From 1c4cc147f59577e4d70190db6826b2fd56e979e4 Mon Sep 17 00:00:00 2001
From: Sam <samuv.eth@gmail.com>
Date: Sat, 29 Aug 2026 17:20:24 +0700
Subject: [PATCH] GM tickets are in, and a login failure shows the string 1.12
 shows
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- GM tickets, end to end: five request/answer pairs, the seven Help-window bindings, three events and `GMTicketCategory.dbc` — the ten categories `HelpFrame.lua` keys 1..10 live in a DBC nothing here had ever opened (the four `TICKET_TYPE` strings feed a dropdown 1.12 never gave a frame); the category is one byte on the wire (a u32 would shift the map id and position and file every ticket at a garbage spot), and `UPDATETEXT` carries it too, which vmangos stores and cmangos swallows as the first character of the text — faithful to the client, the divergence recorded
- the engine re-asks for the ticket after a create or update succeeds and on a status push (the ask opcode has three callers in the reference, two of them engine legs with no idempotence guard) — which is why the shipped FrameXML registers no handler for the three response opcodes and still repaints; without that leg the form stays a form for ten minutes; `UPDATE_GM_STATUS` is a signed passthrough (`0xFFFFFFFF` → −1), the five ticket verbs drain through one ordered queue because call order is wire order, and the Help micro button — drawn, hovering and a no-op since the micro menu landed — is live
- a typed wrong password reads the reference's long "check the spelling of the account name and password" (0x04 and 0x05 share one jump-table arm — the client cannot say "wrong password", and the lockout cmangos's header describes does not exist in the binary), unknown codes read "Disconnected from server" rather than "Authentication failed", and every realmd row of the old map was in the wrong one: the two login-status enums have two key tables and two dialog paths, and a server source can only ever verify the codes, never which string the client draws for them

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 crates/benilla-app/assets/ui/HelpFrame.xml    | 1669 +++++++++++++++++
 crates/benilla-app/assets/ui/MicroMenu.xml    |   33 +-
 crates/benilla-app/assets/ui/UiPanels.xml     |   18 +-
 crates/benilla-app/assets/ui/benilla.toc      |   16 +
 crates/benilla-app/src/capture/mod.rs         |    2 +
 .../src/capture/probe_gm_ticket.rs            |  779 ++++++++
 crates/benilla-app/src/dev.rs                 |    8 +
 crates/benilla-app/src/lib.rs                 |    7 +
 crates/benilla-app/src/login/mod.rs           |  169 +-
 crates/benilla-app/src/net.rs                 |  597 ++++--
 crates/benilla-app/src/net/apply.rs           |   36 +
 crates/benilla-app/src/net/apply/session.rs   |    6 +
 crates/benilla-app/src/net/io.rs              |   12 +
 crates/benilla-app/src/ui_gm_ticket.rs        |  611 ++++++
 .../src/ui_script/help_frame_tests.rs         |  400 ++++
 crates/benilla-app/src/ui_script/mod.rs       |    6 +
 .../benilla-formats/src/gm_ticket_category.rs |  143 ++
 crates/benilla-formats/src/lib.rs             |    4 +
 crates/benilla-protocol/src/events.rs         |   21 +-
 crates/benilla-protocol/src/events/decode.rs  |   16 +
 .../src/messages/gm_ticket.rs                 |  282 +++
 crates/benilla-protocol/src/messages/mod.rs   |   14 +
 .../benilla-protocol/src/messages/opcode.rs   |   41 +
 .../benilla-protocol/src/messages/packet.rs   |   41 +-
 crates/benilla-protocol/src/messages/parse.rs |   28 +-
 .../src/world/writer/gm_ticket.rs             |   79 +
 .../benilla-protocol/src/world/writer/mod.rs  |    2 +
 crates/benilla-ui/src/script/gm_ticket.rs     |  164 ++
 crates/benilla-ui/src/script/mod.rs           |    3 +
 crates/benilla-ui/src/script/model.rs         |   16 +
 .../benilla-ui/src/script/tests/gm_ticket.rs  |  163 ++
 crates/benilla-ui/src/script/tests/mod.rs     |    1 +
 32 files changed, 5215 insertions(+), 172 deletions(-)
 create mode 100644 crates/benilla-app/assets/ui/HelpFrame.xml
 create mode 100644 crates/benilla-app/src/capture/probe_gm_ticket.rs
 create mode 100644 crates/benilla-app/src/ui_gm_ticket.rs
 create mode 100644 crates/benilla-app/src/ui_script/help_frame_tests.rs
 create mode 100644 crates/benilla-formats/src/gm_ticket_category.rs
 create mode 100644 crates/benilla-protocol/src/messages/gm_ticket.rs
 create mode 100644 crates/benilla-protocol/src/world/writer/gm_ticket.rs
 create mode 100644 crates/benilla-ui/src/script/gm_ticket.rs
 create mode 100644 crates/benilla-ui/src/script/tests/gm_ticket.rs

