feat(challenges): non-combat engine v2 — six challenge frameworks

[Daren9m]

PR 2 of the Non-Combat Encounter Engine v2 (closes #49). Rebuilds /challenges on the shared core that shipped with the puzzles overhaul — six structured frameworks, every lever shaping the encounter, every result seeded and shareable.

What's new

Six challenge frameworks (src/lib/challenge-frameworks/)

• Skill challenges — success counts derived from party size × time budget × difficulty (successesNeeded/phaseSplit math, test-locked), set-piece phases with objective-specific titles, a complication ladder at the 1st/2nd failure, one group-check moment, and a skill palette lint-enforced to span ≥4 ability scores so every PC has a lane
• Social encounters — persona × want × secret × leverage (what actually moves them, and what backfires), a three-state attitude track (Hostile→Indifferent→Friendly with per-stage influence DCs, unlocks, and shift conditions), side NPCs scaled to party size with distinct wants
• Exploration — obstacle chains sized by time budget, weather woven in, tier-aware creative-solution guidance ("at tier 3+, assume fly — here's how it stays interesting"), climactic failure costs per the severity-table column rule
• Complex traps — detection clues placed before the trigger, 2/2/3 stepped countermeasures by difficulty, climactic trigger + recurring escalation damage, tone-aware stakes (whimsical traps embarrass instead of maiming; grim wounds refuse healing), and a twist
• Chases (new) — quarry profiles with tricks and desperation moves, one waypoint complication per round (3/5/7 by time budget), and a live lead counter with concrete catch/escape math
• Investigations (new) — a generated truth (culprit/method/motive) behind a clue web honoring the three-clue rule: 2/3/4 revelation nodes by budget, three clues per node on three distinct discovery vectors, difficulty-driven directness, exactly one red herring with its disconfirming clue, and a shuffled clue-cards player handout

Content: new cast pools (14 personas, 20 wants, 20 secrets, 6 leverage kinds, complications, interruptions) and scenario pools (14 objectives, 17 obstacles, 10 weather lines, 15 trap frames, 12 quarries, 14 waypoints, 12 investigation frames) — all lint-enforced (sizes, ability spread, no dice/DC text in data, register rules).

Challenges page: the same seven levers as /puzzles (including working party size), seed chip with reroll, full-state ?seed= share links with one-shot hydration, six type quick-cards, and new display sections (challenge structure, attitude track, chase rounds, DM clue web, rendered clue-card handouts). The orchestrator's frozen draw order is golden-pinned (default + explicit-lever paths).

Process

Spec: docs/superpowers/specs/2026-07-15-noncombat-encounter-engine-v2-design.md §8 · Plan: docs/superpowers/plans/2026-07-16-noncombat-engine-v2-pr2-challenges.md

10 TDD tasks, each gated by an independent spec+quality review (6 fix waves — including a reviewer catch that clue templates leaked the placeholder "the culprit" onto player-facing cards). The final whole-branch review swept 7,776 generated encounters across every lever combination (zero mechanical defects) and its five content findings were fixed pre-merge while the seed contract was still fluid.

Verification

• 295 tests green (structure-math locks, three-clue-rule property tests, tone contracts, golden pins hand-derived from the LCG by an independent reviewer)
• npm run typecheck / npm run build clean; live browser pass over all six types (dev) and a static-export check with zero console errors
• Both pages now share one engine core — levers, theming, seeds, and handouts behave identically across /puzzles and /challenges