diff --git a/crates/benilla-app/src/capture/probe_book.rs b/crates/benilla-app/src/capture/probe_book.rs
index 94ddc955..c216d8a0 100644
--- a/crates/benilla-app/src/capture/probe_book.rs
+++ b/crates/benilla-app/src/capture/probe_book.rs
@@ -190,6 +190,22 @@ fn report_render(script: &UiScript) -> u32 {
     } else {
         info!("PROBE_BOOK: (render) PASS — no block is cut off with \"...\"");
     }
+    // **Does the page FIT?** The director's own comparison against 1.12.1 (08-15) was that ours
+    // ran off the bottom where the reference's ends inside the window. The scroll range answers it
+    // exactly and without an eye: it is the content's overhang past the viewport, so this page —
+    // which the reference shows whole — must come out at zero.
+    let range = script
+        .eval::<f64>("return ItemTextScrollFrame:GetVerticalScrollRange()")
+        .unwrap_or(-1.0);
+    if range == 0.0 {
+        info!("PROBE_BOOK: (render) PASS — the page fits the window (scroll range 0)");
+    } else {
+        fails += 1;
+        error!(
+            "PROBE_BOOK: (render) FAIL — the page overhangs its window by {range} units; the \
+             reference shows this one whole"
+        );
+    }
     fails
 }
 
diff --git a/crates/benilla-app/src/chat_bubble.rs b/crates/benilla-app/src/chat_bubble.rs
index 70da8e50..413338e0 100644
--- a/crates/benilla-app/src/chat_bubble.rs
+++ b/crates/benilla-app/src/chat_bubble.rs
@@ -448,33 +448,29 @@ fn draw_bubble(
     let border = border_px(viewport, basis);
     let margin = gx_px(MARGIN, basis);
 
-    // Shape at the nearest baked atlas size, then rescale to the exact window-derived em —
-    // the plate-text recipe (`crate::vplates::plate_text`).
+    // The exact window-derived em, laid out AT that em. This used to shape at the nearest baked
+    // ladder size and rescale the finished quads by `px/shaped` around the box centre — a bubble's
+    // size is derived from the viewport and so lands on nothing round, which meant every bubble on
+    // screen was a resampled bitmap. Since decision 1342 the raster follows the request.
     let px = text_px(TEXT_H, basis);
-    let shaped = atlas.snap_size(px);
-    if shaped <= 0.0 {
+    if px <= 0.0 {
         return;
     }
-    let s = px / shaped;
+    let mut e = atlas.lock();
     let spec = FontSpec {
-        path: None, // NAMEPLATE_FONT — Friz Quadrata, the atlas default
-        height: Some(shaped),
+        path: None, // NAMEPLATE_FONT — Friz Quadrata, the engine's default face
+        height: Some(px),
         outline: Outline::None,
-        paint_halo: true,
         alpha_gradient: None,
     };
     // The wrap law (`0x4b1600` tail): single-line width > 0.2 gx → hard-cap (forces wrap);
-    // else max(measured, 2·border-unit). All in shaped space, rescaled after.
-    let cap_s = gx_px(WRAP_W, basis) / s;
-    let floor_s = (2.0 * border) / s;
-    let (line_w, _) = measure_text(&atlas.metrics, &b.text, None, spec);
-    let box_w_s = if line_w > cap_s {
-        cap_s
-    } else {
-        line_w.max(floor_s)
-    };
-    let (_, box_h_s) = measure_text(&atlas.metrics, &b.text, Some(box_w_s), spec);
-    let (text_w, text_h) = ((box_w_s * s).ceil(), (box_h_s * s).ceil());
+    // else max(measured, 2·border-unit).
+    let cap = gx_px(WRAP_W, basis);
+    let floor = 2.0 * border;
+    let (line_w, _) = measure_text(&mut e, &b.text, None, spec);
+    let box_w = if line_w > cap { cap } else { line_w.max(floor) };
+    let (_, box_h) = measure_text(&mut e, &b.text, Some(box_w), spec);
+    let (text_w, text_h) = (box_w.ceil(), box_h.ceil());
 
     // The auto-fit body: the frame hugs the text layout ± the flat margin; BOTTOM-center on
     // the seat, growing upward. Snapped to whole logical px (the plate divergence — a
@@ -538,13 +534,13 @@ fn draw_bubble(
         color: [1.0, 1.0, 1.0, alpha],
         ..default()
     });
-    // The text: centered in the margin box, wrapped at the shaped-space cap, rescaled around
-    // the box center to the exact em (uniform, so wrap points survive the rescale).
+    // The text: centered in the margin box, wrapped at the cap. No rescale pass — the glyphs came
+    // out of the cache at this em.
     let center = Vec2::new(cx, (frame.min.y + frame.max.y) * 0.5);
     let mut text_quads = layout_text_quads(
-        atlas,
+        &mut e,
         &b.text,
-        Rect::from_center_size(center, Vec2::new(box_w_s, box_h_s)),
+        Rect::from_center_size(center, Vec2::new(box_w, box_h)),
         [b.color[0], b.color[1], b.color[2], alpha],
         Justify {
             h: JustifyH::Center,
@@ -553,14 +549,7 @@ fn draw_bubble(
         Z_TEXT,
         spec,
     );
-    for q in text_quads.iter_mut() {
-        q.rect = Rect::new(
-            center.x + (q.rect.min.x - center.x) * s,
-            center.y + (q.rect.min.y - center.y) * s,
-            center.x + (q.rect.max.x - center.x) * s,
-            center.y + (q.rect.max.y - center.y) * s,
-        );
-    }
+    drop(e);
     if trace {
         eprintln!(
             "bubble-trace: viewport={viewport:?} frame=({:.1},{:.1})..({:.1},{:.1}) border={border:.1} alpha={alpha:.2} text={:?}",
diff --git a/crates/benilla-app/src/combat_text/mod.rs b/crates/benilla-app/src/combat_text/mod.rs
index 2f8d8226..3b72ff82 100644
--- a/crates/benilla-app/src/combat_text/mod.rs
+++ b/crates/benilla-app/src/combat_text/mod.rs
@@ -33,7 +33,13 @@
 //! **The render geometry** (wow-re `worldtext-geometry-law.md`, §5-verified, 9af65294 — zero free
 //! parameters; the anchor-seat half corrected here, see the seating comment in
 //! [`float_combat_text`]): the rise is added to **world z before projection**; the block is
-//! **h-centered with its bottom at** the projected point (rising above it), clamped on-screen;
+//! **h-centered with its bottom at** the projected point (rising above it), clamped on-screen —
+//! but only once the projector has ACCEPTED the point at all: a number whose anchor lands behind
+//! the camera or outside the viewport is **destroyed and its slot released**
+//! (`6c7d9d` → `6c6dda` → `0x6c86a0`; wow-re `object-layer/scratch/nameplate-offscreen-cull.md`,
+//! §5-VERIFIED 2026-08-15), never clamped to a border and never claiming a bucket-1 rect. Ours
+//! clamped, which put another unit's numbers on the screen edge — the worldtext half of 1341's
+//! phantom plates, and the half that record's §7 wrongly called byte-attested;
 //! the on-screen size is
 //! **constant with unit distance** (the depth counter-scale exists only in the *nameplate* path)
 //! and composes as `px = round_half_away(v × √(W²+H²))` — `v` the category's interpolated scale
@@ -261,6 +267,11 @@ pub(crate) fn float_combat_text(
     bucket.clear();
     let mut order: Vec<usize> = (0..texts.0.len()).collect();
     order.sort_by_key(|&i| (texts.0[i].anchor, std::cmp::Reverse(texts.0[i].slot)));
+    // A number whose anchor fails the projector's accept verdict is **destroyed, and its slot
+    // released** (`6c7d9d` → `6c6dda` → `0x6c86a0`) — not skipped for a frame, and never clamped
+    // to a border (wow-re `object-layer/scratch/nameplate-offscreen-cull.md`, §5-VERIFIED
+    // 2026-08-15). Collected here and reaped after the walk, since the walk holds the list.
+    let mut culled: Vec<usize> = Vec::new();
     for i in order {
         let t = &texts.0[i];
         let cat = &CATEGORIES[t.category as usize];
@@ -269,18 +280,21 @@ pub(crate) fn float_combat_text(
         // The rise enters world z BEFORE the projection (`6c7d29 fadd` into `+0x1c`, projected at
         // `6c7d96`) — no post-projection y term exists.
         let world = t.pos + Vec3::Y * (cat.rise * life);
-        let Ok(screen) = cam.world_to_viewport(&cam_tf, world) else {
-            continue; // behind the camera
+        let Some(screen) = crate::ui_pass::project_overlay(cam, &cam_tf, world, viewport) else {
+            culled.push(i); // behind the camera or off the viewport — the ref destroys it
+            continue;
         };
         // The size law: constant with distance (no depth term anywhere in the worldtext path).
         let size_value = scale_value(t.category, life);
         let target_px = text_px(size_value, viewport);
-        // Shape at the atlas size nearest the target (crisp bitmaps), then scale the quad rects
-        // about the anchor point for the exact size — the crit pop animates through sizes the
-        // atlas never baked.
-        let shaped_px = atlas.snap_size(target_px);
+        // Laid out AT the target size. The crit pop animates through a continuum of sizes, which
+        // under the old fixed ladder meant shaping at the nearest rung and rescaling every quad
+        // about the anchor — a resampled bitmap for the whole animation. Now the pop steps through
+        // whole device-pixel sizes and each one is rasterized crisp (decision 1342). The real
+        // client stretched a ≤32 px raster here; rendering the true size is the recorded upgrade.
+        let mut e = atlas.lock();
         let mut glyphs = layout_text_quads(
-            atlas,
+            &mut e,
             &t.text,
             Rect::from_center_size(screen, Vec2::ZERO),
             argb(t.color),
@@ -290,21 +304,16 @@ pub(crate) fn float_combat_text(
             },
             Z_WORLD_TEXT,
             FontSpec {
-                path: None, // DAMAGE_TEXT_FONT = Friz Quadrata (the atlas default), no outline
-                height: Some(shaped_px),
+                path: None, // DAMAGE_TEXT_FONT = Friz Quadrata (the default face), no outline
+                height: Some(target_px),
                 outline: Outline::None,
-                paint_halo: true,
                 alpha_gradient: None,
             },
         );
-        let ratio = target_px / shaped_px;
+        drop(e);
         let (alpha_text, alpha_shadow) = fade_alpha(cat, elapsed_ms);
         let mut bounds: Option<Rect> = None;
         for q in &mut glyphs {
-            q.rect = Rect {
-                min: screen + (q.rect.min - screen) * ratio,
-                max: screen + (q.rect.max - screen) * ratio,
-            };
             // REPLACE, never multiply: the fade byte IS the rendered alpha (module doc, the
             // ALPHA + SHADOW law) — the packed color's alpha byte (row 4's 0x80) never draws.
             q.color[3] = f32::from(alpha_text) / 255.0;
@@ -365,6 +374,29 @@ pub(crate) fn float_combat_text(
         }
         quads.overlays.append(&mut glyphs);
     }
+    // The destroy half of the cull above. Releasing the SLOT is the point, not just skipping the
+    // draw: the per-unit array is 4 deep and a spawn past it is a hard drop, so a number aging out
+    // of sight behind you would otherwise hold a slot a visible number could have had.
+    drop_indices(&mut texts.0, culled);
+}
+
+/// Remove `idx` (in any order, no duplicates) from `v`, keeping the rest in order.
+///
+/// Its own function because the walk that decides *which* numbers to destroy runs over a sorted
+/// index permutation while the list is borrowed, so the removal has to happen afterwards by index
+/// — and index bookkeeping under removal is exactly the kind of thing that is quietly wrong for a
+/// month. Tested below.
+fn drop_indices<T>(v: &mut Vec<T>, mut idx: Vec<usize>) {
+    if idx.is_empty() {
+        return;
+    }
+    idx.sort_unstable();
+    let mut i = 0;
+    v.retain(|_| {
+        let keep = idx.binary_search(&i).is_err();
+        i += 1;
+        keep
+    });
 }
 
 /// The MELEE number/word producer: consumes [`SwingImpact`] (the swing clip's impact keyframe —
@@ -479,4 +511,20 @@ mod tests {
         let gold = texts.0.iter().find(|t| t.anchor == other).unwrap();
         assert_eq!(gold.color, COLOR_SPELL_GOLD);
     }
+
+    /// The destroy half of the off-screen cull (1344): the walk collects indices out of order,
+    /// against the *pre-removal* list, so the reap has to take them all at once and keep the rest
+    /// in order. Slots are freed by this and by nothing else.
+    #[test]
+    fn drop_indices_takes_exactly_those() {
+        let mut v = vec!["a", "b", "c", "d", "e"];
+        drop_indices(&mut v, vec![3, 0, 1]); // unsorted, as the seat walk produces them
+        assert_eq!(v, ["c", "e"]);
+        drop_indices(&mut v, vec![]);
+        assert_eq!(v, ["c", "e"], "no culls, no change");
+        drop_indices(&mut v, vec![1]);
+        assert_eq!(v, ["c"]);
+        drop_indices(&mut v, vec![0]);
+        assert!(v.is_empty());
+    }
 }
diff --git a/crates/benilla-app/src/loading_screen.rs b/crates/benilla-app/src/loading_screen.rs
index a7d83b98..51a1efd0 100644
--- a/crates/benilla-app/src/loading_screen.rs
+++ b/crates/benilla-app/src/loading_screen.rs
@@ -118,6 +118,15 @@ impl LoadingScreen {
         self.active
     }
 
+    /// An active cover, for tests that drive covered-frame accounting (the entry-load deferral).
+    #[cfg(test)]
+    pub(crate) fn test_covering() -> Self {
+        Self {
+            active: true,
+            ..Self::default()
+        }
+    }
+
     /// Raise (or re-arm) the screen for a fresh load. `awaiting_snap` marks a raise whose
     /// destination snap is still in flight; `map` is the destination when the edge knows it.
     fn raise(&mut self, reason: &str, awaiting_snap: bool, map: Option<u32>, now: f32) {
@@ -164,34 +173,13 @@ fn setup_loading_screen(
     world_assets: Option<ResMut<WorldAssets>>,
     mut images: ResMut<Assets<Image>>,
 ) {
-    let Some(mut assets) = world_assets else {
-        return;
-    };
-
-    // Catalog (LoadingScreenID → BLP path).
-    match load_loading_screens(&mut assets.chain.lock_recover()) {
-        Ok(c) => {
-            info!("LoadingScreens.dbc: {} screens catalogued", c.len());
-            commands.insert_resource(LoadingScreenCatalogRes(c));
-        }
-        Err(e) => {
-            error!("LoadingScreens.dbc unavailable, loading screen disabled: {e:#}");
-            return;
-        }
-    }
-
-    // The two layers 1.12 actually draws (sRGB clamp sprites — UI art, not tiling world art).
-    let mut tex = |path: &str| assets.sprite_texture(path, &mut images);
-    let Some(border) = tex("Interface\\Glues\\LoadingBar\\Loading-BarBorder.blp") else {
-        error!("loading bar textures missing, loading screen disabled");
-        return;
-    };
-    let fill = tex("Interface\\Glues\\LoadingBar\\Loading-BarFill.blp").unwrap_or_default();
-    // The spawned ImageNodes below own these handles (the root is never despawned, only hidden), so
-    // the textures stay resident without a separate holder resource.
-
-    // Root: fullscreen black — this IS the pillarbox letterbox. Flex-centres the 4:3 content area.
-    commands
+    // Root: fullscreen black — this IS the pillarbox letterbox, and it spawns UNCONDITIONALLY.
+    // Every `covering()` consumer (the world camera stays active to warm pipelines, the warm
+    // pass, the settle hold, and now the audio hold) behaves as if covered whenever
+    // `LoadingScreen::active` is true — so a missing catalog or bar texture must degrade to a
+    // plain black cover, never to "no cover node at all" while the whole client pretends one is
+    // up (the naked-world failure this used to be). Flex-centres the 4:3 content area.
+    let root = commands
         .spawn((
             LoadingRoot,
             Node {
@@ -207,73 +195,101 @@ fn setup_loading_screen(
             GlobalZIndex(1000),
             Visibility::Hidden,
         ))
-        .with_children(|root| {
-            // The whole loading screen renders in one 4:3 area fit to viewport height, centred, with
-            // the root's black showing as pillarbox bars L/R (the reference's behaviour — the glue/load
-            // screen is authored 4:3; on a wider window it letterboxes). Width = height·4/3 in vh.
-            // The backdrop + bar are children, so their verified fractions are relative to THIS area.
-            // Sibling paint order = spawn order: backdrop → fill → border (border on top).
-            root.spawn(Node {
-                width: Val::Vh(100.0 * BACKDROP_ASPECT),
-                height: Val::Vh(100.0),
-                position_type: PositionType::Relative,
-                ..default()
-            })
-            .with_children(|area| {
-                // Backdrop art: the square BLP stretched to fill the 4:3 area (mild widen — what the
-                // reference does). Starts black (default-white texture tinted) until the art resolves.
-                area.spawn((
-                    LoadingBackdrop,
-                    ImageNode {
-                        color: Color::BLACK,
-                        image_mode: NodeImageMode::Stretch,
-                        ..default()
-                    },
-                    Node {
-                        position_type: PositionType::Absolute,
-                        width: Val::Percent(100.0),
-                        height: Val::Percent(100.0),
-                        ..default()
-                    },
-                ));
-                // Fill — left-anchored; width = progress·FILL_MAX_WIDTH (set each frame). y from the
-                // BOTTOM (verified by screenshot + binary). The fill art is a horizontally-uniform
-                // gradient, so width-scaling reads as a left→right reveal.
-                area.spawn((
-                    LoadingBarFill,
-                    Node {
-                        position_type: PositionType::Absolute,
-                        left: Val::Percent(FILL_LEFT * 100.0),
-                        bottom: Val::Percent(FILL_BOTTOM * 100.0),
-                        width: Val::Percent(0.0), // set each frame
-                        height: Val::Percent(FILL_HEIGHT * 100.0),
-                        ..default()
-                    },
-                    ImageNode {
-                        image: fill,
-                        image_mode: NodeImageMode::Stretch,
-                        ..default()
-                    },
-                ));
-                // Border frame, on top.
-                area.spawn((
-                    LoadingBarBorder,
-                    Node {
-                        position_type: PositionType::Absolute,
-                        left: Val::Percent(BORDER_LEFT * 100.0),
-                        bottom: Val::Percent(BORDER_BOTTOM * 100.0),
-                        width: Val::Percent(BORDER_WIDTH * 100.0),
-                        height: Val::Percent(BORDER_HEIGHT * 100.0),
-                        ..default()
-                    },
-                    ImageNode {
-                        image: border,
-                        image_mode: NodeImageMode::Stretch,
-                        ..default()
-                    },
-                ));
-            });
+        .id();
+
+    let Some(mut assets) = world_assets else {
+        return;
+    };
+
+    // Catalog (LoadingScreenID → BLP path).
+    match load_loading_screens(&mut assets.chain.lock_recover()) {
+        Ok(c) => {
+            info!("LoadingScreens.dbc: {} screens catalogued", c.len());
+            commands.insert_resource(LoadingScreenCatalogRes(c));
+        }
+        Err(e) => {
+            error!("LoadingScreens.dbc unavailable — plain black cover, no art: {e:#}");
+            return;
+        }
+    }
+
+    // The two layers 1.12 actually draws (sRGB clamp sprites — UI art, not tiling world art).
+    let mut tex = |path: &str| assets.sprite_texture(path, &mut images);
+    let Some(border) = tex("Interface\\Glues\\LoadingBar\\Loading-BarBorder.blp") else {
+        error!("loading bar textures missing — plain black cover, no art");
+        return;
+    };
+    let fill = tex("Interface\\Glues\\LoadingBar\\Loading-BarFill.blp").unwrap_or_default();
+    // The spawned ImageNodes below own these handles (the root is never despawned, only hidden), so
+    // the textures stay resident without a separate holder resource.
+
+    commands.entity(root).with_children(|root| {
+        // The whole loading screen renders in one 4:3 area fit to viewport height, centred, with
+        // the root's black showing as pillarbox bars L/R (the reference's behaviour — the glue/load
+        // screen is authored 4:3; on a wider window it letterboxes). Width = height·4/3 in vh.
+        // The backdrop + bar are children, so their verified fractions are relative to THIS area.
+        // Sibling paint order = spawn order: backdrop → fill → border (border on top).
+        root.spawn(Node {
+            width: Val::Vh(100.0 * BACKDROP_ASPECT),
+            height: Val::Vh(100.0),
+            position_type: PositionType::Relative,
+            ..default()
+        })
+        .with_children(|area| {
+            // Backdrop art: the square BLP stretched to fill the 4:3 area (mild widen — what the
+            // reference does). Starts black (default-white texture tinted) until the art resolves.
+            area.spawn((
+                LoadingBackdrop,
+                ImageNode {
+                    color: Color::BLACK,
+                    image_mode: NodeImageMode::Stretch,
+                    ..default()
+                },
+                Node {
+                    position_type: PositionType::Absolute,
+                    width: Val::Percent(100.0),
+                    height: Val::Percent(100.0),
+                    ..default()
+                },
+            ));
+            // Fill — left-anchored; width = progress·FILL_MAX_WIDTH (set each frame). y from the
+            // BOTTOM (verified by screenshot + binary). The fill art is a horizontally-uniform
+            // gradient, so width-scaling reads as a left→right reveal.
+            area.spawn((
+                LoadingBarFill,
+                Node {
+                    position_type: PositionType::Absolute,
+                    left: Val::Percent(FILL_LEFT * 100.0),
+                    bottom: Val::Percent(FILL_BOTTOM * 100.0),
+                    width: Val::Percent(0.0), // set each frame
+                    height: Val::Percent(FILL_HEIGHT * 100.0),
+                    ..default()
+                },
+                ImageNode {
+                    image: fill,
+                    image_mode: NodeImageMode::Stretch,
+                    ..default()
+                },
+            ));
+            // Border frame, on top.
+            area.spawn((
+                LoadingBarBorder,
+                Node {
+                    position_type: PositionType::Absolute,
+                    left: Val::Percent(BORDER_LEFT * 100.0),
+                    bottom: Val::Percent(BORDER_BOTTOM * 100.0),
+                    width: Val::Percent(BORDER_WIDTH * 100.0),
+                    height: Val::Percent(BORDER_HEIGHT * 100.0),
+                    ..default()
+                },
+                ImageNode {
+                    image: border,
+                    image_mode: NodeImageMode::Stretch,
+                    ..default()
+                },
+            ));
         });
+    });
 }
 
 /// Per-frame: observe the lifecycle edges, run the trigger/clear state machine, resolve backdrop
@@ -303,6 +319,11 @@ fn drive_loading_screen(
     // The 0837 warm pass: the cover holds until the menagerie's pipelines have compiled — the
     // point of the cover is that NOTHING first-sight-compiles after it lifts.
     warm: Res<crate::pipe_warm::WarmPass>,
+    // The deferred world-entry UI load (0962's frame accounting, applied to 1051's burst):
+    // armed at the entry edge, run behind this cover a few frames in. While it is still
+    // pending the reveal would show a world with no interface — the reference's reveal always
+    // has the UI up, because its UI load happens inside its blocking world load.
+    entry_ui_pending: Option<Res<crate::ui_script::PendingEntryUiLoad>>,
     // The lifecycle edges (decisions 0737/0738), all observed from what the net bridge already
     // publishes — this module owns the whole state machine, nothing else is instrumented for it.
     edges: (
@@ -425,6 +446,7 @@ fn drive_loading_screen(
             && !screen.awaiting_snap
             && !player_settling
             && warm.satisfied()
+            && entry_ui_pending.is_none()
         {
             screen.ready_frames += 1;
             if screen.ready_frames >= CLEAR_AFTER_READY_FRAMES {
@@ -445,7 +467,7 @@ fn drive_loading_screen(
                 screen.last_wait_log = now;
                 info!(
                     "loading screen: waiting {:.1}s — {}/{} resident, {} placements pending, \
-                     {} colliders pending, awaiting_snap={}, settling={}, warm={}",
+                     {} colliders pending, awaiting_snap={}, settling={}, warm={}, ui_pending={}",
                     now - screen.active_since,
                     progress.ready,
                     progress.total,
@@ -454,6 +476,7 @@ fn drive_loading_screen(
                     screen.awaiting_snap,
                     player_settling,
                     warm.satisfied(),
+                    entry_ui_pending.is_some(),
                 );
             }
         }
diff --git a/crates/benilla-app/src/nameplates.rs b/crates/benilla-app/src/nameplates.rs
index 067e2160..1b982d9c 100644
--- a/crates/benilla-app/src/nameplates.rs
+++ b/crates/benilla-app/src/nameplates.rs
@@ -163,20 +163,26 @@ impl NamePaint {
 /// atlas exists), one mesh per distinct line stack (every "Young Wolf" shares one mesh), and the
 /// live per-unit plate entities.
 ///
-/// **Every field here is atlas-derived and dies with the bake it was built from** ([`baked_from`]).
-/// The meshes carry glyph-cell UVs in their vertex data ([`build_name_mesh`]) and the materials
-/// bind the atlas image by handle — both are readings of ONE `UiFontAtlas`, and a re-bake
-/// (`ui_text::atlas`'s `BakeEnv` edge, decision 1296) replaces that atlas with a new image and a
-/// new cell layout. Keeping either across the edge draws new-bake UVs through the old-bake
-/// texture: the garbage-glyph unit names the maximised window produced (B272, decision 1339).
+/// **The meshes are glyph-cell UVs on the GPU, and they die with the cell layout they were built
+/// from** ([`baked_from`]). This is the one place in the codebase that persists glyph UVs across
+/// frames ([`build_name_mesh`] bakes them into `ATTRIBUTE_UV_0`), which makes it the one place that
+/// has to watch [`UiFontAtlas::generation`].
+///
+/// The **materials** used to be on that list and no longer are: they bind the glyph sheet by
+/// handle, and since decision 1342 that texture is written in place and its handle never changes.
+/// It was the old size ladder's re-bake — a whole new image asset per window resize — that made a
+/// bound handle go stale, and drawing new-bake UVs through the old-bake texture is what turned unit
+/// names into fragments of other letters (B272, decision 1339). There is no successor texture now,
+/// so there is nothing for a material to go stale against; only the UVs can move, and only when the
+/// sheet fills and resets.
 #[derive(Resource, Default)]
 pub(crate) struct Nameplates {
     materials: HashMap<NamePaint, Handle<StandardMaterial>>,
     meshes: HashMap<Vec<String>, Handle<Mesh>>,
     /// unit → (plate entity, the (lines, color) it was built with).
     live: bevy::ecs::entity::EntityHashMap<(Entity, Vec<String>, NamePaint)>,
-    /// The `UiFontAtlas::generation` every cache above was built from — `None` before the first
-    /// build. [`drop_stale_atlas_caches`] empties all three when it moves.
+    /// The `UiFontAtlas::generation` the meshes' UVs were built from — `None` before the first
+    /// build. [`drop_stale_glyph_caches`] empties them when it moves.
     baked_from: Option<u64>,
 }
 
@@ -213,8 +219,15 @@ const ROCK_MEAN_RATE: f32 = 1.5;
 /// mean to it instead of easing through seconds of misplaced name.
 const ROCK_SNAP: f32 = 1.0;
 
-/// The shaped-glyph source size (px) for the mesh bake — a baked atlas size (crisp cells); only
-/// the cell UVs and the relative geometry survive the normalization to pitch units.
+/// The source size (logical px) the name glyphs are rasterized at for the mesh bake. Only the cell
+/// UVs and the *relative* geometry survive the normalization to pitch units, so this is purely a
+/// resolution dial: the world transform scales the block to its real size, and a bigger source
+/// means crisper letters when a name is close.
+///
+/// The real client's unit-name font is pinned at a 32-px raster and magnifies the cells for every
+/// plate (`UNIT_NAME_FONT`, size `0.99f` with string flag `0x80` — wow-re `system/font`, so its
+/// world text was always a stretched bitmap). Rendering the source larger is the same recorded
+/// crispness divergence world text already takes at the [`crate::ui_text::FONTSTRING_EM_CAP`].
 const BAKE_PX: f32 = 36.0;
 
 /// Build one name-block mesh in **name-local pitch units**: x centered on 0 (exact centering for
@@ -239,11 +252,17 @@ fn build_name_mesh(atlas: &mut UiFontAtlas, lines: &[String]) -> Mesh {
     // asc/(asc+|desc|))` load_param the 2-D path seats with) — needed to hang each line FROM its
     // baseline. Invariant to the ratio's value: `line_top` shifts with it but the baseline stays
     // pinned to the byte grid, so this only has to AGREE with `layout_text_quads`, not be exact.
-    let baseline_frac = ((f64::from(BAKE_PX) * f64::from(atlas.ascent_ratio(None)) + 0.5).floor()
-        / f64::from(BAKE_PX)) as f32;
+    let mut e = atlas.lock();
+    // The size the glyphs are ACTUALLY laid out at: [`BAKE_PX`] rounded to whole device pixels and
+    // back ([`TextEngine::ppem`]). Normalizing by the requested 36 instead would be off by up to
+    // half a device pixel per unit of pitch on a fractional-DPI display — small, but it is exactly
+    // the kind of "close enough" that the size ladder was made of.
+    let src = e.drawn_size(BAKE_PX);
+    let baseline_frac =
+        ((f64::from(src) * f64::from(e.ascent_ratio(None)) + 0.5).floor() / f64::from(src)) as f32;
     for (i, line) in lines.iter().enumerate() {
         let glyphs = layout_text_quads(
-            atlas,
+            &mut e,
             line,
             Rect::from_center_size(Vec2::ZERO, Vec2::ZERO),
             [1.0, 1.0, 1.0, 1.0], // the material tints; glyph alpha rides the texture
@@ -253,10 +272,9 @@ fn build_name_mesh(atlas: &mut UiFontAtlas, lines: &[String]) -> Mesh {
             },
             0,
             FontSpec {
-                path: None, // UNIT_NAME_FONT = Friz Quadrata, the atlas default
+                path: None, // UNIT_NAME_FONT = Friz Quadrata, the default face
                 height: Some(BAKE_PX),
                 outline: Outline::None,
-                paint_halo: true,
                 alpha_gradient: None,
             },
         );
@@ -271,10 +289,10 @@ fn build_name_mesh(atlas: &mut UiFontAtlas, lines: &[String]) -> Mesh {
         // of a cell below the cell top, so the cell top maps to n − i + baseline_frac.
         let line_top = n - i as f32 + baseline_frac;
         for q in &glyphs {
-            let x0 = (q.rect.min.x - cx) / BAKE_PX;
-            let x1 = (q.rect.max.x - cx) / BAKE_PX;
-            let y0 = line_top - q.rect.min.y / BAKE_PX; // px top → local (higher)
-            let y1 = line_top - q.rect.max.y / BAKE_PX; // px bottom → local (lower)
+            let x0 = (q.rect.min.x - cx) / src;
+            let x1 = (q.rect.max.x - cx) / src;
+            let y0 = line_top - q.rect.min.y / src; // px top → local (higher)
+            let y1 = line_top - q.rect.max.y / src; // px bottom → local (lower)
             let base = positions.len() as u32;
             positions.extend([[x0, y0, 0.0], [x1, y0, 0.0], [x1, y1, 0.0], [x0, y1, 0.0]]);
             let [tl, tr, br, bl] = q.uv.corners;
@@ -283,6 +301,7 @@ fn build_name_mesh(atlas: &mut UiFontAtlas, lines: &[String]) -> Mesh {
             indices.extend([base, base + 2, base + 1, base, base + 3, base + 2]);
         }
     }
+    drop(e);
     let mut mesh = Mesh::new(
         PrimitiveTopology::TriangleList,
         RenderAssetUsages::default(),
@@ -348,8 +367,8 @@ pub(crate) fn drive_nameplates(
     let (Ok(cam_tf), Some(atlas)) = (camera.single(), atlas.as_mut()) else {
         return;
     };
-    // A re-baked atlas invalidates every cache below it (see [`Nameplates`]).
-    drop_stale_atlas_caches(&mut plates, atlas.generation, &mut commands);
+    // A glyph-sheet reset moves every cached UV (see [`Nameplates`]).
+    drop_stale_glyph_caches(&mut plates, atlas.generation, &mut commands);
     // The palette materials, once (they need the atlas image).
     if plates.materials.is_empty() {
         let image = atlas.image();
@@ -669,27 +688,30 @@ impl Plugin for NameplatesPlugin {
     }
 }
 
-/// Empty every atlas-derived cache when the bake under it moves — the staleness edge [`Nameplates`]
+/// Empty the UV-bearing caches when the glyph sheet resets — the staleness edge [`Nameplates`]
 /// describes.
 ///
-/// A re-bake hands us a different image and a different cell layout, so the meshes' baked UVs and
-/// the materials' bound texture both stop meaning what they meant. Dropping the maps alone is not
-/// enough: the live plate entities still hold their old `Mesh3d`/`MeshMaterial3d` handles, so they
-/// are despawned too and rebuilt from the new atlas on this same frame's walk below (which
-/// re-enters every visible unit). That one-frame rebuild is the whole cost of a re-bake here.
+/// A reset repacks the sheet from empty, so every UV baked into a mesh stops pointing at its own
+/// letter. Dropping the mesh map alone is not enough: the live plate entities still hold their old
+/// `Mesh3d` handles, so they are despawned too and rebuilt on this same frame's walk below (which
+/// re-enters every visible unit). That one-frame rebuild is the whole cost of a reset here.
+///
+/// The **materials survive**, because the sheet's texture handle does (decision 1342). Under the
+/// old size ladder this edge fired on every window resize and had to drop them too; now it fires
+/// only when the sheet fills, which the occupancy instrument (`WOW_GLYPH_CACHE=1`) exists to keep
+/// honest.
 ///
 /// The **first** build is not an edge — `baked_from: None` seeds to the live generation with
 /// nothing to drop.
-fn drop_stale_atlas_caches(plates: &mut Nameplates, generation: u64, commands: &mut Commands) {
+fn drop_stale_glyph_caches(plates: &mut Nameplates, generation: u64, commands: &mut Commands) {
     if plates.baked_from == Some(generation) {
         return;
     }
     if plates.baked_from.is_some() {
         debug!(
-            "nameplates: atlas re-baked (generation {generation}) — dropping {} meshes, {} \
-             materials and {} live plates",
+            "nameplates: glyph sheet reset (generation {generation}) — dropping {} meshes and {} \
+             live plates",
             plates.meshes.len(),
-            plates.materials.len(),
             plates.live.len(),
         );
         for (plate, _, _) in plates.live.values() {
@@ -699,15 +721,14 @@ fn drop_stale_atlas_caches(plates: &mut Nameplates, generation: u64, commands: &
         }
         plates.live.clear();
         plates.meshes.clear();
-        plates.materials.clear();
     }
     plates.baked_from = Some(generation);
 }
 
 /// Drop the per-line-stack mesh dedup on a cross-map transition (`world_map::MapChange` — see its
 /// doc): it grows with every distinct name ever seen and the old map's population never comes
-/// back. The palette `materials` stay — they are keyed by the atlas bake, not the map
-/// ([`drop_stale_atlas_caches`] owns that edge).
+/// back. The palette `materials` stay — they bind the one stable glyph sheet and outlive both this
+/// edge and [`drop_stale_glyph_caches`]'s.
 fn evict_name_meshes(
     mut changes: MessageReader<benilla_world::world_map::MapChange>,
     mut plates: ResMut<Nameplates>,
@@ -815,19 +836,19 @@ mod tests {
         plates
     }
 
-    /// **A re-bake empties every atlas-derived cache, live plates included** (B272, decision 1339).
+    /// **A sheet reset empties every UV-bearing cache, live plates included** (B272, decision
+    /// 1339; narrowed by 1342).
     ///
-    /// The meshes carry glyph-cell UVs in vertex data and the materials bind the atlas image by
-    /// handle. A re-bake replaces the atlas with a new image whose HEIGHT is a function of the
-    /// seam-dependent size ladder, so every normalized V from the old bake addresses a different
-    /// row of the new one. Keeping the material while rebuilding meshes is what drew new-bake UVs
-    /// through the old-bake texture — unit names as fragments of other letters.
+    /// The meshes carry glyph-cell UVs in vertex data, and a reset repacks the sheet from empty, so
+    /// every one of them stops pointing at its own letter. Dropping the map is not enough on its
+    /// own: the live plate entities still hold the old `Mesh3d`, so they must be despawned to be
+    /// rebuilt. That is the assertion a map-clear alone would pass and the screen would not.
     ///
-    /// Dropping the maps is not enough on its own: the live plate entities still hold the old
-    /// `Mesh3d`/`MeshMaterial3d`, so they must be despawned to be rebuilt. That is the assertion
-    /// the map-clear alone would pass and the screen would not.
+    /// The materials must **survive** — they bind a texture whose handle never changes. Dropping
+    /// them was right when a re-bake published a new image every window resize; keeping them now is
+    /// the difference between rebuilding a handful of meshes and rebuilding the whole palette.
     #[test]
-    fn a_rebake_drops_the_meshes_the_materials_and_the_live_plates() {
+    fn a_sheet_reset_drops_the_meshes_and_the_live_plates_but_not_the_materials() {
         let mut world = World::new();
         let unit = world.spawn_empty().id();
         let plate = world.spawn_empty().id();
@@ -836,29 +857,29 @@ mod tests {
         let mut queue = bevy::ecs::world::CommandQueue::default();
         {
             let mut commands = Commands::new(&mut queue, &world);
-            drop_stale_atlas_caches(&mut plates, 8, &mut commands);
+            drop_stale_glyph_caches(&mut plates, 8, &mut commands);
         }
         queue.apply(&mut world);
 
         assert!(plates.meshes.is_empty(), "stale UVs must not survive");
-        assert!(
-            plates.materials.is_empty(),
-            "the material binds the OLD atlas image — the half that made it garbage rather than \
-             merely soft"
+        assert_eq!(
+            plates.materials.len(),
+            1,
+            "the material binds a texture whose handle never moves — dropping it is pure churn"
         );
         assert!(plates.live.is_empty());
         assert!(
             world.get_entity(plate).is_err(),
-            "a live plate holds the old mesh+material handles: clearing the maps around it leaves \
-             the wrong cells on screen"
+            "a live plate holds the old mesh handle: clearing the map around it leaves the wrong \
+             cells on screen"
         );
         assert_eq!(plates.baked_from, Some(8));
     }
 
-    /// The FIRST build is not an edge — there is nothing baked from a previous atlas to drop, and
+    /// The FIRST build is not an edge — there is nothing from a previous cell layout to drop, and
     /// treating it as one would despawn the plates the same frame they were spawned.
     #[test]
-    fn the_first_bake_seeds_without_dropping_anything() {
+    fn the_first_build_seeds_without_dropping_anything() {
         let mut world = World::new();
         let unit = world.spawn_empty().id();
         let plate = world.spawn_empty().id();
@@ -867,7 +888,7 @@ mod tests {
         let mut queue = bevy::ecs::world::CommandQueue::default();
         {
             let mut commands = Commands::new(&mut queue, &world);
-            drop_stale_atlas_caches(&mut plates, 0, &mut commands);
+            drop_stale_glyph_caches(&mut plates, 0, &mut commands);
         }
         queue.apply(&mut world);
 
@@ -877,9 +898,10 @@ mod tests {
         assert_eq!(plates.baked_from, Some(0));
     }
 
-    /// The steady frame — every frame that is not a re-bake — costs nothing and keeps everything.
+    /// The steady frame — every frame that is not a reset, which is very nearly all of them —
+    /// costs nothing and keeps everything.
     #[test]
-    fn an_unmoved_bake_is_a_no_op() {
+    fn an_unmoved_generation_is_a_no_op() {
         let mut world = World::new();
         let unit = world.spawn_empty().id();
         let plate = world.spawn_empty().id();
@@ -888,7 +910,7 @@ mod tests {
         let mut queue = bevy::ecs::world::CommandQueue::default();
         {
             let mut commands = Commands::new(&mut queue, &world);
-            drop_stale_atlas_caches(&mut plates, 3, &mut commands);
+            drop_stale_glyph_caches(&mut plates, 3, &mut commands);
         }
         queue.apply(&mut world);
 
diff --git a/crates/benilla-app/src/net.rs b/crates/benilla-app/src/net.rs
index 661f61b0..21530225 100644
--- a/crates/benilla-app/src/net.rs
+++ b/crates/benilla-app/src/net.rs
@@ -138,10 +138,29 @@ impl Plugin for NetPlugin {
                     .in_set(WorldStage::Net),
             )
             // Not part of the movement chain above: one send on the world-enter message.
-            .add_systems(Update, send_query_time.in_set(WorldStage::Net));
+            .add_systems(Update, send_query_time.in_set(WorldStage::Net))
+            .add_systems(Update, population_pulse.in_set(WorldStage::Net));
     }
 }
 
+/// The population pulse (`WOW_MOVE_TRACE_TAGS=pop`): once a second, one trace line with the count
+/// of net entities resident in the object index. The "did the world arrive" instrument, born as
+/// decision 1340's retest: a teleport's visibility refresh (the release-time position report)
+/// reads as the count climbing within a couple of seconds of the `sett` release, while the ~20 s
+/// lazy-relocation pop-in the report guards against reads as the count sitting still until the
+/// server's own timer fires. Free when the tag is off.
+fn population_pulse(index: Res<GuidIndex>, time: Res<Time>, mut last: Local<f32>) {
+    if !benilla_assets::trace::enabled_for("pop") {
+        return;
+    }
+    let now = time.elapsed_secs();
+    if now - *last < 1.0 {
+        return;
+    }
+    *last = now;
+    benilla_assets::trace::line("pop", &format!("net entities={}", index.0.len()));
+}
+
 // ── ECS state: components ────────────────────────────────────────────────────────────────────────
 
 /// The server guid of a streamed entity. The one stable identity for a unit/player/GameObject.
@@ -698,6 +717,7 @@ pub(crate) static CAST_TRACE: std::sync::LazyLock<bool> =
 