diff --git a/crates/benilla-app/assets/ui/HelpFrame.xml b/crates/benilla-app/assets/ui/HelpFrame.xml
new file mode 100644
index 00000000..691cdc98
--- /dev/null
+++ b/crates/benilla-app/assets/ui/HelpFrame.xml
@@ -0,0 +1,1669 @@
+<Ui>
+    <!--
+        benilla's GM help window — the trouble-ticket panel the Help micro button opens, plus the
+        ticket-status toast that hangs under the buff row while a ticket is open.
+
+        The house convention, as MailFrame.xml and AuctionFrame.xml state it: the geometry, art
+        paths, sizes, offsets, anchors and texcoords below are QUOTED from the reference
+        `WoW/_extracted_framexml/HelpFrame.xml` (cited inline as `ref-xml l.N`) — they are
+        measurements, not expression. **THE LUA IS OURS.** The reference's `HelpFrame.lua` is the
+        SPECIFICATION — which functions an addon may call, the event vocabulary, and every branch's
+        observable effect are read off it (`ref-lua l.N`) — and how any of it is spelled here is
+        this file's own business. It is folded into the inline script block below rather than
+        shipped as a second `.lua`, which is this house's shape for every transcribed window.
+
+        NAMES ARE THE REFERENCE'S, not `Benilla*`-prefixed. `ToggleHelpFrame`, `HelpFrame`,
+        `TicketStatusFrame` and `HelpFrame_ShowFrame` are the names the reference's own
+        MainMenuBarMicroButtons and StaticPopup entries reach by, and MicroMenu.xml is a straight
+        transcription that now calls the first of them. Same posture as MicroMenu/FriendsFrame.
+
+        ── THE ENGINE SEAM ─────────────────────────────────────────────────────────────────────
+        Six bindings, all of them the reference's own declarations: `GetGMTicket()`,
+        `NewGMTicket(category, text)`, `UpdateGMTicket(category, text)`, `DeleteGMTicket()`,
+        `GetGMStatus()` and `Stuck()`, plus `GetGMTicketCategories()` — a flat vararg list
+        `id1, name1, id2, name2, …` sourced from `GMTicketCategory.dbc`. That DBC ships exactly ten
+        rows and its ids ARE the wire category values (1 Stuck, 2 Behavior/Harassment, 3 Guild,
+        4 Item, 5 Environmental, 6 Non-Quest/Creep, 7 Quest/Quest NPC, 8 Technical,
+        9 Account/Billing, 10 Character) — which is WHY `HELPFRAME_FRAMES` and `GENERAL_HELPFRAME`
+        below are keyed 1..10: the keys are the DBC ids, so `HelpFrameGM_UpdateCategories`'s
+        `button.key = <id>` transcribes unchanged and a click carries the wire value straight into
+        `NewGMTicket`.
+
+        ── THE STRING TABLE ─────────────────────────────────────────────────────────────────────
+        We ship none of Blizzard's text (AuctionFrame.xml's header carries the law):
+        `GlobalStrings.lua` is EXECUTED off the player's own patch chain at boot. In XML a
+        SCREAMING_SNAKE `text` attribute IS a global-string lookup (loader/mod.rs `resolve_text`,
+        wow-re `FrameScript_GetText 0x703bf0`), which is the reference's own mechanism and is used
+        verbatim throughout the markup below. In Lua every read goes through
+        `gs(key[, fallback])`, because a harness that loads only this XML has no string table and a
+        nil global there would take a whole repaint down. A fallback is a SHAPE ("%s"), never a
+        translation — only `GM_TICKET_WAIT_TIME` needs one; every other key is plain prose whose
+        shape is the empty string.
+
+        ── WHAT IS DELIBERATELY NOT HERE ────────────────────────────────────────────────────────
+        1 · **The GM survey.** `Blizzard_GMSurveyUI` is a separate addon and a separate decision.
+            The three places the reference reaches it (`HelpFrameOpenTicket_OnEvent`'s
+            `GMSURVEY_DISPLAY` arm, `TicketStatusFrame.hasGMSurvey`, and the survey branch shared by
+            `TicketStatusButton`'s OnClick and the toast's OnMouseUp) are transcribed STRUCTURALLY —
+            the event is still registered, the flag still exists, the branch is still taken first —
+            but the body is a no-op that cannot error. In particular `GMSurveyFrame_LoadUI()` is NOT
+            called: no such global exists here, and calling it would abort the handler. Deferred,
+            not forgotten.
+        2 · **`HelpFrameOpenTicketDropDown_*` (ref-lua l.361-387) is DEAD and is dropped.** Four
+            functions with no frame: grepping the whole 1.12 extraction for
+            `HelpFrameOpenTicketDropDown` finds only those four definitions and ONE more hit —
+            ref-xml l.750, where `HelpFrameOpenTicket`'s `<OnShow>` body is
+            `HelpFrameOpenTicketDropDown_OnShow();` behind a Lua line comment, commented
+            out by Blizzard itself. No `<Frame>`,
+            `<Button>` or `CreateFrame` anywhere declares that name, so
+            `UIDropDownMenu_Initialize(this, …)` in `_OnLoad` could never have run and
+            `UIDropDownMenu_SetSelectedID(HelpFrameOpenTicketDropDown, …)` in `_OnClick` would
+            index a nil global. `TICKET_TYPE1..4` (GlobalStrings.lua l.4239-4242) feed only
+            `_Initialize` and are therefore dead with it. The ticket's category comes from the GM
+            category button that was clicked instead (`HelpFrameOpenTicket.ticketType`).
+        3 · **The `<OnUpdate>ScrollingEdit_OnUpdate()</OnUpdate>` on the ticket editor** (ref-xml
+            l.700-702). `ScrollingEdit_OnTextChanged` and `_OnCursorChanged` both ship
+            (ScrollTemplates.xml) and are wired below; `_OnUpdate` deliberately does not — it needs
+            the caret's own pixel offset from the font engine, which our EditBox does not report
+            yet, and that file names it rather than stubbing it. Wiring a call to a nil global would
+            abort the editor's OnUpdate every frame, so the handler is absent. Consequence: typing
+            past the bottom of the 378px view does not auto-scroll; the bar still does.
+        4 · **HELP_TICKET's close button and its 350px width** (ref StaticPopup.lua l.1591-1597).
+            Our shared StaticPopupTemplate (UiPanels.xml) declares no `$parentCloseButton`, and
+            `StaticPopup_Show`'s width arm says so in its own comment ("HELP_TICKET's 350 arm waits
+            for that dialog"). Both halves are the ENGINE's to grow, not this window's, so the
+            dialog shows at the standard 320 with no corner X. It is not a trap: clicking the ticket
+            icon again hides it (`TicketStatus_OnClick`'s middle branch, ref-xml l.1490-1492), which
+            is the reference's own second way out. Its two labels ("Edit My Ticket" / "Abandon My
+            Ticket") also sit in the engine's fixed 120px buttons — UiPanels.xml's own named
+            narrowing.
+
+        ── FRAMES NOTHING REACHES TODAY (transcribed anyway, so nobody "fixes" a non-bug) ───────
+        `HelpFrameStuck` (ref-xml l.1301-1378) and `HelpFrameBug` (ref-xml l.1380-1392) are
+        unreachable in 1.12. Every caller of `HelpFrame_ShowFrame` in the whole extraction passes
+        "Home", "GMHome", "OpenTicket", or a GM category id 1..10 (grepped: ref-lua l.177/504/540,
+        ref-xml l.378/593/975/1105/1255/1285/1373, StaticPopup.lua l.351) — never "Stuck" and never
+        "Bug". `HELPFRAME_FRAMES["Stuck"]` therefore never fires, because ticket category 1
+        ("Stuck") routes through `HELPFRAME_FRAMES[1]` to `HelpFrameGeneral`, which
+        `GENERAL_HELPFRAME[1]` dresses with the unstick button. There is no `HELPFRAME_FRAMES`
+        "Bug" key at all — `HelpFrameBug` is a bare divider frame with no route to it. Both are
+        transcribed because they are the reference's own layout and a later
+        `HelpFrame_ShowFrame("Stuck")` would want them intact.
+
+        ── DELIBERATE DIVERGENCES (each stated where it stands, listed here so they are countable) ─
+        1 · The GM category list is the house FAUX scroll kit (ScrollTemplates.xml, decisions
+            0247/0250/0251): a plain `<Frame inherits="FauxScrollFrameTemplate">`, not the
+            reference's `<ScrollFrame>`, so its `<OnVerticalScroll>` body (ref-xml l.564-566) has
+            nothing to fire and is replaced by an `updateFunc`. The three loose trough textures the
+            reference hangs beside each bar (ref-xml l.517-560 and l.642-685) become the kit's
+            shared `BenillaScrollTroughTemplate`, whose seat law was derived from exactly these
+            offsets. ReputationFrame.xml's precedent.
+        2 · The ticket editor's scroll frame IS a real `UIPanelScrollFrameTemplate`, so its bar is
+            always up and `BenillaScrollBar_SetShown` (the only thing that seats a trough) never
+            runs for it. Its trough is seated explicitly in the frame's OnLoad through the kit's own
+            public `BenillaScrollTrough_Seat`. GuildInfoFrameScrollFrame (FriendsFrame.xml) simply
+            has no trough; that is an omission, not a law, and the reference draws the channel here.
+        3 · "Fit the button to its label" reads the Button's own `GetTextWidth()` (which forwards to
+            the label's unwrapped `GetStringWidth`, script/button.rs) rather than the reference's
+            `…Text:GetWidth()`. Same number for a non-wrapping label; the laid-out width is the one
+            that feeds itself its own previous output (decision 0997's measured feedback loop). The
+            fit also moves from the button's `<OnLoad>` to its page's `<OnShow>`, because a measure
+            taken before the atlas has seen the string answers 0 and nothing would re-run it.
+        4 · `TicketStatusFrame_OnEvent`'s "no ticket" leg re-anchors `TemporaryEnchantFrame` back to
+            TOPRIGHT **(-175, -13)**, not the reference's (-180, -13) (ref-lua l.498). -175 is what
+            BuffFrame.xml (and ref-BuffFrame.xml l.390-394) actually declares, so the reference
+            nudges the frame 5px left after every ticket closes and never puts it back. A typo, not
+            a mechanism — MicroMenu.xml's precedent for not reproducing one.
+        5 · `HELP_TICKET`'s OnCancel drops the reference's `local currentFrame = this:GetParent()` /
+            `dialogFrame.data = currentFrame` pair (StaticPopup.lua l.357-361). Our engine calls
+            `OnCancel(data, reason)` as a plain function with no `this`, and nothing ever reads that
+            data — `HELP_TICKET_ABANDON_CONFIRM`'s OnAccept calls `DeleteGMTicket()` with no
+            argument. Keeping it would be two lines that can only throw.
+        6 · The reference's Lua-5.0 `arg`/`arg.n` vararg table is written the 5.1-native way,
+            `select("#", ...)` / `select(i, ...)` (this VM is lua51 — TalentFrame.xml's precedent),
+            and its `for k, v in <table> do` generic-for becomes `ipairs`.
+        7 · `elapsedTime = 0` (ref-lua l.164) is dropped: a global assigned once and read nowhere in
+            the whole extraction. `refreshTime` (ref-lua l.495/548) becomes a file-local rather than
+            a leaked global — it is read by exactly one function in this file.
+        8 · `message("Not enough bullets!  Tell Derek")` (ref-lua l.260/284) is dropped. It is a
+            Blizzard developer assert naming a Blizzard engineer, not UI text, and the branch is
+            unreachable: `MAX_GENERAL_BULLETS` is 10 and the longest configured run is 7.
+        9 · `HelpFrameOpenTicket_OnEvent`'s `ticketFrameHeight`/`twoLineHeight` locals are dropped:
+            assigned on three legs and read on none, even in the reference — the toast sizes itself
+            from its two measured FontStrings. ReputationFrame.xml's precedent.
+
+        ── TWO FIDELITY NOTES A LATER READER WOULD OTHERWISE MISREAD AS BUGS ────────────────────
+        · `HelpFrame_OnEvent`'s `UPDATE_GM_STATUS` arm branches on arg1 == 1 (queue up) and
+          arg1 == -1 (queue down AND pop HELP_TICKET_QUEUE_DISABLED). Against the vmangos server
+          benilla talks to, `SMSG_GMTICKETSYSTEMSTATUS` only ever carries 0 or 1 — so the -1 leg is
+          transcribed faithfully and is simply unreachable here today.
+        · `CATEGORY_TO_NOT_DISPLAY` (ref-lua l.305) suppresses one category's action button. Its
+          ONLY setter in the whole extraction is `Localization.lua`'s `LocalizeFrames()` (l.23,
+          `= 9`) — an enGB-only adjustment that hides the Billing & Account button because EU
+          billing went somewhere else. benilla ships no Localization.lua (GameTime.xml's header
+          makes the same note about `TwentyFourHourTime`), so the global is nil, the guard never
+          fires, and category 9 keeps its button. That is the enUS behaviour.
+    -->
+    <Script><![CDATA[
+        -- One GlobalString read. See this file's header: the table is the player's own, executed
+        -- off their chain at boot, and absent in a bare-XML harness.
+        local function gs(key, fallback)
+            local value = getglobal(key)
+            if value and value ~= "" then
+                return value
+            end
+            return fallback or ""
+        end
+
+        -- ── Constants (ref-lua l.1-2, l.160-166) ────────────────────────────────────────────────
+        HELPFRAME_BULLET_SPACING = -3         -- ref-lua l.1
+        HELPFRAME_SECTION_SPACING = -20       -- ref-lua l.2
+        MAX_GENERAL_BULLETS = 10              -- ref-lua l.160
+        NUM_GM_CATEGORIES_TO_DISPLAY = 10     -- ref-lua l.161
+        GMTICKET_CHECK_INTERVAL = 600         -- ref-lua l.162: 10 minutes
+        -- The petition queue starts ASSUMED UP (ref-lua l.166), so the window is usable before the
+        -- first UPDATE_GM_STATUS lands. Public because the HELP_TICKET dialog below reads it.
+        PETITION_QUEUE_ACTIVE = 1
+
+        -- Seconds until the next GetGMTicket poll while a ticket is open (ref-lua l.495/548). A
+        -- file-local, not the reference's leaked global: one reader, in this file.
+        local refreshTime
+
+        -- ref-lua l.5-8. Defined before GENERAL_HELPFRAME because that table stores it as a value;
+        -- the reference's own comment on this is "Ugly, but needs to be up here".
+        function HelpFrameUnstick_OnClick()
+            Stuck()
+            HideUIPanel(HelpFrame)
+        end
+
+        -- ── The category → page routing table (ref-lua l.11-27) ────────────────────────────────
+        -- The numeric keys ARE the GMTicketCategory.dbc ids (this file's header): whatever
+        -- GetGMTicketCategories() hands a button becomes both the page key and the wire category.
+        -- Nine of the ten land on the one HelpFrameGeneral page, which GENERAL_HELPFRAME below
+        -- re-dresses per category; only 2 (Behavior/Harassment) has a page of its own.
+        HELPFRAME_FRAMES = {}
+        HELPFRAME_FRAMES[1] = { name = "HelpFrameGeneral" }       -- Stuck
+        HELPFRAME_FRAMES[2] = { name = "HelpFrameHarassment" }    -- Behavior / Harassment
+        HELPFRAME_FRAMES[3] = { name = "HelpFrameGeneral" }       -- Guild
+        HELPFRAME_FRAMES[4] = { name = "HelpFrameGeneral" }       -- Item
+        HELPFRAME_FRAMES[5] = { name = "HelpFrameGeneral" }       -- Environmental
+        HELPFRAME_FRAMES[6] = { name = "HelpFrameGeneral" }       -- Non-Quest NPC / Creep
+        HELPFRAME_FRAMES[7] = { name = "HelpFrameGeneral" }       -- Quest / Quest NPC
+        HELPFRAME_FRAMES[8] = { name = "HelpFrameGeneral" }       -- Technical
+        HELPFRAME_FRAMES[9] = { name = "HelpFrameGeneral" }       -- Account / Billing
+        HELPFRAME_FRAMES[10] = { name = "HelpFrameGeneral" }      -- Character
+        -- Unreachable today (this file's header): category 1 routes to HelpFrameGeneral above, and
+        -- nothing anywhere passes "Stuck". Kept because the page exists and the route is the
+        -- reference's own.
+        HELPFRAME_FRAMES["Stuck"] = { name = "HelpFrameStuck" }
+        HELPFRAME_FRAMES["GMHome"] = { name = "HelpFrameGM" }
+        HELPFRAME_FRAMES["Home"] = { name = "HelpFrameHome" }
+        HELPFRAME_FRAMES["OpenTicket"] = { name = "HelpFrameOpenTicket" }
+
+        -- ── The nine dressings of the shared general page (ref-lua l.29-158) ───────────────────
+        -- Every string is a gs() read (header). Categories 1..10 minus 2 (its own page); note the
+        -- reference configures no entry for 2, which is exactly why 2 is the one with a page.
+        GENERAL_HELPFRAME = {}
+        -- 1 · Stuck. The only entry with a click override and a second button: its primary action is
+        -- the client-side unstick, and button2 falls through to the normal "page a GM" path
+        -- (HelpFrameGeneralButton_OnClick's else leg). ref-lua l.30-36.
+        GENERAL_HELPFRAME[1] = {
+            title = gs("STUCK_OPTION"),                      -- GlobalStrings l.4207
+            titleText = gs("HELPFRAME_STUCK_TEXT1"),         -- l.2232
+            buttonText = gs("STUCK_BUTTON_TEXT"),            -- l.4206
+            buttonOnClickFunc = HelpFrameUnstick_OnClick,
+            button2Text = gs("STUCK_BUTTON2_TEXT"),          -- l.4205
+        }
+        -- 3 · Guild. ref-lua l.37-47.
+        GENERAL_HELPFRAME[3] = {
+            title = gs("HELPFRAME_GUILD_TITLE"),                    -- l.2179
+            titleText = gs("HELPFRAME_GUILD_TEXT"),                 -- l.2178
+            bulletTitle1 = gs("HELPFRAME_GUILD_BULLET_TITLE1"),     -- l.2176
+            bullets1 = {
+                gs("HELPFRAME_GUILD_BULLET1"),                      -- l.2173
+                gs("HELPFRAME_GUILD_BULLET2"),                      -- l.2174
+                gs("HELPFRAME_GUILD_BULLET3"),                      -- l.2175
+            },
+            buttonText = gs("HELPFRAME_GUILD_BUTTON_TEXT"),         -- l.2177
+        }
+        -- 4 · Item. ref-lua l.48-65.
+        GENERAL_HELPFRAME[4] = {
+            title = gs("HELPFRAME_ITEM_TITLE"),                     -- l.2203
+            titleText = gs("HELPFRAME_ITEM_TEXT"),                  -- l.2202
+            bulletTitle1 = gs("HELPFRAME_ITEM_BULLET_TITLE1"),      -- l.2199
+            bullets1 = {
+                gs("HELPFRAME_ITEM_BULLET1"),                       -- l.2192
+                gs("HELPFRAME_ITEM_BULLET2"),                       -- l.2193
+                gs("HELPFRAME_ITEM_BULLET3"),                       -- l.2194
+                gs("HELPFRAME_ITEM_BULLET4"),                       -- l.2195
+                gs("HELPFRAME_ITEM_BULLET5"),                       -- l.2196
+            },
+            bulletTitle2 = gs("HELPFRAME_ITEM_BULLET_TITLE2"),      -- l.2200
+            bullets2 = {
+                gs("HELPFRAME_ITEM_BULLET6"),                       -- l.2197
+                gs("HELPFRAME_ITEM_BULLET7"),                       -- l.2198
+            },
+            buttonText = gs("HELPFRAME_ITEM_BUTTON_TEXT"),          -- l.2201
+        }
+        -- 5 · Environmental. ref-lua l.66-83.
+        GENERAL_HELPFRAME[5] = {
+            title = gs("HELPFRAME_ENVIRONMENTAL_TITLE"),                  -- l.2168
+            titleText = gs("HELPFRAME_ENVIRONMENTAL_TEXT"),               -- l.2167
+            bulletTitle1 = gs("HELPFRAME_ENVIRONMENTAL_BULLET_TITLE1"),   -- l.2164
+            bullets1 = {
+                gs("HELPFRAME_ENVIRONMENTAL_BULLET1"),                    -- l.2158
+                gs("HELPFRAME_ENVIRONMENTAL_BULLET2"),                    -- l.2159
+                gs("HELPFRAME_ENVIRONMENTAL_BULLET3"),                    -- l.2160
+                gs("HELPFRAME_ENVIRONMENTAL_BULLET4"),                    -- l.2161
+            },
+            bulletTitle2 = gs("HELPFRAME_ENVIRONMENTAL_BULLET_TITLE2"),   -- l.2165
+            bullets2 = {
+                gs("HELPFRAME_ENVIRONMENTAL_BULLET5"),                    -- l.2162
+                gs("HELPFRAME_ENVIRONMENTAL_BULLET6"),                    -- l.2163
+            },
+            buttonText = gs("HELPFRAME_ENVIRONMENTAL_BUTTON_TEXT"),       -- l.2166
+        }
+        -- 6 · Non-Quest NPC / Creep. ref-lua l.84-102.
+        GENERAL_HELPFRAME[6] = {
+            title = gs("HELPFRAME_NONQUEST_TITLE"),                  -- l.2215
+            titleText = gs("HELPFRAME_NONQUEST_TEXT"),               -- l.2214
+            bulletTitle1 = gs("HELPFRAME_NONQUEST_BULLET_TITLE1"),   -- l.2211
+            bullets1 = {
+                gs("HELPFRAME_NONQUEST_BULLET1"),                    -- l.2204
+                gs("HELPFRAME_NONQUEST_BULLET2"),                    -- l.2205
+                gs("HELPFRAME_NONQUEST_BULLET3"),                    -- l.2206
+                gs("HELPFRAME_NONQUEST_BULLET4"),                    -- l.2207
+            },
+            bulletTitle2 = gs("HELPFRAME_NONQUEST_BULLET_TITLE2"),   -- l.2212
+            bullets2 = {
+                gs("HELPFRAME_NONQUEST_BULLET5"),                    -- l.2208
+                gs("HELPFRAME_NONQUEST_BULLET6"),                    -- l.2209
+                gs("HELPFRAME_NONQUEST_BULLET7"),                    -- l.2210
+            },
+            buttonText = gs("HELPFRAME_NONQUEST_BUTTON_TEXT"),       -- l.2213
+        }
+        -- 7 · Quest / Quest NPC. ref-lua l.103-118.
+        GENERAL_HELPFRAME[7] = {
+            title = gs("HELPFRAME_QUEST_TITLE"),                  -- l.2229
+            titleText = gs("HELPFRAME_QUEST_TEXT"),               -- l.2228
+            bulletTitle1 = gs("HELPFRAME_QUEST_BULLET_TITLE1"),   -- l.2225
+            bullets1 = {
+                gs("HELPFRAME_QUEST_BULLET1"),                    -- l.2220
+                gs("HELPFRAME_QUEST_BULLET2"),                    -- l.2221
+                gs("HELPFRAME_QUEST_BULLET3"),                    -- l.2222
+            },
+            bulletTitle2 = gs("HELPFRAME_QUEST_BULLET_TITLE2"),   -- l.2226
+            bullets2 = {
+                gs("HELPFRAME_QUEST_BULLET4"),                    -- l.2223
+                gs("HELPFRAME_QUEST_BULLET5"),                    -- l.2224
+            },
+            buttonText = gs("HELPFRAME_QUEST_BUTTON_TEXT"),       -- l.2227
+        }
+        -- 8 · Technical. The one entry with an endText but NO button: the reference routes technical
+        -- issues to the support site, not to a GM (ref-lua l.119-133 — note it sets `endText` from
+        -- the _BULLET_TITLE2 key, which is that key's real content here).
+        GENERAL_HELPFRAME[8] = {
+            title = gs("HELPFRAME_TECHNICAL_TITLE"),                  -- l.2246
+            titleText = gs("HELPFRAME_TECHNICAL_TEXT"),               -- l.2245
+            bulletTitle1 = gs("HELPFRAME_TECHNICAL_BULLET_TITLE1"),   -- l.2242
+            bullets1 = {
+                gs("HELPFRAME_TECHNICAL_BULLET1"),                    -- l.2235
+                gs("HELPFRAME_TECHNICAL_BULLET2"),                    -- l.2236
+                gs("HELPFRAME_TECHNICAL_BULLET3"),                    -- l.2237
+                gs("HELPFRAME_TECHNICAL_BULLET4"),                    -- l.2238
+                gs("HELPFRAME_TECHNICAL_BULLET5"),                    -- l.2239
+                gs("HELPFRAME_TECHNICAL_BULLET6"),                    -- l.2240
+                gs("HELPFRAME_TECHNICAL_BULLET7"),                    -- l.2241
+            },
+            endText = gs("HELPFRAME_TECHNICAL_BULLET_TITLE2"),        -- l.2243
+        }
+        -- 9 · Account / Billing. ref-lua l.134-145. The reference's bullets1 stops at BULLET3;
+        -- HELPFRAME_ACCOUNT_BULLET4 (l.2141) exists in the string table and is unused — transcribed
+        -- as written rather than "completed".
+        GENERAL_HELPFRAME[9] = {
+            title = gs("HELPFRAME_ACCOUNT_TITLE"),                  -- l.2146
+            titleText = gs("HELPFRAME_ACCOUNT_TEXT"),               -- l.2145
+            bulletTitle1 = gs("HELPFRAME_ACCOUNT_BULLET_TITLE1"),   -- l.2142
+            bullets1 = {
+                gs("HELPFRAME_ACCOUNT_BULLET1"),                    -- l.2138
+                gs("HELPFRAME_ACCOUNT_BULLET2"),                    -- l.2139
+                gs("HELPFRAME_ACCOUNT_BULLET3"),                    -- l.2140
+            },
+            endText = gs("HELPFRAME_ACCOUNT_ENDTEXT"),              -- l.2144
+            buttonText = gs("HELPFRAME_ACCOUNT_BUTTON_TEXT"),       -- l.2143
+        }
+        -- 10 · Character. ref-lua l.146-158.
+        GENERAL_HELPFRAME[10] = {
+            title = gs("HELPFRAME_CHARACTER_TITLE"),                  -- l.2157
+            titleText = gs("HELPFRAME_CHARACTER_TEXT"),               -- l.2156
+            bulletTitle1 = gs("HELPFRAME_CHARACTER_BULLET_TITLE1"),   -- l.2154
+            bullets1 = {
+                gs("HELPFRAME_CHARACTER_BULLET1"),                    -- l.2149
+                gs("HELPFRAME_CHARACTER_BULLET2"),                    -- l.2150
+                gs("HELPFRAME_CHARACTER_BULLET3"),                    -- l.2151
+                gs("HELPFRAME_CHARACTER_BULLET4"),                    -- l.2152
+                gs("HELPFRAME_CHARACTER_BULLET5"),                    -- l.2153
+            },
+            buttonText = gs("HELPFRAME_CHARACTER_BUTTON_TEXT"),       -- l.2155
+        }
+
+        -- Fit a button to its label, the reference's arithmetic (`+40`, ref-xml l.375/1341 and
+        -- ref-lua l.307/334) on the house's measure verb. See divergence 3 in the header for why
+        -- this is `GetTextWidth` and not the label's laid-out `GetWidth`.
+        function HelpFrameButton_FitToText(button)
+            if not button then return end
+            button:SetWidth(button:GetTextWidth() + 40)
+        end
+
+        -- ── The window (ref-lua l.168-194) ─────────────────────────────────────────────────────
+        -- The reference's tab handling is commented out in its own OnLoad (ref-lua l.170-171) and
+        -- OnShow (l.176) — 1.12 ships this window with no tab strip — so it is not transcribed.
+        function HelpFrame_OnLoad(frame)
+            frame:RegisterEvent("UPDATE_GM_STATUS")
+        end
+
+        function HelpFrame_OnShow(frame)
+            HelpFrame_ShowFrame("Home")
+            if UpdateMicroButtons then UpdateMicroButtons() end
+            PlaySound("igCharacterInfoOpen")
+            GetGMStatus()
+        end
+
+        -- ref-lua l.183-194. arg1 == 1 means the petition queue is up; anything else takes it down,
+        -- and -1 additionally says so out loud. Against vmangos, SMSG_GMTICKETSYSTEMSTATUS only
+        -- ever carries 0 or 1, so the -1 leg is faithful but unreachable here (header note).
+        function HelpFrame_OnEvent()
+            if event == "UPDATE_GM_STATUS" then
+                if arg1 == 1 then
+                    PETITION_QUEUE_ACTIVE = 1
+                else
+                    PETITION_QUEUE_ACTIVE = nil
+                    if arg1 == -1 then
+                        StaticPopup_Show("HELP_TICKET_QUEUE_DISABLED")
+                    end
+                end
+            end
+        end
+
+        -- ref-lua l.196-229. `key` is either a HELPFRAME_FRAMES key (a category id, "Home",
+        -- "GMHome", "OpenTicket") or something unknown, which falls through to the ticket editor —
+        -- the reference's own default, and what makes a category with no route still openable.
+        function HelpFrame_ShowFrame(key, ticketType)
+            if HelpFrame.openFrame then
+                HelpFrame.openFrame:Hide()
+            end
+
+            -- Asking for the editor with the queue down closes the window and says why.
+            if key == "OpenTicket" and not PETITION_QUEUE_ACTIVE then
+                HideUIPanel(HelpFrame)
+                StaticPopup_Show("HELP_TICKET_QUEUE_DISABLED")
+                return
+            end
+
+            local frame
+            local frameInfo = HELPFRAME_FRAMES[key]
+            if frameInfo then
+                local targetName = frameInfo.name
+                if targetName == "HelpFrameGeneral" then
+                    HelpFrame_SetupGeneralFrame(key)
+                end
+                frame = getglobal(targetName)
+            else
+                frame = getglobal(HELPFRAME_FRAMES["OpenTicket"].name)
+            end
+            frame:Show()
+            HelpFrame.openFrame = frame
+
+            if ticketType then
+                HelpFrameOpenTicket.ticketType = ticketType
+            end
+        end
+
+        -- ref-lua l.231-349. The shared general page re-dressed for one category: a title, body
+        -- text, up to two bullet sections with their own headings, an optional trailing paragraph,
+        -- and up to two action buttons — each element re-anchored to whatever ended up above it,
+        -- which is why this is a chain of SetPoints rather than a static layout.
+        function HelpFrame_SetupGeneralFrame(key)
+            local info = GENERAL_HELPFRAME[key]
+            if not info then
+                return
+            end
+            if info.title then
+                HelpFrameGeneralTitle:SetText(info.title)
+            end
+            if info.titleText then
+                HelpFrameGeneralTitleText:SetText(info.titleText)
+            end
+            if info.bulletTitle1 then
+                HelpFrameBulletTitle1:SetText(info.bulletTitle1)
+            else
+                HelpFrameBulletTitle1:SetText("")
+            end
+
+            local bulletIndex = 1
+            local bullet
+            if info.bullets1 then
+                for index, value in ipairs(info.bullets1) do
+                    bullet = getglobal("HelpFrameGeneralBullet" .. bulletIndex)
+                    -- Unreachable: MAX_GENERAL_BULLETS is 10 and the longest run configured above
+                    -- is 7. The reference's `message(...)` dev assert is dropped (header, 8).
+                    if bullet then
+                        getglobal("HelpFrameGeneralBullet" .. bulletIndex .. "Text"):SetText(value)
+                        bullet:Show()
+                        if index > 1 then
+                            bullet:SetPoint("TOPLEFT", "HelpFrameGeneralBullet" .. (bulletIndex - 1),
+                                "BOTTOMLEFT", 0, HELPFRAME_BULLET_SPACING)
+                        end
+                        bulletIndex = bulletIndex + 1
+                    end
+                end
+            end
+
+            if info.bulletTitle2 then
+                HelpFrameBulletTitle2:Show()
+                HelpFrameBulletTitle2:SetPoint("TOPLEFT",
+                    "HelpFrameGeneralBullet" .. (bulletIndex - 1), "BOTTOMLEFT", -5,
+                    HELPFRAME_SECTION_SPACING)
+                HelpFrameBulletTitle2:SetText(info.bulletTitle2)
+            else
+                HelpFrameBulletTitle2:Hide()
+            end
+
+            if info.bullets2 then
+                for index, value in ipairs(info.bullets2) do
+                    bullet = getglobal("HelpFrameGeneralBullet" .. bulletIndex)
+                    if bullet then
+                        getglobal("HelpFrameGeneralBullet" .. bulletIndex .. "Text"):SetText(value)
+                        bullet:Show()
+                        if index == 1 then
+                            bullet:SetPoint("TOPLEFT", "HelpFrameBulletTitle2", "BOTTOMLEFT", 5,
+                                HELPFRAME_BULLET_SPACING)
+                        else
+                            bullet:SetPoint("TOPLEFT", "HelpFrameGeneralBullet" .. (bulletIndex - 1),
+                                "BOTTOMLEFT", 0, HELPFRAME_BULLET_SPACING)
+                        end
+                        bulletIndex = bulletIndex + 1
+                    end
+                end
+            end
+
+            for i = bulletIndex, MAX_GENERAL_BULLETS do
+                getglobal("HelpFrameGeneralBullet" .. i):Hide()
+            end
+            -- Floor of 2, so a category with NO bullets still has "bullet 1" to anchor under
+            -- (ref-lua l.293; the anchors below all read bulletIndex-1).
+            bulletIndex = max(bulletIndex, 2)
+
+            if info.endText then
+                HelpFrameEndText:SetText(info.endText)
+                HelpFrameEndText:SetPoint("TOPLEFT",
+                    "HelpFrameGeneralBullet" .. (bulletIndex - 1), "BOTTOMLEFT", -5,
+                    HELPFRAME_SECTION_SPACING)
+                HelpFrameEndText:Show()
+            else
+                HelpFrameEndText:Hide()
+            end
+
+            -- The action button. CATEGORY_TO_NOT_DISPLAY is nil here — its only setter is
+            -- Localization.lua's enGB LocalizeFrames(), which benilla does not ship (header note).
+            if info.buttonText
+                and (not (CATEGORY_TO_NOT_DISPLAY and (CATEGORY_TO_NOT_DISPLAY == key))) then
+                HelpFrameGeneralButton:SetText(info.buttonText)
+                HelpFrameButton_FitToText(HelpFrameGeneralButton)
+                if info.endText then
+                    HelpFrameGeneralButton:SetPoint("TOP", "HelpFrameEndText", "BOTTOM", 0,
+                        HELPFRAME_SECTION_SPACING)
+                else
+                    HelpFrameGeneralButton:SetPoint("TOP",
+                        "HelpFrameGeneralBullet" .. (bulletIndex - 1), "BOTTOM", 0,
+                        HELPFRAME_SECTION_SPACING)
+                end
+                HelpFrameGeneralButton.onClick = info.buttonOnClickFunc
+                HelpFrameGeneralButton:Show()
+            else
+                HelpFrameGeneralButton:Hide()
+            end
+
+            -- titleText2 / button2 (ref-lua l.322-348). No configured entry sets titleText2, so the
+            -- -300 x-offset below never runs today; kept because button2 (Stuck's "Page a GM") does.
+            if info.titleText2 then
+                HelpFrameGeneralTitleText2:SetText(info.titleText2)
+                HelpFrameGeneralTitleText2:SetPoint("TOPLEFT", "HelpFrameGeneralButton", "BOTTOM",
+                    -300, HELPFRAME_SECTION_SPACING)
+                HelpFrameGeneralTitleText2:Show()
+            else
+                HelpFrameGeneralTitleText2:Hide()
+            end
+
+            if info.button2Text then
+                HelpFrameGeneralButton2:SetText(info.button2Text)
+                HelpFrameButton_FitToText(HelpFrameGeneralButton2)
+                if info.titleText2 then
+                    HelpFrameGeneralButton2:SetPoint("TOP", "HelpFrameGeneralTitleText2", "BOTTOM",
+                        0, HELPFRAME_SECTION_SPACING)
+                else
+                    HelpFrameGeneralButton2:SetPoint("TOP", "HelpFrameGeneralButton", "BOTTOM", 0,
+                        HELPFRAME_SECTION_SPACING)
+                end
+                HelpFrameGeneralButton2.onClick = info.button2OnClickFunc
+                HelpFrameGeneralButton2:Show()
+            else
+                HelpFrameGeneralButton2:Hide()
+            end
+        end
+
+        -- ref-lua l.351-359. Opening the window dismisses both ticket dialogs — you are about to be
+        -- shown the same choice in a bigger frame.
+        function ToggleHelpFrame()
+            if HelpFrame:IsVisible() then
+                HideUIPanel(HelpFrame)
+            else
+                ShowUIPanel(HelpFrame)
+                StaticPopup_Hide("HELP_TICKET_ABANDON_CONFIRM")
+                StaticPopup_Hide("HELP_TICKET")
+            end
+        end
+
+        -- ── The ticket editor (ref-lua l.389-486) ──────────────────────────────────────────────
+        -- UPDATE_TICKET's arguments, the reference's own block comment (ref-lua l.409-423):
+        --   arg1 category · arg2 description · arg3 ticket age (days) · arg4 oldest ticket (days)
+        --   arg5 how stale that oldest-ticket figure is (days; > 1 hour means bad data)
+        --   arg6 assigned-to-GM flag (0 no, 1 a GM, 2 the escalation queue)
+        --   arg7 opened-by-GM flag (0 never, 1 yes)
+        function HelpFrameOpenTicket_OnEvent(eventName)
+            -- The GM SURVEY branch, structurally faithful and deliberately inert (header, 1). The
+            -- reference dresses the toast as a survey invitation, flashes it, and returns; we take
+            -- the same early return so nothing below can misread a survey event as a ticket, but we
+            -- neither paint nor flash it, because GMSurveyFrame_LoadUI (the thing the toast would
+            -- then open) does not exist here. CHOSEN_FOR_GMSURVEY (GlobalStrings l.749) and
+            -- UIFrameFlash go with it.
+            if eventName == "GMSURVEY_DISPLAY" then
+                return
+            end
+
+            if arg1 and arg1 ~= 0 then
+                -- There IS an open ticket.
+                TicketStatusTitleText:SetText(gs("TICKET_STATUS1"))    -- GlobalStrings l.4238
+                HelpFrameOpenTicket.ticketType = arg1
+                HelpFrameOpenTicketText:SetText(arg2)
+
+                -- The reference's `ticketFrameHeight` (35 / 40 / 52) is DEAD WEIGHT and is
+                -- dropped: it is assigned on three legs (ref-lua l.424, 444, 451) and read on
+                -- none — the toast's height comes from the measured text at l.460, below.
+                -- ReputationFrame.xml's precedent for dropping the reference's own unread locals.
+                local statusText
+                HelpFrameOpenTicket.ticketTimer = nil
+                if arg7 == 1 then
+                    -- A GM has already opened it: no estimate, just a state.
+                    if arg6 == 2 then
+                        statusText = gs("GM_TICKET_ESCALATED")         -- l.2020
+                    else
+                        statusText = gs("GM_TICKET_SERVICE_SOON")      -- l.2022
+                    end
+                else
+                    -- Estimate = how much older the oldest open ticket is than yours, in seconds.
+                    local estimatedWaitTime = (arg4 - arg3) * 24 * 60 * 60
+                    if estimatedWaitTime < 0 then
+                        estimatedWaitTime = 0
+                    end
+
+                    -- 0.042 days is ~1 hour: the reference's own "this data is stale, do not quote a
+                    -- number" threshold (its comment at ref-lua l.415).
+                    if arg4 < 0 or arg5 < 0 or arg5 > 0.042 then
+                        statusText = gs("GM_TICKET_UNAVAILABLE")       -- l.2023
+                    elseif estimatedWaitTime > 7200 then
+                        statusText = gs("GM_TICKET_HIGH_VOLUME")       -- l.2021
+                    elseif estimatedWaitTime > 300 then
+                        statusText = format(gs("GM_TICKET_WAIT_TIME", "%s"),
+                            SecondsToTime(estimatedWaitTime, 1))       -- l.2024
+                        -- Only this leg arms the live countdown below.
+                        HelpFrameOpenTicket.ticketTimer = estimatedWaitTime
+                    else
+                        statusText = gs("GM_TICKET_SERVICE_SOON")      -- l.2022
+                    end
+                end
+                if statusText then
+                    TicketStatusTime:Show()
+                    TicketStatusTime:SetText(statusText)
+                    TicketStatusFrame:SetHeight(TicketStatusTitleText:GetHeight()
+                        + TicketStatusTime:GetHeight() + 20)
+                end
+
+                HelpFrameOpenTicket.hasTicket = 1
+                HelpFrameOpenTicketSubmit:SetText(gs("EDIT_TICKET"))               -- l.965
+                HelpFrameOpenTicketCancel:SetText(gs("EXIT"))                      -- l.1933
+                HelpFrameOpenTicketLabel:SetText(gs("HELPFRAME_OPENTICKET_EDITTEXT"))  -- l.2216
+            else
+                -- No open ticket. On the wire the server answers a no-ticket
+                -- CMSG_GMTICKET_GETTICKET with a status-only body and the app fires UPDATE_TICKET
+                -- with a single arg1 = 0 — this leg is what puts the form back to SUBMIT/CANCEL,
+                -- so it is load-bearing, not defensive.
+                HelpFrameOpenTicketText:SetText("")
+                HelpFrameOpenTicket.hasTicket = nil
+                HelpFrameOpenTicketSubmit:SetText(gs("SUBMIT"))                    -- l.4211
+                HelpFrameOpenTicketCancel:SetText(gs("CANCEL"))                    -- l.465
+                HelpFrameOpenTicketLabel:SetText(gs("HELPFRAME_OPENTICKET_TEXT"))  -- l.2217
+            end
+        end
+
+        -- ref-lua l.478-486. Edit vs create is the only difference, and both close the window.
+        function HelpFrameOpenTicketSubmit_OnClick()
+            if HelpFrameOpenTicket.hasTicket then
+                UpdateGMTicket(HelpFrameOpenTicket.ticketType, HelpFrameOpenTicketText:GetText())
+            else
+                NewGMTicket(HelpFrameOpenTicket.ticketType, HelpFrameOpenTicketText:GetText())
+            end
+            HideUIPanel(HelpFrame)
+        end
+
+        -- ── The toast (ref-lua l.488-501) ──────────────────────────────────────────────────────
+        -- Entering the world asks for the ticket; every UPDATE_TICKET after that shows or hides the
+        -- toast, and the temporary-enchant column steps down out of its way. The -175 restore is
+        -- BuffFrame's own declared anchor, not the reference's -180 (header, 4).
+        function TicketStatusFrame_OnEvent(frame)
+            if event == "PLAYER_ENTERING_WORLD" then
+                GetGMTicket()
+            elseif arg1 ~= 0 then
+                frame:Show()
+                if TemporaryEnchantFrame then
+                    TemporaryEnchantFrame:SetPoint("TOPRIGHT", "UIParent", "TOPRIGHT", -205,
+                        -frame:GetHeight())
+                end
+                refreshTime = GMTICKET_CHECK_INTERVAL
+            else
+                frame:Hide()
+                if TemporaryEnchantFrame then
+                    TemporaryEnchantFrame:SetPoint("TOPRIGHT", "UIParent", "TOPRIGHT", -175, -13)
+                end
+            end
+        end
+
+        -- ref-lua l.544-561. Two independent timers on one tick: a 10-minute re-poll of the server,
+        -- and the local countdown of the estimate it last gave us. Runs only while the toast is up.
+        function TicketStatus_OnUpdate(elapsed)
+            if HelpFrameOpenTicket.hasTicket then
+                if refreshTime then
+                    refreshTime = refreshTime - elapsed
+                    if refreshTime <= 0 then
+                        refreshTime = GMTICKET_CHECK_INTERVAL
+                        GetGMTicket()
+                    end
+                end
+                if HelpFrameOpenTicket.ticketTimer then
+                    HelpFrameOpenTicket.ticketTimer = HelpFrameOpenTicket.ticketTimer - elapsed
+                    TicketStatusTime:SetText(format(gs("GM_TICKET_WAIT_TIME", "%s"),
+                        SecondsToTime(HelpFrameOpenTicket.ticketTimer, 1)))
+                end
+            end
+        end
+
+        -- The toast's click. The reference writes this body TWICE — TicketStatusButton's OnClick
+        -- (ref-xml l.1485-1496) and the frame's own OnMouseUp (ref-xml l.1513-1524) are character
+        -- for character identical, because the 32px icon does not cover the whole 208px toast.
+        -- One function, wired from both.
+        function TicketStatus_OnClick()
+            if TicketStatusFrame.hasGMSurvey then
+                -- The survey branch (header, 1): the reference opens GMSurveyFrame and hides the
+                -- toast. Deferred, and deliberately not stubbed into "hide the toast" — that would
+                -- silently eat a survey the player agreed to take.
+                return
+            elseif StaticPopup_Visible("HELP_TICKET_ABANDON_CONFIRM")
+                or StaticPopup_Visible("HELP_TICKET") then
+                StaticPopup_Hide("HELP_TICKET_ABANDON_CONFIRM")
+                StaticPopup_Hide("HELP_TICKET")
+            elseif not HelpFrame:IsVisible() then
+                StaticPopup_Show("HELP_TICKET")
+            end
+        end
+
+        -- ── The GM category list (ref-lua l.503-534) ───────────────────────────────────────────
+        function HelpFrameButton_OnClick(button)
+            HelpFrame_ShowFrame(button.key, button.ticketType)
+        end
+
+        function HelpFrameGM_Update()
+            HelpFrameGM_UpdateCategories(GetGMTicketCategories())
+        end
+
+        -- The vararg is a FLAT id/name list, so row i reads the pair at 2*(offset+i)-1. Lua-5.0
+        -- `arg.n`/`arg[i]` written the 5.1 way (header, 6).
+        function HelpFrameGM_UpdateCategories(...)
+            local n = select("#", ...)
+            local offset = FauxScrollFrame_GetOffset(HelpFrameGMScrollFrame)
+            for i = 1, NUM_GM_CATEGORIES_TO_DISPLAY do
+                getglobal("HelpFrameButton" .. i):Hide()
+            end
+            for i = 1, NUM_GM_CATEGORIES_TO_DISPLAY do
+                local index = 2 * (offset + i) - 1
+                local button = getglobal("HelpFrameButton" .. i)
+                local text = getglobal("HelpFrameButton" .. i .. "Text")
+                if index <= n then
+                    -- Both reads are pinned to ONE value: `select(i, ...)` returns the whole tail,
+                    -- and as the last argument of a call that tail would expand.
+                    local id = select(index, ...)
+                    local name = select(index + 1, ...)
+                    text:SetText(name)
+                    -- key AND ticketType are the same DBC id: one picks the page, the other rides
+                    -- the wire (this file's header).
+                    button.key = id
+                    button.ticketType = id
+                    button:Show()
+                else
+                    button:Hide()
+                end
+            end
+            -- n/2 categories, 37px a row. With the ten DBC rows against ten displayed this leaves
+            -- the bar (and its trough) hidden, which is the reference's look too.
+            FauxScrollFrame_Update(HelpFrameGMScrollFrame, n / 2, NUM_GM_CATEGORIES_TO_DISPLAY, 37)
+        end
+
+        -- ref-lua l.536-542. A configured override (only Stuck has one) or the default route into
+        -- the ticket editor.
+        function HelpFrameGeneralButton_OnClick(button)
+            if button.onClick then
+                button.onClick()
+            else
+                HelpFrame_ShowFrame("OpenTicket")
+            end
+        end
+
+        -- The eight harassment tips. Done here rather than in eight XML `<OnLoad>` bodies because
+        -- gs() is this chunk's local — an XML script body is a separate chunk and cannot see it.
+        function HelpFrameHarassment_OnLoad()
+            local tips = {
+                VerbalAbuseTip1 = "VERBAL_HARASSMENT_TEXT2",       -- GlobalStrings l.4460
+                VerbalAbuseTip2 = "VERBAL_HARASSMENT_TEXT3",       -- l.4461
+                VerbalAbuseTip3 = "VERBAL_HARASSMENT_TEXT4",       -- l.4463
+                PhysicalAbuseTip1 = "PHYSICAL_HARASSMENT_TEXT2",   -- l.3066
+                PhysicalAbuseTip2 = "PHYSICAL_HARASSMENT_TEXT3",   -- l.3063
+                PhysicalAbuseTip3 = "PHYSICAL_HARASSMENT_TEXT4",   -- l.3065
+                PhysicalAbuseTip4 = "PHYSICAL_HARASSMENT_TEXT5",   -- l.3064
+                PhysicalAbuseTip5 = "PHYSICAL_HARASSMENT_TEXT6",   -- l.3068
+            }
+            for name, key in pairs(tips) do
+                local label = getglobal(name .. "Text")
+                if label then
+                    label:SetText(gs(key))
+                end
+            end
+        end
+
+        -- ── The three ticket dialogs ───────────────────────────────────────────────────────────
+        -- Registered HERE, not in UiPanels.xml, and that is this house's rule rather than a
+        -- preference: only the generic DELETE_ITEM lives with the engine; every other entry ships
+        -- with the window that raises it (BinderConfirm, MailFrame, AuctionFrame, BankFrame,
+        -- PetActionBar, …). All three of these are raised from this file and from nowhere else —
+        -- HELP_TICKET_QUEUE_DISABLED by HelpFrame_OnEvent and HelpFrame_ShowFrame, HELP_TICKET by
+        -- the toast's click, HELP_TICKET_ABANDON_CONFIRM by HELP_TICKET's own Cancel.
+        --
+        -- Note the nesting: HELP_TICKET's Cancel shows ABANDON_CONFIRM *before* the click's own
+        -- hide, so a second dialog instance must be free. STATICPOPUP_NUMDIALOGS is 2 and this is
+        -- the second flow (after decline-a-res) that needs both.
+
+        -- StaticPopup.lua l.163-168.
+        StaticPopupDialogs["HELP_TICKET_QUEUE_DISABLED"] = {
+            text = gs("HELP_TICKET_QUEUE_DISABLED"),   -- GlobalStrings l.2270
+            button1 = gs("OKAY"),                      -- l.2818
+            showAlert = 1,
+            timeout = 0,
+        }
+
+        -- StaticPopup.lua l.331-343.
+        StaticPopupDialogs["HELP_TICKET_ABANDON_CONFIRM"] = {
+            text = gs("HELP_TICKET_ABANDON_CONFIRM"),  -- l.2267
+            button1 = gs("YES"),                       -- l.5463
+            button2 = gs("NO"),                        -- l.2794
+            OnAccept = function()
+                DeleteGMTicket()
+            end,
+            timeout = 0,
+            whileDead = 1,
+            hideOnEscape = 1,
+        }
+
+        -- StaticPopup.lua l.344-364. No hideOnEscape, by the reference's own omission: the choice
+        -- is Edit or Abandon, and ESC is neither. The way out is the ticket icon (TicketStatus_OnClick).
+        StaticPopupDialogs["HELP_TICKET"] = {
+            text = gs("HELP_TICKET_EDIT_ABANDON"),     -- l.2269
+            button1 = gs("HELP_TICKET_EDIT"),          -- l.2268
+            button2 = gs("HELP_TICKET_ABANDON"),       -- l.2266
+            OnAccept = function()
+                if PETITION_QUEUE_ACTIVE then
+                    ShowUIPanel(HelpFrame)
+                    HelpFrame_ShowFrame("OpenTicket")
+                else
+                    HideUIPanel(HelpFrame)
+                    StaticPopup_Show("HELP_TICKET_QUEUE_DISABLED")
+                end
+            end,
+            -- The reference stashes the raising frame on the new dialog and never reads it back
+            -- (header, 5).
+            OnCancel = function()
+                StaticPopup_Show("HELP_TICKET_ABANDON_CONFIRM")
+            end,
+            timeout = 0,
+            whileDead = 1,
+        }
+    ]]></Script>
+
+    <!-- ── The four templates (ref-xml l.4-126, geometry verbatim) ──────────────────────────────
+         A bullet row: the quest window's bullet glyph with a 548-wide wrapping label beside it.
+         550x12 is the ROW's declared size and is smaller than the label's — the label overflows it
+         downward, which is what lets a two-line bullet still chain from the next one's TOPLEFT
+         anchor at the reference's own -3/-5 spacings. -->
+    <Frame name="HelpFrameBulletPointTemplate" virtual="true">
+        <Size><AbsDimension x="550" y="12"/></Size>
+        <Layers>
+            <Layer level="BACKGROUND">
+                <Texture file="Interface\QuestFrame\UI-Quest-BulletPoint">
+                    <Size><AbsDimension x="16" y="16"/></Size>
+                    <Anchors><Anchor point="TOPLEFT"><Offset><AbsDimension x="0" y="0"/></Offset></Anchor></Anchors>
+                </Texture>
+                <FontString name="$parentText" inherits="GameFontHighlightSmall" justifyH="LEFT">
+                    <Size><AbsDimension x="548" y="0"/></Size>
+                    <Anchors><Anchor point="TOPLEFT"><Offset><AbsDimension x="17" y="-3"/></Offset></Anchor></Anchors>
+                </FontString>
+            </Layer>
+        </Layers>
+    </Frame>
+
+    <!-- The horizontal rule (ref-xml l.38-77): one 256x64 sheet cut into three bands stacked in v
+         (0..0.3125 left cap, 0.3125..0.625 middle, 0.625..0.9375 right cap) and laid end to end.
+         The middle's +1 y-offset is the reference's own. -->
+    <Frame name="HelpFrameDividerTemplate" virtual="true">
+        <Size><AbsDimension x="577" y="19"/></Size>
+        <Layers>
+            <Layer level="BACKGROUND">
+                <Texture name="$parentLeft" file="Interface\HelpFrame\HelpFrameDivider">
+                    <Size><AbsDimension x="256" y="20"/></Size>
+                    <Anchors><Anchor point="TOPLEFT"/></Anchors>
+                    <TexCoords left="0" right="1.0" top="0" bottom="0.3125"/>
+                </Texture>
+                <Texture name="$parentMiddle" file="Interface\HelpFrame\HelpFrameDivider">
+                    <Size><AbsDimension x="256" y="20"/></Size>
+                    <Anchors>
+                        <Anchor point="LEFT" relativeTo="$parentLeft" relativePoint="RIGHT"><Offset><AbsDimension x="0" y="1"/></Offset></Anchor>
+                    </Anchors>
+                    <TexCoords left="0" right="1.0" top="0.3125" bottom="0.625"/>
+                </Texture>
+                <Texture name="$parentRight" file="Interface\HelpFrame\HelpFrameDivider">
+                    <Size><AbsDimension x="65" y="20"/></Size>
+                    <Anchors>
+                        <Anchor point="LEFT" relativeTo="$parentMiddle" relativePoint="RIGHT"/>
+                    </Anchors>
+                    <TexCoords left="0" right="0.25390625" top="0.625" bottom="0.9375"/>
+                </Texture>
+            </Layer>
+        </Layers>
+    </Frame>
+
+    <!-- A list row (ref-xml l.78-119): bullet glyph, a bold label and a small description under it,
+         with the HelpFrame highlight sheet cropped to its top 0.578125 as the hover. No scripts —
+         the GM variant below adds the only click this template has. -->
+    <Button name="HelpFrameHomeButtonTemplate" virtual="true">
+        <Size><AbsDimension x="568" y="37"/></Size>
+        <Layers>
+            <Layer level="BACKGROUND">
+                <FontString name="$parentText" inherits="GameFontNormal">
+                    <Anchors><Anchor point="TOPLEFT"><Offset><AbsDimension x="22" y="-4"/></Offset></Anchor></Anchors>
+                </FontString>
+                <FontString name="$parentDescription" inherits="GameFontHighlightSmall">
+                    <Anchors>
+                        <Anchor point="TOPLEFT" relativeTo="$parentText" relativePoint="BOTTOMLEFT"><Offset><AbsDimension x="0" y="-2"/></Offset></Anchor>
+                    </Anchors>
+                </FontString>
+                <Texture file="Interface\QuestFrame\UI-Quest-BulletPoint">
+                    <Size><AbsDimension x="16" y="16"/></Size>
+                    <Anchors><Anchor point="TOPLEFT"><Offset><AbsDimension x="0" y="-2"/></Offset></Anchor></Anchors>
+                </Texture>
+            </Layer>
+        </Layers>
+        <HighlightTexture file="Interface\HelpFrame\HelpFrameButton-Highlight" alphaMode="ADD">
+            <TexCoords left="0" right="1.0" top="0" bottom="0.578125"/>
+        </HighlightTexture>
+    </Button>
+
+    <!-- ref-xml l.120-126. `$parentDescription` is never filled on this variant: the GM list's rows
+         carry only the DBC category name, which HelpFrameGM_UpdateCategories writes into
+         `$parentText`. That blank second line is the reference's own look. -->
+    <Button name="GMCategoryButtonTemplate" inherits="HelpFrameHomeButtonTemplate" virtual="true">
+        <Scripts>
+            <OnClick>HelpFrameButton_OnClick(self)</OnClick>
+        </Scripts>
+    </Button>
+
+    <!-- ── The window (ref-xml l.127-1409) ─────────────────────────────────────────────────────
+         640x512 of six plate pieces (four 256x256 quadrant/edge tiles and two 128-wide right-hand
+         caps), the shared dialog header band, and six full-bleed pages that take turns. The
+         `<HitRectInsets>` keeps the right 44px and bottom 13px of the plate out of the mouse rect —
+         the art bleeds past the drawn frame there.
+
+         `parent="UIParent"` is the reference's and is kept verbatim (ItemTextFrame.xml's
+         precedent); it is inert in this engine, which has no cross-file parent attachment and
+         screen-parents a bare toplevel anyway. `movable` is the reference's too and is equally
+         inert: this window declares no drag scripts, so it never actually moves. -->
+    <Frame name="HelpFrame" toplevel="true" parent="UIParent" movable="true" enableMouse="true" hidden="true">
+        <Size><AbsDimension x="640" y="512"/></Size>
+        <Anchors><Anchor point="CENTER"><Offset><AbsDimension x="0" y="0"/></Offset></Anchor></Anchors>
+        <HitRectInsets><AbsInset left="0" right="44" top="0" bottom="13"/></HitRectInsets>
+        <Layers>
+            <Layer level="BACKGROUND">
+                <Texture file="Interface\HelpFrame\HelpFrame-TopLeft">
+                    <Size><AbsDimension x="256" y="256"/></Size>
+                    <Anchors><Anchor point="TOPLEFT"/></Anchors>
+                </Texture>
+                <Texture file="Interface\HelpFrame\HelpFrame-Top">
+                    <Size><AbsDimension x="256" y="256"/></Size>
+                    <Anchors><Anchor point="TOPLEFT"><Offset><AbsDimension x="256" y="0"/></Offset></Anchor></Anchors>
+                </Texture>
+                <Texture file="Interface\HelpFrame\HelpFrame-TopRight">
+                    <Size><AbsDimension x="128" y="256"/></Size>
+                    <Anchors><Anchor point="TOPRIGHT"/></Anchors>
+                </Texture>
+                <Texture file="Interface\HelpFrame\HelpFrame-BotLeft">
+                    <Size><AbsDimension x="256" y="256"/></Size>
+                    <Anchors><Anchor point="BOTTOMLEFT"/></Anchors>
+                </Texture>
+                <Texture file="Interface\HelpFrame\HelpFrame-Bottom">
+                    <Size><AbsDimension x="256" y="256"/></Size>
+                    <Anchors><Anchor point="BOTTOMLEFT"><Offset><AbsDimension x="256" y="0"/></Offset></Anchor></Anchors>
+                </Texture>
+                <Texture file="Interface\HelpFrame\HelpFrame-BotRight">
+                    <Size><AbsDimension x="128" y="256"/></Size>
+                    <Anchors><Anchor point="BOTTOMRIGHT"/></Anchors>
+                </Texture>
+            </Layer>
+            <Layer level="ARTWORK">
+                <Texture name="HelpFrameHeader" file="Interface\DialogFrame\UI-DialogBox-Header">
+                    <Size><AbsDimension x="336" y="64"/></Size>
+                    <Anchors><Anchor point="TOP"><Offset><AbsDimension x="-12" y="12"/></Offset></Anchor></Anchors>
+                </Texture>
+                <FontString inherits="GameFontNormal" text="HELP_FRAME_TITLE">
+                    <Anchors>
+                        <Anchor point="TOP" relativeTo="HelpFrameHeader"><Offset><AbsDimension x="0" y="-14"/></Offset></Anchor>
+                    </Anchors>
+                </FontString>
+            </Layer>
+        </Layers>
+        <Frames>
+            <Button name="HelpFrameCloseButton" inherits="UIPanelCloseButton">
+                <Anchors><Anchor point="TOPRIGHT"><Offset><AbsDimension x="-42" y="-3"/></Offset></Anchor></Anchors>
+            </Button>
+
+            <!-- ── Page 1 · Home (ref-xml l.236-397) ─────────────────────────────────────────────
+                 The "what a GM can and cannot help with" preamble. Every page is `setAllPoints` +
+                 `hidden`, and HelpFrame_ShowFrame swaps exactly one of them in. -->
+            <Frame name="HelpFrameHome" setAllPoints="true" hidden="true">
+                <Layers>
+                    <Layer level="ARTWORK">
+                        <FontString name="HelpFrameHomeTitle" inherits="GameFontNormalLarge" text="PETITION_GAME_MASTER" justifyH="LEFT">
+                            <Size><AbsDimension x="550" y="0"/></Size>
+                            <Anchors><Anchor point="TOPLEFT"><Offset><AbsDimension x="25" y="-65"/></Offset></Anchor></Anchors>
+                        </FontString>
+                        <FontString name="HelpFrameHomeText1" inherits="GameFontHighlight" text="HELPFRAME_HOME_TEXT1" justifyH="LEFT">
+                            <Size><AbsDimension x="550" y="0"/></Size>
+                            <Anchors>
+                                <Anchor point="TOPLEFT" relativeTo="HelpFrameHomeTitle" relativePoint="BOTTOMLEFT"><Offset><AbsDimension x="0" y="-3"/></Offset></Anchor>
+                            </Anchors>
+                        </FontString>
+                        <FontString name="HelpFrameHomeIssue1Header" inherits="GameFontNormal" text="HELPFRAME_HOME_ISSUE1_HEADER" justifyH="LEFT">
+                            <Size><AbsDimension x="540" y="0"/></Size>
+                            <Anchors>
+                                <Anchor point="TOPLEFT" relativeTo="HelpFrameHomeText1" relativePoint="BOTTOMLEFT"><Offset><AbsDimension x="10" y="-10"/></Offset></Anchor>
+                            </Anchors>
+                        </FontString>
+                        <FontString name="HelpFrameHomeIssue1" inherits="GameFontHighlightSmall" text="HELPFRAME_HOME_ISSUE1" justifyH="LEFT">
+                            <Size><AbsDimension x="540" y="0"/></Size>
+                            <Anchors>
+                                <Anchor point="TOPLEFT" relativeTo="HelpFrameHomeIssue1Header" relativePoint="BOTTOMLEFT"><Offset><AbsDimension x="0" y="0"/></Offset></Anchor>
+                            </Anchors>
+                        </FontString>
+                        <FontString name="HelpFrameHomeIssue2Header" inherits="GameFontNormal" text="HELPFRAME_HOME_ISSUE2_HEADER" justifyH="LEFT">
+                            <Size><AbsDimension x="540" y="0"/></Size>
+                            <Anchors>
+                                <Anchor point="TOPLEFT" relativeTo="HelpFrameHomeIssue1" relativePoint="BOTTOMLEFT"><Offset><AbsDimension x="0" y="-10"/></Offset></Anchor>
+                            </Anchors>
+                        </FontString>
+                        <FontString name="HelpFrameHomeIssue2" inherits="GameFontHighlightSmall" text="HELPFRAME_HOME_ISSUE2" justifyH="LEFT">
+                            <Size><AbsDimension x="540" y="0"/></Size>
+                            <Anchors>
+                                <Anchor point="TOPLEFT" relativeTo="HelpFrameHomeIssue2Header" relativePoint="BOTTOMLEFT"><Offset><AbsDimension x="0" y="0"/></Offset></Anchor>
+                            </Anchors>
+                        </FontString>
+                        <FontString name="HelpFrameHomeIssue3Header" inherits="GameFontNormal" text="HELPFRAME_HOME_ISSUE3_HEADER" justifyH="LEFT">
+                            <Size><AbsDimension x="540" y="0"/></Size>
+                            <Anchors>
+                                <Anchor point="TOPLEFT" relativeTo="HelpFrameHomeIssue2" relativePoint="BOTTOMLEFT"><Offset><AbsDimension x="0" y="-10"/></Offset></Anchor>
+                            </Anchors>
+                        </FontString>
+                        <FontString name="HelpFrameHomeIssue3" inherits="GameFontHighlightSmall" text="HELPFRAME_HOME_ISSUE3" justifyH="LEFT">
+                            <Size><AbsDimension x="540" y="0"/></Size>
+                            <Anchors>
+                                <Anchor point="TOPLEFT" relativeTo="HelpFrameHomeIssue3Header" relativePoint="BOTTOMLEFT"><Offset><AbsDimension x="0" y="0"/></Offset></Anchor>
+                            </Anchors>
+                        </FontString>
+                        <!-- The PvP policy link. The declared height of **-5** is the reference's
+                             own (ref-xml l.337) and is kept verbatim, because it is not inert: the
+                             client's `CSimpleFontString::GetHeight 0x772a60` takes the authored
+                             value whenever it is not exactly 0.0 and only then floors it at one
+                             FrameXML unit (wow-re `region-size-fallback.md` §3, which this engine
+                             implements identically — layout.rs's FONTSTRING_MIN_SPAN). So this line's
+                             BOX is one unit tall in the real client too, and HelpFrameHomeText2
+                             below — which hangs off that box's BOTTOMLEFT at -25 — rides up over the
+                             link. Correcting it here would be a divergence, not a fix. -->
+                        <FontString name="HelpFrameHomePvpPolicyUrl" inherits="GameFontNormal" text="PVP_POLICY_URL">
+                            <Size><AbsDimension x="550" y="-5"/></Size>
+                            <Anchors>
+                                <Anchor point="TOP" relativeTo="HelpFrameHomeIssue3" relativePoint="BOTTOM"><Offset><AbsDimension x="0" y="-10"/></Offset></Anchor>
+                            </Anchors>
+                        </FontString>
+                        <FontString name="HelpFrameHomeText2" inherits="GameFontHighlight" text="HELPFRAME_HOME_TEXT2" justifyH="LEFT">
+                            <Size><AbsDimension x="550" y="0"/></Size>
+                            <Anchors>
+                                <Anchor point="TOPLEFT" relativeTo="HelpFrameHomePvpPolicyUrl" relativePoint="BOTTOMLEFT"><Offset><AbsDimension x="0" y="-25"/></Offset></Anchor>
+                            </Anchors>
+                        </FontString>
+                    </Layer>
+                </Layers>
+                <Frames>
+                    <!-- ref-xml l.362-381. The reference fits this button to its label in the
+                         button's own OnLoad; ours does it from the page's OnShow (header, 3). -->
+                    <Button name="HelpFrameHomeIssues" inherits="UIPanelButtonTemplate2" text="HELPFRAME_HOME_BUTTON_TEXT">
+                        <Size><AbsDimension x="250" y="22"/></Size>
+                        <Anchors>
+                            <Anchor point="TOP" relativeTo="HelpFrameHomeText2" relativePoint="BOTTOM"><Offset><AbsDimension x="0" y="-40"/></Offset></Anchor>
+                        </Anchors>
+                        <Scripts>
+                            <OnClick>HelpFrame_ShowFrame("GMHome")</OnClick>
+                        </Scripts>
+                    </Button>
+                    <Button name="HelpFrameHomeCancel" inherits="GameMenuButtonTemplate" text="CANCEL">
+                        <Anchors><Anchor point="BOTTOMRIGHT"><Offset><AbsDimension x="-53" y="21"/></Offset></Anchor></Anchors>
+                        <Scripts>
+                            <OnClick>HideUIPanel(HelpFrame)</OnClick>
+                        </Scripts>
+                    </Button>
+                </Frames>
+                <Scripts>
+                    <OnShow>HelpFrameButton_FitToText(HelpFrameHomeIssues)</OnShow>
+                </Scripts>
+            </Frame>
+
+            <!-- ── Page 2 · Page a GM (ref-xml l.399-603) ────────────────────────────────────────
+                 The ten category rows over the faux scroll kit. Ten rows against ten DBC categories
+                 means the bar and its trough stay hidden (FauxScrollFrame_Update's own gate), which
+                 is the reference's look as well. -->
+            <Frame name="HelpFrameGM" setAllPoints="true" hidden="true">
+                <Layers>
+                    <Layer level="BACKGROUND">
+                        <FontString inherits="GameFontHighlightSmall" text="HELPFRAME_HOME_TEXT">
+                            <Anchors><Anchor point="TOP"><Offset><AbsDimension x="0" y="-60"/></Offset></Anchor></Anchors>
+                        </FontString>
+                    </Layer>
+                </Layers>
+                <Frames>
+                    <Button name="HelpFrameButton1" inherits="GMCategoryButtonTemplate">
+                        <Anchors><Anchor point="TOPLEFT"><Offset><AbsDimension x="20" y="-80"/></Offset></Anchor></Anchors>
+                    </Button>
+                    <Button name="HelpFrameButton2" inherits="GMCategoryButtonTemplate">
+                        <Anchors><Anchor point="TOPLEFT" relativeTo="HelpFrameButton1" relativePoint="BOTTOMLEFT"><Offset><AbsDimension x="0" y="0"/></Offset></Anchor></Anchors>
+                    </Button>
+                    <Button name="HelpFrameButton3" inherits="GMCategoryButtonTemplate">
+                        <Anchors><Anchor point="TOPLEFT" relativeTo="HelpFrameButton2" relativePoint="BOTTOMLEFT"><Offset><AbsDimension x="0" y="0"/></Offset></Anchor></Anchors>
+                    </Button>
+                    <Button name="HelpFrameButton4" inherits="GMCategoryButtonTemplate">
+                        <Anchors><Anchor point="TOPLEFT" relativeTo="HelpFrameButton3" relativePoint="BOTTOMLEFT"><Offset><AbsDimension x="0" y="0"/></Offset></Anchor></Anchors>
+                    </Button>
+                    <Button name="HelpFrameButton5" inherits="GMCategoryButtonTemplate">
+                        <Anchors><Anchor point="TOPLEFT" relativeTo="HelpFrameButton4" relativePoint="BOTTOMLEFT"><Offset><AbsDimension x="0" y="0"/></Offset></Anchor></Anchors>
+                    </Button>
+                    <Button name="HelpFrameButton6" inherits="GMCategoryButtonTemplate">
+                        <Anchors><Anchor point="TOPLEFT" relativeTo="HelpFrameButton5" relativePoint="BOTTOMLEFT"><Offset><AbsDimension x="0" y="0"/></Offset></Anchor></Anchors>
+                    </Button>
+                    <Button name="HelpFrameButton7" inherits="GMCategoryButtonTemplate">
+                        <Anchors><Anchor point="TOPLEFT" relativeTo="HelpFrameButton6" relativePoint="BOTTOMLEFT"><Offset><AbsDimension x="0" y="0"/></Offset></Anchor></Anchors>
+                    </Button>
+                    <Button name="HelpFrameButton8" inherits="GMCategoryButtonTemplate">
+                        <Anchors><Anchor point="TOPLEFT" relativeTo="HelpFrameButton7" relativePoint="BOTTOMLEFT"><Offset><AbsDimension x="0" y="0"/></Offset></Anchor></Anchors>
+                    </Button>
+                    <Button name="HelpFrameButton9" inherits="GMCategoryButtonTemplate">
+                        <Anchors><Anchor point="TOPLEFT" relativeTo="HelpFrameButton8" relativePoint="BOTTOMLEFT"><Offset><AbsDimension x="0" y="0"/></Offset></Anchor></Anchors>
+                    </Button>
+                    <Button name="HelpFrameButton10" inherits="GMCategoryButtonTemplate">
+                        <Anchors><Anchor point="TOPLEFT" relativeTo="HelpFrameButton9" relativePoint="BOTTOMLEFT"><Offset><AbsDimension x="0" y="0"/></Offset></Anchor></Anchors>
+                    </Button>
+
+                    <!-- The bar's TROUGH, replacing the reference's three loose textures
+                         (ref-xml l.517-560). No anchors of its own: it seats itself on its bar the
+                         first time BenillaScrollBar_SetShown touches it, at the very hang those
+                         reference offsets define. Declared BEFORE the faux frame so it draws
+                         beneath the bar. -->
+                    <Frame name="HelpFrameGMScrollFrameScrollBarTrough" inherits="BenillaScrollTroughTemplate"/>
+                    <!-- ref-xml l.504-568: 540x410 at the page's TOPRIGHT(-80,-54). A plain
+                         `<Frame>` on the house faux kit, so the reference's `<OnVerticalScroll>`
+                         (`FauxScrollFrame_OnVerticalScroll(37, HelpFrameGM_Update)`) has nothing to
+                         fire and becomes `updateFunc` instead (header, 1). The instance's OnLoad
+                         REPLACES the template's, so ScrollFrame_OnLoad is re-issued here. -->
+                    <Frame name="HelpFrameGMScrollFrame" inherits="FauxScrollFrameTemplate">
+                        <Size><AbsDimension x="540" y="410"/></Size>
+                        <Anchors><Anchor point="TOPRIGHT"><Offset><AbsDimension x="-80" y="-54"/></Offset></Anchor></Anchors>
+                        <Scripts>
+                            <OnLoad>
+                                ScrollFrame_OnLoad()
+                                self.updateFunc = HelpFrameGM_Update
+                            </OnLoad>
+                        </Scripts>
+                    </Frame>
+
+                    <Button name="HelpFrameGMCancel" inherits="GameMenuButtonTemplate" text="CANCEL">
+                        <Anchors><Anchor point="BOTTOMRIGHT"><Offset><AbsDimension x="-53" y="21"/></Offset></Anchor></Anchors>
+                        <Scripts>
+                            <OnClick>HideUIPanel(HelpFrame)</OnClick>
+                        </Scripts>
+                    </Button>
+                    <Button name="HelpFrameGMBack" inherits="GameMenuButtonTemplate" text="BACK">
+                        <Anchors>
+                            <Anchor point="RIGHT" relativeTo="HelpFrameGMCancel" relativePoint="LEFT"><Offset><AbsDimension x="0" y="0"/></Offset></Anchor>
+                        </Anchors>
+                        <Scripts>
+                            <OnClick>HelpFrame_ShowFrame("Home")</OnClick>
+                        </Scripts>
+                    </Button>
+                </Frames>
+                <Scripts>
+                    <OnShow>HelpFrameGM_Update()</OnShow>
+                </Scripts>
+            </Frame>
+
+            <!-- ── Page 3 · The ticket editor (ref-xml l.605-753) ────────────────────────────────
+                 `letters="500"` is the reference's own cap and is kept verbatim; note the client
+                 engine separately truncates the outgoing description to 1999 characters before the
+                 packet leaves, so the box's limit is the tighter of the two and the engine cap sits
+                 behind it unreached. -->
+            <Frame name="HelpFrameOpenTicket" setAllPoints="true" hidden="true">
+                <Layers>
+                    <Layer level="BACKGROUND">
+                        <FontString name="HelpFrameOpenTicketLabel" inherits="GameFontHighlight" text="HELPFRAME_OPENTICKET_TEXT">
+                            <Anchors><Anchor point="TOPLEFT"><Offset><AbsDimension x="25" y="-58"/></Offset></Anchor></Anchors>
+                        </FontString>
+                    </Layer>
+                </Layers>
+                <Frames>
+                    <Frame name="HelpFrameOpenTicketDivider" inherits="HelpFrameDividerTemplate">
+                        <Anchors><Anchor point="TOPLEFT"><Offset><AbsDimension x="12" y="-72"/></Offset></Anchor></Anchors>
+                    </Frame>
+                    <!-- This bar is on a REAL scroll frame, so it is always up and
+                         BenillaScrollBar_SetShown — the only thing that seats a trough — never runs
+                         for it. Seated explicitly below through the kit's own public seat verb
+                         (header, 2), replacing the reference's three loose textures at
+                         ref-xml l.642-685. -->
+                    <Frame name="HelpFrameOpenTicketScrollFrameScrollBarTrough" inherits="BenillaScrollTroughTemplate"/>
+                    <ScrollFrame name="HelpFrameOpenTicketScrollFrame" inherits="UIPanelScrollFrameTemplate">
+                        <Size><AbsDimension x="540" y="378"/></Size>
+                        <Anchors>
+                            <Anchor point="TOPLEFT" relativeTo="HelpFrameOpenTicketDivider" relativePoint="BOTTOMLEFT"><Offset><AbsDimension x="8" y="4"/></Offset></Anchor>
+                        </Anchors>
+                        <Scripts>
+                            <OnLoad>
+                                ScrollFrame_OnLoad()
+                                local trough = getglobal(self:GetName() .. "ScrollBarTrough")
+                                BenillaScrollTrough_Seat(trough, getglobal(self:GetName() .. "ScrollBar"))
+                                trough:Show()
+                            </OnLoad>
+                        </Scripts>
+                        <ScrollChild>
+                            <!-- ref-xml l.689-708. 541 wide inside a 540 view, which is the
+                                 reference's own arithmetic. The `<OnUpdate>ScrollingEdit_OnUpdate()`
+                                 the reference wires here is deliberately absent (header, 3).
+                                 No `autoFocus` attribute, exactly as the reference declares none —
+                                 but the consequence differs: the UI.xsd defaults it TRUE, while
+                                 this engine applies the C++ ctor default (flags=0, off) uniformly
+                                 to XML and CreateFrame alike (loader/widgets.rs l.278-281). So the
+                                 reference's box takes the keyboard the moment the page shows and
+                                 ours waits for a click. That is an engine-wide policy, not this
+                                 window's choice, and restating it as `autoFocus="false"` here would
+                                 only hide it. -->
+                            <EditBox name="HelpFrameOpenTicketText" multiLine="true" letters="500">
+                                <Size><AbsDimension x="541" y="357"/></Size>
+                                <Scripts>
+                                    <OnTextChanged>ScrollingEdit_OnTextChanged()</OnTextChanged>
+                                    <OnCursorChanged>ScrollingEdit_OnCursorChanged(arg1, arg2, arg3, arg4)</OnCursorChanged>
+                                    <OnEscapePressed>HideUIPanel(HelpFrame)</OnEscapePressed>
+                                </Scripts>
+                                <FontString inherits="ChatFontNormal"/>
+                            </EditBox>
+                        </ScrollChild>
+                    </ScrollFrame>
+                    <!-- Cancel re-asks the server for the ticket before closing: the box may hold
+                         edits that were never submitted, and the next open must show what the
+                         SERVER has, not what was typed (ref-xml l.720-723). -->
+                    <Button name="HelpFrameOpenTicketCancel" inherits="GameMenuButtonTemplate" text="CANCEL">
+                        <Anchors><Anchor point="BOTTOMRIGHT"><Offset><AbsDimension x="-53" y="21"/></Offset></Anchor></Anchors>
+                        <Scripts>
+                            <OnClick>
+                                GetGMTicket()
+                                HideUIPanel(HelpFrame)
+                            </OnClick>
+                        </Scripts>
+                    </Button>
+                    <Button name="HelpFrameOpenTicketSubmit" inherits="GameMenuButtonTemplate" text="SUBMIT">
+                        <Anchors>
+                            <Anchor point="RIGHT" relativeTo="HelpFrameOpenTicketCancel" relativePoint="LEFT"><Offset><AbsDimension x="0" y="0"/></Offset></Anchor>
+                        </Anchors>
+                        <Scripts>
+                            <OnClick>HelpFrameOpenTicketSubmit_OnClick()</OnClick>
+                        </Scripts>
+                    </Button>
+                </Frames>
+                <Scripts>
+                    <OnLoad>
+                        self:RegisterEvent("UPDATE_TICKET")
+                        self:RegisterEvent("GMSURVEY_DISPLAY")
+                    </OnLoad>
+                    <OnEvent>HelpFrameOpenTicket_OnEvent(event)</OnEvent>
+                    <!-- The reference's `<OnShow>` body is its own commented-out
+                         `HelpFrameOpenTicketDropDown_OnShow()` (ref-xml l.750) — the dead dropdown
+                         (header, 2). Nothing replaces it: the editor is filled by UPDATE_TICKET,
+                         which the Cancel path above and TicketStatusFrame's world-entry poll both
+                         provoke. -->
+                </Scripts>
+            </Frame>
+
+            <!-- ── Page 4 · The shared general page (ref-xml l.755-980) ──────────────────────────
+                 Nine of the ten categories land here; HelpFrame_SetupGeneralFrame re-dresses and
+                 re-anchors everything below before the page is shown. BulletTitle2 and EndText
+                 declare a bare TOPLEFT (0,0) because that anchor is always replaced in Lua. -->
+            <Frame name="HelpFrameGeneral" setAllPoints="true" hidden="true">
+                <Layers>
+                    <Layer level="ARTWORK">
+                        <FontString name="HelpFrameGeneralTitle" inherits="GameFontNormalLarge" justifyH="LEFT">
+                            <Size><AbsDimension x="550" y="0"/></Size>
+                            <Anchors><Anchor point="TOPLEFT"><Offset><AbsDimension x="25" y="-65"/></Offset></Anchor></Anchors>
+                        </FontString>
+                        <FontString name="HelpFrameGeneralTitleText" inherits="GameFontHighlight" justifyH="LEFT">
+                            <Size><AbsDimension x="550" y="0"/></Size>
+                            <Anchors>
+                                <Anchor point="TOPLEFT" relativeTo="HelpFrameGeneralTitle" relativePoint="BOTTOMLEFT"><Offset><AbsDimension x="0" y="-3"/></Offset></Anchor>
+                            </Anchors>
+                        </FontString>
+                        <!-- Declared on the same anchor as its sibling above (ref-xml l.782-793) and
+                             re-seated in Lua when a category actually uses it. None does today. -->
+                        <FontString name="HelpFrameGeneralTitleText2" inherits="GameFontHighlight" justifyH="LEFT">
+                            <Size><AbsDimension x="550" y="0"/></Size>
+                            <Anchors>
+                                <Anchor point="TOPLEFT" relativeTo="HelpFrameGeneralTitle" relativePoint="BOTTOMLEFT"><Offset><AbsDimension x="0" y="-3"/></Offset></Anchor>
+                            </Anchors>
+                        </FontString>
+                        <FontString name="HelpFrameBulletTitle1" inherits="GameFontNormal" justifyH="LEFT">
+                            <Size><AbsDimension x="550" y="0"/></Size>
+                            <Anchors>
+                                <Anchor point="TOPLEFT" relativeTo="HelpFrameGeneralTitleText" relativePoint="BOTTOMLEFT"><Offset><AbsDimension x="0" y="-10"/></Offset></Anchor>
+                            </Anchors>
+                        </FontString>
+                        <FontString name="HelpFrameBulletTitle2" inherits="GameFontNormal" justifyH="LEFT">
+                            <Size><AbsDimension x="550" y="0"/></Size>
+                            <Anchors><Anchor point="TOPLEFT"><Offset><AbsDimension x="0" y="0"/></Offset></Anchor></Anchors>
+                        </FontString>
+                        <FontString name="HelpFrameEndText" inherits="GameFontHighlightSmall" justifyH="LEFT">
+                            <Size><AbsDimension x="550" y="0"/></Size>
+                            <Anchors><Anchor point="TOPLEFT"><Offset><AbsDimension x="0" y="0"/></Offset></Anchor></Anchors>
+                        </FontString>
+                    </Layer>
+                </Layers>
+                <Frames>
+                    <Frame name="HelpFrameGeneralBullet1" inherits="HelpFrameBulletPointTemplate">
+                        <Anchors><Anchor point="TOPLEFT" relativeTo="HelpFrameBulletTitle1" relativePoint="BOTTOMLEFT"><Offset><AbsDimension x="5" y="-5"/></Offset></Anchor></Anchors>
+                    </Frame>
+                    <Frame name="HelpFrameGeneralBullet2" inherits="HelpFrameBulletPointTemplate">
+                        <Anchors><Anchor point="TOPLEFT" relativeTo="HelpFrameGeneralBullet1" relativePoint="BOTTOMLEFT"><Offset><AbsDimension x="0" y="-5"/></Offset></Anchor></Anchors>
+                    </Frame>
+                    <Frame name="HelpFrameGeneralBullet3" inherits="HelpFrameBulletPointTemplate">
+                        <Anchors><Anchor point="TOPLEFT" relativeTo="HelpFrameGeneralBullet2" relativePoint="BOTTOMLEFT"><Offset><AbsDimension x="0" y="-5"/></Offset></Anchor></Anchors>
+                    </Frame>
+                    <Frame name="HelpFrameGeneralBullet4" inherits="HelpFrameBulletPointTemplate">
+                        <Anchors><Anchor point="TOPLEFT" relativeTo="HelpFrameGeneralBullet3" relativePoint="BOTTOMLEFT"><Offset><AbsDimension x="0" y="-5"/></Offset></Anchor></Anchors>
+                    </Frame>
+                    <Frame name="HelpFrameGeneralBullet5" inherits="HelpFrameBulletPointTemplate">
+                        <Anchors><Anchor point="TOPLEFT" relativeTo="HelpFrameGeneralBullet4" relativePoint="BOTTOMLEFT"><Offset><AbsDimension x="0" y="-5"/></Offset></Anchor></Anchors>
+                    </Frame>
+                    <Frame name="HelpFrameGeneralBullet6" inherits="HelpFrameBulletPointTemplate">
+                        <Anchors><Anchor point="TOPLEFT" relativeTo="HelpFrameGeneralBullet5" relativePoint="BOTTOMLEFT"><Offset><AbsDimension x="0" y="-5"/></Offset></Anchor></Anchors>
+                    </Frame>
+                    <Frame name="HelpFrameGeneralBullet7" inherits="HelpFrameBulletPointTemplate">
+                        <Anchors><Anchor point="TOPLEFT" relativeTo="HelpFrameGeneralBullet6" relativePoint="BOTTOMLEFT"><Offset><AbsDimension x="0" y="-5"/></Offset></Anchor></Anchors>
+                    </Frame>
+                    <Frame name="HelpFrameGeneralBullet8" inherits="HelpFrameBulletPointTemplate">
+                        <Anchors><Anchor point="TOPLEFT" relativeTo="HelpFrameGeneralBullet7" relativePoint="BOTTOMLEFT"><Offset><AbsDimension x="0" y="-5"/></Offset></Anchor></Anchors>
+                    </Frame>
+                    <Frame name="HelpFrameGeneralBullet9" inherits="HelpFrameBulletPointTemplate">
+                        <Anchors><Anchor point="TOPLEFT" relativeTo="HelpFrameGeneralBullet8" relativePoint="BOTTOMLEFT"><Offset><AbsDimension x="0" y="-5"/></Offset></Anchor></Anchors>
+                    </Frame>
+                    <Frame name="HelpFrameGeneralBullet10" inherits="HelpFrameBulletPointTemplate">
+                        <Anchors><Anchor point="TOPLEFT" relativeTo="HelpFrameGeneralBullet9" relativePoint="BOTTOMLEFT"><Offset><AbsDimension x="0" y="-5"/></Offset></Anchor></Anchors>
+                    </Frame>
+                    <!-- Both action buttons declare the same throwaway TOP (0,15); the setup
+                         function seats them under whatever the page ended up with. -->
+                    <Button name="HelpFrameGeneralButton" inherits="UIPanelButtonTemplate2">
+                        <Anchors><Anchor point="TOP"><Offset><AbsDimension x="0" y="15"/></Offset></Anchor></Anchors>
+                        <Scripts>
+                            <OnClick>HelpFrameGeneralButton_OnClick(self)</OnClick>
+                        </Scripts>
+                    </Button>
+                    <Button name="HelpFrameGeneralButton2" inherits="UIPanelButtonTemplate2">
+                        <Anchors><Anchor point="TOP"><Offset><AbsDimension x="0" y="15"/></Offset></Anchor></Anchors>
+                        <Scripts>
+                            <OnClick>HelpFrameGeneralButton_OnClick(self)</OnClick>
+                        </Scripts>
+                    </Button>
+                    <Button name="HelpFrameGeneralCancel" inherits="GameMenuButtonTemplate" text="CANCEL">
+                        <Anchors><Anchor point="BOTTOMRIGHT"><Offset><AbsDimension x="-53" y="21"/></Offset></Anchor></Anchors>
+                        <Scripts>
+                            <OnClick>HideUIPanel(HelpFrame)</OnClick>
+                        </Scripts>
+                    </Button>
+                    <Button name="HelpFrameGeneralBack" inherits="GameMenuButtonTemplate" text="BACK">
+                        <Anchors>
+                            <Anchor point="RIGHT" relativeTo="HelpFrameGeneralCancel" relativePoint="LEFT"><Offset><AbsDimension x="0" y="0"/></Offset></Anchor>
+                        </Anchors>
+                        <Scripts>
+                            <OnClick>HelpFrame_ShowFrame("GMHome")</OnClick>
+                        </Scripts>
+                    </Button>
+                </Frames>
+            </Frame>
+
+            <!-- ── Page 5 · Harassment (ref-xml l.983-1299) ──────────────────────────────────────
+                 The one category with a page of its own (id 2): two sections, each a heading, a
+                 definition, a "the following are NOT" list, and its own report button. Both buttons
+                 go to the same place. The eight tip strings are filled from Lua (this file's
+                 HelpFrameHarassment_OnLoad) rather than from eight XML OnLoad bodies. -->
+            <Frame name="HelpFrameHarassment" setAllPoints="true" hidden="true">
+                <Layers>
+                    <Layer level="BACKGROUND">
+                        <FontString name="HelpFrameHarassmentText" inherits="GameFontHighlight" text="HARASSMENT_TEXT">
+                            <Anchors><Anchor point="TOP"><Offset><AbsDimension x="0" y="-60"/></Offset></Anchor></Anchors>
+                        </FontString>
+                    </Layer>
+                </Layers>
+                <Frames>
+                    <Frame name="HelpFrameVerbalHarassment">
+                        <Size><AbsDimension x="564" y="165"/></Size>
+                        <Anchors><Anchor point="TOPLEFT"><Offset><AbsDimension x="20" y="-86"/></Offset></Anchor></Anchors>
+                        <Layers>
+                            <Layer level="BACKGROUND">
+                                <FontString name="$parentText" inherits="GameFontNormal" text="VERBAL_HARASSMENT" justifyH="LEFT">
+                                    <Size><AbsDimension x="560" y="0"/></Size>
+                                    <Anchors><Anchor point="TOPLEFT"><Offset><AbsDimension x="5" y="-5"/></Offset></Anchor></Anchors>
+                                </FontString>
+                                <FontString name="$parentDescription" inherits="GameFontHighlightSmall" text="VERBAL_HARASSMENT_DESCRIPTION" justifyH="LEFT">
+                                    <Size><AbsDimension x="560" y="0"/></Size>
+                                    <Anchors>
+                                        <Anchor point="TOPLEFT" relativeTo="$parentText" relativePoint="BOTTOMLEFT"><Offset><AbsDimension x="0" y="-2"/></Offset></Anchor>
+                                    </Anchors>
+                                </FontString>
+                                <FontString name="$parentTipText" inherits="GameFontNormalSmall" text="VERBAL_HARASSMENT_TEXT1" justifyH="LEFT">
+                                    <Size><AbsDimension x="560" y="0"/></Size>
+                                    <Anchors>
+                                        <Anchor point="TOPLEFT" relativeTo="$parentDescription" relativePoint="BOTTOMLEFT"><Offset><AbsDimension x="0" y="-15"/></Offset></Anchor>
+                                    </Anchors>
+                                </FontString>
+                            </Layer>
+                        </Layers>
+                        <Frames>
+                            <Frame name="VerbalAbuseTip1" inherits="HelpFrameBulletPointTemplate">
+                                <Anchors>
+                                    <Anchor point="TOPLEFT" relativeTo="$parentTipText" relativePoint="BOTTOMLEFT"><Offset><AbsDimension x="-3" y="-5"/></Offset></Anchor>
+                                </Anchors>
+                            </Frame>
+                            <Frame name="VerbalAbuseTip2" inherits="HelpFrameBulletPointTemplate">
+                                <Anchors>
+                                    <Anchor point="TOPLEFT" relativeTo="VerbalAbuseTip1" relativePoint="BOTTOMLEFT"><Offset><AbsDimension x="0" y="-5"/></Offset></Anchor>
+                                </Anchors>
+                            </Frame>
+                            <Frame name="VerbalAbuseTip3" inherits="HelpFrameBulletPointTemplate">
+                                <Anchors>
+                                    <Anchor point="TOPLEFT" relativeTo="VerbalAbuseTip2" relativePoint="BOTTOMLEFT"><Offset><AbsDimension x="0" y="-5"/></Offset></Anchor>
+                                </Anchors>
+                            </Frame>
+                            <Button name="HelpFrameVerbalHarassmentButton" inherits="UIPanelButtonTemplate2" text="REPORT_VERBAL_HARASSMENT">
+                                <Size><AbsDimension x="200" y="22"/></Size>
+                                <Anchors><Anchor point="BOTTOM"><Offset><AbsDimension x="0" y="15"/></Offset></Anchor></Anchors>
+                                <Scripts>
+                                    <OnClick>HelpFrame_ShowFrame("OpenTicket")</OnClick>
+                                </Scripts>
+                            </Button>
+                        </Frames>
+                    </Frame>
+                    <Frame name="HelpFrameHarassmentDivider2" inherits="HelpFrameDividerTemplate">
+                        <Anchors>
+                            <Anchor point="TOPLEFT" relativeTo="HelpFrameVerbalHarassment" relativePoint="BOTTOMLEFT"><Offset><AbsDimension x="-9" y="13"/></Offset></Anchor>
+                        </Anchors>
+                    </Frame>
+                    <Frame name="HelpFramePhysicalHarassment">
+                        <Size><AbsDimension x="568" y="220"/></Size>
+                        <Anchors>
+                            <Anchor point="TOPLEFT" relativeTo="HelpFrameHarassmentDivider2" relativePoint="BOTTOMLEFT"><Offset><AbsDimension x="9" y="5"/></Offset></Anchor>
+                        </Anchors>
+                        <Layers>
+                            <Layer level="BACKGROUND">
+                                <FontString name="$parentText" inherits="GameFontNormal" text="PHYSICAL_HARASSMENT" justifyH="LEFT">
+                                    <Size><AbsDimension x="564" y="0"/></Size>
+                                    <Anchors><Anchor point="TOPLEFT"><Offset><AbsDimension x="5" y="-5"/></Offset></Anchor></Anchors>
+                                </FontString>
+                                <FontString name="$parentDescription" inherits="GameFontHighlightSmall" text="PHYSICAL_HARASSMENT_DESCRIPTION" justifyH="LEFT">
+                                    <Size><AbsDimension x="564" y="0"/></Size>
+                                    <Anchors>
+                                        <Anchor point="TOPLEFT" relativeTo="$parentText" relativePoint="BOTTOMLEFT"><Offset><AbsDimension x="0" y="-2"/></Offset></Anchor>
+                                    </Anchors>
+                                </FontString>
+                                <FontString name="$parentTipText" inherits="GameFontNormalSmall" text="PHYSICAL_HARASSMENT_TEXT1" justifyH="LEFT">
+                                    <Size><AbsDimension x="564" y="0"/></Size>
+                                    <Anchors>
+                                        <Anchor point="TOPLEFT" relativeTo="$parentDescription" relativePoint="BOTTOMLEFT"><Offset><AbsDimension x="0" y="-15"/></Offset></Anchor>
+                                    </Anchors>
+                                </FontString>
+                            </Layer>
+                        </Layers>
+                        <Frames>
+                            <Frame name="PhysicalAbuseTip1" inherits="HelpFrameBulletPointTemplate">
+                                <Anchors>
+                                    <Anchor point="TOPLEFT" relativeTo="$parentTipText" relativePoint="BOTTOMLEFT"><Offset><AbsDimension x="-3" y="-5"/></Offset></Anchor>
+                                </Anchors>
+                            </Frame>
+                            <Frame name="PhysicalAbuseTip2" inherits="HelpFrameBulletPointTemplate">
+                                <Anchors>
+                                    <Anchor point="TOPLEFT" relativeTo="PhysicalAbuseTip1" relativePoint="BOTTOMLEFT"><Offset><AbsDimension x="0" y="-5"/></Offset></Anchor>
+                                </Anchors>
+                            </Frame>
+                            <Frame name="PhysicalAbuseTip3" inherits="HelpFrameBulletPointTemplate">
+                                <Anchors>
+                                    <Anchor point="TOPLEFT" relativeTo="PhysicalAbuseTip2" relativePoint="BOTTOMLEFT"><Offset><AbsDimension x="0" y="-5"/></Offset></Anchor>
+                                </Anchors>
+                            </Frame>
+                            <Frame name="PhysicalAbuseTip4" inherits="HelpFrameBulletPointTemplate">
+                                <Anchors>
+                                    <Anchor point="TOPLEFT" relativeTo="PhysicalAbuseTip3" relativePoint="BOTTOMLEFT"><Offset><AbsDimension x="0" y="-5"/></Offset></Anchor>
+                                </Anchors>
+                            </Frame>
+                            <Frame name="PhysicalAbuseTip5" inherits="HelpFrameBulletPointTemplate">
+                                <Anchors>
+                                    <Anchor point="TOPLEFT" relativeTo="PhysicalAbuseTip4" relativePoint="BOTTOMLEFT"><Offset><AbsDimension x="0" y="-5"/></Offset></Anchor>
+                                </Anchors>
+                            </Frame>
+                            <Button name="HelpFramePhysicalHarassmentButton" inherits="UIPanelButtonTemplate2" text="REPORT_PHYSICAL_HARASSMENT">
+                                <Size><AbsDimension x="200" y="22"/></Size>
+                                <Anchors><Anchor point="BOTTOM"><Offset><AbsDimension x="0" y="15"/></Offset></Anchor></Anchors>
+                                <Scripts>
+                                    <OnClick>HelpFrame_ShowFrame("OpenTicket")</OnClick>
+                                </Scripts>
+                            </Button>
+                        </Frames>
+                    </Frame>
+                    <Button name="HelpFrameHarassmentCancel" inherits="GameMenuButtonTemplate" text="CANCEL">
+                        <Anchors><Anchor point="BOTTOMRIGHT"><Offset><AbsDimension x="-53" y="21"/></Offset></Anchor></Anchors>
+                        <Scripts>
+                            <OnClick>HideUIPanel(HelpFrame)</OnClick>
+                        </Scripts>
+                    </Button>
+                    <Button name="HelpFrameHarassmentBack" inherits="GameMenuButtonTemplate" text="BACK">
+                        <Anchors>
+                            <Anchor point="RIGHT" relativeTo="HelpFrameHarassmentCancel" relativePoint="LEFT"><Offset><AbsDimension x="0" y="0"/></Offset></Anchor>
+                        </Anchors>
+                        <Scripts>
+                            <OnClick>HelpFrame_ShowFrame("GMHome")</OnClick>
+                        </Scripts>
+                    </Button>
+                    <!-- Declared last, as the reference does (ref-xml l.1289-1297) — it anchors to
+                         the page itself, so nothing depends on its position in the list. -->
+                    <Frame name="HelpFrameHarassmentDivider" inherits="HelpFrameDividerTemplate">
+                        <Anchors><Anchor point="TOPLEFT"><Offset><AbsDimension x="12" y="-70"/></Offset></Anchor></Anchors>
+                    </Frame>
+                </Frames>
+                <Scripts>
+                    <OnLoad>HelpFrameHarassment_OnLoad()</OnLoad>
+                </Scripts>
+            </Frame>
+
+            <!-- ── Page 6 · Stuck (ref-xml l.1301-1378) — UNREACHABLE TODAY, and that is not a bug.
+                 Nothing anywhere passes "Stuck" to HelpFrame_ShowFrame: category id 1 is "Stuck" on
+                 the wire and routes through HELPFRAME_FRAMES[1] to the general page, which
+                 GENERAL_HELPFRAME[1] dresses with this same title, text and unstick button. This
+                 page is the reference's own layout and a later HelpFrame_ShowFrame("Stuck") would
+                 want it, so it is transcribed rather than dropped. See this file's header. -->
+            <Frame name="HelpFrameStuck" setAllPoints="true" hidden="true">
+                <Layers>
+                    <Layer level="ARTWORK">
+                        <FontString name="HelpFrameStuckTitle" inherits="GameFontNormalLarge" text="STUCK_OPTION" justifyH="LEFT">
+                            <Size><AbsDimension x="550" y="0"/></Size>
+                            <Anchors><Anchor point="TOPLEFT"><Offset><AbsDimension x="25" y="-65"/></Offset></Anchor></Anchors>
+                        </FontString>
+                        <FontString name="HelpFrameStuckText1" inherits="GameFontHighlight" text="HELPFRAME_STUCK_TEXT1" justifyH="LEFT">
+                            <Size><AbsDimension x="550" y="0"/></Size>
+                            <Anchors>
+                                <Anchor point="TOPLEFT" relativeTo="HelpFrameStuckTitle" relativePoint="BOTTOMLEFT"><Offset><AbsDimension x="0" y="-3"/></Offset></Anchor>
+                            </Anchors>
+                        </FontString>
+                    </Layer>
+                </Layers>
+                <Frames>
+                    <Button name="HelpFrameStuckStuck" inherits="UIPanelButtonTemplate2" text="STUCK_BUTTON_TEXT">
+                        <Anchors>
+                            <Anchor point="TOP" relativeTo="HelpFrameStuckText1" relativePoint="BOTTOM"><Offset><AbsDimension x="0" y="-25"/></Offset></Anchor>
+                        </Anchors>
+                        <Scripts>
+                            <OnClick>
+                                Stuck()
+                                HideUIPanel(HelpFrame)
+                            </OnClick>
+                        </Scripts>
+                    </Button>
+                    <Button name="HelpFrameStuckCancel" inherits="GameMenuButtonTemplate" text="CANCEL">
+                        <Anchors><Anchor point="BOTTOMRIGHT"><Offset><AbsDimension x="-53" y="21"/></Offset></Anchor></Anchors>
+                        <Scripts>
+                            <OnClick>HideUIPanel(HelpFrame)</OnClick>
+                        </Scripts>
+                    </Button>
+                    <Button name="HelpFrameStuckBack" inherits="GameMenuButtonTemplate" text="BACK">
+                        <Anchors>
+                            <Anchor point="RIGHT" relativeTo="HelpFrameStuckCancel" relativePoint="LEFT"><Offset><AbsDimension x="0" y="0"/></Offset></Anchor>
+                        </Anchors>
+                        <Scripts>
+                            <OnClick>HelpFrame_ShowFrame("GMHome")</OnClick>
+                        </Scripts>
+                    </Button>
+                </Frames>
+                <Scripts>
+                    <OnShow>HelpFrameButton_FitToText(HelpFrameStuckStuck)</OnShow>
+                </Scripts>
+            </Frame>
+
+            <!-- ── Page 7 · Bug (ref-xml l.1380-1392) — UNREACHABLE, and emptier still. There is no
+                 HELPFRAME_FRAMES "Bug" key at all, so no caller could reach it even by name; the
+                 page is a single divider with nothing above or below it, which is what the
+                 reference ships. Transcribed for the same reason as Stuck above. -->
+            <Frame name="HelpFrameBug" setAllPoints="true" hidden="true">
+                <Frames>
+                    <Frame name="HelpFrameBugDivider" inherits="HelpFrameDividerTemplate">
+                        <Anchors><Anchor point="TOPLEFT"><Offset><AbsDimension x="12" y="-223"/></Offset></Anchor></Anchors>
+                    </Frame>
+                </Frames>
+            </Frame>
+        </Frames>
+        <Scripts>
+            <OnLoad>HelpFrame_OnLoad(self)</OnLoad>
+            <OnShow>HelpFrame_OnShow(self)</OnShow>
+            <OnEvent>HelpFrame_OnEvent()</OnEvent>
+            <OnHide>
+                PlaySound("igCharacterInfoClose")
+                if UpdateMicroButtons then UpdateMicroButtons() end
+            </OnHide>
+        </Scripts>
+    </Frame>
+
+    <!-- ── The ticket toast (ref-xml l.1410-1526) ───────────────────────────────────────────────
+         A tooltip-skinned 208x52 panel in the top-right corner with the open-ticket icon, shown
+         whenever the player has a ticket outstanding and clickable anywhere on its surface. Its
+         height is rewritten from the text it ends up holding (HelpFrameOpenTicket_OnEvent).
+         `movable` is the reference's and is inert for the same reason as the window's. -->
+    <Frame name="TicketStatusFrame" toplevel="true" parent="UIParent" movable="true" enableMouse="true" hidden="true">
+        <Size><AbsDimension x="208" y="52"/></Size>
+        <Anchors><Anchor point="TOPRIGHT"><Offset><AbsDimension x="-180" y="0"/></Offset></Anchor></Anchors>
+        <Backdrop bgFile="Interface\Tooltips\UI-Tooltip-Background" edgeFile="Interface\Tooltips\UI-Tooltip-Border" tile="true">
+            <EdgeSize><AbsValue val="16"/></EdgeSize>
+            <TileSize><AbsValue val="16"/></TileSize>
+            <BackgroundInsets><AbsInset left="5" right="5" top="5" bottom="5"/></BackgroundInsets>
+        </Backdrop>
+        <Layers>
+            <Layer level="ARTWORK">
+                <FontString name="TicketStatusTitleText" inherits="GameFontNormalSmall" justifyH="LEFT">
+                    <Size x="168" y="0"/>
+                    <Anchors><Anchor point="TOPLEFT"><Offset><AbsDimension x="10" y="-8"/></Offset></Anchor></Anchors>
+                </FontString>
+                <FontString name="TicketStatusTime" inherits="GameFontHighlightSmall" justifyH="LEFT">
+                    <Size x="168" y="0"/>
+                    <Anchors>
+                        <Anchor point="TOPLEFT" relativeTo="TicketStatusTitleText" relativePoint="BOTTOMLEFT"><Offset><AbsDimension x="0" y="-2"/></Offset></Anchor>
+                    </Anchors>
+                </FontString>
+            </Layer>
+        </Layers>
+        <Frames>
+            <Button name="TicketStatusButton">
+                <Size><AbsDimension x="32" y="32"/></Size>
+                <Anchors><Anchor point="TOPRIGHT"><Offset><AbsDimension x="-3" y="0"/></Offset></Anchor></Anchors>
+                <Layers>
+                    <Layer level="ARTWORK">
+                        <Texture file="Interface\HelpFrame\OpenTicketIcon">
+                            <Size><AbsDimension x="32" y="32"/></Size>
+                            <Anchors><Anchor point="TOPRIGHT"><Offset><AbsDimension x="0" y="0"/></Offset></Anchor></Anchors>
+                        </Texture>
+                    </Layer>
+                </Layers>
+                <Scripts>
+                    <OnClick>TicketStatus_OnClick()</OnClick>
+                </Scripts>
+            </Button>
+        </Frames>
+        <Scripts>
+            <!-- The tooltip skin's colours, guarded the way this house guards every cross-file
+                 global reached at load (GameTooltip.xml loads far above in the toc; harness tests
+                 load subsets). -->
+            <OnLoad>
+                if TOOLTIP_DEFAULT_COLOR then
+                    self:SetBackdropBorderColor(TOOLTIP_DEFAULT_COLOR.r, TOOLTIP_DEFAULT_COLOR.g, TOOLTIP_DEFAULT_COLOR.b)
+                end
+                if TOOLTIP_DEFAULT_BACKGROUND_COLOR then
+                    self:SetBackdropColor(TOOLTIP_DEFAULT_BACKGROUND_COLOR.r, TOOLTIP_DEFAULT_BACKGROUND_COLOR.g, TOOLTIP_DEFAULT_BACKGROUND_COLOR.b)
+                end
+                self:RegisterEvent("UPDATE_TICKET")
+                self:RegisterEvent("PLAYER_ENTERING_WORLD")
+            </OnLoad>
+            <OnEvent>TicketStatusFrame_OnEvent(self)</OnEvent>
+            <OnUpdate>TicketStatus_OnUpdate(arg1)</OnUpdate>
+            <!-- The reference repeats the button's whole click body here because the 32px icon does
+                 not cover the 208px toast (ref-xml l.1513-1524, character-identical to l.1485-1496).
+                 One shared function instead. -->
+            <OnMouseUp>TicketStatus_OnClick()</OnMouseUp>
+        </Scripts>
+    </Frame>
+</Ui>
diff --git a/crates/benilla-app/assets/ui/MicroMenu.xml b/crates/benilla-app/assets/ui/MicroMenu.xml
index d68cbbd8..de6fc068 100644
--- a/crates/benilla-app/assets/ui/MicroMenu.xml
+++ b/crates/benilla-app/assets/ui/MicroMenu.xml
@@ -29,12 +29,13 @@
         bar plate doesn't paint over them. Same shape the bag bar next door already uses.
 
