From 5e8b5b87d11b236980f61c7cc3f7da9ee90fa8e1 Mon Sep 17 00:00:00 2001
From: openclaws <41108781+absol89@users.noreply.github.com>
Date: Thu, 18 Jun 2026 19:22:17 +0200
Subject: [PATCH 01/23] Hide location from player list; default to party menu
 tab (#868)

---
 .../src/app/components/player-list/player-list.component.html | 4 ----
 Code/skyrim_ui/src/app/store/ui.repository.ts                 | 2 +-
 2 files changed, 1 insertion(+), 5 deletions(-)

diff --git a/Code/skyrim_ui/src/app/components/player-list/player-list.component.html b/Code/skyrim_ui/src/app/components/player-list/player-list.component.html
index 8bccbd5fe..712f2c59a 100644
--- a/Code/skyrim_ui/src/app/components/player-list/player-list.component.html
+++ b/Code/skyrim_ui/src/app/components/player-list/player-list.component.html
@@ -12,9 +12,6 @@
         <tr>
           <th>{{ 'COMPONENT.PARTY_LIST.TABLE_HEADERS.LEVEL' | transloco }}</th>
           <th>{{ 'COMPONENT.PARTY_LIST.TABLE_HEADERS.NAME' | transloco }}</th>
-          <th>
-            {{ 'COMPONENT.PARTY_LIST.TABLE_HEADERS.LOCATION' | transloco }}
-          </th>
           <th></th>
         </tr>
       </thead>
@@ -22,7 +19,6 @@
         <tr *ngFor="let player of playerList$ | async">
           <td>{{ player.level }}</td>
           <td>{{ player.name }}</td>
-          <td>{{ player.cellName }}</td>
           <td class="actions-col">
             <button
               [class.hidden]="player.isMember || !(isPartyLeader$ | async)"
diff --git a/Code/skyrim_ui/src/app/store/ui.repository.ts b/Code/skyrim_ui/src/app/store/ui.repository.ts
index d72036efe..56ed7847e 100644
--- a/Code/skyrim_ui/src/app/store/ui.repository.ts
+++ b/Code/skyrim_ui/src/app/store/ui.repository.ts
@@ -18,7 +18,7 @@ const uiStore = createStore(
   { name: 'auth' },
   withProps<UiProps>({
     view: null,
-    playerManagerTab: PlayerManagerTab.PLAYER_LIST,
+    playerManagerTab: PlayerManagerTab.PARTY_MENU,
     connectIp: null,
     connectPort: null,
     connectName: null,

From c50e59275af87ba2690fde7267764e71dc0be362 Mon Sep 17 00:00:00 2001
From: Daniil <miredirex@gmail.com>
Date: Thu, 18 Jun 2026 23:09:48 +0300
Subject: [PATCH 02/23] CI: pin `windows-2022` runner for now (#876)

`windows-latest` and `windows-2025` are now defaulting to VS2026. VS2026 and the newer SDKs/platform toolsets currently can cause issues (like certain DLLs not loading for some reason); we'll migrate later, maybe

Also undo `MemoryLayout.cpp` change
---
 .github/workflows/windows-playable-build.yml    | 2 +-
 .github/workflows/windows.yml                   | 2 +-
 Code/immersive_launcher/loader/MemoryLayout.cpp | 2 +-
 3 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/windows-playable-build.yml b/.github/workflows/windows-playable-build.yml
index 2749cd965..313175354 100644
--- a/.github/workflows/windows-playable-build.yml
+++ b/.github/workflows/windows-playable-build.yml
@@ -20,7 +20,7 @@ jobs:
       upload-build-for-next-job: true
 
   package-and-upload:
-    runs-on: windows-latest
+    runs-on: windows-2022
     needs: build-windows
     steps:
       - name: Download artifact from the previous job
diff --git a/.github/workflows/windows.yml b/.github/workflows/windows.yml
index f2070226e..3c9b01311 100644
--- a/.github/workflows/windows.yml
+++ b/.github/workflows/windows.yml
@@ -25,7 +25,7 @@ jobs:
   build:
     strategy:
       matrix:
-        os: [windows-latest]
+        os: [windows-2022]
         arch: [x64]
 
     runs-on: ${{ matrix.os }}
diff --git a/Code/immersive_launcher/loader/MemoryLayout.cpp b/Code/immersive_launcher/loader/MemoryLayout.cpp
index d1e31e0ce..3f7a7b713 100644
--- a/Code/immersive_launcher/loader/MemoryLayout.cpp
+++ b/Code/immersive_launcher/loader/MemoryLayout.cpp
@@ -32,7 +32,7 @@ namespace
 {
 extern "C" const IMAGE_DOS_HEADER __ImageBase;
 
-const uint8_t* const pBasePtr = reinterpret_cast<const uint8_t*>(&__ImageBase);
+constinit const uint8_t* pBasePtr = reinterpret_cast<const uint8_t*>(&__ImageBase);
 const uint8_t* kpImageEnd{pBasePtr + ((PIMAGE_NT_HEADERS)(pBasePtr + __ImageBase.e_lfanew))->OptionalHeader.SizeOfImage};
 
 bool InRange(const uint8_t* apObj, const uint8_t* apLo, const uint8_t* apHi)

From 9d81ef07d68e4bb2bd94fca246e798a564b7fb92 Mon Sep 17 00:00:00 2001
From: openclaws <41108781+absol89@users.noreply.github.com>
Date: Sun, 21 Jun 2026 20:57:08 +0200
Subject: [PATCH 03/23] Allow party leaders to use the `/settime` chat command
 on private servers (#877)

* fix: IsPlayerLeader const-qualified for party-leader /setTime check

* fix: add const Player::GetParty() overload and use it in IsPlayerLeader

* fix: avoid sol2 overload ambiguity in Player_Bindings after adding const GetParty

* fix: use const-safe GetById() in IsPlayerLeader

* feat: /setTime party-leader allowed when bAnnounceServer is false; clean IsPlayerLeader conflict

* feat: allow party leaders to use /setTime on private servers
---
 Code/server/Game/Player.h                 |  1 +
 Code/server/Scripting/Player_Bindings.cpp |  2 +-
 Code/server/Services/CommandService.cpp   | 24 ++++++++++++++++++++++-
 Code/server/Services/PartyService.cpp     |  8 ++++----
 Code/server/Services/PartyService.h       |  2 +-
 5 files changed, 30 insertions(+), 7 deletions(-)

diff --git a/Code/server/Game/Player.h b/Code/server/Game/Player.h
index 0ae7af3bb..ed80ad004 100644
--- a/Code/server/Game/Player.h
+++ b/Code/server/Game/Player.h
@@ -16,6 +16,7 @@ struct Player
     [[nodiscard]] ConnectionId_t GetConnectionId() const noexcept { return m_connectionId; }
     [[nodiscard]] std::optional<entt::entity> GetCharacter() const noexcept { return m_character; }
     [[nodiscard]] PartyComponent& GetParty() noexcept { return m_party; }
+    [[nodiscard]] const PartyComponent& GetParty() const noexcept { return m_party; }
     [[nodiscard]] const String& GetUsername() const noexcept { return m_username; }
     [[nodiscard]] const String& GetEndPoint() const noexcept { return m_endpoint; }
     [[nodiscard]] const uint64_t GetDiscordId() const noexcept { return m_discordId; }
diff --git a/Code/server/Scripting/Player_Bindings.cpp b/Code/server/Scripting/Player_Bindings.cpp
index 999fea81d..90ea953ca 100644
--- a/Code/server/Scripting/Player_Bindings.cpp
+++ b/Code/server/Scripting/Player_Bindings.cpp
@@ -13,7 +13,7 @@ void BindPlayer(sol::state_view aState)
     playerType["GetId"] = &Player::GetId;
     playerType["GetConnectionId"] = &Player::GetConnectionId;
     playerType["GetCharacter"] = &Player::GetCharacter;
-    playerType["GetParty"] = &Player::GetParty;
+    playerType["GetParty"] = [](Player& aSelf) -> PartyComponent& { return aSelf.GetParty(); };
     playerType["GetUsername"] = &Player::GetUsername;
     playerType["GetEndPoint"] = &Player::GetEndPoint;
     playerType["GetDiscordId"] = &Player::GetDiscordId;
diff --git a/Code/server/Services/CommandService.cpp b/Code/server/Services/CommandService.cpp
index 7bb66ce86..527e780a5 100644
--- a/Code/server/Services/CommandService.cpp
+++ b/Code/server/Services/CommandService.cpp
@@ -9,6 +9,13 @@
 #include <Messages/TeleportCommandRequest.h>
 #include <Messages/TeleportCommandResponse.h>
 
+#include <Setting.h>
+
+namespace
+{
+Console::Setting bAnnounceServer{"LiveServices:bAnnounceServer", "Whether to list the server on the public server list", false};
+}
+
 CommandService::CommandService(World& aWorld, entt::dispatcher& aDispatcher) noexcept
     : m_world(aWorld)
 {
@@ -22,7 +29,7 @@ void CommandService::OnSetTimeCommand(const PacketEvent<SetTimeCommandRequest>&
 
     const auto cPlayerId = static_cast<uint32_t>(acMessage.Packet.PlayerId);
 
-    // Only set time if player is an admin
+    // Admin override: always allowed
     for (const auto session : GameServer::Get()->GetAdminSessions())
     {
         if (PlayerManager::Get()->GetByConnectionId(session)->GetId() == cPlayerId)
@@ -39,6 +46,21 @@ void CommandService::OnSetTimeCommand(const PacketEvent<SetTimeCommandRequest>&
         }
     }
 
+    // Party leader allowed on private servers only
+    const auto* pPartyService = &m_world.GetPartyService();
+    if (pPartyService->IsPlayerLeader(acMessage.pPlayer) && !bAnnounceServer)
+    {
+        const auto cHours = static_cast<int>(acMessage.Packet.Hours);
+        const auto cMinutes = static_cast<int>(acMessage.Packet.Minutes);
+
+        m_world.GetCalendarService().SetTime(cHours, cMinutes, m_world.GetCalendarService().GetTimeScale());
+
+        response.Result = NotifySetTimeResult::SetTimeResult::kSuccess;
+        acMessage.pPlayer->Send(response);
+
+        return;
+    }
+
     response.Result = NotifySetTimeResult::SetTimeResult::kNoPermission;
     acMessage.pPlayer->Send(response);
 }
diff --git a/Code/server/Services/PartyService.cpp b/Code/server/Services/PartyService.cpp
index deabdd974..7dce6c51a 100644
--- a/Code/server/Services/PartyService.cpp
+++ b/Code/server/Services/PartyService.cpp
@@ -53,13 +53,13 @@ bool PartyService::IsPlayerInParty(Player* const apPlayer) const noexcept
     return apPlayer->GetParty().JoinedPartyId.has_value();
 }
 
-bool PartyService::IsPlayerLeader(Player* const apPlayer) noexcept
+bool PartyService::IsPlayerLeader(const Player* const apPlayer) const noexcept
 {
-    auto& inviterPartyComponent = apPlayer->GetParty();
+    const auto& inviterPartyComponent = apPlayer->GetParty();
     if (inviterPartyComponent.JoinedPartyId)
     {
-        Party& party = m_parties[*inviterPartyComponent.JoinedPartyId];
-        return party.LeaderPlayerId == apPlayer->GetId();
+        if (const auto* const pParty = GetById(*inviterPartyComponent.JoinedPartyId))
+            return pParty->LeaderPlayerId == apPlayer->GetId();
     }
 
     return false;
diff --git a/Code/server/Services/PartyService.h b/Code/server/Services/PartyService.h
index fbb0f7f7d..e1803ca19 100644
--- a/Code/server/Services/PartyService.h
+++ b/Code/server/Services/PartyService.h
@@ -33,7 +33,7 @@ struct PartyService
 
     const Party* GetById(uint32_t aId) const noexcept;
     bool IsPlayerInParty(Player* const apPlayer) const noexcept;
-    bool IsPlayerLeader(Player* const apPlayer) noexcept;
+    bool IsPlayerLeader(const Player* const apPlayer) const noexcept;
     Party* GetPlayerParty(Player* const apPlayer) noexcept;
 
 protected:

From 4fb53dde7c64771b0e20d564248865998ddaa6e8 Mon Sep 17 00:00:00 2001
From: DJLegends <dkidd799@gmail.com>
Date: Fri, 3 Jul 2026 13:45:24 -0500
Subject: [PATCH 04/23] chore: add leveled NPC resolution probe (temporary)

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 Code/client/Games/Skyrim/Forms/TESNPC.cpp | 51 +++++++++++++++++++++--
 1 file changed, 48 insertions(+), 3 deletions(-)

diff --git a/Code/client/Games/Skyrim/Forms/TESNPC.cpp b/Code/client/Games/Skyrim/Forms/TESNPC.cpp
index a465215cf..ddfba53ff 100644
--- a/Code/client/Games/Skyrim/Forms/TESNPC.cpp
+++ b/Code/client/Games/Skyrim/Forms/TESNPC.cpp
@@ -5,11 +5,56 @@
 TP_THIS_FUNCTION(TSetLeveledNpc, TESNPC*, TESNPC, TESNPC*);
 static TSetLeveledNpc* RealSetLeveledNpc = nullptr;
 
