formats+app: a stale snapshot archive mounts below the realm's patches

grom is keeping `patch-A.mpq` — it is almost certainly textures — so the
shadowing it causes is handled in the chain instead of on his disk.

`mount_order` stays the reference's law, letter above digit and all, and
`demote_stale_snapshots` runs after it: an archive whose `FrameXML.toc`
is a **strict subset** of another's is an earlier edition of the realm's
manifest, so it mounts just below the patch set — above `patch.MPQ` and
the base archives, so anything only it carries still resolves. A toc
that differs by *removal* is a different manifest rather than an older
one and is left exactly where its name puts it. `WOW_CHAIN_DEMOTE=0`
keeps the reference's order for comparison.

On his install `patch-A.mpq` (Aug 7) now loses to `patch-5.mpq`, so the
realm's current data is what loads: its `FrameXML.toc`, its
`GlobalStrings.lua` and a `Spell.dbc` with **28019** rows against the
27992 his last session reported — 27 spells the update added that were
invisible.

Reading the realm's real files then broke ten tests, all of which had
pinned August's behaviour, and each is now pinned the realm's way:

- `AIOHandlers.lua` claimed the `OctoRadio` block as a no-op on the
  evidence that the radio file carried no AIO call. The update built the
  radio out into a file twice the size whose `RegisterNowPlayingFeed`
  registers that name at `VARIABLES_LOADED`, and `AIO.RegisterEvent`
  asserts on a duplicate, so our shim raised through seven tests. The
  row is gone, and the shim now claims at `PLAYER_LOGIN` through `pcall`
  so a realm that implements one of these takes the name and we step
  aside. `no_aio_block_we_shim_is_one_the_realm_now_handles` fails a row
  the realm has implemented — verified by putting `OctoRadio` back.
- `BATTLEFIELDS_CLOSED` no longer hides the battlefield list, by the
  realm's decision: the server stamps `SMSG_BATTLEFIELD_LIST`'s
  battlemaster guid with the player's own, so the client anchors the
  window to the spot it opened and closes it when you step away, on foot
  or on a boat (bug tracker #330 and its follow-up). Pinned that way,
  with the close button proving the list still closes.
- `MAX_QUESTLOG_QUESTS` is 25, not 1.12's 20. The test reads the realm's
  global now, so the next bump is data and not a failure.
- The realm's `OctoQuestLogPoller` redraws the log every 0.2 s, which
  legitimately costs a layout gate walk. `POLLS_ON_A_TIMER` stands it
  down by name before the quiet-frame bench measures, rather than
  raising the threshold and blunting the one instrument that catches an
  every-frame writer. A timed realm handler that is not listed fails.

269 data-gated failures, identical to the baseline at HEAD name for
name, and all nine gates green.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01SgstFWtn1RxEJ5kVrpgYwn

crates/benilla-app/src/ui_script/battlefield_tests.rs

@@ -207,12 +207,28 @@ fn the_list_window_opens_on_battlefields_show_and_joins_the_selection() {
     s.run("BattlefieldFrameJoinButton:Click()").unwrap();
     assert_eq!(s.take_battlefield_join_requests(), vec![(9, false)]);
 
+    // `BATTLEFIELDS_CLOSED` does **not** close this list on OctoWoW, and that is the realm's own
+    // decision rather than a gap here. Its `BattlefieldFrame.lua` returns out of that handler for
+    // the raw-shown list (bug tracker #330 and its follow-up): the server stamps
+    // `SMSG_BATTLEFIELD_LIST`'s battlemaster guid with the *player's own*, so the client treats the
+    // window as an NPC conversation anchored where it opened and fires the close as soon as you
+    // step off that spot — on foot, on a taxi, or on a boat that carries you off it. The realm
+    // queues from anywhere by design, so there is no proximity rule left to honour.
+    //
+    // This assertion used to read the other way, against an August copy of that file in an archive
+    // that outranked the realm's own (`chain::demote_stale_snapshots`). It is pinned in the
+    // realm's direction now, and the close button below is what proves the list still closes.
     s.fire_event("BATTLEFIELDS_SHOW", vec![]);
     assert!(visible(&s, "BattlefieldFrame"));
     s.fire_event("BATTLEFIELDS_CLOSED", vec![]);
+    assert!(
+        visible(&s, "BattlefieldFrame"),
+        "the realm swallows the leash's event: stepping off the anchor must not shut the list"
+    );
+    s.run("BattlefieldFrameCloseButton:Click()").unwrap();
     assert!(
         !visible(&s, "BattlefieldFrame"),
-        "the leash's event hides it"
+        "…and its own close button still does close it (`BattlefieldFrame_OctoHide`)"
     );
 }
 

crates/benilla-app/src/ui_script/questlog_tests.rs

@@ -772,10 +772,20 @@ fn empty_quest_log_hides_rows_and_disables_abandon() {
             .unwrap(),
         "no selection: the detail pane is hidden, header and all"
     );
+    // Against the realm's own cap, not 1.12's 20: OctoWoW's `QuestLogFrame.lua` sets
+    // `MAX_QUESTLOG_QUESTS = 25` and drives slots 21-25 from its own poller, since those ride
+    // update-fields the client's descriptor table calls combat ratings and so never raise the
+    // quest-log event. Read from the global rather than pinned, so the next bump is data and not a
+    // failure; this read 20 while an August copy of that file outranked the realm's own
+    // (`chain::demote_stale_snapshots`).
+    let cap = s
+        .eval::<i64>("return MAX_QUESTLOG_QUESTS")
+        .expect("the realm's quest-log cap");
+    assert!(cap >= 20, "the cap cannot be below 1.12's own: {cap}");
     assert_eq!(
         s.eval::<String>("return QuestLogQuestCount:GetText()")
             .unwrap(),
-        "Quests: |cffffffff0/20|r"
+        format!("Quests: |cffffffff0/{cap}|r")
     );
 }
 