         SCOPE / real-client divergences (noted, not bugs):
-        - ONE button has no panel to open yet: Help (no HelpFrame). It is drawn, hovers, and
-          highlights like the rest, but its click is a no-op — the same "art only, wired the day the
-          panel lands" call the page up/down arrows on this same bar already make. Deliberately NOT
-          greyed with the ref's `-Disabled` art: a dead grey button mid-row reads as a broken bar,
-          and the point of this slice is that the bar reads whole. It is one OnClick line from live.
-          (Socials went live with decision 0668, Main Menu with 0674.)
+        - EVERY button now opens something. Help was the last "art only, wired the day the panel
+          lands" one, and HelpFrame.xml is that panel — its click is `ToggleHelpFrame()` and its
+          pushed arm is in UpdateMicroButtons below, exactly as the ref writes both. (Socials went
+          live with decision 0668, Main Menu with 0674, Help with the HelpFrame transcription.)
+          The bar was deliberately never greyed with the ref's `-Disabled` art while the gap
+          lasted: a dead grey button mid-row reads as a broken bar, and it really was one OnClick
+          line from live.
         - The "(key)" suffix is LIVE since 0997: `button.binding` carries the binding ACTION
           name (TOGGLECHARACTER0, TOGGLESPELLBOOK, ...) and the tooltip looks the key up through
           GetBindingKey at hover time — the ref MicroButtonTooltipText's own contract, restored
@@ -173,15 +174,23 @@
         -- ref UpdateMicroButtons (l.20-84): each button reflects whether its panel is up. The
         -- MainMenu arm is the ref's own six-way test (l.47-58) minus the five frames that don't
         -- exist here — GameMenuFrame is the one that does (decision 0674), and it is the one the
-        -- reference lists first. Its keyring arm has no frame here; the still-unwired Help button
-        -- simply never pushes.
+        -- reference lists first. Its keyring arm (l.79-83) still has no frame here.
+        --
+        -- The Help arm is the ref's l.72-76, live since HelpFrame.xml landed. It calls BACK into
+        -- this function from its own OnShow and OnHide, which is the ref's wiring too and is why
+        -- the reference's HelpFrame is the one panel that does not need an event to stay in sync.
         function UpdateMicroButtons()
             BenillaMicroButton_SetPushed(CharacterMicroButton, BenillaMicro_PanelShown("CharacterFrame"))
             BenillaMicroButton_SetPushed(SpellbookMicroButton, BenillaMicro_PanelShown("SpellBookFrame"))
             BenillaMicroButton_SetPushed(TalentMicroButton, BenillaMicro_PanelShown("BenillaTalentFrame"))
             BenillaMicroButton_SetPushed(QuestLogMicroButton, BenillaMicro_PanelShown("QuestLogFrame"))
+            -- ref l.60-64. Missing since the Socials button went live with decision 0668: the
+            -- window opened but its button never read pushed. Spotted while wiring Help, which is
+            -- the same arm one line down; fixed here rather than left for a bug report.
+            BenillaMicroButton_SetPushed(SocialsMicroButton, BenillaMicro_PanelShown("FriendsFrame"))
             BenillaMicroButton_SetPushed(WorldMapMicroButton, BenillaMicro_PanelShown("WorldMapFrame"))
             BenillaMicroButton_SetPushed(MainMenuMicroButton, BenillaMicro_PanelShown("GameMenuFrame"))
+            BenillaMicroButton_SetPushed(HelpMicroButton, BenillaMicro_PanelShown("HelpFrame"))
         end
 
         -- ref CharacterMicroButton_SetPushed/_SetNormal (l.109-117): the portrait shifts its window
@@ -358,13 +367,19 @@
         </Scripts>
     </Button>
 