+// Temporary investigation probe, removed in the apply task.
+static void DumpNpc(const char* apLabel, TESNPC* apNpc)
+{
+    if (!apNpc)
+    {
+        spdlog::info("[LvlProbe] {}: null", apLabel);
+        return;
+    }
+
+    const char* pName = "<not an npc>";
+    if (apNpc->formType == FormType::Npc && apNpc->fullName.value)
+        pName = apNpc->fullName.value;
+
+    spdlog::info("[LvlProbe] {}: formID={:X}, temp={}, formType={}, name='{}'", apLabel, apNpc->formID, apNpc->IsTemporary(), static_cast<uint8_t>(apNpc->formType), pName);
+}
+
+static void DumpTemplateChain(TESNPC* apNpc)
+{
+    if (!apNpc)
+        return;
+
+    TESNPC* pCurrent = apNpc->npcTemplate;
+    int depth = 0;
+
+    while (pCurrent && depth < 10)
+    {
+        DumpNpc("chain", pCurrent);
+
+        // A chain entry can be a TESLevCharacter posing as TESNPC*; its layout
+        // is too small to hold npcTemplate, so stop before reading past it.
+        if (pCurrent->formType != FormType::Npc)
+            break;
+
+        pCurrent = pCurrent->npcTemplate;
+        ++depth;
+    }
+}
+
 TESNPC* TP_MAKE_THISCALL(HookSetLeveledNpc, TESNPC, TESNPC* apSelectedNpc)
 {
-    spdlog::info("For TESNPC: {}, spawning: {}", apThis->fullName.value, apSelectedNpc->fullName.value);
+    DumpNpc("this", apThis);
+    DumpNpc("selected", apSelectedNpc);
+
+    TESNPC* pResult = TiltedPhoques::ThisCall(RealSetLeveledNpc, apThis, apSelectedNpc);
+
+    DumpNpc("result", pResult);
+    spdlog::info("[LvlProbe] result == this: {}", pResult == apThis);
+    DumpTemplateChain(pResult);
 
-    return TiltedPhoques::ThisCall(RealSetLeveledNpc, apThis, Cast<TESNPC>(TESForm::GetById(0x3B547)));
+    return pResult;
 }
 
 static TiltedPhoques::Initializer s_npcInitHooks(
@@ -19,5 +64,5 @@ static TiltedPhoques::Initializer s_npcInitHooks(
 
         RealSetLeveledNpc = s_SetLeveledNpc.Get();
 
-        // TP_HOOK(&RealSetLeveledNpc, HookSetLeveledNpc);
+        TP_HOOK(&RealSetLeveledNpc, HookSetLeveledNpc);
     });

From 4e7e608281100bcfe4a69d2673e0c1d063098ab8 Mon Sep 17 00:00:00 2001
From: DJLegends <dkidd799@gmail.com>
Date: Fri, 3 Jul 2026 13:53:59 -0500
Subject: [PATCH 05/23] feat: add LeveledNpcPickId to character assignment and
 spawn messages

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 Code/encoding/Messages/AssignCharacterRequest.cpp | 2 ++
 Code/encoding/Messages/AssignCharacterRequest.h   | 3 ++-
 Code/encoding/Messages/CharacterSpawnRequest.cpp  | 2 ++
 Code/encoding/Messages/CharacterSpawnRequest.h    | 3 ++-
 4 files changed, 8 insertions(+), 2 deletions(-)

diff --git a/Code/encoding/Messages/AssignCharacterRequest.cpp b/Code/encoding/Messages/AssignCharacterRequest.cpp
index 9c4d1f567..7d7af8147 100644
--- a/Code/encoding/Messages/AssignCharacterRequest.cpp
+++ b/Code/encoding/Messages/AssignCharacterRequest.cpp
@@ -19,6 +19,7 @@ void AssignCharacterRequest::SerializeRaw(TiltedPhoques::Buffer::Writer& aWriter
     Serialization::WriteBool(aWriter, IsMount);
     Serialization::WriteBool(aWriter, IsPlayerSummon);
     CurrentActorData.Serialize(aWriter);
+    LeveledNpcPickId.Serialize(aWriter);
 }
 
 void AssignCharacterRequest::DeserializeRaw(TiltedPhoques::Buffer::Reader& aReader) noexcept
@@ -53,4 +54,5 @@ void AssignCharacterRequest::DeserializeRaw(TiltedPhoques::Buffer::Reader& aRead
     IsPlayerSummon = Serialization::ReadBool(aReader);
 
     CurrentActorData.Deserialize(aReader);
+    LeveledNpcPickId.Deserialize(aReader);
 }
diff --git a/Code/encoding/Messages/AssignCharacterRequest.h b/Code/encoding/Messages/AssignCharacterRequest.h
index 5241633a4..b6f6561cd 100644
--- a/Code/encoding/Messages/AssignCharacterRequest.h
+++ b/Code/encoding/Messages/AssignCharacterRequest.h
@@ -30,12 +30,13 @@ struct AssignCharacterRequest final : ClientMessage
     bool operator==(const AssignCharacterRequest& acRhs) const noexcept
     {
         return GetOpcode() == acRhs.GetOpcode() && Cookie == acRhs.Cookie && ReferenceId == acRhs.ReferenceId && FormId == acRhs.FormId && CellId == acRhs.CellId && WorldSpaceId == acRhs.WorldSpaceId && Position == acRhs.Position && Rotation == acRhs.Rotation && ChangeFlags == acRhs.ChangeFlags &&
-               AppearanceBuffer == acRhs.AppearanceBuffer && FactionsContent == acRhs.FactionsContent && LatestAction == acRhs.LatestAction && FaceTints == acRhs.FaceTints && QuestContent == acRhs.QuestContent && IsDragon == acRhs.IsDragon && IsMount == acRhs.IsMount && IsPlayerSummon == acRhs.IsPlayerSummon;
+               AppearanceBuffer == acRhs.AppearanceBuffer && FactionsContent == acRhs.FactionsContent && LatestAction == acRhs.LatestAction && FaceTints == acRhs.FaceTints && QuestContent == acRhs.QuestContent && IsDragon == acRhs.IsDragon && IsMount == acRhs.IsMount && IsPlayerSummon == acRhs.IsPlayerSummon && LeveledNpcPickId == acRhs.LeveledNpcPickId;
     }
 
     uint32_t Cookie{};
     GameId ReferenceId{};
     GameId FormId{};
+    GameId LeveledNpcPickId{};
     GameId CellId{};
     GameId WorldSpaceId{};
     Vector3_NetQuantize Position{};
diff --git a/Code/encoding/Messages/CharacterSpawnRequest.cpp b/Code/encoding/Messages/CharacterSpawnRequest.cpp
index 8427d7693..838edfdc9 100644
--- a/Code/encoding/Messages/CharacterSpawnRequest.cpp
+++ b/Code/encoding/Messages/CharacterSpawnRequest.cpp
@@ -20,6 +20,7 @@ void CharacterSpawnRequest::SerializeRaw(TiltedPhoques::Buffer::Writer& aWriter)
     Serialization::WriteBool(aWriter, IsPlayer);
     Serialization::WriteBool(aWriter, IsWeaponDrawn);
     Serialization::WriteBool(aWriter, IsPlayerSummon);
+    LeveledNpcPickId.Serialize(aWriter);
 }
 
 void CharacterSpawnRequest::DeserializeRaw(TiltedPhoques::Buffer::Reader& aReader) noexcept
@@ -55,4 +56,5 @@ void CharacterSpawnRequest::DeserializeRaw(TiltedPhoques::Buffer::Reader& aReade
     IsPlayer = Serialization::ReadBool(aReader);
     IsWeaponDrawn = Serialization::ReadBool(aReader);
     IsPlayerSummon = Serialization::ReadBool(aReader);
+    LeveledNpcPickId.Deserialize(aReader);
 }
diff --git a/Code/encoding/Messages/CharacterSpawnRequest.h b/Code/encoding/Messages/CharacterSpawnRequest.h
index a73f0eb2f..70b34477e 100644
--- a/Code/encoding/Messages/CharacterSpawnRequest.h
+++ b/Code/encoding/Messages/CharacterSpawnRequest.h
@@ -33,12 +33,13 @@ struct CharacterSpawnRequest final : ServerMessage
                InventoryContent == acRhs.InventoryContent && FactionsContent == acRhs.FactionsContent &&
                ActionsToReplay == acRhs.ActionsToReplay && FaceTints == acRhs.FaceTints && PlayerId == acRhs.PlayerId &&
                IsDead == acRhs.IsDead && IsPlayer == acRhs.IsPlayer && IsWeaponDrawn == acRhs.IsWeaponDrawn &&
-               IsPlayerSummon == acRhs.IsPlayerSummon && GetOpcode() == acRhs.GetOpcode();
+               IsPlayerSummon == acRhs.IsPlayerSummon && LeveledNpcPickId == acRhs.LeveledNpcPickId && GetOpcode() == acRhs.GetOpcode();
     }
 
     uint32_t ServerId{};
     GameId FormId{};
     GameId BaseId{};
+    GameId LeveledNpcPickId{};
     GameId CellId{};
     Vector3_NetQuantize Position{};
     Rotator2_NetQuantize Rotation{};

From e37ce17a66e04f927a4fd4d8fff06fd076baa5bf Mon Sep 17 00:00:00 2001
From: DJLegends <dkidd799@gmail.com>
Date: Fri, 3 Jul 2026 17:41:25 -0500
Subject: [PATCH 06/23] feat: store and relay leveled NPC pick server-side

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 Code/server/Components/CharacterComponent.h | 1 +
 Code/server/Services/CharacterService.cpp   | 6 ++++++
 2 files changed, 7 insertions(+)

diff --git a/Code/server/Components/CharacterComponent.h b/Code/server/Components/CharacterComponent.h
index 92e2ccd90..1fc9a34fa 100644
--- a/Code/server/Components/CharacterComponent.h
+++ b/Code/server/Components/CharacterComponent.h
@@ -81,6 +81,7 @@ struct CharacterComponent
     uint32_t ChangeFlags{0};
     String SaveBuffer{};
     FormIdComponent BaseId{};
+    FormIdComponent LeveledNpcPickId{};
     Tints FaceTints{};
     Factions FactionsContent{};
     uint16_t Flags{};
diff --git a/Code/server/Services/CharacterService.cpp b/Code/server/Services/CharacterService.cpp
index 9ec33d9ad..538f68398 100644
--- a/Code/server/Services/CharacterService.cpp
+++ b/Code/server/Services/CharacterService.cpp
@@ -106,6 +106,11 @@ void CharacterService::Serialize(World& aRegistry, entt::entity aEntity, Charact
         apSpawnRequest->BaseId = characterComponent.BaseId.Id;
     }
 
+    if (characterComponent.LeveledNpcPickId)
+    {
+        apSpawnRequest->LeveledNpcPickId = characterComponent.LeveledNpcPickId.Id;
+    }
+
     const auto* pMovementComponent = aRegistry.try_get<MovementComponent>(aEntity);
     if (pMovementComponent)
     {
@@ -602,6 +607,7 @@ void CharacterService::CreateCharacter(const PacketEvent<AssignCharacterRequest>
     characterComponent.ChangeFlags = message.ChangeFlags;
     characterComponent.SaveBuffer = std::move(message.AppearanceBuffer);
     characterComponent.BaseId = FormIdComponent(message.FormId);
+    characterComponent.LeveledNpcPickId = FormIdComponent(message.LeveledNpcPickId);
     characterComponent.FaceTints = message.FaceTints;
     characterComponent.FactionsContent = message.FactionsContent;
     characterComponent.SetDead(message.CurrentActorData.IsDead);

From dd20290b218389ed22ed607de927ee2497286641 Mon Sep 17 00:00:00 2001
From: DJLegends <dkidd799@gmail.com>
Date: Fri, 3 Jul 2026 17:52:50 -0500
Subject: [PATCH 07/23] feat: capture resolved leveled NPC pick on assignment

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 Code/client/Games/Skyrim/Forms/TESNPC.cpp     | 56 +++++--------------
 Code/client/Games/Skyrim/Forms/TESNPC.h       |  2 +
 .../Services/Generic/CharacterService.cpp     |  8 +++
 3 files changed, 23 insertions(+), 43 deletions(-)

diff --git a/Code/client/Games/Skyrim/Forms/TESNPC.cpp b/Code/client/Games/Skyrim/Forms/TESNPC.cpp
index ddfba53ff..ccb4ec5fa 100644
--- a/Code/client/Games/Skyrim/Forms/TESNPC.cpp
+++ b/Code/client/Games/Skyrim/Forms/TESNPC.cpp
@@ -5,58 +5,28 @@
 TP_THIS_FUNCTION(TSetLeveledNpc, TESNPC*, TESNPC, TESNPC*);
 static TSetLeveledNpc* RealSetLeveledNpc = nullptr;
 
-// Temporary investigation probe, removed in the apply task.
-static void DumpNpc(const char* apLabel, TESNPC* apNpc)
-{
-    if (!apNpc)
-    {
-        spdlog::info("[LvlProbe] {}: null", apLabel);
-        return;
-    }
-
-    const char* pName = "<not an npc>";
-    if (apNpc->formType == FormType::Npc && apNpc->fullName.value)
-        pName = apNpc->fullName.value;
-
-    spdlog::info("[LvlProbe] {}: formID={:X}, temp={}, formType={}, name='{}'", apLabel, apNpc->formID, apNpc->IsTemporary(), static_cast<uint8_t>(apNpc->formType), pName);
-}
-
-static void DumpTemplateChain(TESNPC* apNpc)
-{
-    if (!apNpc)
-        return;
-
-    TESNPC* pCurrent = apNpc->npcTemplate;
-    int depth = 0;
-
-    while (pCurrent && depth < 10)
-    {
-        DumpNpc("chain", pCurrent);
-
-        // A chain entry can be a TESLevCharacter posing as TESNPC*; its layout
-        // is too small to hold npcTemplate, so stop before reading past it.
-        if (pCurrent->formType != FormType::Npc)
-            break;
-
-        pCurrent = pCurrent->npcTemplate;
-        ++depth;
-    }
-}
+// The engine resolves a leveled spawn by creating a temporary TESNPC from
+// (placed base, picked NPC); the pick is not reliably recoverable from the
+// temp NPC afterwards, so remember it here. Temp form ids are recycled by
+// the engine, which conveniently overwrites stale entries.
+static TiltedPhoques::Map<uint32_t, uint32_t> s_leveledPicks;
 
 TESNPC* TP_MAKE_THISCALL(HookSetLeveledNpc, TESNPC, TESNPC* apSelectedNpc)
 {
-    DumpNpc("this", apThis);
-    DumpNpc("selected", apSelectedNpc);
-
     TESNPC* pResult = TiltedPhoques::ThisCall(RealSetLeveledNpc, apThis, apSelectedNpc);
 