 /// A message the ECS sends to the server through the write thread. Carries the player's pose so the
 /// writer thread needs no shared state.
+#[derive(Debug)]
 pub(crate) enum ClientCommand {
     /// A self-movement packet: the [`MoveKind`] opcode + the live CMovement `flags` + our pose, plus the
     /// airborne clock (`fall_time`, ms) and ballistic launch tail (`jump`) while jumping/falling. The
diff --git a/crates/benilla-app/src/player/state.rs b/crates/benilla-app/src/player/state.rs
index 004b2686..c47176f6 100644
--- a/crates/benilla-app/src/player/state.rs
+++ b/crates/benilla-app/src/player/state.rs
@@ -612,6 +612,14 @@ pub(crate) struct Player {
     /// it drops the ride + spline without mirroring the stale flight pose over the snap (the
     /// 4-yd-hover + full-6s-settle landing bug, decision 0501) and owes no `CMSG_MOVE_SPLINE_DONE`.
     pub(super) ride_abort: bool,
+    /// **A `MSG_MOVE_WORLDPORT_ACK` is owed, payable at the settle release** (decision 1340).
+    /// The real client sends the worldport ack as the LAST act of its blocking destination load
+    /// (wow-re: `0x401bc0` sends `0xDC` at `0x401cae` only after `0x66fbe0`'s load returns) — our
+    /// async re-expression of "after the load" is the release. Safe to defer: vmangos has no load
+    /// timeout, drops every packet we'd send meanwhile (the player is out-of-world for the whole
+    /// window), and force-acks at logout. Set by the non-riding worldport snap; a riding crossing
+    /// (0455) never settles and acks immediately, as before.
+    pub(crate) owes_worldport_ack: bool,
     /// `Time::elapsed_secs` when we last sent a heartbeat.
     pub(super) last_heartbeat: f32,
     /// `Time::elapsed_secs` when the current airborne phase (jump or step-off) began, else `None` on the
diff --git a/crates/benilla-app/src/player/wire_in.rs b/crates/benilla-app/src/player/wire_in.rs
index 2546f0b3..bc2125c4 100644
--- a/crates/benilla-app/src/player/wire_in.rs
+++ b/crates/benilla-app/src/player/wire_in.rs
@@ -21,7 +21,7 @@ use benilla_assets::coords::{bevy_to_wow, wow_to_bevy};
 
 use crate::creature_anim::{move_flags, wrap_pi};
 use crate::net::{
-    ClientCommand, ClientControlMessage, Embodied, Guid, MoveKind, MoveModeMessage, NetCommands,
+    ClientCommand, ClientControlMessage, Embodied, Guid, MoveModeMessage, NetCommands,
     SelfMoveMessage, SpeedChangeMessage, TeleportMessage, WorldportMessage,
 };
 use crate::transport::Transport;
@@ -266,17 +266,25 @@ pub(super) fn apply_server_moves(
                                       // loaded map. If terrain setup never ran (no `./WoW/`), inserting is harmless.
         commands.insert_resource(CurrentMap(w.map_id));
         if w.needs_ack {
-            let _ = net_cmds.0.send(ClientCommand::WorldportAck);
-            info!(
-                "worldport: mapId {} @ {:?} ({}, acked)",
-                w.map_id,
-                w.position,
-                if riding {
-                    "riding, boat-local pose"
-                } else {
-                    "world pose"
-                }
-            );
+            if riding {
+                // A riding crossing never settles (the deck is the support, 0455) — ack now,
+                // exactly as before 1340.
+                let _ = net_cmds.0.send(ClientCommand::WorldportAck);
+                info!(
+                    "worldport: mapId {} @ {:?} (riding, boat-local pose, acked)",
+                    w.map_id, w.position
+                );
+            } else {
+                // The ack rides the settle release (decision 1340): the real client sends
+                // MSG_MOVE_WORLDPORT_ACK only after its blocking destination load completes, and
+                // vmangos keeps us out-of-world — dropping everything we'd send — until the ack
+                // lands, with no load timeout. See [`Player::owes_worldport_ack`].
+                player.owes_worldport_ack = true;
+                info!(
+                    "worldport: mapId {} @ {:?} (world pose, ack deferred to release)",
+                    w.map_id, w.position
+                );
+            }
         } else {
             info!(
                 "worldport: initial login on mapId {} @ {:?}",
@@ -304,29 +312,20 @@ pub(super) fn apply_server_moves(
         // and drops the ride instead of mirroring the stale flight pose back over this snap
         // (decision 0501 — the 4-yd hover + full-6s settle at every taxi landing).
         player.ride_abort = true;
+        // The echo goes now, and it is the WHOLE near-teleport handshake (decision 1340). The
+        // real client echoes on the very next movement tick (wow-re: the 0xC7 drain applies the
+        // snap, then `0x60e0a0` sends guid+counter+time) and sends nothing else — no
+        // `MSG_MOVE_STOP` exists anywhere in its chain. vmangos holds us at the OLD position
+        // until the echo lands; processing it runs the full relocation + visibility refresh
+        // (`ExecuteTeleportNear` → `TeleportPositionRelocation`), and the destination's units
+        // stream within ~1 s of this send — measured with the `pop` pulse, four legs, no
+        // stall. The invented echo-time Stop this arm used to send served nothing; if a
+        // silent-player pop-in ever resurfaces, `WOW_MOVE_TRACE_TAGS=pop` decides in one run.
         let _ = net_cmds.0.send(ClientCommand::TeleportAck {
             guid: t.guid,
             counter: t.counter,
         });
-        // After the ack, report our settled position. vmangos refreshes a STATIONARY player's
-        // surrounding object visibility only on its lazy relocation timer (~20s observed), but forces
-        // an immediate refresh on any received movement packet. Without this, the NPCs/GameObjects at
-        // the destination don't appear for ~20s after a teleport (yet a fresh login is instant, because
-        // that does a full world-enter) — the real client reports its position, so they show at once.
-        let _ = net_cmds.0.send(ClientCommand::Move {
-            kind: MoveKind::Stop,
-            flags: 0,
-            pos: t.position,
-            orientation: t.orientation,
-            pitch: 0.0, // a Stop clears the flags → not swimming → no pitch tail
-            fall_time: 0,
-            jump: None,
-            transport: None, // flags 0 → no transport tail
-        });
-        info!(
-            "teleport: snapped to {:?}, acked + reported position",
-            t.position
-        );
+        info!("teleport: snapped to {:?}, acked", t.position);
     }
     // A bare server-authored move for our own mover (decision 0725) — no handshake, no ack. Drained
     // after the teleport arms deliberately: a teleport in the same frame is the larger edge (it
@@ -609,6 +608,11 @@ pub(super) fn release_on_session_end(
         player.airborne_since = None;
         player.wedged = false;
         player.wedge_still = 0;
+        // The arrival debt dies with the session (decision 1340): a logout mid-settle must not
+        // carry a worldport ack into the NEXT login's settle release — the server would reject
+        // an ack from a player who is in world (vmangos ProcessPackets, STATUS_TRANSFER), and
+        // the old session's transfer was already force-acked server-side at logout.
+        player.owes_worldport_ack = false;
     }
 }
 
diff --git a/crates/benilla-app/src/player/world_focus.rs b/crates/benilla-app/src/player/world_focus.rs
index 25d9d8b4..d2fac828 100644
--- a/crates/benilla-app/src/player/world_focus.rs
+++ b/crates/benilla-app/src/player/world_focus.rs
@@ -106,6 +106,7 @@ pub(super) fn release_post_snap_hold(
     progress: Option<Res<WorldLoadProgress>>,
     time: Res<Time>,
     mut last_counters: Local<Option<[usize; 4]>>,
+    net_cmds: Option<Res<crate::net::NetCommands>>,
 ) {
     let Some(p) = progress else { return };
     // **The facts must be about the ground under our own feet** (decision 1336, B263 round 3).
@@ -151,6 +152,17 @@ pub(super) fn release_post_snap_hold(
     } else if now >= player.settle_deadline {
         player.end_settle(false, now);
     }
+    // **Pay the worldport ack the moment the hold ends** (decision 1340) — on either end, the
+    // resident release or the stall timeout (a dead stream must still complete the transfer, or
+    // the server holds us out-of-world until logout). This is the real client's post-load `0xDC`,
+    // re-expressed: its blocking load's "done" is our release.
+    if !player.settling && player.owes_worldport_ack {
+        if let Some(net) = net_cmds.as_deref() {
+            player.owes_worldport_ack = false;
+            let _ = net.0.send(crate::net::ClientCommand::WorldportAck);
+            info!("worldport: ack sent at settle release");
+        }
+    }
 }
 
 #[cfg(test)]
@@ -334,4 +346,77 @@ mod tests {
         step(&mut app, 0.05, |p| p.focus_tile = Some(own_tile()));
         assert!(!settling(&mut app), "matching residency must still release");
     }
+
+    /// Decision 1340: the arrival debts — the deferred worldport ack and the near-teleport
+    /// position report — are paid on the frame the hold ends, and exactly once. The ack is the
+    /// real client's post-load `0xDC`, so it must ride the release, never the snap — and go
+    /// out exactly once.
+    #[test]
+    fn the_resident_release_pays_the_worldport_ack_once() {
+        let mut app = app();
+        let (tx, rx) = crossbeam_channel::unbounded();
+        app.insert_resource(crate::net::NetCommands(tx));
+        {
+            let mut player = app.world_mut().resource_mut::<Player>();
+            player.world_stale = false;
+            player.owes_worldport_ack = true;
+        }
+        // Still streaming: settling holds, nothing is sent.
+        step(&mut app, 0.1, |p| {
+            p.total = 2000;
+            p.ready = 1500;
+            p.colliders_pending = 5;
+            p.scene_ready = false;
+        });
+        assert!(settling(&mut app));
+        assert!(
+            rx.try_recv().is_err(),
+            "the ack went out before the release"
+        );
+        // Residency lands: the hold ends and the ack goes out.
+        step(&mut app, 0.1, |p| {
+            p.ready = 2000;
+            p.colliders_pending = 0;
+            p.scene_ready = true;
+        });
+        assert!(!settling(&mut app));
+        let sent: Vec<crate::net::ClientCommand> = rx.try_iter().collect();
+        assert!(
+            matches!(sent[..], [crate::net::ClientCommand::WorldportAck]),
+            "exactly one worldport ack at the release, got {sent:?}"
+        );
+        // Paid once: further quiet frames send nothing more.
+        step(&mut app, 0.1, |_| {});
+        assert!(rx.try_recv().is_err(), "the ack was paid twice");
+    }
+
+    /// The stall timeout pays the ack too: a dead stream must still complete the transfer —
+    /// vmangos keeps an unacked far teleport out-of-world (dropping every packet) until logout,
+    /// so a release with no ack would strand the session, silently.
+    #[test]
+    fn a_timeout_release_still_pays_the_ack() {
+        let mut app = app();
+        let (tx, rx) = crossbeam_channel::unbounded();
+        app.insert_resource(crate::net::NetCommands(tx));
+        {
+            let mut player = app.world_mut().resource_mut::<Player>();
+            player.world_stale = false;
+            player.owes_worldport_ack = true;
+        }
+        // Frozen counters, scene never presentable: first frame baselines, then the budget runs.
+        for _ in 0..=(SETTLE_TIMEOUT + 2.0) as usize {
+            step(&mut app, 1.0, |p| {
+                p.total = 2000;
+                p.ready = 500;
+                p.colliders_pending = 300;
+                p.scene_ready = false;
+            });
+        }
+        assert!(!settling(&mut app), "the stall backstop never fired");
+        let sent: Vec<crate::net::ClientCommand> = rx.try_iter().collect();
+        assert!(
+            matches!(sent[..], [crate::net::ClientCommand::WorldportAck]),
+            "the timeout release must still ack the transfer, got {sent:?}"
+        );
+    }
 }
diff --git a/crates/benilla-app/src/sound/kit.rs b/crates/benilla-app/src/sound/kit.rs
index 33215590..0fbe8f87 100644
--- a/crates/benilla-app/src/sound/kit.rs
+++ b/crates/benilla-app/src/sound/kit.rs
@@ -154,6 +154,14 @@ pub(super) fn play_kit_ext(
     source: Option<Entity>,
     force_loop: bool,
 ) -> Result<()> {
+    // The cover's audio hold ([`SoundConfig::world_hold`]): while the loading screen is up, no
+    // new sound starts — checked before anything allocates, so the per-frame retry drivers (the
+    // creature body-loop, the liquid loops) cost one bool while held and start clean at the
+    // reveal. A dropped one-shot under an opaque cover is a sound the reference never played:
+    // its world load blocks, and the events these sounds voice happen unheard.
+    if config.world_hold {
+        return Ok(());
+    }
     let kit = match kit_ref {
         KitRef::Id(id) => kits.catalog.get(id),
         KitRef::Name(name) => kits.catalog.by_name(name),
@@ -351,6 +359,10 @@ pub(crate) fn play_file(
     path: &str,
     category: SoundCategory,
 ) -> Result<()> {
+    // The cover's audio hold — same gate as [`play_kit_ext`], same reason.
+    if config.world_hold {
+        return Ok(());
+    }
     let data = kits.sfx(assets, path)?;
     let data = data.volume(mixer::amp_to_db(config.category_amp(category)));
     let mixer = out.mixer.as_mut().context("no audio device")?;
diff --git a/crates/benilla-app/src/sound/mod.rs b/crates/benilla-app/src/sound/mod.rs
index 8cfae5e7..7cc0d60b 100644
--- a/crates/benilla-app/src/sound/mod.rs
+++ b/crates/benilla-app/src/sound/mod.rs
@@ -107,6 +107,17 @@ pub(crate) struct SoundConfig {
     /// persists — to hear what the DBC data asks for. (The reference's route is
     /// `/console SoundReverb 1`; benilla has no `ConsoleExec` yet.)
     pub reverb: bool,
+    /// **The loading cover's audio half** — NOT a CVar, a per-frame live bit fed from
+    /// [`crate::loading_screen::LoadingScreen::covering`] by [`feed_world_hold`]. While the cover
+    /// is up, no new sound *starts* ([`kit::play_kit_ext`]/[`kit::play_file`] return early) and
+    /// the zone beds hard-stop and stay down (`zone::zone_audio`'s hold arm) — the reference
+    /// blocks on its world load, so nothing world-side is audible under its loading screen, and
+    /// an async client has to build that observable explicitly (0737's argument, in audio).
+    /// Sounds already ringing when the cover rises play out — the reference's sound engine keeps
+    /// running through the load edge too, which is what lets the glue theme's 2 s fade tail
+    /// (1109) ride under the entry cover exactly as the real client's does: its amp is applied
+    /// once at start, and a playing stream never passes back through the kit starters.
+    pub world_hold: bool,
 }
 
 impl SoundConfig {
@@ -136,10 +147,27 @@ impl Default for SoundConfig {
             music_enabled: true,
             ambience_enabled: true,
             reverb: false,
+            world_hold: false,
         }
     }
 }
 
+/// Copy the loading cover's state into [`SoundConfig::world_hold`], once per frame, in
+/// `PreUpdate` — before every trigger system, so the whole frame reads one answer. The one-frame
+/// lag off the raise (the raise happens in the previous frame's `Present`) is inherent and
+/// harmless: the raise frame is the snap frame, and the leaks this closes — units streaming in,
+/// footsteps, the fall grunt, the zone beds — all fire on later frames. The lag also keeps the
+/// enter-world button's own click audible: it plays on the raise frame, before the bit flips.
+fn feed_world_hold(
+    mut config: ResMut<SoundConfig>,
+    screen: Res<crate::loading_screen::LoadingScreen>,
+) {
+    let hold = screen.covering();
+    if config.world_hold != hold {
+        config.world_hold = hold;
+    }
+}
+
 /// The backend output. `mixer` is `None` when no audio device exists (headless/CI) or
 /// `$WOW_NOSOUND` is set — every consumer tolerates silence. A **non-Send** resource: the
 /// backend's device stream is not `Send` on every platform, so all audio systems run on the
@@ -224,6 +252,9 @@ impl Plugin for SoundPlugin {
         .init_resource::<SoundConfig>()
         .init_resource::<AudioListener>()
         .add_systems(Startup, hal_overload::setup)
+        // The cover's audio hold (see [`SoundConfig::world_hold`]): fed in PreUpdate so every
+        // trigger system this frame — whatever stage it runs in — reads one answer.
+        .add_systems(PreUpdate, feed_world_hold)
         .add_systems(
             Update,
             (
diff --git a/crates/benilla-app/src/sound/zone.rs b/crates/benilla-app/src/sound/zone.rs
index 0dd7c847..606fa3ff 100644
--- a/crates/benilla-app/src/sound/zone.rs
+++ b/crates/benilla-app/src/sound/zone.rs
@@ -280,6 +280,17 @@ fn zone_audio(
     let phase = phase(&clock);
     let zone = &mut *zone;
 
+    // The cover's audio hold ([`SoundConfig::world_hold`]): the raise kills the world
+    // soundscape — the reference's loading screen sits over a torn-down world, so a departure
+    // zone's bed playing under the destination's cover is a sound it cannot make. Resetting
+    // `area`/`interior` with the beds is what makes the reveal a fresh zone entry: the first
+    // uncovered frame re-resolves the destination and starts its music/ambience through the
+    // ordinary change block below, exactly like walking into the zone.
+    if config.world_hold {
+        stop_world_soundscape(zone, "loading cover");
+        return;
+    }
+
     // ---- react to an area or interior change (the WMO row overrides the terrain chain where
     // its FKs are nonzero — sound::interior, decision 0076) ----
     let inside = interior.0;
@@ -630,6 +641,13 @@ fn server_sounds(
     if msgs.is_empty() {
         return;
     }
+    // Under the cover a push is dropped, not deferred (the hold, [`SoundConfig::world_hold`]):
+    // the reference's blocking load hears none of these, and the recurring pushes (the Darkmoon
+    // Faire emitter re-pushes every 5 s) re-arrive on their own after the reveal.
+    if config.world_hold {
+        msgs.clear();
+        return;
+    }
     let (Some(mut kits), Some(assets)) = (kits, assets) else {
         return;
     };
@@ -682,6 +700,15 @@ fn server_sounds(
 /// counterparts are process-global statics, not per-session state (the 6 s cold-start and the
 /// intro throttle survive a relog).
 fn leave_world(mut zone: NonSendMut<ZoneAudio>) {
+    stop_world_soundscape(&mut zone, "left world");
+}
+
+/// Stop the beds and reset the scheduler to cold — shared by the two edges where the world's
+/// audio dies: leaving the world ([`leave_world`]) and the loading cover rising over it
+/// ([`zone_audio`]'s hold arm, decision 1345 — the cover kills the world soundscape exactly
+/// as the reference's blocking load does). Idempotent: with the handles already taken, every
+/// line is a no-op and nothing logs.
+fn stop_world_soundscape(zone: &mut ZoneAudio, reason: &str) {
     // The teardown declick — fast enough to read as a cut, long enough not to pop.
     const WORLD_TEARDOWN_FADE_MS: u64 = 250;
     let had = zone.music.is_some() || zone.ambience.is_some();
@@ -705,7 +732,7 @@ fn leave_world(mut zone: NonSendMut<ZoneAudio>) {
     zone.interior = None;
     zone.was_underwater = false;
     if had {
-        info!("sound: world soundscape stopped (left world)");
+        info!("sound: world soundscape stopped ({reason})");
     }
 }
 
diff --git a/crates/benilla-app/src/ui_pass.rs b/crates/benilla-app/src/ui_pass.rs
index 7448586f..f718d8fa 100644
--- a/crates/benilla-app/src/ui_pass.rs
+++ b/crates/benilla-app/src/ui_pass.rs
@@ -350,6 +350,44 @@ impl Material2d for UiQuadMaterial {
 #[derive(SystemSet, Debug, Clone, Copy, PartialEq, Eq, Hash)]
 pub(crate) struct UiQuadAppend;
 
+/// Project a world point for a world-anchored overlay, **with the reference projector's own accept
+/// verdict** — `None` means "this one does not draw", and the caller must honour it.
+///
+/// `0x483ee0` returns a boolean (wow-re `object-layer/scratch/nameplate-offscreen-cull.md`,
+/// §5-VERIFIED 2026-08-15). It rejects a point behind the near plane (`483f7a`) **and** a point
+/// outside the viewport — the four tests at `484075`/`484086`/`484096`/`4840a6`, against the
+/// **WorldFrame**'s own region (`[0xb4b2bc]`, mirrored ÷G44/÷G48 at `0x483970`), so the accept
+/// region is exactly the viewport, inclusive. Both plate and worldtext callers **destroy** the
+/// thing they were about to place when it comes back false.
+///
+/// **The trap this exists to remove:** on the viewport rejections the projector has *already
+/// written* the out-param (`484065`/`484067`), so a caller that ignores the verdict reads a
+/// perfectly plausible off-screen coordinate and sails on — which is exactly how benilla ended up
+/// clamping the plates of units nobody can see onto the screen border (1341). Returning `Option`
+/// makes the verdict unignorable at the call site.
+///
+/// The chat bubble deliberately does **not** call this: the reference's bubble seat is the one
+/// caller of the three that ignores the boolean, so a bubble simply slides off the edge with its
+/// speaker. Bevy's own `Err` covers only the behind-camera half, which is why the viewport test
+/// has to be here rather than left to it.
+pub(crate) fn project_overlay(
+    cam: &Camera,
+    cam_tf: &GlobalTransform,
+    world: Vec3,
+    viewport: Vec2,
+) -> Option<Vec2> {
+    // Bevy's `Err` is the near-plane half (`483f7a`); `accepts` is the viewport half.
+    let p = cam.world_to_viewport(cam_tf, world).ok()?;
+    accepts(p, viewport).then_some(p)
+}
+
+/// The accept REGION: exactly the viewport, **inclusive**. `[0xb4b2bc]` is the WorldFrame, and its
+/// region rect is mirrored ÷G44/÷G48 into the compare fields (`0x483970`), so the aspect factors
+/// cancel exactly and the test is against the raw screen box.
+fn accepts(p: Vec2, viewport: Vec2) -> bool {
+    (0.0..=viewport.x).contains(&p.x) && (0.0..=viewport.y).contains(&p.y)
+}
+
 /// Owns the player-UI camera + the per-frame quad→mesh rebuild. See the module doc for the
 /// camera-order arbitration and the batching/ordering approach.
 pub(crate) struct PlayerUiPlugin;
@@ -986,6 +1024,29 @@ mod tests {
         app
     }
 
+    /// The projector's accept region is **exactly the viewport, inclusive** — the WorldFrame's own
+    /// region mirrored ÷G44/÷G48 (`0x483970`), so the aspect factors cancel. A point on the edge
+    /// draws (the seat's clamp, not this, is what keeps the rect fully inside); a point outside it
+    /// does not, however plausible the coordinate the projector already wrote looks. The last row
+    /// is the measured phantom that bought this: a unit two thirds of a screen below the bottom,
+    /// whose plate used to be dragged up onto the border (1341).
+    #[test]
+    fn the_accept_region_is_the_viewport_inclusive() {
+        let vp = Vec2::new(1440.0, 810.0);
+        assert!(accepts(Vec2::new(720.0, 405.0), vp));
+        assert!(accepts(Vec2::ZERO, vp), "the corner is in view");
+        assert!(accepts(vp, vp), "so is the far corner");
+        for out in [
+            Vec2::new(-0.5, 405.0),
+            Vec2::new(1440.5, 405.0),
+            Vec2::new(720.0, -0.5),
+            Vec2::new(720.0, 810.5),
+            Vec2::new(1409.0, 1332.0),
+        ] {
+            assert!(!accepts(out, vp), "{out:?} is not on screen");
+        }
+    }
+
     fn batches(app: &mut App) -> usize {
         app.world_mut()
             .query_filtered::<(), With<UiQuadBatch>>()
diff --git a/crates/benilla-app/src/ui_script/extract/mod.rs b/crates/benilla-app/src/ui_script/extract/mod.rs
index 4f6fb61d..3ec78127 100644
--- a/crates/benilla-app/src/ui_script/extract/mod.rs
+++ b/crates/benilla-app/src/ui_script/extract/mod.rs
@@ -44,19 +44,19 @@ fn report_gate_miss(
     now: &[benilla_ui::script::ExtractedQuad],
     prev: &[benilla_ui::script::ExtractedQuad],
     dims_eq: bool,
-    bake_eq: bool,
+    generation_eq: bool,
     text_ui_eq: bool,
     portraits_eq: bool,
 ) {
     if !dims_eq {
-        eprintln!("[ui-gate] miss: window/scale changed");
+        eprintln!("[ui-gate] miss: window size / seam scale / DPI changed");
         return;
     }
-    if !bake_eq {
-        // Named, because it is the one miss whose cause is a QUARTER SECOND behind the input that
-        // provoked it (`REBAKE_SETTLE`): a resize that has already settled, re-converting again
-        // when the atlas it was waiting for finally lands (decision 1339).
-        eprintln!("[ui-gate] miss: glyph atlas re-baked");
+    if !generation_eq {
+        // Named, because it is the one miss with no visible cause at all: the glyph sheet filled
+        // and was repacked from empty, so every held quad's UV moved. It should be very rare —
+        // `WOW_GLYPH_CACHE=1` reports the occupancy that led here (decision 1342).
+        eprintln!("[ui-gate] miss: the glyph sheet reset");
         return;
     }
     if !text_ui_eq {
@@ -102,11 +102,11 @@ fn report_gate_miss(
 pub(super) struct GateInputs {
     extracted: Vec<benilla_ui::script::ExtractedQuad>,
     text_ui: Option<benilla_ui::script::EditBoxTextUi>,
-    dims: Option<(u32, u32, u32)>,
+    dims: Option<(u32, u32, u32, u32)>,
     portraits: std::collections::HashMap<String, crate::portrait::PortraitSource>,
-    /// The `UiFontAtlas::generation` the held quads' glyph cells were rasterized from — the term
-    /// that stopped being constant at decision 1296 (see the gate's own note below, decision 1339).
-    bake: Option<u64>,
+    /// The `UiFontAtlas::generation` the held quads' glyph UVs came from — see the gate's own
+    /// note below. Moves only when the glyph sheet resets (decisions 1339, 1342).
+    generation: Option<u64>,
 }
 
 /// Per frame: screen size → `tick` (OnUpdate) → `resolve` → `extract` → [`UiQuads`]. Script errors
@@ -153,27 +153,29 @@ pub(super) fn drive_script(
     // VM has no cached measures to invalidate and no measurer at all, and the re-seat below already
     // catches that on its own test (`!script.has_text_measurer()`).
     mut last_seam: Local<f32>,
-    // The atlas bake this pass last seated a measurer from (decision 1296) — the other half of the
-    // same staleness edge. `None` until an atlas exists, which is also a real edge to catch.
-    mut last_bake: Local<Option<u64>>,
+    // The `scale_factor` this pass last answered measures under — the other half of the same
+    // staleness edge (decision 1342). `0.0` until the first frame, which is also a real edge.
+    mut last_dpi: Local<f32>,
     // The uiScale dial folded into the seam scale (decision 0584).
     ui_scale: Res<super::UiScaleCvar>,
     // ── The extract gate's memory (decision 0740): last frame's conversion inputs ─────────────
-    // The conversion loop below is a pure function of (extracted, text_ui, window dims × seam
-    // scale, the portrait token map, THE ATLAS BAKE) — the sprite caches are monotone
-    // path→handle, so equal inputs reproduce the same `UiQuads` the diff would then discard.
-    // Capture mode never skips (the harness wants exact per-frame output, including the
+    // The conversion loop below is a pure function of (extracted, text_ui, the RASTER
+    // ENVIRONMENT, the portrait token map, the glyph-sheet generation) — the sprite caches are
+    // monotone path→handle, so equal inputs reproduce the same `UiQuads` the diff would then
+    // discard. Capture mode never skips (the harness wants exact per-frame output, including the
     // cursor-icon quad's live mouse position).
     //
-    // The bake term is decision 1339's correction: this list read "the glyph atlas bakes once at
-    // Startup", which decision 1296 falsified — the atlas now re-bakes whenever the raster
-    // environment moves, and every glyph quad the conversion emits carries that bake's cell UVs
-    // and image handle. The two are DEBOUNCED apart by design (`REBAKE_SETTLE` = 0.25 s), which is
-    // exactly what made the omission bite: the seam moves the instant the window resizes, the UI
-    // re-converts and settles well inside a quarter second, and *then* the new atlas arrives to a
-    // gate whose other four inputs all match — so the conversion is skipped and the screen keeps
-    // the old bake's resampled cells indefinitely. 1296's re-bake landed and nothing on screen
-    // used it, which is the shape of the reports that survived it.
+    // The raster environment is window size × seam scale × **`scale_factor`**, and that last term
+    // is decision 1342's correction. A monitor hop at an unchanged window size moves nothing else
+    // in this list, but it changes the integer device-pixel size every glyph rasterizes at
+    // (`TextEngine::ppem`) — so the quads held from last frame are the wrong size and the gate
+    // must miss. (1339 caught the same hole through an atlas-bake counter, which was the right
+    // fix for a design where the atlas re-baked; there is nothing to re-bake now, so the term that
+    // survives is the one that actually moved.)
+    //
+    // The generation term is the glyph sheet RESETTING — the one event that moves a cached cell's
+    // UV, which happens when the sheet fills and is repacked from empty. Held quads carry the old
+    // UVs and would draw letters as fragments of other letters.
     //
     // A [`crate::ui_script::VmMemo`] because a skip is not only a quad-conversion skip: it also skips
     // `set_link_spans` and the minimap-slot / booth-pane refills, which are pushes INTO the VM. The
@@ -208,18 +210,20 @@ pub(super) fn drive_script(
     // eats fitting text: the director's "Contr..." rows, reproduced by `WOW_RESIZE`). Declare the
     // staleness at the seam and let every round-trip re-answer under the new `s`.
     //
-    // A **re-bake** is the same staleness by the other route: the atlas now follows the seam
-    // (decision 1296), and a fresh bake replaces the whole step table — so a cached metric answered
-    // off the old table is stale even when `s` itself did not move (a pure DPI hop, a monitor
-    // change). Watch the generation beside the seam and treat either edge identically.
+    // **The DPI is the other half of the same edge** (decision 1342). A logical height becomes an
+    // integer DEVICE-pixel raster size, so a monitor hop at an unchanged window size leaves `s`
+    // exactly where it was and still moves every measured width. (1296/1339 caught this through
+    // the atlas's bake generation, which followed the same two terms; with nothing to re-bake, the
+    // honest thing to watch is the term itself.)
+    let dpi = window.scale_factor();
     let generation = font_atlas.as_deref().map(|a| a.generation);
-    let seam_moved = *last_seam != s || *last_bake != generation;
+    let seam_moved = *last_seam != s || *last_dpi != dpi;
     if seam_moved {
         if *last_seam != 0.0 {
             script.invalidate_text_measures();
         }
         *last_seam = s;
-        *last_bake = generation;
+        *last_dpi = dpi;
     }
     // …and re-seat the VM's own font engine at the same edge, for the same reason: an
     // [`crate::ui_text::AtlasMeasurer`] answers only for the seam it was built under. This is what
@@ -233,7 +237,7 @@ pub(super) fn drive_script(
     if let Some(atlas) = font_atlas.as_deref() {
         if seam_moved || !script.has_text_measurer() {
             script.set_text_measurer(Box::new(crate::ui_text::AtlasMeasurer::new(
-                atlas.metrics(),
+                atlas.engine(),
                 s,
             )));
         }
@@ -323,7 +327,7 @@ pub(super) fn drive_script(
                 .iter()
                 .map(|r| {
                     let n = crate::ui_text::measure_wrapped_rows(
-                        atlas,
+                        &mut atlas.lock(),
                         &r.text,
                         // wrap_width is the RESOLVED frame width (scale already in it) — ×s only;
                         // the font height is frame-local — ×s × the frame's scale, the drawn size.
@@ -333,7 +337,6 @@ pub(super) fn drive_script(
                             // The band's own drawn px (one-to-one regime; inert ≤ 32).
                             height: crate::ui_text::drawn_px(r.height, None, s * r.scale),
                             outline: r.outline, // step-law width bias, as in the measures above
-                            paint_halo: true,   // measure never paints; irrelevant here
                             alpha_gradient: None,
                         },
                     );
@@ -386,10 +389,9 @@ pub(super) fn drive_script(
                 // request's `scale` doc).
                 height: crate::ui_text::drawn_px(req.height, None, s * req.scale),
                 outline: req.outline,
-                paint_halo: true,     // measure never paints
                 alpha_gradient: None, // alpha never changes metrics
             };
-            let cum: Vec<f32> = crate::ui_text::line_advances(atlas, &req.text, spec)
+            let cum: Vec<f32> = crate::ui_text::line_advances(&mut atlas.lock(), &req.text, spec)
                 .iter()
                 .map(|a| a / s)
                 .collect();
@@ -398,7 +400,7 @@ pub(super) fn drive_script(
             // Advances/pitch return in UI units (÷s): the engine's click→index and row math
             // compare them against the ÷s mouse feed.
             let (rows, cell_h) = match req.wrap_width {
-                Some(w) => crate::ui_text::line_rows(atlas, &req.text, w * s, spec),
+                Some(w) => crate::ui_text::line_rows(&mut atlas.lock(), &req.text, w * s, spec),
                 None => (vec![0], 0.0),
             };
             script.set_editbox_advances(req.id, req.key, cum, rows, cell_h / s);
@@ -419,10 +421,10 @@ pub(super) fn drive_script(
     // LBRS pin that was every single settled frame, ~0.3 ms/frame of glyph re-rasterization for
     // an identical `Vec`. On a skip, `quads`/`minimap_widget`/the engine's link spans all keep
     // last frame's values, which the equal inputs prove are this frame's values too.
-    let dims = (w.to_bits(), h.to_bits(), s.to_bits());
+    let dims = (w.to_bits(), h.to_bits(), s.to_bits(), dpi.to_bits());
     let settled = capture.is_none()
         && prev.dims == Some(dims)
-        && prev.bake == generation
+        && prev.generation == generation
         && text_ui == prev.text_ui
         && booths.images.0 == prev.portraits
         && extracted == prev.extracted;
@@ -465,13 +467,13 @@ pub(super) fn drive_script(
             &extracted,
             &prev.extracted,
             prev.dims == Some(dims),
-            prev.bake == generation,
+            prev.generation == generation,
             text_ui == prev.text_ui,
             booths.images.0 == prev.portraits,
         );
     }
     prev.dims = Some(dims);
-    prev.bake = generation;
+    prev.generation = generation;
     prev.text_ui = text_ui.clone();
     prev.portraits = booths.images.0.clone();
     prev.extracted = extracted.clone();
@@ -836,12 +838,12 @@ fn measure_fontstrings(
         return false;
     }
     // Every answer goes through the ONE measure body ([`crate::ui_text::measure_request`]) the VM's
-    // own synchronous measurer calls, over the same `Arc`-shared table — so a string measured here
+    // own synchronous measurer calls, against the same shared engine — so a string measured here
     // and the same string measured mid-tick are not two computations that agree, they are one.
     let measures: Vec<(u32, f32, f32, f32, u64)> = requests
         .iter()
         .map(|r| {
-            let (w, h, natural) = crate::ui_text::measure_request(&atlas.metrics, s, r);
+            let (w, h, natural) = crate::ui_text::measure_request(&mut atlas.lock(), s, r);
             (r.id, w, h, natural, r.key)
         })
         .collect();
diff --git a/crates/benilla-app/src/ui_script/extract/text.rs b/crates/benilla-app/src/ui_script/extract/text.rs
index 40c34fe7..ad4fbb79 100644
--- a/crates/benilla-app/src/ui_script/extract/text.rs
+++ b/crates/benilla-app/src/ui_script/extract/text.rs
@@ -79,7 +79,6 @@ pub(super) fn emit(
             host.scale * host.font_scale,
         ),
         outline: style.outline,
-        paint_halo: true,
         alpha_gradient: style.alpha_gradient,
     };
     // The focused edit box's text draws WINDOWED (`0x77da80`): the scroll window's substring,
@@ -121,7 +120,7 @@ pub(super) fn emit(
     if let Some(ui) = ebox {
         let drawn = &text[ui.display_from.min(text.len())..];
         let (x0, top, cell_h) =
-            crate::ui_text::line_origin(atlas, drawn, host.rect, draw_justify, spec);
+            crate::ui_text::line_origin(&mut atlas.lock(), drawn, host.rect, draw_justify, spec);
         ebox_geom = Some((x0, top, cell_h));
         text_clip = Some(host.clip.map_or(host.rect, |c| c.intersect(host.rect)));
         if !ui.multi_line {
@@ -190,7 +189,7 @@ pub(super) fn emit(
         // (`ink=`). They diverge by the width of the markup when the advance table is measured over
         // the raw buffer — the caret-out-in-space report (decision 1075) as a pair of numbers.
         let ebox_geom = ebox.map(|ui| {
-            let ink = crate::ui_text::measure_text(&atlas.metrics, draw_text, None, spec).0;
+            let ink = crate::ui_text::measure_text(&mut atlas.lock(), draw_text, None, spec).0;
             format!(" caret={:.1} ink={ink:.1}", ui.caret_x * host.scale)
         });
         info!(
@@ -209,9 +208,9 @@ pub(super) fn emit(
     // the stable z-sort keeps it behind the glyph pass. Offset is WoW y-up (`y="-1"` = down) →
     // y-down screen dy = −y. Markup color codes inside the text tint the shadow run too (v1
     // corner, invisible for solid-color strings). The shadow is a single flat offset copy —
-    // never itself outlined (an outlined shadow would be a muddy black blob), so it suppresses
-    // the halo PAINT only: it keeps the font's true outline for the step law, laying out
-    // identically to its fill (a shadow with different steps would smear under long strings).
+    // never itself outlined — it lays out identically to its fill (a shadow with different steps
+    // would smear under long strings) and redraws the same composite cells in the shadow color,
+    // where the ring's black is indistinguishable from the shadow's.
     if let (Some(sh), Some((dx, dy))) = (style.shadow, shadow_delta) {
         // WHOLE pixels (`shadow_offset_px`, computed above): the shadow is a rigid copy of the
         // fill, so its displacement must be an integer in the rect's own space — see that fn for
@@ -222,12 +221,9 @@ pub(super) fn emit(
             draw_rect.max.x + dx,
             draw_rect.max.y + dy,
         );
-        let shadow_spec = crate::ui_text::FontSpec {
-            paint_halo: false,
-            ..spec
-        };
+        let shadow_spec = crate::ui_text::FontSpec { ..spec };
         let mut sq = layout_text_quads(
-            atlas,
+            &mut atlas.lock(),
             draw_text,
             srect,
             sh.color,
@@ -257,7 +253,7 @@ pub(super) fn emit(
         // for the engine's click hit-test (y-down → y-up flip).
         let mut spans = Vec::new();
         let g = layout_text_quads_links(
-            atlas,
+            &mut atlas.lock(),
             text,
             host.rect,
             base_color,
@@ -286,7 +282,7 @@ pub(super) fn emit(
         g
     } else {
         layout_text_quads(
-            atlas,
+            &mut atlas.lock(),
             draw_text,
             draw_rect,
             base_color,
diff --git a/crates/benilla-app/src/ui_script/lifecycle.rs b/crates/benilla-app/src/ui_script/lifecycle.rs
index 022d66c1..7622b6c1 100644
--- a/crates/benilla-app/src/ui_script/lifecycle.rs
+++ b/crates/benilla-app/src/ui_script/lifecycle.rs
@@ -101,7 +101,82 @@ fn ui_wanted(world: &World) -> bool {
         || std::env::var("WOW_CAPTURE_UI").as_deref() == Ok("1")
 }
 