-    <!-- No HelpFrame yet (SCOPE note). -->
+    <!-- The GM help window (HelpFrame.xml). `ToggleHelpFrame()` is the ref's own OnClick
+         (ref-MainMenuBarMicroButtons.xml l.217-219) and it is the whole wiring: the toggle takes
+         care of the panel manager, and the panel's own OnShow/OnHide call UpdateMicroButtons back
+         so this button's pushed state follows it however the window was opened or closed.
+         It takes no binding — 1.12 has no TOGGLEHELP action — so the tooltip shows the bare
+         label, which is the ref's behaviour for this one too. -->
     <Button name="HelpMicroButton" inherits="BenillaMicroButtonTemplate">
         <Anchors>
             <Anchor point="BOTTOMLEFT" relativeTo="MainMenuMicroButton" relativePoint="BOTTOMRIGHT"><Offset><AbsDimension x="-3" y="0"/></Offset></Anchor>
         </Anchors>
         <Scripts>
             <OnLoad>BenillaMicroButton_OnLoad(self, "Help", HELP_BUTTON, nil, NEWBIE_TOOLTIP_HELP)</OnLoad>
+            <OnClick>ToggleHelpFrame()</OnClick>
         </Scripts>
     </Button>
 </Ui>
diff --git a/crates/benilla-app/assets/ui/UiPanels.xml b/crates/benilla-app/assets/ui/UiPanels.xml
index c80f9fbb..69f82084 100644
--- a/crates/benilla-app/assets/ui/UiPanels.xml
+++ b/crates/benilla-app/assets/ui/UiPanels.xml
@@ -26,9 +26,10 @@
     <Script><![CDATA[
         -- UIParent.lua l.14-42: UIPanelWindows["FrameName"] = { area, pushable, whileDead }. Only
         -- the rows benilla ships today; the ref rows with no benilla window yet (Tabard, Petition,
-        -- GuildRegistrar, Battlefield, Help, Cinematic, WorldStateScore, Minigame) join as their
-        -- windows land (audited row-by-row against the bytes, decision 1507). Two have since left
-        -- that list: the doublewide AuctionFrame with decision 1511, PetStableFrame with 1676.
+        -- GuildRegistrar, Battlefield, Cinematic, WorldStateScore, Minigame) join as their windows
+        -- land (audited row-by-row against the bytes, decision 1507). Three have since left that
+        -- list: the doublewide AuctionFrame with decision 1511, PetStableFrame with 1676, and
+        -- HelpFrame with 1673 — all three are rows below.
         UIPanelWindows = {}
         UIPanelWindows["GossipFrame"] = { area = "left", pushable = 0 }
         UIPanelWindows["MerchantFrame"] = { area = "left", pushable = 0 }
@@ -155,6 +156,17 @@
         -- the client. (The ref's l.17-18 register SoundOptionsFrame/UIOptionsFrame the same way;
         -- those panels are this one window's category rows now, so the rows have no frames.)
         UIPanelWindows["OptionsFrame"] = { area = "center", pushable = 0, whileDead = 1 }
+        -- The GM help window (HelpFrame.xml) — the ref's own registration verbatim
+        -- (`UIPanelWindows["HelpFrame"] = { area = "center", pushable = 0, whileDead = 1 }`,
+        -- UIParent.lua l.35): the THIRD native-center row, and the first one that is not part of
+        -- the settings shell. Same MODE as the two above — it keeps its own screen-CENTER anchor,
+        -- closes every other window on the way in, and while it holds the slot ShowUIPanel refuses
+        -- every non-center panel (`CanOpenPanels` below). That is deliberate here rather than
+        -- incidental: petitioning a GM is a full stop, not something you do beside your bags.
+        -- whileDead, because being dead somewhere you cannot leave is one of the things you page a
+        -- GM about — and it is what lets the ticket toast's HELP_TICKET dialog reach the window
+        -- from a corpse. (The ref's l.40 WorldStateScoreFrame row is center too; no frame here.)
+        UIPanelWindows["HelpFrame"] = { area = "center", pushable = 0, whileDead = 1 }
         -- (0997's KeyBindingFrame row is gone — decision 1008 folded key bindings into the
         -- options window above, the 1.15 layout's own placement; KeyBindingsPage.xml.)
         -- The world map (decision 0203 phase 2) — the ref's own line verbatim (UIParent.lua l.30)
diff --git a/crates/benilla-app/assets/ui/benilla.toc b/crates/benilla-app/assets/ui/benilla.toc
index e8b501b2..a5bba594 100644
--- a/crates/benilla-app/assets/ui/benilla.toc
+++ b/crates/benilla-app/assets/ui/benilla.toc
@@ -429,6 +429,22 @@ MacroFrame.xml
 # UiPanels (ShowUIPanel/HideUIPanel + the UIPanelWindows row that seats it and gets it closed
 # by ESC). Before GameMenuFrame, which is deliberately last.
 ScriptLogFrame.xml
+# The GM help window + the ticket-status toast (the HelpFrame.xml transcription): the third
+# **center**-area UIPanelWindows row, so it opens like the game menu and the options window and
+# shuts every other panel on the way in. It heads the SHELL TAIL for that reason — Help, then the
+# options pair, then the game menu last — and it goes ahead of KeyBindingsPage.xml rather than
+# between it and OptionsFrame.xml, because those two are a hard must-load-before pair and nothing
+# should be wedged into it. Every dependency is far above: UiPanels (ShowUIPanel/HideUIPanel, the
+# UIPanelWindows row, and the StaticPopup engine its three ticket dialogs register into),
+# UIPanelTemplates (UIPanelCloseButton, UIPanelButtonTemplate2, GameMenuButtonTemplate and the
+# real UIPanelScrollFrameTemplate the ticket editor is built on), ScrollTemplates (the faux kit
+# behind the GM category list, its shared trough, and the ScrollingEdit pair), GameTooltip (the
+# toast wears the tooltip backdrop colours at OnLoad) and MicroMenu (whose Help button calls this
+# file's ToggleHelpFrame, and whose UpdateMicroButtons this file calls back on show/hide — both
+# resolved at call time, so that pair could sit either way round). The one seat that is a REAL
+# requirement rather than legibility is **after BuffFrame.xml**: the toast re-anchors
+# TemporaryEnchantFrame out of its own way, and that frame is declared there.
+HelpFrame.xml
 # The Keybindings page MODULE (decision 1008, superseding 0997's standalone window):
 # the templates + script of the Options window's Keybindings category, over the
 # engine's binding table (benilla_ui::script::keybind + crate::bindings — the 1.12
diff --git a/crates/benilla-app/src/capture/mod.rs b/crates/benilla-app/src/capture/mod.rs
index 1a1792a8..580410cb 100644
--- a/crates/benilla-app/src/capture/mod.rs
+++ b/crates/benilla-app/src/capture/mod.rs
@@ -90,6 +90,7 @@ mod probe_charcreate;
 mod probe_chest;
 mod probe_clam;
 mod probe_crossing;
+mod probe_gm_ticket;
 mod probe_guard_poi;
 mod probe_mail;
 mod probe_melee;
@@ -113,6 +114,7 @@ pub(crate) use probe_charcreate::ProbeCharCreatePlugin;
 pub(crate) use probe_chest::ProbeChestPlugin;
 pub(crate) use probe_clam::ProbeClamPlugin;
 pub(crate) use probe_crossing::ProbeCrossingPlugin;
+pub(crate) use probe_gm_ticket::ProbeGmTicketPlugin;
 pub(crate) use probe_guard_poi::ProbeGuardPoiPlugin;
 pub(crate) use probe_mail::ProbeMailPlugin;
 pub(crate) use probe_melee::ProbeMeleePlugin;
diff --git a/crates/benilla-app/src/capture/probe_gm_ticket.rs b/crates/benilla-app/src/capture/probe_gm_ticket.rs
new file mode 100644
index 00000000..32275449
--- /dev/null
+++ b/crates/benilla-app/src/capture/probe_gm_ticket.rs
@@ -0,0 +1,779 @@
+//! The GM trouble-ticket live probe (`WOW_PROBE_GMTICKET=1`) — decision 1673's end-to-end
+//! instrument: log in, and drive the whole five-opcode ticket wire through the **live Lua VM's own
+//! bindings** (`GetGMStatus`, `DeleteGMTicket`, `GetGMTicket`, `NewGMTicket`, `UpdateGMTicket`),
+//! observing every answer where the Help window observes it — as an `UPDATE_TICKET` /
+//! `UPDATE_GM_STATUS` event fired at a real frame. One
+//! `PROBE_GMTICKET: <step> PASS/FAIL/SKIP <detail>` line per step, then a final
+//! `PROBE_GMTICKET: DONE pass=<n> fail=<m>`. Modeled on [`super::probe_binder`] and
+//! [`super::probe_bank`] — same phase machine, same trace style, same self-terminating exit
+//! ([`super::probes::ProbeExitPlugin`]'s pattern), same live-VM observation idiom (a small Lua hook
+//! appending to a probe table, read back with `script.eval`).
+//!
+//! ## Why unit tests cannot close this feature
+//!
+//! 1673 ships 23 unit tests, byte-exact wire goldens and a DBC oracle, and **not one of them can
+//! tell whether vmangos accepts the packet**. The server answers several refusals with *silence*:
+//! `HandleGMTicketCreateOpcode` returns with no packet at all when the queue is off, when the
+//! player is under `GMTickets.MinLevel`, or when the category is `>= GMTICKET_MAX` (11), and
+//! `HandleGMTicketDeleteTicketOpcode` likewise when there is no ticket (vmangos
+//! `Handlers/GMTicketHandler.cpp`, read this session). A create the server drops on the floor is
+//! byte-identical, from the client's side, to one that worked. Only a live round trip settles it.
+//!
+//! ## What each step can and cannot conclude
+//!
+//! 1. **queue** — `GetGMStatus()`, then `UPDATE_GM_STATUS` carrying **1**. `GMTickets.Enable`
+//!    defaults to `true` (`World.cpp:684`), so 1 is the expected answer; no event at all means the
+//!    opcode round trip is dead and is a FAIL. A `0` is not a client defect — it is the queue
+//!    genuinely switched off, and every later step would then be answered with silence, so the
+//!    probe SKIPs the rest rather than manufacturing failures out of a server setting.
+//! 2. **clean** — `DeleteGMTicket()`, then `GetGMTicket()`, expecting `arg1 == 0`. Clears a
+//!    leftover ticket from an earlier run *and* proves the "no ticket" answer decodes
+//!    (`GMTICKET_STATUS_DEFAULT`, a 4-byte body). **The trap:** delete-with-no-ticket is answered
+//!    with nothing at all, so this waits on the `GetGMTicket` answer that follows, never on a
+//!    delete response.
+//! 3. **create** — `NewGMTicket(4, <unique text>)` (4 = Item, `GMTicketCategory.dbc` id 4 =
+//!    vmangos `GMTICKET_ITEM`), then `GetGMTicket()`, expecting `arg1 == 4` and `arg2` **equal** to
+//!    the text sent. The load-bearing step: it proves the `u8` category, the map/position block,
+//!    the text and the trailing `"Reserved for future use"` cstring are laid out the way vmangos
+//!    reads them. A category widened to `u32` would shift the map id and the position three bytes
+//!    down; the server would file the ticket at a garbage spot or reject the packet outright.
+//! 4. **db** — the row itself. **A two-part check, and the probe only does the first half**: the
+//!    client never reads map/position back, so the echo in step 3 cannot prove they landed. The
+//!    probe *prints* what it sent (`PROBE_GMTICKET: db-expect …`) and the operator runs the SQL
+//!    after the run and compares. This step therefore always reports SKIP — it is not a pass the
+//!    probe is entitled to claim. The line carries a `drift=` figure: how far the body could have
+//!    moved between the position sample and the frame the packet was stamped (see [`REST_EPS`]).
+//!    `drift=0.000` means the position in the line is exact.
+//! 5. **edit** — `UpdateGMTicket(4, <second unique text>)`, then `GetGMTicket()`, expecting `arg2`
+//!    **equal** to the new text. This is the step that proves the **category byte** on
+//!    `CMSG_GMTICKET_UPDATETEXT` — the emulator fork 1673 records, where cmangos-classic reads a
+//!    bare cstring and would swallow our category byte as the first character of the text. The
+//!    comparison is equality, never `contains`, because a stray leading control byte is exactly
+//!    the failure this step exists to catch.
+//! 6. **abandon** — `DeleteGMTicket()`, then `GetGMTicket()`, expecting `arg1 == 0` again.
+//!
+//! ## Two facts about waiting that this probe is built around
+//!
+//! **The wait is for the SERVER, never for the drain.** Lua's calls reach the wire in call order:
+//! [`crate::ui_gm_ticket`]'s `drain_gm_ticket` walks ONE ordered intent queue
+//! (`take_gm_ticket_intents`), so `DeleteGMTicket(); GetGMTicket()` in a single chunk arrives
+//! delete-then-get. It did not always — the drain used to walk a counter per verb and put every
+//! ask ahead of every write and delete, which inverted exactly that pair and made the get answer
+//! with the *pre*-delete state. This probe is what surfaced that (driving the bindings directly is
+//! what a third-party addon does and what no shipped-window test exercises); decision 1673's "One
+//! ordered queue, not a counter per verb" records the fix. What still has to be waited for is the
+//! **round trip**: each step separates its write from the read-back by [`WRITE_GAP_SECS`] and then
+//! waits up to [`ANSWER_TIMEOUT_SECS`] for an answer that matches. The gap is no longer a
+//! correctness crutch; it keeps one exchange per trace line, which is what makes a failing step
+//! readable.
+//!
+//! **Answers are not correlated to asks, so nothing here waits for "the next event".** Three
+//! sources put an `UPDATE_TICKET` on the stream that this probe never explicitly asked for: a GM's
+//! `.ticket viewid`/`escalate`/`complete`; vmangos's own delete handler (`SendTicket(this,
+//! nullptr)`, right after the delete response); and the **engine's own re-ask**, which fires on
+//! every create-ok (2) and update-ok (4) response (`GmTicketState::note_write_landed`, the
+//! reference's `0x5e4479`). So after step 3's `NewGMTicket` an answer arrives *before* the probe's
+//! own `GetGMTicket()` — expected, not an anomaly. Each step latches the observed event count as a
+//! baseline and then waits for **any** answer after it that matches the expectation, failing only
+//! at the timeout and printing every answer it did see. Matching on a *unique* text for the two
+//! load-bearing steps is what keeps that from being a weaker assertion than "the next one".
+//!
+//! ## What the DB row looks like afterwards
+//!
+//! vmangos's abandon is `CloseTicket`, which sets `closed_by` and `SaveToDB()`s — it does **not**
+//! delete the row (`GMTicketMgr.cpp:401-410`) — so step 6 leaves the row in place for the operator
+//! to read. `HandleGMTicketUpdateTextOpcode` calls `SetTicketType(packet.type)` as well as
+//! `SetMessage`, so after step 5 the row's `message` is the **edited** text while `map`/
+//! `position_*` still carry the create's values (the row is REPLACEd in place). Both `db-expect`
+//! lines say which is which.
+//!
+//! ## The run recipe
+//!
+//! ```text
+//! WOW_NOSOUND=1 WOW_USER=probe3 WOW_PASS=pprobe3 WOW_CHAR=Probethree \
+//!     WOW_PROBE_GMTICKET=1 cargo run -q -p benilla
+//! ```
+//! (the slot-keyed probe identity — this worktree is `pool-3` → `probe3`/`pprobe3`/`Probethree`;
+//! method.md "The local vmangos server"). Non-combat; the probe never drives the body and sends no
+//! GM command, so GM mode and position are left exactly as found — but note that the body is not
+//! necessarily *still* when a run starts (see [`REST_EPS`]). An outer `timeout` + grep on
+//! `PROBE_GMTICKET:` is the whole harness; the probe self-exits once DONE. Nothing here is a
+//! timing measurement, so an occluded window costs wall clock and no correctness.
+//!
+//! Every step SKIPs with a note rather than FAILing for an environmental problem (no UI VM in this
+//! build, the queue switched off server-side, a binding that would not run). A genuine wrong value
+//! is a FAIL.
+
+use bevy::prelude::*;
+
+use benilla_assets::coords::bevy_to_wow;
+use benilla_ui::script::UiScript;
+
+use super::probes::ProbeClock;
+use crate::net::SelfPlayer;
+use crate::player::Player;
+
+/// `GMTicketCategory.dbc` id 4 = "Item" (decision 1673's table), which is vmangos's
+/// `GMTICKET_ITEM = 4` (`SharedDefines.h:1779`) — the same number on both sides, which is the
+/// point: the id is the wire value, not a list index.
+const CATEGORY_ITEM: u32 = 4;
+
+/// `SMSG_GMTICKETSYSTEMSTATUS`'s "the queue is taking tickets" (`GMTICKET_QUEUE_STATUS_ENABLED`).
+///
+/// The field is **signed** (`GmTicketState::queue_status`, byte-verified: the reference loads it
+/// with `fild dword`), so `-1` — the window's "queue down, and say so" arm — is a value this probe
+/// can legitimately read back. vmangos only ever sends 0 or 1.
+const QUEUE_ENABLED: f64 = 1.0;
+
+/// The `UPDATE_TICKET` `arg1` that means "you have no ticket" — the window's whole else-branch
+/// hangs on `arg1 and arg1 ~= 0`.
+const NO_TICKET: f64 = 0.0;
+
+/// Settle before the first ask: lets the body land, the world stream, and any login-time
+/// `GetGMTicket()` the shipped Help window fires drain and answer before a baseline is latched.
+const SETTLE_SECS: f64 = 3.0;
+
+/// The gap between a write/delete and the `GetGMTicket()` that reads it back.
+///
+/// Not a correctness requirement — the drain preserves Lua's call order (module doc) — but a
+/// readability one: it keeps one exchange per trace line, so a step that fails names the exchange
+/// that failed rather than a batch of them.
+const WRITE_GAP_SECS: f64 = 1.0;
+
+/// How long a step waits for a matching answer before calling it. Generous on purpose: a starved
+/// (occluded) window polls at ~1 fps and a timeout tight enough to trip on that would report a
+/// FAIL about the wire, which is the one thing an instrument must never do.
+const ANSWER_TIMEOUT_SECS: f64 = 20.0;
+
+/// **The body must be at rest before the ticket is filed.** A ticket records *where you are*, and
+/// the first live run of this probe filed one while the body was still falling: it entered the
+/// world at z ≈ 94, the preflight banner read 82, and it was through 60 a second later — 21 yd of
+/// travel across the create. The row happened to match anyway (the drain sampled the same frame),
+/// but "happened to" is not a property an instrument may rest step 4 on, so the create now waits
+/// for the body to stop moving. Movement under [`REST_EPS`] yd for [`REST_HOLD_SECS`] counts as
+/// stopped.
+const REST_EPS: f32 = 0.02;
+const REST_HOLD_SECS: f64 = 0.5;
+/// The cap on that wait. Timing out is not a failure — the probe files anyway and says the
+/// position may be off, because a body that genuinely cannot come to rest (a lift, a swim, a
+/// treadmill of terrain streaming) still has a working ticket wire to test.
+const REST_TIMEOUT_SECS: f64 = 20.0;
+
+/// How far the body may have travelled between the position sample and the frame the drain stamps
+/// the packet, before the db-expect line stops being trustworthy (yd, WoW space).
+const STAMP_DRIFT_EPS: f32 = 0.05;
+
+/// The operator's half of step 4, printed verbatim so it can be pasted.
+const DB_QUERY: &str = "cd /Users/sam/dev/vmangos-deploy && docker compose exec -T database \
+                        mariadb -umangos -pmangos characters -e \"SELECT ticket_id, name, \
+                        ticket_type, map, position_x, position_y, position_z, closed_by, message \
+                        FROM gm_tickets ORDER BY ticket_id DESC LIMIT 1;\"";
+
+pub(crate) struct ProbeGmTicketPlugin;
+
+impl Plugin for ProbeGmTicketPlugin {
+    fn build(&self, app: &mut App) {
+        app.init_resource::<GmTicketProbe>()
+            .add_systems(Update, gm_ticket_probe);
+    }
+}
+
+/// The probe's phase machine plus what it discovered along the way (the bank/binder probes' shape:
+/// a `Copy` phase snapshotted out of the resource each tick, so an arm can mutate `probe` freely).
+#[derive(Resource, Default)]
+struct GmTicketProbe {
+    phase: Phase,
+    /// The text step 3 filed — unique per run, so no stale answer can satisfy step 3 by accident.
+    create_text: String,
+    /// The text step 5 edited it to.
+    edit_text: String,
+    /// Map and WoW-space position sampled at the moment `NewGMTicket` was called — what the drain
+    /// stamps into `CMSG_GMTICKET_CREATE` in that frame or the next, and what the DB row must
+    /// carry.
+    create_map: u32,
+    create_pos: [f32; 3],
+    /// How far the body had travelled by the frame after the create call — the honest bound on
+    /// how wrong the db-expect position could be (`None` until that frame has been seen).
+    stamp_drift: Option<f32>,
+    passes: u32,
+    fails: u32,
+    /// Latched once [`Phase::Done`] has fired its exit (never re-fire on a later frame).
+    exited: bool,
+}
+
+#[derive(Default, Clone, Copy, PartialEq)]
+enum Phase {
+    #[default]
+    Wait,
+    /// Hook installed; settling before the first ask (module doc).
+    Settling {
+        since: f64,
+    },
+    /// `GetGMStatus()` called; waiting for `UPDATE_GM_STATUS` (step 1).
+    Queue {
+        since: f64,
+        baseline: usize,
+    },
+    /// `DeleteGMTicket()` called; letting the drain flush it before the read-back (step 2a).
+    CleanGap {
+        since: f64,
+    },
+    /// `GetGMTicket()` called; waiting for `arg1 == 0` (step 2b).
+    CleanGet {
+        since: f64,
+        baseline: usize,
+    },
+    /// Waiting for the body to stop moving before the ticket is filed ([`REST_EPS`]) — `last` is
+    /// the previous sample and `still_since` when it was last seen to move.
+    Rest {
+        since: f64,
+        last: [f32; 3],
+        still_since: f64,
+    },
+    /// `NewGMTicket(4, …)` called; letting the drain flush it (step 3a).
+    CreateGap {
+        since: f64,
+    },
+    /// `GetGMTicket()` called; waiting for the filed ticket to come back (step 3b).
+    CreateGet {
+        since: f64,
+        baseline: usize,
+    },
+    /// `UpdateGMTicket(4, …)` called; letting the drain flush it (step 5a).
+    EditGap {
+        since: f64,
+    },
+    /// `GetGMTicket()` called; waiting for the *new* text (step 5b).
+    EditGet {
+        since: f64,
+        baseline: usize,
+    },
+    /// `DeleteGMTicket()` called; letting the drain flush it (step 6a).
+    AbandonGap {
+        since: f64,
+    },
+    /// `GetGMTicket()` called; waiting for `arg1 == 0` again (step 6b).
+    AbandonGet {
+        since: f64,
+        baseline: usize,
+    },
+    Done,
+}
+
+/// The `UPDATE_TICKET` answers the live VM has seen, newest last, as `(arg1, arg2)` — the category
+/// (0 for "no ticket") and the description. `arg2` is recorded as `""` whenever `arg1` is 0, since
+/// the no-ticket fire carries a single argument and reading a second one would be reading whatever
+/// the global happened to hold.
+fn ticket_answers(script: &UiScript) -> Vec<(f64, String)> {
+    let cats = script
+        .eval::<Vec<f64>>("return ProbeGmTicketCat or {}")
+        .unwrap_or_default();
+    let texts = script
+        .eval::<Vec<String>>("return ProbeGmTicketText or {}")
+        .unwrap_or_default();
+    cats.into_iter().zip(texts).collect()
+}
+
+/// The `UPDATE_GM_STATUS` values the live VM has seen, newest last.
+fn status_answers(script: &UiScript) -> Vec<f64> {
+    script
+        .eval::<Vec<f64>>("return ProbeGmStatus or {}")
+        .unwrap_or_default()
+}
+
+/// The first answer after `baseline` that satisfies `want` — the module doc's match-or-timeout
+/// rule. Answers are not correlated to asks, so "the next event" is not a safe read; "any answer
+/// after the baseline that matches" is, and the timeout is what turns a never-matching stream into
+/// a FAIL that prints everything it saw.
+fn matching<T>(answers: &[T], baseline: usize, want: impl Fn(&T) -> bool) -> Option<usize> {
+    answers
+        .iter()
+        .enumerate()
+        .skip(baseline)
+        .find(|(_, a)| want(a))
+        .map(|(i, _)| i)
+}
+
+/// A unique-per-run ticket text, so no stale or unsolicited answer can satisfy steps 3/5 by
+/// accident. Seconds resolution is plenty — two runs cannot start in the same second and reach the
+/// same step, and the suffix distinguishes the two texts within a run.
+fn unique_text(suffix: &str) -> String {
+    let secs = std::time::SystemTime::now()
+        .duration_since(std::time::UNIX_EPOCH)
+        .map(|d| d.as_secs())
+        .unwrap_or(0);
+    format!("benilla probe {secs}{suffix}")
+}
+
+fn gm_ticket_probe(
+    time: ProbeClock,
+    mut probe: ResMut<GmTicketProbe>,
+    script: Option<NonSendMut<UiScript>>,
+    self_player: Query<(), With<SelfPlayer>>,
+    player: Res<Player>,
+    map: Option<Res<benilla_world::world_map::CurrentMap>>,
+    mut exit: MessageWriter<AppExit>,
+) {
+    if self_player.is_empty() {
+        return; // not in-world yet
+    }
+    let Some(script) = script else {
+        return; // no UI VM this build (headless net-only) — nothing this probe can drive
+    };
+    let now = time.elapsed_secs_f64();
+    let phase = probe.phase;
+
+    match phase {
+        Phase::Wait => {
+            // The observation channel, installed before anything is asked so it is live for every
+            // answer including the unsolicited ones (the binder probe's exact pattern).
+            if let Err(e) = script.run(
+                r#"
+                if not ProbeGmTicketHooked then
+                    ProbeGmTicketHooked = true
+                    ProbeGmTicketCat = {}
+                    ProbeGmTicketText = {}
+                    ProbeGmStatus = {}
+                    local f = CreateFrame("Frame")
+                    f:RegisterEvent("UPDATE_TICKET")
+                    f:RegisterEvent("UPDATE_GM_STATUS")
+                    f:SetScript("OnEvent", function()
+                        if event == "UPDATE_TICKET" then
+                            local c = arg1 or 0
+                            table.insert(ProbeGmTicketCat, c)
+                            if c == 0 then
+                                table.insert(ProbeGmTicketText, "")
+                            else
+                                table.insert(ProbeGmTicketText, arg2 or "")
+                            end
+                        else
+                            table.insert(ProbeGmStatus, arg1 or 0)
+                        end
+                    end)
+                end
+                "#,
+            ) {
+                // Without the hook nothing can be observed, and every step would then FAIL for a
+                // reason that has nothing to do with the wire. That is the one failure mode an
+                // instrument must never produce, so it stops here instead.
+                warn!(
+                    "PROBE_GMTICKET: SKIP (0 hook) — the UPDATE_TICKET/UPDATE_GM_STATUS hook would \
+                     not install in the live VM: {e}. Nothing can be observed, so no step below \
+                     could be trusted (environmental, not a wire failure)."
+                );
+                probe.phase = Phase::Done;
+                return;
+            }
+            info!("PROBE_GMTICKET: hook installed; settling {SETTLE_SECS}s before the first ask");
+            probe.phase = Phase::Settling { since: now };
+        }
+
+        Phase::Settling { since } => {
+            if now - since < SETTLE_SECS {
+                return;
+            }
+            let baseline = status_answers(&script).len();
+            if !run_or_skip(&mut probe, &script, "1 queue", "GetGMStatus()") {
+                return;
+            }
+            probe.phase = Phase::Queue {
+                since: now,
+                baseline,
+            };
+        }
+
+        // Step 1 — the queue status. No event at all means the round trip is dead.
+        Phase::Queue { since, baseline } => {
+            let seen = status_answers(&script);
+            let Some(i) = matching(&seen, baseline, |_| true) else {
+                if now - since > ANSWER_TIMEOUT_SECS {
+                    error!(
+                        "PROBE_GMTICKET: FAIL (1 queue) — no UPDATE_GM_STATUS within \
+                         {ANSWER_TIMEOUT_SECS}s of GetGMStatus(). The CMSG_GMTICKET_SYSTEMSTATUS \
+                         → SMSG_GMTICKETSYSTEMSTATUS round trip is dead: either the send never \
+                         reached the wire or the answer never decoded. (values seen this run: \
+                         {seen:?})"
+                    );
+                    probe.fails += 1;
+                    probe.phase = Phase::Done;
+                }
+                return;
+            };
+            let status = seen[i];
+            if status != QUEUE_ENABLED {
+                warn!(
+                    "PROBE_GMTICKET: SKIP (1 queue) — the round trip WORKS (UPDATE_GM_STATUS \
+                     fired carrying {status}), but the server's ticket queue is not enabled. \
+                     vmangos then answers create with silence (GMTicketHandler.cpp: \
+                     `GetStatus() == GMTICKET_QUEUE_STATUS_DISABLED` → return), so every later \
+                     step would fail for a server setting rather than a client defect. Set \
+                     GMTickets.Enable = 1 and re-run."
+                );
+                probe.phase = Phase::Done;
+                return;
+            }
+            info!(
+                "PROBE_GMTICKET: PASS (1 queue) — UPDATE_GM_STATUS fired carrying \
+                 {QUEUE_ENABLED} (the petition queue is up; the window's PETITION_QUEUE_ACTIVE \
+                 gate opens)"
+            );
+            probe.passes += 1;
+            if !run_or_skip(&mut probe, &script, "2 clean", "DeleteGMTicket()") {
+                return;
+            }
+            probe.phase = Phase::CleanGap { since: now };
+        }
+
+        // Step 2 — the clean slate. The delete is deliberately NOT waited on: with no ticket
+        // vmangos answers it with nothing at all.
+        Phase::CleanGap { since } => {
+            if now - since < WRITE_GAP_SECS {
+                return;
+            }
+            let baseline = ticket_answers(&script).len();
+            if !run_or_skip(&mut probe, &script, "2 clean", "GetGMTicket()") {
+                return;
+            }
+            probe.phase = Phase::CleanGet {
+                since: now,
+                baseline,
+            };
+        }
+        Phase::CleanGet { since, baseline } => {
+            let seen = ticket_answers(&script);
+            if matching(&seen, baseline, |(c, _)| *c == NO_TICKET).is_some() {
+                info!(
+                    "PROBE_GMTICKET: PASS (2 clean) — UPDATE_TICKET fired with arg1 == 0: no open \
+                     ticket, and the 4-byte GMTICKET_STATUS_DEFAULT answer decodes"
+                );
+                probe.passes += 1;
+                probe.phase = Phase::Rest {
+                    since: now,
+                    last: bevy_to_wow(player.pos),
+                    still_since: now,
+                };
+            } else if now - since > ANSWER_TIMEOUT_SECS {
+                error!(
+                    "PROBE_GMTICKET: FAIL (2 clean) — no UPDATE_TICKET with arg1 == 0 within \
+                     {ANSWER_TIMEOUT_SECS}s of DeleteGMTicket() + GetGMTicket(). Answers seen \
+                     after the baseline: {:?}. A leftover ticket that refuses to clear, or a \
+                     GETTICKET round trip that never answers.",
+                    &seen[baseline.min(seen.len())..]
+                );
+                probe.fails += 1;
+                probe.phase = Phase::Done;
+            }
+        }
+
+        // The rest gate: a ticket records where you are, so file it from a body that has stopped
+        // moving (module doc — the first live run filed one mid-fall).
+        Phase::Rest {
+            since,
+            last,
+            still_since,
+        } => {
+            let here = bevy_to_wow(player.pos);
+            if distance(here, last) > REST_EPS {
+                probe.phase = Phase::Rest {
+                    since,
+                    last: here,
+                    still_since: now,
+                };
+                return;
+            }
+            let timed_out = now - since > REST_TIMEOUT_SECS;
+            if !timed_out && now - still_since < REST_HOLD_SECS {
+                return;
+            }
+            if timed_out {
+                warn!(
+                    "PROBE_GMTICKET: (3 create) the body never came to rest within \
+                     {REST_TIMEOUT_SECS}s (still at {here:?}); filing anyway — the wire is still \
+                     testable, but treat the db-expect position as approximate."
+                );
+            }
+            let text = unique_text("");
+            probe.create_pos = here;
+            probe.create_map = map.map(|m| m.0).unwrap_or(0);
+            if !run_or_skip(
+                &mut probe,
+                &script,
+                "3 create",
+                &format!("NewGMTicket({CATEGORY_ITEM}, \"{text}\")"),
+            ) {
+                return;
+            }
+            probe.create_text = text;
+            probe.phase = Phase::CreateGap { since: now };
+        }
+
+        // Step 3 — the load-bearing one: the create body's layout, proven by the echo.
+        Phase::CreateGap { since } => {
+            // The first tick after the create call is the last frame in which the drain can still
+            // stamp the packet, so this is the whole window in which the body could move between
+            // the sample and the wire. Measuring it here — rather than a second later, at the
+            // db-expect print — is the difference between an honest bound and crying wolf at a
+            // body that simply kept falling after the packet had already gone.
+            if probe.stamp_drift.is_none() {
+                let drift = distance(bevy_to_wow(player.pos), probe.create_pos);
+                probe.stamp_drift = Some(drift);
+                if drift > STAMP_DRIFT_EPS {
+                    warn!(
+                        "PROBE_GMTICKET: (3 create) the body moved {drift:.3} yd in the frame the \
+                         packet was stamped; the db-expect position below is good only to that."
+                    );
+                }
+            }
+            if now - since < WRITE_GAP_SECS {
+                return;
+            }
+            let baseline = ticket_answers(&script).len();
+            if !run_or_skip(&mut probe, &script, "3 create", "GetGMTicket()") {
+                return;
+            }
+            probe.phase = Phase::CreateGet {
+                since: now,
+                baseline,
+            };
+        }
+        Phase::CreateGet { since, baseline } => {
+            let seen = ticket_answers(&script);
+            let want = probe.create_text.clone();
+            if let Some(i) = matching(&seen, baseline, |(_, t)| *t == want) {
+                let (cat, text) = &seen[i];
+                if *cat != f64::from(CATEGORY_ITEM) {
+                    error!(
+                        "PROBE_GMTICKET: FAIL (3 create) — the ticket came back with the right \
+                         text but category {cat}, wanted {CATEGORY_ITEM}. The category byte is \
+                         the head of CMSG_GMTICKET_CREATE; a wrong value there shifts the map id \
+                         and the whole position."
+                    );
+                    probe.fails += 1;
+                    probe.phase = Phase::Done;
+                    return;
+                }
+                info!(
+                    "PROBE_GMTICKET: PASS (3 create) — the server filed and echoed the ticket: \
+                     arg1 == {cat} (Item) and arg2 == {text:?} byte for byte. The u8 category, \
+                     the map/position block, the text and the trailing \"Reserved for future \
+                     use\" cstring are all laid out the way vmangos reads them."
+                );
+                probe.passes += 1;
+                report_db_expectation(&probe, "after create", &want);
+                warn!(
+                    "PROBE_GMTICKET: SKIP (4 db) — operator step, by design: the client never \
+                     reads map/position back, so only the server's own row proves they landed. \
+                     After the run: {DB_QUERY} — and compare against the db-expect line(s)."
+                );
+                let text = unique_text(" edited");
+                if !run_or_skip(
+                    &mut probe,
+                    &script,
+                    "5 edit",
+                    &format!("UpdateGMTicket({CATEGORY_ITEM}, \"{text}\")"),
+                ) {
+                    return;
+                }
+                probe.edit_text = text;
+                probe.phase = Phase::EditGap { since: now };
+            } else if now - since > ANSWER_TIMEOUT_SECS {
+                error!(
+                    "PROBE_GMTICKET: FAIL (3 create) — the ticket never came back within \
+                     {ANSWER_TIMEOUT_SECS}s. Wanted arg2 == {want:?}; answers seen after the \
+                     baseline: {:?}. vmangos answers a REFUSED create with silence — queue off, \
+                     under GMTickets.MinLevel, or category >= 11 — and a malformed body reads as \
+                     exactly this. Step 1 already proved the queue is up, so a wrong create body \
+                     is the live suspect.",
+                    &seen[baseline.min(seen.len())..]
+                );
+                probe.fails += 1;
+                probe.phase = Phase::Done;
+            }
+        }
+
+        // Step 5 — the edit, and with it the category byte on CMSG_GMTICKET_UPDATETEXT.
+        Phase::EditGap { since } => {
+            if now - since < WRITE_GAP_SECS {
+                return;
+            }
+            let baseline = ticket_answers(&script).len();
+            if !run_or_skip(&mut probe, &script, "5 edit", "GetGMTicket()") {
+                return;
+            }
+            probe.phase = Phase::EditGet {
+                since: now,
+                baseline,
+            };
+        }
+        Phase::EditGet { since, baseline } => {
+            let seen = ticket_answers(&script);
+            let want = probe.edit_text.clone();
+            // Equality, never `contains`: a leading control byte in the stored text is precisely
+            // the cmangos-style failure this step exists to catch (decision 1673's divergence).
+            if let Some(i) = matching(&seen, baseline, |(_, t)| *t == want) {
+                let (cat, text) = &seen[i];
+                info!(
+                    "PROBE_GMTICKET: PASS (5 edit) — the edit landed and echoed EXACTLY: arg2 == \
+                     {text:?} (arg1 == {cat}). No stray leading byte, so the server read our \
+                     category as a category and the text as text — CMSG_GMTICKET_UPDATETEXT's \
+                     `u8 type; cstring text` is right for this server."
+                );
+                probe.passes += 1;
+                report_db_expectation(&probe, "after edit", &want);
+                if !run_or_skip(&mut probe, &script, "6 abandon", "DeleteGMTicket()") {
+                    return;
+                }
+                probe.phase = Phase::AbandonGap { since: now };
+            } else if now - since > ANSWER_TIMEOUT_SECS {
+                let stray = seen
+                    .iter()
+                    .skip(baseline)
+                    .any(|(_, t)| t.len() > want.len() && t.ends_with(&want));
+                error!(
+                    "PROBE_GMTICKET: FAIL (5 edit) — the edited text never came back within \
+                     {ANSWER_TIMEOUT_SECS}s. Wanted arg2 == {want:?}; answers seen after the \
+                     baseline: {:?}. leading-byte-swallowed={stray} — if that is true, the server \
+                     read our category byte as the first character of the text, which is the \
+                     cmangos-classic behaviour decision 1673 records.",
+                    &seen[baseline.min(seen.len())..]
+                );
+                probe.fails += 1;
+                probe.phase = Phase::Done;
+            }
+        }
+
+        // Step 6 — abandon. vmangos keeps the row (CloseTicket → closed_by + SaveToDB), so the
+        // operator's SQL still finds it afterwards.
+        Phase::AbandonGap { since } => {
+            if now - since < WRITE_GAP_SECS {
+                return;
+            }
+            let baseline = ticket_answers(&script).len();
+            if !run_or_skip(&mut probe, &script, "6 abandon", "GetGMTicket()") {
+                return;
+            }
+            probe.phase = Phase::AbandonGet {
+                since: now,
+                baseline,
+            };
+        }
+        Phase::AbandonGet { since, baseline } => {
+            let seen = ticket_answers(&script);
+            if matching(&seen, baseline, |(c, _)| *c == NO_TICKET).is_some() {
+                info!(
+                    "PROBE_GMTICKET: PASS (6 abandon) — UPDATE_TICKET fired with arg1 == 0 again: \
+                     the ticket is gone from the player's view (vmangos marks it closed_by and \
+                     keeps the row, so the db-expect rows above still resolve)"
+                );
+                probe.passes += 1;
+            } else if now - since > ANSWER_TIMEOUT_SECS {
+                error!(
+                    "PROBE_GMTICKET: FAIL (6 abandon) — still holding a ticket \
+                     {ANSWER_TIMEOUT_SECS}s after DeleteGMTicket() + GetGMTicket(). Answers seen \
+                     after the baseline: {:?}",
+                    &seen[baseline.min(seen.len())..]
+                );
+                probe.fails += 1;
+            } else {
+                return;
+            }
+            probe.phase = Phase::Done;
+        }
+
+        Phase::Done => {
+            if probe.exited {
+                return;
+            }
+            probe.exited = true;
+            info!(
+                "PROBE_GMTICKET: DONE pass={} fail={}",
+                probe.passes, probe.fails
+            );
+            // The probe self-exit pattern (`ProbeExitPlugin::fire_probe_exit`): a polite AppExit
+            // plus a hard backstop thread, so a net/winit teardown hang can't leave a zombie
+            // client holding the probe account.
+            exit.write(AppExit::Success);
+            std::thread::spawn(|| {
+                std::thread::sleep(std::time::Duration::from_secs(5));
+                warn!("PROBE_GMTICKET: still alive 5s after AppExit — hard exit");
+                std::process::exit(0);
+            });
+        }
+    }
+}
+
+/// Run one binding in the live VM, or SKIP the whole probe with the reason.
+///
+/// A binding that will not run is environmental (no VM, a broken chunk) — never a wire verdict —
+/// so it must not print a FAIL. Returns `false` once the probe has been parked in [`Phase::Done`].
+fn run_or_skip(probe: &mut GmTicketProbe, script: &UiScript, step: &str, chunk: &str) -> bool {
+    match script.run(chunk) {
+        Ok(()) => {
+            info!("PROBE_GMTICKET: ({step}) {chunk} run in the live VM");
+            true
+        }
+        Err(e) => {
+            warn!(
+                "PROBE_GMTICKET: SKIP ({step}) — `{chunk}` would not run in the live VM: {e} \
+                 (environmental, not a wire failure)"
+            );
+            probe.phase = Phase::Done;
+            false
+        }
+    }
+}
+
+/// Print step 4's half of the check: exactly what the DB row must carry.
+///
+/// The position is the one sampled at the `NewGMTicket` call — what the drain stamps into the
+/// packet, in that frame or the next. How much the body could have moved inside that window is
+/// measured once, at the frame after the call, and reported here as `drift=`; a value at or under
+/// [`STAMP_DRIFT_EPS`] means the line is exact. The map id and `ticket_type` are exact regardless.
+/// **Nothing here is a PASS** — the row is the operator's to read.
+fn report_db_expectation(probe: &GmTicketProbe, when: &str, message: &str) {
+    let [x, y, z] = probe.create_pos;
+    info!(
+        "PROBE_GMTICKET: db-expect ({when}) map={} pos={x},{y},{z} ticket_type={CATEGORY_ITEM} \
+         message={message:?} drift={:.3}",
+        probe.create_map,
+        probe.stamp_drift.unwrap_or(0.0)
+    );
+}
+
+/// Straight-line distance between two WoW-space points, in yards.
+fn distance(a: [f32; 3], b: [f32; 3]) -> f32 {
+    ((a[0] - b[0]).powi(2) + (a[1] - b[1]).powi(2) + (a[2] - b[2]).powi(2)).sqrt()
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    /// The match-or-timeout rule: a step accepts **any** answer after its baseline that matches,
+    /// because unsolicited answers (a GM's `.ticket viewid`, vmangos's own post-delete push) share
+    /// the stream with the solicited ones. It must never accept one from *before* the baseline.
+    #[test]
+    fn a_step_matches_after_its_baseline_and_never_before_it() {
+        let answers = vec![
+            (0.0, String::new()),
+            (4.0, "mine".to_string()),
+            (0.0, String::new()),
+            (4.0, "mine".to_string()),
+        ];
+        assert_eq!(matching(&answers, 0, |(_, t)| t == "mine"), Some(1));
+        // Baseline past the first match: the later identical answer is the one taken.
+        assert_eq!(matching(&answers, 2, |(_, t)| t == "mine"), Some(3));
+        // Nothing after the baseline matches — the caller's timeout is what turns this into a
+        // FAIL, and it must not be papered over by an earlier answer.
+        assert_eq!(matching(&answers, 4, |(_, t)| t == "mine"), None);
+        assert_eq!(matching(&answers, 2, |(c, _)| *c == NO_TICKET), Some(2));
+    }
+
+    /// The two texts within a run are distinct — step 5's assertion is "the text CHANGED to this",
+    /// and it would be vacuous if the edit reused the create's string.
+    #[test]
+    fn the_create_and_edit_texts_are_distinct() {
+        assert_ne!(unique_text(""), unique_text(" edited"));
+        assert!(unique_text(" edited").ends_with(" edited"));
+    }
+}
diff --git a/crates/benilla-app/src/dev.rs b/crates/benilla-app/src/dev.rs
index 0087adfc..37ae1c29 100644
--- a/crates/benilla-app/src/dev.rs
+++ b/crates/benilla-app/src/dev.rs
@@ -323,6 +323,14 @@ impl Plugin for DevProbesPlugin {
             if std::env::var("WOW_PROBE_BINDER").is_ok() {
                 app.add_plugins(crate::capture::ProbeBinderPlugin);
             }
+            // The GM trouble-ticket live probe: `WOW_PROBE_GMTICKET=1` drives the whole five-opcode
+            // ticket wire through the live VM's own bindings — queue status, clean slate, file, edit,
+            // abandon — and prints the row the server must have stored so the operator can check the
+            // map/position the client never reads back (decision 1673's end-to-end instrument; see
+            // `capture::ProbeGmTicketPlugin`).
+            if std::env::var("WOW_PROBE_GMTICKET").is_ok() {
+                app.add_plugins(crate::capture::ProbeGmTicketPlugin);
+            }
             // The world-book live probe: `WOW_PROBE_BOOK=1` teleports to the Old Town plaque and
             // measures what having the item-text reader open costs per frame, closed vs open —
             // B240's instrument (see `capture::ProbeBookPlugin`).
diff --git a/crates/benilla-app/src/lib.rs b/crates/benilla-app/src/lib.rs
index f790a92f..c69d4c5f 100644
--- a/crates/benilla-app/src/lib.rs
+++ b/crates/benilla-app/src/lib.rs
@@ -116,6 +116,7 @@ mod ui_dressup;
 mod ui_duel;
 mod ui_follow;
 mod ui_gamma;
+mod ui_gm_ticket;
 mod ui_gossip;
 mod ui_guild;
 mod ui_hide;
@@ -193,6 +194,7 @@ use ui_chat::UiChatPlugin;
 use ui_craft::UiCraftPlugin;
 use ui_duel::UiDuelPlugin;
 use ui_follow::UiFollowPlugin;
+use ui_gm_ticket::UiGmTicketPlugin;
 use ui_gossip::UiGossipPlugin;
 use ui_guild::UiGuildPlugin;
 use ui_item_text::UiItemTextPlugin;
@@ -599,6 +601,11 @@ pub fn run(build: BuildId) -> AppExit {
     // CONFIRM_BINDER dialog it raises, and the CMSG_BINDER_ACTIVATE its Accept sends — the only
     // packet in the flow that actually binds anything.
     .add_plugins(UiBinderPlugin)
+    // The GM trouble-ticket flow (decision 1673): the Help window's five sends, the UPDATE_TICKET
+    // answer ticket behind its 10-minute poll, and the GMTicketCategory.dbc list its "page a GM"
+    // rows are built from. Beside the binder because it is the same feed/drain shape, and after it
+    // because both want UiInput ordering and this reads better grouped.
+    .add_plugins(UiGmTicketPlugin)
     // Auto-follow's UI seam: the popup's Follow row + `FollowUnit`/`FollowByName` inbound, and
     // the AUTOFOLLOW_BEGIN/END pair that drives the centre-screen status line outbound.
     .add_plugins(UiFollowPlugin)
diff --git a/crates/benilla-app/src/login/mod.rs b/crates/benilla-app/src/login/mod.rs
index 446dc758..a3993523 100644
--- a/crates/benilla-app/src/login/mod.rs
+++ b/crates/benilla-app/src/login/mod.rs
@@ -247,6 +247,30 @@ fn world_refusal_text(strings: &GlueStrings, code: u8) -> &str {
         m::AUTH_SERVER_SHUTTING_DOWN => ("AUTH_SERVER_SHUTTING_DOWN", "Server Shutting Down"),
         m::AUTH_ALREADY_LOGGING_IN => ("AUTH_ALREADY_LOGGING_IN", "Already Logging In"),
         m::AUTH_LOGIN_SERVER_NOT_FOUND => ("AUTH_LOGIN_SERVER_NOT_FOUND", "Invalid Login Server"),
+        // The tail past the queue. These five are exactly the rows of the client's `OKAY_WITH_URL`
+        // table (`0x803740`), which is why the URL dialog is reachable only from THIS enum: the
+        // lookup is a linear search over a ClientServices code and realmd's results never enter it.
+        // benilla shows the text without the URL button — `LaunchURL` is a shell-out we do not do,
+        // and its whitelist (`0x85cc34`) is ten worldofwarcraft.com/blizzard.com domains that have
+        // not served these pages in fifteen years.
+        m::AUTH_BANNED => (
+            "AUTH_BANNED",
+            "This account has been banned for violating the Terms of Use Agreement",
+        ),
+        m::AUTH_ALREADY_ONLINE => ("AUTH_ALREADY_ONLINE", "This character is still logged on"),
+        m::AUTH_NO_TIME => (
+            "AUTH_NO_TIME",
+            "Your World of Warcraft subscription has expired",
+        ),
+        m::AUTH_DB_BUSY => ("AUTH_DB_BUSY", "This session has timed out"),
+        m::AUTH_SUSPENDED => (
+            "AUTH_SUSPENDED",
+            "This account has been temporarily suspended for violating the Terms of Use Agreement",
+        ),
+        m::AUTH_PARENTAL_CONTROL => (
+            "AUTH_PARENTAL_CONTROL",
+            "Access to this account has been blocked by parental controls.",
+        ),
         // `AUTH_OK` never reaches here (it is the success path) and `AUTH_WAIT_QUEUE` is not a
         // refusal at all; anything else is a code this client does not know.
         _ => ("AUTH_FAILED", "Authentication failed"),
@@ -254,27 +278,90 @@ fn world_refusal_text(strings: &GlueStrings, code: u8) -> &str {
     strings.text(key, fallback)
 }
 
-/// The **realmd** logon-proof refusal, borrowed straight out of the table.
+/// The **realmd** logon-proof refusal, in the client's own words — the LONG `LOGIN_*` family.
+///
+/// **This table was wrong in every row until decision 1679**, and wrong in an instructive way: the
+/// codes were right and the *string family* was not. Decision 0539 §6 built it by reading vmangos'
+/// `AuthCodes.h`, which names the wire bytes but says nothing about what the client displays, and
+/// `GlueStrings.lua` happens to define two plausible families whose keys read alike. So a bad
+/// password showed the terse `AUTH_UNKNOWN_ACCOUNT` ("Unknown account") — a real reference string,
+/// in the wrong slot.
+///
+/// VERIFIED (wow-re `system/glue/scratch/login-failure-dialogs.md`, §5 cross-checked): the client
+/// keeps **two** login-status enums with **two** key tables, and they are conflated precisely
+/// because both raise the dialog through `OPEN_STATUS_DIALOG`. realmd's results resolve against
+/// table `0x836b78` — the long `LOGIN_*` family; the world server's resolve against `0x85cae8` —
+/// the short `AUTH_*` family ([`world_refusal_text`]). The chain is grunt opcode table `0x85e278`
+/// → `Logon::OnAuthResult 0x5b2c90` (byte-index table `0x5b2ea4` + jump table `0x5b2e78`) →
+/// `CGlueMgr::OnLoginState 0x46b0f0` → `CGlueMgr::UpdateLoginDialog 0x46b140`.
+///
+/// Two consequences worth stating outright:
+///
+/// **0x04 and 0x05 share one jump-table arm** — byte-identical, both `LOGIN_UNKNOWN_ACCOUNT`. The
+/// reference client structurally *cannot* say "wrong password" on a logon refusal, and
+/// `LOGIN_INCORRECT_PASSWORD` is dead surface it never reaches. That also retires the emulator lore
+/// that the client locks out after 0x05 (vmangos sends 0x04 for both to avoid it): there is no
+/// lockout — no disabled button, no delay, nothing persisted. Its one counter is gated on a
+/// `securityFlags` byte that is zero on vmangos and cmangos, and only escalates the same string
+/// toward its `_PIN`/`_CALL` variants.
+///
+/// **Anything past 0x0F is clamped**, not passed through: the byte-index table saturates at 0xFF,
+/// which lands on the arm that shows `DISCONNECTED`. So 0x10/0x11/0x12 and every unknown future
+/// code read as a disconnect rather than as an authentication message.
 fn logon_refusal_text(strings: &GlueStrings, code: Option<u8>) -> &str {
     let (key, fallback): (&str, &str) = match code {
-        None => ("LOGIN_FAILED", "Unable to connect"),
-        Some(0x03) => ("AUTH_BANNED", "This account has been banned"),
-        // vmangos sends 0x04 for unknown account AND wrong password (its AuthCodes.h comment:
-        // the client locks out after an 0x05).
-        Some(0x04) => ("AUTH_UNKNOWN_ACCOUNT", "Unknown account"),
-        Some(0x05) => ("AUTH_INCORRECT_PASSWORD", "Incorrect Password"),
-        Some(0x06) => ("AUTH_ALREADY_ONLINE", "This account is already logged in"),
-        Some(0x07) => ("AUTH_NO_TIME", "Your subscription has expired"),
-        Some(0x08) => ("AUTH_DB_BUSY", "This session has timed out"),
-        Some(0x09) => ("AUTH_VERSION_MISMATCH", "Wrong client version"),
-        Some(0x0B) => ("LOGIN_FAILED", "Unable to connect"),
-        Some(0x0C) => (
-            "AUTH_SUSPENDED",
-            "This account has been temporarily suspended",
+        // A transport failure never had a code; the client's own answer for the codes that mean
+        // "no usable connection" is the same string, so they share this row.
+        // 0x01/0x02 (unknown0/1), 0x0B (invalid server), 0x0D (no access).
+        None | Some(0x01) | Some(0x02) | Some(0x0B) | Some(0x0D) => {
+            ("LOGIN_FAILED", "Unable to connect")
+        }
+        Some(0x03) => (
+            "LOGIN_BANNED",
+            "This World of Warcraft account has been closed and is no longer available for use.  \
+             Please go to http://www.worldofwarcraft.com/misc/banned.html for further information. ",
         ),
-        Some(0x0D) => ("AUTH_REJECT", "Login unavailable"),
-        Some(0x0F) => ("AUTH_PARENTAL_CONTROL", "Blocked by parental controls"),
-        Some(_) => ("AUTH_FAILED", "Authentication failed"),
+        // BOTH the unknown account and the wrong password — see the doc above.
+        Some(0x04) | Some(0x05) => (
+            "LOGIN_UNKNOWN_ACCOUNT",
+            "The information you have entered is not valid.  Please check the spelling of the \
+             account name and password.  If you need help in retrieving a lost or stolen password \
+             and account, see www.worldofwarcraft.com for more information.",
+        ),
+        Some(0x06) => (
+            "LOGIN_ALREADYONLINE",
+            "This account is already logged into World of Warcraft.  Please check the spelling and \
+             try again.",
+        ),
+        Some(0x07) => (
+            "LOGIN_NOTIME",
+            "You have used up your prepaid time for this account. Please purchase more to continue \
+             playing",
+        ),
+        Some(0x08) => (
+            "LOGIN_DBBUSY",
+            "Could not log in to World of Warcraft at this time.  Please try again later.",
+        ),
+        Some(0x09) => (
+            "LOGIN_BADVERSION",
+            "Unable to validate game version.  This may be caused by file corruption or the \
+             interference of another program.  Please visit www.blizzard.com/support/wow/ for more \
+             information and possible solutions to this issue.",
+        ),
+        Some(0x0C) => (
+            "LOGIN_SUSPENDED",
+            "This World of Warcraft account has been temporarily suspended.  Please go to \
+             http://www.worldofwarcraft.com/misc/banned.html for further information.",
+        ),
+        Some(0x0F) => (
+            "LOGIN_PARENTALCONTROL",
+            "Access to this account has been blocked by parental controls.  Your settings may be \
+             changed in your account preferences at http://www.worldofwarcraft.com.",
+        ),
+        // 0x0A (version update) is IGNORED on the proof (`0x5bada2`) and never reaches a dialog;
+        // it only means anything on the challenge, where it is the patch-download state. Every
+        // remaining code clamps to the disconnect arm.
+        Some(_) => ("DISCONNECTED", "Disconnected from server"),
     };
     strings.text(key, fallback)
 }
@@ -1340,15 +1427,39 @@ mod tests {
     }
 
     /// The code→string map quotes the client's own strings for the vmangos-verified rows.
+    /// The realmd map, against the byte-verified table (wow-re `login-failure-dialogs.md`).
+    ///
+    /// Every row of this changed in decision 1679: the codes were always right and the string
+    /// FAMILY was always wrong, so each of these used to answer with the terse `AUTH_*` twin of
+    /// the string it now gives.
     #[test]
     fn fail_text_maps_the_verified_codes() {
         let strings = GlueStrings::default(); // empty table → the fallback literals
         let logon = |b| fail_text(&strings, Some(LoginRefusal::Logon(b)), None);
-        assert_eq!(logon(0x04), "Unknown account");
-        assert_eq!(logon(0x05), "Incorrect Password");
+
+        // 0x04 and 0x05 share one jump-table arm — the client cannot say "wrong password", and
+        // this is the string a player actually gets for a typo.
+        assert!(logon(0x04).starts_with("The information you have entered is not valid."));
+        assert_eq!(logon(0x05), logon(0x04), "one arm, byte-identical");
+        assert!(logon(0x04).contains("account name and password"));
+
+        // The four "no usable connection" codes share `LOGIN_FAILED` with a bare transport failure.
         assert_eq!(fail_text(&strings, None, None), "Unable to connect");
-        assert_eq!(logon(0x09), "Wrong client version");
-        assert_eq!(logon(0xEE), "Authentication failed");
+        for code in [0x01, 0x02, 0x0B, 0x0D] {
+            assert_eq!(logon(code), "Unable to connect", "code {code:#04x}");
+        }
+
+        assert!(logon(0x03).contains("has been closed"));
+        assert!(logon(0x06).contains("already logged into"));
+        assert!(logon(0x09).contains("Unable to validate game version"));
+        assert!(logon(0x0C).contains("temporarily suspended"));
+        assert!(logon(0x0F).contains("parental controls"));
+
+        // Past 0x0F the byte-index table saturates onto the disconnect arm — so an unknown code
+        // reads as a disconnect, not as an authentication message.
+        for code in [0x10, 0x11, 0x12, 0xEE] {
+            assert_eq!(logon(code), "Disconnected from server", "code {code:#04x}");
+        }
     }
 
     /// **The two result enums are different enums**, and the same byte must not mean the same
@@ -1362,7 +1473,9 @@ mod tests {
         let logon = |b| fail_text(&strings, Some(LoginRefusal::Logon(b)), None);
         let world = |b| fail_text(&strings, Some(LoginRefusal::World(b)), None);
 
-        assert_eq!(logon(0x0C), "This account has been temporarily suspended");
+        // 0x0C: "suspended" to realmd, and to the world server it is AUTH_OK — success, which
+        // never reaches a refusal string at all.
+        assert!(logon(0x0C).contains("temporarily suspended"));
         assert_eq!(world(m::AUTH_BILLING_ERROR), "Billing system error");
         assert_ne!(logon(0x0C), world(0x0C));
 
@@ -1375,6 +1488,10 @@ mod tests {
             world(m::AUTH_UNAVAILABLE),
             "System unavailable - Please try again later"
         );
+        // The five codes the reference's URL dialog keys on — reachable only from this enum.
+        assert!(world(m::AUTH_BANNED).contains("banned"));
+        assert!(world(m::AUTH_SUSPENDED).contains("temporarily suspended"));
+        assert!(world(m::AUTH_PARENTAL_CONTROL).contains("parental controls"));
         // A code this client does not know still lands on the authored catch-all.
         assert_eq!(world(0xEE), "Authentication failed");
     }
@@ -1404,10 +1521,8 @@ mod tests {
             "the name resolved to nothing — this one IS the address",
         );
         // A refusal still wins its own authored string; the dial verdict only speaks for the dial.
-        assert_eq!(
-            fail_text(&strings, Some(LoginRefusal::Logon(0x05)), None),
-            "Incorrect Password",
-        );
+        assert!(fail_text(&strings, Some(LoginRefusal::Logon(0x05)), None)
+            .starts_with("The information you have entered is not valid."));
     }
 