-    DumpNpc("result", pResult);
-    spdlog::info("[LvlProbe] result == this: {}", pResult == apThis);
-    DumpTemplateChain(pResult);
+    if (pResult && apSelectedNpc)
+        s_leveledPicks[pResult->formID] = apSelectedNpc->formID;
 
     return pResult;
 }
 
+uint32_t TESNPC::GetLeveledPickFormId(uint32_t aTempNpcFormId) noexcept
+{
+    const auto cIt = s_leveledPicks.find(aTempNpcFormId);
+    return cIt != s_leveledPicks.end() ? cIt->second : 0;
+}
+
 static TiltedPhoques::Initializer s_npcInitHooks(
     []()
     {
diff --git a/Code/client/Games/Skyrim/Forms/TESNPC.h b/Code/client/Games/Skyrim/Forms/TESNPC.h
index e51de58ef..60413baa5 100644
--- a/Code/client/Games/Skyrim/Forms/TESNPC.h
+++ b/Code/client/Games/Skyrim/Forms/TESNPC.h
@@ -30,6 +30,8 @@ struct TESNPC : TESActorBase
         return pTemplate;
     }
 
+    static uint32_t GetLeveledPickFormId(uint32_t aTempNpcFormId) noexcept;
+
     struct FaceMorphs
     {
         float option[19];
diff --git a/Code/client/Services/Generic/CharacterService.cpp b/Code/client/Services/Generic/CharacterService.cpp
index 7a1e83040..b0a99bea3 100644
--- a/Code/client/Services/Generic/CharacterService.cpp
+++ b/Code/client/Services/Generic/CharacterService.cpp
@@ -1275,7 +1275,15 @@ void CharacterService::RequestServerAssignment(const entt::entity aEntity) const
     message.IsPlayerSummon = pActor->GetCommandingActor() && pActor->GetCommandingActor()->formID == 0x14;
 
     if (pNpc->IsTemporary())
+    {
+        if (const uint32_t cPickFormId = TESNPC::GetLeveledPickFormId(pNpc->formID))
+        {
+            if (!m_world.GetModSystem().GetServerModId(cPickFormId, message.LeveledNpcPickId))
+                spdlog::warn("Leveled NPC pick {:X} has no server id, identity sync skipped", cPickFormId);
+        }
+
         pNpc = pNpc->GetTemplateBase();
+    }
 
     if (isTemporary)
     {

From 227c0053b1f432f4091c7eb3187a4e927770aa9f Mon Sep 17 00:00:00 2001
From: DJLegends <dkidd799@gmail.com>
Date: Fri, 3 Jul 2026 17:59:53 -0500
Subject: [PATCH 08/23] feat: conform remote clients to owner's leveled NPC
 pick

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 Code/client/Games/Skyrim/Forms/TESNPC.cpp     | 17 +++++-
 Code/client/Games/Skyrim/Forms/TESNPC.h       |  1 +
 Code/client/Services/CharacterService.h       |  1 +
 .../Services/Generic/CharacterService.cpp     | 56 ++++++++++++++++++-
 4 files changed, 69 insertions(+), 6 deletions(-)

diff --git a/Code/client/Games/Skyrim/Forms/TESNPC.cpp b/Code/client/Games/Skyrim/Forms/TESNPC.cpp
index ccb4ec5fa..d150df6fc 100644
--- a/Code/client/Games/Skyrim/Forms/TESNPC.cpp
+++ b/Code/client/Games/Skyrim/Forms/TESNPC.cpp
@@ -11,16 +11,27 @@ static TSetLeveledNpc* RealSetLeveledNpc = nullptr;
 // the engine, which conveniently overwrites stale entries.
 static TiltedPhoques::Map<uint32_t, uint32_t> s_leveledPicks;
 
+// Substituted for the engine's random roll while a remote correction
+// re-resolves an actor (set around DisableImpl/EnableImpl by the applier).
+static thread_local TESNPC* s_pForcedLeveledPick = nullptr;
+
 TESNPC* TP_MAKE_THISCALL(HookSetLeveledNpc, TESNPC, TESNPC* apSelectedNpc)
 {
-    TESNPC* pResult = TiltedPhoques::ThisCall(RealSetLeveledNpc, apThis, apSelectedNpc);
+    TESNPC* pSelected = s_pForcedLeveledPick ? s_pForcedLeveledPick : apSelectedNpc;
+
+    TESNPC* pResult = TiltedPhoques::ThisCall(RealSetLeveledNpc, apThis, pSelected);
 
-    if (pResult && apSelectedNpc)
-        s_leveledPicks[pResult->formID] = apSelectedNpc->formID;
+    if (pResult && pSelected)
+        s_leveledPicks[pResult->formID] = pSelected->formID;
 
     return pResult;
 }
 
+void TESNPC::SetForcedLeveledPick(TESNPC* apPick) noexcept
+{
+    s_pForcedLeveledPick = apPick;
+}
+
 uint32_t TESNPC::GetLeveledPickFormId(uint32_t aTempNpcFormId) noexcept
 {
     const auto cIt = s_leveledPicks.find(aTempNpcFormId);
diff --git a/Code/client/Games/Skyrim/Forms/TESNPC.h b/Code/client/Games/Skyrim/Forms/TESNPC.h
index 60413baa5..6ef98e01e 100644
--- a/Code/client/Games/Skyrim/Forms/TESNPC.h
+++ b/Code/client/Games/Skyrim/Forms/TESNPC.h
@@ -31,6 +31,7 @@ struct TESNPC : TESActorBase
     }
 
     static uint32_t GetLeveledPickFormId(uint32_t aTempNpcFormId) noexcept;
+    static void SetForcedLeveledPick(TESNPC* apPick) noexcept;
 
     struct FaceMorphs
     {
diff --git a/Code/client/Services/CharacterService.h b/Code/client/Services/CharacterService.h
index 7ae13a0e6..9ad283196 100644
--- a/Code/client/Services/CharacterService.h
+++ b/Code/client/Services/CharacterService.h
@@ -100,6 +100,7 @@ struct CharacterService
 
     Actor* CreateCharacterForEntity(entt::entity aEntity) const noexcept;
     ActorData BuildActorData(Actor* apActor) const noexcept;
+    void ApplyLeveledNpcPick(Actor* apActor, const GameId& acPickId) const noexcept;
 
     void RunLocalUpdates() const noexcept;
     void RunRemoteUpdates() noexcept;
diff --git a/Code/client/Services/Generic/CharacterService.cpp b/Code/client/Services/Generic/CharacterService.cpp
index b0a99bea3..3bb93f698 100644
--- a/Code/client/Services/Generic/CharacterService.cpp
+++ b/Code/client/Services/Generic/CharacterService.cpp
@@ -396,10 +396,15 @@ void CharacterService::OnCharacterSpawn(const CharacterSpawnRequest& acMessage)
 
         if (acMessage.BaseId != GameId{})
         {
-            const auto cNpcId = World::Get().GetModSystem().GetGameId(acMessage.BaseId);
+            // Prefer the owner's resolved leveled pick over the lossy template base
+            GameId baseId = acMessage.BaseId;
+            if (acMessage.LeveledNpcPickId != GameId{} && World::Get().GetModSystem().GetGameId(acMessage.LeveledNpcPickId) != 0)
+                baseId = acMessage.LeveledNpcPickId;
+
+            const auto cNpcId = World::Get().GetModSystem().GetGameId(baseId);
             if (cNpcId == 0)
             {
-                spdlog::error("Failed to retrieve NPC, it will not be spawned, possibly missing mod, base: {:X}:{:X}, form: {:X}:{:X}", acMessage.BaseId.BaseId, acMessage.BaseId.ModId, acMessage.FormId.BaseId, acMessage.FormId.ModId);
+                spdlog::error("Failed to retrieve NPC, it will not be spawned, possibly missing mod, base: {:X}:{:X}, form: {:X}:{:X}", baseId.BaseId, baseId.ModId, acMessage.FormId.BaseId, acMessage.FormId.ModId);
                 return;
             }
 
@@ -487,6 +492,10 @@ void CharacterService::OnCharacterSpawn(const CharacterSpawnRequest& acMessage)
         pActor->SetCommandingActor(PlayerCharacter::Get()->GetHandle());
     }
 
+    // Static references arrive with their own locally rolled leveled pick; conform to the owner's
+    if (acMessage.FormId != GameId{})
+        ApplyLeveledNpcPick(pActor, acMessage.LeveledNpcPickId);
+
     auto& remoteComponent = m_world.emplace_or_replace<RemoteComponent>(*entity, acMessage.ServerId, pActor->formID);
 
     auto& interpolationComponent = InterpolationSystem::Setup(m_world, *entity);
@@ -1409,7 +1418,12 @@ Actor* CharacterService::CreateCharacterForEntity(entt::entity aEntity) const no
 
         if (acMessage.BaseId != GameId{})
         {
-            const uint32_t cNpcId = World::Get().GetModSystem().GetGameId(acMessage.BaseId);
+            // Prefer the owner's resolved leveled pick over the lossy template base
+            GameId baseId = acMessage.BaseId;
+            if (acMessage.LeveledNpcPickId != GameId{} && World::Get().GetModSystem().GetGameId(acMessage.LeveledNpcPickId) != 0)
+                baseId = acMessage.LeveledNpcPickId;
+
+            const uint32_t cNpcId = World::Get().GetModSystem().GetGameId(baseId);
             if (cNpcId == 0)
             {
                 spdlog::error("Failed to retrieve NPC, it will not be spawned, possibly missing mod");
@@ -1469,6 +1483,42 @@ ActorData CharacterService::BuildActorData(Actor* apActor) const noexcept
     return actorData;
 }
 
+void CharacterService::ApplyLeveledNpcPick(Actor* apActor, const GameId& acPickId) const noexcept
+{
+    if (acPickId == GameId{})
+        return;
+
+    TESNPC* pBase = Cast<TESNPC>(apActor->baseForm);
+    if (!pBase || !pBase->IsTemporary())
+        return;
+
+    const uint32_t cPickId = World::Get().GetModSystem().GetGameId(acPickId);
+    if (cPickId == 0)
+    {
+        spdlog::warn("Leveled NPC pick {:X}:{:X} not resolvable, possibly missing mod, keeping local pick", acPickId.ModId, acPickId.BaseId);
+        return;
+    }
+
+    TESNPC* pPick = Cast<TESNPC>(TESForm::GetById(cPickId));
+    if (!pPick)
+    {
+        spdlog::warn("Leveled NPC pick {:X} is not an NPC, keeping local pick", cPickId);
+        return;
+    }
+
+    if (TESNPC::GetLeveledPickFormId(pBase->formID) == cPickId)
+        return;
+
+    spdlog::info("Conforming leveled actor {:X} to owner's pick {:X}", apActor->formID, cPickId);
+
+    // Re-run the engine's leveled resolution with our pick forced in;
+    // disable/enable re-rolls the pick and rebuilds the 3D
+    TESNPC::SetForcedLeveledPick(pPick);
+    apActor->DisableImpl();
+    apActor->EnableImpl();
+    TESNPC::SetForcedLeveledPick(nullptr);
+}
+
 void CharacterService::RunLocalUpdates() const noexcept
 {
     static std::chrono::steady_clock::time_point lastSendTimePoint;

From b3f3ddd19efe1de4d4c7af0a43f2a7bced138230 Mon Sep 17 00:00:00 2001
From: DJLegends <dkidd799@gmail.com>
Date: Fri, 3 Jul 2026 18:06:41 -0500
Subject: [PATCH 09/23] fix: harden leveled pick capture against races and
 forced-pick bleed

Guard the pick map with a lock (resolution can run on a loader thread),
consume the forced pick one-shot so neighbor resolutions in the same
enable window cannot inherit it, resolve the pick GameId once, and note
the client-authoritative trust model server-side.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 Code/client/Games/Skyrim/Forms/TESNPC.cpp     | 23 +++++++++++++++---
 .../Services/Generic/CharacterService.cpp     | 24 ++++++++++++++-----
 Code/server/Services/CharacterService.cpp     |  1 +
 3 files changed, 39 insertions(+), 9 deletions(-)

diff --git a/Code/client/Games/Skyrim/Forms/TESNPC.cpp b/Code/client/Games/Skyrim/Forms/TESNPC.cpp
index d150df6fc..197317b51 100644
--- a/Code/client/Games/Skyrim/Forms/TESNPC.cpp
+++ b/Code/client/Games/Skyrim/Forms/TESNPC.cpp
@@ -7,22 +7,37 @@ static TSetLeveledNpc* RealSetLeveledNpc = nullptr;
 
 // The engine resolves a leveled spawn by creating a temporary TESNPC from
 // (placed base, picked NPC); the pick is not reliably recoverable from the
-// temp NPC afterwards, so remember it here. Temp form ids are recycled by
-// the engine, which conveniently overwrites stale entries.
+// temp NPC afterwards, so remember it here. Entries are 8 bytes and recycled
+// temp form ids overwrite their stale predecessors; the lock is needed since
+// resolution can run on a loader thread while services read from the game
+// thread.
+static std::mutex s_leveledPicksLock;
 static TiltedPhoques::Map<uint32_t, uint32_t> s_leveledPicks;
 
 // Substituted for the engine's random roll while a remote correction
 // re-resolves an actor (set around DisableImpl/EnableImpl by the applier).
+// thread_local scopes it to resolutions made synchronously inside that
+// enable call; consumed one-shot so a batched neighbor resolution in the
+// same window cannot inherit it.
 static thread_local TESNPC* s_pForcedLeveledPick = nullptr;
 