crates/benilla-app/src/ui_script/reference_ui.rs

@@ -484,6 +484,62 @@ mod tests {
         }
     }
 
+    /// Our AIO shim claims a block name against every later registration, the realm's own
+    /// included, because `AIO.RegisterEvent` asserts on a duplicate and AIO cannot unregister. So
+    /// a name in `IGNORED` must be one the realm's own interface does *not* register, or the row
+    /// has gone stale and the shim is standing in front of a feature that now exists.
+    ///
+    /// Exactly what happened on 2026-10-23: the row claimed `OctoRadio` on the evidence that the
+    /// radio file carried no AIO call, and the update built it out into one that registers that
+    /// name at `VARIABLES_LOADED`. The shim yields through `pcall` now rather than raising, so this
+    /// is about the row being wrong rather than fatal — but a wrong row still means a dead feature,
+    /// and this is where it gets noticed.
+    #[test]
+    fn no_aio_block_we_shim_is_one_the_realm_now_handles() {
+        let _data = benilla_formats::wow_data_or_skip!();
+        let shim = super::super::content::read("AIOHandlers.lua").expect("our AIO shim");
+        let names: Vec<String> = shim
+            .lines()
+            .find(|l| l.trim_start().starts_with("local IGNORED"))
+            .map(|l| {
+                l.split('"')
+                    .skip(1)
+                    .step_by(2)
+                    .map(str::to_string)
+                    .collect()
+            })
+            .expect("the IGNORED list, as one line of string literals");
+        if names.is_empty() {
+            return;
+        }
+        let Some(rows) = super::realm_toc_rows() else {
+            return;
+        };
+        let mut taken = Vec::new();
+        for row in &rows {
+            let path = format!("{}{}", super::FRAMEXML_PREFIX, row.replace('/', "\\"));
+            let Some(bytes) = super::read(&path) else {
+                continue;
+            };
+            let src = benilla_ui::source::decode(&bytes);
+            for name in &names {
+                // `AIO.AddHandlers("X", …)` and `AIO.RegisterEvent("X", …)` both claim the name.
+                if src.contains(&format!("AddHandlers(\"{name}\""))
+                    || src.contains(&format!("RegisterEvent(\"{name}\""))
+                {
+                    taken.push(format!("{name} (registered in {row})"));
+                }
+            }
+        }
+        assert!(
+            taken.is_empty(),
+            "AIOHandlers.lua stands in for AIO blocks the realm now handles itself \u{2014} drop \
+             them from IGNORED, or the shim claims the name first and the real handler never \
+             runs: {}",
+            taken.join(", ")
+        );
+    }
+
     /// A [`super::DECLINED`] row must still be a row the realm ships, or it is a note about a file
     /// nobody has any more — and the next reader would take it for a live decision.
     #[test]

crates/benilla-app/src/ui_script/resolve_bench.rs

@@ -223,6 +223,18 @@ fn an_authored_span_is_read_without_resolving_and_a_derived_one_is_not() {
     );
 }
 
+/// Frames in the player's own interface that redraw on a timer rather than on an event, which this
+/// bench stands down before measuring. Each row says why the redraw is legitimate, so a row that
+/// stops being true is a row to delete.
+const POLLS_ON_A_TIMER: &[(&str, &str)] = &[(
+    "OctoQuestLogPoller",
+    "OctoWoW's own, in its `QuestLogFrame.lua`: every 0.2 s it calls `GetNumQuestLogEntries()` and \
+     on a change redraws the log and the watch. Load-bearing on the reference client rather than a \
+     convenience — quest slots 21-25 ride update-fields the descriptor table calls combat ratings, \
+     so nothing raises the quest-log event for them and the poll is the only thing that notices an \
+     accepted quest",
+)];
+
 /// With nothing happening, the settled shipped UI costs zero gate walks per frame: this catches a
 /// shipped handler writing a layout input every frame. `WOW_LAYOUT_TOUCH_TRACE=<secs>:<n>` names
 /// the writer on a live run (`docs/CONTRIBUTING.md`, "Running it unattended").
@@ -246,6 +258,31 @@ fn the_settled_shipped_ui_costs_no_gate_walk_on_a_quiet_frame() {
     )
     .expect("the shipped UI's OnUpdate handlers must run under app_frame_ticked");
 
+    // The realm's own periodic handlers are stood down for the measurement, by name and with the
+    // reason, because the question here is whether *our* shipped UI writes a layout input on a
+    // quiet frame. A handler that redraws on a timer is not that, and tolerating it by raising the
+    // threshold instead would blunt the only instrument that catches an every-frame writer: one of
+    // those costs a walk per frame where a 0.2 s poller costs one per twelve.
+    //
+    // Keeping the list explicit is the point. A realm handler that appears here and is not listed
+    // fails this test, which is how the next one gets read rather than absorbed.
+    for (frame, why) in POLLS_ON_A_TIMER {
+        let armed = s
+            .eval::<bool>(&format!(
+                "local f = getglobal(\"{frame}\") return f ~= nil and f:GetScript(\"OnUpdate\") ~= nil"
+            ))
+            .unwrap_or(false);
+        assert!(
+            armed,
+            "`{frame}` is listed as a timed redraw this test stands down, but the loaded \
+             interface has no such frame with an OnUpdate — drop the row ({why})"
+        );
+        s.run(&format!(
+            "getglobal(\"{frame}\"):SetScript(\"OnUpdate\", nil)"
+        ))
+        .expect("stand down a timed redraw");
+    }
+
     let before = s.layout_gate_walks();
     for _ in 0..20 {
         app_frame_ticked(&mut s, 1.0 / 60.0);