     /// Save → load → clear round-trips through the dot-file (the ref's Get/SetSavedAccountName).
diff --git a/crates/benilla-app/src/net.rs b/crates/benilla-app/src/net.rs
index b417464f..2dbe2991 100644
--- a/crates/benilla-app/src/net.rs
+++ b/crates/benilla-app/src/net.rs
@@ -785,7 +785,9 @@ pub(crate) enum ClientCommand {
     /// Claim `guid` as our mover (`CMSG_SET_ACTIVE_MOVER`). Login sends it for our own body; a
     /// possession handoff re-sends it for the unit we were handed, because the server drops every
     /// `MSG_MOVE_*` for a mover it has not confirmed.
-    SetActiveMover { guid: u64 },
+    SetActiveMover {
+        guid: u64,
+    },
     /// Release `guid` as our mover (`CMSG_MOVE_NOT_ACTIVE_MOVER`) at the pose it is parting on —
     /// the server re-broadcasts a stop under that guid from this payload, so observers do not keep
     /// the unit sliding.
@@ -798,14 +800,21 @@ pub(crate) enum ClientCommand {
     },
     /// Vote on the far-sight view (`CMSG_FAR_SIGHT`): `true` as it attaches, `false` as it
     /// releases. The reference sends both; neither names an object.
-    FarSight { engage: bool },
+    FarSight {
+        engage: bool,
+    },
     /// Echo a same-map teleport ack (`MSG_MOVE_TELEPORT_ACK_Client`) — without it the server freezes
     /// our movement until relog.
-    TeleportAck { guid: u64, counter: u32 },
+    TeleportAck {
+        guid: u64,
+        counter: u32,
+    },
     /// Echo a cross-map worldport ack (`MSG_MOVE_WORLDPORT_ACK`) — unblocks the new map's stream.
     WorldportAck,
     /// Set (or clear, with `guid == 0`) our current target on the server (`CMSG_SET_SELECTION`).
-    SetSelection { guid: u64 },
+    SetSelection {
+        guid: u64,
+    },
     /// Send a chat line as the given [`ChatKind`] (`CMSG_MESSAGECHAT`). `target` carries the
     /// whisper recipient's name — meaningful only when `kind == ChatKind::Whisper` — and is
     /// `None` otherwise. Plain lines with no leading `/` (including `.` dot commands, which
@@ -835,18 +844,29 @@ pub(crate) enum ClientCommand {
     },
     /// Ask a player character's name (`CMSG_NAME_QUERY`); answered by a `PlayerName` event into the
     /// [`crate::names::NameCache`]. Sent by the cache's ask-once resolve, never directly.
-    NameQuery { guid: u64 },
+    NameQuery {
+        guid: u64,
+    },
     /// Ask a creature template's name (`CMSG_CREATURE_QUERY`, entry from the guid's bits 24–47);
     /// answered by a `CreatureName` event into the cache.
-    CreatureQuery { entry: u32, guid: u64 },
+    CreatureQuery {
+        entry: u32,
+        guid: u64,
+    },
     /// Ask a pet's name (`CMSG_PET_NAME_QUERY`, pet number from the guid's bits 24–47 — where a
     /// creature keeps its template entry); answered by a `PetName` event into the cache. A pet
     /// cannot be named by [`Self::CreatureQuery`]; see [`benilla_protocol::guid::pet_number`].
-    PetNameQuery { pet_number: u32, guid: u64 },
+    PetNameQuery {
+        pet_number: u32,
+        guid: u64,
+    },
     /// Ask an item template (`CMSG_ITEM_QUERY_SINGLE`; `guid` = the concrete item when the ask is
     /// about one, `0` for template-only); answered by an `ItemTemplate` event into the
     /// [`crate::items::Items`] cache. Sent by the cache's ask-once resolve, never directly.
-    ItemQuery { entry: u32, guid: u64 },
+    ItemQuery {
+        entry: u32,
+        guid: u64,
+    },
     /// Use an item by wire bag position (`CMSG_USE_ITEM` — bag 255 + absolute slot for anything
     /// in the player's own field array, i.e. an equipment slot, the backpack or the keyring; a
     /// bag's own player-array slot 19–22 + inner slot otherwise). The container drain maps the
@@ -869,22 +889,33 @@ pub(crate) enum ClientCommand {
     /// server answers `SMSG_LOOT_RESPONSE` on the **item's own guid**, so the ordinary loot feed
     /// opens a window over a thing in the bag; a wrapped gift instead swaps entry in place and
     /// sends no window. Refusals arrive as `InventoryFailure` (still locked, dead, flying).
-    OpenItem { bag_index: u8, slot: u8 },
+    OpenItem {
+        bag_index: u8,
+        slot: u8,
+    },
     /// Equip a bag item (`CMSG_AUTOEQUIP_ITEM`, same bag addressing) — the drain's fork for an
     /// *equippable* click, mirroring the real client's equip-vs-use decision. Refusals come back
     /// as `InventoryFailure` events onto the UI error line.
-    AutoEquipItem { bag_index: u8, slot: u8 },
+    AutoEquipItem {
+        bag_index: u8,
+        slot: u8,
+    },
     /// Load ammo into the ammo slot (`CMSG_SET_AMMO`) — the equip drains' fork when the clicked/
     /// dropped item is ammo-class (INVTYPE_AMMO), mirroring the real client's own auto-equip fork
     /// (wow-re `cursor-dragdrop-slots.md`). Addressed by item `entry`, not a bag slot: the stack
     /// stays in the bag and `PLAYER_AMMO_ID` starts referencing it. A wrong/absent ranged weapon
     /// refuses via `InventoryFailure`. Decision 0526.
-    SetAmmo { entry: u32 },
+    SetAmmo {
+        entry: u32,
+    },
     /// Swap two of the player's own inventory slots (`CMSG_SWAP_INV_ITEM`) — the wire for a
     /// backpack-internal pick/place/swap, both slots on the player array (`INVENTORY_SLOT_ITEM_START`
     /// onward). The container-move drain maps the Lua backpack `(bag 0, slot)` space onto these; an
     /// empty destination is a move. Refusals surface as `InventoryFailure` events.
-    SwapInvItem { src_slot: u8, dst_slot: u8 },
+    SwapInvItem {
+        src_slot: u8,
+        dst_slot: u8,
+    },
     /// The general bag↔bag move (`CMSG_SWAP_ITEM`, decision 0216 §6 slice 2) — either endpoint may
     /// be an equipped bag (unlike [`ClientCommand::SwapInvItem`], the player-array-only wire). The
     /// container-move drain sends this instead of `SwapInvItem` whenever either end's wire bag
@@ -912,27 +943,45 @@ pub(crate) enum ClientCommand {
     /// Sent by the delete-confirm popup's accept (`DeleteCursorItem`), mapped from the engine's
     /// queued `(bag, slot, count)` destroy through the same wire-position map as every other
     /// container drain.
-    DestroyItem { bag_index: u8, slot: u8, count: u8 },
+    DestroyItem {
+        bag_index: u8,
+        slot: u8,
+        count: u8,
+    },
     /// Perform a chat emote (`CMSG_TEXT_EMOTE`); the server echoes it back to us (and everyone
     /// in range) as `SMSG_TEXT_EMOTE`, so the local sound/anim ride the receive path.
-    TextEmote { text_id: u32, target: u64 },
+    TextEmote {
+        text_id: u32,
+        target: u64,
+    },
     /// Cast a spell (`CMSG_CAST_SPELL`): `target: None` = self/implicit-target cast, `Some(guid)`
     /// = explicit unit target. Answered by `SMSG_CAST_RESULT` (a `CastResult` event).
-    CastSpell { spell_id: u32, target: Option<u64> },
+    CastSpell {
+        spell_id: u32,
+        target: Option<u64>,
+    },
     /// Cast a spell at a **ground point** (`CMSG_CAST_SPELL` with `TARGET_FLAG_DEST_LOCATION`,
     /// decision 0792): the targeting-cursor commit for a ground-targeted AOE. `dest` is the
     /// clicked world point in **WoW coords** (`bevy_to_wow` at the send site — the wire never
     /// sees Bevy space). Answered by `SMSG_CAST_RESULT`.
-    CastSpellAtDest { spell_id: u32, dest: [f32; 3] },
+    CastSpellAtDest {
+        spell_id: u32,
+        dest: [f32; 3],
+    },
     /// Cancel one of our own auras (`CMSG_CANCEL_AURA`, decision 0257): the right-click-a-buff wire,
     /// carrying the **spell id** (the server cancels by spell, not slot). No answer packet — the
     /// removal comes back as a `UNIT_FIELD_AURA` delta. Sent by the aura feed's cancel drain.
-    CancelAura { spell_id: u32 },
+    CancelAura {
+        spell_id: u32,
+    },
     /// Set (or clear, `packed == 0`) one action-bar slot (`CMSG_SET_ACTION_BUTTON`, decision
     /// 0216 §7/0218 §4): `button` is the 0-based wire slot (lua action id − 1), `packed` the
     /// engine's own `kind<<24 | action` word. Sent by the action drain on every queued
     /// `PickupAction`/`PlaceAction` mutation — client-authoritative, no answer packet.
-    SetActionButton { button: u8, packed: u32 },
+    SetActionButton {
+        button: u8,
+        packed: u32,
+    },
     /// Post the four extra bars' visibility byte (`CMSG_SET_ACTIONBAR_TOGGLES`, `PLAYER_FIELD_BYTES`
     /// byte 2 — wow-re `system/ui/scratch/action-bar-toggles.md`). Sent by the toggle drain, one
     /// per `SetActionBarToggles` call: the binding gates nothing, so two calls in a frame are two
@@ -947,7 +996,9 @@ pub(crate) enum ClientCommand {
     ///
     /// A send while disconnected is a **silent no-op**, matching the reference's three unreported
     /// drops (`0x5ab637`, `0x5379ab`, `0x5379b6`) behind a binding that returns zero Lua values.
-    SetActionBarToggles { toggles: u8 },
+    SetActionBarToggles {
+        toggles: u8,
+    },
     /// Press one pet bar slot (`CMSG_PET_ACTION`, decisions 0982/0988). `packed` is the slot's OWN
     /// word as the server last sent it — command, reaction and spell all ride this one command,
     /// because the server dispatches on the type byte inside the word. `target_guid` is the
@@ -974,7 +1025,9 @@ pub(crate) enum ClientCommand {
         entries: Vec<(u32, u32)>,
     },
     /// Call the pet off its target (`CMSG_PET_STOP_ATTACK`) — the Attack button's second press.
-    PetStopAttack { pet_guid: u64 },
+    PetStopAttack {
+        pet_guid: u64,
+    },
     /// Cancel one of the **pet's** auras (`CMSG_PET_CANCEL_AURA`, decision 1007) — the pet bar's
     /// press-again-to-cancel, and the pet-shaped twin of [`Self::CancelAura`].
     ///
@@ -982,7 +1035,10 @@ pub(crate) enum ClientCommand {
     /// know *whose* aura to drop, and `CMSG_CANCEL_AURA`'s body is a bare spell id. Like its
     /// player twin: no answer packet — the removal arrives as a `UNIT_FIELD_AURA` delta on the
     /// pet, which is also what puts the slot's icon back.
-    PetCancelAura { pet_guid: u64, spell_id: u32 },
+    PetCancelAura {
+        pet_guid: u64,
+        spell_id: u32,
+    },
     /// Flip one pet **spellbook** entry's autocast (`CMSG_PET_SPELL_AUTOCAST` 0x2F3, decision
     /// 1032) — `ToggleSpellAutocast`'s send, and **not** the pet bar's autocast verb.
     ///
@@ -1004,14 +1060,21 @@ pub(crate) enum ClientCommand {
     /// (wow-re §11c). Both would have worked against vmangos, which is why it is written here.
     ///
     /// No reply: the answer is `SMSG_PET_SPELLS` with a zero guid, and the pet object leaving.
-    PetAbandon { pet_guid: u64 },
+    PetAbandon {
+        pet_guid: u64,
+    },
     /// Rename the pet (`CMSG_PET_RENAME`, decision 1066) — the `PETRENAMECONFIRM` popup's accept.
     ///
     /// The server may refuse the name outright, so nothing is applied locally; success arrives as a
     /// bumped `UNIT_FIELD_PET_NAME_TIMESTAMP` on the pet, which is what re-asks the name cache.
-    PetRename { pet_guid: u64, name: String },
+    PetRename {
+        pet_guid: u64,
+        name: String,
+    },
     /// Start melee auto-attack on `guid` (`CMSG_ATTACKSWING`); echoed as `SMSG_ATTACKSTART`.
-    AttackSwing { guid: u64 },
+    AttackSwing {
+        guid: u64,
+    },
     /// Stop melee auto-attack (`CMSG_ATTACKSTOP`); echoed as `SMSG_ATTACKSTOP`, whose receive path
     /// drops the attacker's [`crate::creature_anim::Engaged`] stance. Sent when the attack target
     /// is lost — Esc / click-off / target death (ref-observed: losing the target stops the swing
@@ -1026,20 +1089,28 @@ pub(crate) enum ClientCommand {
     /// wand-only auto-repeat handoff before its local cancel (`0x6095b8`, wow-re
     /// `nocked-ammo-cancel.md` §Q-B-5) and by the cast bar's local self-cancel (movement/Esc
     /// mid-cast — `ui_cast`'s mirror of the client's `AbortCast 0x6e4940` send leg).
-    CancelCast { spell_id: u32 },
+    CancelCast {
+        spell_id: u32,
+    },
     /// End our own running channel (`CMSG_CANCEL_CHANNELLING`, one `u32` spell id the server
     /// reads and ignores — the real client still writes it). The channel half of the local
     /// self-cancel (`ui_cast`).
-    CancelChannelling { spell_id: u32 },
+    CancelChannelling {
+        spell_id: u32,
+    },
     /// Volunteer our sheath state (`CMSG_SETSHEATHED`: 0 stowed · 1 melee · 2 ranged). The real
     /// client auto-sends `1` when initiating melee with weapons stowed (decision 0073, verified
     /// `0x5ecb70` → `0x611cf0`); it lands in our `UNIT_FIELD_BYTES_2`, which drives everyone's
     /// weapon placement — including our own, via the descriptor echo.
-    SetSheathed { state: u32 },
+    SetSheathed {
+        state: u32,
+    },
     /// Volunteer our stand state (`CMSG_STANDSTATECHANGE`: 0 stand · 1 sit · 3 sleep · 8 kneel).
     /// The echo into `UNIT_FIELD_BYTES_1` byte 0 drives everyone's sit/stand pose — including our
     /// own, via the descriptor (decision 0080c: the same pattern as sheath).
-    StandStateChange { state: u32 },
+    StandStateChange {
+        state: u32,
+    },
     /// The mounted space-bar flourish (`CMSG_MOUNTSPECIAL_ANIM`, empty body). The sender
     /// plays MountSpecial(94) on its own mount locally at send time; the broadcast echo —
     /// present or not by server config — is self-suppressed on receive (decision 0441 P2).
@@ -1048,25 +1119,39 @@ pub(crate) enum ClientCommand {
     /// interact opener — the server's `CanInteractWithNPC` passes `UNIT_NPC_FLAG_NONE`, so it
     /// works on any interactable creature. Sent by the right-click interact route
     /// ([`crate::target`]); answered by `SMSG_GOSSIP_MESSAGE` (a `GossipMenu` event).
-    GossipHello { guid: u64 },
+    GossipHello {
+        guid: u64,
+    },
     /// Choose a gossip menu option (`CMSG_GOSSIP_SELECT_OPTION`): `option` is the chosen line's
     /// echoed `index`. v1 never sends a password — coded options are greyed and never selected
     /// (decision 0081), so the writer always omits the trailing code. The server answers a fresh
     /// menu (`SMSG_GOSSIP_MESSAGE`) or closes it (`SMSG_GOSSIP_COMPLETE`).
-    GossipSelectOption { guid: u64, option: u32 },
+    GossipSelectOption {
+        guid: u64,
+        option: u32,
+    },
     /// Fetch a gossip menu's greeting text (`CMSG_NPC_TEXT_QUERY`) — auto-sent on menu receipt for
     /// its `text_id`; answered by `SMSG_NPC_TEXT_UPDATE` (an `NpcGreeting` event). Ask-once cached
     /// per `text_id`, like an item template (decision 0081 phase 3).
-    NpcTextQuery { text_id: u32, guid: u64 },
+    NpcTextQuery {
+        text_id: u32,
+        guid: u64,
+    },
     /// Open a vendor's stock (`CMSG_LIST_INVENTORY`, decision 0081 phase 2): the direct opener a
     /// right-click on a vendor-only NPC uses. Answered by `SMSG_LIST_INVENTORY` (a
     /// `VendorInventory` event; the merchant window is phase 4).
-    ListInventory { guid: u64 },
+    ListInventory {
+        guid: u64,
+    },
     /// Buy from a vendor (`CMSG_BUY_ITEM`, decision 0081 phase 4): `entry` is the item **template**
     /// id (buy is by entry, not the vendor row's `muid`), `count` the number of stacks. Auto-places
     /// into the first free bag slot; success answers `SMSG_BUY_ITEM` + the item-create path, refusal
     /// `SMSG_BUY_FAILED` (a `VendorBuyFailed` event → the merchant error line).
-    BuyItem { vendor: u64, entry: u32, count: u8 },
+    BuyItem {
+        vendor: u64,
+        entry: u32,
+        count: u8,
+    },
     /// Sell an item to a vendor (`CMSG_SELL_ITEM`, decision 0081 phase 4's sell affordance):
     /// `item_guid` is the concrete bag item, `count` 0 = the whole stack. Success is silent (the item
     /// vanishes + coinage rises via `UPDATE_OBJECT`); refusal answers `SMSG_SELL_ITEM`'s error shape
@@ -1080,129 +1165,226 @@ pub(crate) enum ClientCommand {
     /// slot 69–80 (the app maps the clicked 1-based, timestamp-sorted list index to it). Success is
     /// the item re-creating + coinage falling via `UPDATE_OBJECT`; refusal answers
     /// `SMSG_BUY_FAILED`.
-    BuybackItem { vendor: u64, slot: u32 },
+    BuybackItem {
+        vendor: u64,
+        slot: u32,
+    },
     /// Repair at a repair-capable vendor (`CMSG_REPAIR_ITEM`): `item_guid` 0 = repair everything,
     /// else the one item. Success is durability rising + coinage falling via `UPDATE_OBJECT`
     /// (no dedicated answer packet).
-    RepairItem { vendor: u64, item_guid: u64 },
+    RepairItem {
+        vendor: u64,
+        item_guid: u64,
+    },
     /// Accept an innkeeper's bind offer (`CMSG_BINDER_ACTIVATE`, decision 1331): the
     /// `CONFIRM_BINDER` dialog's Accept, carrying the guid `SMSG_BINDER_CONFIRM` asked with. This
     /// is the ONLY packet in the flow that binds anything — selecting the gossip line just raises
     /// the question. Answered by `SMSG_BINDPOINTUPDATE` + `SMSG_PLAYERBOUND` once the innkeeper's
     /// Bind cast lands; declining sends nothing.
-    BinderActivate { binder: u64 },
+    /// File a GM trouble ticket (`CMSG_GMTICKET_CREATE`, decision 1673): the Help window's Submit.
+    /// `category` is a `GMTicketCategory.dbc` id (1..10); `map`/`pos` are where the player stands,
+    /// which is what a GM's `.ticket go` uses. Answered by `SMSG_GMTICKET_CREATE` — **or by
+    /// nothing**, on vmangos's several silent refusals (queue off, under `GMTickets.MinLevel`,
+    /// category >= 11). Never retried: the window asks once per click.
+    GmTicketCreate {
+        category: u8,
+        map: u32,
+        pos: [f32; 3],
+        text: String,
+    },
+    /// Edit the open ticket's text (`CMSG_GMTICKET_UPDATETEXT`): the window's "Save Changes".
+    /// Carries the category byte the real client carries even though vmangos discards it.
+    /// **Rate-limited server-side to 2 per world tick, sanction = kick** — one send per click.
+    GmTicketUpdate {
+        category: u8,
+        text: String,
+    },
+    /// Ask for the open ticket (`CMSG_GMTICKET_GETTICKET`, empty body): `GetGMTicket()`. The
+    /// window's own poll — once on world entry, then every 10 minutes while the toast is up.
+    GmTicketGet,
+    /// Abandon the open ticket (`CMSG_GMTICKET_DELETETICKET`, empty body): the
+    /// `HELP_TICKET_ABANDON_CONFIRM` dialog's Yes.
+    GmTicketDelete,
+    /// Ask whether the petition queue is taking tickets (`CMSG_GMTICKET_SYSTEMSTATUS`, empty
+    /// body): `GetGMStatus()`, called from the Help window's OnShow.
+    GmTicketSystemStatus,
+    BinderActivate {
+        binder: u64,
+    },
     /// Unlearn every talent (`MSG_TALENT_WIPE_CONFIRM` outbound, decision 1580): the
     /// `CONFIRM_TALENT_WIPE` dialog's Accept, carrying the guid the trainer's question asked with.
     /// This is the ONLY packet in the flow that resets anything — selecting the gossip line just
     /// raises the question. Answered by the un-learn of every rank spell plus the refreshed
     /// `PLAYER_CHARACTER_POINTS1`; declining sends nothing.
-    TalentWipeConfirm { trainer: u64 },
+    TalentWipeConfirm {
+        trainer: u64,
+    },
     /// Open the bank (`CMSG_BANKER_ACTIVATE`, decision 0604): the direct opener a right-click on
     /// a pure banker (bit 8 the lowest service bit) uses — a gossip-flagged banker routes through
     /// the gossip menu instead, whose bank option makes the server volunteer the same answer.
     /// Answered by `SMSG_SHOW_BANK` (a `ShowBank` event → the bank window opens off local state).
-    BankerActivate { guid: u64 },
+    BankerActivate {
+        guid: u64,
+    },
     /// Buy the next bank-bag slot (`CMSG_BUY_BANK_SLOT`, decision 0604): the purchase popup's
     /// accept. **No packet on success** — the descriptor's `PLAYER_BYTES_2` bank-bag count + the
     /// falling coinage are the confirmation; refusal answers `SMSG_BUY_BANK_SLOT_RESULT` (a
     /// `BuyBankSlotResult` event → the red error line).
-    BuyBankSlot { guid: u64 },
+    BuyBankSlot {
+        guid: u64,
+    },
     /// Deposit: auto-place a bag/doll item into the bank (`CMSG_AUTOBANK_ITEM`, decision 0604) —
     /// the right-click auto-move while the bank window is open. Wire `(bag, slot)`; refusal
     /// answers `SMSG_INVENTORY_CHANGE_FAILURE` (the red line), success moves the item via
     /// `UPDATE_OBJECT` field deltas.
-    AutoBankItem { bag: u8, slot: u8 },
+    AutoBankItem {
+        bag: u8,
+        slot: u8,
+    },
     /// Withdraw: auto-place a bank item into the bags (`CMSG_AUTOSTORE_BANK_ITEM`, decision 0604)
     /// — the right-click auto-move on a bank slot. Same wire shape and answers as
     /// [`Self::AutoBankItem`] (vmangos routes by whether the source is a bank position).
-    AutoStoreBankItem { bag: u8, slot: u8 },
+    AutoStoreBankItem {
+        bag: u8,
+        slot: u8,
+    },
     /// Ask (or re-ask) a trainer's service list (`CMSG_TRAINER_LIST`, decision 0237): one trainer
     /// guid. The window first opens off the gossip trainer option's `SMSG_TRAINER_LIST`; this is the
     /// *refresh* verb, re-requested after a purchase to repaint the bought row green→gray (the server
     /// does not auto-resend on a buy). Answered by `SMSG_TRAINER_LIST` (a `TrainerList` event).
-    TrainerList { trainer: u64 },
+    TrainerList {
+        trainer: u64,
+    },
     /// Buy (learn) a trainer service (`CMSG_TRAINER_BUY_SPELL`, decision 0237): the trainer guid + the
     /// service's `spell_id`. Sent by the Train button ([`crate::ui_trainer`]'s buy drain). Success
     /// answers `SMSG_TRAINER_BUY_SUCCEEDED` and delivers the spell via `SMSG_LEARNED_SPELL`; refusal
     /// answers `SMSG_TRAINER_BUY_FAILED` (a `TrainerBuyFailed` event → the window's error line).
-    TrainerBuySpell { trainer: u64, spell_id: u32 },
+    TrainerBuySpell {
+        trainer: u64,
+        spell_id: u32,
+    },
     /// Ask (or re-ask) a stable master's pet list (`MSG_LIST_STABLED_PETS`, decision 1676): one
     /// NPC guid. The window first opens off the gossip stable option's own inbound send of the
     /// same opcode; this is the *refresh* verb, re-requested after every successful mutation
     /// because none of them is answered with a fresh list.
-    ListStabledPets { npc: u64 },
+    ListStabledPets {
+        npc: u64,
+    },
     /// Put the current pet away (`CMSG_STABLE_PET`, decision 1676). **No destination slot** — the
     /// server takes the first free bought one, so there is none to carry.
-    StablePet { npc: u64 },
+    StablePet {
+        npc: u64,
+    },
     /// Summon a stabled pet (`CMSG_UNSTABLE_PET`, decision 1676): the NPC guid + the pet's own
     /// number. Valid only with no current pet; with one out the verb is [`Self::StableSwapPet`].
-    UnstablePet { npc: u64, pet_number: u32 },
+    UnstablePet {
+        npc: u64,
+        pet_number: u32,
+    },
     /// Trade the current pet for a stabled one in one step (`CMSG_STABLE_SWAP_PET`, decision 1676).
-    StableSwapPet { npc: u64, pet_number: u32 },
+    StableSwapPet {
+        npc: u64,
+        pet_number: u32,
+    },
     /// Buy the next stable slot (`CMSG_BUY_STABLE_SLOT`, decision 1676). The *which* is implicit,
     /// as with the bank's bag slots; a refusal answers `SMSG_STABLE_RESULT`'s `ERR_MONEY`.
-    BuyStableSlot { npc: u64 },
+    BuyStableSlot {
+        npc: u64,
+    },
     /// Spend talent points (`CMSG_LEARN_TALENT`, decision 0304): a `Talent.dbc` row id + the
     /// requested rank (0-based, learn-up-to — the click sends the current rank count). Sent by
     /// the talent window's click-to-learn. No dedicated reply: success arrives as the rank
     /// spell's learn effects + the refreshed `PLAYER_CHARACTER_POINTS1`.
-    LearnTalent { talent_id: u32, rank: u32 },
+    LearnTalent {
+        talent_id: u32,
+        rank: u32,
+    },
     /// Abandon a whole skill line (`CMSG_UNLEARN_SKILL`): the skills pane's unlearn button →
     /// the `UNLEARN_SKILL` popup's accept ([`crate::ui_char`]'s abandon drain). No ack — the
     /// server's `SetSkill(id, 0, 0)` returns as a `PLAYER_SKILL_INFO` field update, which the
     /// skills feed re-pushes (the engine never removes the line locally).
-    UnlearnSkill { skill_id: u32 },
+    UnlearnSkill {
+        skill_id: u32,
+    },
     /// Declare or withdraw war on a faction (`CMSG_SET_FACTION_ATWAR`): the reputation pane's
     /// crossed-swords box. Addressed by reputation-list slot. No ack — the engine already flipped
     /// its own flag copy ([`crate::ui_reputation`]), and vmangos DROPS the request outright while
     /// the player is in combat.
-    SetFactionAtWar { rep_list_id: u32, at_war: bool },
+    SetFactionAtWar {
+        rep_list_id: u32,
+        at_war: bool,
+    },
     /// Move a faction into or out of the pane's inactive bucket (`CMSG_SET_FACTION_INACTIVE`).
     /// Same slot addressing and same no-ack rule as [`Self::SetFactionAtWar`].
-    SetFactionInactive { rep_list_id: u32, inactive: bool },
+    SetFactionInactive {
+        rep_list_id: u32,
+        inactive: bool,
+    },
     /// Watch a faction's bar on the main menu bar (`CMSG_SET_WATCHED_FACTION`). **Signed**, and
     /// `-1` — not `0` — is "watch nothing": slot 0 is the Bloodsail Buccaneers. The answer returns
     /// as a `PLAYER_FIELD_WATCHED_FACTION_INDEX` descriptor update.
-    SetWatchedFaction { rep_list_id: i32 },
+    SetWatchedFaction {
+        rep_list_id: i32,
+    },
     /// Use a world GameObject (`CMSG_GAMEOBJ_USE`, decision 0236): a full guid naming the
     /// chest/door/quest-object/lever under the cursor. Sent by the right-click route
     /// ([`crate::target`]) when the nearest hovered CGObject is a usable GameObject. The server fans
     /// it out by GO type — a chest answers with `SMSG_LOOT_RESPONSE` (the loot window), a questgiver
     /// GO with the gossip/quest packets, a door with a `GAMEOBJECT_STATE` flip — or refuses silently.
-    GameObjUse { guid: u64 },
+    GameObjUse {
+        guid: u64,
+    },
     /// Report walking into an `AreaTrigger.dbc` volume (`CMSG_AREATRIGGER`): the trigger's id.
     /// Sent by [`crate::area_trigger`]'s per-frame containment check — the client's whole part in
     /// the system. The server answers a teleport trigger with the ordinary
     /// `SMSG_TRANSFER_PENDING`/`SMSG_NEW_WORLD` pair (or a same-map `MSG_MOVE_TELEPORT_ACK`), a
     /// refused one with `SMSG_AREA_TRIGGER_MESSAGE`, and most with nothing at all.
-    AreaTrigger { trigger_id: u32 },
+    AreaTrigger {
+        trigger_id: u32,
+    },
     /// Ask a GameObject's template (`CMSG_GAMEOBJECT_QUERY`, decision 0239): `entry` + the asking
     /// `guid`. Sent ask-once when a GameObject streams in ([`crate::go_templates`]); the answer's
     /// `lockId` decides whether a right-click uses it or casts an OPEN_LOCK spell.
-    GameObjectQuery { entry: u32, guid: u64 },
+    GameObjectQuery {
+        entry: u32,
+        guid: u64,
+    },
     /// Ask for one page of a book (`CMSG_PAGE_TEXT_QUERY`, decision 1105): the `PageText` id + the
     /// asking object's `guid` (an item's or a TEXT GameObject's — the server discards it). Sent
     /// ask-once by [`crate::ui_item_text::PageTexts`] when a reader opens on a page it hasn't got;
     /// vmangos answers with the whole forward chain, one `SMSG_PAGE_TEXT_QUERY_RESPONSE` per page.
-    PageTextQuery { page_id: u32, guid: u64 },
+    PageTextQuery {
+        page_id: u32,
+        guid: u64,
+    },
     /// Cast an OPEN_LOCK spell at a **GameObject** (`CMSG_CAST_SPELL`, decision 0239): the right-click
     /// on a locked chest / mining vein / herb node. The server runs `EffectOpenLock` → a chest opens
     /// its loot (`SMSG_LOOT_RESPONSE`); the profession/skill gate is the server's.
-    CastSpellGameObject { spell_id: u32, go_guid: u64 },
+    CastSpellGameObject {
+        spell_id: u32,
+        go_guid: u64,
+    },
     /// An item-targeted cast (`TARGET_FLAG_ITEM` + packed guid) — the CraftFrame enchant pick
     /// (decision 0437 phase 3).
-    CastSpellItem { spell_id: u32, item_guid: u64 },
+    CastSpellItem {
+        spell_id: u32,
+        item_guid: u64,
+    },
     /// Open a corpse/creature's loot (`CMSG_LOOT`, decision 0084): a full guid naming the lootable
     /// unit. Sent by the right-click loot route ([`crate::target`]) on the loot classification
     /// (a dead unit carrying `UNIT_DYNFLAG_LOOTABLE`). Answered by `SMSG_LOOT_RESPONSE` (a
     /// `LootResponse` event on success, `LootError` on refusal). Not usable on a GameObject guid —
     /// the server rejects those; a GameObject loots via `GameObjUse` above.
-    Loot { guid: u64 },
+    Loot {
+        guid: u64,
+    },
     /// Take one loot row into the bags (`CMSG_AUTOSTORE_LOOT_ITEM`): `slot` is the **wire** loot slot
     /// (0-based, from `SMSG_LOOT_RESPONSE`), which the loot drain maps from the clicked 1-based
     /// display row. The server auto-places into the first free bag slot; success answers
     /// `SMSG_LOOT_REMOVED` + `SMSG_ITEM_PUSH_RESULT` + the item-create path.
-    AutostoreLootItem { slot: u8 },
+    AutostoreLootItem {
+        slot: u8,
+    },
     /// Take the loot's coin pile (`CMSG_LOOT_MONEY`, empty body): the intent a click on the
     /// synthesized coin row queues. Answered by `SMSG_LOOT_CLEAR_MONEY` (+ the coinage rising via
     /// `UPDATE_OBJECT`; solo looting gets no `SMSG_LOOT_MONEY_NOTIFY` on this server).
@@ -1210,7 +1392,9 @@ pub(crate) enum ClientCommand {
     /// Close the loot window (`CMSG_LOOT_RELEASE`, decision 0084): the server ignores `guid` and
     /// releases whatever loot it has stored for us. Sent on `CloseLoot` (the window's `OnHide`).
     /// Answered by `SMSG_LOOT_RELEASE_RESPONSE` (a `LootReleaseResponse` event).
-    LootRelease { guid: u64 },
+    LootRelease {
+        guid: u64,
+    },
     /// Cast a group-loot vote (`CMSG_LOOT_ROLL`, decision 0591): the Need/Greed/Pass click on a
     /// `GroupLootFrame`. The roll is addressed by the `(looted_target, item_slot)` pair the server
     /// opened it with — the client-internal `rollID` the Lua side uses never reaches the wire.
@@ -1224,43 +1408,71 @@ pub(crate) enum ClientCommand {
     /// looter's dropdown pick. `guid` is the open loot source, `slot` the row's **wire** slot, and
     /// `target` the recipient's guid. Success arrives as an ordinary `SMSG_LOOT_REMOVED` (the item
     /// traffic goes to the recipient, not to us); a refusal as a `MASTER_*` loot error.
-    LootMasterGive { guid: u64, slot: u8, target: u64 },
+    LootMasterGive {
+        guid: u64,
+        slot: u8,
+        target: u64,
+    },
     /// Look at an available quest (`CMSG_QUESTGIVER_QUERY_QUEST`, decision 0088): a greeting/gossip
     /// quest row click. Answered by `SMSG_QUESTGIVER_QUEST_DETAILS` (a `QuestDetail` event → the
     /// accept panel).
-    QuestgiverQuery { npc: u64, quest: u32 },
+    QuestgiverQuery {
+        npc: u64,
+        quest: u32,
+    },
     /// Accept a quest (`CMSG_QUESTGIVER_ACCEPT_QUEST`): the detail panel's Accept button. Adds it to
     /// the log; the server closes the gossip window (`SMSG_GOSSIP_COMPLETE`).
-    QuestgiverAccept { npc: u64, quest: u32 },
+    QuestgiverAccept {
+        npc: u64,
+        quest: u32,
+    },
     /// Ask a quest's turn-in progress panel (`CMSG_QUESTGIVER_COMPLETE_QUEST`): an active greeting/
     /// gossip quest row click. Answered by `SMSG_QUESTGIVER_REQUEST_ITEMS` (a `QuestProgress` event),
     /// or OFFER_REWARD when there are no required items.
-    QuestgiverComplete { npc: u64, quest: u32 },
+    QuestgiverComplete {
+        npc: u64,
+        quest: u32,
+    },
     /// Advance from the progress panel to the reward panel (`CMSG_QUESTGIVER_REQUEST_REWARD`): the
     /// progress panel's Continue button. Answered by `SMSG_QUESTGIVER_OFFER_REWARD` (a `QuestOffer`
     /// event).
-    QuestgiverRequestReward { npc: u64, quest: u32 },
+    QuestgiverRequestReward {
+        npc: u64,
+        quest: u32,
+    },
     /// Choose a reward and finish the quest (`CMSG_QUESTGIVER_CHOOSE_REWARD`, `choice` = the 0-based
     /// choice index): the reward panel's Complete button. Answered by `SMSG_QUESTGIVER_QUEST_COMPLETE`
     /// (a `QuestComplete` event) + the XP/money/item grants via `UPDATE_OBJECT`.
-    QuestgiverChooseReward { npc: u64, quest: u32, choice: u32 },
+    QuestgiverChooseReward {
+        npc: u64,
+        quest: u32,
+        choice: u32,
+    },
     /// Ask a quest's full template (`CMSG_QUEST_QUERY`, the quest-log slice, decision 0088's
     /// deferred second half): the log window's ask-once detail source, distinct from
     /// `QuestgiverQuery` (which needs an NPC guid, not just the quest id). Answered by
     /// `SMSG_QUEST_QUERY_RESPONSE` (a `QuestTemplate` event) into the [`crate::ui_quest_log::QuestLog`]
     /// cache.
-    QuestQuery { quest: u32 },
+    QuestQuery {
+        quest: u32,
+    },
     /// Ask an NPC's questgiver dialog status (`CMSG_QUESTGIVER_STATUS_QUERY`) — the overhead
     /// `!`/`?` marker's value, answered by `SMSG_QUESTGIVER_STATUS`.
-    QuestgiverStatusQuery { npc: u64 },
+    QuestgiverStatusQuery {
+        npc: u64,
+    },
     /// Abandon a quest-log slot (`CMSG_QUESTLOG_REMOVE_QUEST`): the log window's confirmed abandon
     /// (`AbandonQuest()`'s two-step). No ack SMSG — the server clears the `PLAYER_QUEST_LOG` slot
     /// fields directly, which the next feed pass reads as the slot going empty.
-    QuestlogRemove { slot: u8 },
+    QuestlogRemove {
+        slot: u8,
+    },
     // ── The mail arc (decision 0544; writer bodies in benilla-protocol `world/writer/mail.rs`). ──
     /// Ask the mailbox's inbox page (`CMSG_GET_MAIL_LIST`) — the window's open verb and its
     /// refresh. Answered by `SMSG_MAIL_LIST_RESULT` (a `MailList` event).
-    GetMailList { mailbox: u64 },
+    GetMailList {
+        mailbox: u64,
+    },
     /// Send a mail (`CMSG_SEND_MAIL`): recipient/subject/body, an optional item attachment
     /// (`item_guid == 0` = none), money, and COD. Answered by `SMSG_SEND_MAIL_RESULT`.
     SendMail {
@@ -1273,22 +1485,43 @@ pub(crate) enum ClientCommand {
         cod: u32,
     },
     /// Take a mail's attached money (`CMSG_MAIL_TAKE_MONEY`).
-    MailTakeMoney { mailbox: u64, mail_id: u32 },
+    MailTakeMoney {
+        mailbox: u64,
+        mail_id: u32,
+    },
     /// Take a mail's attached item (`CMSG_MAIL_TAKE_ITEM`).
-    MailTakeItem { mailbox: u64, mail_id: u32 },
+    MailTakeItem {
+        mailbox: u64,
+        mail_id: u32,
+    },
     /// Mark a mail read (`CMSG_MAIL_MARK_AS_READ`) — sent when a letter opens. No response packet.
-    MailMarkAsRead { mailbox: u64, mail_id: u32 },
+    MailMarkAsRead {
+        mailbox: u64,
+        mail_id: u32,
+    },
     /// Return a mail to its sender (`CMSG_MAIL_RETURN_TO_SENDER`).
-    MailReturnToSender { mailbox: u64, mail_id: u32 },
+    MailReturnToSender {
+        mailbox: u64,
+        mail_id: u32,
+    },
     /// Delete a mail (`CMSG_MAIL_DELETE`) — the taken-letter close and the explicit Delete button
     /// alike.
-    MailDelete { mailbox: u64, mail_id: u32 },
+    MailDelete {
+        mailbox: u64,
+        mail_id: u32,
+    },
     /// Make a permanent copy of a letter's body (`CMSG_MAIL_CREATE_TEXT_ITEM`) — the open letter's
     /// attachment-row letter button. Answered by `SMSG_SEND_MAIL_RESULT` (action MADE_PERMANENT).
-    MailCreateTextItem { mailbox: u64, mail_id: u32 },
+    MailCreateTextItem {
+        mailbox: u64,
+        mail_id: u32,
+    },
     /// Fetch a letter's body text (`CMSG_ITEM_TEXT_QUERY`) — sent once per mail whose
     /// `item_text_id != 0`. Answered by `SMSG_ITEM_TEXT_QUERY_RESPONSE` (a `MailItemText` event).
-    ItemTextQuery { text_id: u32, mail_id: u32 },
+    ItemTextQuery {
+        text_id: u32,
+        mail_id: u32,
+    },
     /// Ask whether unread mail is waiting (`MSG_QUERY_NEXT_MAIL_TIME`, empty body). Sent once at
     /// login to seed `HasNewMail()`/the minimap letter icon (decision 0544 P3, sent by
     /// `crate::ui_mail`'s world-enter one-shot).
@@ -1306,7 +1539,9 @@ pub(crate) enum ClientCommand {
     /// Greet an auctioneer (`MSG_AUCTION_HELLO`, one guid) — the two-way opcode whose *reply*
     /// (an `AuctionHello` event, carrying the `AuctionHouse.dbc` house id) opens the window.
     #[allow(dead_code)]
-    AuctionHello { auctioneer: u64 },
+    AuctionHello {
+        auctioneer: u64,
+    },
     /// Ask a Browse page (`CMSG_AUCTION_LIST_ITEMS`): the search filters exactly as the server
     /// reads them, with `benilla_protocol::messages::auction_filter`'s sentinels for the unset
     /// ones. **No sort rides the wire** — sorting the page is ours. `list_from` pages by 50.
@@ -1326,7 +1561,10 @@ pub(crate) enum ClientCommand {
     },
     /// Ask the Auctions tab page (`CMSG_AUCTION_LIST_OWNER_ITEMS`) — our own listings.
     #[allow(dead_code)]
-    AuctionListOwnerItems { auctioneer: u64, list_from: u32 },
+    AuctionListOwnerItems {
+        auctioneer: u64,
+        list_from: u32,
+    },
     /// Ask the Bid tab page (`CMSG_AUCTION_LIST_BIDDER_ITEMS`). `auction_ids` is a **refresh
     /// set**, not a filter: those rows are emitted first, then every auction we currently hold the
     /// bid on. Empty for a plain page.
@@ -1357,7 +1595,10 @@ pub(crate) enum ClientCommand {
     /// Cancel one of our own auctions (`CMSG_AUCTION_REMOVE_ITEM`). The deposit is forfeit, and a
     /// cancel on an auction that already has a bid costs the 5% cut out of pocket.
     #[allow(dead_code)]
-    AuctionRemoveItem { auctioneer: u64, auction_id: u32 },
+    AuctionRemoveItem {
+        auctioneer: u64,
+        auction_id: u32,
+    },
     /// Ask for the server's wall clock (`CMSG_QUERY_TIME`, empty body) — sent on every world
     /// entry, answered by `SMSG_QUERY_TIME_RESPONSE` into [`ServerWallClock`]. That clock is the
     /// only way to read the absolute deadlines the server writes into descriptor fields, which is
@@ -1367,19 +1608,25 @@ pub(crate) enum ClientCommand {
     /// (decision 0631). Fire-and-forget: the reply echoes the guid and nothing else, and the window
     /// paints from the already-streamed PUBLIC `PLAYER_VISIBLE_ITEM_*` fields. Sent anyway because
     /// server-side it also sets our selection (`MiscHandler.cpp:945`), as the real client's does.
-    Inspect { target: u64 },
+    Inspect {
+        target: u64,
+    },
     /// Ask for a player's honor stats (`MSG_INSPECT_HONOR_STATS`, `u64 target`) — the inspect
     /// window's Honor tab (decision 1512). Unlike [`Self::Inspect`] this one is a **real** round
     /// trip: the reply rides the same opcode and is the only source of another player's honor
     /// numbers, since every field of the honor block is PRIVATE. A refusal is silence — the server
     /// applies the same three gates as `CMSG_INSPECT` and simply does not answer.
-    InspectHonorStats { target: u64 },
+    InspectHonorStats {
+        target: u64,
+    },
     // ── The player-trade arc (decision 0592; writer bodies in benilla-protocol
     //    `world/writer/trade.rs`). ─────────────────────────────────────────────────────────────
     /// Offer to trade with a player (`CMSG_INITIATE_TRADE`, `u64 target`) — the UnitPopup TRADE row.
     /// The server answers the initiator on any refusal (`SMSG_TRADE_STATUS`) and, on success, sends
     /// the *target* `BEGIN_TRADE`.
-    InitiateTrade { target: u64 },
+    InitiateTrade {
+        target: u64,
+    },
     /// The target's auto-reply to `BEGIN_TRADE` (`CMSG_BEGIN_TRADE`, empty) — makes the server emit
     /// `OPEN_WINDOW` to both sides. Sent by the net bridge the frame it decodes a `BEGIN_TRADE`
     /// status (decision 0592 P1; the reference client auto-answers, `TradeHandler.cpp`).
@@ -1393,14 +1640,22 @@ pub(crate) enum ClientCommand {
     /// Offer this many copper on our side (`CMSG_SET_TRADE_GOLD`, `u32`) — the money input's
     /// value-changed callback (decision 0592 P2). Clears both accepts + re-arms the 200 ms scam delay
     /// server-side; the server echoes our new gold back as `SMSG_TRADE_STATUS_EXTENDED`.
-    SetTradeGold { copper: u32 },
+    SetTradeGold {
+        copper: u32,
+    },
     /// Place the item at inventory (`bag`, `slot`) into our trade slot `trade_slot` (0-based, 0..=6;
     /// 6 = the non-traded/enchant slot) — `CMSG_SET_TRADE_ITEM`, a bag item dropped onto the slot
     /// (decision 0592 P2). The server echoes the filled slot back as `SMSG_TRADE_STATUS_EXTENDED`.
-    SetTradeItem { trade_slot: u8, bag: u8, slot: u8 },
+    SetTradeItem {
+        trade_slot: u8,
+        bag: u8,
+        slot: u8,
+    },
     /// Clear our trade slot `trade_slot` (0-based) — `CMSG_CLEAR_TRADE_ITEM`, an empty-cursor click on
     /// a filled slot (decision 0592 P2).
-    ClearTradeItem { trade_slot: u8 },
+    ClearTradeItem {
+        trade_slot: u8,
+    },
     /// Leave the world back to character select (`CMSG_LOGOUT_REQUEST`, the `/logout` command —
     /// decision 0193). The server answers `SMSG_LOGOUT_COMPLETE` (instant for a resting/GM
     /// character), which the IO thread turns into a [`LoggedOutMessage`] + an immediate
@@ -1411,13 +1666,23 @@ pub(crate) enum ClientCommand {
     /// `SMSG_LOGOUT_CANCEL_ACK`, which becomes the UI's `LOGOUT_CANCEL` event.
     LogoutCancel,
     /// Join a chat channel (`CMSG_JOIN_CHANNEL` — `/join`, and the 0288 P6 zone auto-join).
-    JoinChannel { name: String, password: String },
+    JoinChannel {
+        name: String,
+        password: String,
+    },
     /// Leave a chat channel (`CMSG_LEAVE_CHANNEL` — `/leave`).
-    LeaveChannel { name: String },
+    LeaveChannel {
+        name: String,
+    },
     /// Ask a channel's roster (`CMSG_CHANNEL_LIST` — `/chatlist <name>`).
-    ChannelList { name: String },
+    ChannelList {
+        name: String,
+    },
     /// `/random [min] [max]` (`MSG_RANDOM_ROLL`).
-    RandomRoll { min: u32, max: u32 },
+    RandomRoll {
+        min: u32,
+        max: u32,
+    },
     /// `/played` (`CMSG_PLAYED_TIME`).
     PlayedTime,
     /// Acknowledge a triggered cinematic as finished (`CMSG_COMPLETE_CINEMATIC`). benilla doesn't
@@ -1452,25 +1717,38 @@ pub(crate) enum ClientCommand {
     CorpseQuery,
     /// Reclaim our corpse (`CMSG_RECLAIM_CORPSE` — RECOVER_CORPSE's Accept). Server-gated to
     /// ghost + delay elapsed + 39 yd; success returns as ordinary descriptor deltas.
-    ReclaimCorpse { corpse: u64 },
+    ReclaimCorpse {
+        corpse: u64,
+    },
     /// Take the spirit healer's resurrection (`CMSG_SPIRIT_HEALER_ACTIVATE` — the XP_LOSS
     /// confirm's final Accept): 50% res, 25% durability, sickness at level ≥ 11.
-    SpiritHealerActivate { npc: u64 },
+    SpiritHealerActivate {
+        npc: u64,
+    },
     /// Answer a resurrection offer (`CMSG_RESURRECT_RESPONSE` — the RESURRECT popups).
-    ResurrectResponse { caster: u64, accept: bool },
+    ResurrectResponse {
+        caster: u64,
+        accept: bool,
+    },
     // ── The group/party family (decision 0434; writer bodies in benilla-protocol
     //    `world/writer/group.rs`) ──────────────────────────────────────────────────────────────
     /// Invite a player by name (`CMSG_GROUP_INVITE` — `/invite`, the unit menus, the invite ack
     /// comes back as `SMSG_PARTY_COMMAND_RESULT`).
-    GroupInvite { name: String },
+    GroupInvite {
+        name: String,
+    },
     /// Accept the pending group invite (`CMSG_GROUP_ACCEPT` — the PARTY_INVITE popup's Accept).
     GroupAccept,
     /// Decline the pending group invite (`CMSG_GROUP_DECLINE` — Decline/timeout/escape).
     GroupDecline,
     /// Kick a member by name (`CMSG_GROUP_UNINVITE` — `/uninvite`, leader only).
-    GroupUninvite { name: String },
+    GroupUninvite {
+        name: String,
+    },
     /// Hand leadership to a member (`CMSG_GROUP_SET_LEADER` — `/promote`, leader only).
-    GroupSetLeader { guid: u64 },
+    GroupSetLeader {
+        guid: u64,
+    },
     /// Leave the group (`CMSG_GROUP_DISBAND` — the wire's leave verb, despite the name).
     GroupLeave,
     /// Convert the party into a raid (`CMSG_GROUP_RAID_CONVERT`, leader only; echoes back as a
@@ -1484,7 +1762,9 @@ pub(crate) enum ClientCommand {
     /// the object manager (`net::apply::group::member_deactivated`), and the GROUP_LIST seat of a
     /// member new to the roster whose object we do not hold (`seat_new_records`). There is no
     /// timer and no Lua binding — a periodic poll would be ours, not the client's.
-    RequestPartyMemberStats { guid: u64 },
+    RequestPartyMemberStats {
+        guid: u64,
+    },
     /// Set the loot rules (`CMSG_LOOT_METHOD`): `method` 0..4, `master` guid (master loot only),
     /// `threshold` quality 2..4. Leader only; echoes back as a fresh `SMSG_GROUP_LIST`.
     LootMethod {
@@ -1495,55 +1775,88 @@ pub(crate) enum ClientCommand {
     /// Mark a unit with a raid-target icon (`MSG_RAID_TARGET_UPDATE` outbound — the popup's
     /// submenu, decision 0434 §5): wire `icon` 0..7, `guid` 0 clears that icon's slot. Leader/
     /// assistant only server-side; echoes back as the delta form.
-    SetRaidTarget { icon: u8, guid: u64 },
+    SetRaidTarget {
+        icon: u8,
+        guid: u64,
+    },
     /// `MSG_MINIMAP_PING` (a minimap click, decision 1596): raw world `(x, y)`. The server relays
     /// them verbatim to the rest of the group and does nothing at all when we are solo — which is
     /// why the marker is drawn locally at click time rather than awaited off the wire.
-    MinimapPing { x: f32, y: f32 },
+    MinimapPing {
+        x: f32,
+        y: f32,
+    },
     // ── The raid-management family (decision 1549's Raid tab) ─────────────────────────────────
     /// Move a raid member to another subgroup (`CMSG_GROUP_CHANGE_SUB_GROUP`): the member's NAME
     /// and the **0-based** subgroup the wire wants. Leader/assistant only; echoes as a fresh
     /// `SMSG_GROUP_LIST`.
-    GroupChangeSubGroup { name: String, group: u8 },
+    GroupChangeSubGroup {
+        name: String,
+        group: u8,
+    },
     /// Trade two raid members' subgroups (`CMSG_GROUP_SWAP_SUB_GROUP`, two names).
-    GroupSwapSubGroup { name: String, other: String },
+    GroupSwapSubGroup {
+        name: String,
+        other: String,
+    },
     /// Grant or revoke the raid-assistant flag (`CMSG_GROUP_ASSISTANT_LEADER`, leader only).
-    GroupAssistantLeader { guid: u64, grant: bool },
+    GroupAssistantLeader {
+        guid: u64,
+        grant: bool,
+    },
     /// Start a ready check (`MSG_RAID_READY_CHECK`, empty body — leader only).
     ReadyCheckStart,
     /// Answer a ready check (`MSG_RAID_READY_CHECK`, one byte).
-    ReadyCheckAnswer { ready: bool },
+    ReadyCheckAnswer {
+        ready: bool,
+    },
     /// Ask for our saved raid lockouts (`CMSG_REQUEST_RAID_INFO`) — the Raid Info panel.
     RequestRaidInfo,
     // ── The duel family (decision 0633; writer bodies in benilla-protocol
     //    `world/writer/duel.rs`). Challenging is a `CastSpell` of the duel spell, not a verb here.
     /// Accept a duel challenge (`CMSG_DUEL_ACCEPTED`) — the popup's Accept, and the challenger's
     /// own auto-accept the instant its request echoes back.
-    DuelAccepted { arbiter: u64 },
+    DuelAccepted {
+        arbiter: u64,
+    },
     /// Decline / cancel / forfeit a duel (`CMSG_DUEL_CANCELLED`) — one opcode for all three; the
     /// server reads the intent from the duel's state.
-    DuelCancelled { arbiter: u64 },
+    DuelCancelled {
+        arbiter: u64,
+    },
     // ── The social family (decision 0668; writer bodies in benilla-protocol
     //    `world/writer/social.rs`). Note the wire's own asymmetry: add by NAME, remove by GUID.
     /// Refresh the friend list (`CMSG_FRIEND_LIST`) — the FrameXML's `ShowFriends()`. The list
     /// also arrives unasked at login, so this is never the only path.
     FriendListRequest,
     /// Befriend a character by name (`CMSG_ADD_FRIEND`).
-    AddFriend { name: String },
+    AddFriend {
+        name: String,
+    },
     /// Drop a friend by guid (`CMSG_DEL_FRIEND`) — the caller resolves the name first.
-    DelFriend { guid: u64 },
+    DelFriend {
+        guid: u64,
+    },
     /// Ignore a character by name (`CMSG_ADD_IGNORE`).
-    AddIgnore { name: String },
+    AddIgnore {
+        name: String,
+    },
     /// Stop ignoring, by guid (`CMSG_DEL_IGNORE`).
-    DelIgnore { guid: u64 },
+    DelIgnore {
+        guid: u64,
+    },
     /// Tell the server we dropped an ignored player's whisper (`CMSG_CHAT_IGNORED`) so it can
     /// answer them "X is ignoring you". The drop itself is entirely client-side — the server
     /// keeps delivering an ignored player's chat, which is why the client has to filter *and*
     /// report.
-    ChatIgnored { guid: u64 },
+    ChatIgnored {
+        guid: u64,
+    },
     /// Run a `/who` (`CMSG_WHO`) — the filter string is already parsed into wire fields
     /// (`ui_social::who_query`, which needs the DBCs the parse resolves names against).
-    Who { request: Box<WhoRequest> },
+    Who {
+        request: Box<WhoRequest>,
+    },
     /// Ask to flip our own PvP flag (`CMSG_TOGGLE_PVP`, empty body — decision 0646): `/pvp` and
     /// the unit popup's PvP row, both through the VM's intent queue. Nothing local changes; the
     /// answer is the descriptor's PvP bit (and flagging *off* waits out the server's 300 s timer).
@@ -1571,13 +1884,19 @@ pub(crate) enum ClientCommand {
     //    so nothing would answer it anyway.
     /// Ask a guild's public identity by id (`CMSG_GUILD_QUERY`) — the ask-once cache fill behind
     /// every "which guild is that?" (a roster row, a `/who` hit, a guild chat line).
-    GuildQuery { guild_id: u32 },
+    GuildQuery {
+        guild_id: u32,
+    },
     /// Found a guild by name (`CMSG_GUILD_CREATE`). vmangos registers the opcode `STATUS_NEVER` —
     /// at 1.12 founding runs through the charter flow — so this draws no reply.
     #[allow(dead_code)]
-    GuildCreate { name: String },
+    GuildCreate {
+        name: String,
+    },
     /// Invite a character into our guild (`CMSG_GUILD_INVITE`).
-    GuildInvite { name: String },
+    GuildInvite {
+        name: String,
+    },
     /// Accept the guild invitation we are holding (`CMSG_GUILD_ACCEPT`, empty body) — which one is
     /// the server's pending state, not a field.
     GuildAccept,
@@ -1589,20 +1908,30 @@ pub(crate) enum ClientCommand {
     /// server also pushes the roster unasked after every change, so this is never the only path.
     GuildRosterRequest,
     /// Promote a member one rank (`CMSG_GUILD_PROMOTE`) — towards guild master.
-    GuildPromote { name: String },
+    GuildPromote {
+        name: String,
+    },
     /// Demote a member one rank (`CMSG_GUILD_DEMOTE`).
-    GuildDemote { name: String },
+    GuildDemote {
+        name: String,
+    },
     /// Leave our guild (`CMSG_GUILD_LEAVE`, empty body). Refused while we are the guild master and
     /// anyone else remains.
     GuildLeave,
     /// Kick a member by name (`CMSG_GUILD_REMOVE`).
-    GuildRemove { name: String },
+    GuildRemove {
+        name: String,
+    },
     /// Disband the guild (`CMSG_GUILD_DISBAND`, empty body) — guild master only, irreversible.
     GuildDisband,
     /// Hand the guild to another member (`CMSG_GUILD_LEADER`).
-    GuildLeader { name: String },
+    GuildLeader {
+        name: String,
+    },
     /// Set the message of the day (`CMSG_GUILD_MOTD`); `""` clears it.
-    GuildMotd { motd: String },
+    GuildMotd {
+        motd: String,
+    },
     /// Rewrite one rank's name **and** rights together (`CMSG_GUILD_RANK`) — there is no partial
     /// form, so a caller changing one must resend the other's current value. Rank 0's rights are
     /// ignored and forced to "all"; an over-long name gets the session kicked, so cap it at
@@ -1613,18 +1942,28 @@ pub(crate) enum ClientCommand {
         name: String,
     },
     /// Append a rank at the bottom of the ladder (`CMSG_GUILD_ADD_RANK`).
-    GuildAddRank { name: String },
+    GuildAddRank {
+        name: String,
+    },
     /// Delete the **lowest** rank (`CMSG_GUILD_DEL_RANK`, empty body) — there is no rank id on the
     /// wire, it is always the last one.
     GuildDelRank,
     /// Set a member's public note (`CMSG_GUILD_SET_PUBLIC_NOTE`).
-    GuildSetPublicNote { name: String, note: String },
+    GuildSetPublicNote {
+        name: String,
+        note: String,
+    },
     /// Set a member's officer note (`CMSG_GUILD_SET_OFFICER_NOTE`). Editing and *viewing* officer
     /// notes are separate rights — an all-empty officer column may mean we cannot see them.
-    GuildSetOfficerNote { name: String, note: String },
+    GuildSetOfficerNote {
+        name: String,
+        note: String,
+    },
     /// Set the guild information text (`CMSG_GUILD_INFO_TEXT`) — the long free-text pane, which
     /// rides back as the roster's `info` field.
-    GuildInfoText { text: String },
+    GuildInfoText {
+        text: String,
+    },
     // ── The taxi/flight-master family (decision 0484 phase 1; writer bodies in
     //    benilla-protocol `messages::taxi`) ──────────────────────────────────────────────────
     /// Ask a nearby flight master's known status (`CMSG_TAXINODE_STATUS_QUERY`): the guid of the
@@ -1632,14 +1971,18 @@ pub(crate) enum ClientCommand {
     /// `SMSG_TAXINODE_STATUS` (a `TaxiNodeStatus` event). No send site yet — phase 2's cursor/
     /// tooltip work; wired end-to-end now so that phase only adds a call site.
     #[allow(dead_code)]
-    TaxiNodeStatusQuery { guid: u64 },
+    TaxiNodeStatusQuery {
+        guid: u64,
+    },
     /// Open a flight master's taxi map (`CMSG_TAXIQUERYAVAILABLENODES`, decision 0496 I4:
     /// CONFIRMED as built): the direct opener the taxi-cursor interact sends — the interact ladder
     /// is first-match-wins low→high over `UNIT_NPC_FLAGS`, so a gossip+taxi NPC pre-empts to
     /// gossip and only a pure flightmaster reaches this send. A known node answers
     /// `SMSG_SHOWTAXINODES` (a `TaxiNodesShown` event); a never-visited node instead answers the
     /// first-visit learn pair (`NewTaxiPath` + `TaxiNodeStatus`) and opens nothing on this click.
-    TaxiQueryNodes { guid: u64 },
+    TaxiQueryNodes {
+        guid: u64,
+    },
     /// Fly a single hop (`CMSG_ACTIVATETAXI`): the flight-master guid, the source node, the
     /// destination node. Answered by `SMSG_ACTIVATETAXIREPLY`; success continues into the mount +
     /// `SMSG_MONSTER_MOVE` flight (the existing self-spline rails, decision 0260). Sent by the
diff --git a/crates/benilla-app/src/net/apply.rs b/crates/benilla-app/src/net/apply.rs
index fb6b8faf..81b06537 100644
--- a/crates/benilla-app/src/net/apply.rs
+++ b/crates/benilla-app/src/net/apply.rs
@@ -237,6 +237,11 @@ pub(super) fn apply_net_updates(
                 // The minimap ping (decision 1596) — a group member's `MSG_MINIMAP_PING` seats the
                 // world point here and the minimap renderer derives everything else from it.
                 ResMut<crate::minimap::MinimapPing>,
+                // The GM ticket (decision 1673) — `SMSG_GMTICKET_GETTICKET` replaces the held
+                // ticket here and BUMPS AN ANSWER COUNTER, which is what `crate::ui_gm_ticket`
+                // diffs on: the Help window re-polls every 10 minutes and an unchanged answer
+                // still has to re-fire `UPDATE_TICKET`.
+                ResMut<crate::ui_gm_ticket::GmTicketState>,
             ),
         ),
     ),
@@ -412,6 +417,7 @@ pub(super) fn apply_net_updates(
                 mut auction_open,
                 guild_notify,
                 mut ping,
+                mut gm_ticket,
             ),
         ),
     ) = caches;
@@ -525,6 +531,7 @@ pub(super) fn apply_net_updates(
                     &mut duel,
                     &mut social,
                     &mut guild,
+                    &mut gm_ticket,
                     &mut aura.6,
                     &mut disconnects,
                 );
@@ -749,6 +756,35 @@ pub(super) fn apply_net_updates(
                 });
             }
             SessionEvent::BinderConfirm { binder: npc } => binder.ask(npc),
+            // The GM ticket answers (decision 1673). The GETTICKET arm takes EVERY answer,
+            // including `None` ("you have no ticket") and including an unsolicited one pushed by a
+            // GM's `.ticket view`/`escalate`/`complete` — they are indistinguishable on the wire
+            // and want identical handling.
+            SessionEvent::GmTicket { ticket } => gm_ticket.answer(ticket),
+            SessionEvent::GmTicketSystemStatus { status } => gm_ticket.answer_queue(status),
+            // A GM touched the ticket. Value 1 makes the reference re-ask (`0x5e7932`), the same
+            // leg the create/update success codes take; 2 (closed) and 3 (survey offered) are
+            // recorded and not acted on — 3 is the survey trigger and that window is deferred.
+            // vmangos never sends this packet at all, so on our server the arm is dead; cmangos
+            // makes it the whole notification model, which is why it is parsed rather than dropped.
+            SessionEvent::GmTicketStatusUpdate { status } => {
+                crate::ui_gm_ticket::apply::status_update(status, &mut gm_ticket)
+            }
+            // The three response codes have no consumer in the shipped 1.12 UI — no event, no
+            // handler. Logged so a refusal is visible in a session log rather than silent; the
+            // `ERR_TICKET_*` display path is still unpinned (see `ui_gm_ticket::apply`).
+            // Create-ok (2) and update-ok (4) make the ENGINE re-ask for the ticket — the
+            // reference's own `0x5e4479` arm, and the reason the shipped UI needs no handler for
+            // either opcode. Without it a filed ticket goes unseen until the 10-minute poll.
+            SessionEvent::GmTicketCreated { response } => {
+                crate::ui_gm_ticket::apply::write_response("create", response, 2, &mut gm_ticket)
+            }
+            SessionEvent::GmTicketUpdated { response } => {
+                crate::ui_gm_ticket::apply::write_response("update", response, 4, &mut gm_ticket)
+            }
+            SessionEvent::GmTicketDeleted { response } => {
+                crate::ui_gm_ticket::apply::response("delete", response)
+            }
             // A zero trainer guid is vmangos's "you have no talents to reset" refusal, not a
             // question — there is nothing to ask about, so nothing goes on screen (decision 1580;
             // `crate::ui_talent_wipe`'s header carries why the reference instead re-sends here).
diff --git a/crates/benilla-app/src/net/apply/session.rs b/crates/benilla-app/src/net/apply/session.rs
index 0e2616f5..aa0debb7 100644
--- a/crates/benilla-app/src/net/apply/session.rs
+++ b/crates/benilla-app/src/net/apply/session.rs
@@ -164,6 +164,7 @@ pub(super) fn disconnected(
     duel: &mut crate::ui_duel::DuelState,
     social: &mut crate::ui_social::SocialState,
     guild: &mut crate::ui_guild::GuildState,
+    gm_ticket: &mut crate::ui_gm_ticket::GmTicketState,
     pending_transfer: &mut PendingTransfer,
     disconnects: &mut MessageWriter<DisconnectedMessage>,
 ) {
@@ -247,6 +248,11 @@ pub(super) fn disconnected(
     // lazily, and keeping a cache alive across a socket only to save one query is not worth the
     // one wrong name a renamed guild would show.
     *guild = crate::ui_guild::GuildState::default();
+    // The GM ticket is login-scoped too (decision 1673), and for a sharper reason than most: the
+    // ticket belongs to the CHARACTER, and the next login may be a different one. Its answer
+    // counters go with it, so the first `SMSG_GMTICKET_GETTICKET` of the new session re-fires
+    // `UPDATE_TICKET` rather than being diffed away against the old character's answer count.
+    gm_ticket.clear_session();
     // The death stores are session-scoped too: a reclaim expiry, resurrect offer, or corpse
     // marker must not survive the socket (the reconnect re-sends the reclaim delay when dead).
     *death_net = crate::death::DeathNet::default();
diff --git a/crates/benilla-app/src/net/io.rs b/crates/benilla-app/src/net/io.rs
index 3b6b56d3..ca909df8 100644
--- a/crates/benilla-app/src/net/io.rs
+++ b/crates/benilla-app/src/net/io.rs
@@ -803,6 +803,18 @@ fn writer_loop(
                     ClientCommand::RepairItem { vendor, item_guid } => {
                         w.repair_item(vendor, item_guid)
                     }
+                    ClientCommand::GmTicketCreate {
+                        category,
+                        map,
+                        pos,
+                        text,
+                    } => w.gm_ticket_create(category, map, pos, &text),
+                    ClientCommand::GmTicketUpdate { category, text } => {
+                        w.gm_ticket_updatetext(category, &text)
+                    }
+                    ClientCommand::GmTicketGet => w.gm_ticket_get(),
+                    ClientCommand::GmTicketDelete => w.gm_ticket_delete(),
+                    ClientCommand::GmTicketSystemStatus => w.gm_ticket_system_status(),
                     ClientCommand::BinderActivate { binder } => w.binder_activate(binder),
                     ClientCommand::TalentWipeConfirm { trainer } => w.talent_wipe_confirm(trainer),
                     ClientCommand::BankerActivate { guid } => w.banker_activate(guid),
diff --git a/crates/benilla-app/src/ui_gm_ticket.rs b/crates/benilla-app/src/ui_gm_ticket.rs
new file mode 100644
index 00000000..08cbcabe
--- /dev/null
+++ b/crates/benilla-app/src/ui_gm_ticket.rs
@@ -0,0 +1,611 @@
+//! The GM trouble-ticket flow — the Help window's wire, its events, and its answers
+//! (decision 1673).
+//!
+//! **The law worth stating first: the client holds no ticket state.** There is no local "I have a
+//! ticket" bit that survives anything; every question is a round trip, and `SMSG_GMTICKET_GETTICKET`
+//! is the only truth about whether a ticket exists, what it says, and how long the wait is. That is
+//! why this module is almost entirely feed-and-drain with a single counter of substance, and why
+//! the Help window re-polls rather than caching.
+//!
+//! ## Three events, and why each fires when it does
+//!
+//! - **`UPDATE_TICKET`** — fired for **every** `SMSG_GMTICKET_GETTICKET`, including the "you have
+//!   no ticket" answer, and including the second identical answer in a row. It is an **answer
+//!   ticket**, not a state diff ([`GmTicketState::answers`]): the shipped window polls
+//!   `GetGMTicket()` every `GMTICKET_CHECK_INTERVAL` (600 s) from `TicketStatus_OnUpdate`, and a
+//!   feed that suppressed an unchanged answer would make the poll look like a hang. The idiom is
+//!   [`crate::ui_party`]'s saved-instance ticket, for exactly the same reason.
+//! - **`UPDATE_GM_STATUS`** — fired for every `SMSG_GMTICKETSYSTEMSTATUS`. Sets the window's
+//!   `PETITION_QUEUE_ACTIVE`, which gates the whole "page a GM" path.
+//! - **`GMSURVEY_DISPLAY`** — **not fired, deliberately.** See "The survey" below.
+//!
+//! ## The argument order is NOT the wire order
+//!
+//! `HelpFrameOpenTicket_OnEvent` reads `UPDATE_TICKET` as `arg1` = category, `arg2` = description,
+//! `arg3..5` = the three day-valued floats, `arg6` = assignedToGM, `arg7` = openedByGM. The packet
+//! puts the **text first and the category second** (both emulators agree byte-for-byte; see
+//! [`benilla_protocol::messages::gm_ticket`]). So the reorder happens here, in [`feed_gm_ticket`],
+//! which is where the reference client's own handler does it. Do not "fix" the decoder to match
+//! the event: that would desynchronise every field after the string.
+//!
+//! **The no-ticket answer is a single `arg1 = 0`**, because the window's test is
+//! `if ( arg1 and arg1 ~= 0 )`. That branch is what resets Submit/Cancel back to SUBMIT/CANCEL and
+//! empties the edit box, so it is load-bearing rather than a null case.
+//!
+//! ## What vmangos actually does, and what that costs us
+//!
+//! Verified against `/Users/sam/wre/vmangos-src` (`Handlers/GMTicketHandler.cpp`, `GMTicketMgr.cpp`,
+//! `Commands/TicketCommands.cpp`) — four behaviours a client author has to design around:
+//!
+//! 1. **Silence is a legal answer.** Create returns with no packet at all when the queue is off,
+//!    when the player is under `GMTickets.MinLevel`, or when the category is ≥ 11
+//!    (`GMTicketHandler.cpp:91,106-113`); delete with no ticket likewise (`:73-86`). Nothing here
+//!    may block on or retry an answer — and nothing does: every send is fire-and-forget, and the
+//!    window's own re-poll is what eventually reconciles.
+//! 2. **`SMSG_GMTICKET_GETTICKET` and `SMSG_GMTICKET_DELETETICKET` arrive UNSOLICITED** when a GM
+//!    runs `.ticket viewid`/`escalate`/`complete`/`delete` (`GMTicketMgr.cpp:153-159`,
+//!    `TicketCommands.cpp:100-103,265,443-452`). They are handled identically to a solicited one,
+//!    which is the whole benefit of not correlating answers to asks.
+//! 3. **The GM's reply arrives inside the ticket text.** 1.12 has no response channel, so vmangos
+//!    appends `"…GM answer: <response>"` to the description itself (`GMTicketMgr.cpp:124-136`).
+//!    The window renders it verbatim, which is correct — there is nowhere else for it to go.
+//! 4. **Editing is rate-limited to 2 per world tick, and the sanction is a KICK**
+//!    (`WorldSession.cpp:1316-1342`). One send per click, never a retry.
+//!
+//! ## The survey
+//!
+//! `Blizzard_GMSurveyUI` and the `GMSURVEY_DISPLAY` event are **deferred, not forgotten**. The
+//! trigger does not exist on this server: `SMSG_GM_TICKET_STATUS_UPDATE` — the packet cmangos uses
+//! to raise a survey — is registered in vmangos's opcode table but **never constructed anywhere in
+//! its source**, so a vmangos client can never be asked to fill one in. Building the survey window
+//! now would be shipping a panel nothing can open. The DBCs it would read are already on disk and
+//! already understood (`GMSurveyCurrentSurvey` → `GMSurveySurveys` → `GMSurveyQuestions`, five
+//! questions, ids 28-32), so the work is scoped whenever a server grows the trigger.
+
+use benilla_ui::script::{GmTicketIntent, GmTicketWrite, ScriptValue, UiScript};
+use bevy::prelude::*;
+
+use benilla_assets::coords::bevy_to_wow;
+
+use crate::net::{ClientCommand, NetCommands};
+use crate::player::Player;
+use crate::ui_script::{UiInput, VmMemo};
+
+/// Spell 7355 "Stuck" — what `Stuck()` casts, and the Help window's "Auto-Unstuck".
+///
+/// Pinned from **both** sides rather than assumed: `Spell.dbc` row 7355 is named "Stuck" in the
+/// shipped 5875 client, and it is the only spell in the server's whole `spell_template` table
+/// carrying `SPELL_EFFECT_STUCK` (84), whose handler teleports the player to their last safe
+/// position (`vmangos SpellEffects.cpp:4697`, gated by `CastUnstuck` which defaults on). So the
+/// id is not a guess in either direction.
+const SPELL_STUCK: u32 = 7355;
+
+/// What the last `SMSG_GMTICKET_GETTICKET` said, and **how many** have arrived.
+///
+/// The count is the load-bearing half. A `bool`/value diff cannot express "the server answered
+/// again with the same thing", and that is precisely the Help window's 10-minute poll — so the
+/// feed fires on the counter moving, never on the value changing.
+#[derive(Resource, Default)]
+pub(crate) struct GmTicketState {
+    /// The open ticket, or `None` for "you have no ticket" — the ordinary answer.
+    ticket: Option<Box<benilla_protocol::messages::GmTicket>>,
+    /// One per `SMSG_GMTICKET_GETTICKET`, wrapping. The answer ticket.
+    answers: u32,
+    /// Re-asks the ENGINE owes the server — see [`Self::note_write_landed`]. Drained into
+    /// `CMSG_GMTICKET_GETTICKET` sends by [`drain_gm_ticket`], beside the ones Lua asked for.
+    engine_reasks: u32,
+    /// The last queue status the server reported, and its own answer counter — same idiom, because
+    /// `GetGMStatus()` is asked on every window open and the answer is usually unchanged.
+    ///
+    /// **`i32`, not `u32`, and that is byte-verified rather than a preference** (wow-re §5, this
+    /// session): the reference copies the field off the wire verbatim at `0x418e95` with no
+    /// extension, pushes it unmodified at `0x5e467b`, and hands it to Lua through
+    /// `0x704fa6 fild dword` — a **signed** load, with no `cmp`, `test`, clamp or mapping anywhere
+    /// between the wire and the event. So `HelpFrame`'s `arg1 == -1` arm is reachable exactly when
+    /// a server sends `0xFFFFFFFF`, and reading the field unsigned would turn that into
+    /// 4294967295, silently costing the "the queue is down" dialog.
+    queue_status: i32,
+    queue_answers: u32,
+}
+
+impl GmTicketState {
+    /// `SMSG_GMTICKET_GETTICKET` — replace the ticket wholesale and count the answer. **An empty
+    /// answer still counts**: it is what "you abandoned it" and "you never had one" both look like,
+    /// and the window has to hear it.
+    pub(crate) fn answer(&mut self, ticket: Option<Box<benilla_protocol::messages::GmTicket>>) {
+        self.ticket = ticket;
+        self.answers = self.answers.wrapping_add(1);
+    }
+
+    /// **The client re-asks for its own ticket whenever a write lands** — the mechanism that makes
+    /// the shipped UI's total silence on the three response opcodes correct rather than a gap.
+    ///
+    /// Byte-verified in wow-re (§5, this session): `CMSG_GMTICKET_GETTICKET` (`0x211`) has three
+    /// callers, and two of them are *engine* legs reacting to a server push — the `0x206`/`0x208`
+    /// arm on response codes 2 (create-ok) and 4 (update-ok) at `0x5e4479`, and the `0x328` handler
+    /// on body value 1 at `0x5e7932`. **Neither carries an idempotence guard**, so it is one resend
+    /// per qualifying push, which is what this counter models.
+    ///
+    /// Without it the window would not learn its own ticket exists until the 10-minute poll came
+    /// round: file a ticket, and the toast stays dark and the form stays a form for up to ten
+    /// minutes. That is exactly the "goes stale" failure, and no FrameXML handler can fix it —
+    /// there is none to fix.
+    pub(crate) fn note_write_landed(&mut self) {
+        self.engine_reasks = self.engine_reasks.saturating_add(1);
+    }
+
+    /// Drain the engine's owed re-asks.
+    fn take_reasks(&mut self) -> u32 {
+        std::mem::take(&mut self.engine_reasks)
+    }
+
+    /// `SMSG_GMTICKETSYSTEMSTATUS` — the petition queue's state, counted the same way.
+    pub(crate) fn answer_queue(&mut self, status: i32) {
+        self.queue_status = status;
+        self.queue_answers = self.queue_answers.wrapping_add(1);
+    }
+
+    /// The socket died: a fresh session has not been answered, so both tickets go back to zero
+    /// along with the state they described. Without this a reconnect would show the previous
+    /// character's ticket until the first poll landed.
+    pub(crate) fn clear_session(&mut self) {
+        *self = Self::default();
+    }
+}
+
+/// What the VM has already been told, per VM.
+///
+/// Behind a [`VmMemo`] (1290/1291) for the reason every feed's is: a `/reload` replaces the VM
+/// without despawning the world, and a memory of what the *old* VM heard would leave the new one
+/// with no categories, no ticket and no event ever coming.
+#[derive(Resource, Default)]
+struct GmTicketFeedState {
+    vm: VmMemo<FedTicket>,
+}
+
+/// The per-VM change bases: the two answer counters already fired, and whether the static category
+/// catalog has been handed over.
+#[derive(Default)]
+struct FedTicket {
+    answers: u32,
+    queue_answers: u32,
+    categories_pushed: bool,
+}
+
+/// Fire `UPDATE_TICKET`/`UPDATE_GM_STATUS` for answers the UI has not heard yet, and push the
+/// category catalog once.
+fn feed_gm_ticket(
+    script: Option<NonSendMut<UiScript>>,
+    state: Res<GmTicketState>,
+    categories: Option<Res<GmTicketCategories>>,
+    mut feed: ResMut<GmTicketFeedState>,
+) {
+    let Some(mut script) = script else {
+        return;
+    };
+    let fed = feed.vm.get(&script);
+
+    // The catalog is static client data — pushed once per VM, before any window can ask for it.
+    if !fed.categories_pushed {
+        if let Some(categories) = categories.as_deref() {
+            script.set_gm_ticket_categories(categories.0.clone());
+            fed.categories_pushed = true;
+        }
+    }
+
+    if fed.queue_answers != state.queue_answers {
+        fed.queue_answers = state.queue_answers;
+        // arg1 is the queue status as a NUMBER: the window tests `arg1 == 1` for "up" and
+        // `arg1 == -1` for "down, and say so". vmangos only ever sends 0 or 1, so the -1 arm — the
+        // one that pops HELP_TICKET_QUEUE_DISABLED unprompted — is unreachable against this
+        // server. Passed through unchanged rather than remapped: inventing a -1 would put a dialog
+        // on screen that the server never asked for.
+        script.fire_event(
+            "UPDATE_GM_STATUS",
+            vec![ScriptValue::Int(i64::from(state.queue_status))],
+        );
+    }
+
+    if fed.answers != state.answers {
+        fed.answers = state.answers;
+        script.fire_event("UPDATE_TICKET", update_ticket_args(state.ticket.as_deref()));
+    }
+}
+
+/// `UPDATE_TICKET`'s argument list — **the reorder** the module doc explains.
+///
+/// With a ticket: category, text, then the three day-floats, then the two status bytes. Without
+/// one: a single `0`, because `HelpFrameOpenTicket_OnEvent` gates its whole "you have a ticket"
+/// branch on `arg1 and arg1 ~= 0` and `TicketStatusFrame_OnEvent` on `arg1 ~= 0`.
+fn update_ticket_args(ticket: Option<&benilla_protocol::messages::GmTicket>) -> Vec<ScriptValue> {
+    let Some(t) = ticket else {
+        return vec![ScriptValue::Int(0)];
+    };
+    vec![
+        ScriptValue::Int(i64::from(t.category)),
+        ScriptValue::Str(t.text.clone()),
+        // Days, as f64 — and deliberately unclamped: a negative arg4/arg5 is the server saying
+        // "I don't know", which the window renders as GM_TICKET_UNAVAILABLE. Clamping to 0 here
+        // would turn "unavailable" into a confident wait estimate of zero.
+        ScriptValue::Number(f64::from(t.ticket_age)),
+        ScriptValue::Number(f64::from(t.oldest_ticket_age)),
+        ScriptValue::Number(f64::from(t.update_time)),
+        ScriptValue::Int(i64::from(t.assigned_to_gm)),
+        ScriptValue::Int(i64::from(t.opened_by_gm)),
+    ]
+}
+
+/// Turn the window's clicks into packets.
+fn drain_gm_ticket(
+    script: Option<NonSendMut<UiScript>>,
+    mut reask: ResMut<GmTicketState>,
+    commands: Res<NetCommands>,
+    player: Option<Res<Player>>,
+    map: Option<Res<benilla_world::world_map::CurrentMap>>,
+) {
+    let Some(mut script) = script else {
+        return;
+    };
+
+    // The engine's own re-asks first: they answer a server push that arrived before this frame's
+    // input ran, so they precede anything the player typed into it.
+    for _ in 0..reask.take_reasks() {
+        let _ = commands.0.send(ClientCommand::GmTicketGet);
+    }
+
+    for _ in 0..script.take_stuck_casts() {
+        let _ = commands.0.send(ClientCommand::CastSpell {
+            spell_id: SPELL_STUCK,
+            target: None,
+        });
+    }
+
+    let intents = script.take_gm_ticket_intents();
+    if intents.is_empty() {
+        return;
+    }
+    // The position is stamped at SEND time, not at window-open time: a ticket says where you are
+    // when you file it, which is what makes `.ticket go` land on the problem. Raw WoW coords —
+    // the wire never sees Bevy's basis. Resolved once for the whole batch: every intent in it was
+    // raised in the same frame, so they cannot honestly disagree about where the player stands.
+    let pos = player.map(|p| bevy_to_wow(p.pos)).unwrap_or([0.0; 3]);
+    let map = map.map(|m| m.0).unwrap_or(0);
+    // **In call order.** A per-verb drain would reorder `DeleteGMTicket(); GetGMTicket()` into
+    // get-then-delete, and the get would answer with the pre-delete state.
+    for intent in intents {
+        let _ = commands.0.send(match intent {
+            GmTicketIntent::Ask => ClientCommand::GmTicketGet,
+            GmTicketIntent::AskStatus => ClientCommand::GmTicketSystemStatus,
+            GmTicketIntent::Delete => ClientCommand::GmTicketDelete,
+            GmTicketIntent::Write(write) => {
+                let category = write.category;
+                match client_command_for(write, map, pos) {
+                    Some(cmd) => cmd,
+                    None => {
+                        warn!(
+                            "gm ticket: refusing to file under category {category} — not a \
+                             GMTicketCategory.dbc id (1..={GM_TICKET_CATEGORY_MAX})"
+                        );
+                        continue;
+                    }
+                }
+            }
+        });
+    }
+}
+
+/// One drained write → its packet, or `None` for a category that cannot be filed.
+///
+/// Split out so the verb choice is testable without a world: **the window's own `hasTicket` flag
+/// picks the opcode**, and we must not re-derive it from whether we believe a ticket exists — our
+/// belief can be stale by up to the 10-minute poll.
+///
+/// **The range check is not defensive tidiness — it is the only thing between a bad argument and a
+/// silently misfiled ticket.** The category rides the wire as one byte, and vmangos's whole
+/// validation is `if (packet.ticketType >= GMTICKET_MAX) return;` with `GMTICKET_MAX == 11`
+/// (`GMTicketHandler.cpp:112`; the enum starts at `GMTICKET_STUCK = 1`, `SharedDefines.h:1776`).
+/// So 11 and up are dropped by the server — but **0 is not**: it passes that check and is stored as
+/// `ticket_type = 0`, a heading `GetTicketCategoryName` cannot name. Truncating a nonsense argument
+/// into a `u8` lands exactly there, and a category of 256 truncates to 0 as well. No shipped UI
+/// path can produce one (the buttons carry `GMTicketCategory.dbc` ids, 1..10), so this guards a
+/// third-party addon's argument — and it refuses loudly rather than filing a ticket no GM can
+/// categorise.
+fn client_command_for(write: GmTicketWrite, map: u32, pos: [f32; 3]) -> Option<ClientCommand> {
+    let category = u8::try_from(write.category)
+        .ok()
+        .filter(|c| (1..=GM_TICKET_CATEGORY_MAX).contains(c))?;
+    Some(if write.is_new {
+        ClientCommand::GmTicketCreate {
+            category,
+            map,
+            pos,
+            text: write.text,
+        }
+    } else {
+        ClientCommand::GmTicketUpdate {
+            category,
+            text: write.text,
+        }
+    })
+}
+
+/// The highest category the server will file — `GMTICKET_MAX - 1`, and also the last row of
+/// `GMTicketCategory.dbc`. The two agree, which is why one constant serves both.
+const GM_TICKET_CATEGORY_MAX: u8 = 10;
+
+/// `GMTicketCategory.dbc`, loaded once — the ten rows `GetGMTicketCategories()` returns, already
+/// flattened to the `(id, name)` pairs the binding hands Lua.
+#[derive(Resource)]
+pub(crate) struct GmTicketCategories(pub(crate) Vec<(u32, String)>);
+
+/// Startup (after the MPQ chain opens): the ticket-category catalog.
+///
+/// Ordered `.after(AssetSet::Open)` for the reason `ui_items`' loader records — a bare `Startup`
+/// slot races the chain open and, when it wins, silently leaves the resource absent for the whole
+/// session. Absent here means the "page a GM" list paints no rows, which is a quiet and confusing
+/// failure, so the ordering matters more than the warn line does.
+fn load_gm_ticket_dbc(
+    mut commands: Commands,
+    world_assets: Option<Res<benilla_assets::WorldAssets>>,
+) {
+    use benilla_assets::LockRecover;
+    let Some(world_assets) = world_assets else {
+        return;
+    };
+    let mut chain = world_assets.chain.lock_recover();
+    match benilla_formats::load_gm_ticket_categories(&mut chain) {
+        Ok(cat) => {
+            info!(
+                "gm ticket: GMTicketCategory.dbc loaded ({} categories)",
+                cat.len()
+            );
+            commands.insert_resource(GmTicketCategories(
+                cat.categories()
+                    .iter()
+                    .map(|c| (c.id, c.name.clone()))
+                    .collect(),
+            ));
+        }
+        Err(e) => warn!("gm ticket: GMTicketCategory.dbc failed to load: {e:#}"),
+    }
+}
+
+/// The net drain's arms, beside the state they drive.
+pub(crate) mod apply {
+    use bevy::prelude::*;
+
+    /// `SMSG_GMTICKET_CREATE` (2 = created) and `SMSG_GMTICKET_UPDATETEXT` (4 = saved) — the two
+    /// codes the reference engine answers by **re-asking for the ticket**, at `0x5e4479`.
+    ///
+    /// The shipped FrameXML registers no handler for either opcode, and that is not a gap: the
+    /// engine turns the success code straight into a `CMSG_GMTICKET_GETTICKET`, whose answer fires
+    /// the `UPDATE_TICKET` the window *does* listen for. So this arm is the whole reason filing a
+    /// ticket updates the screen at all.
+    ///
+    /// Every other code is logged and nothing else. The reference surfaces the `ERR_TICKET_*`
+    /// GlobalStrings on the failures; which string rides which code, and through which display
+    /// path, is not yet pinned, and a guess here would put wrong words on screen.
+    pub(crate) fn write_response(
+        what: &str,
+        response: u32,
+        success: u32,
+        ticket: &mut super::GmTicketState,
+    ) {
+        if response == success {
+            debug!("gm ticket: {what} landed ({response}) — re-asking for the ticket");
+            ticket.note_write_landed();
+        } else {
+            debug!("gm ticket: {what} answered {response}");
+        }
+    }
+
+    /// `SMSG_GM_TICKET_STATUS_UPDATE` — a GM touched the ticket.
+    ///
+    /// **1 (updated) re-asks**, which is the reference's `0x5e7932` leg and the third of the three
+    /// `CMSG_GMTICKET_GETTICKET` callers. 2 (closed) and 3 (a survey is offered) are logged: the
+    /// close will arrive as an ordinary `UPDATE_TICKET` on the next poll either way, and the survey
+    /// window is deferred (module doc), so acting on 3 would mean promising a panel that does not
+    /// exist.
+    pub(crate) fn status_update(status: u32, ticket: &mut super::GmTicketState) {
+        match status {
+            1 => {
+                debug!("gm ticket: a GM updated the ticket — re-asking");
+                ticket.note_write_landed();
+            }
+            2 => debug!("gm ticket: a GM closed the ticket"),
+            3 => {
+                debug!("gm ticket: a GM survey was offered — the survey window is deferred (1673)")
+            }
+            other => debug!("gm ticket: unknown status update {other}"),
+        }
+    }
+
+    /// `SMSG_GMTICKET_DELETETICKET` — logged only. The reference has no re-ask leg here (its
+    /// `0x5e4479` arm covers create and update alone), and the abandon path's own `GetGMTicket()`
+    /// is the Lua dialog's, not the engine's.
+    pub(crate) fn response(what: &str, response: u32) {
+        debug!("gm ticket: {what} answered {response}");
+    }
+}
+
+/// The GM trouble-ticket flow: the answer feed and the window's sends.
+pub(crate) struct UiGmTicketPlugin;
+
+impl Plugin for UiGmTicketPlugin {
+    fn build(&self, app: &mut App) {
+        app.init_resource::<GmTicketState>()
+            .init_resource::<GmTicketFeedState>()
+            .add_systems(
+                Startup,
+                load_gm_ticket_dbc.after(benilla_assets::AssetSet::Open),
+            )
+            .add_systems(
+                Update,
+                (
+                    feed_gm_ticket.before(UiInput),
+                    drain_gm_ticket.after(UiInput),
+                ),
+            );
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use benilla_protocol::messages::GmTicket;
+
+    fn ticket() -> Box<GmTicket> {
+        Box::new(GmTicket {
+            text: "Stuck in a rock.".into(),
+            category: 1,
+            ticket_age: 0.25,
+            oldest_ticket_age: 2.5,
+            update_time: 0.01,
+            assigned_to_gm: 2,
+            opened_by_gm: 1,
+        })
+    }
+
+    /// The reorder, pinned: the event leads with the CATEGORY, the packet leads with the TEXT.
+    /// This test is the guard on someone "simplifying" the two into agreement.
+    #[test]
+    fn the_event_args_lead_with_the_category_not_the_text() {
+        let t = ticket();
+        let args = update_ticket_args(Some(&t));
+        assert_eq!(args[0], ScriptValue::Int(1), "arg1 is the category");
+        assert_eq!(
+            args[1],
+            ScriptValue::Str("Stuck in a rock.".into()),
+            "arg2 is the description"
+        );
+        assert_eq!(args.len(), 7, "arg1..arg7, the shipped window's whole read");
+        assert_eq!(args[5], ScriptValue::Int(2), "arg6 assignedToGM");
+        assert_eq!(args[6], ScriptValue::Int(1), "arg7 openedByGM");
+    }
+
+    /// "No ticket" is ONE argument and it is zero — the window's entire else-branch hangs on
+    /// `arg1 and arg1 ~= 0`, so an empty arg list or a nil here would leave the Submit button
+    /// reading "Save Changes" forever.
+    #[test]
+    fn the_no_ticket_answer_is_a_single_zero() {
+        assert_eq!(update_ticket_args(None), vec![ScriptValue::Int(0)]);
+    }
+
+    /// A negative wait figure survives to Lua unclamped: it is the server saying "unavailable",
+    /// and the window has a branch for exactly that (`arg4 < 0 or arg5 < 0`).
+    #[test]
+    fn an_unknown_wait_time_reaches_lua_as_a_negative_not_a_zero() {
+        let mut t = ticket();
+        t.oldest_ticket_age = -1.0;
+        t.update_time = -1.0;
+        let args = update_ticket_args(Some(&t));
+        assert_eq!(args[3], ScriptValue::Number(-1.0));
+        assert_eq!(args[4], ScriptValue::Number(-1.0));
+    }
+
+    /// An unchanged answer is still an answer. This is the whole reason the state carries a
+    /// counter: the window polls every 10 minutes and must be re-fed each time, so a second
+    /// identical `SMSG_GMTICKET_GETTICKET` has to move the ticket that the feed diffs on.
+    #[test]
+    fn a_repeated_identical_answer_still_counts_as_an_answer() {
+        let mut state = GmTicketState::default();
+        state.answer(Some(ticket()));
+        let first = state.answers;
+        state.answer(Some(ticket()));
+        assert_ne!(state.answers, first, "the poll must re-fire UPDATE_TICKET");
+
+        // And so does a repeated *empty* one — "still no ticket" is the common case.
+        state.answer(None);
+        let empty = state.answers;
+        state.answer(None);
+        assert_ne!(state.answers, empty);
+    }
+
+    /// **The engine re-asks after a write lands** — the reference's `0x5e4479` arm, and the reason
+    /// the shipped UI needs no handler for `SMSG_GMTICKET_CREATE`/`UPDATETEXT` at all. Without this
+    /// a filed ticket is invisible until the 10-minute poll: the toast stays dark and the form
+    /// stays a form. The failure codes must NOT re-ask — there is nothing new to fetch.
+    #[test]
+    fn a_landed_write_makes_the_engine_reask_and_a_refused_one_does_not() {
+        let mut state = GmTicketState::default();
+        apply::write_response("create", 2, 2, &mut state);
+        apply::write_response("update", 4, 4, &mut state);
+        assert_eq!(state.take_reasks(), 2, "one re-ask per landed write");
+        assert_eq!(state.take_reasks(), 0, "drained means drained");
+
+        apply::write_response("create", 3, 2, &mut state); // CREATE_ERROR
+        apply::write_response("update", 5, 4, &mut state); // UPDATE_ERROR
+        assert_eq!(state.take_reasks(), 0, "a refusal has nothing to fetch");
+    }
+
+    /// The queue status reaches Lua **signed**. `-1` is the value the window branches on to raise
+    /// "GM Help Tickets are currently unavailable"; read unsigned it would arrive as 4294967295 and
+    /// that arm could never fire. vmangos only sends 0 or 1, so no live run would catch this.
+    #[test]
+    fn a_minus_one_queue_status_survives_to_lua_as_minus_one() {
+        let mut state = GmTicketState::default();
+        state.answer_queue(-1);
+        assert_eq!(state.queue_status, -1);
+        assert_eq!(i64::from(state.queue_status), -1_i64);
+    }
+
+    /// The socket dying resets both counters and the ticket, so a reconnect cannot show the
+    /// previous session's ticket while the first poll is in flight.
+    #[test]
+    fn a_dead_session_forgets_the_ticket_and_both_answer_counts() {
+        let mut state = GmTicketState::default();
+        state.answer(Some(ticket()));
+        state.answer_queue(1);
+        state.clear_session();
+        assert!(state.ticket.is_none());
+        assert_eq!(state.answers, 0);
+        assert_eq!(state.queue_answers, 0);
+    }
+
+    /// The window's own verb choice picks the opcode — never our belief about whether a ticket
+    /// exists, which can be up to ten minutes stale.
+    #[test]
+    fn the_windows_verb_picks_the_opcode() {
+        let write = |category, is_new| GmTicketWrite {
+            category,
+            text: "gone".into(),
+            is_new,
+        };
+        assert!(matches!(
+            client_command_for(write(4, true), 1, [1.0, 2.0, 3.0]),
+            Some(ClientCommand::GmTicketCreate {
+                category: 4,
+                map: 1,
+                ..
+            })
+        ));
+        assert!(matches!(
+            client_command_for(write(4, false), 1, [1.0, 2.0, 3.0]),
+            Some(ClientCommand::GmTicketUpdate { category: 4, .. })
+        ));
+    }
+
+    /// A category the server cannot file is refused here rather than sent.
+    ///
+    /// **0 is the one that matters**, and it is the one a naive truncation produces: vmangos only
+    /// rejects `>= 11`, so a zero passes its check and is stored as an unnameable
+    /// `ticket_type = 0` — a ticket filed under nothing, with no error anywhere. 256 truncates to
+    /// 0 in a `u8` and would land in the same place.
+    #[test]
+    fn a_category_the_server_cannot_file_is_refused_rather_than_sent() {
+        let write = |category| GmTicketWrite {
+            category,
+            text: "x".into(),
+            is_new: true,
+        };
+        for bad in [0, 11, 256, 99_999] {
+            assert!(
+                client_command_for(write(bad), 1, [0.0; 3]).is_none(),
+                "category {bad} must not reach the wire"
+            );
+        }
+        for good in 1..=10 {
+            assert!(client_command_for(write(good), 1, [0.0; 3]).is_some());
+        }
+    }
+}
diff --git a/crates/benilla-app/src/ui_script/help_frame_tests.rs b/crates/benilla-app/src/ui_script/help_frame_tests.rs
new file mode 100644
index 00000000..63600063
--- /dev/null
+++ b/crates/benilla-app/src/ui_script/help_frame_tests.rs
@@ -0,0 +1,400 @@
+//! The GM help window (decision 1673, HelpFrame.xml): the category list the DBC feeds it, the two
+//! faces of `UPDATE_TICKET`, the queue gate, the ticket toast, and the three dialogs.
+//!
+//! Written as the **falsification** pass over the transcription rather than a demonstration of it:
+//! every test is named after one claim the window makes, and each was checked to fail when the
+//! claim is broken. The load-bearing one is
+//! [`clicking_a_category_files_a_ticket_under_that_categorys_dbc_id`] — the id travels from
+//! `GMTicketCategory.dbc` through a button, a page, and the editor onto the wire, and a break
+//! anywhere in that chain files every ticket under the wrong heading with nothing on screen to
+//! show for it.
+
+use benilla_ui::script::{GmTicketIntent, GmTicketWrite, ScriptValue, UiScript};
+
+/// Load one shipped `assets/ui/<file>` into `s`, panicking on any loader error (the binder tests'
+/// loader, duplicated so this file is self-contained).
+fn load_xml(s: &UiScript, file: &str) -> usize {
+    let text = std::fs::read_to_string(
+        std::path::Path::new(env!("CARGO_MANIFEST_DIR"))
+            .join("assets/ui")
+            .join(file),
+    )
+    .unwrap();
+    let doc = benilla_ui::framexml::parse(&text).unwrap();
+    let report = benilla_ui::loader::load(s, &doc, &|_| None);
+    assert!(
+        report.errors.is_empty(),
+        "{file}: loader errors: {:?}",
+        report.errors
+    );
+    report.frames
+}
+
+/// The window, its dependencies, and the catalog the app pushes — the real ten `GMTicketCategory`
+/// rows, so a test that walks the list is walking the shipped data.
+fn setup() -> UiScript {
+    let mut s = UiScript::new().unwrap();
+    s.set_screen_size(1024.0, 768.0);
+    for file in [
+        "Fonts.xml",
+        "BasicControls.xml",
+        "UIPanelTemplates.xml",
+        "ScrollTemplates.xml",
+        "GameTooltip.xml",
+        // Before UiPanels.xml: the shared StaticPopup carries a `SmallMoneyFrameTemplate` coin
+        // row, whose OnLoad calls `SmallMoneyFrame_OnLoad` — the TOC's own order (1580's
+        // talent-wipe fixture hit this first).
+        "MoneyFrame.xml",
+        "UiPanels.xml",
+        "HelpFrame.xml",
+    ] {
+        load_xml(&s, file);
+    }
+    s.set_gm_ticket_categories(vec![
+        (1, "Stuck".into()),
+        (2, "Behavior/Harassment".into()),
+        (3, "Guild".into()),
+        (4, "Item".into()),
+        (5, "Environmental".into()),
+        (6, "Non-Quest/Creep".into()),
+        (7, "Quest/Quest NPC".into()),
+        (8, "Technical".into()),
+        (9, "Account/Billing".into()),
+        (10, "Character".into()),
+    ]);
+    s
+}
+
+/// The `UPDATE_TICKET` argument list the app's feed builds for an open ticket — category first,
+/// text second, exactly as `ui_gm_ticket::update_ticket_args` orders it. Kept in sync by being
+/// written the same way in both places; if they ever disagree, this file's tests are what notices.
+fn open_ticket_args(
+    category: i64,
+    text: &str,
+    age: f64,
+    oldest: f64,
+    update: f64,
+) -> Vec<ScriptValue> {
+    vec![
+        ScriptValue::Int(category),
+        ScriptValue::Str(text.into()),
+        ScriptValue::Number(age),
+        ScriptValue::Number(oldest),
+        ScriptValue::Number(update),
+        ScriptValue::Int(0),
+        ScriptValue::Int(0),
+    ]
+}
+
+/// **The whole point of the feature, end to end.** The category id travels
+/// `GMTicketCategory.dbc` → `GetGMTicketCategories()` → a `HelpFrameButton*` → the page route →
+/// `HelpFrameOpenTicket.ticketType` → `NewGMTicket`'s wire value. Break any link and every ticket
+/// files under the wrong heading, silently — nothing on screen looks wrong.
+#[test]
+fn clicking_a_category_files_a_ticket_under_that_categorys_dbc_id() {
+    let mut s = setup();
+    s.run("ShowUIPanel(HelpFrame) HelpFrame_ShowFrame(\"GMHome\")")
+        .unwrap();
+    // Opening the window is itself traffic: its OnShow calls `GetGMStatus()`. Drained here so the
+    // assertion below is about the CLICK and nothing else — the intents are one ordered queue, so
+    // setup traffic and the thing under test share it (decision 1673).
+    let _ = s.take_gm_ticket_intents();
+
+    // Row 4 is Item, DBC id 4 — the row's LABEL and its stored id must be the same pair.
+    assert_eq!(
+        s.eval::<String>("return HelpFrameButton4Text:GetText()")
+            .unwrap(),
+        "Item"
+    );
+    assert_eq!(
+        s.eval::<i64>("return HelpFrameButton4.ticketType").unwrap(),
+        4,
+        "the button carries the DBC id, not its row number"
+    );
+
+    // Click it, take the page's action button through to the editor, and submit.
+    s.run("HelpFrameButton4:Click()").unwrap();
+    s.run("HelpFrameGeneralButton_OnClick(HelpFrameGeneralButton)")
+        .unwrap();
+    s.run("HelpFrameOpenTicketText:SetText(\"My sword vanished.\")")
+        .unwrap();
+    s.run("HelpFrameOpenTicketSubmit_OnClick()").unwrap();
+
+    assert_eq!(
+        s.take_gm_ticket_intents(),
+        vec![GmTicketIntent::Write(GmTicketWrite {
+            category: 4,
+            text: "My sword vanished.".into(),
+            is_new: true,
+        })],
+        "the clicked category's DBC id is what goes on the wire"
+    );
+}
+
+/// The ten shipped rows paint in DBC order, and row 2 routes to its OWN page rather than the
+/// shared one — the single category in the table with a bespoke frame.
+#[test]
+fn the_ten_categories_paint_in_dbc_order_and_harassment_has_its_own_page() {
+    let s = setup();
+    s.run("ShowUIPanel(HelpFrame) HelpFrame_ShowFrame(\"GMHome\")")
+        .unwrap();
+    assert_eq!(
+        s.eval::<String>("return HelpFrameButton1Text:GetText()")
+            .unwrap(),
+        "Stuck"
+    );
+    assert_eq!(
+        s.eval::<String>("return HelpFrameButton10Text:GetText()")
+            .unwrap(),
+        "Character",
+        "all ten rows fit without scrolling"
+    );
+
+    s.run("HelpFrameButton2:Click()").unwrap();
+    assert!(
+        s.eval::<bool>("return HelpFrameHarassment:IsVisible()")
+            .unwrap(),
+        "category 2 routes to HelpFrameHarassment"
+    );
+    s.run("HelpFrameButton3:Click()").unwrap();
+    assert!(
+        s.eval::<bool>("return HelpFrameGeneral:IsVisible()")
+            .unwrap(),
+        "category 3 routes to the shared general page"
+    );
+    assert!(
+        !s.eval::<bool>("return HelpFrameHarassment:IsVisible()")
+            .unwrap(),
+        "and the previous page is hidden — one page at a time"
+    );
+}
+
+/// **`UPDATE_TICKET`'s two faces.** With a ticket the editor becomes an editor (Save Changes /
+/// Exit); with the bare `arg1 = 0` it goes back to being a form (Submit / Cancel). The zero leg is
+/// the one that would silently rot: it is the ordinary answer, so a window stuck in edit mode
+/// looks fine until you try to file a second ticket.
+#[test]
+fn an_open_ticket_turns_the_form_into_an_editor_and_a_zero_turns_it_back() {
+    let mut s = setup();
+    s.run("ShowUIPanel(HelpFrame) HelpFrame_ShowFrame(\"OpenTicket\")")
+        .unwrap();
+
+    s.fire_event(
+        "UPDATE_TICKET",
+        open_ticket_args(7, "Where is this NPC?", 0.25, 2.5, 0.01),
+    );
+    assert_eq!(
+        s.eval::<String>("return HelpFrameOpenTicketText:GetText()")
+            .unwrap(),
+        "Where is this NPC?",
+        "arg2 is the description"
+    );
+    assert_eq!(
+        s.eval::<i64>("return HelpFrameOpenTicket.ticketType")
+            .unwrap(),
+        7,
+        "arg1 is the category"
+    );
+    assert_eq!(
+        s.eval::<i64>("return HelpFrameOpenTicket.hasTicket")
+            .unwrap(),
+        1
+    );
+
+    // And now the ordinary answer.
+    s.fire_event("UPDATE_TICKET", vec![ScriptValue::Int(0)]);
+    assert_eq!(
+        s.eval::<String>("return HelpFrameOpenTicketText:GetText()")
+            .unwrap(),
+        "",
+        "the editor empties"
+    );
+    assert!(
+        s.eval::<bool>("return HelpFrameOpenTicket.hasTicket == nil")
+            .unwrap(),
+        "and stops believing it has a ticket"
+    );
+}
+
+/// The Submit button picks its verb from the window's own `hasTicket`, which is what the app must
+/// not second-guess: an edit after an answer is an UPDATE, a submit before one is a CREATE.
+#[test]
+fn submit_sends_create_before_an_answer_and_update_after_one() {
+    let mut s = setup();
+    s.run("ShowUIPanel(HelpFrame) HelpFrame_ShowFrame(\"OpenTicket\")")
+        .unwrap();
+    let _ = s.take_gm_ticket_intents(); // the OnShow GetGMStatus — see the category test
+    s.run("HelpFrameOpenTicket.ticketType = 3 HelpFrameOpenTicketText:SetText(\"a\")")
+        .unwrap();
+    s.run("HelpFrameOpenTicketSubmit_OnClick()").unwrap();
+    assert!(
+        matches!(
+            s.take_gm_ticket_intents().as_slice(),
+            [GmTicketIntent::Write(w)] if w.is_new
+        ),
+        "no ticket known yet — this is a create"
+    );
+
+    s.fire_event("UPDATE_TICKET", open_ticket_args(3, "a", 0.1, 0.2, 0.01));
+    s.run("HelpFrameOpenTicketText:SetText(\"a, still\")")
+        .unwrap();
+    s.run("HelpFrameOpenTicketSubmit_OnClick()").unwrap();
+    let intents = s.take_gm_ticket_intents();
+    let [GmTicketIntent::Write(write)] = intents.as_slice() else {
+        panic!("expected exactly one write, got {intents:?}");
+    };
+    assert!(!write.is_new, "a ticket is known — this is an update");
+    assert_eq!(write.text, "a, still");
+}
+
+/// **The queue gate.** `UPDATE_GM_STATUS(0)` takes the petition queue down, and asking for the
+/// editor then closes the window and says why instead of showing a form that cannot submit.
+/// The `1` leg must put it back — a one-way gate would lock the player out for the session.
+#[test]
+fn a_downed_queue_refuses_the_editor_and_says_so_and_comes_back_up() {
+    let mut s = setup();
+    s.fire_event("UPDATE_GM_STATUS", vec![ScriptValue::Int(0)]);
+    s.run("ShowUIPanel(HelpFrame) HelpFrame_ShowFrame(\"OpenTicket\")")
+        .unwrap();
+    assert!(
+        !s.eval::<bool>("return HelpFrame:IsVisible()").unwrap(),
+        "the window closes"
+    );
+    assert!(
+        s.eval::<bool>("return StaticPopup_Visible(\"HELP_TICKET_QUEUE_DISABLED\") ~= nil")
+            .unwrap(),
+        "and the dialog says why"
+    );
+
+    s.fire_event("UPDATE_GM_STATUS", vec![ScriptValue::Int(1)]);
+    s.run("ShowUIPanel(HelpFrame) HelpFrame_ShowFrame(\"OpenTicket\")")
+        .unwrap();
+    assert!(
+        s.eval::<bool>("return HelpFrameOpenTicket:IsVisible()")
+            .unwrap(),
+        "queue back up, editor opens"
+    );
+}
+
+/// The toast follows the ticket: up while one is open, gone when it is not. It is the only thing
+/// on screen that says a ticket exists at all once the window is closed.
+#[test]
+fn the_ticket_toast_follows_the_ticket() {
+    let mut s = setup();
+    s.fire_event(
+        "UPDATE_TICKET",
+        open_ticket_args(1, "Stuck.", 0.1, 0.2, 0.01),
+    );
+    assert!(
+        s.eval::<bool>("return TicketStatusFrame:IsVisible()")
+            .unwrap(),
+        "a ticket raises the toast"
+    );
+    s.fire_event("UPDATE_TICKET", vec![ScriptValue::Int(0)]);
+    assert!(
+        !s.eval::<bool>("return TicketStatusFrame:IsVisible()")
+            .unwrap(),
+        "and abandoning it takes the toast away"
+    );
+}
+
+/// The toast's own poll is what keeps a long wait honest: `TicketStatus_OnUpdate` re-asks the
+/// server every `GMTICKET_CHECK_INTERVAL`, and not before. This is the reason the app counts
+/// answers instead of diffing them, so it is worth a test on this side too.
+#[test]
+fn the_toast_repolls_the_server_only_after_the_full_interval() {
+    let mut s = setup();
+    s.fire_event(
+        "UPDATE_TICKET",
+        open_ticket_args(1, "Stuck.", 0.1, 0.2, 0.01),
+    );
+    let _ = s.take_gm_ticket_intents();
+
+    s.run("TicketStatus_OnUpdate(599)").unwrap();
+    assert!(s.take_gm_ticket_intents().is_empty(), "not yet");
+    s.run("TicketStatus_OnUpdate(2)").unwrap();
+    assert_eq!(
+        s.take_gm_ticket_intents(),
+        vec![GmTicketIntent::Ask],
+        "600s elapsed — re-ask"
+    );
+    s.run("TicketStatus_OnUpdate(1)").unwrap();
+    assert!(
+        s.take_gm_ticket_intents().is_empty(),
+        "and the clock restarts"
+    );
+}
+
+/// Abandoning goes through a confirm, and only its Yes sends the delete. A dialog whose Yes did
+/// nothing would look identical to one that worked, right up until the ticket reappeared.
+#[test]
+fn abandoning_a_ticket_confirms_first_and_only_yes_sends_it() {
+    let mut s = setup();
+    s.run("StaticPopup_Show(\"HELP_TICKET_ABANDON_CONFIRM\")")
+        .unwrap();
+    s.run("StaticPopup_OnClick(StaticPopup1, 2)").unwrap();
+    assert!(s.take_gm_ticket_intents().is_empty(), "No sends nothing");
+
+    s.run("StaticPopup_Show(\"HELP_TICKET_ABANDON_CONFIRM\")")
+        .unwrap();
+    s.run("StaticPopup_OnClick(StaticPopup1, 1)").unwrap();
+    assert_eq!(s.take_gm_ticket_intents(), vec![GmTicketIntent::Delete]);
+}
+
+/// `ToggleHelpFrame` is the micro button's whole wiring, and opening the window asks the server
+/// for the queue status — without that ask the gate above would run on a stale assumption for the
+/// life of the session.
+#[test]
+fn toggling_the_window_opens_it_and_asks_for_the_queue_status() {
+    let mut s = setup();
+    s.run("ToggleHelpFrame()").unwrap();
+    assert!(s.eval::<bool>("return HelpFrame:IsVisible()").unwrap());
+    assert_eq!(
+        s.take_gm_ticket_intents(),
+        vec![GmTicketIntent::AskStatus],
+        "OnShow calls GetGMStatus — the gate must not run on an assumption"
+    );
+    // This is the one test that asserts the OnShow traffic itself; the others drain it away first.
+    assert!(
+        s.eval::<bool>("return HelpFrameHome:IsVisible()").unwrap(),
+        "and it opens on Home"
+    );
+
+    s.run("ToggleHelpFrame()").unwrap();
+    assert!(!s.eval::<bool>("return HelpFrame:IsVisible()").unwrap());
+}
+
+/// The Auto-Unstuck button casts the Stuck spell and closes the window. It is the one control in
+/// this window that does something other than talk about tickets.
+#[test]
+fn auto_unstuck_casts_and_closes() {
+    let mut s = setup();
+    s.run("ShowUIPanel(HelpFrame) HelpFrame_ShowFrame(1)")
+        .unwrap();
+    s.run("HelpFrameUnstick_OnClick()").unwrap();
+    assert_eq!(s.take_stuck_casts(), 1);
+    assert!(!s.eval::<bool>("return HelpFrame:IsVisible()").unwrap());
+}
+
+/// **The geometry oracle** (decision 0675): every element the transcription shares with the
+/// reference file carries the reference's own `<AbsDimension>` numbers.
+///
+/// **Verified to fail**, as 0675 requires: nudging `TicketStatusFrame`'s width 208 → 209 makes it
+/// report `TicketStatusFrame: ours [(209.0, 52.0), …] != ref [(208.0, 52.0), …]` and fail. It is a
+/// guard, not a comfort.
+#[test]
+fn the_windows_geometry_matches_the_reference_file() {
+    let Some(reference) = super::framexml_diff::reference("HelpFrame.xml") else {
+        return; // no install — this test is a no-op rather than a failure
+    };
+    /// Deliberate deviations, by REFERENCE name. Each earns its reason here; a tolerance would
+    /// let a real difference hide, so this is a list and stays a list.
+    const EXPECTED: &[&str] = &[
+        // The GM category list is the house FAUX scroll kit, not the reference's ScrollFrame, and
+        // the kit's shared trough replaces the three loose bar textures the reference hangs beside
+        // it (HelpFrame.xml's header, divergence 1). Same for the ticket editor's own trough.
+        "HelpFrameGMScrollFrame",
+        "HelpFrameOpenTicketScrollFrame",
+    ];
+    super::framexml_diff::assert_geometry_matches("HelpFrame.xml", &reference, EXPECTED, 60);
+}
diff --git a/crates/benilla-app/src/ui_script/mod.rs b/crates/benilla-app/src/ui_script/mod.rs
index 4ec17398..daf0bfe9 100644
--- a/crates/benilla-app/src/ui_script/mod.rs
+++ b/crates/benilla-app/src/ui_script/mod.rs
@@ -917,6 +917,12 @@ mod friends_tests;
 #[cfg(test)]
 mod guild_tests;
 