-/// `OnEnter(InWorld)`: materialize the in-game UI for **this** session.
+/// The world-entry UI load, armed at `OnEnter(InWorld)` and run by [`run_pending_entry_load`]
+/// once the loading cover is actually ON THE GLASS.
+///
+/// This is 0962's frame accounting, second offender: `OnEnter(InWorld)` fires on exactly the
+/// frame whose render would first present the cover (the raise frame still renders the glue
+/// above it), so a synchronous burst there holds the *previous* present — the frozen character
+/// screen — for its whole duration. 0962 taught the menagerie to wait for
+/// `WARM_COVER_PRESENT_FRAMES`; 1051 then moved the FrameXML load onto the same unprotected
+/// frame, and by 1290+addons the burst had grown to ~0.5 s (measured live: raise 48.317 →
+/// reference sourcing + 55 files + addons + saved vars + `PLAYER_LOGIN` → 48.83) — the
+/// director's "frozen char for 1 sec" at every Enter World.
+///
+/// The counter counts covered+in-world frames, exactly like the warm pass: renders are serial,
+/// so at [`ENTRY_LOAD_COVER_FRAMES`] the two intermediate frames' renders — which draw the
+/// cover — have committed their presents before this frame's stall begins. The loading screen
+/// folds this resource's existence into its clear condition, so a reveal can never precede the
+/// UI it is supposed to reveal.
+#[derive(Resource, Default)]
+pub(crate) struct PendingEntryUiLoad {
+    covered_frames: u32,
+}
+
+/// Covered+in-world frames before the entry load runs — the same present proxy, and the same
+/// value, as `pipe_warm::WARM_COVER_PRESENT_FRAMES` (0962's argument, restated there).
+const ENTRY_LOAD_COVER_FRAMES: u32 = 3;
+
+/// `OnEnter(InWorld)`: arm the deferred entry load. The load itself runs a few frames later —
+/// see [`PendingEntryUiLoad`].
+pub(crate) fn arm_entry_ui_load(mut commands: Commands) {
+    commands.insert_resource(PendingEntryUiLoad::default());
+}
+
+/// `PreUpdate` (chained after [`run_pending_reload`] — same exclusive slot, and a reload must
+/// not interleave an armed entry load): run the armed entry load once the cover has presented.
+///
+/// No cover at all — a capture booting straight `InWorld`, or the screen's assets missing —
+/// means there is no glass to protect and nothing watching the previous present: load
+/// immediately. Leaving the world first (an instant disconnect) drops the latch unrun;
+/// [`end_ui_session`] treats that as "the in-game UI never existed" and skips the shutdown
+/// writes, so a UI-less VM can never clobber the saved-variables files with its emptiness.
+pub(crate) fn run_pending_entry_load(world: &mut World) {
+    if world.get_resource::<PendingEntryUiLoad>().is_none() {
+        return;
+    }
+    let in_world = *world
+        .resource::<State<crate::char_select::ClientState>>()
+        .get()
+        == crate::char_select::ClientState::InWorld;
+    if !in_world {
+        // Left the world before the load ran — nothing to build a UI for.
+        world.remove_resource::<PendingEntryUiLoad>();
+        return;
+    }
+    let covering = world
+        .get_resource::<crate::loading_screen::LoadingScreen>()
+        .is_some_and(|s| s.covering());
+    if covering {
+        let mut pending = world.resource_mut::<PendingEntryUiLoad>();
+        pending.covered_frames += 1;
+        if pending.covered_frames < ENTRY_LOAD_COVER_FRAMES {
+            return;
+        }
+    }
+    world.remove_resource::<PendingEntryUiLoad>();
+    let start = std::time::Instant::now();
+    load_ingame_ui_on_world_entry(world);
+    // The standing instrument for this burst: the one number that says whether the cover is
+    // still hiding it, on every entry, in every log.
+    info!(
+        "ui_script: in-game UI up in {:.0} ms (behind the cover: {})",
+        start.elapsed().as_secs_f32() * 1000.0,
+        covering
+    );
+}
+
+/// Materialize the in-game UI for **this** session.
 ///
 /// **Once per world entry, not once per process** (decision 1290). The reference builds the whole
 /// in-game UI at `CGGameUI::Initialize 0x48fbf0` and destroys it again at `0x490bd0` on the way
@@ -293,11 +368,17 @@ pub(crate) fn shutdown_ui_state(script: &mut UiScript, identity: Option<&(String
 /// Exclusive rather than a `NonSendMut` system because it both drops and installs a `NonSend`, and
 /// because the shutdown writes must be ordered against each other — see [`shutdown_ui_state`].
 pub(crate) fn end_ui_session(world: &mut World) {
+    // An armed-but-unrun entry load ([`PendingEntryUiLoad`]) means this session never built an
+    // in-game UI: there are no globals to save and no addon state to write, and running the
+    // shutdown tail against the boot VM would overwrite the real files with that emptiness.
+    let ui_never_loaded = world.remove_resource::<PendingEntryUiLoad>().is_some();
     let identity = world
         .get_resource::<AddOnIdentity>()
         .and_then(|id| id.0.clone());
-    if let Some(mut script) = world.get_non_send_resource_mut::<UiScript>() {
-        shutdown_ui_state(&mut script, identity.as_ref());
+    if !ui_never_loaded {
+        if let Some(mut script) = world.get_non_send_resource_mut::<UiScript>() {
+            shutdown_ui_state(&mut script, identity.as_ref());
+        }
     }
     // The CVar bridge (decision 1291): the dying VM's table folds into the persist state — after
     // the shutdown events above (a `PLAYER_LOGOUT` handler may `SetCVar`, and in the reference
@@ -386,11 +467,16 @@ pub(crate) fn run_pending_reload(world: &mut World) {
 pub(crate) fn shutdown_on_exit(
     script: Option<NonSendMut<UiScript>>,
     id: Res<AddOnIdentity>,
+    pending_entry: Option<Res<PendingEntryUiLoad>>,
     mut exits: MessageReader<AppExit>,
 ) {
     if exits.read().next().is_none() {
         return;
     }
+    // Same guard as [`end_ui_session`]: a quit inside the entry-load window has no UI to save.
+    if pending_entry.is_some() {
+        return;
+    }
     if let Some(mut script) = script {
         shutdown_ui_state(&mut script, id.0.as_ref());
     }
diff --git a/crates/benilla-app/src/ui_script/mod.rs b/crates/benilla-app/src/ui_script/mod.rs
index 52901dea..ae59df60 100644
--- a/crates/benilla-app/src/ui_script/mod.rs
+++ b/crates/benilla-app/src/ui_script/mod.rs
@@ -264,10 +264,14 @@ impl Plugin for UiScriptPlugin {
             // cast-fail display (0427) resolves its messages from.
             .add_systems(Startup, setup_script.after(benilla_assets::AssetSet::Open))
             // The in-game UI materializes on entering the world, not at boot (1051) — the
-            // reference's own seam. Only the font registry loads at `Startup`.
+            // reference's own seam; only the font registry loads at `Startup`. The entry edge
+            // ARMS the load; it runs a few frames later, once the loading cover has actually
+            // presented — the ~0.5 s burst must never stall the frame whose render would first
+            // show the cover, or what covers it is the frozen character screen (0962's frame
+            // accounting; see [`lifecycle::PendingEntryUiLoad`]).
             .add_systems(
                 OnEnter(crate::char_select::ClientState::InWorld),
-                load_ingame_ui_on_world_entry,
+                lifecycle::arm_entry_ui_load,
             )
             // The whole shutdown tail — events then writes, in the reference's order. See
             // [`shutdown_ui_state`]; the two edges here are its five roots as far as our session
@@ -285,7 +289,13 @@ impl Plugin for UiScriptPlugin {
             // `save_config`, discarding a dirty CVar edit, or after `seed_bindings`, giving one
             // whole frame with an empty binding table. See [`run_pending_reload`].
             .init_resource::<ReloadUiPending>()
-            .add_systems(PreUpdate, run_pending_reload)
+            // The armed entry load shares the reload's slot, chained after it: both are
+            // exclusive edges on the same VM, and a reload must not interleave a pending entry
+            // load.
+            .add_systems(
+                PreUpdate,
+                (run_pending_reload, lifecycle::run_pending_entry_load).chain(),
+            )
             // `GetFramerate()`'s host half (decision 1195), before the VM ticks so an `OnUpdate`
             // handler reads this frame's number rather than the previous one's.
             .add_systems(Update, feed_framerate.before(UiInput))
@@ -354,15 +364,18 @@ fn arbitrate_pointer_over_ui(
 /// lives there; this module keeps the per-frame bridge. See its header.
 mod lifecycle;
 pub(crate) use lifecycle::{
-    end_ui_session, run_pending_reload, setup_script, AddOnIdentity, ReloadUiPending,
+    end_ui_session, run_pending_reload, setup_script, AddOnIdentity, PendingEntryUiLoad,
+    ReloadUiPending,
 };
 // Consumed only from other modules' test code (the emote-table checks, the harness's UI-init
 // tail, the quit-once pin) — a plain re-export would warn unused in a non-test build.
 #[cfg(test)]
+use lifecycle::load_ingame_ui_on_world_entry;
+use lifecycle::shutdown_on_exit;
+#[cfg(test)]
 pub(crate) use lifecycle::{
     finish_ui_load, is_emote_token_line, seat_from_roster, shutdown_ui_state,
 };
-use lifecycle::{load_ingame_ui_on_world_entry, shutdown_on_exit};
 