 TESNPC* TP_MAKE_THISCALL(HookSetLeveledNpc, TESNPC, TESNPC* apSelectedNpc)
 {
-    TESNPC* pSelected = s_pForcedLeveledPick ? s_pForcedLeveledPick : apSelectedNpc;
+    TESNPC* pSelected = apSelectedNpc;
+
+    if (s_pForcedLeveledPick)
+    {
+        pSelected = s_pForcedLeveledPick;
+        s_pForcedLeveledPick = nullptr;
+    }
 
     TESNPC* pResult = TiltedPhoques::ThisCall(RealSetLeveledNpc, apThis, pSelected);
 
     if (pResult && pSelected)
+    {
+        std::lock_guard lock(s_leveledPicksLock);
         s_leveledPicks[pResult->formID] = pSelected->formID;
+    }
 
     return pResult;
 }
@@ -34,6 +49,8 @@ void TESNPC::SetForcedLeveledPick(TESNPC* apPick) noexcept
 
 uint32_t TESNPC::GetLeveledPickFormId(uint32_t aTempNpcFormId) noexcept
 {
+    std::lock_guard lock(s_leveledPicksLock);
+
     const auto cIt = s_leveledPicks.find(aTempNpcFormId);
     return cIt != s_leveledPicks.end() ? cIt->second : 0;
 }
diff --git a/Code/client/Services/Generic/CharacterService.cpp b/Code/client/Services/Generic/CharacterService.cpp
index 3bb93f698..1e159e9d6 100644
--- a/Code/client/Services/Generic/CharacterService.cpp
+++ b/Code/client/Services/Generic/CharacterService.cpp
@@ -398,10 +398,16 @@ void CharacterService::OnCharacterSpawn(const CharacterSpawnRequest& acMessage)
         {
             // Prefer the owner's resolved leveled pick over the lossy template base
             GameId baseId = acMessage.BaseId;
-            if (acMessage.LeveledNpcPickId != GameId{} && World::Get().GetModSystem().GetGameId(acMessage.LeveledNpcPickId) != 0)
-                baseId = acMessage.LeveledNpcPickId;
+            uint32_t cNpcId = World::Get().GetModSystem().GetGameId(baseId);
+            if (acMessage.LeveledNpcPickId != GameId{})
+            {
+                if (const uint32_t cPickNpcId = World::Get().GetModSystem().GetGameId(acMessage.LeveledNpcPickId))
+                {
+                    baseId = acMessage.LeveledNpcPickId;
+                    cNpcId = cPickNpcId;
+                }
+            }
 
-            const auto cNpcId = World::Get().GetModSystem().GetGameId(baseId);
             if (cNpcId == 0)
             {
                 spdlog::error("Failed to retrieve NPC, it will not be spawned, possibly missing mod, base: {:X}:{:X}, form: {:X}:{:X}", baseId.BaseId, baseId.ModId, acMessage.FormId.BaseId, acMessage.FormId.ModId);
@@ -1420,10 +1426,16 @@ Actor* CharacterService::CreateCharacterForEntity(entt::entity aEntity) const no
         {
             // Prefer the owner's resolved leveled pick over the lossy template base
             GameId baseId = acMessage.BaseId;
-            if (acMessage.LeveledNpcPickId != GameId{} && World::Get().GetModSystem().GetGameId(acMessage.LeveledNpcPickId) != 0)
-                baseId = acMessage.LeveledNpcPickId;
+            uint32_t cNpcId = World::Get().GetModSystem().GetGameId(baseId);
+            if (acMessage.LeveledNpcPickId != GameId{})
+            {
+                if (const uint32_t cPickNpcId = World::Get().GetModSystem().GetGameId(acMessage.LeveledNpcPickId))
+                {
+                    baseId = acMessage.LeveledNpcPickId;
+                    cNpcId = cPickNpcId;
+                }
+            }
 
-            const uint32_t cNpcId = World::Get().GetModSystem().GetGameId(baseId);
             if (cNpcId == 0)
             {
                 spdlog::error("Failed to retrieve NPC, it will not be spawned, possibly missing mod");
diff --git a/Code/server/Services/CharacterService.cpp b/Code/server/Services/CharacterService.cpp
index 538f68398..b4da0de13 100644
--- a/Code/server/Services/CharacterService.cpp
+++ b/Code/server/Services/CharacterService.cpp
@@ -607,6 +607,7 @@ void CharacterService::CreateCharacter(const PacketEvent<AssignCharacterRequest>
     characterComponent.ChangeFlags = message.ChangeFlags;
     characterComponent.SaveBuffer = std::move(message.AppearanceBuffer);
     characterComponent.BaseId = FormIdComponent(message.FormId);
+    // Client-authoritative like BaseId; worst case a forged id changes which NPC identity renders
     characterComponent.LeveledNpcPickId = FormIdComponent(message.LeveledNpcPickId);
     characterComponent.FaceTints = message.FaceTints;
     characterComponent.FactionsContent = message.FactionsContent;

From 970a772cd05dd3eada25414c600c48c78fc9bf44 Mon Sep 17 00:00:00 2001
From: DJLegends <dkidd799@gmail.com>
Date: Fri, 3 Jul 2026 18:10:19 -0500
Subject: [PATCH 10/23] style: drop const prefix from mutable npc id lookups

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 .../client/Services/Generic/CharacterService.cpp | 16 ++++++++--------
 1 file changed, 8 insertions(+), 8 deletions(-)

diff --git a/Code/client/Services/Generic/CharacterService.cpp b/Code/client/Services/Generic/CharacterService.cpp
index 1e159e9d6..b8989e19e 100644
--- a/Code/client/Services/Generic/CharacterService.cpp
+++ b/Code/client/Services/Generic/CharacterService.cpp
@@ -398,23 +398,23 @@ void CharacterService::OnCharacterSpawn(const CharacterSpawnRequest& acMessage)
         {
             // Prefer the owner's resolved leveled pick over the lossy template base
             GameId baseId = acMessage.BaseId;
-            uint32_t cNpcId = World::Get().GetModSystem().GetGameId(baseId);
+            uint32_t npcId = World::Get().GetModSystem().GetGameId(baseId);
             if (acMessage.LeveledNpcPickId != GameId{})
             {
                 if (const uint32_t cPickNpcId = World::Get().GetModSystem().GetGameId(acMessage.LeveledNpcPickId))
                 {
                     baseId = acMessage.LeveledNpcPickId;
-                    cNpcId = cPickNpcId;
+                    npcId = cPickNpcId;
                 }
             }
 
-            if (cNpcId == 0)
+            if (npcId == 0)
             {
                 spdlog::error("Failed to retrieve NPC, it will not be spawned, possibly missing mod, base: {:X}:{:X}, form: {:X}:{:X}", baseId.BaseId, baseId.ModId, acMessage.FormId.BaseId, acMessage.FormId.ModId);
                 return;
             }
 
-            pNpc = Cast<TESNPC>(TESForm::GetById(cNpcId));
+            pNpc = Cast<TESNPC>(TESForm::GetById(npcId));
             pNpc->Deserialize(acMessage.AppearanceBuffer, acMessage.ChangeFlags);
         }
         else
@@ -1426,23 +1426,23 @@ Actor* CharacterService::CreateCharacterForEntity(entt::entity aEntity) const no
         {
             // Prefer the owner's resolved leveled pick over the lossy template base
             GameId baseId = acMessage.BaseId;
-            uint32_t cNpcId = World::Get().GetModSystem().GetGameId(baseId);
+            uint32_t npcId = World::Get().GetModSystem().GetGameId(baseId);
             if (acMessage.LeveledNpcPickId != GameId{})
             {
                 if (const uint32_t cPickNpcId = World::Get().GetModSystem().GetGameId(acMessage.LeveledNpcPickId))
                 {
                     baseId = acMessage.LeveledNpcPickId;
-                    cNpcId = cPickNpcId;
+                    npcId = cPickNpcId;
                 }
             }
 
-            if (cNpcId == 0)
+            if (npcId == 0)
             {
                 spdlog::error("Failed to retrieve NPC, it will not be spawned, possibly missing mod");
                 return nullptr;
             }
 
-            pNpc = Cast<TESNPC>(TESForm::GetById(cNpcId));
+            pNpc = Cast<TESNPC>(TESForm::GetById(npcId));
             pNpc->Deserialize(acMessage.AppearanceBuffer, acMessage.ChangeFlags);
         }
         else

From 47ce3e1571fed96b5e6bd57ddb726a0a2ab3058f Mon Sep 17 00:00:00 2001
From: DJLegends <dkidd799@gmail.com>
Date: Fri, 3 Jul 2026 18:34:11 -0500
Subject: [PATCH 11/23] fix: relay leveled pick on assignment response and add
 sync diagnostics

The main co-op scenario (second client discovers an actor the host
already owns) resolves through AssignCharacterResponse, not
CharacterSpawnRequest, so the pick never reached remote clients. Carry
the pick on the response and apply it in the not-owner branch. Every
capture/apply path now logs at info so mismatches are diagnosable from
tp_client.log and the server log.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 .../Services/Generic/CharacterService.cpp       | 17 +++++++++++++++--
 .../Messages/AssignCharacterResponse.cpp        |  2 ++
 .../encoding/Messages/AssignCharacterResponse.h |  3 ++-
 Code/server/Services/CharacterService.cpp       |  9 +++++++++
 4 files changed, 28 insertions(+), 3 deletions(-)

diff --git a/Code/client/Services/Generic/CharacterService.cpp b/Code/client/Services/Generic/CharacterService.cpp
index b8989e19e..dfdb06eca 100644
--- a/Code/client/Services/Generic/CharacterService.cpp
+++ b/Code/client/Services/Generic/CharacterService.cpp
@@ -369,6 +369,9 @@ void CharacterService::OnAssignCharacter(const AssignCharacterResponse& acMessag
         m_weaponDrawUpdates[pActor->formID] = {acMessage.IsWeaponDrawn};
 
         MoveActor(pActor, acMessage.WorldSpaceId, acMessage.CellId, acMessage.Position);
+
+        // The owner's leveled pick rides the assignment response for actors we discovered ourselves
+        ApplyLeveledNpcPick(pActor, acMessage.LeveledNpcPickId);
     }
 }
 
@@ -1293,9 +1296,13 @@ void CharacterService::RequestServerAssignment(const entt::entity aEntity) const
     {
         if (const uint32_t cPickFormId = TESNPC::GetLeveledPickFormId(pNpc->formID))
         {
-            if (!m_world.GetModSystem().GetServerModId(cPickFormId, message.LeveledNpcPickId))
+            if (m_world.GetModSystem().GetServerModId(cPickFormId, message.LeveledNpcPickId))
+                spdlog::info("Captured leveled NPC pick {:X} for actor {:X} (temp base {:X})", cPickFormId, pActor->formID, pNpc->formID);
+            else
                 spdlog::warn("Leveled NPC pick {:X} has no server id, identity sync skipped", cPickFormId);
         }
+        else
+            spdlog::info("No leveled pick recorded for temp base {:X} (actor {:X}), identity sync unavailable", pNpc->formID, pActor->formID);
 
         pNpc = pNpc->GetTemplateBase();
     }
@@ -1502,7 +1509,10 @@ void CharacterService::ApplyLeveledNpcPick(Actor* apActor, const GameId& acPickI
 
     TESNPC* pBase = Cast<TESNPC>(apActor->baseForm);
     if (!pBase || !pBase->IsTemporary())
+    {
+        spdlog::info("Leveled pick {:x}:{:x} received for actor {:X} whose base is not a leveled temp, skipping", acPickId.ModId, acPickId.BaseId, apActor->formID);
         return;
+    }
 
     const uint32_t cPickId = World::Get().GetModSystem().GetGameId(acPickId);
     if (cPickId == 0)
@@ -1519,9 +1529,12 @@ void CharacterService::ApplyLeveledNpcPick(Actor* apActor, const GameId& acPickI
     }
 
     if (TESNPC::GetLeveledPickFormId(pBase->formID) == cPickId)
+    {
+        spdlog::info("Leveled actor {:X} already matches owner's pick {:X}", apActor->formID, cPickId);
         return;
+    }
 
-    spdlog::info("Conforming leveled actor {:X} to owner's pick {:X}", apActor->formID, cPickId);
+    spdlog::info("Conforming leveled actor {:X} (temp base {:X}, local pick {:X}) to owner's pick {:X}", apActor->formID, pBase->formID, TESNPC::GetLeveledPickFormId(pBase->formID), cPickId);
 