+/// The GM help window and its ticket toast (decision 1673). Its own module because every test in
+/// it pushes a `GMTicketCategory.dbc` catalog and drives the ticket wire's own event vocabulary,
+/// which none of the neighbouring windows share.
+#[cfg(test)]
+mod help_frame_tests;
+
 /// The social window's fourth tab — the raid pane and its grid (decision 1549). Its own module for
 /// `guild_tests`' reason: every test in it pushes a RAID roster first, which a file about the
 /// friends list must not be in the business of.
diff --git a/crates/benilla-formats/src/gm_ticket_category.rs b/crates/benilla-formats/src/gm_ticket_category.rs
new file mode 100644
index 00000000..429633eb
--- /dev/null
+++ b/crates/benilla-formats/src/gm_ticket_category.rs
@@ -0,0 +1,143 @@
+//! GMTicketCategory.dbc — the ten trouble-ticket categories the Help window's "page a GM" list is
+//! built from, and the id each one submits as (decision 1673).
+//!
+//! This table is the answer to a question the shipped FrameXML makes look unanswerable. Its
+//! `HelpFrameGM_UpdateCategories(GetGMTicketCategories())` consumes the binding's varargs as
+//! `(key, text)` PAIRS, and `HELPFRAME_FRAMES`/`GENERAL_HELPFRAME` are keyed `1..10` with ten
+//! distinct titles — yet `GlobalStrings.lua` ships only `TICKET_TYPE1..4` ("Game Play",
+//! "Harassment", "Stuck", "Bug"). Those four are not this list: they feed the OpenTicket
+//! *dropdown*, which has no frame in 1.12 and whose `OnShow` call is commented out. The category
+//! list is DBC data, and it lines up with `GENERAL_HELPFRAME`'s keys row for row:
+//!
+//! | id | name | the frame `HELPFRAME_FRAMES[id]` sends it to |
+//! |---|---|---|
+//! | 1 | Stuck | `HelpFrameGeneral`, configured by `GENERAL_HELPFRAME[1]` (`STUCK_OPTION`) |
+//! | 2 | Behavior/Harassment | `HelpFrameHarassment` |
+//! | 3 | Guild | `HelpFrameGeneral` (`HELPFRAME_GUILD_TITLE`) |
+//! | 4 | Item | `HelpFrameGeneral` (`HELPFRAME_ITEM_TITLE`) |
+//! | 5 | Environmental | `HelpFrameGeneral` (`HELPFRAME_ENVIRONMENTAL_TITLE`) |
+//! | 6 | Non-Quest/Creep | `HelpFrameGeneral` (`HELPFRAME_NONQUEST_TITLE`) |
+//! | 7 | Quest/Quest NPC | `HelpFrameGeneral` (`HELPFRAME_QUEST_TITLE`) |
+//! | 8 | Technical | `HelpFrameGeneral` (`HELPFRAME_TECHNICAL_TITLE`) |
+//! | 9 | Account/Billing | `HelpFrameGeneral` (`HELPFRAME_ACCOUNT_TITLE`) |
+//! | 10 | Character | `HelpFrameGeneral` (`HELPFRAME_CHARACTER_TITLE`) |
+//!
+//! **The id is the wire value**, not just a list index: the clicked button stores it as
+//! `HelpFrameOpenTicket.ticketType`, and that is what `NewGMTicket(category, text)` puts in
+//! `CMSG_GMTICKET_CREATE`'s category field. So a catalog that renumbered on load would file every
+//! ticket under the wrong heading, silently — which is why this is an ordered id-keyed read of the
+//! file rather than a `Vec` indexed from zero.
+//!
+//! Record layout (10 rows in the shipped 5875 file, verified by loading it): `ID@0`,
+//! `Name_Lang@1..8`, `NameFlags@9` — the same 8-locale + mask shape as [`crate::itembagfamily`].
+//! Ids are 1..10 contiguous here, but nothing downstream may assume that: the ordered pairs are
+//! what the binding pushes, and the id is what the wire carries.
+
+use anyhow::{Context, Result};
+use benilla_dbc::{FieldType, Schema, SchemaField};
+
+use crate::dbc::{parse, str_at, u32_at};
+use crate::Chain;
+
+const GM_TICKET_CATEGORY: &str = "DBFilesClient\\GMTicketCategory.dbc";
+
+/// GMTicketCategory.dbc, in file order — the order `GetGMTicketCategories()` pushes them in, which
+/// is the order the ten `HelpFrameButton*` rows are painted in.
+pub struct GmTicketCategoryCatalog {
+    categories: Vec<GmTicketCategory>,
+}
+
+/// One row: the wire category id and its localized display name.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct GmTicketCategory {
+    /// The id `CMSG_GMTICKET_CREATE` carries — see the module doc's warning about renumbering.
+    pub id: u32,
+    /// The button label, from the active locale's `Name_Lang` slot.
+    pub name: String,
+}
+
+impl GmTicketCategoryCatalog {
+    /// The rows, in file order.
+    pub fn categories(&self) -> &[GmTicketCategory] {
+        &self.categories
+    }
+
+    /// Row count, for the load log.
+    pub fn len(&self) -> usize {
+        self.categories.len()
+    }
+
+    pub fn is_empty(&self) -> bool {
+        self.categories.is_empty()
+    }
+}
+
+fn gm_ticket_category_schema() -> Schema {
+    let mut s = Schema::new("GMTicketCategory");
+    s.add_field(SchemaField::new("ID", FieldType::UInt32));
+    for i in 0..8 {
+        s.add_field(SchemaField::new(format!("Name{i}"), FieldType::String));
+    }
+    s.add_field(SchemaField::new("NameFlags", FieldType::UInt32));
+    s
+}
+
+/// Load GMTicketCategory.dbc from the patch chain.
+///
+/// A row whose name is empty is skipped rather than pushed blank: the Help window paints one
+/// button per returned pair and an unnamed button is a dead click, not a category. The shipped
+/// 5875 file has no such row — this is a guard on a locale slot, not a modelled branch.
+pub fn load_gm_ticket_categories(chain: &mut Chain) -> Result<GmTicketCategoryCatalog> {
+    let bytes = chain
+        .read_file(GM_TICKET_CATEGORY)
+        .with_context(|| format!("reading {GM_TICKET_CATEGORY}"))?;
+    let rs = parse(&bytes, gm_ticket_category_schema(), "GMTicketCategory")?;
+    let mut categories = Vec::with_capacity(rs.records().len());
+    for r in rs.records() {
+        let (Some(id), Some(name)) = (u32_at(r, 0), str_at(&rs, r, 1).filter(|n| !n.is_empty()))
+        else {
+            continue;
+        };
+        categories.push(GmTicketCategory { id, name });
+    }
+    Ok(GmTicketCategoryCatalog { categories })
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    /// The shipped 5875 table, read as data rather than assumed. Pins **both** halves that matter:
+    /// the ids (which go on the wire) and the order (which is the painted order), plus the row-for-
+    /// row correspondence with `GENERAL_HELPFRAME`'s ten keys that the module doc tabulates.
+    /// Skips without client data.
+    #[test]
+    fn the_shipped_categories_are_the_ten_help_window_rows_in_order() {
+        let data = crate::wow_data_or_skip!();
+        let mut chain = crate::open_chain(&data).expect("open chain");
+        let cat = load_gm_ticket_categories(&mut chain).expect("GMTicketCategory.dbc");
+
+        let rows: Vec<(u32, &str)> = cat
+            .categories()
+            .iter()
+            .map(|c| (c.id, c.name.as_str()))
+            .collect();
+        assert_eq!(
+            rows,
+            vec![
+                (1, "Stuck"),
+                (2, "Behavior/Harassment"),
+                (3, "Guild"),
+                (4, "Item"),
+                (5, "Environmental"),
+                (6, "Non-Quest/Creep"),
+                (7, "Quest/Quest NPC"),
+                (8, "Technical"),
+                (9, "Account/Billing"),
+                (10, "Character"),
+            ],
+            "the wire ids and the painted order both matter — see the module doc"
+        );
+        assert_eq!(cat.len(), 10, "the whole shipped table");
+    }
+}
diff --git a/crates/benilla-formats/src/lib.rs b/crates/benilla-formats/src/lib.rs
index 94ead16f..485a5b3d 100644
--- a/crates/benilla-formats/src/lib.rs
+++ b/crates/benilla-formats/src/lib.rs
@@ -46,6 +46,10 @@ mod macro_icons;
 pub use unit_blood::{load_blood_catalog, BloodCatalog};
 mod itemsets;
 pub use itemsets::{load_item_sets, ItemSetCatalog, ItemSetInfo};
+mod gm_ticket_category;
+pub use gm_ticket_category::{
+    load_gm_ticket_categories, GmTicketCategory, GmTicketCategoryCatalog,
+};
 mod itembagfamily;
 pub use itembagfamily::{load_item_bag_families, ItemBagFamilyCatalog};
 mod itemclass;
diff --git a/crates/benilla-protocol/src/events.rs b/crates/benilla-protocol/src/events.rs
index 1a681a79..6899e860 100644
--- a/crates/benilla-protocol/src/events.rs
+++ b/crates/benilla-protocol/src/events.rs
@@ -12,7 +12,7 @@
 use crate::messages::{
     ActionButton, AttackerState, AuctionBidderNotification, AuctionCommandTail, AuctionListEntry,
     AuctionOwnerNotification, ChannelNoticeTail, Character, CreateSpline, DamageShield,
-    EnvironmentalDamageLog, ExplorationXp, FriendEntry, FriendStatusUpdate, GossipOption,
+    EnvironmentalDamageLog, ExplorationXp, FriendEntry, FriendStatusUpdate, GmTicket, GossipOption,
     GroupLootInfo, GroupMemberEntry, GuildCommandResult, GuildEventNotice, GuildInfo,
     GuildQueryResponse, GuildRoster, InspectHonorStats, ItemInfo, ItemPushResult, JumpInfo,
     LevelUpInfo, LootAllPassed, LootItem, LootRoll, LootRollWon, LootStartRoll, MailListEntry,
@@ -372,6 +372,25 @@ pub enum SessionEvent {
     /// The player's hearthstone bind point (`SMSG_BINDPOINTUPDATE`): the AreaTable id the
     /// `$z` token names ("Returns you to <area>.").
     BindPoint { area: u32 },
+    /// The player's open GM ticket, or `None` for the ordinary "you have no ticket" answer
+    /// (`SMSG_GMTICKET_GETTICKET`; decision 1673). **Every one of these is an answer, including a
+    /// `None`** — the Help window re-polls every 10 minutes and must re-fire `UPDATE_TICKET` each
+    /// time even when nothing changed, so the consumer counts these rather than diffing them.
+    GmTicket { ticket: Option<Box<GmTicket>> },
+    /// The answer to filing a ticket (`SMSG_GMTICKET_CREATE`): 2 = created, 3 = refused,
+    /// 1 = one already exists (vmangos never sends 1 and sometimes sends nothing at all).
+    GmTicketCreated { response: u32 },
+    /// The answer to editing a ticket (`SMSG_GMTICKET_UPDATETEXT`): 4 = saved, 5 = refused.
+    GmTicketUpdated { response: u32 },
+    /// The answer to abandoning a ticket (`SMSG_GMTICKET_DELETETICKET`): 9 = deleted. Also arrives
+    /// unsolicited when a GM runs `.ticket delete`.
+    GmTicketDeleted { response: u32 },
+    /// Whether the petition queue is taking tickets (`SMSG_GMTICKETSYSTEMSTATUS`): 1 = yes.
+    /// Drives `UPDATE_GM_STATUS`, and through it the Help window's "page a GM" gate.
+    GmTicketSystemStatus { status: i32 },
+    /// A GM touched the ticket (`SMSG_GM_TICKET_STATUS_UPDATE`): 1 = updated, 2 = closed,
+    /// 3 = a survey is offered. vmangos never sends it; cmangos makes it the notification model.
+    GmTicketStatusUpdate { status: u32 },
     /// An innkeeper is asking whether to make this your home (`SMSG_BINDER_CONFIRM`) — the
     /// question the `CONFIRM_BINDER` dialog puts on screen. `binder` is the innkeeper's guid, and
     /// it must be echoed in `CMSG_BINDER_ACTIVATE` for the bind to happen at all (decision 1331).
diff --git a/crates/benilla-protocol/src/events/decode.rs b/crates/benilla-protocol/src/events/decode.rs
index afb42b79..a0c4c8e3 100644
--- a/crates/benilla-protocol/src/events/decode.rs
+++ b/crates/benilla-protocol/src/events/decode.rs
@@ -666,6 +666,22 @@ pub fn decode(packet: ServerPacket) -> Vec<SessionEvent> {
             vec![SessionEvent::ServerUnixTime { unix_time }]
         }
         ServerPacket::BindPoint { area, .. } => vec![SessionEvent::BindPoint { area }],
+        ServerPacket::GmTicketAnswer { ticket } => vec![SessionEvent::GmTicket { ticket }],
+        ServerPacket::GmTicketCreated { response } => {
+            vec![SessionEvent::GmTicketCreated { response }]
+        }
+        ServerPacket::GmTicketUpdated { response } => {
+            vec![SessionEvent::GmTicketUpdated { response }]
+        }
+        ServerPacket::GmTicketDeleted { response } => {
+            vec![SessionEvent::GmTicketDeleted { response }]
+        }
+        ServerPacket::GmTicketSystemStatus { status } => {
+            vec![SessionEvent::GmTicketSystemStatus { status }]
+        }
+        ServerPacket::GmTicketStatusUpdate { status } => {
+            vec![SessionEvent::GmTicketStatusUpdate { status }]
+        }
         ServerPacket::BinderConfirm { binder } => vec![SessionEvent::BinderConfirm { binder }],
         ServerPacket::TalentWipeConfirm { trainer, cost } => {
             vec![SessionEvent::TalentWipeConfirm { trainer, cost }]
diff --git a/crates/benilla-protocol/src/messages/gm_ticket.rs b/crates/benilla-protocol/src/messages/gm_ticket.rs
new file mode 100644
index 00000000..2ee47d41
--- /dev/null
+++ b/crates/benilla-protocol/src/messages/gm_ticket.rs
@@ -0,0 +1,282 @@
+//! The GM trouble-ticket family — the five request/answer pairs behind the Help window
+//! (opcodes 0x205-0x21B; decision 1673).
+//!
+//! | opcode | direction | body |
+//! |---|---|---|
+//! | `CMSG_GMTICKET_CREATE` 0x205 | out | `u8` category, `u32` map, `f32` x/y/z, cstring text, cstring reserved |
+//! | `SMSG_GMTICKET_CREATE` 0x206 | in | `u32` response |
+//! | `CMSG_GMTICKET_UPDATETEXT` 0x207 | out | `u8` category, cstring text |
+//! | `SMSG_GMTICKET_UPDATETEXT` 0x208 | in | `u32` response |
+//! | `CMSG_GMTICKET_GETTICKET` 0x211 | out | *empty* |
+//! | `SMSG_GMTICKET_GETTICKET` 0x212 | in | `u32` status, then the ticket iff status == 6 |
+//! | `CMSG_GMTICKET_DELETETICKET` 0x217 | out | *empty* |
+//! | `SMSG_GMTICKET_DELETETICKET` 0x218 | in | `u32` response |
+//! | `CMSG_GMTICKET_SYSTEMSTATUS` 0x21A | out | *empty* |
+//! | `SMSG_GMTICKET_SYSTEMSTATUS` 0x21B | in | `u32` queue status |
+//!
+//! ## The two outbound bodies are byte-verified against the real client, not just the server
+//!
+//! Both are places where reading only the emulator would have got it wrong, so both were taken
+//! from the 5875 binary's own senders:
+//!
+//! - **`CMSG_GMTICKET_CREATE`'s category is a `u8`, not a `u32`** (sender `0x5ef740`, reached from
+//!   the Lua glue `NewGMTicket` `0x48c9d0`): `PutInt8` at `0x5ef851`, then `PutInt32(mapId)`, three
+//!   `PutFloat`s, `PutCString(text)`, and a second cstring — the literal
+//!   [`RESERVED_FOR_FUTURE_USE`] at VA `0x860708`. vmangos reads exactly that head
+//!   (`Server/Packets/GmTicket.cpp:5-17`).
+//! - **`CMSG_GMTICKET_UPDATETEXT` carries the category byte too** (sender `0x5efac0`: `PutInt8` at
+//!   `0x5efb2d`, `PutCString` at `0x5efb3c`). This one is a real fork in the emulator world —
+//!   vmangos reads `u8 type; cstring text` (`GmTicket.cpp:19-23`) and matches the client, while
+//!   cmangos-classic reads a bare cstring (`GMTicketHandler.cpp:160-161`) and therefore swallows
+//!   our category byte as the first character of the ticket. We are faithful to the client; a
+//!   cmangos server would store a stray control byte at the head of the text. Recorded rather than
+//!   worked around: the client is the authority, and bending the wire to one emulator's bug would
+//!   break the other.
+//!
+//! **The `category == 2` chat-log tail is deliberately not sent.** The real client appends a
+//! zlib-compressed transcript of the last (up to 60) chat lines to a Behavior/Harassment ticket
+//! (`0x5ef936` onward). Neither emulator uses it: vmangos does not read it at all (and logs a
+//! parse-length warning for the leftover bytes), cmangos reads two `u32`s under the wrong names
+//! and discards the rest. Sending it would buy nothing and cost a log line per ticket, so
+//! [`gm_ticket_create`] stops after the reserved string — see [`crate::messages::gm_ticket`]'s
+//! test for the byte-exact shape we do send.
+//!
+//! ## The inbound ticket reads TEXT BEFORE CATEGORY
+//!
+//! [`GmTicket`]'s field order is the *wire* order, and it is not the order the Lua `UPDATE_TICKET`
+//! event uses (`HelpFrameOpenTicket_OnEvent` reads arg1 = category, arg2 = description). vmangos
+//! and cmangos agree byte-for-byte on the wire order — `cstring text` then `u8 category`
+//! (vmangos `Server/Packets/GmTicket.cpp:66-79` filled at `GMTicketMgr.cpp:120-151`; cmangos
+//! `GMTickets/GMTicketHandler.cpp:35-51`) — so the reorder happens inside the client's own handler
+//! and belongs to the app's event feed, not here. Decoding it any other way would desynchronise
+//! the whole struct after the first string.
+
+use std::io;
+
+use crate::wire::{read_cstring, read_f32_le, read_u32_le, read_u8};
+
+/// The second cstring of `CMSG_GMTICKET_CREATE`, verbatim from the client's own constant at VA
+/// `0x860708`. It is exactly what it says: a slot nothing has ever read. We send the real string
+/// rather than an empty one because that is what the client puts on the wire, and a server that
+/// ever grows a use for it should see what retail sent.
+pub const RESERVED_FOR_FUTURE_USE: &str = "Reserved for future use";
+
+/// `SMSG_GMTICKET_GETTICKET`'s status when a ticket follows (`GMTICKET_STATUS_HASTEXT`).
+pub const GMTICKET_STATUS_HASTEXT: u32 = 0x06;
+
+/// `SMSG_GMTICKET_GETTICKET`'s status when there is no ticket (`GMTICKET_STATUS_DEFAULT`) — a
+/// 4-byte body and nothing after it. **This is the ordinary answer, not an error**: it is what
+/// retail answered the client's own post-login ask with in the 1.12.1 sniff, and it is what the
+/// Help window's "you have no open ticket" state is drawn from.
+pub const GMTICKET_STATUS_DEFAULT: u32 = 0x0A;
+
+/// The queue is accepting tickets (`GMTICKET_QUEUE_STATUS_ENABLED`).
+pub const GMTICKET_QUEUE_ENABLED: i32 = 1;
+
+/// The player's open ticket, as `SMSG_GMTICKET_GETTICKET` describes it.
+///
+/// The three `f32`s are **days**, not seconds, and two of them can legitimately be negative:
+/// cmangos sends `-1.0` for `oldest_ticket_age`/`update_time` when it has never computed them
+/// (`GMTicketMgr.h:318`, `GMTicketMgr.cpp:1340-1343`), and the shipped FrameXML tests exactly that
+/// (`arg4 < 0 or arg5 < 0` → "Wait time currently unavailable"). So this is a plain `f32` with no
+/// clamping: the negative *is* the signal.
+#[derive(Debug, Clone, PartialEq)]
+pub struct GmTicket {
+    /// What the player typed. On vmangos a completed ticket has the GM's answer **appended into
+    /// this same string** (`GMTicketMgr.cpp:124-136`) — there is no response channel in 1.12, so
+    /// the reply arrives as part of the description.
+    pub text: String,
+    /// The `GMTicketCategory.dbc` id the ticket was filed under (1..10).
+    pub category: u8,
+    /// Days since the ticket was last modified — the FrameXML's `arg3`.
+    pub ticket_age: f32,
+    /// Days since the oldest open ticket on the realm was last modified; `0.0` when there is none,
+    /// negative when unknown. The FrameXML subtracts `ticket_age` from this to estimate the wait.
+    pub oldest_ticket_age: f32,
+    /// How stale the oldest-ticket figure is, in days; negative or `> 0.042` (≈ 1 hour) means the
+    /// data is no good and the window says so instead of guessing.
+    pub update_time: f32,
+    /// 0 = unassigned, 1 = assigned to a GM, 2 = in the escalation queue. vmangos clamps its
+    /// internal 3 ("escalated and assigned") down to 2 before sending (`GMTicketMgr.cpp:147`), so
+    /// nothing above 2 can arrive.
+    pub assigned_to_gm: u8,
+    /// 1 once a GM has actually opened the ticket, 0 before that.
+    pub opened_by_gm: u8,
+}
+
+/// Body of `CMSG_GMTICKET_CREATE` — the Submit that files a new ticket.
+///
+/// `map`/`x`/`y`/`z` are where the player is standing when they file it; vmangos stores them so a
+/// GM can `.ticket go` to the spot. The text is sent as typed: the client's own 1999-char cap
+/// (`SStrCopy` bound `0x7d0` at `0x5ef7fd`) sits far above the Help window's `letters="500"`
+/// EditBox, so nothing here can truncate a ticket the UI allowed.
+pub fn gm_ticket_create(category: u8, map: u32, pos: [f32; 3], text: &str) -> Vec<u8> {
+    let mut out =
+        Vec::with_capacity(1 + 4 + 12 + text.len() + 1 + RESERVED_FOR_FUTURE_USE.len() + 1);
+    out.push(category);
+    out.extend_from_slice(&map.to_le_bytes());
+    for c in pos {
+        out.extend_from_slice(&c.to_le_bytes());
+    }
+    out.extend_from_slice(text.as_bytes());
+    out.push(0);
+    out.extend_from_slice(RESERVED_FOR_FUTURE_USE.as_bytes());
+    out.push(0);
+    out
+}
+
+/// Body of `CMSG_GMTICKET_UPDATETEXT` — the "Save Changes" that edits an open ticket.
+///
+/// Carries the category byte as well as the text (module doc: byte-verified at `0x5efb2d`), and
+/// vmangos **stores** it: `HandleGMTicketUpdateTextOpcode` does `SetMessage(packet.ticketText)`
+/// then `SetTicketType(TicketType(packet.type))` before saving (`GMTicketHandler.cpp:59-61`). So an
+/// edit re-files the ticket under whatever category the byte carries, and getting this field wrong
+/// silently moves a GM's ticket to a different queue rather than merely being ignored.
+///
+/// The shipped Help window always passes the ticket's existing `HelpFrameOpenTicket.ticketType`
+/// here, so in practice the value is unchanged by an edit — but that is the window's discipline,
+/// not the server's.
+pub fn gm_ticket_updatetext(category: u8, text: &str) -> Vec<u8> {
+    let mut out = Vec::with_capacity(1 + text.len() + 1);
+    out.push(category);
+    out.extend_from_slice(text.as_bytes());
+    out.push(0);
+    out
+}
+
+/// Read the shared `u32` answer of `SMSG_GMTICKET_CREATE` / `UPDATETEXT` / `DELETETICKET`.
+///
+/// One reader for three opcodes because all three bodies are the same 4 bytes — the *meaning* of
+/// the number is the opcode's, and that split lives in [`crate::events`]. The value set (vmangos
+/// `GMTicketMgr.h:49-54`): 1 already-exists, 2 create-ok, 3 create-error, 4 update-ok,
+/// 5 update-error, 9 deleted.
+pub(super) fn read_gm_ticket_response(r: &mut &[u8]) -> io::Result<u32> {
+    read_u32_le(r)
+}
+
+/// Read `SMSG_GMTICKETSYSTEMSTATUS`: 1 = the queue is taking tickets, 0 = it is not.
+///
+/// **Signed, and that is byte-verified rather than a preference.** The reference copies the field
+/// off the wire verbatim (`0x418e95`, no extension), pushes it unmodified (`0x5e467b`) and hands it
+/// to Lua through `0x704fa6 fild dword` — a signed load, with no `cmp`, `test`, clamp or mapping
+/// anywhere in between (wow-re §5). `HelpFrame`'s `arg1 == -1` arm — "the queue is down, say so" —
+/// is therefore reachable exactly when a server sends `0xFFFFFFFF`, and reading this unsigned would
+/// turn that into 4294967295 and silently cost the dialog. vmangos only ever sends 0 or 1, so
+/// nothing here would have caught the difference in a live run.
+pub(super) fn read_gm_ticket_system_status(r: &mut &[u8]) -> io::Result<i32> {
+    Ok(read_u32_le(r)? as i32)
+}
+
+/// Read `SMSG_GMTICKET_GETTICKET`: a status, and the ticket itself only when that status is
+/// [`GMTICKET_STATUS_HASTEXT`].
+///
+/// Returns `Ok(None)` for every other status — which in practice is the 4-byte
+/// [`GMTICKET_STATUS_DEFAULT`] body meaning "you have no open ticket". Deliberately **not** an
+/// error: that answer is the common case, it is what the client's own post-login ask gets, and
+/// treating it as a parse failure would put a warn line in the log on every login.
+pub(super) fn read_gm_ticket(r: &mut &[u8]) -> io::Result<Option<GmTicket>> {
+    if read_u32_le(r)? != GMTICKET_STATUS_HASTEXT {
+        return Ok(None);
+    }
+    Ok(Some(GmTicket {
+        text: read_cstring(r)?,
+        category: read_u8(r)?,
+        ticket_age: read_f32_le(r)?,
+        oldest_ticket_age: read_f32_le(r)?,
+        update_time: read_f32_le(r)?,
+        assigned_to_gm: read_u8(r)?,
+        opened_by_gm: read_u8(r)?,
+    }))
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    /// The create body, byte for byte — the client's own field order and widths (`0x5ef740`), with
+    /// the category as ONE byte. Getting this wrong by widening the category to `u32` would shift
+    /// the map id and the whole position by three bytes and file every ticket at a garbage spot.
+    #[test]
+    fn the_create_body_is_a_category_byte_then_map_position_text_and_the_reserved_string() {
+        let body = gm_ticket_create(4, 1, [-8949.95, -132.493, 83.5312], "My sword vanished.");
+        let mut want = vec![0x04];
+        want.extend_from_slice(&1u32.to_le_bytes());
+        want.extend_from_slice(&(-8949.95f32).to_le_bytes());
+        want.extend_from_slice(&(-132.493f32).to_le_bytes());
+        want.extend_from_slice(&(83.5312f32).to_le_bytes());
+        want.extend_from_slice(b"My sword vanished.\0");
+        want.extend_from_slice(b"Reserved for future use\0");
+        assert_eq!(body, want);
+        // The tail the client sends for a Behavior/Harassment ticket is deliberately absent: the
+        // body ends at the reserved string for every category, including 2.
+        assert_eq!(
+            gm_ticket_create(2, 0, [0.0; 3], "x").len(),
+            1 + 4 + 12 + 2 + 24,
+            "no chat-log tail, even for category 2"
+        );
+    }
+
+    /// The updatetext body leads with the category byte — the divergence the module doc records.
+    /// A bare cstring here is what cmangos expects and what the client never sends.
+    #[test]
+    fn the_updatetext_body_leads_with_the_category_byte() {
+        assert_eq!(
+            gm_ticket_updatetext(7, "Still stuck."),
+            b"\x07Still stuck.\0"
+        );
+    }
+
+    /// The ticket round-trips in WIRE order — text first, category second. Pinning it here is the
+    /// point: the Lua event's order is the reverse, and a "fix" that swapped these two to match
+    /// the event would desynchronise every field after the string.
+    #[test]
+    fn a_held_ticket_decodes_in_wire_order_text_before_category() {
+        let mut bytes = GMTICKET_STATUS_HASTEXT.to_le_bytes().to_vec();
+        bytes.extend_from_slice(b"Stuck in a rock.\0");
+        bytes.push(1);
+        bytes.extend_from_slice(&0.25f32.to_le_bytes());
+        bytes.extend_from_slice(&2.5f32.to_le_bytes());
+        bytes.extend_from_slice(&0.01f32.to_le_bytes());
+        bytes.push(2);
+        bytes.push(1);
+
+        assert_eq!(
+            read_gm_ticket(&mut &bytes[..]).unwrap(),
+            Some(GmTicket {
+                text: "Stuck in a rock.".to_string(),
+                category: 1,
+                ticket_age: 0.25,
+                oldest_ticket_age: 2.5,
+                update_time: 0.01,
+                assigned_to_gm: 2,
+                opened_by_gm: 1,
+            })
+        );
+    }
+
+    /// The queue status is read SIGNED: `0xFFFFFFFF` must reach Lua as `-1`, which is the value the
+    /// shipped window branches on to raise "GM Help Tickets are currently unavailable." Read it
+    /// unsigned and that arm can never fire.
+    #[test]
+    fn the_queue_status_is_signed_so_all_ones_reads_as_minus_one() {
+        assert_eq!(
+            read_gm_ticket_system_status(&mut &0xFFFF_FFFFu32.to_le_bytes()[..]).unwrap(),
+            -1
+        );
+        assert_eq!(
+            read_gm_ticket_system_status(&mut &1u32.to_le_bytes()[..]).unwrap(),
+            GMTICKET_QUEUE_ENABLED
+        );
+    }
+
+    /// "You have no ticket" is a 4-byte body and an `Ok(None)`, never an error — it is the answer
+    /// retail gave the client's own post-login ask, so an error here would warn on every login.
+    #[test]
+    fn the_no_ticket_answer_is_four_bytes_and_is_not_an_error() {
+        let bytes = GMTICKET_STATUS_DEFAULT.to_le_bytes();
+        assert_eq!(read_gm_ticket(&mut &bytes[..]).unwrap(), None);
+        // Any other status is likewise "nothing to show" rather than a parse failure.
+        let bytes = 0u32.to_le_bytes();
+        assert_eq!(read_gm_ticket(&mut &bytes[..]).unwrap(), None);
+    }
+}
diff --git a/crates/benilla-protocol/src/messages/mod.rs b/crates/benilla-protocol/src/messages/mod.rs
index 14d96a4a..2a6ce841 100644
--- a/crates/benilla-protocol/src/messages/mod.rs
+++ b/crates/benilla-protocol/src/messages/mod.rs
@@ -29,6 +29,7 @@ mod combat_log;
 mod death;
 mod duel;
 mod gameobject;
+mod gm_ticket;
 mod gossip;
 mod group;
 mod guild;
@@ -110,6 +111,10 @@ pub use duel::{
     read_duel_winner, DuelRequested, DuelWinner,
 };
 pub use gameobject::{gameobj_use, gameobject_query, GameObjectQueryInfo};
+pub use gm_ticket::{
+    gm_ticket_create, gm_ticket_updatetext, GmTicket, GMTICKET_QUEUE_ENABLED,
+    GMTICKET_STATUS_DEFAULT, GMTICKET_STATUS_HASTEXT, RESERVED_FOR_FUTURE_USE,
+};
 pub use gossip::{
     gossip_hello, gossip_select_option, npc_text_query, select_greeting, GossipOption, GossipPoi,
     NpcTextBlock, QuestOption, NPC_TEXT_BLOCKS,
@@ -256,6 +261,15 @@ pub const AUTH_ALREADY_LOGGING_IN: u8 = 0x19;
 pub const AUTH_LOGIN_SERVER_NOT_FOUND: u8 = 0x1A;
 /// The realm is full and we are **queued**, not refused — the one code here that is not an ending.
 pub const AUTH_WAIT_QUEUE: u8 = 0x1B;
+// The tail past the queue. These five are exactly the codes the client's `OKAY_WITH_URL` table
+// (`0x803740`, 5 records, stride 0x24) keys on — banned/no-time/db-busy/suspended/parental — which
+// is why the URL dialog is reachable ONLY from this enum and never from realmd.
+pub const AUTH_BANNED: u8 = 0x1C;
+pub const AUTH_ALREADY_ONLINE: u8 = 0x1D;
+pub const AUTH_NO_TIME: u8 = 0x1E;
+pub const AUTH_DB_BUSY: u8 = 0x1F;
+pub const AUTH_SUSPENDED: u8 = 0x20;
+pub const AUTH_PARENTAL_CONTROL: u8 = 0x21;
 /// `LogoutResult::Success` (`SMSG_LOGOUT_RESPONSE`).
 pub const LOGOUT_SUCCESS: u32 = 0x0;
 /// Chat `Language` wire ids (VERIFIED vmangos `SharedDefines.h:256-261`): the faction tongues.
diff --git a/crates/benilla-protocol/src/messages/opcode.rs b/crates/benilla-protocol/src/messages/opcode.rs
index 22713cf1..3f057a07 100644
--- a/crates/benilla-protocol/src/messages/opcode.rs
+++ b/crates/benilla-protocol/src/messages/opcode.rs
@@ -728,6 +728,47 @@ pub const CMSG_BINDER_ACTIVATE: u16 = 0x01B5; // 437
 pub const SMSG_PLAYERBOUND: u16 = 0x0158; // 344
 pub const SMSG_BINDER_CONFIRM: u16 = 0x02EB; // 747
 