 /// `GetFramerate()`'s host half: push a **smoothed** frames-per-second into the VM each frame
 /// (decision 1195).
diff --git a/crates/benilla-app/src/ui_script/session.rs b/crates/benilla-app/src/ui_script/session.rs
index 8d1b0c86..57ab76c7 100644
--- a/crates/benilla-app/src/ui_script/session.rs
+++ b/crates/benilla-app/src/ui_script/session.rs
@@ -183,14 +183,11 @@ mod tests {
         // re-seats off `!script.has_text_measurer()` — it interrogates the VM instead of a memo,
         // which is the same guarantee arrived at the other way.
         ("ui_script/extract/mod.rs", "last_seam"),
-        // The atlas bake generation beside it (decision 1296) — a fact about the glyph atlas, a
-        // Bevy resource that outlives any VM, not about the VM. It gates the same re-seat
-        // `last_seam` does, and a fresh VM re-seats on `!has_text_measurer()` regardless.
-        ("ui_script/extract/mod.rs", "last_bake"),
-        // How long the raster environment has differed from the baked one (decision 1296's
-        // re-bake debounce): a stopwatch about the WINDOW, zeroed by its own equality test every
-        // frame. A new VM neither reads it nor is described by it.
-        ("ui_text/atlas.rs", "drifted_for"),
+        // The window's `scale_factor` beside it (decision 1342) — the other term a measure is
+        // only correct under, since a logical height becomes an integer DEVICE-pixel raster size.
+        // A fact about the window, not about the VM; it gates the same re-seat `last_seam` does,
+        // and a fresh VM re-seats on `!has_text_measurer()` regardless.
+        ("ui_script/extract/mod.rs", "last_dpi"),
         // Pushed unconditionally every frame; there is nothing remembered to go stale.
         ("ui_script/mod.rs", "smoothed"),
         // The cursor systems, both platform arms: these track the OS cursor and an `NSCursor` raw
diff --git a/crates/benilla-app/src/ui_script/world_entry_tests.rs b/crates/benilla-app/src/ui_script/world_entry_tests.rs
index f6fa000d..c783a685 100644
--- a/crates/benilla-app/src/ui_script/world_entry_tests.rs
+++ b/crates/benilla-app/src/ui_script/world_entry_tests.rs
@@ -568,3 +568,110 @@ fn a_looping_addon_cannot_freeze_world_entry() {
     drop(world);
     let _ = std::fs::remove_dir_all(&tmp);
 }
+
+// ─────────────────── The deferred entry load (0962's frame accounting) ───────────────────
+
+/// **The director's "frozen char for 1 sec" report, from the other side.** With the cover up,
+/// the armed entry load waits [`super::lifecycle::run_pending_entry_load`]'s covered-frame
+/// count — the frames whose renders put the cover on the glass — and only then pays the burst.
+/// Before the deferral the load ran inside `OnEnter(InWorld)`, which is exactly the frame whose
+/// render would first present the cover, so the ~0.5 s of FrameXML + addons + `PLAYER_LOGIN`
+/// held the previous present: the frozen character screen.
+#[test]
+fn the_entry_load_waits_for_the_cover_to_present() {
+    let _l = ENV_LOCK
+        .lock()
+        .unwrap_or_else(std::sync::PoisonError::into_inner);
+    let (tmp, _c, _h) = hermetic_probe("defer");
+    let mut world = booted_world();
+    world.insert_resource(State::new(crate::char_select::ClientState::InWorld));
+    world.insert_resource(crate::loading_screen::LoadingScreen::test_covering());
+    world.insert_resource(roster_named("Onehunter", 1));
+    world.insert_resource(super::PendingEntryUiLoad::default());
+
+    // Covered frames 1 and 2: the cover has not provably presented yet — no load.
+    for frame in 1..=2 {
+        super::lifecycle::run_pending_entry_load(&mut world);
+        assert_eq!(
+            probe_saw(&world),
+            None,
+            "covered frame {frame}: the burst must wait for the cover to reach the glass"
+        );
+    }
+    // Covered frame 3: two cover renders have committed — the burst is hidden. Load.
+    super::lifecycle::run_pending_entry_load(&mut world);
+    assert_eq!(
+        probe_saw(&world).as_deref(),
+        Some("Onehunter"),
+        "the third covered frame pays the load, behind a presented cover"
+    );
+    assert!(
+        world.get_resource::<super::PendingEntryUiLoad>().is_none(),
+        "the latch is consumed — the loading screen's clear condition reads its absence"
+    );
+
+    drop(world);
+    let _ = std::fs::remove_dir_all(&tmp);
+}
+
+/// No cover — a capture booting straight `InWorld`, or the screen's assets missing — means no
+/// glass to protect: the armed load runs on the first frame. Without this arm a coverless run
+/// would count covered frames that never come and the UI would never load.
+#[test]
+fn no_cover_means_the_entry_load_runs_at_once() {
+    let _l = ENV_LOCK
+        .lock()
+        .unwrap_or_else(std::sync::PoisonError::into_inner);
+    let (tmp, _c, _h) = hermetic_probe("nocover");
+    let mut world = booted_world();
+    world.insert_resource(State::new(crate::char_select::ClientState::InWorld));
+    world.insert_resource(crate::loading_screen::LoadingScreen::default());
+    world.insert_resource(roster_named("Onehunter", 1));
+    world.insert_resource(super::PendingEntryUiLoad::default());
+
+    super::lifecycle::run_pending_entry_load(&mut world);
+    assert_eq!(
+        probe_saw(&world).as_deref(),
+        Some("Onehunter"),
+        "uncovered: the load runs immediately"
+    );
+
+    drop(world);
+    let _ = std::fs::remove_dir_all(&tmp);
+}
+
+/// An exit inside the deferral window (an instant disconnect at entry) drops the armed load and
+/// **writes nothing**: the session never built a UI, so the shutdown tail running against the
+/// boot VM would compose every saved file from emptiness — the wipe
+/// [`quitting_from_the_character_screen_does_not_blank_the_session_it_wrote`] guards at the
+/// other edge.
+#[test]
+fn leaving_inside_the_deferral_window_drops_the_load_and_writes_nothing() {
+    let _l = ENV_LOCK
+        .lock()
+        .unwrap_or_else(std::sync::PoisonError::into_inner);
+    let (tmp, _c, _h) = hermetic_probe("dropped");
+    let mut world = booted_world();
+    world.insert_resource(State::new(crate::char_select::ClientState::InWorld));
+    world.insert_resource(crate::loading_screen::LoadingScreen::test_covering());
+    world.insert_resource(roster_named("Onehunter", 1));
+    world.insert_resource(super::PendingEntryUiLoad::default());
+
+    super::lifecycle::run_pending_entry_load(&mut world); // covered frame 1 — still pending
+    super::end_ui_session(&mut world);
+
+    assert_eq!(probe_saw(&world), None, "no UI ever loaded");
+    assert!(
+        world.get_resource::<super::PendingEntryUiLoad>().is_none(),
+        "the latch died with the session — it must not fire on the glue"
+    );
+    let flat = crate::local_state::saved_variables_path()
+        .expect("hermetic home resolves the flat saved path");
+    assert!(
+        !flat.exists(),
+        "the shutdown tail was skipped — a UI-less VM must not write saved variables"
+    );
+
+    drop(world);
+    let _ = std::fs::remove_dir_all(&tmp);
+}
diff --git a/crates/benilla-app/src/ui_text/atlas.rs b/crates/benilla-app/src/ui_text/atlas.rs
deleted file mode 100644
index 41c1a92c..00000000
--- a/crates/benilla-app/src/ui_text/atlas.rs
+++ /dev/null
@@ -1,1461 +0,0 @@
-use std::collections::HashMap;
-use std::sync::Arc;
-
-use bevy::asset::RenderAssetUsages;
-use bevy::image::Image;
-use bevy::math::Rect;
-use bevy::prelude::*;
-use bevy::render::render_resource::{Extent3d, TextureDimension, TextureFormat};
-use bevy::window::PrimaryWindow;
-use cosmic_text::{Attrs, Buffer, Family, FontSystem, Metrics, Shaping, SwashCache, Wrap};
-
-use benilla_assets::{LockRecover, WorldAssets};
-
-use super::DEFAULT_FONT_SIZE;
-
-/// The base set of sizes baked into the atlas **for every registered face** — the distinct
-/// heights our shipped `Fonts.xml` objects use (`GameFontNormalSmall` 10 … `GameFontNormalHuge`
-/// 20). A `FontString` requesting a height not in its face's baked set snaps to the nearest baked
-/// size ([`nearest_size`] via [`UiFontAtlas::snap_for`] — per face, so a face never snaps to a
-/// size only another face bakes).
-const FONT_SIZES: &[f32] = &[
-    10.0, 12.0, 13.0, 14.0, 15.0, 16.0, 18.0, 20.0, 24.0, 36.0, 48.0,
-];
-
-/// Extra sizes baked for **Friz Quadrata only** — the zone-splash fonts (decision 0287, sizes
-/// corrected by the one-to-one fold-back): `SubZoneTextFont` 26, and 32 = the
-/// [`super::FONTSTRING_EM_CAP`] every over-cap request lands on (`ZoneTextFont`/
-/// `WorldMapTextFont`'s nominal 102, the world-map label's `SetFont` 33) — baked exact so the
-/// splash never snaps off its lawful size. The original 102 bake is gone with the law that
-/// capped it: no UI request can reach it anymore, and a retina 102 was a 204px raster per glyph.
-/// Friz is the only face any shipped `Fonts.xml` object names at these heights; baking them for
-/// all four faces would cost glyphs nothing draws.
-const FRIZ_SPLASH_SIZES: &[f32] = &[26.0, 32.0];
-
-/// The four client TTFs (verified present in `fonts.MPQ`, plain TTF — no exotic wrapper), read through
-/// the app's own patch chain rather than `std::fs` (there is no `std::fs` path to client data — see
-/// [`WorldAssets`]). Index 0 (Friz Quadrata) is the only one baked into [`UiFontAtlas`] in v1; see the
-/// module doc.
-const CLIENT_FONTS: &[&str] = &[
-    "Fonts\\FRIZQT__.TTF",
-    "Fonts\\ARIALN.TTF",
-    "Fonts\\MORPHEUS.TTF",
-    "Fonts\\SKURRI.TTF",
-];
-
-// ─────────────────────────────────────────────────────────────────────────────────────────────
-// Font loading — ported from probes/text-glyph/src/font.rs
-// ─────────────────────────────────────────────────────────────────────────────────────────────
-
-/// The face's baseline ascender as a fraction of the em — `hhea.asc / (hhea.asc + |hhea.desc|)` —
-/// straight from the raw sfnt bytes. This is the term in the client's glyph *placement* law: the
-/// ink hangs from the pixel ascender `[CGxFont+0x17c] = round(em · asc/(asc+|desc|))`, threaded
-/// unchanged into `glyph_vplace` (0x5d1360) as the operand that fixes `baseline = cellTop +
-/// ascender` (wow-re `system/font`, §5-verified 2026-07-09: the call chain `0x5ca160 → 0x5d1120
-/// [ebp+0xc] → 0x5d1360 [ebp+0x10]`, where the cell's own `[[FT_Face+0x54]+0x68]` is the
-/// per-glyph `bitmap_top`, the *subordinate* operand). This is the `ComputeRasterMetrics`
-/// `load_param`; the FreeType scaled hhea ascender (`asc/upem` ≈ 0.965) appears NOWHERE in the
-/// placement path — seating with it drops every line ~3px too low for Friz (965/1215 ≈ 0.794 vs
-/// 0.965 → baseline row 10 vs 13 in a 13-tall cell). A tiny table-directory walk (`hhea` →
-/// ascender@+4, descender@+6); `None` on any malformed/missing table.
-fn hhea_ascent_ratio(bytes: &[u8]) -> Option<f32> {
-    let num = u16::from_be_bytes(bytes.get(4..6)?.try_into().ok()?) as usize;
-    let (mut asc, mut desc) = (None, None);
-    for i in 0..num {
-        let rec = bytes.get(12 + 16 * i..12 + 16 * i + 16)?;
-        let toff = u32::from_be_bytes(rec[8..12].try_into().ok()?) as usize;
-        if &rec[0..4] == b"hhea" {
-            asc = Some(i16::from_be_bytes(bytes.get(toff + 4..toff + 6)?.try_into().ok()?) as f32);
-            desc = Some(i16::from_be_bytes(bytes.get(toff + 6..toff + 8)?.try_into().ok()?) as f32);
-        }
-    }
-    let (asc, desc) = (asc?, desc?);
-    // The denominator is narrowed to f32 exactly as the binary does (`fstp m32` @0x5ca0d?),
-    // then the ratio; `em · ratio + 0.5` floors to the load_param at the call site below.
-    let denom = asc + desc.abs();
-    (denom > 0.0 && asc > 0.0).then_some(asc / denom)
-}
-
-/// Registers `bytes` (raw TTF) into `font_system`'s `fontdb`, returning `(face_id, family_name)` — the
-/// family name is read back off the just-loaded face so callers build an exact `Attrs::family` match
-/// with no reliance on hardcoding Blizzard's font-name strings.
-fn register_font(
-    font_system: &mut FontSystem,
-    bytes: Vec<u8>,
-) -> anyhow::Result<(fontdb::ID, String)> {
-    let source = fontdb::Source::Binary(
-        std::sync::Arc::new(bytes) as std::sync::Arc<dyn AsRef<[u8]> + Sync + Send>
-    );
-    let ids = font_system.db_mut().load_font_source(source);
-    let id = *ids
-        .first()
-        .ok_or_else(|| anyhow::anyhow!("font source produced no faces (not a valid TTF?)"))?;
-    let family = font_system
-        .db_mut()
-        .face(id)
-        .ok_or_else(|| anyhow::anyhow!("face {id:?} vanished right after loading"))?
-        .families
-        .first()
-        .map(|(name, _)| name.clone())
-        .ok_or_else(|| anyhow::anyhow!("face {id:?} carries no family name"))?;
-    Ok((id, family))
-}
-
-// ─────────────────────────────────────────────────────────────────────────────────────────────
-// Glyph atlas — ported from probes/text-glyph/src/atlas.rs
-// ─────────────────────────────────────────────────────────────────────────────────────────────
-
-/// `(font, glyph, size, outline_radius)` — the atlas's lookup key. `size_bits` is `f32::to_bits()`
-/// of the exact logical size the glyph was rasterized at; [`layout_text_quads`] must shape at the
-/// same size it looks up. `outline_radius` selects the cell VARIANT: `0` = the plain coverage cell
-/// (white × coverage — every face/size bakes one; all measurement reads these, advances are
-/// variant-invariant), `1`/`2` = the NORMAL/THICK **outlined composite** cell (black ring + white
-/// fill in one texture, the real client's baked-outline architecture — its blit dispatch `0x5cf310`
-/// selects an outline blit variant by font flags, so ring and fill live in ONE cell and fade as one
-/// under frame alpha; the fade-composite fold-back record). Outlined variants exist only for the
-/// `(face, size, radius)` triples the shipped `Fonts.xml` registry actually names — an unplanned
-/// combo misses and [`layout_text_quads`] falls back to the legacy stamped halos.
-pub(super) type GlyphKey = (fontdb::ID, u16, u32, u8);
-
-/// The baked-cell radius for a font's outline flag: the same `r` the legacy stamp synthesis used
-/// (`r=1` NORMAL, `r=2` THICK — logical px), now the bake-time ring reach and the lookup key's
-/// variant discriminant.
-pub(super) fn outline_radius(outline: benilla_ui::script::Outline) -> u8 {
-    match outline {
-        benilla_ui::script::Outline::None => 0,
-        benilla_ui::script::Outline::Normal => 1,
-        benilla_ui::script::Outline::Thick => 2,
-    }
-}
-
-/// One packed glyph's metadata — atlas UV rect, bitmap size, bearing (from the rasterized bitmap's
-/// origin to its top-left, swash convention: `left` rightward, `top` upward from the baseline), and
-/// the shaped advance width (`LayoutGlyph::w`, cosmic-text's own hitbox width — kerned/hinted, but
-/// **not** the RE font kernel's bit-exact advance; see the module doc's fidelity note).
-///
-/// **All fields are PHYSICAL px** — the glyph was baked at `logical_size × bake_scale` (the DPI-aware
-/// bake, [`UiFontAtlas::scale`]). [`layout_text_quads`]/[`measure_text`] divide these back by
-/// `scale` to lay out in logical units, then snap positions to the physical-pixel grid; the net effect
-/// is a bitmap rasterized at device resolution and drawn 1 texel : 1 physical pixel (crisp), not a
-/// half-resolution bitmap upscaled by the retina framebuffer (the pre-DPI blur).
-#[derive(Clone, Copy, Debug)]
-pub(super) struct GlyphInfo {
-    pub(super) uv: Rect,
-    pub(super) px_w: f32,
-    pub(super) px_h: f32,
-    pub(super) bearing_x: f32,
-    pub(super) bearing_top: f32,
-    pub(super) advance: f32,
-}
-
-/// Simple shelf (row) packer: places rects left-to-right, wraps to a new row when a rect wouldn't fit,
-/// 1px padding on every edge to avoid bilinear-sample bleed between neighbours.
-struct ShelfPacker {
-    width: u32,
-    cursor_x: u32,
-    cursor_y: u32,
-    row_height: u32,
-}
-
-impl ShelfPacker {
-    fn new(width: u32) -> Self {
-        Self {
-            width,
-            cursor_x: 0,
-            cursor_y: 0,
-            row_height: 0,
-        }
-    }
-
-    fn place(&mut self, w: u32, h: u32) -> (u32, u32) {
-        if self.cursor_x + w + 1 > self.width {
-            self.cursor_x = 0;
-            self.cursor_y += self.row_height + 1;
-            self.row_height = 0;
-        }
-        let pos = (self.cursor_x, self.cursor_y);
-        self.cursor_x += w + 1;
-        self.row_height = self.row_height.max(h);
-        pos
-    }
-
-    fn total_height(&self) -> u32 {
-        (self.cursor_y + self.row_height).max(1)
-    }
-}
-
-/// A baked cell's texel payload: plain coverage (blitted as white × alpha) or a pre-composited
-/// RGBA cell (the outlined variants — black ring + white fill, blitted verbatim).
-enum CellData {
-    Coverage(Vec<u8>), // one byte/px
-    Rgba(Vec<u8>),     // four bytes/px, straight alpha
-}
-
-struct RasterEntry {
-    key: GlyphKey,
-    w: u32,
-    h: u32,
-    data: CellData,
-    bearing_x: f32,
-    bearing_top: f32,
-    advance: f32,
-}
-
-/// The client's AA neighbour-count → outline-alpha LUT (`DAT_0080a8ec`, wow-re
-/// `system/font/scratch/outline-bake-tint.md`, §5 double-pair + difftests, commit `f80ce699`):
-/// index = the number of marked cells in the in-bounds 3×3 box (centre included), value = the
-/// 4-bit alpha, here pre-widened to 8-bit (`nibble × 17`).
-const AA_NEIGHBOUR_LUT: [u8; 10] = [0, 17, 17, 51, 85, 119, 153, 187, 221, 255];
-
-/// Composite one glyph's coverage bitmap into an **outlined cell** — the byte recipe of the
-/// client's AA-outline blit (`glyph_blit_aa_outline 0x5cea30`, dispatched by `0x5cf310`; wow-re
-/// `outline-bake-tint.md`, difftested emulation `wow-5875-re/crates/font/src/raster.rs`):
-///
-/// 1. **Mark** every texel with non-zero coverage.
-/// 2. **Dilate** iteratively — each pass marks every virgin texel 8-adjacent to a marked one.
-///    The binary runs 1 pass for NORMAL, 2 for THICK; we run `r × round(scale)` so the ring keeps
-///    its logical weight under the DPI-aware physical bake (at `scale = 1` this IS the byte
-///    recipe; the finer grid at retina is the same deliberate resolution upgrade as the glyph
-///    bake itself).
-/// 3. **Alpha** per texel = [`AA_NEIGHBOUR_LUT`]`[count of marked cells in the in-bounds 3×3
-///    box]` — the ring AND the fill edge take the same neighbourhood-graded alpha (interior = 9
-///    marked ⇒ opaque; a THICK ring's outer corners grade down to ~⅓ — the real softer outer
-///    edge).
-/// 4. **Pack**: unmarked ⇒ transparent; zero-coverage (pure ring) ⇒ black at the LUT alpha; else
-///    `RGB = the coverage as gray` (the fill ramps *toward the ring's black* at AA edges — not
-///    white-with-thin-alpha) at the LUT alpha. The binary quantizes to ARGB4444; we keep 8-bit
-///    (same law, no banding — the one deliberate widening, like the LUT `×17`).
-///
-/// Draw-side law this feeds (same note, prongs 2–3): one quad per glyph, vertex color MODULATE —
-/// white fill takes the text tint, black ring stays black — and ONE alpha per pass, so a frame
-/// fade thins ring+fill together (no `α(1−α)` blackening, the defect the stamped halos had).
-///
-/// Returns `(rgba, out_w, out_h, pad)`: the cell grows by `pad = r·round(scale)` texels each side
-/// (the binary's cell `em+2/+4` and origin col `1/2`, generalized); the caller shifts bearings by
-/// `pad`. The advance is untouched — the step law owns tracking (THICK `+1`, NORMAL none).
-fn outlined_cell(cov: &[u8], w: u32, h: u32, r: u8, scale: f32) -> (Vec<u8>, u32, u32, u32) {
-    let passes = (u32::from(r) * (scale.round().max(1.0) as u32)).max(1);
-    let pad = passes;
-    let (out_w, out_h) = (w + 2 * pad, h + 2 * pad);
-    let cells = (out_w * out_h) as usize;
-
-    // 1. Mark coverage into the map (1 = glyph ink), coverage kept alongside for the pack.
-    let mut map = vec![0u8; cells];
-    for row in 0..h {
-        for col in 0..w {
-            if cov[(row * w + col) as usize] != 0 {
-                map[((row + pad) * out_w + (col + pad)) as usize] = 1;
-            }
-        }
-    }
-
-    // 2. Iterative 8-neighbour dilation: pass k marks virgin cells adjacent to any marked cell
-    //    (the binary's mask-1-write-2 / mask-3-write-4 passes, generalized to k marks).
-    for pass in 0..passes {
-        let mark = (pass + 2) as u8; // 1 = ink, 2.. = ring generations
-        for row in 0..out_h {
-            for col in 0..out_w {
-                let c = (row * out_w + col) as usize;
-                if map[c] != 0 {
-                    continue;
-                }
-                'probe: for dr in -1i32..=1 {
-                    for dc in -1i32..=1 {
-                        let (rr, cc) = (row as i32 + dr, col as i32 + dc);
-                        if rr < 0 || rr >= out_h as i32 || cc < 0 || cc >= out_w as i32 {
-                            continue;
-                        }
-                        let n = map[(rr as u32 * out_w + cc as u32) as usize];
-                        if n != 0 && n < mark {
-                            map[c] = mark;
-                            break 'probe;
-                        }
-                    }
-                }
-            }
-        }
-    }
-
-    // 3.+4. Neighbourhood-count alpha + pack.
-    let mut rgba = vec![0u8; cells * 4];
-    for row in 0..out_h {
-        for col in 0..out_w {
-            let c = (row * out_w + col) as usize;
-            if map[c] == 0 {
-                continue;
-            }
-            let mut count = 0usize;
-            for dr in -1i32..=1 {
-                for dc in -1i32..=1 {
-                    let (rr, cc) = (row as i32 + dr, col as i32 + dc);
-                    if rr < 0 || rr >= out_h as i32 || cc < 0 || cc >= out_w as i32 {
-                        continue;
-                    }
-                    if map[(rr as u32 * out_w + cc as u32) as usize] != 0 {
-                        count += 1;
-                    }
-                }
-            }
-            let alpha = AA_NEIGHBOUR_LUT[count];
-            let fill = if row >= pad && row < pad + h && col >= pad && col < pad + w {
-                cov[((row - pad) * w + (col - pad)) as usize]
-            } else {
-                0
-            };
-            let idx = c * 4;
-            // Pure ring: black. Fill: the coverage as gray (ramps toward the ring at AA edges).
-            rgba[idx] = fill;
-            rgba[idx + 1] = fill;
-            rgba[idx + 2] = fill;
-            rgba[idx + 3] = alpha;
-        }
-    }
-    (rgba, out_w, out_h, pad)
-}
-
-/// The built atlas bitmap plus its glyph table. Chars with no glyph in any baked font end up in
-/// `missing` (reported, not fatal).
-struct BuiltAtlas {
-    rgba: Vec<u8>,
-    width: u32,
-    height: u32,
-    glyphs: HashMap<GlyphKey, GlyphInfo>,
-    missing: Vec<char>,
-}
-
-/// Rasterize `charset` for every `(font_id, family_name)` in `fonts`, at every size in `sizes`, into
-/// one packed atlas — every glyph baked at **zero subpixel offset** (the standard bitmap-font-atlas
-/// simplification; see `probes/text-glyph`'s report §7 for where this does/doesn't matter — never for
-/// game UI at integer-pixel placement).
-///
-/// **DPI-aware:** each logical `size` is shaped and rasterized at `size × scale` (the window's
-/// `scale_factor`), so on a retina display the bitmap carries the full device resolution instead of a
-/// half-res upscale. The glyph is *keyed* by its **logical** size (`size.to_bits()`) — the physical
-/// scale is an implementation detail of the bake, transparent to the lookup — and every stored metric
-/// (advance/bearing/bitmap size) is in physical px, divided back by `scale` at layout time.
-fn build_atlas(
-    font_system: &mut FontSystem,
-    swash_cache: &mut SwashCache,
-    fonts: &[(fontdb::ID, String, Vec<f32>)],
-    charset: &[char],
-    atlas_width: u32,
-    scale: f32,
-    // The outlined-cell bake plan: `(family, logical-size bits) → ring radii` — the distinct
-    // outlined pairings the shipped font-object registry names (census in
-    // [`load_fonts_and_build_atlas`]). Each planned radius bakes an [`outlined_cell`] variant
-    // alongside the plain cell.
-    outlined: &HashMap<(String, u32), Vec<u8>>,
-) -> BuiltAtlas {
-    let mut rasters: Vec<RasterEntry> = Vec::new();
-    let mut missing = Vec::new();
-
-    for (_font_id, family, sizes) in fonts {
-        let attrs = Attrs::new().family(Family::Name(family));
-        for &size in sizes.iter() {
-            let radii: &[u8] = outlined
-                .get(&(family.clone(), size.to_bits()))
-                .map_or(&[], Vec::as_slice);
-            // Shape + rasterize at the physical size; key by the logical size so layout looks up by
-            // the height a `FontString` asks for, never by the retina-dependent physical size.
-            let phys = size * scale;
-            for &ch in charset {
-                let mut one = [0u8; 4];
-                let s = ch.encode_utf8(&mut one);
-
-                let mut buffer = Buffer::new(font_system, Metrics::new(phys, phys));
-                buffer.set_wrap(font_system, Wrap::None);
-                buffer.set_text(font_system, s, &attrs, Shaping::Advanced, None);
-                buffer.shape_until_scroll(font_system, false);
-
-                let mut found = false;
-                for run in buffer.layout_runs() {
-                    for glyph in run.glyphs {
-                        found = true;
-                        // A lone first glyph on the line has x == y == 0.0, so this is the
-                        // zero-subpixel canonical rasterization for (font, glyph, physical size).
-                        let physical = glyph.physical((0.0, 0.0), 1.0);
-                        let key: GlyphKey = (glyph.font_id, glyph.glyph_id, size.to_bits(), 0);
-                        let advance = glyph.w;
-                        if let Some(img) = swash_cache.get_image(font_system, physical.cache_key) {
-                            if img.placement.width > 0 && img.placement.height > 0 {
-                                let (w, h) = (img.placement.width, img.placement.height);
-                                // The planned outlined variants: the composite ring+fill cell,
-                                // bearings shifted out by the pad, advance untouched.
-                                for &r in radii {
-                                    let (rgba, ow, oh, pad) =
-                                        outlined_cell(&img.data, w, h, r, scale);
-                                    rasters.push(RasterEntry {
-                                        key: (key.0, key.1, key.2, r),
-                                        w: ow,
-                                        h: oh,
-                                        data: CellData::Rgba(rgba),
-                                        bearing_x: img.placement.left as f32 - pad as f32,
-                                        bearing_top: img.placement.top as f32 + pad as f32,
-                                        advance,
-                                    });
-                                }
-                                rasters.push(RasterEntry {
-                                    key,
-                                    w,
-                                    h,
-                                    data: CellData::Coverage(img.data.clone()),
-                                    bearing_x: img.placement.left as f32,
-                                    bearing_top: img.placement.top as f32,
-                                    advance,
-                                });
-                            } else {
-                                // Whitespace / zero-ink glyph (e.g. space): keep the advance, no
-                                // bitmap — for the planned outlined radii too, so an outlined
-                                // string's spaces hit their variant key instead of falling back.
-                                for &r in radii {
-                                    rasters.push(RasterEntry {
-                                        key: (key.0, key.1, key.2, r),
-                                        w: 0,
-                                        h: 0,
-                                        data: CellData::Coverage(Vec::new()),
-                                        bearing_x: 0.0,
-                                        bearing_top: 0.0,
-                                        advance,
-                                    });
-                                }
-                                rasters.push(RasterEntry {
-                                    key,
-                                    w: 0,
-                                    h: 0,
-                                    data: CellData::Coverage(Vec::new()),
-                                    bearing_x: 0.0,
-                                    bearing_top: 0.0,
-                                    advance,
-                                });
-                            }
-                        }
-                    }
-                }
-                if !found {
-                    missing.push(ch);
-                }
-            }
-        }
-    }
-
-    let mut packer = ShelfPacker::new(atlas_width);
-    let placements: Vec<(u32, u32)> = rasters
-        .iter()
-        .map(|r| {
-            if r.w == 0 || r.h == 0 {
-                (0, 0)
-            } else {
-                packer.place(r.w, r.h)
-            }
-        })
-        .collect();
-    let atlas_height = packer.total_height();
-
-    let mut rgba = vec![0u8; (atlas_width as usize) * (atlas_height as usize) * 4];
-    let mut glyphs = HashMap::with_capacity(rasters.len());
-    for (r, (x, y)) in rasters.iter().zip(placements.iter().copied()) {
-        if r.w > 0 && r.h > 0 {
-            for row in 0..r.h {
-                for col in 0..r.w {
-                    let px = x + col;
-                    let py = y + row;
-                    let idx = ((py * atlas_width + px) * 4) as usize;
-                    match &r.data {
-                        // Plain coverage: white × alpha (vertex color supplies the ink color).
-                        CellData::Coverage(cov) => {
-                            rgba[idx] = 255;
-                            rgba[idx + 1] = 255;
-                            rgba[idx + 2] = 255;
-                            rgba[idx + 3] = cov[(row * r.w + col) as usize];
-                        }
-                        // Pre-composited outlined cell: verbatim (black ring, white fill).
-                        CellData::Rgba(cell) => {
-                            let src = ((row * r.w + col) * 4) as usize;
-                            rgba[idx..idx + 4].copy_from_slice(&cell[src..src + 4]);
-                        }
-                    }
-                }
-            }
-        }
-        let uv = Rect::new(
-            x as f32 / atlas_width as f32,
-            y as f32 / atlas_height as f32,
-            (x + r.w) as f32 / atlas_width as f32,
-            (y + r.h) as f32 / atlas_height as f32,
-        );
-        glyphs.insert(
-            r.key,
-            GlyphInfo {
-                uv,
-                px_w: r.w as f32,
-                px_h: r.h as f32,
-                bearing_x: r.bearing_x,
-                bearing_top: r.bearing_top,
-                advance: r.advance,
-            },
-        );
-    }
-
-    BuiltAtlas {
-        rgba,
-        width: atlas_width,
-        height: atlas_height,
-        glyphs,
-        missing,
-    }
-}
-
-/// ASCII printable (0x20..=0x7E) plus a representative handful of Latin-1 accented glyphs (the
-/// German/French client's own charset overlap).
-fn default_charset() -> Vec<char> {
-    let mut cs: Vec<char> = (0x20u32..=0x7E).filter_map(char::from_u32).collect();
-    cs.extend([
-        'ä', 'ö', 'ü', 'Ä', 'Ö', 'Ü', 'ß', 'é', 'è', 'ê', 'à', 'â', 'ç', 'î', 'ï', 'ô', 'û', 'ù',
-    ]);
-    cs
-}
-
-// ─────────────────────────────────────────────────────────────────────────────────────────────
-// Integration — the resource, plugin, and Bevy Startup system
-// ─────────────────────────────────────────────────────────────────────────────────────────────
-
-/// One character's contribution to a line's width, at one (face, size), **before** the outline
-/// bias — the pre-summed floor of its glyphs' physical advances plus how many glyphs it shaped to.
-///
-/// Two numbers rather than one because the client's step law
-/// ([`super::layout::client_step`]) adds its bias **per glyph**, not per character: a character
-/// that shapes to two glyphs takes two biases. Every character in the baked charset shapes to one
-/// under the client's four faces, so `glyphs` is 1 everywhere today — it is here so the law stays
-/// the law if that ever stops being true.
-#[derive(Clone, Copy, Debug, PartialEq)]
-pub(crate) struct CharStep {
-    /// Σ `advance.floor()` over the character's glyphs, in **physical** px.
-    pub(super) floor_sum: f32,
-    /// How many glyphs it shaped to — the multiplier on the outline bias.
-    pub(super) glyphs: u16,
-}
-
-/// Everything **width measurement** needs, and nothing that needs `&mut` — the pure-data half of
-/// [`UiFontAtlas`], split out so it can be handed to the script VM as a
-/// [`TextMeasure`](benilla_ui::script::TextMeasure) and answer a `GetStringWidth` inline.
-///
-/// **Why a table instead of a shaper.** The client's width law is a sum of per-glyph steps with no
-/// kerning term (`ComputeStep 0x5ca2d0` — see [`super::layout::client_step`]), so a string's width
-/// is a pure function of its characters, its face, its size and its outline. Nothing about it needs
-/// a shaping engine; the shaper was only ever how we looked an advance up. Precomputing that lookup
-/// at bake time is therefore not an approximation of the measure path — it **is** the measure path,
-/// with the one `&mut`-shaped step hoisted out of the hot loop.
-///
-/// Cheap to clone by design ([`Arc`] at every holder), because the VM's copy and the atlas's are
-/// the same table and must never be two tables.
-pub(crate) struct TextMetrics {
-    /// `(family, baked size bits) -> char -> step` for the baked charset. A character absent here
-    /// has no baked glyph, draws nothing, and measures **zero** — see [`Self::char_step`].
-    pub(super) steps: HashMap<(String, u32), HashMap<char, CharStep>>,
-    /// Blizzard font path (lowercased) → `fontdb` family name.
-    pub(super) path_to_family: HashMap<String, String>,
-    /// The fallback family (Friz Quadrata) for a FontString with no/unknown font path.
-    pub(super) default_family: String,
-    /// The default family's baked sizes (the superset), ascending — [`Self::snap_size`]'s list.
-    pub(super) sizes: Vec<f32>,
-    /// Per-family baked sizes (ascending) — [`Self::snap_for`]'s lookup.
-    pub(super) sizes_by_family: HashMap<String, Vec<f32>>,
-    /// The physical/logical scale the atlas was baked at; every step above is physical px.
-    pub(super) scale: f32,
-}
-
-impl TextMetrics {
-    /// The `fontdb` family a Blizzard font path resolves to, or the default face.
-    pub(super) fn family_for(&self, path: Option<&str>) -> String {
-        path.and_then(|p| self.path_to_family.get(&p.to_ascii_lowercase()))
-            .unwrap_or(&self.default_family)
-            .clone()
-    }
-
-    /// The baked size `want` snaps to **for a specific family** — keyed by the face it resolved, so
-    /// a request never snaps to a size only another face bakes.
-    pub(super) fn snap_for(&self, family: &str, want: f32) -> f32 {
-        let sizes = self.sizes_by_family.get(family).unwrap_or(&self.sizes);
-        nearest_size(sizes, want)
-    }
-
-    /// One character's step at `(family, size)`. `None` for a character with no baked glyph: it
-    /// draws nothing, so it measures nothing. That is a deliberate, narrow divergence from the
-    /// render **pen**, which still tracks such a glyph's shaped advance
-    /// ([`super::layout::layout_text_quads`]) — it applies only to text outside the baked charset,
-    /// i.e. text this client cannot draw at all.
-    pub(super) fn char_step(&self, family: &str, size: f32, c: char) -> Option<CharStep> {
-        self.steps
-            .get(&(family.to_string(), size.to_bits()))
-            .and_then(|m| m.get(&c))
-            .copied()
-    }
-}
-
-/// The baked glyph atlas + live shaping state, built once at Startup from the client's own Friz
-/// Quadrata TTF. See the module doc's v1 simplifications for why only one face/size is baked.
-#[derive(Resource)]
-pub(crate) struct UiFontAtlas {
-    /// The raster environment these cells were baked for ([`BakeEnv`]) — compared against the live
-    /// one every frame, and the atlas re-bakes when they part.
-    pub(super) env: BakeEnv,
-    /// Bumped on every re-bake. The host's measure seam watches it: an
-    /// [`crate::ui_text::AtlasMeasurer`] holds a snapshot of the step table, so a new bake must
-    /// re-seat it and drop the engine's cached metrics even when the seam itself is unchanged
-    /// (a pure DPI hop moves the table without moving `seam`).
-    pub(crate) generation: u64,
-    /// Live shaper state — [`layout_text_quads`] needs `&mut FontSystem` to shape each run (kerned
-    /// advances), even though the bitmap glyphs themselves are pre-baked; see the module doc's
-    /// metric-fidelity seam note.
-    pub(super) font_system: FontSystem,
-    /// `(font, glyph, size_bits) -> baked glyph metadata`, looked up by what `font_system` shapes.
-    pub(super) glyphs: HashMap<GlyphKey, GlyphInfo>,
-    /// The packed atlas bitmap, already uploaded.
-    pub(super) image: Handle<Image>,
-    /// Per-family baseline-ascender fraction `hhea.asc / (asc + |desc|)` (see [`hhea_ascent_ratio`])
-    /// — the term in the client's placement law; [`crate::ui_text::layout`] seats each line's
-    /// baseline at `round(size · ratio)`, the face pixel ascender `[CGxFont+0x17c]` that
-    /// `glyph_vplace` 0x5d1360 hangs ink from.
-    pub(super) family_ascent: HashMap<String, f32>,
-    /// The width law's inputs — face resolution, size snapping, per-character steps, bake scale.
-    /// Shared (never copied) with the script VM's synchronous measurer, so a string measured
-    /// mid-tick and the same string measured at extract are the same number by construction.
-    pub(crate) metrics: Arc<TextMetrics>,
-    /// Per-region ellipsis display strings ([`super::EllipsisMemo`]) — the client's own
-    /// `CGxString+0xf8` cache, keyed by the inputs instead of a dirty flag. It lives here because
-    /// a re-bake replaces this whole resource, which is exactly when every answer in it is stale:
-    /// the step table it was computed against is gone.
-    pub(super) ellipsis: super::EllipsisMemo,
-}
-
-impl UiFontAtlas {
-    /// The resolved baseline-ascender fraction (`hhea.asc / (asc + |desc|)`) for a font path
-    /// (`None` = the default family, Friz ≈ 0.794) — the baseline's seat inside a one-pitch cell.
-    /// The overhead-name mesh bake (`crate::nameplates`) uses it to hang each line from its
-    /// byte-law baseline (the world-mode seat, wow-re `name-render-geometry-law.md`).
-    pub(crate) fn ascent_ratio(&self, path: Option<&str>) -> f32 {
-        let family = self.metrics.family_for(path);
-        self.family_ascent.get(&family).copied().unwrap_or(0.794)
-    }
-
-    /// The baked size [`nearest_size`] snaps a requested height to — for a caller outside the
-    /// layout path (world combat text) that needs to know the snap *before* handing the height to
-    /// [`crate::ui_text::layout_text_quads`], so it can rescale the shaped quads to an unbaked
-    /// target size around its own anchor. Snaps against the default family (Friz) — the superset
-    /// list, and the face those callers draw.
-    pub(crate) fn snap_size(&self, want: f32) -> f32 {
-        nearest_size(&self.metrics.sizes, want)
-    }
-
-    /// The shared width-law table — what the script VM's synchronous measurer is built from.
-    pub(crate) fn metrics(&self) -> Arc<TextMetrics> {
-        Arc::clone(&self.metrics)
-    }
-
-    /// The packed atlas texture — for the world-pass consumers (the nameplate meshes) that bind
-    /// glyph cells onto 3-D geometry instead of UI quads.
-    pub(crate) fn image(&self) -> Handle<Image> {
-        self.image.clone()
-    }
-}
-
-/// Loads the client's TTFs + bakes the glyph atlas at Startup, feeding [`crate::ui_script`]'s
-/// `QuadContent::Text` extraction. See the module doc.
-pub(crate) struct UiTextPlugin;
-
-impl Plugin for UiTextPlugin {
-    fn build(&self, app: &mut App) {
-        // Runs each Update: the first bake needs both the patch chain (opened at `AssetSet::Open`)
-        // *and* the primary window's real `scale_factor`, which winit only reports once the OS
-        // window exists (a Startup read can still see the placeholder 1.0), so gating on the window
-        // being present lets it happen on the first frame the real scale is known. Every later
-        // frame it compares the live raster environment against the baked one and re-bakes when
-        // they part ([`BakeEnv`]).
-        app.add_systems(Update, load_fonts_and_build_atlas);
-    }
-}
-
-/// The raster environment a set of glyph cells is only valid inside — the two numbers that decide
-/// what pixel size each logical size bakes at.
-///
-/// **Why the atlas must follow it.** Text draws at `unit height × seam` ([`super::drawn_px`],
-/// decisions 0582/0584) and is rasterized at `× dpi`; the bake plans its size list from the same
-/// two numbers. When they move and the bake does not, every request lands *between* baked sizes:
-/// the layout snaps to the nearest one and rescales the finished quads to the true height
-/// (`drawn_k`), so each glyph is a bitmap resampled by a non-integer factor instead of a cell
-/// drawn one texel per pixel. That is the reported washed-out text (B244) — the default window is
-/// 1600×900, so anyone who maximises moves the seam and every glyph on screen starts resampling —
-/// and, before `measure_text` learned the same rescale, it also armed the measure/render split
-/// that truncated fitting strings (B209).
-///
-/// 0582 accepted keeping the bake ("slightly soft — the same accepted policy as a monitor DPI
-/// hop"); at the ratios a real player produces it is not slight, and it is not a policy anyone
-/// opted into by maximising a window.
-#[derive(Clone, Copy, Debug, PartialEq)]
-pub(super) struct BakeEnv {
-    /// The 768-virtual seam scale `windowH/768 × uiScale` ([`crate::ui_script::seam_scale`]).
-    pub(super) seam: f32,
-    /// The window's `scale_factor` — the physical/logical ratio the cells are rasterized at.
-    pub(super) dpi: f32,
-}
-
-impl BakeEnv {
-    /// Same raster environment? Compared with a tolerance because both terms are recomputed from
-    /// float window metrics every frame; a difference this small cannot move any baked size to a
-    /// different integer pixel.
-    fn matches(self, other: Self) -> bool {
-        (self.seam - other.seam).abs() < 1e-4 && (self.dpi - other.dpi).abs() < 1e-4
-    }
-}
-
-/// How long the raster environment must hold still before the atlas re-bakes.
-///
-/// A window drag delivers a new size every frame and a bake rasterizes the whole charset at every
-/// registry size — baking each intermediate size would rasterize hundreds of times across one
-/// drag. Waiting for the environment to settle costs a fraction of a second of the old (resampled)
-/// cells at the end of a resize, which is exactly the state we already shipped permanently.
-const REBAKE_SETTLE: f32 = 0.25;
-
-/// What the glyph cells must be baked for, read live — the window's two raster terms plus the
-/// uiScale dial, bundled because they answer one question and are read at one place.
-#[derive(bevy::ecs::system::SystemParam)]
-pub(super) struct RasterEnv<'w, 's> {
-    /// The primary window: `scale_factor` (physical/logical) and height (the 768-virtual seam).
-    windows: Query<'w, 's, &'static Window, With<PrimaryWindow>>,
-    /// The uiScale dial folded into the bake scale (decision 0584); optional so a UI-less app
-    /// (no `UiScriptPlugin`) still bakes at the 768 base.
-    scale_cvar: Option<Res<'w, crate::ui_script::UiScaleCvar>>,
-    time: Res<'w, Time>,
-}
-
-impl RasterEnv<'_, '_> {
-    /// The environment to bake for, or `None` before winit has made the window — a Startup read
-    /// can still see the placeholder `scale_factor` 1.0, so the first bake waits for the real one.
-    fn probe(&self) -> Option<BakeEnv> {
-        let window = self.windows.single().ok()?;
-        Some(BakeEnv {
-            seam: crate::ui_script::seam_scale(
-                window.height(),
-                self.scale_cvar.as_deref().map_or(1.0, |c| c.0),
-            ),
-            dpi: window.scale_factor(),
-        })
-    }
-}
-
-/// Read the client TTFs through the app's own patch chain ([`WorldAssets::chain`] — never
-/// `std::fs`), register them into one `fontdb`, and bake **every** registered face at every
-/// [`FONT_SIZES`] into a [`UiFontAtlas`] (so a font object naming ARIALN/MORPHEUS at 10..20px resolves
-/// to real baked glyphs). Index 0 (Friz Quadrata) is the fallback face + required — if it's
-/// unreadable (or no client data is open) text simply won't render, the same graceful-absence posture
-/// [`crate::ui_script`]'s extraction takes (a missing [`UiFontAtlas`] means "skip `Text` regions").
-fn load_fonts_and_build_atlas(
-    mut commands: Commands,
-    world_assets: Option<Res<WorldAssets>>,
-    mut images: ResMut<Assets<Image>>,
-    env: RasterEnv,
-    existing: Option<Res<UiFontAtlas>>,
-    // The engine host (loaded at Startup, so present by this first-Update bake) — read-only, for
-    // the outlined-cell census off its font-object registry. `None` (a UI-less run) just means no
-    // outlined variants: the stamped-halo fallback covers.
-    script: Option<bevy::prelude::NonSend<benilla_ui::script::UiScript>>,
-    // Seconds the live environment has differed from the baked one — the [`REBAKE_SETTLE`] debounce.
-    mut drifted_for: Local<f32>,
-) {
-    let Some(want) = env.probe() else {
-        return;
-    };
-    let (scale, ui_scale) = (want.dpi, want.seam);
-    // Re-bake when the raster environment moves ([`BakeEnv`]) — a resize, a fullscreen toggle, a
-    // monitor hop, the uiScale slider — but only once it has held still, so a window drag doesn't
-    // rasterize the charset once per frame.
-    let generation = match existing.as_deref() {
-        Some(atlas) if atlas.env.matches(want) => {
-            *drifted_for = 0.0;
-            return;
-        }
-        Some(atlas) => {
-            *drifted_for += env.time.delta_secs();
-            if *drifted_for < REBAKE_SETTLE {
-                return;
-            }
-            atlas.generation + 1
-        }
-        None => 0,
-    };
-    *drifted_for = 0.0;
-    let Some(world_assets) = world_assets else {
-        // No client data open — text won't render (the missing-atlas graceful path in `ui_script`).
-        // Nothing to log-throttle here: this returns before inserting, so it retries next frame until
-        // the chain opens; the chain-open failure is already logged by the asset foundation.
-        return;
-    };
-    // Timed because this is the one cost a resize now pays, and a number nobody has is a number
-    // that gets guessed at the next time someone wonders whether the debounce is long enough.
-    let bake_started = std::time::Instant::now();
-    info!(
-        "ui_text: baking glyph atlas (generation {generation}) at scale_factor {scale}, seam \
-         {ui_scale:.4} — physical-resolution glyphs, one texel per device pixel at these sizes"
-    );
-
-    let mut font_system = FontSystem::new_with_fonts(std::iter::empty());
-    let mut swash_cache = SwashCache::new();
-    // The faces we successfully register, in CLIENT_FONTS order (index 0 = Friz = fallback), each
-    // with its baked-size list (Friz gets the splash extras), plus the Blizzard-path → family map
-    // a resolved `font` path selects its baked face through.
-    let mut faces: Vec<(fontdb::ID, String, Vec<f32>)> = Vec::new();
-    let mut path_to_family: HashMap<String, String> = HashMap::new();
-    let mut family_ascent: HashMap<String, f32> = HashMap::new();
-    let mut friz_family: Option<String> = None;
-    for (i, &path) in CLIENT_FONTS.iter().enumerate() {
-        let bytes = {
-            let chain = world_assets.chain.lock_recover();
-            match chain.read(path) {
-                Ok(b) => b,
-                Err(e) => {
-                    warn!("ui_text: failed to read {path} from the patch chain: {e:#}");
-                    continue;
-                }
-            }
-        };
-        let ascent_ratio = hhea_ascent_ratio(&bytes);
-        match register_font(&mut font_system, bytes) {
-            Ok((id, family)) => {
-                path_to_family.insert(path.to_ascii_lowercase(), family.clone());
-                if let Some(r) = ascent_ratio {
-                    family_ascent.insert(family.clone(), r);
-                }
-                let mut sizes = FONT_SIZES.to_vec();
-                if i == 0 {
-                    friz_family = Some(family.clone());
-                    // Friz alone carries the zone-splash sizes (decision 0287); keep the list
-                    // ascending so nearest-tie behavior stays order-stable.
-                    sizes.extend_from_slice(FRIZ_SPLASH_SIZES);
-                    sizes.sort_by(|a, b| a.partial_cmp(b).expect("finite font sizes"));
-                }
-                faces.push((id, family, sizes));
-            }
-            Err(e) => warn!("ui_text: failed to register {path}: {e:#}"),
-        }
-    }
-
-    let Some(friz_family) = friz_family else {
-        warn!(
-            "ui_text: Friz Quadrata (FRIZQT__.TTF) unavailable — FontString text will not render"
-        );
-        return;
-    };
-
-    // The registry-size census (decision 0581): every height the shipped `Fonts.xml` font-object
-    // registry declares joins its face's baked set — the hardcoded FONT_SIZES list had drifted
-    // from the registry (no 25/30), so NumberFontNormalHuge 30 snapped to 24 and the portrait
-    // hit indicator rendered ~20% small. Baking what the registry declares (at the drawn ×s
-    // size) makes the declared sizes exact; runtime SetTextHeight sizes BETWEEN baked ones
-    // rescale in the layout (`layout_text_quads`' exact-height scale, same decision).
-    if let Some(script) = script.as_deref() {
-        for fo in script.font_objects() {
-            let family = fo
-                .font
-                .as_deref()
-                .and_then(|p| path_to_family.get(&p.to_ascii_lowercase()))
-                .unwrap_or(&friz_family)
-                .clone();
-            let Some(h) = super::fontstring_em(fo.height).map(|u| u * ui_scale) else {
-                continue;
-            };
-            if let Some((_, _, sizes)) = faces.iter_mut().find(|(_, f, _)| *f == family) {
-                if !sizes.iter().any(|s| (s - h).abs() < 0.01) {
-                    sizes.push(h);
-                    sizes.sort_by(|a, b| a.partial_cmp(b).expect("finite font sizes"));
-                }
-            }
-        }
-    }
-
-    // The outlined-cell census: every (face, size, ring radius) the shipped font-object registry
-    // can actually request — read from the engine's `Fonts.xml` registry (loaded at Startup,
-    // strictly before this first-Update bake), heights run through the same one-to-one cap +
-    // per-face snap the layout path resolves with, so bake plan == lookup. Runtime `SetFont`
-    // combos outside the registry miss their variant and fall back to the legacy stamped halos
-    // (correct at full alpha; only a fade would show the stamp artifact — no shipped caller).
-    let mut outlined: HashMap<(String, u32), Vec<u8>> = HashMap::new();
-    if let Some(script) = script.as_deref() {
-        for fo in script.font_objects() {
-            let r = outline_radius(fo.outline);
-            if r == 0 {
-                continue;
-            }
-            let family = fo
-                .font
-                .as_deref()
-                .and_then(|p| path_to_family.get(&p.to_ascii_lowercase()))
-                .unwrap_or(&friz_family);
-            let Some(sizes) = faces
-                .iter()
-                .find(|(_, f, _)| f == family)
-                .map(|(_, _, s)| s)
-            else {
-                continue;
-            };
-            let capped =
-                super::fontstring_em(fo.height).unwrap_or(super::DEFAULT_FONT_SIZE) * ui_scale;
-            let snapped = nearest_size(sizes, capped);
-            let radii = outlined
-                .entry((family.clone(), snapped.to_bits()))
-                .or_default();
-            if !radii.contains(&r) {
-                radii.push(r);
-            }
-        }
-    } else {
-        warn!(
-            "ui_text: no UiScript at atlas bake — outlined cells unplanned, outlines will use \
-             the stamped-halo fallback (fade shows the composite artifact)"
-        );
-    }
-
-    let charset = default_charset();
-    // The atlas width scales with the bake resolution so a retina bake (2× the texels per glyph)
-    // doesn't overflow the shelves into an over-tall texture.
-    let atlas_width = (1024.0 * scale).ceil() as u32;
-    let built = build_atlas(
-        &mut font_system,
-        &mut swash_cache,
-        &faces,
-        &charset,
-        atlas_width,
-        scale,
-        &outlined,
-    );
-    if !built.missing.is_empty() {
-        warn!(
-            "ui_text: {} char(s) missing from a baked face: {:?}",
-            built.missing.len(),
-            built.missing
-        );
-    }
-
-    let image = images.add(Image::new(
-        Extent3d {
-            width: built.width,
-            height: built.height,
-            depth_or_array_layers: 1,
-        },
-        TextureDimension::D2,
-        built.rgba,
-        TextureFormat::Rgba8UnormSrgb,
-        RenderAssetUsages::RENDER_WORLD,
-    ));
-
-    let sizes_by_family: HashMap<String, Vec<f32>> = faces
-        .iter()
-        .map(|(_, family, sizes)| (family.clone(), sizes.clone()))
-        .collect();
-    let default_sizes = sizes_by_family
-        .get(&friz_family)
-        .cloned()
-        .unwrap_or_else(|| FONT_SIZES.to_vec());
-    let steps = build_char_steps(&mut font_system, &built.glyphs, &faces, &charset, scale);
-    info!(
-        "ui_text: glyph atlas generation {generation} baked in {:.0} ms ({}×{} texels)",
-        bake_started.elapsed().as_secs_f32() * 1000.0,
-        built.width,
-        built.height,
-    );
-    commands.insert_resource(UiFontAtlas {
-        env: want,
-        generation,
-        font_system,
-        glyphs: built.glyphs,
-        image,
-        family_ascent,
-        metrics: Arc::new(TextMetrics {
-            steps,
-            path_to_family,
-            default_family: friz_family,
-            sizes: default_sizes,
-            sizes_by_family,
-            scale,
-        }),
-        ellipsis: super::EllipsisMemo::default(),
-    });
-}
-
-/// Precompute every baked character's [`CharStep`] at every (face, size) — the width law's lookup
-/// table, shaped **once** here so no measurement ever needs a shaper again.
-///
-/// Each character is shaped alone, which is exactly right rather than a shortcut: the advance that
-/// lands in the sum is the *baked cell's* (`GlyphInfo::advance`), which is the face's own advance
-/// for that glyph and carries no neighbour term — so shaping "abc" and shaping "a","b","c" produce
-/// the same three advances. (Kerning cannot enter: the client's law drops it, and the only path
-/// that would have leaked cosmic-text's kerned `LayoutGlyph::w` is the no-baked-cell fallback,
-/// which by construction cannot fire for a character that is in the charset we just baked.)
-fn build_char_steps(
-    font_system: &mut FontSystem,
-    glyphs: &HashMap<GlyphKey, GlyphInfo>,
-    faces: &[(fontdb::ID, String, Vec<f32>)],
-    charset: &[char],
-    scale: f32,
-) -> HashMap<(String, u32), HashMap<char, CharStep>> {
-    let mut out: HashMap<(String, u32), HashMap<char, CharStep>> = HashMap::new();
-    let mut scratch = String::new();
-    for (_, family, sizes) in faces {
-        let attrs = Attrs::new().family(Family::Name(family));
-        for &size in sizes {
-            let mut table: HashMap<char, CharStep> = HashMap::new();
-            for &c in charset {
-                scratch.clear();
-                scratch.push(c);
-                // Shaped at the PHYSICAL size, exactly as the render pass shapes — so the
-                // no-baked-cell fallback below reads a physical advance like every other one.
-                let phys = size * scale;
-                let mut buffer = Buffer::new(font_system, Metrics::new(phys, phys));
-                buffer.set_wrap(font_system, Wrap::None);
-                buffer.set_text(font_system, &scratch, &attrs, Shaping::Advanced, None);
-                buffer.shape_until_scroll(font_system, false);
-                let mut floor_sum = 0.0f32;
-                let mut n = 0u16;
-                for run in buffer.layout_runs() {
-                    for g in run.glyphs {
-                        let key: GlyphKey = (g.font_id, g.glyph_id, size.to_bits(), 0);
-                        // A charset character with no baked cell was reported in `built.missing`
-                        // and cannot be drawn; its shaped width is still the honest answer for the
-                        // space the render pen will leave.
-                        let adv = glyphs.get(&key).map(|i| i.advance).unwrap_or(g.w);
-                        floor_sum += adv.floor();
-                        n += 1;
-                    }
-                }
-                if n > 0 {
-                    table.insert(
-                        c,
-                        CharStep {
-                            floor_sum,
-                            glyphs: n,
-                        },
-                    );
-                }
-            }
-            out.insert((family.clone(), size.to_bits()), table);
-        }
-    }
-    out
-}
-
-/// Snap a requested font height to the nearest baked size in `sizes` (never empty — always at least
-/// one baked face/size). Keeps the shaped size identical to a baked bitmap variant.
-pub(super) fn nearest_size(sizes: &[f32], requested: f32) -> f32 {
-    sizes
-        .iter()
-        .copied()
-        .min_by(|a, b| {
-            (a - requested)
-                .abs()
-                .partial_cmp(&(b - requested).abs())
-                .unwrap_or(std::cmp::Ordering::Equal)
-        })
-        .unwrap_or(DEFAULT_FONT_SIZE)
-}
-
-#[cfg(test)]
-mod outlined_cell_tests {
-    use super::*;
-
-    /// Read texel (x, y) of an RGBA cell.
-    fn px(rgba: &[u8], w: u32, x: u32, y: u32) -> [u8; 4] {
-        let i = ((y * w + x) * 4) as usize;
-        [rgba[i], rgba[i + 1], rgba[i + 2], rgba[i + 3]]
-    }
-
-    #[test]
-    fn normal_ring_takes_the_lut_grades() {
-        // A 1×1 fully-inked glyph, NORMAL (1 pass), scale 1 → a 3×3 cell, all 9 texels marked.
-        // Per the byte recipe the alpha is AA_NEIGHBOUR_LUT[in-bounds 3×3 marked count]:
-        // centre 9 → 255, edge-mid 6 → 153, corner 4 → 85 — the graded ring, not hard black.
-        let (rgba, w, h, pad) = outlined_cell(&[255], 1, 1, 1, 1.0);
-        assert_eq!((w, h, pad), (3, 3, 1));
-        assert_eq!(px(&rgba, w, 1, 1), [255, 255, 255, 255], "fill core");
-        assert_eq!(px(&rgba, w, 1, 0), [0, 0, 0, 153], "edge-mid ring: count 6");
-        assert_eq!(px(&rgba, w, 0, 1), [0, 0, 0, 153]);
-        assert_eq!(px(&rgba, w, 0, 0), [0, 0, 0, 85], "corner ring: count 4");
-        assert_eq!(px(&rgba, w, 2, 2), [0, 0, 0, 85]);
-    }
-
-    #[test]
-    fn thick_outer_ring_is_the_soft_second_pass() {
-        // THICK = a second dilation pass (the binary's mask-3→4 pass): 5×5, all marked; the
-        // inner ring sits fully surrounded (count 9 → opaque) while the outer edge grades
-        // 153/85 — the real client's softer THICK outer edge.
-        let (rgba, w, h, pad) = outlined_cell(&[255], 1, 1, 2, 1.0);
-        assert_eq!((w, h, pad), (5, 5, 2));
-        assert_eq!(px(&rgba, w, 2, 2), [255, 255, 255, 255], "fill core");
-        assert_eq!(
-            px(&rgba, w, 1, 1),
-            [0, 0, 0, 255],
-            "inner ring: fully surrounded"
-        );
-        assert_eq!(
-            px(&rgba, w, 2, 0),
-            [0, 0, 0, 153],
-            "outer edge-mid: count 6"
-        );
-        assert_eq!(px(&rgba, w, 0, 0), [0, 0, 0, 85], "outer corner: count 4");
-    }
-
-    #[test]
-    fn retina_scales_the_pass_count_with_the_bake() {
-        // scale 2, NORMAL: 2 passes ⇒ a 2-physical-px (1 logical) ring, dense — the iterative
-        // dilation leaves no stride holes (the legacy stamp offsets did).
-        let (rgba, w, h, pad) = outlined_cell(&[255], 1, 1, 1, 2.0);
-        assert_eq!((w, h, pad), (5, 5, 2));
-        assert_eq!(px(&rgba, w, 2, 2), [255, 255, 255, 255]);
-        assert_ne!(px(&rgba, w, 1, 1)[3], 0, "no hole inside the 2-px ring");
-        assert_eq!(px(&rgba, w, 0, 0), [0, 0, 0, 85]);
-    }
-
-    #[test]
-    fn aa_fill_ramps_gray_toward_the_ring() {
-        // Half coverage (128): the fill texel takes the coverage as GRAY at the LUT alpha —
-        // the byte recipe's `RGB = coverage, A = LUT[count]` — never white-with-thin-alpha.
-        let (rgba, w, _, _) = outlined_cell(&[128], 1, 1, 1, 1.0);
-        assert_eq!(
-            px(&rgba, w, 1, 1),
-            [128, 128, 128, 255],
-            "gray fill, LUT alpha"
-        );
-        assert_eq!(px(&rgba, w, 1, 0), [0, 0, 0, 153], "ring stays black");
-    }
-
-    #[test]
-    fn pad_law_is_r_times_scale() {
-        // Cell grows by r·round(scale) each side; the advance is the caller's (untouched here).
-        let (_, w, h, pad) = outlined_cell(&[255, 255, 255, 255], 2, 2, 2, 1.0);
-        assert_eq!((w, h, pad), (6, 6, 2));
-    }
-}
-
-#[cfg(test)]
-mod bake_env_tests {
-    use super::*;
-
-    /// The re-bake edge, both terms. A window resize moves `seam`; a monitor hop moves `dpi`; the
-    /// tolerance exists only to absorb float recomputation, never a real change.
-    #[test]
-    fn a_moved_raster_environment_is_a_different_bake() {
-        let boot = BakeEnv {
-            seam: 1.0546875,
-            dpi: 2.0,
-        };
-        assert!(boot.matches(boot));
-        assert!(
-            boot.matches(BakeEnv {
-                seam: 1.0546875 + 1e-6,
-                ..boot
-            }),
-            "float noise in the same environment is not a re-bake"
-        );
-        // The reported case: booting 1600x900 and maximising to 1440 tall (B244).
-        assert!(
-            !boot.matches(BakeEnv {
-                seam: 1.6875,
-                ..boot
-            }),
-            "a window resize must re-bake"
-        );
-        // A retina/non-retina monitor hop at an unchanged window height — the term that moves the
-        // step table without moving the seam, which is why the measurer watches the generation.
-        assert!(
-            !boot.matches(BakeEnv { dpi: 1.0, ..boot }),
-            "a DPI hop must re-bake"
-        );
-    }
-}
-
-#[cfg(test)]
-mod metrics_tests {
-    use super::*;
-
-    /// **Measure answers in DRAWN space** — the half of the rescale decision 0989 left open
-    /// ("fold into `drawn_k` if a fit ever visibly breaks") and B209 broke.
-    ///
-    /// The draw shapes at the nearest baked size and scales the finished quads by `k = req/snapped`
-    /// (`layout_text_quads_inner`'s tail, decision 0581). So the drawn width of an off-ladder
-    /// request IS `snapped_width × k`, and a measure that answers the un-rescaled number disagrees
-    /// with the render by exactly that factor. When the nearest bake sits ABOVE the request the
-    /// measure over-reports, the wrap test fires, and the height-gated ellipsis eats text that
-    /// fits — the reported "Spellbook" → "Spellbo...".
-    ///
-    /// The second assertion is the **mutation check**: with the rescale dropped, the two calls
-    /// below return the same number, which is precisely what shipped. Skips without an install.
-    #[test]
-    fn a_measure_between_bakes_answers_the_drawn_width() {
-        let data = benilla_formats::wow_data_or_skip!();
-        let chain = match benilla_formats::open_chain(&data) {
-            Ok(c) => c,
-            Err(e) => {
-                eprintln!("skipping: patch chain would not open: {e:#}");
-                return;
-            }
-        };
-        let path = CLIENT_FONTS[0];
-        let Ok(bytes) = chain.read(path) else {
-            eprintln!("skipping {path}: not in the chain");
-            return;
-        };
-        let charset = default_charset();
-        let mut font_system = FontSystem::new_with_fonts(std::iter::empty());
-        let mut swash = SwashCache::new();
-        let (id, family) = register_font(&mut font_system, bytes).expect("register");
-        // A deliberately sparse ladder, so a request can land between bakes the way every request
-        // does once the window has moved off the size the atlas was baked for.
-        let sizes = vec![10.0f32, 20.0];
-        let faces = vec![(id, family.clone(), sizes.clone())];
-        let scale = 1.0f32;
-        let built = build_atlas(
-            &mut font_system,
-            &mut swash,
-            &faces,
-            &charset,
-            1024,
-            scale,
-            &HashMap::new(),
-        );
-        let metrics = TextMetrics {
-            steps: build_char_steps(&mut font_system, &built.glyphs, &faces, &charset, scale),
-            path_to_family: HashMap::from([(path.to_ascii_lowercase(), family.clone())]),
-            default_family: family.clone(),
-            sizes: sizes.clone(),
-            sizes_by_family: HashMap::from([(family.clone(), sizes.clone())]),
-            scale,
-        };
-        let spec = |h: f32| crate::ui_text::FontSpec {
-            path: Some(path),
-            height: Some(h),
-            outline: benilla_ui::script::Outline::None,
-            paint_halo: true,
-            alpha_gradient: None,
-        };
-        // 12 snaps to the 10 bake: the draw magnifies its quads by 1.2.
-        const REQ: f32 = 12.0;
-        const SNAP: f32 = 10.0;
-        let k = REQ / SNAP;
-        assert_eq!(
-            metrics.snap_for(&family, REQ),
-            SNAP,
-            "the ladder under test"
-        );
-
-        let (drawn_w, drawn_h) =
-            crate::ui_text::measure_text(&metrics, "Spellbook", None, spec(REQ));
-        let (snap_w, snap_h) =
-            crate::ui_text::measure_text(&metrics, "Spellbook", None, spec(SNAP));
-
-        // The headroom pixel `measure_text` adds is drawn-space and is not itself rescaled, so it
-        // comes off both sides before the comparison; the tolerance is the one `ceil`.
-        assert!(
-            ((drawn_w - 1.0) - (snap_w - 1.0) * k).abs() <= 1.0,
-            "measured width must be the drawn width: got {drawn_w}, snapped {snap_w} × {k}"
-        );
-        assert!(
-            (drawn_h - snap_h * k).abs() < 1e-3,
-            "measured height must be the drawn height: got {drawn_h}, snapped {snap_h} × {k}"
-        );
-        assert!(
-            drawn_w > snap_w + 1.0,
-            "the mutation check: dropping the rescale makes these one number ({drawn_w} vs \
-             {snap_w}), which is the measure/render split that truncated fitting text"
-        );
-    }
-
-    /// **The differential test: the step table must measure exactly what shaping the whole string
-    /// measured**, over the real client fonts.
-    ///
-    /// The refactor that made a synchronous `GetStringWidth` possible replaced "shape the run, sum
-    /// each glyph's baked advance under the step law" with "sum each character's precomputed step".
-    /// The two are the same number only because of two facts, and this asserts both at once:
-    ///
-    /// 1. **The decomposition is per character** — these four faces carry no ligature or contextual
-    ///    substitution, so shaping `"Onewarrior"` yields the same glyph sequence as shaping its ten
-    ///    characters one at a time. (Not a given: it is a property of the fonts, and exactly the
-    ///    kind that would go silently wrong.)
-    /// 2. **The advance in the sum was never the kerned one.** [`build_atlas`] shapes each charset
-    ///    character alone and stores *that* advance, and the old measure looked the baked advance
-    ///    up by glyph — so cosmic-text's kerned `LayoutGlyph::w` never entered a baked glyph's
-    ///    width. Which is the client's own law: `ComputeStep 0x5ca2d0` drops kerning.
-    ///
-    /// So the reference implementation below is the pre-refactor code, verbatim, and the table must
-    /// match it to the bit. Skips without an install; the fonts are client data.
-    #[test]
-    fn the_step_table_measures_what_shaping_the_whole_string_measured() {
-        let data = benilla_formats::wow_data_or_skip!();
-        let chain = match benilla_formats::open_chain(&data) {
-            Ok(c) => c,
-            Err(e) => {
-                eprintln!("skipping: patch chain would not open: {e:#}");
-                return;
-            }
-        };
-        // Real strings, of the kinds that actually reach a measure: character names (the bug's own
-        // subject), item names, prose, the sequences a ligature table would target, the Latin-1
-        // tail of the baked charset, and the digits the money frame sums.
-        const CORPUS: &[&str] = &[
-            "",
-            " ",
-            "Onewarrior",
-            "Probezero",
-            "Small Brown Pouch",
-            "Staff of the Shadow Flame",
-            "The affluent fiend's fickle offer",
-            "fi fl ffi ffl ff",
-            "AV Ta Wo Yo LT P, r. v.",
-            "0123456789",
-            "Grüße, Ärger; élan côté",
-            "!@#$%^&*()_+-=[]{}|;':\",./<>?",
-        ];
-        let charset = default_charset();
-        let mut checked = 0usize;
-        for (i, &path) in CLIENT_FONTS.iter().enumerate() {
-            let Ok(bytes) = chain.read(path) else {
-                eprintln!("skipping {path}: not in the chain");
-                continue;
-            };
-            let mut font_system = FontSystem::new_with_fonts(std::iter::empty());
-            let mut swash = SwashCache::new();
-            let (id, family) = register_font(&mut font_system, bytes).expect("register");
-            // Two sizes, one small and one large, so a size-dependent hinting difference could not
-            // hide between them; two bake scales, so the physical-px floor is exercised off 1.0.
-            for scale in [1.0f32, 2.0] {
-                let sizes = vec![10.0f32, 20.0];
-                let faces = vec![(id, family.clone(), sizes.clone())];
-                let built = build_atlas(
-                    &mut font_system,
-                    &mut swash,
-                    &faces,
-                    &charset,
-                    (1024.0 * scale).ceil() as u32,
-                    scale,
-                    &HashMap::new(),
-                );
-                let steps =
-                    build_char_steps(&mut font_system, &built.glyphs, &faces, &charset, scale);
-                let metrics = TextMetrics {
-                    steps,
-                    path_to_family: HashMap::from([(path.to_ascii_lowercase(), family.clone())]),
-                    default_family: family.clone(),
-                    sizes: sizes.clone(),
-                    sizes_by_family: HashMap::from([(family.clone(), sizes.clone())]),
-                    scale,
-                };
-                let attrs = Attrs::new().family(Family::Name(&family));
-                for &size in &sizes {
-                    // Both step biases: plain/NORMAL (+1) and THICK (+2).
-                    for step_extra in [1.0f32, 2.0] {
-                        for text in CORPUS {
-                            let want = reference_line_width(
-                                &mut font_system,
-                                &built.glyphs,
-                                &attrs,
-                                size,
-                                scale,
-                                step_extra,
-                                text,
-                            );
-                            let got = crate::ui_text::measure_line_width_for_test(
-                                &metrics, &family, size, step_extra, text,
-                            );
-                            assert_eq!(
-                                got, want,
-                                "{path} @{size} scale {scale} extra {step_extra}: {text:?} — the \
-                                 step table and the shaped sum must be one number"
-                            );
-                            checked += 1;
-                        }
-                    }
-                }
-            }
-            let _ = i;
-        }
-        assert!(
-            checked > 0,
-            "no client font was readable — nothing was proven"
-        );
-    }
-
-    /// The measure **exactly as it was before the step table**: shape the run, take each glyph's
-    /// baked advance (cosmic-text's own `w` only where nothing was baked), floor it, add the
-    /// outline bias, divide back to logical. Kept here, and only here, as the thing the table is
-    /// diffed against.
-    #[allow(clippy::too_many_arguments)]
-    fn reference_line_width(
-        font_system: &mut FontSystem,
-        glyphs: &HashMap<GlyphKey, GlyphInfo>,
-        attrs: &Attrs,
-        font_size: f32,
-        scale: f32,
-        step_extra: f32,
-        text: &str,
-    ) -> f32 {
-        if text.is_empty() {
-            return 0.0;
-        }
-        let phys = font_size * scale;
-        let mut buffer = Buffer::new(font_system, Metrics::new(phys, phys));
-        buffer.set_wrap(font_system, Wrap::None);
-        buffer.set_text(font_system, text, attrs, Shaping::Advanced, None);
-        buffer.shape_until_scroll(font_system, false);
-        let mut w = 0.0f32;
-        for run in buffer.layout_runs() {
-            for g in run.glyphs {
-                let key: GlyphKey = (g.font_id, g.glyph_id, font_size.to_bits(), 0);
-                let adv = glyphs.get(&key).map(|i| i.advance).unwrap_or(g.w);
-                w += (adv.floor() + step_extra) / scale;
-            }
-        }
-        w
-    }
-}
-
-/// Real-font [`TextMetrics`] for a test or bench: the named client faces, read through the app's
-/// own patch chain and baked at the given logical sizes. `None` when there is no install, or the
-/// chain or a face will not open — every caller **skips** rather than fails, the same posture
-/// [`metrics_tests`]'s install-backed tests take (`wow_data_or_skip!`).
-///
-/// The first face is the default family. Only the metric table matters to the callers (the wrap +
-/// step law); the glyph cells are built because [`build_char_steps`] reads their baked advances.
-#[cfg(test)]
-pub(super) fn test_metrics(faces: &[(&str, &[f32])], scale: f32) -> Option<TextMetrics> {
-    let data = benilla_formats::wow_data()?;
-    let chain = benilla_formats::open_chain(&data).ok()?;
-    let charset = default_charset();
-    let mut font_system = FontSystem::new_with_fonts(std::iter::empty());
-    let mut swash = SwashCache::new();
-
-    let mut built: Vec<(fontdb::ID, String, Vec<f32>)> = Vec::new();
-    let mut path_to_family = HashMap::new();
-    let mut sizes_by_family = HashMap::new();
-    for (path, sizes) in faces {
-        let bytes = chain.read(path).ok()?;
-        let (id, family) = register_font(&mut font_system, bytes).ok()?;
-        path_to_family.insert(path.to_ascii_lowercase(), family.clone());
-        sizes_by_family.insert(family.clone(), sizes.to_vec());
-        built.push((id, family, sizes.to_vec()));
-    }
-    let (_, default_family, sizes) = built.first()?.clone();
-    let atlas = build_atlas(
-        &mut font_system,
-        &mut swash,
-        &built,
-        &charset,
-        1024,
-        scale,
-        &HashMap::new(),
-    );
-    Some(TextMetrics {
-        steps: build_char_steps(&mut font_system, &atlas.glyphs, &built, &charset, scale),
-        path_to_family,
-        default_family,
-        sizes,
-        sizes_by_family,
-        scale,
-    })
-}
diff --git a/crates/benilla-app/src/ui_text/engine/faces.rs b/crates/benilla-app/src/ui_text/engine/faces.rs
new file mode 100644
index 00000000..92b9515f
--- /dev/null
+++ b/crates/benilla-app/src/ui_text/engine/faces.rs
@@ -0,0 +1,67 @@
+//! Reading the client's own TTFs, and the one metric that has to come off the raw bytes.
+
+use cosmic_text::FontSystem;
+
+/// The four client TTFs (verified present in `fonts.MPQ`, plain TTF — no exotic wrapper), read
+/// through the app's own patch chain rather than `std::fs` (there is no `std::fs` path to client
+/// data — see [`WorldAssets`]). Index 0 (Friz Quadrata) is the fallback face and is required.
+pub(super) const CLIENT_FONTS: &[&str] = &[
+    "Fonts\\FRIZQT__.TTF",
+    "Fonts\\ARIALN.TTF",
+    "Fonts\\MORPHEUS.TTF",
+    "Fonts\\SKURRI.TTF",
+];
+
+/// The face's baseline ascender as a fraction of the em — `hhea.asc / (hhea.asc + |hhea.desc|)` —
+/// straight from the raw sfnt bytes. This is the term in the client's glyph *placement* law: the
+/// ink hangs from the pixel ascender `[CGxFont+0x17c] = round(em · asc/(asc+|desc|))`, threaded
+/// unchanged into `glyph_vplace` (0x5d1360) as the operand that fixes `baseline = cellTop +
+/// ascender` (wow-re `system/font`, §5-verified 2026-07-09: the call chain `0x5ca160 → 0x5d1120
+/// [ebp+0xc] → 0x5d1360 [ebp+0x10]`, where the cell's own `[[FT_Face+0x54]+0x68]` is the
+/// per-glyph `bitmap_top`, the *subordinate* operand). This is the `ComputeRasterMetrics`
+/// `load_param`; the FreeType scaled hhea ascender (`asc/upem` ≈ 0.965) appears NOWHERE in the
+/// placement path — seating with it drops every line ~3px too low for Friz (965/1215 ≈ 0.794 vs
+/// 0.965 → baseline row 10 vs 13 in a 13-tall cell). A tiny table-directory walk (`hhea` →
+/// ascender@+4, descender@+6); `None` on any malformed/missing table.
+pub(super) fn hhea_ascent_ratio(bytes: &[u8]) -> Option<f32> {
+    let num = u16::from_be_bytes(bytes.get(4..6)?.try_into().ok()?) as usize;
+    let (mut asc, mut desc) = (None, None);
+    for i in 0..num {
+        let rec = bytes.get(12 + 16 * i..12 + 16 * i + 16)?;
+        let toff = u32::from_be_bytes(rec[8..12].try_into().ok()?) as usize;
+        if &rec[0..4] == b"hhea" {
+            asc = Some(i16::from_be_bytes(bytes.get(toff + 4..toff + 6)?.try_into().ok()?) as f32);
+            desc = Some(i16::from_be_bytes(bytes.get(toff + 6..toff + 8)?.try_into().ok()?) as f32);
+        }
+    }
+    let (asc, desc) = (asc?, desc?);
+    // The denominator is narrowed to f32 exactly as the binary does (`fstp m32` @0x5ca0d?),
+    // then the ratio; `em · ratio + 0.5` floors to the load_param at the call site below.
+    let denom = asc + desc.abs();
+    (denom > 0.0 && asc > 0.0).then_some(asc / denom)
+}
+
+/// Registers `bytes` (raw TTF) into `font_system`'s `fontdb`, returning `(face_id, family_name)` —
+/// the family name is read back off the just-loaded face so callers build an exact `Attrs::family`
+/// match with no reliance on hardcoding Blizzard's font-name strings.
+pub(super) fn register_font(
+    font_system: &mut FontSystem,
+    bytes: Vec<u8>,
+) -> anyhow::Result<(fontdb::ID, String)> {
+    let source = fontdb::Source::Binary(
+        std::sync::Arc::new(bytes) as std::sync::Arc<dyn AsRef<[u8]> + Sync + Send>
+    );
+    let ids = font_system.db_mut().load_font_source(source);
+    let id = *ids
+        .first()
+        .ok_or_else(|| anyhow::anyhow!("font source produced no faces (not a valid TTF?)"))?;
+    let family = font_system
+        .db_mut()
+        .face(id)
+        .ok_or_else(|| anyhow::anyhow!("face {id:?} vanished right after loading"))?
+        .families
+        .first()
+        .map(|(name, _)| name.clone())
+        .ok_or_else(|| anyhow::anyhow!("face {id:?} carries no family name"))?;
+    Ok((id, family))
+}
diff --git a/crates/benilla-app/src/ui_text/engine/gpu.rs b/crates/benilla-app/src/ui_text/engine/gpu.rs
new file mode 100644
index 00000000..c5a59d1f
--- /dev/null
+++ b/crates/benilla-app/src/ui_text/engine/gpu.rs
@@ -0,0 +1,216 @@
+//! **The Bevy face of the glyph cache** — building it, following the window, and getting each new