     // Re-run the engine's leveled resolution with our pick forced in;
     // disable/enable re-rolls the pick and rebuilds the 3D
diff --git a/Code/encoding/Messages/AssignCharacterResponse.cpp b/Code/encoding/Messages/AssignCharacterResponse.cpp
index 499d4ddda..60ef260bf 100644
--- a/Code/encoding/Messages/AssignCharacterResponse.cpp
+++ b/Code/encoding/Messages/AssignCharacterResponse.cpp
@@ -14,6 +14,7 @@ void AssignCharacterResponse::SerializeRaw(TiltedPhoques::Buffer::Writer& aWrite
     Serialization::WriteBool(aWriter, Owner);
     Serialization::WriteBool(aWriter, IsDead);
     Serialization::WriteBool(aWriter, IsWeaponDrawn);
+    LeveledNpcPickId.Serialize(aWriter);
 }
 
 void AssignCharacterResponse::DeserializeRaw(TiltedPhoques::Buffer::Reader& aReader) noexcept
@@ -30,4 +31,5 @@ void AssignCharacterResponse::DeserializeRaw(TiltedPhoques::Buffer::Reader& aRea
     Owner = Serialization::ReadBool(aReader);
     IsDead = Serialization::ReadBool(aReader);
     IsWeaponDrawn = Serialization::ReadBool(aReader);
+    LeveledNpcPickId.Deserialize(aReader);
 }
diff --git a/Code/encoding/Messages/AssignCharacterResponse.h b/Code/encoding/Messages/AssignCharacterResponse.h
index deb3519f9..83e8e93d3 100644
--- a/Code/encoding/Messages/AssignCharacterResponse.h
+++ b/Code/encoding/Messages/AssignCharacterResponse.h
@@ -23,7 +23,7 @@ struct AssignCharacterResponse final : ServerMessage
     bool operator==(const AssignCharacterResponse& achRhs) const noexcept
     {
         return GetOpcode() == achRhs.GetOpcode() && Cookie == achRhs.Cookie && ServerId == achRhs.ServerId && PlayerId == achRhs.PlayerId && Position == achRhs.Position && CellId == achRhs.CellId && WorldSpaceId == achRhs.WorldSpaceId && AllActorValues == achRhs.AllActorValues &&
-               CurrentInventory == achRhs.CurrentInventory && ActionsToReplay == achRhs.ActionsToReplay && Owner == achRhs.Owner && IsDead == achRhs.IsDead && IsWeaponDrawn == achRhs.IsWeaponDrawn;
+               CurrentInventory == achRhs.CurrentInventory && ActionsToReplay == achRhs.ActionsToReplay && Owner == achRhs.Owner && IsDead == achRhs.IsDead && IsWeaponDrawn == achRhs.IsWeaponDrawn && LeveledNpcPickId == achRhs.LeveledNpcPickId;
     }
 
     uint32_t Cookie{};
@@ -32,6 +32,7 @@ struct AssignCharacterResponse final : ServerMessage
     Vector3_NetQuantize Position{};
     GameId CellId{};
     GameId WorldSpaceId{};
+    GameId LeveledNpcPickId{};
     ActorValues AllActorValues{};
     Inventory CurrentInventory{};
     ActionReplayChain ActionsToReplay;
diff --git a/Code/server/Services/CharacterService.cpp b/Code/server/Services/CharacterService.cpp
index b4da0de13..01b32f27e 100644
--- a/Code/server/Services/CharacterService.cpp
+++ b/Code/server/Services/CharacterService.cpp
@@ -244,6 +244,12 @@ void CharacterService::OnAssignCharacterRequest(const PacketEvent<AssignCharacte
             response.CellId = cellIdComponent.Cell;
             response.WorldSpaceId = cellIdComponent.WorldSpaceId;
 
+            if (characterComponent.LeveledNpcPickId)
+            {
+                response.LeveledNpcPickId = characterComponent.LeveledNpcPickId.Id;
+                spdlog::info("Relaying leveled NPC pick {:x}:{:x} for server id {:X} to {:x}", response.LeveledNpcPickId.ModId, response.LeveledNpcPickId.BaseId, response.ServerId, acMessage.pPlayer->GetConnectionId());
+            }
+
             if (auto* pAnimationComponent = m_world.try_get<AnimationComponent>(*itor))
             {
                 response.ActionsToReplay = pAnimationComponent->ActionsReplayCache.FormRefinedReplayChain();
@@ -609,6 +615,9 @@ void CharacterService::CreateCharacter(const PacketEvent<AssignCharacterRequest>
     characterComponent.BaseId = FormIdComponent(message.FormId);
     // Client-authoritative like BaseId; worst case a forged id changes which NPC identity renders
     characterComponent.LeveledNpcPickId = FormIdComponent(message.LeveledNpcPickId);
+
+    if (characterComponent.LeveledNpcPickId)
+        spdlog::info("Stored leveled NPC pick {:x}:{:x} for FormId {:x}:{:x}", message.LeveledNpcPickId.ModId, message.LeveledNpcPickId.BaseId, gameId.ModId, gameId.BaseId);
     characterComponent.FaceTints = message.FaceTints;
     characterComponent.FactionsContent = message.FactionsContent;
     characterComponent.SetDead(message.CurrentActorData.IsDead);

From daab68067f8dfe2c3ae3141ee7786f2b560d83bc Mon Sep 17 00:00:00 2001
From: DJLegends <dkidd799@gmail.com>
Date: Fri, 3 Jul 2026 19:13:42 -0500
Subject: [PATCH 12/23] fix: recover leveled pick from template chain when
 resolver hook missed it

Live cell attach can resolve leveled actors without passing through the
hooked fn 14375 (only observed firing during save load), leaving the
pick map empty for freshly spawned camp NPCs. Fall back to the first
static NPC in the temp base template chain, declining when that entry
is the placed shell itself (recognizable by templating off a leveled
list). Also log every hook fire so the actual resolution paths are
visible in tp_client.log.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 Code/client/Games/Skyrim/Forms/TESNPC.cpp     |  2 ++
 Code/client/Games/Skyrim/Forms/TESNPC.h       | 23 +++++++++++++++
 .../Services/Generic/CharacterService.cpp     | 29 ++++++++++++++-----
 3 files changed, 47 insertions(+), 7 deletions(-)

diff --git a/Code/client/Games/Skyrim/Forms/TESNPC.cpp b/Code/client/Games/Skyrim/Forms/TESNPC.cpp
index 197317b51..73d2a8c3c 100644
--- a/Code/client/Games/Skyrim/Forms/TESNPC.cpp
+++ b/Code/client/Games/Skyrim/Forms/TESNPC.cpp
@@ -33,6 +33,8 @@ TESNPC* TP_MAKE_THISCALL(HookSetLeveledNpc, TESNPC, TESNPC* apSelectedNpc)
 
     TESNPC* pResult = TiltedPhoques::ThisCall(RealSetLeveledNpc, apThis, pSelected);
 
+    spdlog::info("Leveled resolution: placed base {:X} -> pick {:X}, temp base {:X}", apThis ? apThis->formID : 0, pSelected ? pSelected->formID : 0, pResult ? pResult->formID : 0);
+
     if (pResult && pSelected)
     {
         std::lock_guard lock(s_leveledPicksLock);
diff --git a/Code/client/Games/Skyrim/Forms/TESNPC.h b/Code/client/Games/Skyrim/Forms/TESNPC.h
index 6ef98e01e..5b4ee6801 100644
--- a/Code/client/Games/Skyrim/Forms/TESNPC.h
+++ b/Code/client/Games/Skyrim/Forms/TESNPC.h
@@ -33,6 +33,29 @@ struct TESNPC : TESActorBase
     static uint32_t GetLeveledPickFormId(uint32_t aTempNpcFormId) noexcept;
     static void SetForcedLeveledPick(TESNPC* apPick) noexcept;
 
+    // Best-effort pick recovery for temp bases the hooked resolver never saw
+    // (some engine spawn paths bypass fn 14375, e.g. live cell attach): the
+    // first static NPC in the template chain is the pick - unless it is the
+    // placed shell itself, recognizable by templating off a leveled list.
+    // Chain entries can be TESLevCharacter posing as TESNPC*, whose layout is
+    // too small to hold npcTemplate - hence the formType guards.
+    TESNPC* GetLeveledPick() const noexcept
+    {
+        TESNPC* pTemplate = npcTemplate;
+
+        while (pTemplate && pTemplate->formType == FormType::Npc && pTemplate->IsTemporary())
+            pTemplate = pTemplate->npcTemplate;
+
+        if (!pTemplate || pTemplate->formType != FormType::Npc)
+            return nullptr;
+
+        TESNPC* pShellTemplate = pTemplate->npcTemplate;
+        if (pShellTemplate && pShellTemplate->formType == FormType::LeveledCharacter)
+            return nullptr;
+
+        return pTemplate;
+    }
+
     struct FaceMorphs
     {
         float option[19];
diff --git a/Code/client/Services/Generic/CharacterService.cpp b/Code/client/Services/Generic/CharacterService.cpp
index dfdb06eca..c8c371c15 100644
--- a/Code/client/Services/Generic/CharacterService.cpp
+++ b/Code/client/Services/Generic/CharacterService.cpp
@@ -1294,15 +1294,23 @@ void CharacterService::RequestServerAssignment(const entt::entity aEntity) const
 
     if (pNpc->IsTemporary())
     {
-        if (const uint32_t cPickFormId = TESNPC::GetLeveledPickFormId(pNpc->formID))
+        uint32_t pickFormId = TESNPC::GetLeveledPickFormId(pNpc->formID);
+        if (pickFormId == 0)
         {
-            if (m_world.GetModSystem().GetServerModId(cPickFormId, message.LeveledNpcPickId))
-                spdlog::info("Captured leveled NPC pick {:X} for actor {:X} (temp base {:X})", cPickFormId, pActor->formID, pNpc->formID);
+            // Not every spawn path goes through the hooked resolver; recover from the template chain
+            if (TESNPC* pChainPick = pNpc->GetLeveledPick())
+                pickFormId = pChainPick->formID;
+        }
+
+        if (pickFormId != 0)
+        {
+            if (m_world.GetModSystem().GetServerModId(pickFormId, message.LeveledNpcPickId))
+                spdlog::info("Captured leveled NPC pick {:X} for actor {:X} (temp base {:X})", pickFormId, pActor->formID, pNpc->formID);
             else
-                spdlog::warn("Leveled NPC pick {:X} has no server id, identity sync skipped", cPickFormId);
+                spdlog::warn("Leveled NPC pick {:X} has no server id, identity sync skipped", pickFormId);
         }
         else
-            spdlog::info("No leveled pick recorded for temp base {:X} (actor {:X}), identity sync unavailable", pNpc->formID, pActor->formID);
+            spdlog::info("No leveled pick recoverable for temp base {:X} (actor {:X}), identity sync unavailable", pNpc->formID, pActor->formID);
 
         pNpc = pNpc->GetTemplateBase();
     }
@@ -1528,13 +1536,20 @@ void CharacterService::ApplyLeveledNpcPick(Actor* apActor, const GameId& acPickI
         return;
     }
 
-    if (TESNPC::GetLeveledPickFormId(pBase->formID) == cPickId)
+    uint32_t localPickId = TESNPC::GetLeveledPickFormId(pBase->formID);
+    if (localPickId == 0)
+    {
+        if (TESNPC* pLocalPick = pBase->GetLeveledPick())
+            localPickId = pLocalPick->formID;
+    }
+
+    if (localPickId == cPickId)
     {
         spdlog::info("Leveled actor {:X} already matches owner's pick {:X}", apActor->formID, cPickId);
         return;
     }
 
-    spdlog::info("Conforming leveled actor {:X} (temp base {:X}, local pick {:X}) to owner's pick {:X}", apActor->formID, pBase->formID, TESNPC::GetLeveledPickFormId(pBase->formID), cPickId);
+    spdlog::info("Conforming leveled actor {:X} (temp base {:X}, local pick {:X}) to owner's pick {:X}", apActor->formID, pBase->formID, localPickId, cPickId);
 
     // Re-run the engine's leveled resolution with our pick forced in;
     // disable/enable re-rolls the pick and rebuilds the 3D

From ca8d89488137373bc829cd8692cd5f7af25b5f0d Mon Sep 17 00:00:00 2001
From: DJLegends <dkidd799@gmail.com>
Date: Fri, 3 Jul 2026 19:32:41 -0500
Subject: [PATCH 13/23] fix: conform leveled actors by base swap with
 frame-deferred re-enable

In-game verification showed EnableImpl never re-runs leveled resolution,
so the forced-pick substitution could not work and the synchronous
disable/enable pair left actors invisible (the queued 3D teardown ate
the rebuild). Point the reference at the picked NPC directly, disable,
and re-enable one frame later via the runner queue. Drop the now-dead
forced-pick machinery and demote the resolver trace to debug.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 Code/client/Games/Skyrim/Forms/TESNPC.cpp     | 28 +++----------------
 Code/client/Games/Skyrim/Forms/TESNPC.h       |  1 -
 .../Services/Generic/CharacterService.cpp     | 24 ++++++++++++----
 3 files changed, 23 insertions(+), 30 deletions(-)

diff --git a/Code/client/Games/Skyrim/Forms/TESNPC.cpp b/Code/client/Games/Skyrim/Forms/TESNPC.cpp
index 73d2a8c3c..e7f3454a3 100644
--- a/Code/client/Games/Skyrim/Forms/TESNPC.cpp
+++ b/Code/client/Games/Skyrim/Forms/TESNPC.cpp
@@ -14,41 +14,21 @@ static TSetLeveledNpc* RealSetLeveledNpc = nullptr;
 static std::mutex s_leveledPicksLock;
 static TiltedPhoques::Map<uint32_t, uint32_t> s_leveledPicks;
 
-// Substituted for the engine's random roll while a remote correction
-// re-resolves an actor (set around DisableImpl/EnableImpl by the applier).
-// thread_local scopes it to resolutions made synchronously inside that
-// enable call; consumed one-shot so a batched neighbor resolution in the
-// same window cannot inherit it.
-static thread_local TESNPC* s_pForcedLeveledPick = nullptr;
-
 TESNPC* TP_MAKE_THISCALL(HookSetLeveledNpc, TESNPC, TESNPC* apSelectedNpc)
 {
-    TESNPC* pSelected = apSelectedNpc;
-
-    if (s_pForcedLeveledPick)
-    {
-        pSelected = s_pForcedLeveledPick;
-        s_pForcedLeveledPick = nullptr;
-    }
+    TESNPC* pResult = TiltedPhoques::ThisCall(RealSetLeveledNpc, apThis, apSelectedNpc);
 
-    TESNPC* pResult = TiltedPhoques::ThisCall(RealSetLeveledNpc, apThis, pSelected);
+    spdlog::debug("Leveled resolution: placed base {:X} -> pick {:X}, temp base {:X}", apThis ? apThis->formID : 0, apSelectedNpc ? apSelectedNpc->formID : 0, pResult ? pResult->formID : 0);
 