+// The GM trouble-ticket set (VERIFIED vmangos `Opcodes_1_12_1.h` + `Opcodes.cpp:608-630`; decision
+// 1673). Five request/answer pairs behind the Help window, and the client asks for all of them —
+// there is no ticket state pushed at login, so `CMSG_GMTICKET_GETTICKET` right after world entry is
+// the client's own (seen in the 1.12.1 retail sniff, answered `TicketStatus: 10 (NoText)`).
+//
+// **Two of these answers can also arrive UNSOLICITED on vmangos**, which is why they are decoded
+// rather than correlated to a pending ask: `.ticket viewid`/`viewname`/`escalate`/`complete` push a
+// fresh `SMSG_GMTICKET_GETTICKET` at the ticket's author (`GMTicketMgr.cpp:153-159`,
+// `TicketCommands.cpp:265,443-452`), and `.ticket delete <id>` pushes a
+// `SMSG_GMTICKET_DELETETICKET` = `TICKET_DELETED` (`TicketCommands.cpp:100-103`).
+//
+// **And two requests can be answered with SILENCE**, which is why nothing in the client blocks on a
+// reply: `HandleGMTicketCreateOpcode` simply returns — no packet at all — when the queue is off,
+// when the player is under `GMTickets.MinLevel`, or when the category is >= 11
+// (`GMTicketHandler.cpp:91,106-113`), and delete-with-no-ticket likewise returns silently (`:73-86`).
+// Bodies in [`super::gm_ticket`].
+pub const CMSG_GMTICKET_CREATE: u16 = 0x0205; // 517
+pub const SMSG_GMTICKET_CREATE: u16 = 0x0206; // 518
+pub const CMSG_GMTICKET_UPDATETEXT: u16 = 0x0207; // 519
+pub const SMSG_GMTICKET_UPDATETEXT: u16 = 0x0208; // 520
+pub const CMSG_GMTICKET_GETTICKET: u16 = 0x0211; // 529
+pub const SMSG_GMTICKET_GETTICKET: u16 = 0x0212; // 530
+pub const CMSG_GMTICKET_DELETETICKET: u16 = 0x0217; // 535
+pub const SMSG_GMTICKET_DELETETICKET: u16 = 0x0218; // 536
+pub const CMSG_GMTICKET_SYSTEMSTATUS: u16 = 0x021A; // 538
+pub const SMSG_GMTICKET_SYSTEMSTATUS: u16 = 0x021B; // 539
+
+/// The GM's own ticket-state push (VERIFIED vmangos `Opcodes_1_12_1.h`: 808). Body is a bare `u32`:
+/// 1 = updated, 2 = closed, 3 = a survey is offered.
+///
+/// **vmangos never constructs this packet on any path** — it is registered in its opcode table and
+/// nothing in its source sends it — so on the server benilla talks to this arm is dead. cmangos-
+/// classic makes it the core of its notification model (escalation, first GM read, re-sort, text
+/// update, assignment, queue toggle, close), which is why it is parsed rather than dropped.
+///
+/// It is decoded for one reason beyond completeness: the reference engine answers value 1 by
+/// re-asking for the ticket (`0x5e7932`, wow-re §5), the same leg the create/update success codes
+/// take. Values 2 and 3 are recorded but not acted on — 3 is the GM-survey trigger, and the survey
+/// window is deferred (decision 1673).
+pub const SMSG_GM_TICKET_STATUS_UPDATE: u16 = 0x0328; // 808
+
 // The bank set (VERIFIED vmangos `Opcodes_1_12_1.h`: 439,440-441,642-643).
 // `CMSG_BANKER_ACTIVATE` right-clicks a pure banker;
 // `SMSG_SHOW_BANK` also arrives unprompted from the `GOSSIP_OPTION_BANKER` gossip option. Slot
diff --git a/crates/benilla-protocol/src/messages/packet.rs b/crates/benilla-protocol/src/messages/packet.rs
index 4a8fb311..1cbbbf16 100644
--- a/crates/benilla-protocol/src/messages/packet.rs
+++ b/crates/benilla-protocol/src/messages/packet.rs
@@ -8,7 +8,7 @@ use super::{
     ActionButton, AttackerState, AuctionBidderNotification, AuctionCommandTail, AuctionListEntry,
     AuctionOwnerNotification, CastOutcome, ChannelNotify, Character, ChatMessage, CorpseLocation,
     DamageShield, EnvironmentalDamageLog, ExplorationXp, FriendEntry, FriendStatusUpdate,
-    GameObjectQueryInfo, GossipOption, GossipPoi, GroupLootInfo, GroupMemberEntry,
+    GameObjectQueryInfo, GmTicket, GossipOption, GossipPoi, GroupLootInfo, GroupMemberEntry,
     GuildCommandResult, GuildEventNotice, GuildInfo, GuildQueryResponse, GuildRoster,
     InitWorldStates, InspectHonorStats, ItemInfo, ItemPushResult, JumpInfo, LevelUpInfo,
     LootAllPassed, LootItem, LootRoll, LootRollWon, LootStartRoll, MailListEntry, MirrorTimerStart,
@@ -217,6 +217,39 @@ pub enum ServerPacket {
         map: u32,
         area: u32,
     },
+    /// `SMSG_GMTICKET_GETTICKET` — the player's open GM ticket, or `None` for the ordinary
+    /// "you have no ticket" answer (decision 1673). **Not always solicited**: vmangos pushes a
+    /// fresh one at the ticket's author when a GM views, escalates or completes it
+    /// (`GMTicketMgr.cpp:153-159`), which is how a reply reaches the player at all in 1.12.
+    GmTicketAnswer {
+        ticket: Option<Box<GmTicket>>,
+    },
+    /// `SMSG_GMTICKET_CREATE` — the answer to filing a ticket: 2 = created, 3 = refused,
+    /// 1 = you already have one (decision 1673). vmangos never sends 1 (an existing ticket just
+    /// yields 3), and answers several refusals with **silence** rather than a code at all.
+    GmTicketCreated {
+        response: u32,
+    },
+    /// `SMSG_GMTICKET_UPDATETEXT` — the answer to editing a ticket: 4 = saved, 5 = refused.
+    GmTicketUpdated {
+        response: u32,
+    },
+    /// `SMSG_GMTICKET_DELETETICKET` — the answer to abandoning a ticket: 9 = deleted.
+    /// Also arrives **unsolicited** when a GM runs `.ticket delete` (`TicketCommands.cpp:100-103`).
+    GmTicketDeleted {
+        response: u32,
+    },
+    /// `SMSG_GMTICKETSYSTEMSTATUS` — 1 = the petition queue is taking tickets, 0 = it is not.
+    /// Answers `CMSG_GMTICKET_SYSTEMSTATUS`; cmangos also broadcasts it to every session when a
+    /// GM toggles the queue, vmangos never does.
+    GmTicketSystemStatus {
+        status: i32,
+    },
+    /// `SMSG_GM_TICKET_STATUS_UPDATE` — a GM touched the ticket: 1 = updated, 2 = closed,
+    /// 3 = a survey is offered. Never sent by vmangos; the core of cmangos's notification model.
+    GmTicketStatusUpdate {
+        status: u32,
+    },
     /// `SMSG_BINDER_CONFIRM` — an innkeeper is *asking* whether to make this your home
     /// (decision 1331). The body is the innkeeper's guid, which must come back in
     /// `CMSG_BINDER_ACTIVATE` for anything to happen: this packet binds nothing on its own.
@@ -1310,6 +1343,12 @@ impl ServerPacket {
             ServerPacket::TimeSpeed { .. } => "SMSG_LOGIN_SETTIMESPEED".into(),
             ServerPacket::QueryTimeResponse { .. } => "SMSG_QUERY_TIME_RESPONSE".into(),
             ServerPacket::BindPoint { .. } => "SMSG_BINDPOINTUPDATE".into(),
+            ServerPacket::GmTicketAnswer { .. } => "SMSG_GMTICKET_GETTICKET".into(),
+            ServerPacket::GmTicketCreated { .. } => "SMSG_GMTICKET_CREATE".into(),
+            ServerPacket::GmTicketUpdated { .. } => "SMSG_GMTICKET_UPDATETEXT".into(),
+            ServerPacket::GmTicketDeleted { .. } => "SMSG_GMTICKET_DELETETICKET".into(),
+            ServerPacket::GmTicketSystemStatus { .. } => "SMSG_GMTICKETSYSTEMSTATUS".into(),
+            ServerPacket::GmTicketStatusUpdate { .. } => "SMSG_GM_TICKET_STATUS_UPDATE".into(),
             ServerPacket::BinderConfirm { .. } => "SMSG_BINDER_CONFIRM".into(),
             ServerPacket::PlayerBound { .. } => "SMSG_PLAYERBOUND".into(),
             ServerPacket::TalentWipeConfirm { .. } => "MSG_TALENT_WIPE_CONFIRM".into(),
diff --git a/crates/benilla-protocol/src/messages/parse.rs b/crates/benilla-protocol/src/messages/parse.rs
index 0dcd60ed..a8a9d3af 100644
--- a/crates/benilla-protocol/src/messages/parse.rs
+++ b/crates/benilla-protocol/src/messages/parse.rs
@@ -12,10 +12,10 @@ use crate::wire::{
 