+//! cell onto the GPU.
+//!
+//! The upload is a sub-rect `RenderQueue::write_texture` into the sheet's existing texture rather
+//! than an `Assets<Image>` mutation, for a reason that is about correctness rather than cost: see
+//! [`crate::ui_text::pack`]'s module doc.
+
+use std::sync::{Arc, Mutex};
+
+use bevy::image::Image;
+use bevy::prelude::*;
+use bevy::render::render_asset::RenderAssets;
+use bevy::render::render_resource::{
+    Extent3d, Origin3d, TexelCopyBufferLayout, TexelCopyTextureInfo, TextureAspect,
+};
+use bevy::render::renderer::RenderQueue;
+use bevy::render::texture::GpuImage;
+use bevy::render::{ExtractSchedule, Render, RenderApp, RenderSystems};
+use bevy::window::PrimaryWindow;
+
+use benilla_assets::WorldAssets;
+
+use super::{TextEngine, UiFontAtlas};
+use crate::ui_text::pack::CellUpload;
+
+/// Cells rasterized this frame, waiting for the render world.
+#[derive(Resource, Default)]
+struct GlyphUploadQueue(Vec<CellUpload>);
+
+/// The render world's copy, which also carries anything whose page texture was not ready yet.
+#[derive(Resource, Default)]
+struct GlyphUploads(Vec<CellUpload>);
+
+/// Loads the client's TTFs and drives the on-demand glyph cache.
+pub(crate) struct UiTextPlugin;
+
+impl Plugin for UiTextPlugin {
+    fn build(&self, app: &mut App) {
+        // `init` runs each Update until it succeeds: the engine needs both the patch chain (opened
+        // at `AssetSet::Open`) *and* the primary window's real `scale_factor`, which winit only
+        // reports once the OS window exists. `publish_pages` runs in `Last`, after every producer
+        // of text quads, so a cell rasterized this frame is queued before the render extract.
+        app.init_resource::<GlyphUploadQueue>()
+            .add_systems(Update, init)
+            .add_systems(Last, publish_sheet);
+        let Some(render_app) = app.get_sub_app_mut(RenderApp) else {
+            return;
+        };
+        render_app
+            .init_resource::<GlyphUploads>()
+            .add_systems(ExtractSchedule, extract_glyph_uploads)
+            .add_systems(
+                Render,
+                // After `prepare_assets::<GpuImage>` (PrepareAssets) so a page created this frame
+                // already has its texture, and before the frame's submit.
+                upload_glyph_cells.in_set(RenderSystems::PrepareResources),
+            );
+    }
+}
+
+/// Build the engine on the first frame both the patch chain and the window's real `scale_factor`
+/// are available.
+fn init(
+    mut commands: Commands,
+    world_assets: Option<Res<WorldAssets>>,
+    images: Res<Assets<Image>>,
+    windows: Query<&Window, With<PrimaryWindow>>,
+    existing: Option<Res<UiFontAtlas>>,
+) {
+    if existing.is_some() {
+        return;
+    }
+    let (Some(world_assets), Ok(window)) = (world_assets, windows.single()) else {
+        return;
+    };
+    let Some(engine) = TextEngine::load(&world_assets, &images, window.scale_factor()) else {
+        return;
+    };
+    commands.insert_resource(UiFontAtlas {
+        engine: Arc::new(Mutex::new(engine)),
+        generation: 0,
+        ellipsis: crate::ui_text::EllipsisMemo::default(),
+    });
+}
+
+/// The frame boundary: follow the window's DPI, carry out a pending reset, create any new page's
+/// texture, and hand this frame's cells to the render world.
+///
+/// **Order matters, and it is the order below.** The reset runs *before* the pending cells are
+/// handed over, so the frame that exhausted the pages does not upload into shelves it is about to
+/// free; and it runs here rather than at the point of failure so no UV can move while quads that
+/// reference it are still being pushed (see [`TextEngine::note_exhausted`]).
+fn publish_sheet(
+    atlas: Option<ResMut<UiFontAtlas>>,
+    mut images: ResMut<Assets<Image>>,
+    mut queue: ResMut<GlyphUploadQueue>,
+    windows: Query<&Window, With<PrimaryWindow>>,
+) {
+    let Some(mut atlas) = atlas else {
+        return;
+    };
+    let dpi = windows.single().map_or(1.0, Window::scale_factor);
+    let (generation, dpi_moved) = {
+        let mut e = atlas.lock();
+        // A DPI change invalidates no cell — it changes which cells get *asked for*.
+        let dpi_moved = (e.dpi - dpi).abs() > 1e-6;
+        e.dpi = dpi;
+        if e.reset_pending {
+            e.reset_pending = false;
+            e.generation += 1;
+            e.stats.resets += 1;
+            e.chars.clear();
+            e.cells.clear();
+            e.sheet.reset();
+        }
+        let (announce, mut cells) = e.sheet.take_pending();
+        if announce {
+            // `insert`, once, on a reserved handle — and never `get_mut` afterwards, which would
+            // recreate the texture and blank every glyph on it (see `pack`'s module doc).
+            // A duplicate insert cannot happen (the sheet announces itself once), and there is
+            // no recovery from a failed one anyway — text simply would not draw.
+            let _ = images.insert(e.sheet.handle().id(), crate::ui_text::pack::sheet_image());
+        }
+        queue.0.append(&mut cells);
+        (e.generation, dpi_moved)
+    };
+    // The one thing a DPI change DOES stale: the ellipsis memo's answers are keyed by a logical
+    // box against a raster size that just moved.
+    if dpi_moved {
+        atlas.ellipsis = crate::ui_text::EllipsisMemo::default();
+    }
+    atlas.generation = generation;
+    report_cache(&atlas);
+}
+
+/// Hand the frame's cells to the render world, appending rather than replacing — anything the
+/// previous frame could not write (its page's texture was not ready) is still in there.
+fn extract_glyph_uploads(
+    mut main_world: ResMut<bevy::render::MainWorld>,
+    mut uploads: ResMut<GlyphUploads>,
+) {
+    if let Some(mut q) = main_world.get_resource_mut::<GlyphUploadQueue>() {
+        uploads.0.append(&mut q.0);
+    }
+}
+
+/// Write each new cell into its page's existing texture — a sub-rect `write_texture`, so the
+/// texture's identity never changes and nothing downstream needs invalidating (see `pack`'s module
+/// doc for what the obvious alternative would have broken). A cell whose page texture has not been
+/// prepared yet stays queued for the next frame rather than being dropped.
+fn upload_glyph_cells(
+    mut uploads: ResMut<GlyphUploads>,
+    gpu_images: Res<RenderAssets<GpuImage>>,
+    render_queue: Res<RenderQueue>,
+) {
+    uploads.0.retain(|u| {
+        let Some(gpu) = gpu_images.get(u.image) else {
+            return true; // the page's texture is not up yet — try again next frame
+        };
+        render_queue.write_texture(
+            TexelCopyTextureInfo {
+                texture: &gpu.texture,
+                mip_level: 0,
+                origin: Origin3d {
+                    x: u.x,
+                    y: u.y,
+                    z: 0,
+                },
+                aspect: TextureAspect::All,
+            },
+            &u.rgba,
+            TexelCopyBufferLayout {
+                offset: 0,
+                bytes_per_row: Some(u.w * 4),
+                rows_per_image: Some(u.h),
+            },
+            Extent3d {
+                width: u.w,
+                height: u.h,
+                depth_or_array_layers: 1,
+            },
+        );
+        false
+    });
+}
+
+/// `WOW_GLYPH_CACHE=1`: one line a second of what the cache holds.
+///
+/// It exists because [`super::pack::MAX_PAGES`] and [`super::pack::PAGE_SIZE`] are the two numbers
+/// this design can get wrong quietly — too small and a session resets on a loading screen, too
+/// large and we hold VRAM nobody reads. Both are cheap to re-choose *from a measurement* and
+/// expensive to re-choose from an argument, so the measurement ships with them.
+fn report_cache(atlas: &UiFontAtlas) {
+    use std::sync::atomic::{AtomicU64, Ordering};
+    static LAST: AtomicU64 = AtomicU64::new(0);
+    if std::env::var_os("WOW_GLYPH_CACHE").is_none_or(|v| v == "0") {
+        return;
+    }
+    let now = std::time::SystemTime::now()
+        .duration_since(std::time::UNIX_EPOCH)
+        .map_or(0, |d| d.as_secs());
+    if LAST.swap(now, Ordering::Relaxed) == now {
+        return;
+    }
+    let e = atlas.lock();
+    let (used, total) = e.sheet.occupancy();
+    eprintln!(
+        "[glyph-cache] {used}/{total} texels ({:.1}%) · {} chars shaped · \
+         {} cells rasterized · {} resets · dpi {}",
+        100.0 * used as f64 / total as f64,
+        e.stats.chars_shaped,
+        e.stats.cells_rasterized,
+        e.stats.resets,
+        e.dpi,
+    );
+}
diff --git a/crates/benilla-app/src/ui_text/engine/mod.rs b/crates/benilla-app/src/ui_text/engine/mod.rs
new file mode 100644
index 00000000..b0a3af17
--- /dev/null
+++ b/crates/benilla-app/src/ui_text/engine/mod.rs
@@ -0,0 +1,988 @@
+//! **The font engine** — an on-demand glyph cache keyed by exact integer device-pixel size.
+//!
+//! ## What this replaced, and why
+//!
+//! Until decision 1342 this module *baked*: at startup (and, after 1296, whenever the raster
+//! environment moved) it rasterized the whole charset for every registered face at a fixed
+//! **ladder** of sizes, packed it into one texture, and published it. A request for a size the
+//! ladder did not carry snapped to the nearest rung, and the finished quads were then rescaled by
+//! `k = requested / snapped`.
+//!
+//! That rescale is gone, and with it the ladder. It had to be, because `k` was never a rendering
+//! detail — it was a second, parallel definition of where text sits, and every seam that forgot to
+//! apply it produced a measure/render disagreement: a caret 28 % past its own text (0989), an
+//! ellipsis eating a word that fits (B209), a tooltip past its border (B231), a Main Menu label
+//! losing its last letter (1339). And one that names the mechanism better than any of them:
+//! **letters that do not share a baseline.** That is what a rescale *is*. The emit pass rounds each
+//! glyph onto the device-pixel grid — uniformly, so the line is flat — and the rescale then
+//! multiplies each rounded position by a non-integer `k` about an anchor. Glyphs have different
+//! vertical offsets (an `O` is not an `x` is not a `p`), so after the multiply every letter lands on
+//! a *different* sub-pixel phase and resamples at a different offset. The line stops being a line.
+//! No amount of care at the call sites fixes that; only not having a `k` does.
+//!
+//! ## What the real client does
+//!
+//! wow-re `system/font` (T3, verified — the lifecycle re-derived by a four-pair cross-check for
+//! decision 1342): a `CGxFont` exists per (face, flags, **exact pixel size**), the size being
+//! `min(32, round(H · max(reqSize, 2/H)))` (`0x5ca030` → `[CGxFont+0x24c]`) — integer device
+//! pixels, always. Glyphs are rasterized **on demand** by `NewCodeDesc` (`0x5cabd0`) into a
+//! per-font `TSHashTable<codepoint → CharCodeDesc>` (`+0x30/+0x38`) and land in a row-partitioned
+//! texture cache (`texcache_set_cellsize` `0x5cf360`, cell size `em + 2·outline pad`, free-slot
+//! search `0x5cf5a0`) of up to 8 pages (`CGxFont+0x18c`). One bitmap per (font, codepoint), zero
+//! subpixel phases — the face is sized by `FT_Set_Pixel_Sizes` to a square integer ppem and the
+//! module calls no `FT_Set_Transform` anywhere.
+//!
+//! There is no size ladder and no snapping. **`k` has no counterpart in the ordinary UI path**,
+//! and the reason is precise: `CSimpleFontString`'s constructor sets the one-to-one bit
+//! (`+0x120 & 0x200`, `0x770dd3`), which makes `GetFontHeight` return the font's own quantized em
+//! back — so the draw's `scale = ScreenToPixelHeight / [CGxFont+0x24c]` comes out exactly `1.0`
+//! and every glyph is an integer 1 texel : 1 pixel blit.
+//!
+//! So: [`TextEngine::ppem`] rounds a logical height to whole device pixels, everything downstream
+//! is keyed by that integer, and [`TextEngine::logical_size`] is the `0x200` bit — the size a
+//! string measures and lays out at is the size its glyphs were rasterized at, not the float that
+//! was asked for. That is the mechanism that makes a rescale unnecessary, and it is the one worth
+//! copying. (It is also the modern idiomatic design: cosmic-text's `SwashCache` over a shelf
+//! allocator, which is what glyphon and egui do.)
+//!
+//! ## Where this deliberately goes further — and where it is thinner
+//!
+//! Being exact about the divergences, because "the client does it this way" is doing a lot of work
+//! above and it should not be doing more than it has earned:
+//!
+//! - **The client scales cells in three places, and we scale in none.** `SetTextHeight` clears the
+//!   one-to-one bit (`0x771600`) and draws at a size the atlas was not rasterized for; a requested
+//!   em past 32 px clamps the raster while the numerator keeps growing; and every 3-D unit name
+//!   goes through `UNIT_NAME_FONT` (created at size `0.99f`, so its em is permanently 32) with
+//!   string flag `0x80` — the explicit magnified mode, ±½-texel UV insets and all. We rasterize
+//!   all three at their true size instead. That is not a new posture: it is exactly the recorded
+//!   divergence at [`super::FONTSTRING_EM_CAP`] — the 32-px ceiling is 2004 raster-memory
+//!   budgeting, and following it literally on a modern display converges every string toward the
+//!   same size and stretches the ones above it (the era's blurry big crits). **Crisper than the
+//!   reference, on purpose, in the same three places we had already chosen to be.**
+//! - **Measuring rasterizes, in the client.** All five measure/layout kernels
+//!   (`0x5c6940`, `0x5c6b70`, `0x5c6c50`, `0x5c7300`, `0x5c7470`) call `NewCodeDesc`
+//!   unconditionally per character, and its miss branch runs `FT_Load_Glyph` + `FT_Render_Glyph`
+//!   with no flag that can skip the render — the advance the measure needs is written *by the
+//!   rasterizer*. [`TextEngine::ensure_metrics`] is therefore a **divergence**: we shape for the
+//!   metrics and skip the bitmap. It produces the same number (the step law reads only the
+//!   advance) and it is what makes a `GetStringWidth` probe over a string nobody draws cost no
+//!   texture at all.
+//! - **The client evicts, we reset.** `NewCodeDesc`'s full-atlas path (`0x5cad2b`) is a true LRU
+//!   over `[CGxFont+0x64..0x6c]`: evict the single least-recently-used glyph, free its cell, repack
+//!   into the hole, and dirty every string on that font that used that page. We drop everything at
+//!   once instead ([`super::pack::Sheet::reset`]) — coarser, but our sheet is far larger than the
+//!   client's 256×256 pages, and a shelf allocator cannot reclaim an interior cell without the
+//!   repack the client's row lists are built for. Recorded, with the occupancy instrument that
+//!   would overturn it.
+//! - **The client flushes on a viewport change; we do not.** `0x5c2b50` (edge-triggered from the
+//!   OS resize event) walks every live `CGxFont` and calls `0x5ca6f0`, which clears the whole glyph
+//!   cache in place and re-issues `FT_Set_Pixel_Sizes` — keeping the FreeType face. That is a
+//!   perfectly good answer to raster-size churn and we may yet want it; what stopped us taking it
+//!   now is that our nameplate meshes bake UVs, so a flush costs a mesh rebuild on every resize
+//!   frame, while simply *keeping* the dead cells costs only sheet space. Same instrument decides.
+//!
+//! ## The shape of the thing
+//!
+//! Two caches, filled by one operation and read by two very different callers:
+//!
+//! - **[`CharCell`]** — per `(face, ppem, char)`: which glyphs the character shapes to, their
+//!   advances, and the pre-summed floor the width law needs. **Never touches the GPU**, which is
+//!   what lets the script VM's synchronous measurer fill it from inside a Lua call.
+//! - **The cells** — per `(face, glyph, ppem, outline radius)`: a rasterized bitmap packed into a
+//!   [page][super::pack]. Only the emit pass asks for these.
+//!
+//! Both live in one engine behind one lock, shared by the render path and the VM's measurer, so a
+//! string measured mid-tick and the same string measured at extract are not merely equal numbers —
+//! they are the same lookup in the same table. (That was already 1289's property; it survives the
+//! rewrite because it is the property that keeps measure and render from drifting.)
+//!
+//! **Lock discipline:** the guard is taken by a leaf entry point and released before it returns.
+//! Nothing may hold it across a call into the script VM — the VM's measurer takes the same lock.
+
+mod faces;
+mod gpu;
+
+use std::collections::{HashMap, HashSet};
+use std::sync::{Arc, Mutex, MutexGuard};
+
+use bevy::image::Image;
+use bevy::math::Rect;
+use bevy::prelude::*;
+use cosmic_text::{
+    Attrs, Buffer, CacheKey, Family, FontSystem, Metrics, Shaping, SwashCache, Wrap,
+};
+
+use benilla_assets::{LockRecover, WorldAssets};
+
+use faces::{hhea_ascent_ratio, register_font, CLIENT_FONTS};
+pub(crate) use gpu::UiTextPlugin;
+
+use super::outline::outlined_cell;
+use super::pack::{Cell, Sheet};
+
+/// The raster size floor, in device pixels — the client's own `max(2, …)` (`0x5ca030`). Below this
+/// a face has no readable ink and FreeType's metrics degenerate.
+const MIN_PPEM: u16 = 2;
+
+/// The raster size ceiling, in device pixels. **Not** the client's `min(32, …)`: that cap is a
+/// 2004 raster-memory ceiling which we deliberately apply in LOGICAL units instead, at the
+/// [`super::fontstring_em`] seam, so a capped zone splash scales with the screen and stays crisp
+/// (the recorded divergence — see [`super::FONTSTRING_EM_CAP`]). World text
+/// ([`crate::combat_text`], the nameplates) sizes by its own viewport laws and passes through
+/// uncapped. This is the backstop under all of that: a request that reaches it is a bug upstream,
+/// not a font to rasterize.
+const MAX_PPEM: u16 = 256;
+
+// ─────────────────────────────────────────────────────────────────────────────────────────────
+// The cache's own types
+// ─────────────────────────────────────────────────────────────────────────────────────────────
+
+/// One registered face.
+struct Face {
+    id: fontdb::ID,
+    family: String,
+    /// `hhea.asc / (asc + |desc|)` — see [`hhea_ascent_ratio`]. Friz's ≈ 0.794 is the fallback for
+    /// a face whose tables would not parse (never the four shipped client fonts).
+    ascent_ratio: f32,
+}
+
+/// `(face, glyph, ppem, outline radius)` — the raster cache's key. The size term is the **exact
+/// integer device-pixel size** the glyph was rasterized at, which is the whole point: there is one
+/// bitmap per size a caller actually asked for, and it is drawn one texel per device pixel.
+type GlyphKey = (fontdb::ID, u16, u16, u8);
+
+/// One rasterized cell. **All fields are PHYSICAL px** — the layout divides by
+/// [`TextEngine::dpi`] on the way into logical space.
+#[derive(Clone, Copy, Debug)]
+pub(super) struct GlyphInfo {
+    pub(super) uv: Rect,
+    pub(super) px_w: f32,
+    pub(super) px_h: f32,
+    /// Swash convention: `left` rightward from the pen, `top` upward from the baseline.
+    pub(super) bearing_x: f32,
+    pub(super) bearing_top: f32,
+}
+
+/// One glyph a character shaped to, as the cache remembers it — everything the **pen** needs, with
+/// no bitmap involved.
+#[derive(Clone, Copy, Debug)]
+pub(super) struct GlyphRef {
+    pub(super) glyph_id: u16,
+    /// Swash's rasterization key for this glyph at this ppem, at zero subpixel offset — kept so a
+    /// cell can be rasterized later (for a different outline radius) without re-shaping.
+    key: CacheKey,
+    /// The face's own advance, physical px, **unfloored**. The step law floors it
+    /// ([`super::layout::client_step`]).
+    pub(super) advance: f32,
+    /// Vertical offset from the line baseline, physical px (0 for every glyph these four Latin
+    /// faces shape — cached rather than assumed).
+    pub(super) y_off: f32,
+}
+
+/// One character's whole contribution at one `(face, ppem)`.
+///
+/// Two numbers rather than one because the client's step law ([`super::layout::client_step`]) adds
+/// its bias **per glyph**, not per character: a character that shapes to two glyphs takes two
+/// biases. Every character these four faces shape takes one — `glyphs` is length 1 everywhere
+/// today — but the law stays the law if that ever stops being true.
+pub(super) struct CharCell {
+    pub(super) glyphs: Vec<GlyphRef>,
+    /// Σ `advance.floor()` over the glyphs, in **physical** px — the width law's per-character
+    /// term, pre-summed so a measure is a hash lookup and an add.
+    pub(super) floor_sum: f32,
+}
+
+/// What the cache instrument (`WOW_GLYPH_CACHE=1`) counts.
+#[derive(Default, Clone, Copy)]
+struct CacheStats {
+    chars_shaped: u64,
+    cells_rasterized: u64,
+    resets: u64,
+}
+
+// ─────────────────────────────────────────────────────────────────────────────────────────────
+// The engine
+// ─────────────────────────────────────────────────────────────────────────────────────────────
+
+/// The font engine: faces, the two caches, and the texture pages.
+pub(crate) struct TextEngine {
+    font_system: FontSystem,
+    swash: SwashCache,
+    faces: Vec<Face>,
+    /// Blizzard font path (lowercased) → index into [`Self::faces`].
+    path_to_face: HashMap<String, usize>,
+    /// The fallback face (Friz Quadrata) for a FontString with no/unknown font path.
+    default_face: usize,
+    /// The window's `scale_factor` — physical px per logical px. Every raster size derives from it
+    /// ([`Self::ppem`]), so moving it invalidates no cell: it simply means new sizes get asked for.
+    /// (The *measures* answered under the old one are stale, which is the extract pass's business,
+    /// not the cache's.)
+    dpi: f32,
+    /// `(face, ppem, char) → what the pen needs`. **Never touches the GPU** — this is the half the
+    /// script VM's measurer fills from inside a Lua call.
+    chars: HashMap<(usize, u16, char), CharCell>,
+    /// `(face, glyph, ppem, radius) → cell`. `None` records a glyph with no ink (a space) or one
+    /// the pages could not fit, so a miss is paid for exactly once.
+    cells: HashMap<GlyphKey, Option<GlyphInfo>>,
+    sheet: Sheet,
+    /// Bumped when the cache [resets][Sheet::reset] — the **only** event that can move a UV, and
+    /// therefore the only thing a cross-frame holder of glyph UVs ([`crate::nameplates`]) has to
+    /// watch. Under the size ladder this fired on every window resize; now it fires when a session
+    /// has minted more distinct raster sizes than the pages hold, which is to say almost never.
+    generation: u64,
+    /// Set when an allocation failed. Acted on at the frame boundary, never mid-string.
+    reset_pending: bool,
+    /// Characters no face could shape, and sizes past the ceiling — reported once each rather than
+    /// once per frame.
+    complained: HashSet<char>,
+    over_ceiling: bool,
+    stats: CacheStats,
+}
+
+impl TextEngine {
+    /// Read the client TTFs through the app's own patch chain ([`WorldAssets::chain`] — never
+    /// `std::fs`) and register them. `None` if Friz Quadrata (the fallback face) is unreadable, in
+    /// which case text simply will not render — the same graceful-absence posture
+    /// [`crate::ui_script`]'s extraction takes.
+    fn load(world_assets: &WorldAssets, images: &Assets<Image>, dpi: f32) -> Option<Self> {
+        let mut font_system = FontSystem::new_with_fonts(std::iter::empty());
+        let mut faces: Vec<Face> = Vec::new();
+        let mut path_to_face = HashMap::new();
+        for &path in CLIENT_FONTS {
+            let bytes = {
+                let chain = world_assets.chain.lock_recover();
+                match chain.read(path) {
+                    Ok(b) => b,
+                    Err(e) => {
+                        warn!("ui_text: failed to read {path} from the patch chain: {e:#}");
+                        continue;
+                    }
+                }
+            };
+            let ascent_ratio = hhea_ascent_ratio(&bytes).unwrap_or(0.794);
+            match register_font(&mut font_system, bytes) {
+                Ok((id, family)) => {
+                    path_to_face.insert(path.to_ascii_lowercase(), faces.len());
+                    faces.push(Face {
+                        id,
+                        family,
+                        ascent_ratio,
+                    });
+                }
+                Err(e) => warn!("ui_text: failed to register {path}: {e:#}"),
+            }
+        }
+        // Friz is index 0 in CLIENT_FONTS and is the fallback; without it nothing downstream has a
+        // face to fall back to.
+        let default_face = *path_to_face.get(&CLIENT_FONTS[0].to_ascii_lowercase())?;
+        info!(
+            "ui_text: font engine ready — {} face(s), glyphs rasterized on demand at {dpi}× \
+             device pixels",
+            faces.len()
+        );
+        Some(Self {
+            font_system,
+            swash: SwashCache::new(),
+            faces,
+            path_to_face,
+            default_face,
+            dpi,
+            chars: HashMap::new(),
+            cells: HashMap::new(),
+            sheet: Sheet::new(images),
+            generation: 0,
+            reset_pending: false,
+            complained: HashSet::new(),
+            over_ceiling: false,
+            stats: CacheStats::default(),
+        })
+    }
+
+    /// The face a Blizzard font path resolves to, or the fallback.
+    pub(super) fn face_for(&self, path: Option<&str>) -> usize {
+        path.and_then(|p| self.path_to_face.get(&p.to_ascii_lowercase()))
+            .copied()
+            .unwrap_or(self.default_face)
+    }
+
+    /// **The size law.** A logical height becomes the exact integer device-pixel size it will be
+    /// rasterized and drawn at — the client's `round((height/768)·deviceH)` with the 768-seam
+    /// already folded into `logical` by the caller ([`super::drawn_px`]), clamped to the raster
+    /// bounds ([`MIN_PPEM`]/[`MAX_PPEM`]).
+    ///
+    /// Everything downstream is keyed by this integer. It is why there is no `k`: the size a string
+    /// is measured at, the size its glyphs are rasterized at, and the size it is drawn at are one
+    /// number by construction, rather than three numbers kept in agreement by discipline.
+    pub(super) fn ppem(&mut self, logical: f32) -> u16 {
+        let px = (logical * self.dpi).round();
+        if !px.is_finite() {
+            return MIN_PPEM;
+        }
+        if px > f32::from(MAX_PPEM) && !self.over_ceiling {
+            self.over_ceiling = true;
+            warn!(
+                "ui_text: a {logical} logical-px request rasterizes at {px} device px, past the \
+                 {MAX_PPEM} ceiling — clamped. A size this large is an upstream bug, not a font."
+            );
+        }
+        (px as i64).clamp(i64::from(MIN_PPEM), i64::from(MAX_PPEM)) as u16
+    }
+
+    /// The **logical** height a ppem draws at — `ppem / dpi`. The pitch, the block height and every
+    /// measured extent are this, not the height that was requested: the request rounds to whole
+    /// device pixels first, exactly as the client rounds it, and everything then agrees with what
+    /// is actually on the screen.
+    pub(super) fn logical_size(&self, ppem: u16) -> f32 {
+        f32::from(ppem) / self.dpi
+    }
+
+    /// Physical px per logical px — the divisor the layout uses to bring cell metrics back into
+    /// logical space.
+    pub(super) fn dpi(&self) -> f32 {
+        self.dpi
+    }
+
+    /// The face's baseline-ascender fraction — the `[CGxFont+0x17c]` load_param the layout seats
+    /// each line's baseline with.
+    pub(super) fn ascent_ratio_of(&self, face: usize) -> f32 {
+        self.faces.get(face).map_or(0.794, |f| f.ascent_ratio)
+    }
+
+    /// The **logical** size a request actually draws at — [`Self::ppem`] rounded and back again.
+    ///
+    /// The crate-facing shape of the size law, for the world-pass callers that have to normalize
+    /// their own geometry against it ([`crate::nameplates`]'s mesh bake). Everything inside
+    /// `ui_text` gets it from the resolved spec instead.
+    pub(crate) fn drawn_size(&mut self, logical: f32) -> f32 {
+        let ppem = self.ppem(logical);
+        self.logical_size(ppem)
+    }
+
+    /// The baseline-ascender fraction for a font path — the `[CGxFont+0x17c]` load_param, for a
+    /// caller that already holds the lock.
+    pub(crate) fn ascent_ratio(&self, path: Option<&str>) -> f32 {
+        self.ascent_ratio_of(self.face_for(path))
+    }
+
+    /// Make sure every character of `text` is in the caches at this `(face, ppem, radius)`,
+    /// rasterizing whatever is missing. Call it once before walking a string; every
+    /// [`Self::char_cell`] / [`Self::cell`] lookup afterwards is a hit.
+    ///
+    /// The client has no such pre-pass — its layout kernels call `NewCodeDesc` (`0x5cabd0`) per
+    /// character as they walk, which is the same work in a different order. (`AllGlyphsCached`
+    /// `0x5c9fa0` is *not* it, despite the name: its one caller is `0x5cd3f0` and it gates
+    /// geometry invalidation after an eviction, never rasterization.) Hoisting it here is what
+    /// lets the walk itself take `&TextEngine` and stay a pure table read.
+    pub(super) fn ensure_str(&mut self, face: usize, ppem: u16, radius: u8, text: &str) {
+        for ch in text.chars() {
+            self.ensure_char(face, ppem, Some(radius), ch);
+        }
+    }
+
+    /// [`Self::ensure_str`]'s **metrics-only** twin: shape what is missing, rasterize nothing.
+    ///
+    /// This is the split that makes the whole design work. A width needs only the face and the
+    /// ppem — no bitmap, no packing, no GPU — so a string the script VM measures inside a Lua call
+    /// costs a shaping and a hash insert, and a string that is measured but never drawn (every
+    /// `GetStringWidth` probe, every wrap candidate the ellipsis seam backs off through) never
+    /// touches the sheet at all.
+    ///
+    /// **A deliberate divergence**, and worth naming as one: the real client's measure path
+    /// rasterizes (module doc). The number is identical either way — the step law reads only the
+    /// advance, which `FT_Load_Glyph` fixes before the render — so what we skip is work, not
+    /// fidelity.
+    pub(super) fn ensure_metrics(&mut self, face: usize, ppem: u16, text: &str) {
+        for ch in text.chars() {
+            self.ensure_char(face, ppem, None, ch);
+        }
+    }
+
+    /// Move the raster environment under a test. Production drives this from the window
+    /// ([`publish_sheet`]); nothing else may set it, because a mid-frame change would put two
+    /// raster sizes in one laid-out string.
+    #[cfg(test)]
+    pub(super) fn set_dpi_for_test(&mut self, dpi: f32) {
+        self.dpi = dpi;
+    }
+
+    /// One character: shape it alone (filling its [`CharCell`]) and rasterize its glyphs at
+    /// `radius`.
+    ///
+    /// **Shaped alone, deliberately.** The advance that lands in the width sum must be the face's
+    /// own advance for the glyph, carrying no neighbour term — the client's law (`ComputeStep`
+    /// `0x5ca2d0`) drops kerning, so a string's width is a pure function of its characters. Shaping
+    /// each character by itself is what makes that true rather than approximately true, and it is
+    /// what lets one table answer a measure and a draw.
+    fn ensure_char(&mut self, face: usize, ppem: u16, radius: Option<u8>, ch: char) {
+        if let Some(known) = self.chars.get(&(face, ppem, ch)) {
+            let Some(radius) = radius else { return };
+            // The pen metrics are there; the cells for THIS radius may not be (an outlined font
+            // asking for a character a plain one already drew).
+            let glyphs = known.glyphs.clone();
+            let Some(id) = self.faces.get(face).map(|f| f.id) else {
+                return;
+            };
+            for g in &glyphs {
+                self.ensure_cell(id, ppem, radius, g);
+            }
+            return;
+        }
+        let Some(f) = self.faces.get(face) else {
+            return;
+        };
+        let (face_id, family) = (f.id, f.family.clone());
+        let attrs = Attrs::new().family(Family::Name(&family));
+        let px = f32::from(ppem);
+        let mut glyphs: Vec<GlyphRef> = Vec::new();
+        let mut floor_sum = 0.0f32;
+        {
+            let mut buf = Buffer::new(&mut self.font_system, Metrics::new(px, px));
+            buf.set_wrap(&mut self.font_system, Wrap::None);
+            let mut one = [0u8; 4];
+            buf.set_text(
+                &mut self.font_system,
+                ch.encode_utf8(&mut one),
+                &attrs,
+                Shaping::Advanced,
+                None,
+            );
+            buf.shape_until_scroll(&mut self.font_system, false);
+            for run in buf.layout_runs() {
+                for g in run.glyphs {
+                    // A lone first glyph on the line has x == y == 0.0, so this is the
+                    // zero-subpixel canonical rasterization for (face, glyph, ppem).
+                    let physical = g.physical((0.0, 0.0), 1.0);
+                    glyphs.push(GlyphRef {
+                        glyph_id: g.glyph_id,
+                        key: physical.cache_key,
+                        advance: g.w,
+                        y_off: g.y,
+                    });
+                    floor_sum += g.w.floor();
+                }
+            }
+        }
+        if glyphs.is_empty() {
+            // No face shaped it — it draws nothing and, per the width law's own note, measures
+            // nothing. Report once, not once per frame.
+            if self.complained.insert(ch) {
+                warn!("ui_text: no glyph for {ch:?} in any registered face");
+            }
+            return;
+        }
+        self.stats.chars_shaped += 1;
+        if let Some(radius) = radius {
+            for g in &glyphs {
+                let g = *g;
+                self.ensure_cell(face_id, ppem, radius, &g);
+            }
+        }
+        self.chars
+            .insert((face, ppem, ch), CharCell { glyphs, floor_sum });
+    }
+
+    /// Rasterize + pack one glyph's cell, unless it is already there.
+    fn ensure_cell(&mut self, face_id: fontdb::ID, ppem: u16, radius: u8, g: &GlyphRef) {
+        let key: GlyphKey = (face_id, g.glyph_id, ppem, radius);
+        if self.cells.contains_key(&key) {
+            return;
+        }
+        // Copied out rather than borrowed, so the pages can be written below.
+        let raster = {
+            let Self {
+                swash, font_system, ..
+            } = self;
+            swash
+                .get_image(font_system, g.key)
+                .as_ref()
+                .map(|i| (i.placement, i.data.clone()))
+        };
+        let Some((placement, cov)) = raster else {
+            self.cells.insert(key, None);
+            return;
+        };
+        let (w, h) = (placement.width, placement.height);
+        if w == 0 || h == 0 {
+            // Whitespace / zero-ink glyph: real metrics, no cell.
+            self.cells.insert(key, None);
+            return;
+        }
+        self.stats.cells_rasterized += 1;
+        // An outlined cell grows by `pad` on every side; the bearings move out with it, the
+        // advance does not (the step law owns tracking).
+        let (uv, cw, ch, bx, bt) = if radius == 0 {
+            (
+                self.sheet.alloc(w, h, &Cell::Coverage(&cov)),
+                w,
+                h,
+                placement.left as f32,
+                placement.top as f32,
+            )
+        } else {
+            let (rgba, ow, oh, pad) = outlined_cell(&cov, w, h, radius, self.dpi);
+            (
+                self.sheet.alloc(ow, oh, &Cell::Rgba(&rgba)),
+                ow,
+                oh,
+                placement.left as f32 - pad as f32,
+                placement.top as f32 + pad as f32,
+            )
+        };
+        match uv {
+            Some(uv) => {
+                self.cells.insert(
+                    key,
+                    Some(GlyphInfo {
+                        uv,
+                        px_w: cw as f32,
+                        px_h: ch as f32,
+                        bearing_x: bx,
+                        bearing_top: bt,
+                    }),
+                );
+            }
+            None => self.note_exhausted(key),
+        }
+    }
+
+    /// The pages could not fit a cell. Record nothing for it (so the glyph draws nothing for at
+    /// most one frame) and ask for a reset at the frame boundary.
+    ///
+    /// A shelf allocator cannot reclaim an interior cell, so there is no piecemeal eviction to
+    /// reach for: the honest move is to drop everything and refill from what is actually on screen,
+    /// which costs one frame of rasterization for the visible text. What must NOT happen is doing
+    /// it here — glyphs already pushed this frame hold UVs into the pages, and moving them mid-pass
+    /// would draw this frame's text as fragments of other letters (the exact shape of 1339's fault
+    /// 2, which is worth not rebuilding).
+    fn note_exhausted(&mut self, key: GlyphKey) {
+        self.cells.insert(key, None);
+        if !self.reset_pending {
+            self.reset_pending = true;
+            let (used, total) = self.sheet.occupancy();
+            warn!(
+                "ui_text: glyph sheet full ({used}/{total} texels, {} cells) — resetting at the \
+                 frame boundary",
+                self.cells.len()
+            );
+        }
+    }
+
+    /// One character's pen metrics — `None` for a character no face can shape (it draws nothing and
+    /// measures nothing, the one narrow place the measure differs from the render pen).
+    pub(super) fn char_cell(&self, face: usize, ppem: u16, ch: char) -> Option<&CharCell> {
+        self.chars.get(&(face, ppem, ch))
+    }
+
+    /// One glyph's cell — `None` for a zero-ink glyph, and for the one frame after an exhaustion.
+    pub(super) fn cell(
+        &self,
+        face: usize,
+        ppem: u16,
+        radius: u8,
+        glyph_id: u16,
+    ) -> Option<GlyphInfo> {
+        let id = self.faces.get(face)?.id;
+        self.cells
+            .get(&(id, glyph_id, ppem, radius))
+            .copied()
+            .flatten()
+    }
+
+    /// The one texture every glyph quad samples.
+    pub(super) fn sheet_image(&self) -> Handle<Image> {
+        self.sheet.handle()
+    }
+}
+
+// ─────────────────────────────────────────────────────────────────────────────────────────────
+// The Bevy face of it
+// ─────────────────────────────────────────────────────────────────────────────────────────────
+
+/// The font engine as the app holds it: one [`TextEngine`] behind one lock, plus the per-region
+/// ellipsis memo.
+///
+/// The lock is what lets the same engine answer the render path and the script VM's synchronous
+/// measurer ([`super::AtlasMeasurer`]), which reaches in from inside a Lua call. See the module
+/// doc's lock discipline.
+#[derive(Resource)]
+pub(crate) struct UiFontAtlas {
+    engine: Arc<Mutex<TextEngine>>,
+    /// Mirrored out of the engine each frame so the extract gate can read it without taking the
+    /// lock. Moves only on a cache reset.
+    pub(crate) generation: u64,
+    /// Per-region ellipsis display strings ([`super::EllipsisMemo`]) — the client's own
+    /// `CGxString+0xf8` cache, keyed by the inputs instead of a dirty flag.
+    pub(super) ellipsis: super::EllipsisMemo,
+}
+
+impl UiFontAtlas {
+    /// Take the engine lock. Release it before calling anything that might re-enter through the
+    /// VM's measurer.
+    pub(crate) fn lock(&self) -> MutexGuard<'_, TextEngine> {
+        self.engine
+            .lock()
+            .unwrap_or_else(std::sync::PoisonError::into_inner)
+    }
+
+    /// The shared engine, for the VM's measurer.
+    pub(crate) fn engine(&self) -> Arc<Mutex<TextEngine>> {
+        Arc::clone(&self.engine)
+    }
+
+    /// The one texture every glyph draws from — for the world-pass consumers
+    /// ([`crate::nameplates`]) that bind glyph cells onto 3-D geometry instead of UI quads.
+    ///
+    /// Stable for the life of the process, which is new: under the size ladder every re-bake
+    /// published a fresh `Handle<Image>`, and a cache that kept the old one drew the new bake's
+    /// UVs through the old bake's texture (B272, decision 1339). Cells are written into this
+    /// texture in place now, so there is no successor to go stale against.
+    pub(crate) fn image(&self) -> Handle<Image> {
+        self.lock().sheet_image()
+    }
+}
+
+/// A real-font engine for a test: the client faces, read through the app's own patch chain. `None`
+/// when there is no install, or the chain or a face will not open — every caller **skips** rather
+/// than fails (`wow_data_or_skip!`).
+#[cfg(test)]
+pub(super) fn test_engine(dpi: f32) -> Option<TextEngine> {
+    let data = benilla_formats::wow_data()?;
+    let chain = benilla_formats::open_chain(&data).ok()?;
+    let mut font_system = FontSystem::new_with_fonts(std::iter::empty());
+    let mut faces: Vec<Face> = Vec::new();
+    let mut path_to_face = HashMap::new();
+    for &path in CLIENT_FONTS {
+        let Ok(bytes) = chain.read(path) else {
+            continue;
+        };
+        let ascent_ratio = hhea_ascent_ratio(&bytes).unwrap_or(0.794);
+        let (id, family) = register_font(&mut font_system, bytes).ok()?;
+        path_to_face.insert(path.to_ascii_lowercase(), faces.len());
+        faces.push(Face {
+            id,
+            family,
+            ascent_ratio,
+        });
+    }
+    let default_face = *path_to_face.get(&CLIENT_FONTS[0].to_ascii_lowercase())?;
+    Some(TextEngine {
+        font_system,
+        swash: SwashCache::new(),
+        faces,
+        path_to_face,
+        default_face,
+        dpi,
+        chars: HashMap::new(),
+        cells: HashMap::new(),
+        sheet: Sheet::new(&Assets::<Image>::default()),
+        generation: 0,
+        reset_pending: false,
+        complained: HashSet::new(),
+        over_ceiling: false,
+        stats: CacheStats::default(),
+    })
+}
+
+/// The client font paths, for tests that name a face.
+#[cfg(test)]
+pub(super) const TEST_FACES: &[&str] = CLIENT_FONTS;
+
+#[cfg(test)]
+mod differential_tests {
+    use super::*;
+
+    /// Real strings of the kinds that actually reach a measure: character names, item names,
+    /// prose, the sequences a ligature table would target, the Latin-1 tail, and the digits the
+    /// money frame sums.
+    const CORPUS: &[&str] = &[
+        "",
+        " ",
+        "Onewarrior",
+        "Probezero",
+        "Small Brown Pouch",
+        "Staff of the Shadow Flame",
+        "The affluent fiend's fickle offer",
+        "fi fl ffi ffl ff",
+        "AV Ta Wo Yo LT P, r. v.",
+        "0123456789",
+        "Grüße, Ärger; élan côté",
+        "!@#$%^&*()_+-=[]{}|;':\",./<>?",
+    ];
+
+    /// **The character walk selects the glyphs whole-string shaping selects** — over the real
+    /// client fonts.
+    ///
+    /// Both halves of this module's design rest on one property: a string's glyph sequence is the
+    /// concatenation of its characters' glyph sequences. That is what lets
+    /// [`TextEngine::ensure_char`] shape one character at a time — which in turn is what lets a
+    /// measure be answered from inside a Lua call, and what lets the emit pass walk characters
+    /// instead of running a shaper.
+    ///
+    /// It is a property of the FONTS, not of the code, and exactly the kind that would go silently
+    /// wrong: a face with a ligature or a contextual substitution would break it and nothing else
+    /// would notice. Skips without an install.
+    #[test]
+    fn a_character_walk_selects_what_the_whole_string_selects() {
+        let Some(mut e) = test_engine(1.0) else {
+            eprintln!("skipping: no install / patch chain");
+            return;
+        };
+        let mut checked = 0usize;
+        for dpi in [1.0f32, 2.0] {
+            e.set_dpi_for_test(dpi);
+            for face in 0..e.faces.len() {
+                let family = e.faces[face].family.clone();
+                // One small size and one large, so a size-dependent substitution could not hide
+                // between them.
+                for ppem in [10u16, 20] {
+                    for text in CORPUS {
+                        let (want, _) = shape_whole(&mut e, &family, ppem, text);
+                        e.ensure_metrics(face, ppem, text);
+                        let got: Vec<u16> = text
+                            .chars()
+                            .filter_map(|c| e.char_cell(face, ppem, c))
+                            .flat_map(|c| c.glyphs.iter().map(|g| g.glyph_id))
+                            .collect();
+                        assert_eq!(
+                            got, want,
+                            "{family} @{ppem} dpi {dpi}: {text:?} — the character walk and the \
+                             whole-string shaping must select the same glyphs"
+                        );
+                        checked += 1;
+                    }
+                }
+            }
+        }
+        assert!(
+            checked > 0,
+            "no client font was readable — nothing was proven"
+        );
+    }
+
+    /// **The width is the sum of unkerned per-character steps, and that is on purpose.**
+    ///
+    /// `measure_line_width` reads [`CharCell::floor_sum`], which is pre-summed at shaping time.
+    /// This recomputes it from each glyph's own stored advance, so a mistake in the pre-summing or
+    /// in the physical→logical divide fails here rather than on screen.
+    ///
+    /// The second half is the one that matters more: it asserts the answer **differs** from
+    /// shaping the whole string, on a corpus of kerning pairs. cosmic-text's `Shaping::Advanced`
+    /// kerns `AV`, `Ta`, `Wo`, `Yo`, `LT` and friends; the client's law does not
+    /// (`ComputeStep 0x5ca2d0` applies only negative pair kerns and rounds, which we drop
+    /// entirely — the module doc's stated v1 simplification). Without this assertion, someone
+    /// "fixing" the measure to shape whole runs would make text quietly narrower than the
+    /// reference and nothing would object.
+    #[test]
+    fn the_width_is_the_unkerned_per_character_sum() {
+        let Some(mut e) = test_engine(1.0) else {
+            eprintln!("skipping: no install / patch chain");
+            return;
+        };
+        let mut kerning_seen = 0usize;
+        for dpi in [1.0f32, 2.0] {
+            e.set_dpi_for_test(dpi);
+            for face in 0..e.faces.len() {
+                let family = e.faces[face].family.clone();
+                for ppem in [10u16, 20] {
+                    // Both step biases: plain/NORMAL (+1) and THICK (+2).
+                    for step_extra in [1.0f32, 2.0] {
+                        for text in CORPUS {
+                            let got = super::super::layout::measure_line_width_for_test(
+                                &mut e, face, ppem, step_extra, text,
+                            );
+                            let by_glyph: f32 = text
+                                .chars()
+                                .filter_map(|c| e.char_cell(face, ppem, c))
+                                .flat_map(|c| c.glyphs.iter())
+                                .map(|g| (g.advance.floor() + step_extra) / dpi)
+                                .sum();
+                            assert_eq!(
+                                got, by_glyph,
+                                "{family} @{ppem} dpi {dpi} extra {step_extra}: {text:?} — the \
+                                 pre-summed floor must be the per-glyph sum"
+                            );
+                            let (_, kerned) = shape_whole(&mut e, &family, ppem, text);
+                            let kerned =
+                                kerned + step_extra * kerned_glyphs(&mut e, face, ppem, text) / dpi;
+                            if (kerned - got).abs() > 1e-3 {
+                                kerning_seen += 1;
+                            }
+                        }
+                    }
+                }
+            }
+        }
+        assert!(
+            kerning_seen > 0,
+            "the corpus is full of kerning pairs — if the shaped sum never differs from ours, \
+             either kerning stopped being dropped or this test stopped measuring it"
+        );
+    }
+
+    /// Glyph count of `text` at `(face, ppem)` — the multiplier the step bias takes.
+    fn kerned_glyphs(e: &mut TextEngine, face: usize, ppem: u16, text: &str) -> f32 {
+        e.ensure_metrics(face, ppem, text);
+        text.chars()
+            .filter_map(|c| e.char_cell(face, ppem, c))
+            .map(|c| c.glyphs.len() as f32)
+            .sum()
+    }
+
+    /// The reference: shape the WHOLE string in one buffer. Returns its glyph ids and the sum of
+    /// its **kerned** floored advances (no step bias — the caller adds it).
+    fn shape_whole(e: &mut TextEngine, family: &str, ppem: u16, text: &str) -> (Vec<u16>, f32) {
+        if text.is_empty() {
+            return (Vec::new(), 0.0);
+        }
+        let attrs = Attrs::new().family(Family::Name(family));
+        let px = f32::from(ppem);
+        let mut buf = Buffer::new(&mut e.font_system, Metrics::new(px, px));
+        buf.set_wrap(&mut e.font_system, Wrap::None);
+        buf.set_text(&mut e.font_system, text, &attrs, Shaping::Advanced, None);
+        buf.shape_until_scroll(&mut e.font_system, false);
+        let (mut ids, mut w) = (Vec::new(), 0.0f32);
+        for run in buf.layout_runs() {
+            for g in run.glyphs {
+                ids.push(g.glyph_id);
+                w += g.w.floor() / e.dpi;
+            }
+        }
+        (ids, w)
+    }
+}
+
+#[cfg(test)]
+mod ppem_tests {
+    use super::*;
+
+    fn engine_or_skip() -> Option<TextEngine> {
+        match test_engine(1.0) {
+            Some(e) => Some(e),
+            None => {
+                eprintln!("skipping: no client install / patch chain");
+                None
+            }
+        }
+    }
+
+    /// **The size law, which is the whole decision.** A logical height becomes whole device pixels
+    /// and nothing else; a request "between sizes" does not exist, because there is nothing to be
+    /// between. Under the ladder, 12.48 snapped to 12 and the draw then stretched every finished
+    /// quad by 1.04 about an anchor — which is what took the letters off their shared baseline.
+    #[test]
+    fn a_logical_height_becomes_whole_device_pixels() {
+        let Some(mut e) = engine_or_skip() else {
+            return;
+        };
+        assert_eq!(e.ppem(12.0), 12, "an exact size is itself");
+        assert_eq!(e.ppem(12.48), 12, "…and a fractional one rounds, not snaps");
+        assert_eq!(e.ppem(12.5), 13);
+        // The era-shaped windows' `SetScale(0.78)` — the case a fixed ladder could never carry,
+        // because the Options window and the Game Menu are off it BY CONSTRUCTION.
+        assert_eq!(e.ppem(16.0 * 0.78), 12);
+        // Retina: the same logical height, twice the pixels, still an integer.
+        e.dpi = 2.0;
+        assert_eq!(e.ppem(12.0), 24);
+        assert_eq!(e.ppem(16.0 * 0.78), 25);
+        // The clamps.
+        assert_eq!(e.ppem(0.0), MIN_PPEM);
+        assert_eq!(e.ppem(-3.0), MIN_PPEM);
+        assert_eq!(e.ppem(f32::NAN), MIN_PPEM);
+        assert_eq!(e.ppem(10_000.0), MAX_PPEM);
+    }
+
+    /// The logical height a ppem draws at round-trips — which is what makes the pitch, the block
+    /// height and every measured extent agree with the pixels on the screen rather than with the
+    /// float that was asked for.
+    #[test]
+    fn the_drawn_logical_size_is_the_ppem_back_again() {
+        let Some(mut e) = engine_or_skip() else {
+            return;
+        };
+        assert_eq!(e.drawn_size(12.0), 12.0);
+        e.dpi = 2.0;
+        assert_eq!(e.drawn_size(12.0), 12.0);
+        // A request that does not land on a whole device pixel draws at the size it rounded to,
+        // and says so — no second, different number anywhere downstream.
+        assert_eq!(e.drawn_size(12.3), 12.5);
+    }
+
+    /// A character is shaped once and rasterized once per (size, radius); asking again is free, and
+    /// asking for a second radius adds a cell without re-shaping.
+    #[test]
+    fn a_character_is_shaped_once_and_cached_per_size_and_radius() {
+        let Some(mut e) = engine_or_skip() else {
+            return;
+        };
+        let face = e.face_for(None);
+        e.ensure_str(face, 14, 0, "Ab");
+        let (shaped, cells) = (e.stats.chars_shaped, e.stats.cells_rasterized);
+        assert_eq!(shaped, 2, "two characters");
+        assert_eq!(cells, 2, "two plain cells");
+
+        e.ensure_str(face, 14, 0, "Ab");
+        assert_eq!(e.stats.chars_shaped, shaped, "a repeat costs no shaping");
+        assert_eq!(e.stats.cells_rasterized, cells, "…and no raster");
+
+        // A second outline radius: new cells, no new shaping.
+        e.ensure_str(face, 14, 1, "Ab");
+        assert_eq!(
+            e.stats.chars_shaped, shaped,
+            "the pen metrics were already there"
+        );
+        assert_eq!(
+            e.stats.cells_rasterized,
+            cells + 2,
+            "…but the ring is a new cell"
+        );
+
+        // A different size is a different raster, as it must be — that is the point.
+        e.ensure_str(face, 15, 0, "Ab");
+        assert_eq!(e.stats.chars_shaped, shaped + 2);
+
+        // …and the cells are all really there, at both sizes.
+        for ppem in [14u16, 15] {
+            for ch in "Ab".chars() {
+                let c = e.char_cell(face, ppem, ch).expect("shaped");
+                for g in &c.glyphs {
+                    assert!(e.cell(face, ppem, 0, g.glyph_id).is_some(), "{ch} @{ppem}");
+                }
+            }
+        }
+    }
+
+    /// A space has real metrics and no cell — it must step the pen and draw nothing, and it must
+    /// not be re-asked every frame.
+    #[test]
+    fn a_zero_ink_character_keeps_its_advance() {
+        let Some(mut e) = engine_or_skip() else {
+            return;
+        };
+        let face = e.face_for(None);
+        e.ensure_str(face, 14, 0, " ");
+        let c = e.char_cell(face, 14, ' ').expect("a space still shapes");
+        assert_eq!(c.glyphs.len(), 1);
+        assert!(c.floor_sum > 0.0, "a space is wide");
+        assert!(
+            e.cell(face, 14, 0, c.glyphs[0].glyph_id).is_none(),
+            "…and has no ink"
+        );
+        let raster = e.stats.cells_rasterized;
+        e.ensure_str(face, 14, 0, " ");
+        assert_eq!(e.stats.cells_rasterized, raster, "the miss is paid once");
+    }
+
+    /// Each face resolves to itself, and an unknown path falls back to Friz.
+    #[test]
+    fn a_font_path_resolves_to_its_own_face() {
+        let Some(e) = engine_or_skip() else {
+            return;
+        };
+        let friz = e.face_for(Some(TEST_FACES[0]));
+        assert_eq!(friz, e.face_for(None), "Friz is the fallback");
+        assert_eq!(friz, e.face_for(Some("Fonts\\NOSUCH.TTF")));
+        assert_eq!(friz, e.face_for(Some("fonts\\frizqt__.ttf")), "case-folded");
+        assert_ne!(friz, e.face_for(Some(TEST_FACES[1])), "ARIALN is its own");
+    }
+}
diff --git a/crates/benilla-app/src/ui_text/layout/measure.rs b/crates/benilla-app/src/ui_text/layout/measure.rs
new file mode 100644
index 00000000..f6af1205
--- /dev/null
+++ b/crates/benilla-app/src/ui_text/layout/measure.rs
@@ -0,0 +1,540 @@
+//! **Measure and fit** — the width law, the wrap walk, and the ellipsis seam.
+//!
+//! Split from the emit pass ([`super`]) at decision 1342, which is when the split finally became
+//! honest. Under the size ladder these two halves computed in *different spaces*: measure answered
+//! in drawn px and the emit pass laid out at the snapped size, with a rescale between them, so
+//! every fit decision had to be converted back and forth and each conversion was a place to get it
+//! wrong (1339's fault 1 — an auto-sized label wrapping inside its own measured width). With the
+//! raster size an exact integer, both halves work in one space over one table, and the seam between
+//! them is just "who calls whom".
+//!
+//! Everything here is a pure function of `(face, ppem, outline bias, characters)`. That is the
+//! client's own law — `ComputeStep 0x5ca2d0` has no kerning term and no neighbour term — and it is
+//! what lets a measure be answered from inside a Lua call, where a shaper could never reach.
+
+use bevy::math::Rect;
+
+use benilla_ui::script::{JustifyH, JustifyV};
+
+use super::super::engine::{TextEngine, UiFontAtlas};
+use super::super::markup::{fontstring_lines, parse_markup, ColorRun};
+use super::wrap::{greedy_pack, tokenize_words};
+use super::{client_step, overflow, FontSpec, Justify, HEIGHT_LIMIT_MIN, WRAP_MIN_WIDTH};
+
+/// A [`FontSpec`] resolved against the engine — everything downstream needs, looked up once.
+///
+/// One body, because the three things it produces have to agree: a measure that resolved a
+/// different face than the draw, or a different raster size, is exactly the class of bug this
+/// decision is about.
+#[derive(Clone, Copy)]
+pub(super) struct Resolved {
+    /// Index into the engine's faces.
+    pub(super) face: usize,
+    /// The exact integer device-pixel size ([`TextEngine::ppem`]).
+    pub(super) ppem: u16,
+    /// The **logical** height that ppem draws at — the line pitch, and the em every block-height
+    /// law uses. Not the height that was requested: see [`TextEngine::logical_size`].
+    pub(super) size: f32,
+    /// The outline cell variant (`0` = plain).
+    pub(super) radius: u8,
+    /// The step law's per-glyph bias ([`super::step_extra_of`]).
+    pub(super) step_extra: f32,
+}
+
+/// Resolve a spec. Does **not** touch the caches — call [`TextEngine::ensure_metrics`] (or
+/// [`TextEngine::ensure_str`], to draw) for the string itself.
+pub(super) fn resolve(e: &mut TextEngine, font: &FontSpec) -> Resolved {
+    let face = e.face_for(font.path);
+    let ppem = e.ppem(font.height.unwrap_or(super::super::DEFAULT_FONT_SIZE));
+    Resolved {
+        face,
+        ppem,
+        size: e.logical_size(ppem),
+        radius: super::super::outline::radius_of(font.outline),
+        step_extra: super::step_extra_of(font.outline),
+    }
+}
+
+/// One line's total laid-out width (logical px) under the client's step law
+/// ([`client_step`]): the sum of per-character steps, read from the cache
+/// ([`TextEngine::char_cell`]). This is the client's `GetTextWidth` (a sum of `ComputeStep`s), so
+/// measure == render == the real client's width. Empty text is zero-width.
+///
+/// **No shaper, and that is the point.** The client's law has no kerning term and no neighbour
+/// term, so a string's width is a pure function of its characters, face, size and outline — which
+/// is what lets the lookup be cached, and therefore what lets this answer from *inside* a Lua call
+/// ([`benilla_ui::script::TextMeasure`]), where a `&mut FontSystem` could never reach. Every
+/// measurement in the app runs through this one function, so the synchronous answer and the batch
+/// answer cannot be different numbers.
+///
+/// A character no face can shape contributes 0 — and steps the render pen by 0 too, so unlike
+/// under the ladder there is no divergence left to document here.
+///
+/// The caller must have ensured `text`'s metrics; a character that has not been is skipped rather
+/// than shaped, because this half is deliberately `&`-only.
+pub(super) fn measure_line_width(e: &TextEngine, r: Resolved, step_extra: f32, text: &str) -> f32 {
+    let dpi = e.dpi();
+    text.chars()
+        .filter_map(|c| e.char_cell(r.face, r.ppem, c))
+        .map(|c| (c.floor_sum + step_extra * c.glyphs.len() as f32) / dpi)
+        .sum()
+}
+
+/// The width law itself, for the differential test that pins it to a shaped sum.
+#[cfg(test)]
+pub(crate) fn measure_line_width_for_test(
+    e: &mut TextEngine,
+    face: usize,
+    ppem: u16,
+    step_extra: f32,
+    text: &str,
+) -> f32 {
+    e.ensure_metrics(face, ppem, text);
+    let r = Resolved {
+        face,
+        ppem,
+        size: e.logical_size(ppem),
+        radius: 0,
+        step_extra,
+    };
+    measure_line_width(e, r, step_extra, text)
+}
+
+/// Greedy word-boundary wrap of one markup line (a `\n`-delimited run sequence) into sub-lines that
+/// each fit within `max_width` px.
+///
+/// The break law is the byte-verified regime-2 wrap (`system/ui/scratch/fontstring-overflow.md`,
+/// the `0x5c6c50`/`0x5c7780` kernel): break at the last break opportunity; a word with none that
+/// overflows alone force-breaks at the last fitting glyph — a rendered line never exceeds the wrap
+/// width. Inter-word whitespace is preserved verbatim (a double space after a period stays a double
+/// space — see [`tokenize_words`]), and only the trailing separator at a line break drops. Colors
+/// are preserved per word (the separating whitespace attaches to the preceding run, since it draws
+/// no ink). **Remaining approximation:** break opportunities are ASCII/Unicode whitespace only —
+/// the kernel's kinsoku (CJK) opportunity classes and the `nonspacewrap` flag (ui `0x1000`:
+/// mid-word breaks become opportunities even when a space exists) are unmodeled; no shipped
+/// FontString renders CJK, and the one `nonspacewrap` consumer (MinimapZoneText) sits in a one-line
+/// box where opportunity choice cannot change the outcome.
+pub(super) fn wrap_line(
+    e: &TextEngine,
+    r: Resolved,
+    line: &[ColorRun],
+    max_width: f32,
+) -> Vec<Vec<ColorRun>> {
+    // Flatten the line's color runs into words, each tagged with its run color and its verbatim
+    // inter-word separator (so Blizzard's double spaces survive the wrap).
+    let words = tokenize_words(line);
+    if words.is_empty() {
+        // A blank line (only whitespace / empty) still occupies a row — keep it as one empty line.
+        return vec![line.to_vec()];
+    }
+    greedy_pack(words, max_width, |t| {
+        measure_line_width(e, r, r.step_extra, t)
+    })
+}
+
+/// Measure `text`'s laid-out size — width of the widest line, height of all (wrapped) lines — at
+/// the resolved face/size, wrapping at `wrap_width` when given (the same [`wrap_line`] pass
+/// rendering uses, so measure == render). The engine's measure round-trip
+/// ([`benilla_ui::script::UiScript::fontstrings_needing_measure`]) sizes height-less FontStrings
+/// with this — the real client's layout asks its font engine for string metrics the same way.
+pub(crate) fn measure_text(
+    e: &mut TextEngine,
+    text: &str,
+    wrap_width: Option<f32>,
+    font: FontSpec,
+) -> (f32, f32) {
+    let r = resolve(e, &font);
+    // The one `&mut` moment: everything below reads the cache this fills. Metrics only — a string
+    // that is measured and never drawn costs no raster and no GPU.
+    e.ensure_metrics(r.face, r.ppem, text);
+    let e = &*e;
+
+    let lines = fontstring_lines(text, [1.0, 1.0, 1.0, 1.0]);
+    let render_lines: Vec<Vec<ColorRun>> = match wrap_width {
+        Some(w) if w > WRAP_MIN_WIDTH => lines
+            .iter()
+            .flat_map(|line| wrap_line(e, r, line, w))
+            .collect(),
+        _ => lines,
+    };
+    let mut max_w = 0.0f32;
+    for line in &render_lines {
+        let mut w = 0.0f32;
+        for run in line {
+            if !run.text.is_empty() {
+                w += measure_line_width(e, r, r.step_extra, &run.text);
+            }
+        }
+        max_w = max_w.max(w);
+    }
+    // A hair of headroom. This used to be load-bearing: the emit pass re-wrapped inside this same
+    // width in a *different* space, and the rescale between them turned float noise into a
+    // proportional error (1339). With one raster size there is one space, and the emit pass sums
+    // the identical per-character steps in the identical order — the two numbers are bit-equal, so
+    // this pixel is now pure belt-and-braces. It stays because removing it narrows every auto-sized
+    // FontString by a pixel, which is a look change and therefore the director's call, not a
+    // refactor's.
+    //
+    // Height: N lines at the client's intrinsic pitch — the font em, NO outline pad (the byte law:
+    // `font_textblock_height 0x5c2070` = N·S + (N−1)·gap, spacing 0 for all shipped UI; the +2r
+    // lives only in the atlas CELL, never the block math — `fontstring-vertical-placement.md`). An
+    // outlined line's ring pokes past this height by design, exactly as it does in the client.
+    (max_w.ceil() + 1.0, render_lines.len() as f32 * r.size)
+}
+
+/// How many display rows `text` wraps into at `wrap_width` — the message-line half of the measure
+/// round-trip ([`benilla_ui::script::UiScript::message_lines_needing_measure`]): the engine's
+/// ScrollingMessageFrame allocates `rows × font-height` per ring line from this. Runs the exact
+/// [`wrap_line`] pass rendering uses (same step law, same outline bias), so the band height always
+/// equals the drawn block height. Never 0 (empty text is one blank row).
+pub(crate) fn measure_wrapped_rows(
+    e: &mut TextEngine,
+    text: &str,
+    wrap_width: f32,
+    font: FontSpec,
+) -> u16 {
+    let r = resolve(e, &font);
+    e.ensure_metrics(r.face, r.ppem, text);
+    let rows = wrapped_rows(e, r, text, wrap_width);
+    rows.clamp(1, usize::from(u16::MAX)) as u16
+}
+
+/// The wrapped display-row count of `text` at `wrap_width` — the exact [`wrap_line`] pass the
+/// render uses. An unconstrained width counts the `\n` lines.
+fn wrapped_rows(e: &TextEngine, r: Resolved, text: &str, wrap_width: f32) -> usize {
+    wrapped_rows_capped(e, r, text, wrap_width, usize::MAX)
+}
+
+/// [`wrapped_rows`] that stops once `cap` rows exist — the client's own fit walk is bounded by the
+/// BOX, not by the string: `GxuFont_GetMaxCharsWithinHeight` (`0x5c21c0`) lays out `min(needed,
+/// fits + 1)` lines and abandons the rest, because the height test sits downstream of the per-line
+/// kernel call (wow-re `system/ui/scratch/fontstring-ellipsis-cost.md`). A caller that only needs
+/// to know whether the text OVERFLOWS passes `allowed + 1` and never pays for the tail; the chat
+/// band's row count, which is a real number, passes [`usize::MAX`].
+fn wrapped_rows_capped(
+    e: &TextEngine,
+    r: Resolved,
+    text: &str,
+    wrap_width: f32,
+    cap: usize,
+) -> usize {
+    let lines = fontstring_lines(text, [1.0, 1.0, 1.0, 1.0]);
+    if wrap_width <= WRAP_MIN_WIDTH {
+        return lines.len().min(cap);
+    }
+    let mut rows = 0usize;
+    for line in &lines {
+        rows += wrap_line(e, r, line, wrap_width).len();
+        if rows >= cap {
+            return cap;
+        }
+    }
+    rows
+}
+
+/// [`wrapped_rows`], for the ellipsis-cost bench.
+#[cfg(test)]
+pub(super) fn wrapped_rows_for_test(
+    e: &TextEngine,
+    r: Resolved,
+    text: &str,
+    wrap_width: f32,
+) -> usize {
+    wrapped_rows(e, r, text, wrap_width)
+}
+
+/// [`wrapped_rows_capped`], for the ellipsis-cost bench.
+#[cfg(test)]
+pub(super) fn wrapped_rows_capped_for_test(
+    e: &TextEngine,
+    r: Resolved,
+    text: &str,
+    wrap_width: f32,
+    cap: usize,
+) -> usize {
+    wrapped_rows_capped(e, r, text, wrap_width, cap)
+}
+
+/// The FontString display string under the height-gated ellipsis-truncate — `CSimpleFontString
+/// 0x771ec0`, regime 3 of the overflow verdict (`fontstring-overflow.md`, decision 0292's named
+/// residue): when the wrapped text needs more lines than the box allows, the tail is replaced by
+/// `"..."`, backed off one char at a time until the candidate fits. `None` = draw the raw text
+/// (fits, or the gate fails). The gate is geometric — `boxW > 0 && boxH > 0` on the resolved rect
+/// (`maxLines` unmodeled; nothing shipped sets it): an auto-height FontString's rect height IS its
+/// wrapped block (the measure round-trip), so it always fits and never truncates — the byte law's
+/// intrinsic-height escape. Applies at the region-FontString paint seam only
+/// ([`crate::ui_script::extract`]): the client's ellipsis is a FontString mechanism — editbox,
+/// message-frame lines, and world text (`combat_text`/nameplates) never take it, exactly as their
+/// C++ counterparts never call `0x771ec0`.
+///
+/// **The box is the box.** Under the ladder this had to divide the rect by the draw's rescale
+/// before comparing it against unscaled glyphs, and getting that backwards is what truncated text
+/// that fits (B209, decision 0989's named residual). There is no rescale now, so there is no
+/// conversion here and none to get backwards.
+pub(crate) fn ellipsize_to_fit(
+    atlas: &mut UiFontAtlas,
+    region: benilla_ui::widget::RegionHandle,
+    text: &str,
+    rect: Rect,
+    font: FontSpec,
+) -> Option<String> {
+    if rect.width() <= WRAP_MIN_WIDTH || rect.height() <= HEIGHT_LIMIT_MIN {
+        return None;
+    }
+    let (box_w, box_h) = (rect.width(), rect.height());
+    // The remembered answer, under exactly these inputs ([`super::super::EllipsisMemo`] — the
+    // client's `CGxString+0xf8`). The paint pass runs every frame; this seam is what the client
+    // rebuilds only on invalidation, and it is the most expensive thing in the pass by an order of
+    // magnitude (B240, decision 1332).
+    if let Some(hit) = atlas.ellipsis.get(region, text, box_w, box_h, &font) {
+        return hit.clone();
+    }
+    let display = {
+        let mut e = atlas.lock();
+        let r = resolve(&mut e, &font);
+        // Every candidate is a prefix of `text` plus "..." — so one ensure covers the whole walk.
+        e.ensure_metrics(r.face, r.ppem, text);
+        e.ensure_metrics(r.face, r.ppem, "...");
+        let e = &*e;
+        // The fit test only has to decide OVERFLOW, so it stops one row past the box — the client's
+        // own bound ([`wrapped_rows_capped`]).
+        let cap = overflow::lines_fitting(box_h.max(r.size), r.size) + 1;
+        overflow::ellipsize_in_box(text, box_h, r.size, |candidate| {
+            wrapped_rows_capped(e, r, candidate, box_w, cap)
+        })
+    };
+    atlas
+        .ellipsis
+        .put(region, text, box_w, box_h, &font, display.clone());
+    display
+}
+
+/// The drawn line's origin for the EditBox text-UI overlays: the line's x0 under `justifyH` (where
+/// the engine's advance-derived caret/selection x-offsets are measured from), plus the single-line
+/// cell's top and height — the same face/size resolution, step law, and justify math as
+/// [`super::layout_text_quads`], so the overlays sit exactly on the glyphs. Single-line by
+/// construction (the EditBox law; a multiLine box would need the wrapped-line walk).
+pub(crate) fn line_origin(
+    e: &mut TextEngine,
+    drawn: &str,
+    rect: Rect,
+    justify: Justify,
+    font: FontSpec,
+) -> (f32, f32, f32) {
+    let r = resolve(e, &font);
+    e.ensure_metrics(r.face, r.ppem, drawn);
+    let e = &*e;
+    // The line origin under justifyH (LEFT needs no width measure — the chat case).
+    let x0 = match justify.h {
+        JustifyH::Left => rect.min.x,
+        JustifyH::Center | JustifyH::Right => {
+            let w = measure_line_width(e, r, r.step_extra, drawn);
+            if matches!(justify.h, JustifyH::Center) {
+                rect.min.x + ((rect.width() - w) * 0.5).max(0.0)
+            } else {
+                rect.max.x - w
+            }
+        }
+    };
+    // The single-line block's v_offset — [`super::layout_text_quads`]'s law with block_h = 1 line,
+    // through the same ONE vertical snap ([`super::snap_block_top`]) so the caret/selection cell
+    // sits exactly on the drawn glyphs.
+    let top = if rect.height() > f32::EPSILON {
+        let v_offset = match justify.v {
+            JustifyV::Top => 0.0,
+            JustifyV::Middle => (rect.height() - r.size) * 0.5,
+            JustifyV::Bottom => rect.height() - r.size,
+        };
+        super::snap_block_top(rect.min.y + v_offset)
+    } else {
+        rect.min.y
+    };
+    (x0, top, r.size)
+}
+
+/// The EditBox advance-table answer ([`benilla_ui::script::UiScript::set_editbox_advances`]'s
+/// payload): per-BYTE cumulative laid-out widths of `text` under the exact step law
+/// [`measure_line_width`] uses — len+1 entries, `[0] = 0`, each character's full step landing on
+/// its END boundary and its interior (continuation) bytes holding the lead's value, so a mid-char
+/// index degrades to the char's start and char-boundary lookups are exact.
+///
+/// **Indexed by the box's RAW byte, measured over what is DRAWN** (decision 1075). The box stores
+/// the escaped string and draws only the visible one, so every `|c…`/`|r`/`|H…|h`/`|T…|t` byte
+/// costs zero width: [`crate::ui_text::markup::visible_map`] carries each drawn byte back to its
+/// raw offset, and the forward-fill below hands every escape byte the previous boundary's width.
+/// Measuring the raw string instead is what parked the caret half a chat bar right of a
+/// shift-clicked item link.
+///
+/// The old shaped-buffer walk carried a stated approximation — the whole drawn string was shaped as
+/// one buffer while the draw shaped each color run separately, so kerning across a color boundary
+/// could differ by a fraction of a pixel. Stepping per character removes it: there is no buffer and
+/// no kerning anywhere in the law, so this table and the drawn pen are the same arithmetic.
+pub(crate) fn line_advances(e: &mut TextEngine, text: &str, font: FontSpec) -> Vec<f32> {
+    let mut cum = vec![0.0f32; text.len() + 1];
+    if text.is_empty() {
+        return cum;
+    }
+    let (drawn, bounds) = crate::ui_text::markup::visible_map(text);
+    if drawn.is_empty() {
+        return cum; // pure markup draws nothing — every boundary sits at x = 0
+    }
+    let r = resolve(e, &font);
+    e.ensure_metrics(r.face, r.ppem, &drawn);
+    let e = &*e;
+    let dpi = e.dpi();
+
+    let mut written = vec![false; text.len() + 1];
+    written[0] = true;
+    let mut x = 0.0f32;
+    for (off, ch) in drawn.char_indices() {
+        if let Some(c) = e.char_cell(r.face, r.ppem, ch) {
+            for g in &c.glyphs {
+                x += client_step(g.advance, r.step_extra, dpi);
+            }
+        }
+        // This character's end boundary in DRAWN bytes → the RAW boundary it sits on.
+        let end = bounds[(off + ch.len_utf8()).min(drawn.len())];
+        cum[end] = x;
+        written[end] = true;
+    }
+    // Forward-fill the unwritten slots (cluster interiors, markup bytes): each carries the
+    // previous boundary's value.
+    for i in 1..cum.len() {
+        if !written[i] {
+            cum[i] = cum[i - 1];
+        }
+    }
+    cum
+}
+
+/// The multiline-EditBox row answer (the 2-D half of
+/// [`benilla_ui::script::UiScript::set_editbox_advances`]'s payload): the byte offset where each
+/// wrapped display row of `text` begins at `wrap_width` — the exact [`wrap_line`] pass the render
+/// wraps with, so the engine's `(row, x)` caret/click law lands on the drawn rows — plus the row
+/// pitch (the font em, the same `N·S` block law [`measure_text`] heights with). Row starts are
+/// reconstructed by walking the source string past each wrapped row's verbatim text and the
+/// separator the break swallowed (wrap keeps inter-word whitespace verbatim and drops only the
+/// trailing separator, so the walk is exact) — in DRAWN bytes, mapped back to RAW ones, since the
+/// rows index the same raw buffer [`line_advances`] does (decision 1075). Never empty (`[0]` for
+/// empty text).
+pub(crate) fn line_rows(
+    e: &mut TextEngine,
+    text: &str,
+    wrap_width: f32,
+    font: FontSpec,
+) -> (Vec<usize>, f32) {
+    let r = resolve(e, &font);
+    e.ensure_metrics(r.face, r.ppem, text);
+    let e = &*e;
+    let mut rows = Vec::new();
+    let mut base = 0usize; // byte offset of the current '\n' segment within `text`
+    for seg in text.split('\n') {
+        let lines = parse_markup(seg, [1.0, 1.0, 1.0, 1.0]);
+        let sub: Vec<Vec<ColorRun>> = if wrap_width > WRAP_MIN_WIDTH {
+            lines
+                .iter()
+                .flat_map(|line| wrap_line(e, r, line, wrap_width))
+                .collect()
+        } else {
+            lines
+        };
+        segment_row_starts(seg, &sub, base, &mut rows);
+        base += seg.len() + 1; // + the '\n' itself (swallowed by the split)
+    }
+    if rows.is_empty() {
+        rows.push(0);
+    }
+    (rows, r.size)
+}
+
+/// [`line_rows`]'s reconstruction walk for one `\n` segment: push the byte start of each wrapped
+/// sub-line of `seg` (offset by `base`, `seg`'s position in the full string) into `rows`. Wrap
+/// keeps inter-word whitespace verbatim inside a row and drops only the separator a break swallows,
+/// so each subsequent row starts past the previous row's bytes plus any whitespace (a force-broken
+/// word swallowed none — the skip loop stops at its first byte). A blank segment still occupies one
+/// row.
+fn segment_row_starts(seg: &str, sub: &[Vec<ColorRun>], base: usize, rows: &mut Vec<usize>) {
+    if sub.is_empty() {
+        rows.push(base);
+        return;
+    }
+    // A wrapped row is made of DRAWN text (the markup is gone by then) while a row start must be a
+    // RAW byte — the offset space the box's cursor and [`line_advances`] both live in. So the walk
+    // runs in drawn bytes and maps each start back (decision 1075).
+    let (drawn, bounds) = crate::ui_text::markup::visible_map(seg);
+    let mut p = 0usize; // byte cursor within `drawn`
+    for (j, line) in sub.iter().enumerate() {
+        if j > 0 {
+            while let Some(c) = drawn[p.min(drawn.len())..].chars().next() {
+                if c.is_whitespace() {
+                    p += c.len_utf8();
+                } else {
+                    break;
+                }
+            }
+        }
+        rows.push(base + bounds[p.min(drawn.len())]);
+        p += line.iter().map(|r| r.text.len()).sum::<usize>();
+    }
+}
+
+#[cfg(test)]
+mod row_start_tests {
+    use super::*;
+
+    fn runs(texts: &[&str]) -> Vec<Vec<ColorRun>> {
+        texts
+            .iter()
+            .map(|t| {
+                vec![ColorRun {
+                    text: (*t).to_string(),
+                    color: [1.0; 4],
+                    link: None,
+                }]
+            })
+            .collect()
+    }
+
+    fn starts(seg: &str, sub: &[Vec<ColorRun>], base: usize) -> Vec<usize> {
+        let mut out = Vec::new();
+        segment_row_starts(seg, sub, base, &mut out);
+        out
+    }
+
+    #[test]
+    fn a_word_break_swallows_its_separator() {
+        assert_eq!(starts("hello world", &runs(&["hello", "world"]), 0), [0, 6]);
+    }
+
+    #[test]
+    fn a_force_broken_word_swallows_nothing() {
+        assert_eq!(
+            starts(
+                "supercalifragilistic",
+                &runs(&["supercali", "fragilistic"]),
+                0
+            ),
+            [0, 9]
+        );
+    }
+
+    #[test]
+    fn a_double_space_separator_is_swallowed_whole() {
+        assert_eq!(starts("one  two", &runs(&["one", "two"]), 0), [0, 5]);
+    }
+
+    #[test]
+    fn inner_whitespace_stays_verbatim_inside_a_row() {
+        assert_eq!(
+            starts("a b  c d", &runs(&["a b  c", "d"]), 0),
+            [0, 7],
+            "only the BREAK's separator is dropped"
+        );
+    }
+
+    #[test]
+    fn a_blank_segment_still_occupies_a_row_and_base_offsets() {
+        assert_eq!(starts("", &[], 12), [12]);
+        assert_eq!(starts("hi there", &runs(&["hi", "there"]), 100), [100, 103]);
+    }
+}
diff --git a/crates/benilla-app/src/ui_text/layout/mod.rs b/crates/benilla-app/src/ui_text/layout/mod.rs
index 9c1c80e8..71213ae6 100644
--- a/crates/benilla-app/src/ui_text/layout/mod.rs
+++ b/crates/benilla-app/src/ui_text/layout/mod.rs
@@ -1,25 +1,39 @@
+//! **The emit pass** — a laid-out string into [`UiQuad`]s.
+//!
+//! Its other half is [`measure`], which decides widths, wraps and fits. The two used to compute in
+//! different spaces with a rescale between them; since decision 1342 the raster size is an exact
+//! integer device-pixel size, so both walk the same per-character table and the pen here and the
+//! sum there are the same arithmetic. See [`super::engine`] for why that matters more than it
+//! sounds like it should.
+
 use bevy::math::Rect;
 use bevy::prelude::*;
-use cosmic_text::{Attrs, Buffer, Family, Metrics, Shaping, Wrap};
 