-    spdlog::info("Leveled resolution: placed base {:X} -> pick {:X}, temp base {:X}", apThis ? apThis->formID : 0, pSelected ? pSelected->formID : 0, pResult ? pResult->formID : 0);
-
-    if (pResult && pSelected)
+    if (pResult && apSelectedNpc)
     {
         std::lock_guard lock(s_leveledPicksLock);
-        s_leveledPicks[pResult->formID] = pSelected->formID;
+        s_leveledPicks[pResult->formID] = apSelectedNpc->formID;
     }
 
     return pResult;
 }
 
-void TESNPC::SetForcedLeveledPick(TESNPC* apPick) noexcept
-{
-    s_pForcedLeveledPick = apPick;
-}
-
 uint32_t TESNPC::GetLeveledPickFormId(uint32_t aTempNpcFormId) noexcept
 {
     std::lock_guard lock(s_leveledPicksLock);
diff --git a/Code/client/Games/Skyrim/Forms/TESNPC.h b/Code/client/Games/Skyrim/Forms/TESNPC.h
index 5b4ee6801..bcaaf9f1f 100644
--- a/Code/client/Games/Skyrim/Forms/TESNPC.h
+++ b/Code/client/Games/Skyrim/Forms/TESNPC.h
@@ -31,7 +31,6 @@ struct TESNPC : TESActorBase
     }
 
     static uint32_t GetLeveledPickFormId(uint32_t aTempNpcFormId) noexcept;
-    static void SetForcedLeveledPick(TESNPC* apPick) noexcept;
 
     // Best-effort pick recovery for temp bases the hooked resolver never saw
     // (some engine spawn paths bypass fn 14375, e.g. live cell attach): the
diff --git a/Code/client/Services/Generic/CharacterService.cpp b/Code/client/Services/Generic/CharacterService.cpp
index c8c371c15..b27890db0 100644
--- a/Code/client/Services/Generic/CharacterService.cpp
+++ b/Code/client/Services/Generic/CharacterService.cpp
@@ -1551,12 +1551,26 @@ void CharacterService::ApplyLeveledNpcPick(Actor* apActor, const GameId& acPickI
 
     spdlog::info("Conforming leveled actor {:X} (temp base {:X}, local pick {:X}) to owner's pick {:X}", apActor->formID, pBase->formID, localPickId, cPickId);
 
-    // Re-run the engine's leveled resolution with our pick forced in;
-    // disable/enable re-rolls the pick and rebuilds the 3D
-    TESNPC::SetForcedLeveledPick(pPick);
+    // The engine does not re-roll a leveled actor on enable (verified in-game),
+    // so point the reference at the pick directly and rebuild the 3D. The
+    // enable must run a frame after the disable, or the queued 3D teardown
+    // swallows the rebuilt model and the actor stays invisible.
+    apActor->baseForm = pPick;
     apActor->DisableImpl();
-    apActor->EnableImpl();
-    TESNPC::SetForcedLeveledPick(nullptr);
+
+    World::Get().GetRunner().Queue(
+        [cFormId = apActor->formID]
+        {
+            Actor* pActor = Cast<Actor>(TESForm::GetById(cFormId));
+            if (!pActor)
+            {
+                spdlog::warn("Leveled actor {:X} vanished before re-enable", cFormId);
+                return;
+            }
+
+            pActor->EnableImpl();
+            spdlog::info("Re-enabled conformed leveled actor {:X}, base {:X}", cFormId, pActor->baseForm ? pActor->baseForm->formID : 0);
+        });
 }
 
 void CharacterService::RunLocalUpdates() const noexcept

From cf2c6a9d5b077f6b11f872d6385e8382f43e158e Mon Sep 17 00:00:00 2001
From: DJLegends <dkidd799@gmail.com>
Date: Fri, 3 Jul 2026 19:44:35 -0500
Subject: [PATCH 14/23] fix: defer leveled conform until actor 3D settles

Mutating the reference while cell attach is still streaming its 3D
crashed the joining client. Poll loadedState through the runner queue
(bounded retries), then disable, swap the base to the pick, and
re-enable one frame later.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 Code/client/Services/CharacterService.h       |  1 +
 .../Services/Generic/CharacterService.cpp     | 51 ++++++++++++++-----
 2 files changed, 39 insertions(+), 13 deletions(-)

diff --git a/Code/client/Services/CharacterService.h b/Code/client/Services/CharacterService.h
index 9ad283196..632836934 100644
--- a/Code/client/Services/CharacterService.h
+++ b/Code/client/Services/CharacterService.h
@@ -101,6 +101,7 @@ struct CharacterService
     Actor* CreateCharacterForEntity(entt::entity aEntity) const noexcept;
     ActorData BuildActorData(Actor* apActor) const noexcept;
     void ApplyLeveledNpcPick(Actor* apActor, const GameId& acPickId) const noexcept;
+    void ConformLeveledActor(uint32_t aFormId, uint32_t aPickFormId, int32_t aRetries) const noexcept;
 
     void RunLocalUpdates() const noexcept;
     void RunRemoteUpdates() noexcept;
diff --git a/Code/client/Services/Generic/CharacterService.cpp b/Code/client/Services/Generic/CharacterService.cpp
index b27890db0..4a57e5e93 100644
--- a/Code/client/Services/Generic/CharacterService.cpp
+++ b/Code/client/Services/Generic/CharacterService.cpp
@@ -1552,24 +1552,49 @@ void CharacterService::ApplyLeveledNpcPick(Actor* apActor, const GameId& acPickI
     spdlog::info("Conforming leveled actor {:X} (temp base {:X}, local pick {:X}) to owner's pick {:X}", apActor->formID, pBase->formID, localPickId, cPickId);
 
     // The engine does not re-roll a leveled actor on enable (verified in-game),
-    // so point the reference at the pick directly and rebuild the 3D. The
-    // enable must run a frame after the disable, or the queued 3D teardown
-    // swallows the rebuilt model and the actor stays invisible.
-    apActor->baseForm = pPick;
-    apActor->DisableImpl();
-
-    World::Get().GetRunner().Queue(
-        [cFormId = apActor->formID]
+    // so re-point the reference at the pick and rebuild the 3D. All mutation is
+    // deferred until the actor's 3D has settled - touching the reference while
+    // the cell attach is still streaming it crashes the loader - and the enable
+    // runs a frame after the disable so the queued teardown cannot swallow the
+    // rebuilt model.
+    ConformLeveledActor(apActor->formID, cPickId, 300);
+}
+
+void CharacterService::ConformLeveledActor(uint32_t aFormId, uint32_t aPickFormId, int32_t aRetries) const noexcept
+{
+    m_world.GetRunner().Queue(
+        [this, aFormId, aPickFormId, aRetries]
         {
-            Actor* pActor = Cast<Actor>(TESForm::GetById(cFormId));
-            if (!pActor)
+            Actor* pActor = Cast<Actor>(TESForm::GetById(aFormId));
+            TESNPC* pPick = Cast<TESNPC>(TESForm::GetById(aPickFormId));
+            if (!pActor || !pPick)
+                return;
+
+            if (!pActor->loadedState)
             {
-                spdlog::warn("Leveled actor {:X} vanished before re-enable", cFormId);
+                if (aRetries > 0)
+                    ConformLeveledActor(aFormId, aPickFormId, aRetries - 1);
+                else
+                    spdlog::warn("Leveled actor {:X} never finished loading 3D, conform abandoned", aFormId);
                 return;
             }
 
-            pActor->EnableImpl();
-            spdlog::info("Re-enabled conformed leveled actor {:X}, base {:X}", cFormId, pActor->baseForm ? pActor->baseForm->formID : 0);
+            pActor->DisableImpl();
+            pActor->baseForm = pPick;
+
+            m_world.GetRunner().Queue(
+                [aFormId]
+                {
+                    Actor* pEnableActor = Cast<Actor>(TESForm::GetById(aFormId));
+                    if (!pEnableActor)
+                    {
+                        spdlog::warn("Leveled actor {:X} vanished before re-enable", aFormId);
+                        return;
+                    }
+
+                    pEnableActor->EnableImpl();
+                    spdlog::info("Re-enabled conformed leveled actor {:X}, base {:X}", aFormId, pEnableActor->baseForm ? pEnableActor->baseForm->formID : 0);
+                });
         });
 }
 

From 1a6dba9d8bcf08fb6d03be9c7dc6bcd450e05168 Mon Sep 17 00:00:00 2001
From: DJLegends <dkidd799@gmail.com>
Date: Fri, 3 Jul 2026 23:24:13 -0500
Subject: [PATCH 15/23] fix: hold leveled conform while the loading screen is
 open

The loadedState gate alone still allowed the conform to run mid cell
attach, crashing the joining client during the loading screen. Poll the
Loading Menu state and only mutate the reference once the world is
interactive; waiting does not consume the retry budget.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 Code/client/Services/Generic/CharacterService.cpp | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/Code/client/Services/Generic/CharacterService.cpp b/Code/client/Services/Generic/CharacterService.cpp
index 4a57e5e93..ee14b846b 100644
--- a/Code/client/Services/Generic/CharacterService.cpp
+++ b/Code/client/Services/Generic/CharacterService.cpp
@@ -11,6 +11,7 @@
 #include <Games/Misc/SubtitleManager.h>
 
 #include <Forms/TESNPC.h>
+#include <Interface/UI.h>
 #include <Forms/TESQuest.h>
 
 #include <BranchInfo.h>
@@ -1565,6 +1566,16 @@ void CharacterService::ConformLeveledActor(uint32_t aFormId, uint32_t aPickFormI
     m_world.GetRunner().Queue(
         [this, aFormId, aPickFormId, aRetries]
         {
+            // Never touch references while the loading screen is up - the cell
+            // attach owns them and mutating mid-stream crashes the loader.
+            // Waiting does not consume the retry budget; loads can run long.
+            UI* pUI = UI::Get();
+            if (pUI && pUI->GetMenuOpen(BSFixedString("Loading Menu")))
+            {
+                ConformLeveledActor(aFormId, aPickFormId, aRetries);
+                return;
+            }
+
             Actor* pActor = Cast<Actor>(TESForm::GetById(aFormId));
             TESNPC* pPick = Cast<TESNPC>(TESForm::GetById(aPickFormId));
             if (!pActor || !pPick)

From 41c6b8d0eaa208c0a76d70edad388d9f15213854 Mon Sep 17 00:00:00 2001
From: DJLegends <dkidd799@gmail.com>
Date: Sat, 4 Jul 2026 02:34:10 -0500
Subject: [PATCH 16/23] fix: apply leveled conforms from the service update
 tick

Root cause of the three joining-client crashes: message handlers queueing
to the runner executes TaskQueue::Add from inside TaskQueue::Drain, which
re-locks the drain mutex on the same thread (UB, silent death, no dump);
the first build additionally mutated references mid cell attach. Replace
the runner round-trips with a pending-conform map drained from
CharacterService::OnUpdate (the m_weaponDrawUpdates pattern), gated on
the loading screen and per-actor 3D state, with disable and re-enable
split across ticks.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 Code/client/Services/CharacterService.h       | 12 ++-
 .../Services/Generic/CharacterService.cpp     | 93 ++++++++++---------
 2 files changed, 59 insertions(+), 46 deletions(-)

diff --git a/Code/client/Services/CharacterService.h b/Code/client/Services/CharacterService.h
index 632836934..a8849dbd6 100644
--- a/Code/client/Services/CharacterService.h
+++ b/Code/client/Services/CharacterService.h
@@ -101,7 +101,7 @@ struct CharacterService
     Actor* CreateCharacterForEntity(entt::entity aEntity) const noexcept;
     ActorData BuildActorData(Actor* apActor) const noexcept;
     void ApplyLeveledNpcPick(Actor* apActor, const GameId& acPickId) const noexcept;
-    void ConformLeveledActor(uint32_t aFormId, uint32_t aPickFormId, int32_t aRetries) const noexcept;
+    void ProcessLeveledConforms() noexcept;
 
     void RunLocalUpdates() const noexcept;
     void RunRemoteUpdates() noexcept;
@@ -132,6 +132,16 @@ struct CharacterService
 
     Map<uint32_t, WeaponDrawData> m_weaponDrawUpdates{};
 
+    struct LeveledConformData
+    {
+        uint32_t PickFormId{};
+        int32_t RetriesLeft{};
+        bool Disabled{};
+    };
+
+    // Written from const message handlers, drained by ProcessLeveledConforms
+    mutable Map<uint32_t, LeveledConformData> m_pendingLeveledConforms{};
+
     entt::scoped_connection m_referenceAddedConnection;
     entt::scoped_connection m_referenceRemovedConnection;
     entt::scoped_connection m_updateConnection;
diff --git a/Code/client/Services/Generic/CharacterService.cpp b/Code/client/Services/Generic/CharacterService.cpp
index ee14b846b..361d29b31 100644
--- a/Code/client/Services/Generic/CharacterService.cpp
+++ b/Code/client/Services/Generic/CharacterService.cpp
@@ -241,6 +241,7 @@ void CharacterService::OnUpdate(const UpdateEvent& acUpdateEvent) noexcept
     RunRemoteUpdates();
     RunExperienceUpdates();
     ApplyCachedWeaponDraws(acUpdateEvent);
+    ProcessLeveledConforms();
 }
 
 void CharacterService::OnConnected(const ConnectedEvent& acConnectedEvent) const noexcept
@@ -1552,61 +1553,63 @@ void CharacterService::ApplyLeveledNpcPick(Actor* apActor, const GameId& acPickI
 
     spdlog::info("Conforming leveled actor {:X} (temp base {:X}, local pick {:X}) to owner's pick {:X}", apActor->formID, pBase->formID, localPickId, cPickId);
 
-    // The engine does not re-roll a leveled actor on enable (verified in-game),
-    // so re-point the reference at the pick and rebuild the 3D. All mutation is
-    // deferred until the actor's 3D has settled - touching the reference while
-    // the cell attach is still streaming it crashes the loader - and the enable
-    // runs a frame after the disable so the queued teardown cannot swallow the
-    // rebuilt model.
-    ConformLeveledActor(apActor->formID, cPickId, 300);
+    // Never mutate the reference here: this runs from message handlers, while
+    // the cell attach may still own the reference, and queueing to the runner
+    // from a drained task re-locks the drain mutex (UB). The service update
+    // tick applies pending conforms once the world has settled.
+    m_pendingLeveledConforms[apActor->formID] = {cPickId, 300, false};
 }
 
