attributes: {}, hthType: "basic", level: 5 }).criticalStrikeOn).toBe(20);
     expect(combatProfile({ attributes: {}, hthType: "basic", level: 6 }).criticalStrikeOn).toBe(19);
diff --git a/vite.config.ts b/vite.config.ts
index 4e30f89..5e950e1 100644
--- a/vite.config.ts
+++ b/vite.config.ts
@@ -19,5 +19,8 @@ export default defineConfig({
     // the only one loaded — apps/web then resolves solid-js to its
     // non-reactive server build and the Convex bindings tests fail.
     projects: ["apps/*", "packages/*"],
+    // Keep cross-workspace runs below the saturation point where concurrent
+    // Convex edge-runtime startup can consume an individual test's timeout.
+    maxWorkers: "50%",
   },
 });