 use benilla_ui::script::{JustifyH, JustifyV, Outline};
 
 use crate::ui_pass::{UiQuad, UvRect};
 
-use super::atlas::{GlyphKey, TextMetrics, UiFontAtlas};
-use super::markup::{parse_markup, ColorRun};
-use super::DEFAULT_FONT_SIZE;
+use super::engine::TextEngine;
+use super::markup::{fontstring_lines, ColorRun};
 
+mod measure;
 mod overflow;
 mod wrap;
-use wrap::{greedy_pack, tokenize_words};
+
+/// The width law itself, for the differential test in [`super::engine`] that pins it against
+/// shaping whole strings. Not a production seam — every caller goes through [`measure_text`].
+#[cfg(test)]
+pub(super) use measure::measure_line_width_for_test;
+pub(crate) use measure::{
+    ellipsize_to_fit, line_advances, line_origin, line_rows, measure_text, measure_wrapped_rows,
+};
 
 /// The smallest resolved rect width (px) treated as a **pinned wrap constraint**. A `FontString`
 /// with no explicit `<Size>`/`setAllPoints`/opposing anchor resolves through [`crate::ui_text`]'s
 /// caller to a near-zero-width rect (the single-point case — the engine's layout derives
 /// `left == right` from the pinned center, see `benilla-ui`'s `layout` resolver); such a rect is
-/// "no width constraint" and text lays out on one line from its justify point, never wrapped. Only a
-/// rect wider than this engages word wrap. No shipped wrappable FontString is this narrow (the
+/// "no width constraint" and text lays out on one line from its justify point, never wrapped. Only
+/// a rect wider than this engages word wrap. No shipped wrappable FontString is this narrow (the
 /// narrowest, a merchant row's price field, is tens of px); the degenerate titles are ~0.
 const WRAP_MIN_WIDTH: f32 = 1.0;
 
@@ -29,12 +43,8 @@ const WRAP_MIN_WIDTH: f32 = 1.0;
 /// line-stack stop ([`overflow::lines_allowed`]) and the ellipsis gate ([`ellipsize_to_fit`]).
 const HEIGHT_LIMIT_MIN: f32 = 1.0;
 
-// ─────────────────────────────────────────────────────────────────────────────────────────────
-// Layout — ported from probes/text-glyph/src/layout.rs, retargeted to the real `UiQuad`
-// ─────────────────────────────────────────────────────────────────────────────────────────────
-
-/// A `FontString`'s two justification axes (`justifyH`/`justifyV`), bundled — they arrive
-/// together from the region's paint and travel together into [`layout_text_quads`].
+/// A `FontString`'s two justification axes (`justifyH`/`justifyV`), bundled — they arrive together
+/// from the region's paint and travel together into [`layout_text_quads`].
 #[derive(Clone, Copy)]
 pub(crate) struct Justify {
     pub h: JustifyH,
@@ -43,21 +53,19 @@ pub(crate) struct Justify {
 