-void CharacterService::ConformLeveledActor(uint32_t aFormId, uint32_t aPickFormId, int32_t aRetries) const noexcept
+void CharacterService::ProcessLeveledConforms() noexcept
 {
-    m_world.GetRunner().Queue(
-        [this, aFormId, aPickFormId, aRetries]
+    if (m_pendingLeveledConforms.empty())
+        return;
+
+    // Never touch references while the loading screen is up - the cell attach
+    // owns them and mutating mid-stream crashes the loader
+    UI* pUI = UI::Get();
+    if (pUI && pUI->GetMenuOpen(BSFixedString("Loading Menu")))
+        return;
+
+    for (auto it = m_pendingLeveledConforms.begin(); it != m_pendingLeveledConforms.end();)
+    {
+        LeveledConformData& conform = it.value();
+
+        Actor* pActor = Cast<Actor>(TESForm::GetById(it->first));
+        TESNPC* pPick = Cast<TESNPC>(TESForm::GetById(conform.PickFormId));
+        if (!pActor || !pPick)
         {
-            // Never touch references while the loading screen is up - the cell
-            // attach owns them and mutating mid-stream crashes the loader.
-            // Waiting does not consume the retry budget; loads can run long.
-            UI* pUI = UI::Get();
-            if (pUI && pUI->GetMenuOpen(BSFixedString("Loading Menu")))
-            {
-                ConformLeveledActor(aFormId, aPickFormId, aRetries);
-                return;
-            }
+            it = m_pendingLeveledConforms.erase(it);
+            continue;
+        }
 
-            Actor* pActor = Cast<Actor>(TESForm::GetById(aFormId));
-            TESNPC* pPick = Cast<TESNPC>(TESForm::GetById(aPickFormId));
-            if (!pActor || !pPick)
-                return;
+        if (conform.Disabled)
+        {
+            // Teardown ran last tick; rebuild the 3D from the pick
+            pActor->baseForm = pPick;
+            pActor->EnableImpl();
+            spdlog::info("Re-enabled conformed leveled actor {:X}, base {:X}", it->first, conform.PickFormId);
+            it = m_pendingLeveledConforms.erase(it);
+            continue;
+        }
 
-            if (!pActor->loadedState)
+        if (!pActor->loadedState)
+        {
+            if (--conform.RetriesLeft <= 0)
             {
-                if (aRetries > 0)
-                    ConformLeveledActor(aFormId, aPickFormId, aRetries - 1);
-                else
-                    spdlog::warn("Leveled actor {:X} never finished loading 3D, conform abandoned", aFormId);
-                return;
+                spdlog::warn("Leveled actor {:X} never finished loading 3D, conform abandoned", it->first);
+                it = m_pendingLeveledConforms.erase(it);
+                continue;
             }
 
-            pActor->DisableImpl();
-            pActor->baseForm = pPick;
+            ++it;
+            continue;
+        }
 
-            m_world.GetRunner().Queue(
-                [aFormId]
-                {
-                    Actor* pEnableActor = Cast<Actor>(TESForm::GetById(aFormId));
-                    if (!pEnableActor)
-                    {
-                        spdlog::warn("Leveled actor {:X} vanished before re-enable", aFormId);
-                        return;
-                    }
-
-                    pEnableActor->EnableImpl();
-                    spdlog::info("Re-enabled conformed leveled actor {:X}, base {:X}", aFormId, pEnableActor->baseForm ? pEnableActor->baseForm->formID : 0);
-                });
-        });
+        pActor->DisableImpl();
+        conform.Disabled = true;
+        ++it;
+    }
 }
 
 void CharacterService::RunLocalUpdates() const noexcept

From 2aa1696cf425c736fd3d0a9a2a5c9f23bf574ece Mon Sep 17 00:00:00 2001
From: DJLegends <dkidd799@gmail.com>
Date: Sat, 4 Jul 2026 02:51:45 -0500
Subject: [PATCH 17/23] fix: prefer template chain over resolver map when
 capturing leveled pick

The resolver map is keyed by temp form ids the engine recycles, and cell
attach resolves leveled actors without the hook, so a map hit can
describe a previous occupant of the id - which shipped a stale Dawnguard
thrall pick for a Forsworn and rendered it on the remote client. The
chain is derived from the live actor and cannot go stale; the map is now
a fallback for named leveled NPCs only.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 Code/client/Games/Skyrim/Forms/TESNPC.cpp     |  8 +++---
 .../Services/Generic/CharacterService.cpp     | 27 +++++++++++--------
 2 files changed, 21 insertions(+), 14 deletions(-)

diff --git a/Code/client/Games/Skyrim/Forms/TESNPC.cpp b/Code/client/Games/Skyrim/Forms/TESNPC.cpp
index e7f3454a3..0512246f8 100644
--- a/Code/client/Games/Skyrim/Forms/TESNPC.cpp
+++ b/Code/client/Games/Skyrim/Forms/TESNPC.cpp
@@ -6,9 +6,11 @@ TP_THIS_FUNCTION(TSetLeveledNpc, TESNPC*, TESNPC, TESNPC*);
 static TSetLeveledNpc* RealSetLeveledNpc = nullptr;
 
 // The engine resolves a leveled spawn by creating a temporary TESNPC from
-// (placed base, picked NPC); the pick is not reliably recoverable from the
-// temp NPC afterwards, so remember it here. Entries are 8 bytes and recycled
-// temp form ids overwrite their stale predecessors; the lock is needed since
+// (placed base, picked NPC); named leveled NPCs hide the pick from the temp
+// NPC's template chain, so remember it here. CAUTION: temp form ids are
+// recycled by the engine and cell attach resolves without this hook, so an
+// entry may describe a previous occupant of its id - consumers must prefer
+// the chain and treat this map as a last resort. The lock is needed since
 // resolution can run on a loader thread while services read from the game
 // thread.
 static std::mutex s_leveledPicksLock;
diff --git a/Code/client/Services/Generic/CharacterService.cpp b/Code/client/Services/Generic/CharacterService.cpp
index 361d29b31..df72dbc33 100644
--- a/Code/client/Services/Generic/CharacterService.cpp
+++ b/Code/client/Services/Generic/CharacterService.cpp
@@ -1296,13 +1296,17 @@ void CharacterService::RequestServerAssignment(const entt::entity aEntity) const
 
     if (pNpc->IsTemporary())
     {
-        uint32_t pickFormId = TESNPC::GetLeveledPickFormId(pNpc->formID);
+        // The chain is derived from the live actor and cannot go stale; the
+        // resolver map is keyed by temp ids the engine recycles, and cell
+        // attach bypasses the hook, so a map hit may describe a previous
+        // occupant of this id. Only named leveled NPCs, whose chain hides
+        // the pick, fall back to the map.
+        uint32_t pickFormId = 0;
+        if (TESNPC* pChainPick = pNpc->GetLeveledPick())
+            pickFormId = pChainPick->formID;
+
         if (pickFormId == 0)
-        {
-            // Not every spawn path goes through the hooked resolver; recover from the template chain
-            if (TESNPC* pChainPick = pNpc->GetLeveledPick())
-                pickFormId = pChainPick->formID;
-        }
+            pickFormId = TESNPC::GetLeveledPickFormId(pNpc->formID);
 
         if (pickFormId != 0)
         {
@@ -1538,12 +1542,13 @@ void CharacterService::ApplyLeveledNpcPick(Actor* apActor, const GameId& acPickI
         return;
     }
 
-    uint32_t localPickId = TESNPC::GetLeveledPickFormId(pBase->formID);
+    // Chain first for the same staleness reason as the capture side
+    uint32_t localPickId = 0;
+    if (TESNPC* pLocalPick = pBase->GetLeveledPick())
+        localPickId = pLocalPick->formID;
+
     if (localPickId == 0)
-    {
-        if (TESNPC* pLocalPick = pBase->GetLeveledPick())
-            localPickId = pLocalPick->formID;
-    }
+        localPickId = TESNPC::GetLeveledPickFormId(pBase->formID);
 
     if (localPickId == cPickId)
     {

From 1779088fdfb8112aa79df43989fa8d7feec5ab12 Mon Sep 17 00:00:00 2001
From: DJLegends <dkidd799@gmail.com>
Date: Sat, 4 Jul 2026 03:02:09 -0500
Subject: [PATCH 18/23] feat: reconcile leveled pick across ownership transfers

When the party leader steals ownership of an already-managed actor, the
server kept the old owner pick and told nobody to conform, leaving each
client with its own roll. Adopt the new owner pick from the transferring
assignment request, carry it on NotifySpawnData, and conform the demoted
owner like any other remote client.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 Code/client/Services/Generic/CharacterService.cpp | 4 ++++
 Code/encoding/Messages/NotifySpawnData.cpp        | 2 ++
 Code/encoding/Messages/NotifySpawnData.h          | 4 +++-
 Code/server/Services/CharacterService.cpp         | 9 +++++++++
 4 files changed, 18 insertions(+), 1 deletion(-)

diff --git a/Code/client/Services/Generic/CharacterService.cpp b/Code/client/Services/Generic/CharacterService.cpp
index df72dbc33..ceac4c451 100644
--- a/Code/client/Services/Generic/CharacterService.cpp
+++ b/Code/client/Services/Generic/CharacterService.cpp
@@ -566,6 +566,10 @@ void CharacterService::OnRemoteSpawnDataReceived(const NotifySpawnData& acMessag
         acMessage.NewActorData.IsDead ? pActor->Kill() : pActor->Respawn();
 
     spdlog::info("Applied remote spawn data, actor form id: {:X}", pActor->formID);
+
+    // Ownership transfers make the new owner's leveled pick authoritative;
+    // the demoted owner conforms like any other remote client
+    ApplyLeveledNpcPick(pActor, acMessage.LeveledNpcPickId);
 }
 
 void CharacterService::OnReferencesMoveRequest(const ServerReferencesMoveRequest& acMessage) const noexcept
diff --git a/Code/encoding/Messages/NotifySpawnData.cpp b/Code/encoding/Messages/NotifySpawnData.cpp
index a7af0eb61..f74a021d6 100644
--- a/Code/encoding/Messages/NotifySpawnData.cpp
+++ b/Code/encoding/Messages/NotifySpawnData.cpp
@@ -4,6 +4,7 @@ void NotifySpawnData::SerializeRaw(TiltedPhoques::Buffer::Writer& aWriter) const
 {
     Serialization::WriteVarInt(aWriter, Id);
     NewActorData.Serialize(aWriter);
+    LeveledNpcPickId.Serialize(aWriter);
 }
 
 void NotifySpawnData::DeserializeRaw(TiltedPhoques::Buffer::Reader& aReader) noexcept
@@ -12,4 +13,5 @@ void NotifySpawnData::DeserializeRaw(TiltedPhoques::Buffer::Reader& aReader) noe
 
     Id = Serialization::ReadVarInt(aReader) & 0xFFFFFFFF;
     NewActorData.Deserialize(aReader);
+    LeveledNpcPickId.Deserialize(aReader);
 }
diff --git a/Code/encoding/Messages/NotifySpawnData.h b/Code/encoding/Messages/NotifySpawnData.h
index 7ccb815e0..f100197b9 100644
--- a/Code/encoding/Messages/NotifySpawnData.h
+++ b/Code/encoding/Messages/NotifySpawnData.h
@@ -2,6 +2,7 @@
 
 #include "Message.h"
 #include <Structs/ActorData.h>
+#include <Structs/GameId.h>
 
 struct NotifySpawnData final : ServerMessage
 {
@@ -17,9 +18,10 @@ struct NotifySpawnData final : ServerMessage
 
     bool operator==(const NotifySpawnData& acRhs) const noexcept
     {
-        return GetOpcode() == acRhs.GetOpcode() && Id == acRhs.Id && NewActorData == acRhs.NewActorData;
+        return GetOpcode() == acRhs.GetOpcode() && Id == acRhs.Id && NewActorData == acRhs.NewActorData && LeveledNpcPickId == acRhs.LeveledNpcPickId;
     }
 
     uint32_t Id{};
     ActorData NewActorData{};
+    GameId LeveledNpcPickId{};
 };
diff --git a/Code/server/Services/CharacterService.cpp b/Code/server/Services/CharacterService.cpp
index 01b32f27e..7af3ccbc9 100644
--- a/Code/server/Services/CharacterService.cpp
+++ b/Code/server/Services/CharacterService.cpp
@@ -226,6 +226,9 @@ void CharacterService::OnAssignCharacterRequest(const PacketEvent<AssignCharacte
                 // Transfer ownership if owning player is in the same party as the owner
                 if (std::find(pParty->Members.begin(), pParty->Members.end(), pOwningPlayer) != pParty->Members.end())
                 {
+                    // The new owner's roll becomes authoritative for the leveled pick;
+                    // empty means unknown, in which case nobody should conform
+                    characterComponent.LeveledNpcPickId = FormIdComponent(message.LeveledNpcPickId);
                     TransferOwnership(acMessage.pPlayer, World::ToInteger(*itor), acMessage.Packet.CurrentActorData);
                     isOwner = true;
                 }
@@ -755,6 +758,12 @@ void CharacterService::BroadcastActorData(Player* apPlayer, const entt::entity a
     notifySpawnData.Id = World::ToInteger(acEntity);
     notifySpawnData.NewActorData = acActorData;
 
+    if (const auto* pCharacterComponent = m_world.try_get<CharacterComponent>(acEntity))
+    {
+        if (pCharacterComponent->LeveledNpcPickId)
+            notifySpawnData.LeveledNpcPickId = pCharacterComponent->LeveledNpcPickId.Id;
+    }
+
     GameServer::Get()->SendToPlayersInRange(notifySpawnData, acEntity, apPlayer);
 }
 

From 559f0fbd49d016203ed6dd8f866b5af278becf00 Mon Sep 17 00:00:00 2001
From: DJLegends <dkidd799@gmail.com>
Date: Sat, 4 Jul 2026 19:24:25 -0500
Subject: [PATCH 19/23] fix: recompute graph descriptor when conforming leveled
 npcs