 use super::{
     action_bar, area_trigger, attack, auction, bank, binder, channel, chat, combat_log, death,
-    duel, gameobject, gossip, group, guild, items, loot, mail, mirror_timer, monster_move,
-    movement, opcode, page_text, pet, progression, pvp, quest, social, spellbook, spells, stable,
-    taxi, trade, trainer, update_object, vendor, world_state, Character, CreatureQueryInfo,
-    MoveMode, ServerPacket, SpeedKind,
+    duel, gameobject, gm_ticket, gossip, group, guild, items, loot, mail, mirror_timer,
+    monster_move, movement, opcode, page_text, pet, progression, pvp, quest, social, spellbook,
+    spells, stable, taxi, trade, trainer, update_object, vendor, world_state, Character,
+    CreatureQueryInfo, MoveMode, ServerPacket, SpeedKind,
 };
 
 /// Read one `SMSG_FORCE_*_SPEED_CHANGE` body — `[packed mover guid][u32 counter][f32 speed]`,
@@ -287,6 +287,26 @@ pub fn parse_server(opcode: u16, body: &[u8]) -> io::Result<ServerPacket> {
                 area,
             }
         }
+        // The GM trouble-ticket answers (decision 1673). The three response opcodes share one
+        // 4-byte body and therefore one reader; only the opcode says which verb was answered.
+        opcode::SMSG_GMTICKET_GETTICKET => ServerPacket::GmTicketAnswer {
+            ticket: gm_ticket::read_gm_ticket(&mut r)?.map(Box::new),
+        },
+        opcode::SMSG_GMTICKET_CREATE => ServerPacket::GmTicketCreated {
+            response: gm_ticket::read_gm_ticket_response(&mut r)?,
+        },
+        opcode::SMSG_GMTICKET_UPDATETEXT => ServerPacket::GmTicketUpdated {
+            response: gm_ticket::read_gm_ticket_response(&mut r)?,
+        },
+        opcode::SMSG_GMTICKET_DELETETICKET => ServerPacket::GmTicketDeleted {
+            response: gm_ticket::read_gm_ticket_response(&mut r)?,
+        },
+        opcode::SMSG_GMTICKET_SYSTEMSTATUS => ServerPacket::GmTicketSystemStatus {
+            status: gm_ticket::read_gm_ticket_system_status(&mut r)?,
+        },
+        opcode::SMSG_GM_TICKET_STATUS_UPDATE => ServerPacket::GmTicketStatusUpdate {
+            status: gm_ticket::read_gm_ticket_response(&mut r)?,
+        },
         opcode::SMSG_BINDER_CONFIRM => ServerPacket::BinderConfirm {
             binder: binder::read_binder_confirm(&mut r)?,
         },
diff --git a/crates/benilla-protocol/src/world/writer/gm_ticket.rs b/crates/benilla-protocol/src/world/writer/gm_ticket.rs
new file mode 100644
index 00000000..a012b609
--- /dev/null
+++ b/crates/benilla-protocol/src/world/writer/gm_ticket.rs
@@ -0,0 +1,79 @@
+//! The Help window's five sends — the whole client half of the GM trouble-ticket flow
+//! (decision 1673).
+//!
+//! Three of the five have empty bodies, which is the shape of the feature: the client holds no
+//! ticket state of its own, so "show me my ticket", "abandon it" and "is the queue up?" are each a
+//! bare opcode and the server's answer is the only truth. The two that carry a body — file and
+//! edit — are byte-verified against the real client's own senders (`0x5ef740` / `0x5efac0`); see
+//! [`crate::messages::gm_ticket`] for why the category is a single byte in both.
+//!
+//! **Nothing here may be retried on a timeout.** vmangos answers several refusals with silence
+//! rather than a response code (queue off, under `GMTickets.MinLevel`, category >= 11 —
+//! `GMTicketHandler.cpp:91,106-113`), and it treats more than two `CMSG_GMTICKET_UPDATETEXT` in a
+//! single world tick as flooding, whose default sanction is a **kick**
+//! (`WorldSession.cpp:1316-1342`, `Antiflood.Sanction = 8`). So a client that re-sent an edit
+//! because no answer came would disconnect itself. The Help window asks once per click, exactly as
+//! the reference does.
+
+use anyhow::Result;
+
+use crate::messages::{self, opcode};
+
+use super::WorldWriter;
+
+impl WorldWriter {
+    /// File a new ticket (`CMSG_GMTICKET_CREATE`) — the Help window's Submit.
+    ///
+    /// `category` is a `GMTicketCategory.dbc` id (1..10, the clicked row); `map`/`pos` are where
+    /// the player is standing, which is what lets a GM `.tele` to the reported spot. Answered by
+    /// `SMSG_GMTICKET_CREATE` — **or by nothing at all**, on the several vmangos paths that refuse
+    /// silently (module doc).
+    pub fn gm_ticket_create(
+        &mut self,
+        category: u8,
+        map: u32,
+        pos: [f32; 3],
+        text: &str,
+    ) -> Result<()> {
+        self.send(
+            opcode::CMSG_GMTICKET_CREATE,
+            &messages::gm_ticket_create(category, map, pos, text),
+        )
+    }
+
+    /// Edit the open ticket's text (`CMSG_GMTICKET_UPDATETEXT`) — the Help window's "Save Changes".
+    ///
+    /// Carries the category byte the client carries even though vmangos reads and discards it; the
+    /// category of an existing ticket cannot actually be changed this way. Answered by
+    /// `SMSG_GMTICKET_UPDATETEXT`. **Rate-limited server-side** — see the module doc.
+    pub fn gm_ticket_updatetext(&mut self, category: u8, text: &str) -> Result<()> {
+        self.send(
+            opcode::CMSG_GMTICKET_UPDATETEXT,
+            &messages::gm_ticket_updatetext(category, text),
+        )
+    }
+
+    /// Ask for the open ticket (`CMSG_GMTICKET_GETTICKET`, empty body) — `GetGMTicket()`.
+    ///
+    /// The client's own poll: once on world entry and every 10 minutes while the ticket status
+    /// toast is up. Answered by `SMSG_GMTICKET_GETTICKET`, and on vmangos **also** by an
+    /// unsolicited `SMSG_QUERY_TIME_RESPONSE` — its handler calls `SendQueryTimeResponse()` as its
+    /// first statement (`GMTicketHandler.cpp:34`), so two packets come back for this one request.
+    pub fn gm_ticket_get(&mut self) -> Result<()> {
+        self.send(opcode::CMSG_GMTICKET_GETTICKET, &[])
+    }
+
+    /// Abandon the open ticket (`CMSG_GMTICKET_DELETETICKET`, empty body) — the
+    /// `HELP_TICKET_ABANDON_CONFIRM` dialog's Yes. Answered by `SMSG_GMTICKET_DELETETICKET`
+    /// carrying 9, or — with no ticket to delete — by nothing at all on vmangos.
+    pub fn gm_ticket_delete(&mut self) -> Result<()> {
+        self.send(opcode::CMSG_GMTICKET_DELETETICKET, &[])
+    }
+
+    /// Ask whether the petition queue is taking tickets (`CMSG_GMTICKET_SYSTEMSTATUS`, empty body)
+    /// — `GetGMStatus()`, which the Help window calls from its own OnShow. Answered by
+    /// `SMSG_GMTICKETSYSTEMSTATUS`.
+    pub fn gm_ticket_system_status(&mut self) -> Result<()> {
+        self.send(opcode::CMSG_GMTICKET_SYSTEMSTATUS, &[])
+    }
+}
diff --git a/crates/benilla-protocol/src/world/writer/mod.rs b/crates/benilla-protocol/src/world/writer/mod.rs
index 73b586ad..2b517ac4 100644
--- a/crates/benilla-protocol/src/world/writer/mod.rs
+++ b/crates/benilla-protocol/src/world/writer/mod.rs
@@ -29,6 +29,7 @@
 //! | [`items`] | bags and equipment: use, equip, swap/split/destroy, the template ask |
 //! | [`loot`] | the loot window: open, take, coin, close, roll |
 //! | [`death`] | the corpse run: release, corpse query, reclaim, spirit healer, res answer |
+//! | [`gm_ticket`] | the Help window: file, edit, ask, abandon, queue status |
 //! | [`gossip`] | the front door to every NPC service window |
 //! | [`vendor`] | buy, sell, buy back, repair |
 //! | [`bank`] | open, buy a slot, deposit, withdraw |
@@ -65,6 +66,7 @@ mod chat;
 mod death;
 mod duel;
 mod gameobject;
+mod gm_ticket;
 mod gossip;
 mod group;
 mod guild;
diff --git a/crates/benilla-ui/src/script/gm_ticket.rs b/crates/benilla-ui/src/script/gm_ticket.rs
new file mode 100644
index 00000000..bb9b2330
--- /dev/null
+++ b/crates/benilla-ui/src/script/gm_ticket.rs
@@ -0,0 +1,164 @@
+//! The GM trouble-ticket **Era API surface** (decision 1673) — the seven globals `HelpFrame.lua`
+//! is written against, and nothing else.
+//!
+//! All seven are engine bindings in 1.12 (`reference/1.12-globals.tsv` lists each as
+//! `function`/`engine`), and the set is closed: the shipped Help window calls exactly
+//! `GetGMTicketCategories`, `GetGMStatus`, `GetGMTicket`, `NewGMTicket`, `UpdateGMTicket`,
+//! `DeleteGMTicket` and `Stuck`, and nothing else in the shipped UI calls any of them.
+//!
+//! **The five ticket verbs share ONE ordered queue** ([`GmTicketIntent`]), rather than a counter
+//! each. Call order is the wire order in the real client, and a per-verb drain cannot preserve it:
+//! with separate queues, `DeleteGMTicket(); GetGMTicket()` in a single chunk puts the *get* on the
+//! wire first and the answer then describes the state before the delete. The shipped Help window
+//! never issues two in one frame, so nothing on screen would ever have shown it — which is exactly
+//! why it is worth getting right rather than leaving as a latent trap for the next addon, or for
+//! our own probe (which hit it).
+//!
+//! A queue, not a set: **two calls are two sends**. That matters more here than for
+//! [`super::binder`], because the ticket toast **re-polls `GetGMTicket()` every 10 minutes** — a
+//! deduplicating drain would silently stop the poll. `Stuck()` keeps its own counter, because it
+//! is not a ticket verb at all (see its registration below) and shares no ordering with them.
+//!
+//! **The category list is DBC data, pushed once.** `GetGMTicketCategories()` returns a flat
+//! `id1, name1, id2, name2, …` vararg list, which `HelpFrameGM_UpdateCategories(...)` walks with
+//! Lua 5.0's `arg`/`arg.n`. The ids are `GMTicketCategory.dbc`'s own and they are the values that
+//! go on the wire, so this is an ordered list of pairs rather than an indexable table — see
+//! [`benilla_formats::gm_ticket_category`] for why renumbering would misfile every ticket.
+//!
+//! **There is no `GetGMTicket` *getter*.** The reference's `GetGMTicket()` is a SEND, not a read:
+//! the answer comes back as the `UPDATE_TICKET` event's arguments, and the window keeps whatever
+//! it needs in its own frame fields. So nothing here holds a ticket snapshot — the same shape as
+//! [`super::duel`] and [`super::binder`], and for the same reason.
+
+use mlua::{Lua, MultiValue, Value};
+
+use super::Model;
+
+/// One ticket verb the window called, in call order — the queue [`super::UiScript::take_gm_ticket_intents`]
+/// drains. Ordered rather than counted so the wire sees what Lua did, in the order Lua did it.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub enum GmTicketIntent {
+    /// `GetGMTicket()` — `CMSG_GMTICKET_GETTICKET`.
+    Ask,
+    /// `GetGMStatus()` — `CMSG_GMTICKET_SYSTEMSTATUS`.
+    AskStatus,
+    /// `DeleteGMTicket()` — `CMSG_GMTICKET_DELETETICKET`.
+    Delete,
+    /// `NewGMTicket`/`UpdateGMTicket` — create or edit.
+    Write(GmTicketWrite),
+}
+
+/// One `NewGMTicket` / `UpdateGMTicket` call, drained by the app.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct GmTicketWrite {
+    /// The `GMTicketCategory.dbc` id the window had selected — `HelpFrameOpenTicket.ticketType`,
+    /// which is the clicked category row's own id.
+    pub category: u32,
+    /// The text as typed. The window's EditBox caps it at 500 letters; the engine's own cap is
+    /// 1999, so nothing here truncates what the UI allowed.
+    pub text: String,
+    /// `true` for `NewGMTicket` (file), `false` for `UpdateGMTicket` (edit). Two different
+    /// opcodes with two different answers, so the distinction survives to the app rather than
+    /// being re-derived from whether a ticket is believed to exist — the reference picks the verb
+    /// from its own `HelpFrameOpenTicket.hasTicket` flag and we must not second-guess it.
+    pub is_new: bool,
+}
+
+impl super::UiScript {
+    /// Publish the ticket categories `GetGMTicketCategories()` returns — the `GMTicketCategory.dbc`
+    /// rows, in file order. Pushed once at load; the table is static client data.
+    pub fn set_gm_ticket_categories(&mut self, categories: Vec<(u32, String)>) {
+        self.model_mut().gm_ticket_categories = categories;
+    }
+
+    /// Drain every ticket verb the window called since the last drain, **in call order** — the
+    /// module doc's reason. Each entry is exactly one packet.
+    pub fn take_gm_ticket_intents(&mut self) -> Vec<GmTicketIntent> {
+        std::mem::take(&mut self.model_mut().gm_ticket_intents)
+    }
+
+    /// Drain the `Stuck()` calls — each is one cast of spell 7355.
+    pub fn take_stuck_casts(&mut self) -> u32 {
+        std::mem::take(&mut self.model_mut().stuck_casts)
+    }
+}
+
+/// Register the seven Help-window globals.
+pub(super) fn install(lua: &Lua) -> mlua::Result<()> {
+    let g = lua.globals();
+
+    // GetGMTicketCategories() — the flat (id, name) vararg list, consumed by
+    // `HelpFrameGM_UpdateCategories` as `arg[i]`/`arg[i+1]` pairs. Empty until the app has pushed
+    // the DBC (a bare-XML harness, or a run with no client data): the window then simply paints no
+    // category rows, which is the honest rendering of "we have no catalog" and cannot error.
+    g.set(
+        "GetGMTicketCategories",
+        lua.create_function(|lua, ()| {
+            let model = lua.app_data_ref::<Model>().expect("model app_data");
+            let mut out = Vec::with_capacity(model.gm_ticket_categories.len() * 2);
+            for (id, name) in &model.gm_ticket_categories {
+                out.push(Value::Integer(i64::from(*id)));
+                out.push(Value::String(lua.create_string(name)?));
+            }
+            Ok(MultiValue::from_vec(out))
+        })?,
+    )?;
+
+    // The three payload-free verbs. Each pushes onto the ONE ordered queue, so a chunk that calls
+    // two of them sends two packets in the order it called them.
+    //   GetGMTicket()    — "send me my ticket"; a send, answered as UPDATE_TICKET.
+    //   GetGMStatus()    — "is the petition queue up?"; answered as UPDATE_GM_STATUS.
+    //   DeleteGMTicket() — the HELP_TICKET_ABANDON_CONFIRM dialog's Yes.
+    for (name, intent) in [
+        ("GetGMTicket", GmTicketIntent::Ask),
+        ("GetGMStatus", GmTicketIntent::AskStatus),
+        ("DeleteGMTicket", GmTicketIntent::Delete),
+    ] {
+        g.set(
+            name,
+            lua.create_function(move |lua, ()| {
+                lua.app_data_mut::<Model>()
+                    .expect("model app_data")
+                    .gm_ticket_intents
+                    .push(intent.clone());
+                Ok(())
+            })?,
+        )?;
+    }
+
+    // NewGMTicket(category, text) / UpdateGMTicket(category, text) — the window's Submit and its
+    // Save Changes. Same signature, different opcode; the reference's own usage string is
+    // `Usage: UpdateGMTicket(type, text)`, so (number, string) is the declared arity for both.
+    for (name, is_new) in [("NewGMTicket", true), ("UpdateGMTicket", false)] {
+        g.set(
+            name,
+            lua.create_function(move |lua, (category, text): (u32, String)| {
+                lua.app_data_mut::<Model>()
+                    .expect("model app_data")
+                    .gm_ticket_intents
+                    .push(GmTicketIntent::Write(GmTicketWrite {
+                        category,
+                        text,
+                        is_new,
+                    }));
+                Ok(())
+            })?,
+        )?;
+    }
+
+    // Stuck() — the Help window's "Auto-Unstuck". NOT a ticket verb despite living only in this
+    // window: it casts spell 7355 "Stuck", whose SPELL_EFFECT_STUCK teleports the player to their
+    // last safe position server-side. It is registered here because HelpFrame is its only caller
+    // in the whole shipped UI, and a module for one binding would be worse than this note.
+    g.set(
+        "Stuck",
+        lua.create_function(|lua, ()| {
+            lua.app_data_mut::<Model>()
+                .expect("model app_data")
+                .stuck_casts += 1;
+            Ok(())
+        })?,
+    )?;
+
+    Ok(())
+}
diff --git a/crates/benilla-ui/src/script/mod.rs b/crates/benilla-ui/src/script/mod.rs
index 6ced0976..04ff9a9c 100644
--- a/crates/benilla-ui/src/script/mod.rs
+++ b/crates/benilla-ui/src/script/mod.rs
@@ -71,6 +71,7 @@ mod extract;
 mod follow;
 pub(crate) mod font;
 mod font_block;
+mod gm_ticket;
 mod gossip;
 mod guild;
 mod handler_prof;
@@ -168,6 +169,7 @@ pub use death::{DeathAction, DeathUiState};
 pub use dressup::DressUpIntent;
 pub use duel::DuelRequest;
 pub use follow::FollowRequest;
+pub use gm_ticket::{GmTicketIntent, GmTicketWrite};
 pub use gossip::{GossipMenu, GossipOptionView, GossipQuestRow};
 pub use guild::{
     GuildMemberInfo, GuildRankEdit, GuildRankInfo, GuildRequest, GuildState, LastOnline, UnitGuild,
@@ -543,6 +545,7 @@ impl UiScript {
         social::install(&lua)?;
         guild::install(&lua)?;
         binder::install(&lua)?;
+        gm_ticket::install(&lua)?;
         duel::install(&lua)?;
         follow::install(&lua)?;
         session::install(&lua)?;
diff --git a/crates/benilla-ui/src/script/model.rs b/crates/benilla-ui/src/script/model.rs
index 3bd44bd1..b27d8ea5 100644
--- a/crates/benilla-ui/src/script/model.rs
+++ b/crates/benilla-ui/src/script/model.rs
@@ -1321,6 +1321,19 @@ pub(crate) struct Model {
     /// `ConfirmBinder()` calls queued since the app last drained them — each is one
     /// `CMSG_BINDER_ACTIVATE`. A COUNT for [`Self::played_time_asks`]'s reason: the intent carries
     /// no payload (the app holds the innkeeper's guid), so two calls are two sends.
+    /// The `GMTicketCategory.dbc` rows behind `GetGMTicketCategories()` — `(id, name)` in file
+    /// order, pushed once by the app ([`super::UiScript::set_gm_ticket_categories`]). The ids are
+    /// the wire values, so this is an ordered pair list rather than an indexable table
+    /// (decision 1673).
+    pub(crate) gm_ticket_categories: Vec<(u32, String)>,
+    /// Every ticket verb the window called since the app's last drain, **in call order** — ask,
+    /// status-ask, delete, create, edit, one packet each. ONE queue rather than a counter per verb
+    /// so that `DeleteGMTicket(); GetGMTicket()` in a single chunk reaches the wire in that order;
+    /// per-verb drains cannot express it, and the get would answer with the pre-delete state
+    /// (decision 1673).
+    pub(crate) gm_ticket_intents: Vec<super::gm_ticket::GmTicketIntent>,
+    /// `Stuck()` calls queued — each is one cast of spell 7355, the Help window's Auto-Unstuck.
+    pub(crate) stuck_casts: u32,
     pub(crate) binder_confirms: u32,
     /// Is an innkeeper's bind question still live and in range — the answer `CheckBinderDist()`
     /// gives, pushed by the app each frame ([`super::UiScript::set_binder_pending`]). The
@@ -1658,6 +1671,9 @@ impl Model {
             screenshot_asks: 0,
             realm_name: String::new(),
             bind_location: String::new(),
+            gm_ticket_categories: Vec::new(),
+            gm_ticket_intents: Vec::new(),
+            stuck_casts: 0,
             binder_confirms: 0,
             binder_pending: false,
             framerate: 0.0,
diff --git a/crates/benilla-ui/src/script/tests/gm_ticket.rs b/crates/benilla-ui/src/script/tests/gm_ticket.rs
new file mode 100644
index 00000000..6a3d7277
--- /dev/null
+++ b/crates/benilla-ui/src/script/tests/gm_ticket.rs
@@ -0,0 +1,163 @@
+//! The Help window's seven engine globals ([`crate::script::gm_ticket`], decision 1673).
+//!
+//! Two claims carry the whole feature and each has a test named after it: the category list is
+//! **flat pairs consumed by Lua 5.0 varargs** (that is what `HelpFrameGM_UpdateCategories` reads),
+//! and the four payload-free verbs **count** rather than latch (that is what keeps the window's
+//! 10-minute ticket poll alive).
+
+use super::common::script;
+use crate::script::{GmTicketIntent, GmTicketWrite, UiScript};
+
+/// The catalog as the app pushes it: `GMTicketCategory.dbc`'s own ids and order.
+fn with_categories() -> UiScript {
+    let mut s = script();
+    s.set_gm_ticket_categories(vec![
+        (1, "Stuck".into()),
+        (2, "Behavior/Harassment".into()),
+        (3, "Guild".into()),
+    ]);
+    s
+}
+
+/// **`GetGMTicketCategories()` returns a FLAT (id, name) vararg list**, which the shipped window
+/// walks as `arg[i]` / `arg[i+1]` pairs with `arg.n` — the Lua 5.0 convention. A table here, or a
+/// list of names alone, would leave every category button unlabelled or unclickable.
+#[test]
+fn the_categories_come_back_as_a_flat_id_name_vararg_list() {
+    let s = with_categories();
+    let n: i64 = s
+        .eval("local f = function(...) return arg.n end return f(GetGMTicketCategories())")
+        .unwrap();
+    assert_eq!(n, 6, "three categories = six varargs");
+
+    let (id1, name1, id3, name3): (i64, String, i64, String) = s
+        .eval(
+            "local f = function(...) return arg[1], arg[2], arg[5], arg[6] end \
+             return f(GetGMTicketCategories())",
+        )
+        .unwrap();
+    assert_eq!((id1, name1.as_str()), (1, "Stuck"));
+    // The THIRD pair is at 5/6 — pairs, not a parallel pair of lists.
+    assert_eq!((id3, name3.as_str()), (3, "Guild"));
+}
+
+/// **The ids are the DBC's, not indices.** `HelpFrameGM_UpdateCategories` stores `arg[index]` as
+/// both `button.key` (an index into `HELPFRAME_FRAMES`) and `button.ticketType` (what goes on the
+/// wire), so a renumbered list would misfile every ticket under the wrong heading.
+#[test]
+fn the_ids_are_the_dbc_ids_not_list_positions() {
+    let mut s = script();
+    // A deliberately gappy, unsorted catalog — nothing may re-index it.
+    s.set_gm_ticket_categories(vec![(10, "Character".into()), (4, "Item".into())]);
+    let (a, b): (i64, i64) = s
+        .eval("local f = function(...) return arg[1], arg[3] end return f(GetGMTicketCategories())")
+        .unwrap();
+    assert_eq!((a, b), (10, 4), "ids and order pass through untouched");
+}
+
+/// No catalog is not an error: the window paints no category rows and cannot raise. This is the
+/// bare-XML harness, and a run with no client data.
+#[test]
+fn an_absent_catalog_returns_nothing_rather_than_erroring() {
+    let s = script();
+    let n: i64 = s
+        .eval("local f = function(...) return arg.n end return f(GetGMTicketCategories())")
+        .unwrap();
+    assert_eq!(n, 0);
+}
+
+/// **The verbs queue, they do not latch.** Two `GetGMTicket()` calls are two packets, because the
+/// ticket toast re-polls every 10 minutes from `TicketStatus_OnUpdate` — a latch would collapse the
+/// second poll into the first and the window would look hung.
+#[test]
+fn the_payload_free_verbs_queue_rather_than_latch() {
+    let mut s = script();
+    s.run("GetGMTicket() GetGMTicket() GetGMStatus() DeleteGMTicket() Stuck() Stuck() Stuck()")
+        .unwrap();
+    assert_eq!(
+        s.take_gm_ticket_intents(),
+        vec![
+            GmTicketIntent::Ask,
+            GmTicketIntent::Ask,
+            GmTicketIntent::AskStatus,
+            GmTicketIntent::Delete,
+        ]
+    );
+    assert_eq!(s.take_stuck_casts(), 3, "Stuck is not a ticket verb");
+    // Drained means drained — the next frame must not re-send.
+    assert!(s.take_gm_ticket_intents().is_empty());
+    assert_eq!(s.take_stuck_casts(), 0);
+}
+
+/// **Call order is wire order.** A chunk that abandons and then re-asks must reach the server in
+/// that order — reversed, the get answers with the state *before* the delete and the window is
+/// told it still has the ticket it just abandoned. Per-verb drains cannot express this, which is
+/// why there is one queue (decision 1673).
+#[test]
+fn the_queue_preserves_call_order_across_different_verbs() {
+    let mut s = script();
+    s.run("DeleteGMTicket() GetGMTicket()").unwrap();
+    assert_eq!(
+        s.take_gm_ticket_intents(),
+        vec![GmTicketIntent::Delete, GmTicketIntent::Ask],
+        "delete first, exactly as Lua called them"
+    );
+
+    // And the other way round, so the test cannot pass on a fixed per-verb ordering that merely
+    // happens to match one of the two cases.
+    s.run("GetGMTicket() DeleteGMTicket()").unwrap();
+    assert_eq!(
+        s.take_gm_ticket_intents(),
+        vec![GmTicketIntent::Ask, GmTicketIntent::Delete]
+    );
+
+    // Writes interleave with the bare verbs on the same queue.
+    s.run("NewGMTicket(1, \"a\") GetGMTicket()").unwrap();
+    assert!(matches!(
+        s.take_gm_ticket_intents().as_slice(),
+        [GmTicketIntent::Write(_), GmTicketIntent::Ask]
+    ));
+}
+
+/// **The window's verb survives to the app.** `NewGMTicket` and `UpdateGMTicket` share a signature
+/// but not an opcode, and the shipped window picks between them from its own `hasTicket` flag —
+/// so the choice is carried, never re-derived from what the client believes.
+#[test]
+fn new_and_update_are_distinguishable_and_keep_their_order() {
+    let mut s = script();
+    s.run("NewGMTicket(4, \"My sword vanished.\") UpdateGMTicket(4, \"Still gone.\")")
+        .unwrap();
+    assert_eq!(
+        s.take_gm_ticket_intents(),
+        vec![
+            GmTicketIntent::Write(GmTicketWrite {
+                category: 4,
+                text: "My sword vanished.".into(),
+                is_new: true,
+            }),
+            GmTicketIntent::Write(GmTicketWrite {
+                category: 4,
+                text: "Still gone.".into(),
+                is_new: false,
+            }),
+        ]
+    );
+}
+
+/// The Era arity is `(number, string)` — the reference's own usage string is
+/// `Usage: UpdateGMTicket(type, text)`. An empty ticket is the *window's* refusal to make, not
+/// ours: the binding queues whatever it is handed, and the engine's own emptiness check sits
+/// upstream of the send.
+#[test]
+fn an_empty_ticket_body_is_queued_not_swallowed() {
+    let mut s = script();
+    s.run("NewGMTicket(1, \"\")").unwrap();
+    assert_eq!(
+        s.take_gm_ticket_intents(),
+        vec![GmTicketIntent::Write(GmTicketWrite {
+            category: 1,
+            text: String::new(),
+            is_new: true,
+        })]
+    );
+}
diff --git a/crates/benilla-ui/src/script/tests/mod.rs b/crates/benilla-ui/src/script/tests/mod.rs
index d598032e..74df9761 100644
--- a/crates/benilla-ui/src/script/tests/mod.rs
+++ b/crates/benilla-ui/src/script/tests/mod.rs
@@ -16,6 +16,7 @@ mod events;
 mod font_object;
 mod frame_api;
 mod generic_for;
+mod gm_ticket;
 mod handler_prof;
 mod input;
 mod keyboard;