 /// The resolved face + size a `FontString` draws with (from its font object / `SetFont`) — bundled
 /// so [`layout_text_quads`] stays within one argument budget. `None`s fall back to Friz Quadrata at
-/// [`DEFAULT_FONT_SIZE`].
+/// [`super::DEFAULT_FONT_SIZE`].
 #[derive(Clone, Copy)]
 pub(crate) struct FontSpec<'a> {
     pub path: Option<&'a str>,
+    /// The **logical** height, seam already folded in ([`super::drawn_px`]). The engine rounds it
+    /// to whole device pixels ([`TextEngine::ppem`]) — there is no "between sizes" any more.
     pub height: Option<f32>,
     /// The font's TRUE glyph outline ([`Outline::None`] for the common case). It selects the
-    /// baked composite-cell variant (ring+fill in one texture — the fallback is the legacy halo
-    /// stamps) AND, for THICK only, the step law's extra `+1` (`GlyphStepBase` 0x5ca2b0 biases
-    /// solely under the THICK flag — wow-re `outline-bake-tint.md`), so [`measure_text`] must see
-    /// it too: a THICK outline changes measured/wrapped width.
+    /// composite cell variant (ring+fill in one texture) AND, for THICK only, the step law's extra
+    /// `+1` (`GlyphStepBase` 0x5ca2b0 biases solely under the THICK flag — wow-re
+    /// `outline-bake-tint.md`), so [`measure_text`] must see it too: a THICK outline changes
+    /// measured/wrapped width.
     pub outline: Outline,
-    /// Paint the outline halo stamps. `false` only for the drop-shadow pass, which must lay out
-    /// IDENTICALLY to its (possibly outlined) fill but never paints halos — an outlined shadow
-    /// would be a muddy black blob.
-    pub paint_halo: bool,
     /// The write-on reveal (`SetAlphaGradient` — per-FontString paint state, like `outline`):
     /// [`layout_text_quads`] multiplies each glyph's alpha by the ramp at its character position.
     /// Riding the spec means the drop-shadow pass (`..spec`) inherits it for free — a revealing
@@ -76,25 +84,25 @@ pub(crate) struct FontSpec<'a> {
 /// **Applied in PHYSICAL device pixels** (the ppem the face is actually rasterized at), then divided
 /// back to logical — because that is where the real client's law lives: `FT_advance >> 6` floors the
 /// device-pixel advance and the `+1`/`+1` biases are whole *device* pixels. Flooring in logical px
-/// instead (the pre-fix shortcut) over-tracks on any window where `scale ≠ 1`: at retina `scale = 2`
-/// a 6.385px-logical (12.77px-physical) ARIALN digit steps `(⌊12.77⌋+2)/2 = 7.0px`, not the logical
+/// instead (the pre-fix shortcut) over-tracks on any window where `dpi ≠ 1`: at retina a
+/// 6.385px-logical (12.77px-physical) ARIALN digit steps `(⌊12.77⌋+2)/2 = 7.0px`, not the logical
 /// `⌊6.385⌋+2 = 8.0px` — a full logical pixel of extra gap *per digit*, proportionally huge on small
-/// outlined numbers (bag counts, money) and the cause of their "digits too wide apart" look. The two
-/// agree only at `scale = 1` (the 768-tall reference), so the divergence hid until a retina look-pass.
+/// outlined numbers (bag counts, money) and the cause of their "digits too wide apart" look.
 ///
 /// Deliberate v1 simplification (module doc): kerning is dropped entirely (the client applies only
-/// *negative* pair kerns and rounds the sum — at UI sizes the rounded contribution is almost always 0).
-fn client_step(raw_physical_advance: f32, step_extra: f32, scale: f32) -> f32 {
-    (raw_physical_advance.floor() + step_extra) / scale
+/// *negative* pair kerns and rounds the sum — at UI sizes the rounded contribution is almost always
+/// 0).
+fn client_step(raw_physical_advance: f32, step_extra: f32, dpi: f32) -> f32 {
+    (raw_physical_advance.floor() + step_extra) / dpi
 }
 
-/// The step-law bias for a font's outline flag: the base `+1` for everyone, and one more `+1`
-/// for **THICK only** — `GlyphStepBase 0x5ca2b0` adds its extra pixel solely under the THICK
-/// font flag (wow-re `outline-bake-tint.md`, §5 + difftests, commit `f80ce699`, CORRECTING the
-/// earlier "any outline" reading this module shipped with: a NORMAL-outlined font steps exactly
-/// like a plain one, its 1px ring riding the base `+1` tracking; mirroring the cell pad onto the
-/// advance was the flagged trap). NumberFontNormal digits (money, counts, hotkeys) are the
-/// visible beneficiaries: one less pixel of gap per glyph.
+/// The step-law bias for a font's outline flag: the base `+1` for everyone, and one more `+1` for
+/// **THICK only** — `GlyphStepBase 0x5ca2b0` adds its extra pixel solely under the THICK font flag
+/// (wow-re `outline-bake-tint.md`, §5 + difftests, commit `f80ce699`, CORRECTING the earlier "any
+/// outline" reading this module shipped with: a NORMAL-outlined font steps exactly like a plain
+/// one, its 1px ring riding the base `+1` tracking; mirroring the cell pad onto the advance was the
+/// flagged trap). NumberFontNormal digits (money, counts, hotkeys) are the visible beneficiaries:
+/// one less pixel of gap per glyph.
 fn step_extra_of(outline: Outline) -> f32 {
     match outline {
         Outline::Thick => 2.0,
@@ -102,592 +110,39 @@ fn step_extra_of(outline: Outline) -> f32 {
     }
 }
 
-/// One line's total laid-out width (logical px) at `font_size` under the client's step law
-/// ([`client_step`]): the sum of per-character steps, read from the bake-time table
-/// ([`TextMetrics::char_step`]). This is the client's `GetTextWidth` (a sum of `ComputeStep`s), so
-/// measure == render == the real client's width. Empty text is zero-width.
-///
-/// **No shaper, and that is the point.** The client's law has no kerning term and no neighbour
-/// term, so a string's width is a pure function of its characters, face, size and outline — which
-/// is what lets the lookup be precomputed, and therefore what lets this answer from *inside* a Lua
-/// call ([`benilla_ui::script::TextMeasure`]), where a `&mut FontSystem` could never reach. Every
-/// measurement in the app now runs through this one function, so the synchronous answer and the
-/// batch answer cannot be different numbers.
-///
-/// A character with no baked glyph contributes 0 — see [`TextMetrics::char_step`] for the single
-/// narrow place that differs from the render pen.
-#[cfg(test)]
-pub(crate) fn measure_line_width_for_test(
-    metrics: &TextMetrics,
-    family: &str,
-    font_size: f32,
-    step_extra: f32,
-    text: &str,
-) -> f32 {
-    measure_line_width(metrics, family, font_size, step_extra, text)
-}
-
-fn measure_line_width(
-    metrics: &TextMetrics,
-    family: &str,
-    font_size: f32,
-    step_extra: f32,
-    text: &str,
-) -> f32 {
-    // The table's steps are PHYSICAL px (the resolution the atlas baked at); the divide back to
-    // logical is [`client_step`]'s, applied per glyph because the bias is per glyph.
-    text.chars()
-        .filter_map(|c| metrics.char_step(family, font_size, c))
-        .map(|s| (s.floor_sum + step_extra * f32::from(s.glyphs)) / metrics.scale)
-        .sum()
-}
-
-/// The EditBox advance-table answer ([`benilla_ui::script::UiScript::set_editbox_advances`]'s
-/// payload): per-BYTE cumulative laid-out widths of `text` under the exact shaping + step law
-/// [`measure_line_width`] uses — len+1 entries, `[0] = 0`, each char's full step landing on its
-/// END boundary and its interior (continuation) bytes holding the lead's value, so a mid-char
-/// index degrades to the char's start and char-boundary lookups are exact. Single-line is the
-/// EditBox law; a `\n`-bearing (multiLine) string accumulates per line via the run's line index
-/// (x resets never — the table stays monotonic, which is all the hit-test needs).
-///
-/// **Indexed by the box's RAW byte, measured over what is DRAWN** (decision 1075). The box stores
-/// the escaped string and draws only the visible one, so every `|c…`/`|r`/`|H…|h`/`|T…|t` byte
-/// costs zero width: [`crate::ui_text::markup::visible_map`] carries each drawn byte back to its
-/// raw offset, and the forward-fill below hands every escape byte the previous boundary's width.
-/// Measuring the raw string instead is what parked the caret half a chat bar right of a
-/// shift-clicked item link.
-///
-/// **Stated approximation:** the drawn string is shaped as ONE buffer, while the draw shapes each
-/// color run separately — so kerning across a color boundary can differ by a fraction of a pixel.
-/// (This predates 1075: the raw string was shaped as one buffer too.)
-pub(crate) fn line_advances(atlas: &mut UiFontAtlas, text: &str, font: FontSpec) -> Vec<f32> {
-    let mut cum = vec![0.0f32; text.len() + 1];
-    if text.is_empty() {
-        return cum;
-    }
-    let (drawn, bounds) = crate::ui_text::markup::visible_map(text);
-    if drawn.is_empty() {
-        return cum; // pure markup draws nothing — every boundary sits at x = 0
-    }
-    let family = atlas.metrics.family_for(font.path);
-    let attrs = Attrs::new().family(Family::Name(&family));
-    let font_size = atlas
-        .metrics
-        .snap_for(&family, font.height.unwrap_or(DEFAULT_FONT_SIZE));
-    let scale = atlas.metrics.scale;
-    let step_extra = step_extra_of(font.outline);
-    // Byte offset of each buffer line ('\n'-split) within the DRAWN string — glyph cluster ranges
-    // are line-relative, and the map below is indexed in drawn bytes.
-    let mut line_starts = vec![0usize];
-    for (i, b) in drawn.bytes().enumerate() {
-        if b == b'\n' {
-            line_starts.push(i + 1);
-        }
-    }
-    let phys = font_size * scale;
-    let mut written = vec![false; text.len() + 1];
-    written[0] = true;
-    {
-        let font_system = &mut atlas.font_system;
-        let mut buffer = Buffer::new(font_system, Metrics::new(phys, phys));
-        buffer.set_wrap(font_system, Wrap::None);
-        buffer.set_text(font_system, &drawn, &attrs, Shaping::Advanced, None);
-        buffer.shape_until_scroll(font_system, false);
-        let mut x = 0.0f32;
-        for run in buffer.layout_runs() {
-            let base = line_starts.get(run.line_i).copied().unwrap_or(0);
-            for g in run.glyphs {
-                let key: GlyphKey = (g.font_id, g.glyph_id, font_size.to_bits(), 0);
-                let adv = atlas.glyphs.get(&key).map(|i| i.advance).unwrap_or(g.w);
-                x += client_step(adv, step_extra, scale);
-                // The glyph's end boundary in DRAWN bytes → the RAW boundary it sits on.
-                let end = bounds[(base + g.end).min(drawn.len())];
-                cum[end] = x;
-                written[end] = true;
-            }
-        }
-    }
-    // Forward-fill the unwritten slots (cluster interiors, separators the shaper consumed):
-    // each carries the previous boundary's value.
-    for i in 1..cum.len() {
-        if !written[i] {
-            cum[i] = cum[i - 1];
-        }
-    }
-    // Into DRAWN space ([`drawn_k`]): the caret/click/selection geometry these feed must land on
-    // the glyphs the 0581 rescale actually put on screen, not on the pre-rescale shaping.
-    let k = drawn_k(font.height, font_size);
-    if k != 1.0 {
-        for v in &mut cum {
-            *v *= k;
-        }
-    }
-    cum
-}
-
-/// The exact-height rescale factor the DRAW applies (decision 0581, [`layout_text_quads_inner`]'s
-/// tail): a requested height between baked sizes shapes at the snapped `font_size` and scales the
-/// finished quads by `req / font_size` about the justify anchor. Every measure that hands geometry
-/// back onto the drawn glyphs — the editbox advance table, the caret cell, the row pitch — must
-/// return values in that DRAWN space, so they apply the same factor. Identity for a baked size and
-/// for `height: None` (the draw's rescale gate is `font.height`-Some too). This stopped being a
-/// theoretical case when the era-shaped windows started riding `SetScale` (0950): their frame
-/// scale multiplies into every drawn height, landing between bakes — the options search box's
-/// caret sat 28% past its own text (director, 2026-08-05; decision 0989).
-fn drawn_k(font_height: Option<f32>, font_size: f32) -> f32 {
-    match font_height {
-        Some(req) if ((req / font_size) - 1.0).abs() > 1e-3 => req / font_size,
-        _ => 1.0,
-    }
-}
-
-/// A DRAWN-space box, in the SNAPPED space every fit decision is made in — `(width, height)`, both
-/// divided by [`drawn_k`].
-///
-/// The three seams that measure a box against glyphs — [`measure_text`]'s wrap, [`ellipsize_to_fit`]
-/// and the emit pass's wrap + line stack — all shape at the nearest baked size and rescale by `k`
-/// at the end, while the rect they are handed is in drawn px. They must convert it the same way or
-/// they decide different breaks over the same string: the emit pass keeping the raw rect while
-/// measure moved into drawn space (1296) is what made an auto-sized FontString wrap inside its own
-/// measured width and lose its tail to the line stack, with no ellipsis (decision 1339). One body,
-/// so the conversion cannot drift back apart, and so the test that pins it binds this code and not
-/// a copy of it (`measure_fits_render`).
-///
-/// Identity at every baked size — all on-ladder UI text takes an unchanged path.
-fn fit_box(rect: Rect, font_height: Option<f32>, font_size: f32) -> (f32, f32) {
-    let k = drawn_k(font_height, font_size);
-    (rect.width() / k, rect.height() / k)
-}
-
-/// The multiline-EditBox row answer (the 2-D half of
-/// [`benilla_ui::script::UiScript::set_editbox_advances`]'s payload): the byte offset where each
-/// wrapped display row of `text` begins at `wrap_width` — the exact [`wrap_line`] pass the render
-/// wraps with, so the engine's `(row, x)` caret/click law lands on the drawn rows — plus the row
-/// pitch (the snapped font em, the same `N·S` block law [`measure_text`] heights with). Row
-/// starts are reconstructed by walking the source string past each wrapped row's verbatim text
-/// and the separator the break swallowed (wrap keeps inter-word whitespace verbatim and drops
-/// only the trailing separator, so the walk is exact) — in DRAWN bytes, mapped back to RAW ones,
-/// since the rows index the same raw buffer [`line_advances`] does (decision 1075). Never empty
-/// (`[0]` for empty text).
-pub(crate) fn line_rows(
-    atlas: &mut UiFontAtlas,
-    text: &str,
-    wrap_width: f32,
-    font: FontSpec,
-) -> (Vec<usize>, f32) {
-    let family = atlas.metrics.family_for(font.path);
-    let font_size = atlas
-        .metrics
-        .snap_for(&family, font.height.unwrap_or(DEFAULT_FONT_SIZE));
-    let step_extra = step_extra_of(font.outline);
-    let mut rows = Vec::new();
-    let mut base = 0usize; // byte offset of the current '\n' segment within `text`
-    for seg in text.split('\n') {
-        let lines = parse_markup(seg, [1.0, 1.0, 1.0, 1.0]);
-        let sub: Vec<Vec<ColorRun>> = if wrap_width > WRAP_MIN_WIDTH {
-            lines
-                .iter()
-                .flat_map(|line| {
-                    wrap_line(
-                        &atlas.metrics,
-                        &family,
-                        font_size,
-                        step_extra,
-                        line,
-                        wrap_width,
-                    )
-                })
-                .collect()
-        } else {
-            lines
-        };
-        segment_row_starts(seg, &sub, base, &mut rows);
-        base += seg.len() + 1; // + the '\n' itself (swallowed by the split)
-    }
-    if rows.is_empty() {
-        rows.push(0);
-    }
-    // Row PITCH in drawn space ([`drawn_k`] — vertical distances rescale with the quads). The row
-    // STARTS stay: both this wrap and the draw's break at unscaled steps against the same width,
-    // so the byte boundaries already agree.
-    (rows, font_size * drawn_k(font.height, font_size))
-}
-
-/// [`line_rows`]'s reconstruction walk for one `\n` segment: push the byte start of each wrapped
-/// sub-line of `seg` (offset by `base`, `seg`'s position in the full string) into `rows`. Wrap
-/// keeps inter-word whitespace verbatim inside a row and drops only the separator a break
-/// swallows, so each subsequent row starts past the previous row's bytes plus any whitespace
-/// (a force-broken word swallowed none — the skip loop stops at its first byte). A blank
-/// segment still occupies one row.
-fn segment_row_starts(seg: &str, sub: &[Vec<ColorRun>], base: usize, rows: &mut Vec<usize>) {
-    if sub.is_empty() {
-        rows.push(base);
-        return;
-    }
-    // A wrapped row is made of DRAWN text (the markup is gone by then) while a row start must be a
-    // RAW byte — the offset space the box's cursor and [`line_advances`] both live in. So the walk
-    // runs in drawn bytes and maps each start back (decision 1075).
-    let (drawn, bounds) = crate::ui_text::markup::visible_map(seg);
-    let mut p = 0usize; // byte cursor within `drawn`
-    for (j, line) in sub.iter().enumerate() {
-        if j > 0 {
-            while let Some(c) = drawn[p.min(drawn.len())..].chars().next() {
-                if c.is_whitespace() {
-                    p += c.len_utf8();
-                } else {
-                    break;
-                }
-            }
-        }
-        rows.push(base + bounds[p.min(drawn.len())]);
-        p += line.iter().map(|r| r.text.len()).sum::<usize>();
-    }
-}
-
-/// Greedy word-boundary wrap of one markup line (a `\n`-delimited run sequence) into sub-lines that
-/// each fit within `max_width` px.
-///
-/// The break law is the byte-verified regime-2 wrap (`system/ui/scratch/fontstring-overflow.md`,
-/// the `0x5c6c50`/`0x5c7780` kernel): break at the last break opportunity; a word with none that
-/// overflows alone force-breaks at the last fitting glyph — a rendered line never exceeds the wrap
-/// width. Inter-word whitespace is preserved verbatim (a double space after a period stays a
-/// double space — see [`tokenize_words`]), and only the trailing separator at a line break drops.
-/// Colors are preserved per word (the separating whitespace attaches to the preceding run, since it
-/// draws no ink). **Remaining approximation:** break opportunities are ASCII/Unicode whitespace
-/// only — the kernel's kinsoku (CJK) opportunity classes and the `nonspacewrap` flag (ui `0x1000`:
-/// mid-word breaks become opportunities even when a space exists) are unmodeled; no shipped
-/// FontString renders CJK, and the one `nonspacewrap` consumer (MinimapZoneText) sits in a
-/// one-line box where opportunity choice can't change the outcome.
-fn wrap_line(
-    metrics: &TextMetrics,
-    family: &str,
-    font_size: f32,
-    step_extra: f32,
-    line: &[ColorRun],
-    max_width: f32,
-) -> Vec<Vec<ColorRun>> {
-    // Flatten the line's color runs into words, each tagged with its run color and its verbatim
-    // inter-word separator (so Blizzard's double spaces survive the wrap).
-    let words = tokenize_words(line);
-    if words.is_empty() {
-        // A blank line (only whitespace / empty) still occupies a row — keep it as one empty line.
-        return vec![line.to_vec()];
-    }
-
-    greedy_pack(words, max_width, |t| {
-        measure_line_width(metrics, family, font_size, step_extra, t)
-    })
-}
-
-/// Lays out `text` top-left within `rect` (screen px, **y-down** — the same space
-/// [`crate::ui_script::extract::drive_script`] already flips frame rects into) and returns one [`UiQuad`] per
-/// non-blank glyph, textured with [`UiFontAtlas`]'s baked atlas. `z_key` is shared by every glyph — the
-/// owning `FontString` region's own [`crate::ui_pass`]-order key (regions already sort after their
-/// frame and by draw layer/decl, so reusing it keeps text in the client's total order with no extra
-/// bookkeeping; ties break by push order, i.e. left-to-right/top-to-bottom, which is what a stable sort
-/// preserves). `base_color` is the region's own color (`SetVertexColor`, default opaque white);
-/// `|cAARRGGBB`/`|r` runs in `text` override it per the markup rules above.
-///
-/// Chars outside [`crate::ui_text`]'s default charset (no baked glyph) are silently skipped — no
-/// fallback glyph in v1.
-///
-/// `justify_h` positions each line's runs horizontally *within* `rect`: `Left` flushes to
-/// `rect.min.x` (the v1 default before justify existed), `Center` centers the line's measured width,
-/// `Right` flushes to `rect.max.x`. `justify_v` positions the line block vertically the same way
-/// (default `Middle`, the client's FontString default; degenerate zero-height rects keep top).
-/// Each line is measured once (a first pass laying glyphs at a zero line-origin), then shifted by the
-/// justification offset — so kerned advances and the shift stay consistent.
-/// Measure `text`'s laid-out size — width of the widest line, height of all (wrapped) lines — at
-/// the resolved face/size, wrapping at `wrap_width` when given (the same [`wrap_line`] pass
-/// rendering uses, so measure == render). The engine's measure round-trip
-/// ([`benilla_ui::script::UiScript::fontstrings_needing_measure`]) sizes height-less FontStrings
-/// with this — the real client's layout asks its font engine for string metrics the same way.
-pub(crate) fn measure_text(
-    metrics: &TextMetrics,
-    text: &str,
-    wrap_width: Option<f32>,
-    font: FontSpec,
-) -> (f32, f32) {
-    let lines = parse_markup(text, [1.0, 1.0, 1.0, 1.0]);
-    let family = metrics.family_for(font.path);
-    let font_size = metrics.snap_for(&family, font.height.unwrap_or(DEFAULT_FONT_SIZE));
-    // The exact-height rescale the DRAW applies ([`drawn_k`]): everything here is computed in
-    // SNAPPED space (the size the step table is keyed by) and the draw multiplies the finished
-    // quads by `k`, so a drawn-space width enters at `/k` and the answer leaves at `×k`. Without
-    // it this reports `drawn/k` and measure and render disagree by exactly the rescale — decision
-    // 0989 left that as a named residual ("fold into `drawn_k` if a fit ever visibly breaks"), and
-    // it broke: an off-ladder request whose nearest bake sits ABOVE it measures wider than it
-    // draws, so the height-gated ellipsis eats text that fits ("Spellbook" → "Spellbo...", B209);
-    // the other sign spills past the backdrop the measure sized (B231). Identity at every baked
-    // size, so all on-ladder UI text is bit-unchanged.
-    let k = drawn_k(font.height, font_size);
-    // The step-law bias ([`client_step`]): measure MUST see the same outline-biased steps the
-    // render pass lays, or wrap points and measured widths drift from what's drawn.
-    let step_extra = step_extra_of(font.outline);
-    let render_lines: Vec<Vec<ColorRun>> = match wrap_width.map(|w| w / k) {
-        Some(w) if w > WRAP_MIN_WIDTH => lines
-            .iter()
-            .flat_map(|line| wrap_line(metrics, &family, font_size, step_extra, line, w))
-            .collect(),
-        _ => lines,
-    };
-    let mut max_w = 0.0f32;
-    for line in &render_lines {
-        let mut w = 0.0f32;
-        for run in line {
-            if !run.text.is_empty() {
-                w += measure_line_width(metrics, &family, font_size, step_extra, &run.text);
-            }
-        }
-        max_w = max_w.max(w);
-    }
-    // A hair of headroom: the render pass re-wraps inside this same width, and a line that fits
-    // EXACTLY can lose the comparison to float noise (the title "Marshal McBride" wrapped inside
-    // its own measured width). One pixel is invisible and keeps measure ⊇ render.
-    // Height: N lines at the client's intrinsic pitch — the font em, NO outline pad (the byte
-    // law: `font_textblock_height 0x5c2070` = N·S + (N−1)·gap, spacing 0 for all shipped UI;
-    // the +2r lives only in the atlas CELL, never the block math —
-    // `fontstring-vertical-placement.md`). An outlined line's ring pokes past this height by
-    // design, exactly as it does in the client.
-    //
-    // Both leave in DRAWN space (`×k`, above) — the headroom pixel is added after, because it is
-    // a drawn-space pixel and must not itself be rescaled.
-    (
-        (max_w * k).ceil() + 1.0,
-        render_lines.len() as f32 * font_size * k,
-    )
-}
-
-/// How many display rows `text` wraps into at `wrap_width` — the message-line half of the measure
-/// round-trip ([`benilla_ui::script::UiScript::message_lines_needing_measure`]): the engine's
-/// ScrollingMessageFrame allocates `rows × font-height` per ring line from this. Runs the exact
-/// [`wrap_line`] pass rendering uses (same step law, same outline bias), so the band height always
-/// equals the drawn block height. Never 0 (empty text is one blank row).
-pub(crate) fn measure_wrapped_rows(
-    atlas: &mut UiFontAtlas,
-    text: &str,
-    wrap_width: f32,
-    font: FontSpec,
-) -> u16 {
-    let family = atlas.metrics.family_for(font.path);
-    // Per-family size snap (the rebase-landed law): rows must count at the exact size the render
-    // pass bakes this face at, or band heights drift from the drawn block.
-    let font_size = atlas
-        .metrics
-        .snap_for(&family, font.height.unwrap_or(DEFAULT_FONT_SIZE));
-    let step_extra = step_extra_of(font.outline);
-    // Into snapped space for the wrap walk ([`drawn_k`] — the caller's width is drawn px, the step
-    // table is keyed by the snapped size); the row COUNT is scale-free, so nothing converts back.
-    let wrap_width = wrap_width / drawn_k(font.height, font_size);
-    let rows = wrapped_rows(
-        &atlas.metrics,
-        &family,
-        font_size,
-        step_extra,
-        text,
-        wrap_width,
-    );
-    rows.clamp(1, usize::from(u16::MAX)) as u16
-}
-
-/// The wrapped display-row count of `text` at `wrap_width` — the exact [`wrap_line`] pass the
-/// render uses (same step law, same outline bias), shared by [`measure_wrapped_rows`] (the chat
-/// band half) and [`ellipsize_to_fit`]'s fit test. An unconstrained width counts the `\n` lines.
-fn wrapped_rows(
-    metrics: &TextMetrics,
-    family: &str,
-    font_size: f32,
-    step_extra: f32,
-    text: &str,
-    wrap_width: f32,
-) -> usize {
-    wrapped_rows_capped(
-        metrics,
-        family,
-        font_size,
-        step_extra,
-        text,
-        wrap_width,
-        usize::MAX,
-    )
-}
-
-/// [`wrapped_rows`] that stops once `cap` rows exist — the client's own fit walk is bounded by the
-/// BOX, not by the string: `GxuFont_GetMaxCharsWithinHeight` (`0x5c21c0`) lays out `min(needed,
-/// fits + 1)` lines and abandons the rest, because the height test sits downstream of the per-line
-/// kernel call (wow-re `system/ui/scratch/fontstring-ellipsis-cost.md`). A caller that only needs
-/// to know whether the text OVERFLOWS passes `allowed + 1` and never pays for the tail; the chat
-/// band's row count, which is a real number, passes [`usize::MAX`].
-fn wrapped_rows_capped(
-    metrics: &TextMetrics,
-    family: &str,
-    font_size: f32,
-    step_extra: f32,
-    text: &str,
-    wrap_width: f32,
-    cap: usize,
-) -> usize {
-    let lines = parse_markup(text, [1.0, 1.0, 1.0, 1.0]);
-    if wrap_width <= WRAP_MIN_WIDTH {
-        return lines.len().min(cap);
-    }
-    let mut rows = 0usize;
-    for line in &lines {
-        rows += wrap_line(metrics, family, font_size, step_extra, line, wrap_width).len();
-        if rows >= cap {
-            return cap;
-        }
-    }
-    rows
-}
-
-/// The FontString display string under the height-gated ellipsis-truncate — `CSimpleFontString
-/// 0x771ec0`, regime 3 of the overflow verdict (`fontstring-overflow.md`, decision 0292's named
-/// residue): when the wrapped text needs more lines than the box allows, the tail is replaced by
-/// `"..."`, backed off one char at a time until the candidate fits. `None` = draw the raw text
-/// (fits, or the gate fails). The gate is geometric — `boxW > 0 && boxH > 0` on the resolved rect
-/// (`maxLines` unmodeled; nothing shipped sets it): an auto-height FontString's rect height IS its
-/// wrapped block (the measure round-trip), so it always fits and never truncates — the byte law's
-/// intrinsic-height escape. Applies at the region-FontString paint seam only
-/// ([`crate::ui_script::extract`]): the client's ellipsis is a FontString mechanism — editbox,
-/// message-frame lines, and world text (`combat_text`/nameplates) never take it, exactly as their
-/// C++ counterparts never call `0x771ec0`.
-pub(crate) fn ellipsize_to_fit(
-    atlas: &mut UiFontAtlas,
-    region: benilla_ui::widget::RegionHandle,
-    text: &str,
-    rect: Rect,
-    font: FontSpec,
-) -> Option<String> {
-    if rect.width() <= WRAP_MIN_WIDTH || rect.height() <= HEIGHT_LIMIT_MIN {
-        return None;
-    }
-    let family = atlas.metrics.family_for(font.path);
-    let font_size = atlas
-        .metrics
-        .snap_for(&family, font.height.unwrap_or(DEFAULT_FONT_SIZE));
-    let step_extra = step_extra_of(font.outline);
-    // The whole fit test runs in SNAPPED space, so the box enters through [`fit_box`] — the rect
-    // is drawn px, the pitch and step table below are the snapped size, and the draw multiplies
-    // its quads by `k`. Measuring the box against unscaled glyphs is what let an off-ladder
-    // request truncate text that fits (B209; decision 0989's named residual). The emit pass reads
-    // its box through the same body, so this seam and the wrap it feeds cannot disagree.
-    let (box_w, box_h) = fit_box(rect, font.height, font_size);
-    // The line pitch — identical to the emit pass's ([`layout_text_quads`]: the font em, NO
-    // outline pad — the byte law, `fontstring-vertical-placement.md`), so the fit test and the
-    // drawn stack agree line for line.
-    // The line-count law lives in `overflow` (it is the FIT law here, not the render stack's) —
-    // see `overflow::ellipsize_in_box`.
-    // The remembered answer, under exactly these inputs ([`super::EllipsisMemo`] — the client's
-    // `CGxString+0xf8`). The paint pass runs every frame; this seam is what the client rebuilds
-    // only on invalidation, and it is the most expensive thing in the pass by an order of
-    // magnitude (B240, decision 1332).
-    if let Some(hit) = atlas.ellipsis.get(region, text, box_w, box_h, &font) {
-        return hit.clone();
-    }
-    // The fit test only has to decide OVERFLOW, so it stops one row past the box — the client's
-    // own bound ([`wrapped_rows_capped`]).
-    let cap = overflow::lines_fitting(box_h.max(font_size), font_size) + 1;
-    let metrics = &atlas.metrics;
-    let display = overflow::ellipsize_in_box(text, box_h, font_size, |candidate| {
-        wrapped_rows_capped(
-            metrics, &family, font_size, step_extra, candidate, box_w, cap,
-        )
-    });
-    atlas
-        .ellipsis
-        .put(region, text, box_w, box_h, &font, display.clone());
-    display
-}
-
-/// The drawn line's origin for the EditBox text-UI overlays: the line's x0 under `justifyH`
-/// (where the engine's advance-derived caret/selection x-offsets are measured from), plus the
-/// single-line cell's top and height — the same family/size snap, step law, and justify math as
-/// [`layout_text_quads`], so the overlays sit exactly on the glyphs. Single-line by construction
-/// (the EditBox law; a multiLine box would need the wrapped-line walk).
-pub(crate) fn line_origin(
-    atlas: &mut UiFontAtlas,
-    drawn: &str,
-    rect: Rect,
-    justify: Justify,
-    font: FontSpec,
-) -> (f32, f32, f32) {
-    let family = atlas.metrics.family_for(font.path);
-    let font_size = atlas
-        .metrics
-        .snap_for(&family, font.height.unwrap_or(DEFAULT_FONT_SIZE));
-    let step_extra = step_extra_of(font.outline);
-    // Everything below returns DRAWN-space geometry ([`drawn_k`]): the string's drawn width, the
-    // caret cell's height, and the cell top all carry the 0581 rescale the glyph quads take.
-    let k = drawn_k(font.height, font_size);
-    // The line origin under justifyH (LEFT needs no width measure — the chat case).
-    let x0 = match justify.h {
-        JustifyH::Left => rect.min.x,
-        JustifyH::Center | JustifyH::Right => {
-            let w = k * measure_line_width(&atlas.metrics, &family, font_size, step_extra, drawn);
-            if matches!(justify.h, JustifyH::Center) {
-                rect.min.x + ((rect.width() - w) * 0.5).max(0.0)
-            } else {
-                rect.max.x - w
-            }
-        }
-    };
-    // The single-line block's v_offset — [`layout_text_quads_inner`]'s law with block_h = 1 line,
-    // through the same ONE vertical snap ([`snap_block_top`]) so the caret/selection cell sits
-    // exactly on the drawn glyphs — then the 0581 rescale about the same v anchor the draw
-    // scales its quads about (snap first, scale second: the draw's own order).
-    let top = if rect.height() > f32::EPSILON {
-        let v_offset = match justify.v {
-            JustifyV::Top => 0.0,
-            JustifyV::Middle => (rect.height() - font_size) * 0.5,
-            JustifyV::Bottom => rect.height() - font_size,
-        };
-        let snapped = snap_block_top(rect.min.y + v_offset);
-        let anchor_y = match justify.v {
-            JustifyV::Top => rect.min.y,
-            JustifyV::Middle => (rect.min.y + rect.max.y) * 0.5,
-            JustifyV::Bottom => rect.max.y,
-        };
-        anchor_y + (snapped - anchor_y) * k
-    } else {
-        rect.min.y
-    };
-    (x0, top, font_size * k)
-}
-
 /// The client's SINGLE vertical anchor snap (`anchor_justify_snap 0x5cdf70` @`0x5ce051`,
-/// `fontstring-vertical-placement.md`): the composed block top — rect top plus the justify
-/// offset — rounds ONCE to the integer pixel grid; the per-line ladder and the within-cell
-/// ascender are added as exact integers after it, never re-snapped. The client's round runs in
-/// the y-UP frame (`round(viewH·anchor.y)`), so a half-pixel tie pushes the block UP on screen —
-/// in y-down units that is round-half-DOWN, `ceil(y − 0.5)` (the money row's H=13/S=14 MIDDLE
-/// tie: offset −1, not 0 — the note's Case 3). Applied in LOGICAL units: the byte law at the
-/// 768-tall design resolution (the 0292 posture), so a retina window seats text exactly as the
-/// design-resolution layout, scaled.
+/// `fontstring-vertical-placement.md`): the composed block top — rect top plus the justify offset —
+/// rounds ONCE to the integer pixel grid; the per-line ladder and the within-cell ascender are added
+/// as exact integers after it, never re-snapped. The client's round runs in the y-UP frame
+/// (`round(viewH·anchor.y)`), so a half-pixel tie pushes the block UP on screen — in y-down units
+/// that is round-half-DOWN, `ceil(y − 0.5)` (the money row's H=13/S=14 MIDDLE tie: offset −1, not 0
+/// — the note's Case 3). Applied in LOGICAL units: the byte law at the 768-tall design resolution
+/// (the 0292 posture), so a retina window seats text exactly as the design-resolution layout,
+/// scaled.
 fn snap_block_top(y: f32) -> f32 {
     snap_block_top_law(y) + UI_SEAT_NUDGE
 }
 
-/// The pure byte law of the snap ([`snap_block_top`] minus the taste nudge) — kept separate so
-/// the tests pin the verified law itself, independent of the dial.
+/// The pure byte law of the snap ([`snap_block_top`] minus the taste nudge) — kept separate so the
+/// tests pin the verified law itself, independent of the dial.
 fn snap_block_top_law(y: f32) -> f32 {
     (y - 0.5).ceil()
 }
 
 /// The director's seat nudge: every UI FontString's text block sits one px LOWER than the byte
 /// law's row. A deliberate **taste deviation** (decision 0351 — the 0104/0235 precedent: the
-/// director's eye outranks the byte reading): the law is triple-confirmed (0338/0346), yet UI
-/// text consistently reads high on the director's display; this is their call, applied at the
-/// one seat every UI FontString shares ([`snap_block_top`] — world text's degenerate rects skip
-/// it, keeping nameplates/combat text on their own approved seats). Rendering only — measures,
-/// wrap, and the Lua metric echoes are untouched.
+/// director's eye outranks the byte reading): the law is triple-confirmed (0338/0346), yet UI text
+/// consistently reads high on the director's display; this is their call, applied at the one seat
+/// every UI FontString shares ([`snap_block_top`] — world text's degenerate rects skip it, keeping
+/// nameplates/combat text on their own approved seats). Rendering only — measures, wrap, and the
+/// Lua metric echoes are untouched.
 ///
 /// Public to the crate because a scissor that means to admit a block's ink has to know the seat
 /// pushed it down — see the message-band clip in [`crate::ui_script`]'s text arm.
 pub(crate) const UI_SEAT_NUDGE: f32 = 1.0;
 
-/// The `SetAlphaGradient` ramp at one character position: opaque before `start`, a linear 1→0
-/// fade across the next `length` characters, invisible beyond (hard edge when `length` ≤ 0).
+/// The `SetAlphaGradient` ramp at one character position: opaque before `start`, a linear 1→0 fade
+/// across the next `length` characters, invisible beyond (hard edge when `length` ≤ 0).
 fn gradient_alpha(index: usize, start: f32, length: f32) -> f32 {
     let i = index as f32;
     if i < start {
@@ -709,8 +164,22 @@ pub(crate) struct LinkSpan {
     pub(crate) markup: String,
 }
 
+/// Lays out `text` within `rect` (screen px, **y-down** — the same space
+/// [`crate::ui_script::extract::drive_script`] already flips frame rects into) and returns one
+/// [`UiQuad`] per non-blank glyph, textured with the page its cell was packed into. `z_key` is
+/// shared by every glyph — the owning `FontString` region's own [`crate::ui_pass`]-order key
+/// (regions already sort after their frame and by draw layer/decl, so reusing it keeps text in the
+/// client's total order with no extra bookkeeping; ties break by push order, i.e.
+/// left-to-right/top-to-bottom, which is what a stable sort preserves). `base_color` is the region's
+/// own color (`SetVertexColor`, default opaque white); `|cAARRGGBB`/`|r` runs in `text` override it
+/// per the markup rules.
+///
+/// `justify_h` positions each line's runs horizontally *within* `rect`; `justify_v` positions the
+/// line block vertically (default `Middle`, the client's FontString default; degenerate zero-height
+/// rects keep top). Each line is measured once (a first pass laying glyphs at a zero line-origin),
+/// then shifted by the justification offset.
 pub(crate) fn layout_text_quads(
-    atlas: &mut UiFontAtlas,
+    e: &mut TextEngine,
     text: &str,
     rect: Rect,
     base_color: [f32; 4],
@@ -718,7 +187,7 @@ pub(crate) fn layout_text_quads(
     z_key: u64,
     font: FontSpec,
 ) -> Vec<UiQuad> {
-    layout_text_quads_inner(atlas, text, rect, base_color, justify, z_key, font, None)
+    layout_text_quads_inner(e, text, rect, base_color, justify, z_key, font, None)
 }
 
 /// [`layout_text_quads`] that also collects the laid-out [`LinkSpan`]s — the message-frame path
@@ -726,7 +195,7 @@ pub(crate) fn layout_text_quads(
 /// hit-test, `benilla_ui::script::UiScript::set_link_spans`).
 #[allow(clippy::too_many_arguments)] // the shared layout context, plus one out-param
 pub(crate) fn layout_text_quads_links(
-    atlas: &mut UiFontAtlas,
+    e: &mut TextEngine,
     text: &str,
     rect: Rect,
     base_color: [f32; 4],
@@ -736,7 +205,7 @@ pub(crate) fn layout_text_quads_links(
     links_out: &mut Vec<LinkSpan>,
 ) -> Vec<UiQuad> {
     layout_text_quads_inner(
-        atlas,
+        e,
         text,
         rect,
         base_color,
@@ -749,7 +218,7 @@ pub(crate) fn layout_text_quads_links(
 
 #[allow(clippy::too_many_arguments)] // the public pair above is the real surface; this is their body
 fn layout_text_quads_inner(
-    atlas: &mut UiFontAtlas,
+    e: &mut TextEngine,
     text: &str,
     rect: Rect,
     base_color: [f32; 4],
@@ -759,89 +228,46 @@ fn layout_text_quads_inner(
     mut links_out: Option<&mut Vec<LinkSpan>>,
 ) -> Vec<UiQuad> {
     let gradient = font.alpha_gradient;
-    let lines = parse_markup(text, base_color);
-    // Resolve the face: the FontString's `font` path → its baked family, else Friz (the fallback).
-    let family = atlas.metrics.family_for(font.path);
-    let attrs = Attrs::new().family(Family::Name(&family));
-    // Resolve the size: the requested height snapped to the nearest baked size (default 12 if none).
-    let font_size = atlas
-        .metrics
-        .snap_for(&family, font.height.unwrap_or(DEFAULT_FONT_SIZE));
-    let scale = atlas.metrics.scale;
-    // DPI-aware layout: shape at the PHYSICAL size the atlas baked at, then divide advances/bearings
-    // back to logical (kerning/hinting computed once at device resolution — never logical shaping with
-    // scaled bitmaps pasted in, which drifts). `snap` rounds a logical coordinate to the nearest
-    // physical pixel (a multiple of `1/scale`) so glyph edges land on device pixels — the same
-    // integer-device-pixel snap the real client does, which keeps a physical-res bitmap crisp instead
-    // of resampled. The quad's far edge is then automatically physical-aligned (a baked cell is an
-    // integer count of physical texels).
-    let phys_size = font_size * scale;
-    let snap = |v: f32| (v * scale).round() / scale;
+    let r = measure::resolve(e, &font);
+    // **`AllGlyphsCached`** (`0x5c9fa0`): one pass to fill the caches, then the whole layout below
+    // is lookups. Markup bytes are ensured along with everything else, which costs a few cells for
+    // `|`/`c`/hex digits that a nearby run would have wanted anyway.
+    e.ensure_str(r.face, r.ppem, r.radius, text);
+    let e = &*e;
+    let dpi = e.dpi();
+    let sheet = e.sheet_image();
+    // Snap a logical coordinate to the nearest DEVICE pixel (a multiple of `1/dpi`), so glyph edges
+    // land on device pixels — the same integer-device-pixel snap the real client does, which keeps
+    // the cell crisp instead of resampled. A cell is an integer count of device texels, so the
+    // quad's far edge is then automatically device-aligned too.
+    //
+    // Note what this now buys that it could not before: every glyph on a line shares one `pen_y`
+    // and an integer physical `bearing_top`, so they all round by the same residual and the line is
+    // FLAT. Under the old size ladder a rescale ran after this and multiplied each already-rounded
+    // position by a non-integer factor, giving every letter its own sub-pixel phase — which is what
+    // "the letters aren't on a line" was (decision 1342).
+    let snap = |v: f32| (v * dpi).round() / dpi;
 