The anim-var sync caches GraphDescriptorHash once per actor. A conform
that crosses animation projects (rabbit -> fox) kept the old project's
variable indices, so every remote update wrote the owner's values through
stale indices into the new graph's variable set; float bits landed in
words the new project reads as quad-variable indices, crashing on an OOB
load in hkbBehaviorGraph::update within seconds. Zero the hash after the
base swap so the next sync tick recomputes it from the rebuilt graph,
mirroring what the werewolf and vampire lord transforms already do.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 Code/client/Services/Generic/CharacterService.cpp | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/Code/client/Services/Generic/CharacterService.cpp b/Code/client/Services/Generic/CharacterService.cpp
index ceac4c451..5ff643a29 100644
--- a/Code/client/Services/Generic/CharacterService.cpp
+++ b/Code/client/Services/Generic/CharacterService.cpp
@@ -1597,6 +1597,15 @@ void CharacterService::ProcessLeveledConforms() noexcept
             // Teardown ran last tick; rebuild the 3D from the pick
             pActor->baseForm = pPick;
             pActor->EnableImpl();
+
+            // The animation sync caches the graph descriptor per actor. A pick that
+            // crosses animation projects (rabbit -> fox) keeps the old project's
+            // variable indices, and every remote update then scribbles the owner's
+            // values through them into the new graph's variable set - the OOB
+            // variable-index crash. Zero it so the next sync tick recomputes it
+            // from the rebuilt graph, like the werewolf/vampire lord transforms do.
+            pActor->GetExtension()->GraphDescriptorHash = 0;
+
             spdlog::info("Re-enabled conformed leveled actor {:X}, base {:X}", it->first, conform.PickFormId);
             it = m_pendingLeveledConforms.erase(it);
             continue;

From f609305e7824eb413e738ddd167cd6698d67a52d Mon Sep 17 00:00:00 2001
From: DJLegends <dkidd799@gmail.com>
Date: Sat, 4 Jul 2026 19:24:39 -0500
Subject: [PATCH 20/23] fix: bounds-check animation variable serialization

The boolean apply loop validated indices against the variable set size
but the float/integer loops and all three serialize loops did not. Any
descriptor/graph mismatch (stale descriptor, modded behaviors) could
read or write out of bounds. Guard every loop so a mismatch degrades to
wrong animation values instead of memory corruption.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 Code/client/Games/Skyrim/TESObjectREFR.cpp | 18 +++++++++++++-----
 1 file changed, 13 insertions(+), 5 deletions(-)

diff --git a/Code/client/Games/Skyrim/TESObjectREFR.cpp b/Code/client/Games/Skyrim/TESObjectREFR.cpp
index 3ef4afa92..8108008aa 100644
--- a/Code/client/Games/Skyrim/TESObjectREFR.cpp
+++ b/Code/client/Games/Skyrim/TESObjectREFR.cpp
@@ -202,7 +202,7 @@ void TESObjectREFR::SaveAnimationVariables(AnimationVariables& aVariables) const
             {
                 const auto idx = pDescriptor->BooleanLookUpTable[i];
 
-                if (pVariableSet->data[idx] != 0)
+                if (pVariableSet->size > idx && pVariableSet->data[idx] != 0)
                     aVariables.Booleans[i] = true;
             }
 
@@ -210,14 +210,16 @@ void TESObjectREFR::SaveAnimationVariables(AnimationVariables& aVariables) const
             {
                 const auto idx = pDescriptor->FloatLookupTable[i];
 
-                aVariables.Floats[i] = *reinterpret_cast<float*>(&pVariableSet->data[idx]);
+                if (pVariableSet->size > idx)
+                    aVariables.Floats[i] = *reinterpret_cast<float*>(&pVariableSet->data[idx]);
             }
 
             for (size_t i = 0; i < pDescriptor->IntegerLookupTable.size(); ++i)
             {
                 const auto idx = pDescriptor->IntegerLookupTable[i];
 
-                aVariables.Integers[i] = *reinterpret_cast<uint32_t*>(&pVariableSet->data[idx]);
+                if (pVariableSet->size > idx)
+                    aVariables.Integers[i] = *reinterpret_cast<uint32_t*>(&pVariableSet->data[idx]);
             }
         }
 
@@ -278,14 +280,20 @@ void TESObjectREFR::LoadAnimationVariables(const AnimationVariables& aVariables)
             {
                 const auto idx = pDescriptor->FloatLookupTable[i];
 
-                *reinterpret_cast<float*>(&pVariableSet->data[idx]) = aVariables.Floats.size() > i ? aVariables.Floats[i] : 0.f;
+                if (pVariableSet->size > idx)
+                {
+                    *reinterpret_cast<float*>(&pVariableSet->data[idx]) = aVariables.Floats.size() > i ? aVariables.Floats[i] : 0.f;
+                }
             }
 
             for (size_t i = 0; i < pDescriptor->IntegerLookupTable.size(); ++i)
             {
                 const auto idx = pDescriptor->IntegerLookupTable[i];
 
-                *reinterpret_cast<uint32_t*>(&pVariableSet->data[idx]) = aVariables.Integers.size() > i ? aVariables.Integers[i] : 0;
+                if (pVariableSet->size > idx)
+                {
+                    *reinterpret_cast<uint32_t*>(&pVariableSet->data[idx]) = aVariables.Integers.size() > i ? aVariables.Integers[i] : 0;
+                }
             }
         }
 

From fe27d189c94537a712ffe325edca9c4c284c53ce Mon Sep 17 00:00:00 2001
From: DJLegends <dkidd799@gmail.com>
Date: Sat, 4 Jul 2026 19:24:39 -0500
Subject: [PATCH 21/23] chore: ignore local tooling and workspace files

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 .gitignore | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/.gitignore b/.gitignore
index 9161be0ee..d0dfb9da1 100644
--- a/.gitignore
+++ b/.gitignore
@@ -6,9 +6,15 @@ vs2019
 vs2022
 vsxmake2019
 vsxmake2022
+vsxmake2026
 .xmake
 vs2019
 
+# Local AI tooling and working notes
+.claude/
+CLAUDE.md
+docs/superpowers/
+
 build
 Build
 Build/*.log

From a8065f43fed5125b04f9596f19ffd8701cf81cc6 Mon Sep 17 00:00:00 2001
From: DJLegends <dkidd799@gmail.com>
Date: Sun, 5 Jul 2026 18:18:44 -0500
Subject: [PATCH 22/23] fix: conform shell-based actors and keep pending
 conforms until 3D exists

Two playtest-proven gaps: the 300-frame retry budget melts at high fps
and can never cover distant actors, abandoning conforms (Embershard
door bandit); and picks arriving while the local actor still carries
the unresolved placed shell were mistaken for already-conformed,
leaving shells invisible or headless (OBIS bosses). Pending conforms
now persist until the actor streams in (cleared on disconnect), and a
static base templating onto a leveled list conforms instead of
skipping, bypassing the 3D gate shells can never satisfy.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 Code/client/Services/CharacterService.h       |  1 -
 .../Services/Generic/CharacterService.cpp     | 45 ++++++++++++++-----
 2 files changed, 33 insertions(+), 13 deletions(-)

diff --git a/Code/client/Services/CharacterService.h b/Code/client/Services/CharacterService.h
index a8849dbd6..ad0f2c2d5 100644
--- a/Code/client/Services/CharacterService.h
+++ b/Code/client/Services/CharacterService.h
@@ -135,7 +135,6 @@ struct CharacterService
     struct LeveledConformData
     {
         uint32_t PickFormId{};
-        int32_t RetriesLeft{};
         bool Disabled{};
     };
 
diff --git a/Code/client/Services/Generic/CharacterService.cpp b/Code/client/Services/Generic/CharacterService.cpp
index 5ff643a29..400c56726 100644
--- a/Code/client/Services/Generic/CharacterService.cpp
+++ b/Code/client/Services/Generic/CharacterService.cpp
@@ -285,6 +285,8 @@ void CharacterService::OnDisconnected(const DisconnectedEvent& acDisconnectedEve
     }
 
     m_world.clear<WaitingForAssignmentComponent, LocalComponent, RemoteComponent>();
+
+    m_pendingLeveledConforms.clear();
 }
 
 void CharacterService::OnAssignCharacter(const AssignCharacterResponse& acMessage) noexcept
@@ -1520,16 +1522,38 @@ ActorData CharacterService::BuildActorData(Actor* apActor) const noexcept
     return actorData;
 }
 
+// A static base still templating onto a leveled list is the placed shell:
+// the local engine has not rolled this actor yet. Shells have no model of
+// their own - such actors render invisible or headless until conformed.
+static bool IsUnresolvedLeveledShell(const TESNPC* apBase) noexcept
+{
+    if (!apBase || apBase->IsTemporary())
+        return false;
+
+    const TESNPC* pTemplate = apBase->npcTemplate;
+    return pTemplate && pTemplate->formType == FormType::LeveledCharacter;
+}
+
 void CharacterService::ApplyLeveledNpcPick(Actor* apActor, const GameId& acPickId) const noexcept
 {
     if (acPickId == GameId{})
         return;
 
     TESNPC* pBase = Cast<TESNPC>(apActor->baseForm);
-    if (!pBase || !pBase->IsTemporary())
-    {
-        spdlog::info("Leveled pick {:x}:{:x} received for actor {:X} whose base is not a leveled temp, skipping", acPickId.ModId, acPickId.BaseId, apActor->formID);
+    if (!pBase)
         return;
+
+    if (!pBase->IsTemporary())
+    {
+        // Conforming a shell is exactly what resolution would have done; any
+        // other static base is an already conformed actor.
+        if (!IsUnresolvedLeveledShell(pBase))
+        {
+            spdlog::info("Leveled pick {:x}:{:x} received for actor {:X} whose base is not a leveled temp, skipping", acPickId.ModId, acPickId.BaseId, apActor->formID);
+            return;
+        }
+
+        spdlog::info("Actor {:X} still carries unresolved shell base {:X}, conforming to owner's pick", apActor->formID, pBase->formID);
     }
 
     const uint32_t cPickId = World::Get().GetModSystem().GetGameId(acPickId);
@@ -1566,7 +1590,7 @@ void CharacterService::ApplyLeveledNpcPick(Actor* apActor, const GameId& acPickI
     // the cell attach may still own the reference, and queueing to the runner
     // from a drained task re-locks the drain mutex (UB). The service update
     // tick applies pending conforms once the world has settled.
-    m_pendingLeveledConforms[apActor->formID] = {cPickId, 300, false};
+    m_pendingLeveledConforms[apActor->formID] = {cPickId, false};
 }
 
 void CharacterService::ProcessLeveledConforms() noexcept
@@ -1611,15 +1635,12 @@ void CharacterService::ProcessLeveledConforms() noexcept
             continue;
         }
 
-        if (!pActor->loadedState)
+        if (!pActor->loadedState && !IsUnresolvedLeveledShell(Cast<TESNPC>(pActor->baseForm)))
         {
-            if (--conform.RetriesLeft <= 0)
-            {
-                spdlog::warn("Leveled actor {:X} never finished loading 3D, conform abandoned", it->first);
-                it = m_pendingLeveledConforms.erase(it);
-                continue;
-            }
-
+            // Distant actors stream their 3D in whenever the player approaches -
+            // possibly minutes later. Stay pending until then; a newer pick
+            // overwrites this entry and a disconnect clears the map. Shell-based
+            // actors are exempt: they have no model to load until conformed.
             ++it;
             continue;
         }

From 200c5d41b2a7ab28365df74ac73c0e57fde42e0d Mon Sep 17 00:00:00 2001
From: DJLegends <dkidd799@gmail.com>
Date: Sun, 5 Jul 2026 18:18:45 -0500
Subject: [PATCH 23/23] tweak: demote leveled pick storage and relay logging to
 debug

Grid-edge critter churn re-requests the same actor every half second,
each printing a relay line at info; the pipeline is proven, so keep
the diagnostics behind the debug level.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 Code/server/Services/CharacterService.cpp | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/Code/server/Services/CharacterService.cpp b/Code/server/Services/CharacterService.cpp
index 7af3ccbc9..276e9f84c 100644
--- a/Code/server/Services/CharacterService.cpp
+++ b/Code/server/Services/CharacterService.cpp
@@ -250,7 +250,7 @@ void CharacterService::OnAssignCharacterRequest(const PacketEvent<AssignCharacte
             if (characterComponent.LeveledNpcPickId)
             {
                 response.LeveledNpcPickId = characterComponent.LeveledNpcPickId.Id;
-                spdlog::info("Relaying leveled NPC pick {:x}:{:x} for server id {:X} to {:x}", response.LeveledNpcPickId.ModId, response.LeveledNpcPickId.BaseId, response.ServerId, acMessage.pPlayer->GetConnectionId());
+                spdlog::debug("Relaying leveled NPC pick {:x}:{:x} for server id {:X} to {:x}", response.LeveledNpcPickId.ModId, response.LeveledNpcPickId.BaseId, response.ServerId, acMessage.pPlayer->GetConnectionId());
             }
 
             if (auto* pAnimationComponent = m_world.try_get<AnimationComponent>(*itor))
@@ -620,7 +620,7 @@ void CharacterService::CreateCharacter(const PacketEvent<AssignCharacterRequest>
     characterComponent.LeveledNpcPickId = FormIdComponent(message.LeveledNpcPickId);
 
     if (characterComponent.LeveledNpcPickId)
-        spdlog::info("Stored leveled NPC pick {:x}:{:x} for FormId {:x}:{:x}", message.LeveledNpcPickId.ModId, message.LeveledNpcPickId.BaseId, gameId.ModId, gameId.BaseId);
+        spdlog::debug("Stored leveled NPC pick {:x}:{:x} for FormId {:x}:{:x}", message.LeveledNpcPickId.ModId, message.LeveledNpcPickId.BaseId, gameId.ModId, gameId.BaseId);
     characterComponent.FaceTints = message.FaceTints;
     characterComponent.FactionsContent = message.FactionsContent;
     characterComponent.SetDead(message.CurrentActorData.IsDead);