-    // Outline (`outline="NORMAL"/"THICK"`, the Number* fonts): cosmic-text bakes plain coverage, so
-    // we synthesize the classic bitmap outline — stamp each glyph's baked bitmap in black at every
-    // integer-logical offset in a filled `r×r` neighbourhood (`r=1` NORMAL, `r=2` THICK), *behind*
-    // the fill. A filled block (not just the 8 ring cells) so a THICK 2px band has no gap between the
-    // ink and its edge. Empty for the common un-outlined case (one alloc, skipped) — and for the
-    // drop-shadow pass (`paint_halo: false`), which must STEP like its outlined fill (the law below)
-    // but never paints halos (an outlined shadow would be a muddy black blob).
-    let outline_offsets: Vec<(f32, f32)> = match font.outline {
-        Outline::None => Vec::new(),
-        _ if !font.paint_halo => Vec::new(),
-        other => {
-            let r: i32 = if matches!(other, Outline::Thick) {
-                2
-            } else {
-                1
-            };
-            (-r..=r)
-                .flat_map(|dy| (-r..=r).map(move |dx| (dx, dy)))
-                .filter(|&(dx, dy)| dx != 0 || dy != 0)
-                .map(|(dx, dy)| (dx as f32, dy as f32))
-                .collect()
-        }
-    };
-    // The client's step law ([`client_step`]) — the same bias measure/wrap use, so measure == render.
-    let step_extra = step_extra_of(font.outline);
+    // The render lays the same lines the measure counted, or a MIDDLE-justified block seats
+    // against a height it does not have ([`fontstring_lines`], decision 1343).
+    let lines = fontstring_lines(text, base_color);
     // The THICK ink rise (`fontstring-baseline-row.md`, §5 trio): the client's THICK quad shift
     // (−2, `0x5cd0e1`) against its blit's baked seat nets the INK **1 row above** the plain
-    // baseline law; NORMAL cancels exactly (outline-invariant). Our baked cell reproduces the
-    // blit, so the quad carries the net: THICK cells rise 1 logical px. (The legacy stamped-halo
-    // fallback skips this — an unplanned-combo path, noted not chased.)
-    let thick_rise = if matches!(font.outline, Outline::Thick) {
-        1.0
-    } else {
-        0.0
-    };
-
-    // The box, in the space this pass lays out in. Everything below — the wrap walk, the line
-    // stack, the pitch — is computed at the SNAPPED size and rescaled to the true height by `k`
-    // in one pass at the end ([`drawn_k`]); `rect` arrives in DRAWN px. So a box the wrap or the
-    // stack is measured against enters divided by `k`, exactly as [`measure_text`] and
-    // [`ellipsize_to_fit`] take it — this pass and those two must decide the same breaks over the
-    // same box or a string does not fit the width its own measure reported.
-    //
-    // Leaving it raw is what put the Main Menu's labels one character short (B272's sibling,
-    // decision 1339): 1296 moved measure into drawn space and left this pass in snapped space, so
-    // an auto-sized FontString — whose rect IS `measure_text`'s answer — wrapped inside its own
-    // box at `k < 1`, and the stack below then dropped the overflow line with no ellipsis to show
-    // for it ("Options" → "Option", "Return to Game" → "Return to"). The error is `w·(1−k)`, so it
-    // grows with the string and the +1 px of measure headroom stops covering it.
-    //
-    // The justify offsets below deliberately keep the raw `rect`: they position the block by an
-    // ANCHOR the final rescale pivots about, so the drawn-space rect term cancels exactly (Left
-    // and Top are the anchor; Center/Middle and Right/Bottom cancel to ±half the block). Only the
-    // two *fit* decisions here are measurements, and only they convert.
-    let (fit_w, fit_h) = fit_box(rect, font.height, font_size);
+    // baseline law; NORMAL cancels exactly (outline-invariant). Our composite cell reproduces the
+    // blit, so the quad carries the net: THICK cells rise 1 logical px.
+    let thick_rise = f32::from(u8::from(matches!(font.outline, Outline::Thick)));
 
     // Word-wrap within the rect when it carries a pinned width; an unsized single-point FontString
-    // resolves to a ~zero-width rect (no constraint) and keeps its single-line behavior. Wrapping
-    // runs first, fully into `render_lines`, so its `&mut atlas.font_system` borrow is released
-    // before the emit pass takes it again.
-    let mut render_lines: Vec<Vec<ColorRun>> = if fit_w > WRAP_MIN_WIDTH {
+    // resolves to a ~zero-width rect (no constraint) and keeps its single-line behavior.
+    //
+    // The box is the box: `rect` is in the same space the pen lays out in, because there is only
+    // one space. Under the size ladder this pass measured a drawn-px rect against snapped-size
+    // glyphs unless it remembered to convert, and forgetting is what put the Main Menu's labels one
+    // character short (1339 — "Options" → "Option", with no ellipsis to show for it).
+    let mut render_lines: Vec<Vec<ColorRun>> = if rect.width() > WRAP_MIN_WIDTH {
         lines
             .iter()
-            .flat_map(|line| wrap_line(&atlas.metrics, &family, font_size, step_extra, line, fit_w))
+            .flat_map(|line| measure::wrap_line(e, r, line, rect.width()))
             .collect()
     } else {
         lines
@@ -851,31 +277,26 @@ fn layout_text_quads_inner(
     // accumulated pitch passes it. A FontString the ellipsis seam ([`ellipsize_to_fit`]) already
     // truncated fits by construction, so this is the belt under any caller that skips that seam —
     // in the client the same split: the ui truncate feeds the gx string, and the gx line stack
-    // clamps regardless. The pitch is the font em (the emit's `pitch` below — same law).
-    if fit_h > HEIGHT_LIMIT_MIN {
-        render_lines.truncate(overflow::lines_allowed(fit_h, font_size));
+    // clamps regardless.
+    if rect.height() > HEIGHT_LIMIT_MIN {
+        render_lines.truncate(overflow::lines_allowed(rect.height(), r.size));
     }
 
     let mut quads = Vec::new();
     // `justifyV` positions the line *block* — N lines at the client's pitch, which IS the font
-    // height (line-step law, the module doc's NOTE on line pitch) — vertically within `rect`. The
-    // real FontString default is MIDDLE, which is what seats the money digits on their coin icons'
-    // centerline. A rect sized *by* the text (the host-measure round-trip's height-less
-    // FontStrings) has `height == block`, so the offset degenerates to 0 there — only
-    // explicitly-sized rects shift. A degenerate rect (unsized single-point anchor, pre-measure)
-    // keeps the v1 top placement rather than hoisting text above its anchor.
-    // The baked outlined-cell variant this spec draws from (`0` = plain). Shadow passes
-    // (`paint_halo: false`) use the SAME variant — the client's shadow is a second draw of the
-    // same string (fontstring-shadow.md), so it redraws the composited cells in the shadow color
-    // (the black ring stays black under the tint; a black shadow is indistinguishable either way).
-    let cell_r = super::atlas::outline_radius(font.outline);
-    // The line pitch is the font em, NO outline pad — the byte law
-    // (`fontstring-vertical-placement.md`, VERIFIED at `0x5cdc20`/`0x5cdf70`): the client's
-    // origin ladder steps `S + spacingPx` (spacing 0 shipped) and the justify block is
-    // `h = N·S`; the `+2r` lives ONLY in the atlas cell (`[font+0x178]`), which the layout
-    // never reads. (The pre-verdict `+2r` here seated every outlined MIDDLE string r px too
-    // high — the money-digit bug.) Stacked outlined lines' rings may touch — faithful.
-    let pitch = font_size;
+    // height (line-step law: `lineStep = px(size) + spacing`, spacing 0 for all shipped UI;
+    // `LayoutLines` 0x5cdc20) — vertically within `rect`. The real FontString default is MIDDLE,
+    // which is what seats the money digits on their coin icons' centerline. A rect sized *by* the
+    // text (the host-measure round-trip's height-less FontStrings) has `height == block`, so the
+    // offset degenerates to 0 there — only explicitly-sized rects shift. A degenerate rect (unsized
+    // single-point anchor, pre-measure) keeps the v1 top placement rather than hoisting text above
+    // its anchor.
+    //
+    // NO outline pad in the pitch — the byte law (`fontstring-vertical-placement.md`, VERIFIED at
+    // `0x5cdc20`/`0x5cdf70`): the justify block is `h = N·S`, and the `+2r` lives ONLY in the atlas
+    // cell (`[font+0x178]`), which the layout never reads. (The pre-verdict `+2r` here seated every
+    // outlined MIDDLE string r px too high — the money-digit bug.)
+    let pitch = r.size;
     let block_h = render_lines.len() as f32 * pitch;
     let v_offset = if rect.height() > f32::EPSILON {
         match justify.v {
@@ -889,14 +310,10 @@ fn layout_text_quads_inner(
     // Baseline of the first line: the row the client hangs ink from — the face's pixel ascender
     // `[CGxFont+0x17c] = round(size · asc/(asc+|desc|))`, threaded unchanged into `glyph_vplace`
     // 0x5d1360 as the operand that fixes `baseline = cellTop + ascender` (wow-re `system/font`,
-    // §5-verified 2026-07-09). The per-family ratio was read off the raw TTF at atlas bake
-    // ([`UiFontAtlas::family_ascent`]); the fallback only fires for a face whose tables failed to
-    // parse (never the four shipped client fonts) and approximates Friz's 0.794 (965/1215). NOT
-    // `asc/upem` ≈ 0.965 — that is the FreeType scaled hhea ascender, which appears nowhere in the
-    // placement path; seating with it dropped every line ~3px too low (baseline row 13 vs 10 in a
-    // 13-tall cell — the gossip/quest row misalignment against its 16-tall icon).
-    let ascent_ratio = atlas.family_ascent.get(&family).copied().unwrap_or(0.794);
-    let baseline_in_cell = (f64::from(font_size) * f64::from(ascent_ratio) + 0.5).floor() as f32;
+    // §5-verified 2026-07-09). NOT `asc/upem` ≈ 0.965 — that is the FreeType scaled hhea ascender,
+    // which appears nowhere in the placement path; seating with it dropped every line ~3px too low.
+    let ascent_ratio = e.ascent_ratio_of(r.face);
+    let baseline_in_cell = (f64::from(r.size) * f64::from(ascent_ratio) + 0.5).floor() as f32;
     // The block top takes the client's ONE vertical snap ([`snap_block_top`]); a degenerate
     // (single-point / world-text) rect keeps its exact fractional origin — those callers
     // (nameplates/vplates/combat_text) own their own seating laws and re-seat by ink.
@@ -910,26 +327,20 @@ fn layout_text_quads_inner(
     // One glyph laid at a line-relative x-origin of 0, pending the line's justification shift.
     struct PendingGlyph {
         x_rel: f32,
-        /// Vertical offset from the line baseline (`pen_y`): `glyph.y − bearing_top`.
+        /// Vertical offset from the line baseline (`pen_y`).
         y_rel: f32,
         uv: Rect,
         px_w: f32,
         px_h: f32,
         color: [f32; 4],
-        /// True = this glyph drew from a PLAIN cell and still owes its outline to the legacy
-        /// stamped-halo pass (an outlined font whose `(face, size, r)` variant wasn't baked —
-        /// an unplanned runtime combo). False = the cell already composites ring+fill (the
-        /// baked-outline architecture, blit dispatch `0x5cf310`): one quad, fades as one, and
-        /// the halo pass must skip it or the ring would double.
-        haloed: bool,
     }
 
-    // The write-on gradient's character counter (`SetAlphaGradient`): a glyph's position is its
-    // char index in the emitted run stream — markup codes stripped, wrap-carried whitespace
-    // counted where it rides. That drifts from the source string by at most the newline count
-    // (the engine-side return condition counts every source char), which only pads the tail of
-    // the reveal by a frame or two — the ramp itself is exact per drawn glyph.
-    let mut chars_before: usize = 0;
+    // The write-on gradient's character counter (`SetAlphaGradient`): a glyph's position is its char
+    // index in the emitted run stream — markup codes stripped, wrap-carried whitespace counted where
+    // it rides. That drifts from the source string by at most the newline count (the engine-side
+    // return condition counts every source char), which only pads the tail of the reveal by a frame
+    // or two — the ramp itself is exact per drawn character.
+    let mut char_index: usize = 0;
     for line in &render_lines {
         // First pass: lay the line's glyphs at line-origin 0 and measure its total width.
         let mut pending: Vec<PendingGlyph> = Vec::new();
@@ -942,74 +353,38 @@ fn layout_text_quads_inner(
                 continue;
             }
             let run_x0 = pen_x;
-            let mut buffer =
-                Buffer::new(&mut atlas.font_system, Metrics::new(phys_size, phys_size));
-            buffer.set_wrap(&mut atlas.font_system, Wrap::None);
-            buffer.set_text(
-                &mut atlas.font_system,
-                &run.text,
-                &attrs,
-                Shaping::Advanced,
-                None,
-            );
-            buffer.shape_until_scroll(&mut atlas.font_system, false);
-
-            // Physical shaping → logical layout: every metric off the buffer / baked cell is
-            // physical, so divide by `scale` on the way into logical `pen`/`x_rel`/cell space.
-            // The pen advances by the client's STEP LAW ([`client_step`]) per glyph — cosmic's own
-            // cumulative `glyph.x` (fractional kerned advances) is deliberately unused for
-            // horizontal placement: the real client lays each glyph at pen + bearing and steps by
-            // its integer-floored advance + 1 (+1 outlined). measure_line_width sums the identical
-            // steps, so measure == render == the client's GetTextWidth.
-            for layout_run in buffer.layout_runs() {
-                for glyph in layout_run.glyphs {
-                    // An outlined spec prefers its composited (ring+fill) cell variant; a miss —
-                    // an unplanned runtime (face, size, r) — falls back to the plain cell plus
-                    // the stamped-halo pass. Advances agree across variants, so the step law
-                    // (and with it measure == render) is untouched by which cell drew.
-                    let plain: GlyphKey = (glyph.font_id, glyph.glyph_id, font_size.to_bits(), 0);
-                    let (info, haloed) = if cell_r > 0 {
-                        match atlas.glyphs.get(&(plain.0, plain.1, plain.2, cell_r)) {
-                            Some(outlined) => (Some(outlined), false),
-                            None => (atlas.glyphs.get(&plain), true),
-                        }
-                    } else {
-                        (atlas.glyphs.get(&plain), false)
-                    };
-                    match info {
-                        Some(info) => {
-                            if info.px_w > 0.0 && info.px_h > 0.0 {
-                                let mut color = run.color;
-                                if let Some((start, length)) = gradient {
-                                    let idx =
-                                        chars_before + run.text[..glyph.start].chars().count();
-                                    color[3] *= gradient_alpha(idx, start, length);
-                                }
-                                // `thick_rise` applies only through the baked composite cell —
-                                // the client's net is quad-vs-blit, and the halo fallback has
-                                // no shifted quad to cancel against.
-                                let rise = if haloed { 0.0 } else { thick_rise };
-                                pending.push(PendingGlyph {
-                                    x_rel: pen_x + info.bearing_x / scale,
-                                    y_rel: glyph.y / scale - info.bearing_top / scale - rise,
-                                    uv: info.uv,
-                                    px_w: info.px_w / scale,
-                                    px_h: info.px_h / scale,
-                                    color,
-                                    haloed,
-                                });
-                            }
-                            pen_x += client_step(info.advance, step_extra, scale);
-                        }
-                        None => {
-                            // No baked glyph (outside default_charset) — step past it anyway so
-                            // later glyphs on the same line don't overlap it.
-                            pen_x += client_step(glyph.w, step_extra, scale);
-                        }
-                    }
+            // The pen walks CHARACTERS, not a shaped buffer. The client's law has no kerning and no
+            // neighbour term (`ComputeStep 0x5ca2d0`), so a run's glyph sequence is the
+            // concatenation of its characters' — which is exactly what the cache holds, and exactly
+            // what `measure_line_width` sums. The two are now the same walk over the same numbers
+            // rather than two computations kept in agreement.
+            for ch in run.text.chars() {
+                let Some(cc) = e.char_cell(r.face, r.ppem, ch) else {
+                    // No face shapes it: it draws nothing and steps nothing, which is also what
+                    // the measure says. (Under the ladder these disagreed — measure returned 0 and
+                    // the pen stepped the shaped advance. One walk, one answer.)
+                    char_index += 1;
+                    continue;
+                };
+                let mut color = run.color;
+                if let Some((start, length)) = gradient {
+                    color[3] *= gradient_alpha(char_index, start, length);
                 }
+                for g in &cc.glyphs {
+                    if let Some(info) = e.cell(r.face, r.ppem, r.radius, g.glyph_id) {
+                        pending.push(PendingGlyph {
+                            x_rel: pen_x + info.bearing_x / dpi,
+                            y_rel: g.y_off / dpi - info.bearing_top / dpi - thick_rise,
+                            uv: info.uv,
+                            px_w: info.px_w / dpi,
+                            px_h: info.px_h / dpi,
+                            color,
+                        });
+                    }
+                    pen_x += client_step(g.advance, r.step_extra, dpi);
+                }
+                char_index += 1;
             }
-            chars_before += run.text.chars().count();
             if let Some(info) = &run.link {
                 match line_links
                     .iter_mut()
@@ -1028,39 +403,14 @@ fn layout_text_quads_inner(
             JustifyH::Center => rect.min.x + (rect.width() - line_width) * 0.5,
             JustifyH::Right => rect.max.x - line_width,
         };
-        // LEGACY outline layer — only for glyphs whose baked outlined cell is missing (`haloed`):
-        // every such glyph's black halo, pushed **before** any fill — so the stable z-sort's
-        // push-order tiebreak keeps every outline stamp behind every fill (including a later
-        // glyph's fill, where tight kerning overlaps them). Stacked stamps under a translucent
-        // fill BLACKEN mid-fade (the `α(1−α)` compositing term) — which is exactly why the baked
-        // composite cell is the primary path (the fade-composite fold-back record); this pass
-        // survives as the any-combo fallback, correct at full alpha.
-        for &(dx, dy) in &outline_offsets {
-            for g in pending.iter().filter(|g| g.haloed) {
-                let gx = snap(origin_x + g.x_rel) + dx;
-                let gy = snap(pen_y + g.y_rel) + dy;
-                quads.push(UiQuad {
-                    rect: Rect::new(gx, gy, gx + g.px_w, gy + g.px_h),
-                    z_key,
-                    texture: Some(atlas.image.clone()),
-                    uv: UvRect::from_rect(g.uv),
-                    // Black, riding the fill's alpha so a fading line's outline fades with it.
-                    color: [0.0, 0.0, 0.0, g.color[3]],
-                    ..default()
-                });
-            }
-        }
         for g in &pending {
-            // Snap the glyph origin to the physical-pixel grid (not the logical grid — that would
-            // re-blur on a retina display). `px_w/px_h` are an integer texel count divided by `scale`,
-            // so `gx + px_w` lands on a device pixel too.
             let gx = snap(origin_x + g.x_rel);
             let gy = snap(pen_y + g.y_rel);
             quads.push(UiQuad {
                 rect: Rect::new(gx, gy, gx + g.px_w, gy + g.px_h),
                 z_key,
-                texture: Some(atlas.image.clone()),
-                // Glyph atlas cells are always normalized (never mirrored); pass them straight through.
+                texture: Some(sheet.clone()),
+                // Glyph cells are always normalized (never mirrored); pass them straight through.
                 uv: UvRect::from_rect(g.uv),
                 color: g.color,
                 ..default()
@@ -1072,58 +422,15 @@ fn layout_text_quads_inner(
             let cell_top = pen_y - baseline_in_cell;
             for (info, x0, x1) in line_links.drain(..) {
                 out.push(LinkSpan {
-                    rect: Rect::new(origin_x + x0, cell_top, origin_x + x1, cell_top + font_size),
+                    rect: Rect::new(origin_x + x0, cell_top, origin_x + x1, cell_top + r.size),
                     link: info.link.clone(),
                     markup: info.markup.clone(),
                 });
             }
         }
-        // Next line: the client's pitch — the font height plus the outlined pad (see `pitch`;
-        // lineStep = px(size) + spacing, spacing 0; `LayoutLines` 0x5cdc20).
         pen_y += pitch;
     }
 
-    // The exact-height rescale (decision 0581): a requested height BETWEEN baked sizes — the
-    // runtime `SetTextHeight` animations (CombatFeedback's ×1.5 crit, CombatText's 30→60 pop;
-    // the real client scales the laid-out string exactly there) — shapes at the snapped size
-    // above and scales the finished quads about the justify anchor to the true height. Every
-    // registry-declared size is baked (the atlas census), so this pass is identity for all
-    // ordinary UI text and the physical-pixel snaps above stay untouched; the worldtext caller
-    // passes its own pre-snapped size (k = 1) and keeps its private seat law. The height is
-    // taken RAW: regime capping is the caller's (`drawn_px` — a SetTextHeight size is uncapped,
-    // decision 0582), so no re-cap here.
-    if let Some(req) = font.height {
-        let k = req / font_size;
-        if (k - 1.0).abs() > 1e-3 {
-            let anchor = Vec2::new(
-                match justify.h {
-                    JustifyH::Left => rect.min.x,
-                    JustifyH::Center => (rect.min.x + rect.max.x) * 0.5,
-                    JustifyH::Right => rect.max.x,
-                },
-                match justify.v {
-                    JustifyV::Top => rect.min.y,
-                    JustifyV::Middle => (rect.min.y + rect.max.y) * 0.5,
-                    JustifyV::Bottom => rect.max.y,
-                },
-            );
-            for q in &mut quads {
-                q.rect = Rect {
-                    min: anchor + (q.rect.min - anchor) * k,
-                    max: anchor + (q.rect.max - anchor) * k,
-                };
-            }
-            if let Some(out) = links_out {
-                for l in out.iter_mut() {
-                    l.rect = Rect {
-                        min: anchor + (l.rect.min - anchor) * k,
-                        max: anchor + (l.rect.max - anchor) * k,
-                    };
-                }
-            }
-        }
-    }
-
     quads
 }
 
@@ -1166,18 +473,6 @@ mod seat_tests {
         assert_eq!(snap_block_top(10.5), snap_block_top_law(10.5) + 1.0);
         assert_eq!(snap_block_top(0.0), 1.0);
     }
-
-    #[test]
-    fn the_measures_ride_the_drawn_space_factor() {
-        // [`drawn_k`] mirrors the 0581 rescale gate exactly: identity at a baked size and for
-        // height-None; the requested/snapped ratio between bakes (0989 — the era-scaled options
-        // window put every request between bakes, and the caret drifted 28% past its text).
-        assert_eq!(drawn_k(None, 8.0), 1.0);
-        assert_eq!(drawn_k(Some(8.0), 8.0), 1.0);
-        assert_eq!(drawn_k(Some(8.004), 8.0), 1.0); // inside the draw's 1e-3 gate
-        let k = drawn_k(Some(6.398), 8.203);
-        assert!((k - 6.398 / 8.203).abs() < 1e-6);
-    }
 }
 
 #[cfg(test)]
@@ -1199,108 +494,16 @@ mod gradient_tests {
     }
 }
 
-#[cfg(test)]
-mod row_start_tests {
-    use super::*;
-
-    fn runs(texts: &[&str]) -> Vec<Vec<ColorRun>> {
-        texts
-            .iter()
-            .map(|t| {
-                vec![ColorRun {
-                    text: (*t).to_string(),
-                    color: [1.0, 1.0, 1.0, 1.0],
-                    link: None,
-                }]
-            })
-            .collect()
-    }
-
-    fn starts(seg: &str, sub: &[Vec<ColorRun>], base: usize) -> Vec<usize> {
-        let mut rows = Vec::new();
-        segment_row_starts(seg, sub, base, &mut rows);
-        rows
-    }
-
-    #[test]
-    fn a_word_break_swallows_its_separator() {
-        // wrap dropped the space after "quick": row 2 starts past it.
-        assert_eq!(
-            starts("the quick brown", &runs(&["the quick", "brown"]), 0),
-            vec![0, 10]
-        );
-    }
-
-    #[test]
-    fn a_force_broken_word_swallows_nothing() {
-        assert_eq!(starts("abcdefgh", &runs(&["abcde", "fgh"]), 0), vec![0, 5]);
-    }
-
-    #[test]
-    fn a_double_space_separator_is_swallowed_whole() {
-        assert_eq!(starts("a.  b", &runs(&["a.", "b"]), 0), vec![0, 4]);
-    }
-
-    #[test]
-    fn inner_whitespace_stays_verbatim_inside_a_row() {
-        // "a  b" wrapped as one row keeps its double space; "c" starts past the break's space.
-        assert_eq!(starts("a  b c", &runs(&["a  b", "c"]), 0), vec![0, 5]);
-    }
-
-    #[test]
-    fn a_blank_segment_still_occupies_a_row_and_base_offsets() {
-        assert_eq!(starts("", &[], 7), vec![7]);
-        assert_eq!(starts("xy", &runs(&["xy"]), 3), vec![3]);
-    }
-}
-
-/// **B240's performance half, measured.** A world book halves the framerate while its reader is
-/// open (Goudy, 2026-08-09: *"page text with html text absolutely annihilates performance"* —
-/// 62 → 36 fps, recovering the moment the window closes).
-///
-/// The seam this measures: the page body draws in a **height-pinned** FontString (270×304, the
-/// rect the reference gives its SimpleHTML), and a body that overflows it enters
-/// [`ellipsize_to_fit`] — a back-off that strips one character at a time from the END of the
-/// string, re-testing the whole candidate at every step. That shape is the real client's, byte for
-/// byte (wow-re `system/ui/scratch/fontstring-ellipsis-cost.md`, §5 trio: the loop seeds from
-/// `strlen`, the `fitCount` it already has is discarded, and it steps one UTF-8 code point per
-/// iteration). What the client does *not* do is run it per frame, or re-lay the whole string on
-/// each step — the two divergences decision 1332 closes.
-///
-/// The HTML body is only the loudest case, not the boundary: the seam is armed by OVERFLOW, and
-/// vmangos ships 1257 page bodies of which the longest are **plain prose** — measured here beside
-/// the reported one, and four times worse.
-///
-/// Run with `cargo test --release -p benilla-app -- --ignored --nocapture ellipsis_cost`. Skips
-/// without an install.
-/// **A string fits the width its own measure reported** — the invariant that binds
-/// [`measure_text`] to the emit pass's wrap, over the real client fonts.
-///
-/// An auto-sized FontString has no width of its own: the engine's measure round-trip
-/// (`ui_script::extract`) sizes its rect *from* [`measure_text`], and [`layout_text_quads`] then
-/// re-wraps inside that rect. So the two must decide the same breaks over the same box, or a
-/// string wraps inside itself — and the emit pass's line stack drops the overflow row with no
-/// ellipsis to show for it, which is text silently losing its tail.
-///
-/// They stopped agreeing at 1296, which moved measure into DRAWN space (`×k`) and left the emit
-/// pass measuring the drawn-space rect against the SNAPPED step table. The gap is `w·(1−k)`, so it
-/// grows with the string while the measure's headroom stays one pixel: short labels survived and
-/// long ones lost a character. The Main Menu — every label auto-sized, the whole window wearing
-/// `SetScale(ERA_WINDOW_SCALE)` = 0.78 so nothing lands on the ladder — showed it whole:
-/// `Options` → `Option`, `Return to Game` → `Return to` (B272's sibling, decision 1339).
 #[cfg(test)]
 mod measure_fits_render {
     use super::*;
+    use crate::ui_text::engine::test_engine;
+    use crate::ui_text::markup::parse_markup;
 
-    /// Friz Quadrata on a deliberately sparse ladder, so a request lands between bakes the way
-    /// every request does under a scaled frame. 16 snaps UP to 20: `k = 0.8`, the sign that
-    /// truncates (the emit pass's snapped glyphs are 25 % wider than what it draws).
     const FACE: &str = "Fonts\\FRIZQT__.TTF";
-    const LADDER: &[f32] = &[10.0, 20.0];
-    const REQ: f32 = 16.0;
 
-    /// Every label the Main Menu draws, plus the two that survived — the shipped strings, so a
-    /// regression reads as the screenshot did.
+    /// Every label the Main Menu draws — the shipped strings, so a regression reads as the
+    /// director's screenshot did (`Options` → `Option`, `Return to Game` → `Return to`).
     const LABELS: &[&str] = &[
         "Options",
         "Support",
@@ -1313,59 +516,138 @@ mod measure_fits_render {
         "Main Menu",
     ];
 
+    /// `ERA_WINDOW_SCALE` — the Game Menu and the Options window carry `SetScale(0.78)`, so their
+    /// font heights land on nothing round. That was unrepresentable on a fixed size ladder BY
+    /// CONSTRUCTION, and it is the case the Main Menu report came from.
+    const ERA: f32 = 0.78;
+
+    fn spec(h: f32) -> FontSpec<'static> {
+        FontSpec {
+            path: Some(FACE),
+            height: Some(h),
+            outline: Outline::None,
+            alpha_gradient: None,
+        }
+    }
+
+    /// **A string fits the width its own measure reported.** An auto-sized FontString has no width
+    /// of its own: the engine's measure round-trip sizes its rect *from* `measure_text`, and the
+    /// emit pass then re-wraps inside that rect. If the two ever answer in different spaces the
+    /// string wraps inside its own box and the line stack drops the overflow row with no ellipsis
+    /// — which is what shipped (1339). Here they are one walk over one table, so this holds at
+    /// every size and DPI rather than at the ones somebody remembered to bake.
     #[test]
     fn a_string_fits_the_width_its_own_measure_reported() {
-        let Some(metrics) = super::super::atlas::test_metrics(&[(FACE, LADDER)], 1.0) else {
+        let Some(mut e) = test_engine(1.0) else {
             eprintln!("skipping: no install / font chain");
             return;
         };
-        let family = metrics.family_for(Some(FACE));
-        let font_size = metrics.snap_for(&family, REQ);
-        let k = drawn_k(Some(REQ), font_size);
-        assert!(k < 1.0, "the truncating sign: {REQ} must snap UP (k = {k})");
-        let step_extra = step_extra_of(Outline::None);
-        let spec = FontSpec {
-            path: Some(FACE),
-            height: Some(REQ),
-            outline: Outline::None,
-            paint_halo: true,
-            alpha_gradient: None,
-        };
-
-        let mut raw_wrapped = 0usize;
-        for label in LABELS {
-            // The rect an auto-sized FontString gets: measure's own answer, in drawn px.
-            let measured = measure_text(&metrics, label, None, spec).0;
-            let runs = parse_markup(label, [1.0, 1.0, 1.0, 1.0]);
-            let line = runs.first().expect("one line");
-
-            // The emit pass's wrap, over the box read through the SAME body it reads it through
-            // ([`fit_box`]) — so putting the raw rect back fails here, not just a copy of it.
-            let rect = Rect::new(0.0, 0.0, measured, REQ);
-            let (fit_w, _) = fit_box(rect, spec.height, font_size);
-            let rows = wrap_line(&metrics, &family, font_size, step_extra, line, fit_w);
-            assert_eq!(
-                rows.len(),
-                1,
-                "{label:?} wrapped inside its own measured width ({measured} drawn px)"
-            );
-
-            // The mutation check, welded in: measuring that same box RAW — what shipped — wraps
-            // the longer labels, and the emit pass's stack then eats the row it made.
-            let raw = wrap_line(&metrics, &family, font_size, step_extra, line, measured);
-            raw_wrapped += usize::from(raw.len() > 1);
+        // Sizes that a ladder could not carry: the era scale against each shipped menu height,
+        // and both DPIs.
+        for dpi in [1.0f32, 2.0] {
+            e.set_dpi_for_test(dpi);
+            for base in [10.0f32, 12.0, 13.0, 14.0, 16.0, 18.0, 20.0] {
+                let h = base * ERA;
+                let s = spec(h);
+                for label in LABELS {
+                    let measured = measure_text(&mut e, label, None, s).0;
+                    let r = measure::resolve(&mut e, &s);
+                    e.ensure_metrics(r.face, r.ppem, label);
+                    let runs = parse_markup(label, [1.0, 1.0, 1.0, 1.0]);
+                    let line = runs.first().expect("one line");
+                    let rows = measure::wrap_line(&e, r, line, measured);
+                    assert_eq!(
+                        rows.len(),
+                        1,
+                        "{label:?} wrapped inside its own measured width \
+                         ({measured} px, height {h}, dpi {dpi})"
+                    );
+                }
+            }
         }
-        assert!(
-            raw_wrapped > 0,
-            "the raw-box mutation must still break at least one label — otherwise this test \
-             cannot fail on the bug it pins"
+    }
+
+    /// **The pen and the measure are the same number, to the bit.** The emit pass walks characters
+    /// and steps; `measure_line_width` sums the same per-character steps. Nothing rounds between
+    /// them, so this is equality, not a tolerance — and any future divergence (a re-introduced
+    /// rescale, a shaper creeping back into one side) fails here rather than on someone's screen.
+    #[test]
+    fn the_drawn_line_is_exactly_as_wide_as_the_measure_says() {
+        let Some(mut e) = test_engine(2.0) else {
+            eprintln!("skipping: no install / font chain");
+            return;
+        };
+        for label in LABELS {
+            let s = spec(16.0 * ERA);
+            let want = measure_text(&mut e, label, None, s).0 - 1.0; // less the headroom pixel
+                                                                     // The emit pass's own line width, read off the quads it produced: the ink of the last
+                                                                     // glyph never passes the pen, and the first starts at the origin.
+            let quads = layout_text_quads(
+                &mut e,
+                label,
+                Rect::new(0.0, 0.0, 0.0, 0.0),
+                [1.0; 4],
+                Justify {
+                    h: JustifyH::Left,
+                    v: JustifyV::Top,
+                },
+                0,
+                s,
+            );
+            let ink = quads.iter().map(|q| q.rect.max.x).fold(0.0f32, f32::max);
+            assert!(
+                ink <= want.ceil() + 1e-3,
+                "{label:?}: ink reaches {ink} but the measure promised {want}"
+            );
+            assert!(!quads.is_empty(), "{label:?} drew nothing");
+        }
+    }
+
+    /// **The letters sit on one line.** Every glyph of a single-line string shares a baseline, so
+    /// every quad's top edge is an exact device pixel and the whole row rounds by one residual.
+    /// This is the director's report in an assertion: under the size ladder the rescale ran after
+    /// the snap and multiplied each already-rounded position by a non-integer factor, giving every
+    /// letter its own sub-pixel phase.
+    #[test]
+    fn every_glyph_on_a_line_lands_on_the_device_pixel_grid() {
+        let Some(mut e) = test_engine(2.0) else {
+            eprintln!("skipping: no install / font chain");
+            return;
+        };
+        // Deliberately an awkward height (12.48 logical at dpi 2 → 25 device px) and a fractional
+        // rect origin, which is what a `SetScale`d frame actually resolves to.
+        let s = spec(16.0 * ERA);
+        let quads = layout_text_quads(
+            &mut e,
+            "Return to Game",
+            Rect::new(10.5, 20.0, 400.0, 40.0),
+            [1.0; 4],
+            Justify {
+                h: JustifyH::Left,
+                v: JustifyV::Middle,
+            },
+            0,
+            s,
         );
+        assert!(quads.len() > 8, "the string drew");
+        let dpi = 2.0f32;
+        for q in &quads {
+            for v in [q.rect.min.x, q.rect.min.y, q.rect.max.x, q.rect.max.y] {
+                let device = v * dpi;
+                assert!(
+                    (device - device.round()).abs() < 1e-3,
+                    "a glyph edge at {v} logical is {device} device px — off the grid, which is \
+                     the sub-pixel scatter that took the letters off their line"
+                );
+            }
+        }
     }
 }
 
 #[cfg(test)]
 mod ellipsis_cost {
     use super::*;
+    use crate::ui_text::engine::test_engine;
     use std::cell::Cell;
     use std::time::Instant;
 
@@ -1413,8 +695,6 @@ mod ellipsis_cost {
         "in happier times.\n\nYour friend,\nLeagrem\n\n",
     );
 
-    /// The reader's own wrapper — `ItemTextFrame.xml`'s READY handler frames an authorless page
-    /// with a leading and a trailing newline.
     /// The reader's own wrapper — `ItemTextFrame.xml`'s READY handler frames an authorless page
     /// with a leading and a trailing newline.
     fn page_body(page: &str) -> String {
@@ -1423,28 +703,33 @@ mod ellipsis_cost {
 
     /// `ItemTextPageText`'s geometry and face: 270×304 at `ItemTextFontNormal`
     /// (`Fonts\MORPHEUS.TTF`, height 15). At the 768-tall design window the seam scale is 1, so
-    /// these are also the drawn px; a taller window scales box and pitch together, which leaves
-    /// the line counts — and therefore this whole measurement — unchanged.
+    /// these are also the drawn px.
     const FACE: &str = "Fonts\\MORPHEUS.TTF";
     const SIZE: f32 = 15.0;
     const BOX_W: f32 = 270.0;
     const BOX_H: f32 = 304.0;
 
     #[test]
-    #[ignore = "bakes a real font atlas from the install; run explicitly"]
+    #[ignore = "rasterizes a real font from the install; run explicitly"]
     fn a_page_that_overflows_its_box_costs_a_whole_back_off() {
-        let Some(metrics) = super::super::atlas::test_metrics(&[(FACE, &[SIZE])], 1.0) else {
+        let Some(mut e) = test_engine(1.0) else {
             eprintln!("skipping: no install / font chain");
             return;
         };
-        let family = metrics.family_for(Some(FACE));
-        let font_size = metrics.snap_for(&family, SIZE);
-        let step_extra = step_extra_of(Outline::None);
-        let fits = overflow::lines_fitting(BOX_H, font_size);
+        let s = FontSpec {
+            path: Some(FACE),
+            height: Some(SIZE),
+            outline: Outline::None,
+            alpha_gradient: None,
+        };
+        let r = measure::resolve(&mut e, &s);
+        let fits = overflow::lines_fitting(BOX_H, r.size);
 
         for (label, page) in [("html 2676", PAGE), ("plain 2880", PLAIN)] {
             let text = page_body(page);
-            let full = wrapped_rows(&metrics, &family, font_size, step_extra, &text, BOX_W);
+            e.ensure_metrics(r.face, r.ppem, &text);
+            e.ensure_metrics(r.face, r.ppem, "...");
+            let full = measure::wrapped_rows_for_test(&e, r, &text, BOX_W);
             eprintln!(
                 "[ellipsis-cost] {label:<11} {:>4} chars -> {full:>2} rows in a {fits}-row box",
                 text.chars().count(),
@@ -1457,12 +742,10 @@ mod ellipsis_cost {
                 let probes = Cell::new(0usize);
                 let chars = Cell::new(0usize);
                 let t = Instant::now();
-                let got = overflow::ellipsize_in_box(&text, BOX_H, font_size, |candidate| {
+                let got = overflow::ellipsize_in_box(&text, BOX_H, r.size, |candidate| {
                     probes.set(probes.get() + 1);
                     chars.set(chars.get() + candidate.chars().count());
-                    wrapped_rows_capped(
-                        &metrics, &family, font_size, step_extra, candidate, BOX_W, cap,
-                    )
+                    measure::wrapped_rows_capped_for_test(&e, r, candidate, BOX_W, cap)
                 });
                 let us = t.elapsed().as_secs_f64() * 1e6;
                 eprintln!(
diff --git a/crates/benilla-app/src/ui_text/markup.rs b/crates/benilla-app/src/ui_text/markup.rs
index 44cc3da6..bf853e3f 100644
--- a/crates/benilla-app/src/ui_text/markup.rs
+++ b/crates/benilla-app/src/ui_text/markup.rs
@@ -99,6 +99,40 @@ pub(super) fn parse_markup(input: &str, base_color: [f32; 4]) -> Vec<Vec<ColorRu
     lines
 }
 
+/// [`parse_markup`] under the FontString **line-count law** — what the client's height kernel
+/// `GxuFont_GetTextBlockHeight 0x5c2070` actually counts (wow-re `system/font/scratch/
+/// re-wave1-capi.md`; the two edge cases spelled out in `system/ui/scratch/
+/// simplehtml-markup-engine.md` §4.4).
+///
+/// The kernel walks the string: a bare line break at the cursor is an empty line and costs one;
+/// otherwise it lays a line, and **that line's own terminating break is consumed with it**. So a
+/// trailing break terminates its line rather than opening a new one, and the loop guard
+/// (`cmp byte [esi],0`) means an empty string is **zero** lines with height `0.0`, not one.
+///
+/// The difference from a plain split is exactly one line, on exactly the strings that end in a
+/// break — which is every `<BR/>` block SimpleHTML builds (`"\n"`: one blank line in the client,
+/// two under a split) and every page body the item-text reader pads. B240's reader drew its
+/// section gaps at double height until this existed (the director, 08-15, against his own 1.12.1
+/// shot); decision 1343.
+///
+/// **Not the EditBox's law.** A multiline box that ends in a newline really does show the empty
+/// row its caret sits on, and it reaches its rows through `line_rows`/`0x77da80`, not this kernel
+/// — so [`parse_markup`] itself is left alone and this is a separate seam over it.
+pub(super) fn fontstring_lines(input: &str, base_color: [f32; 4]) -> Vec<Vec<ColorRun>> {
+    if input.is_empty() {
+        return Vec::new();
+    }
+    let mut lines = parse_markup(input, base_color);
+    if lines.len() > 1
+        && lines
+            .last()
+            .is_some_and(|l| l.iter().all(|r| r.text.is_empty()))
+    {
+        lines.pop();
+    }
+    lines
+}
+
 /// Accumulate one drawn char into the current run, and into the open link's visible text.
 fn push_visible(c: char, cur: &mut String, link: &mut Option<(String, String, Vec<usize>)>) {
     if let Some((_, visible, _)) = link {
@@ -368,6 +402,36 @@ mod markup_tests {
         assert_eq!(drawn, "a|Tfoo|tb");
     }
 
+    /// The FontString **line-count law** (`GxuFont_GetTextBlockHeight 0x5c2070`), pinned on the
+    /// strings that separate it from a plain split: a **trailing** break terminates its line
+    /// rather than opening a new one, and an empty string is **zero** lines.
+    ///
+    /// The director found this against his own 1.12.1 client (08-15): every `<BR/>` in a book page
+    /// is a `"\n"` block, and under a split that is two blank lines instead of one — so the page's
+    /// section gaps came out at double height and the text ran off the bottom. The second block
+    /// below is the mutation check: the cases a split already got right must not move.
+    #[test]
+    fn a_trailing_break_does_not_open_a_line() {
+        let n = |t: &str| fontstring_lines(t, [1.0, 1.0, 1.0, 1.0]).len();
+        // The three the kernel counts differently from a split.
+        assert_eq!(n("\n"), 1, "a <BR/> block is ONE blank line");
+        assert_eq!(n("a\n"), 1);
+        assert_eq!(n(""), 0, "an empty string is zero lines, height 0.0");
+        // …and everything else is unchanged.
+        assert_eq!(n("a"), 1);
+        assert_eq!(n("a\nb"), 2);
+        assert_eq!(
+            n("\nbody\n"),
+            2,
+            "the reader's own padding: a blank line, then the body"
+        );
+        assert_eq!(n("\n\n"), 2);
+        assert_eq!(n("a\n\nb"), 3);
+        // `|n` is the same break token, so it obeys the same law.
+        assert_eq!(n("a|n"), 1);
+        assert_eq!(n("a|nb"), 2);
+    }
+
     /// A malformed escape is literal text to the draw, so it must be literal to the map too —
     /// otherwise the metrics would charge zero width for bytes the user can see.
     #[test]
diff --git a/crates/benilla-app/src/ui_text/measurer.rs b/crates/benilla-app/src/ui_text/measurer.rs
index 26a8fecb..a5803fad 100644
--- a/crates/benilla-app/src/ui_text/measurer.rs
+++ b/crates/benilla-app/src/ui_text/measurer.rs
@@ -2,24 +2,29 @@
 //! [`benilla_ui::script::TextMeasure`].
 //!
 //! The engine seam (`benilla-ui`'s `script::measure`) exists because the reference answers
-//! `GetStringWidth` from its font engine *inline* and ours could not: measuring needed the baked
-//! atlas, and the atlas only met the VM at the frame boundary. What closes the gap is that the
-//! client's width law is a **table**, not a computation — a sum of per-glyph steps with no kerning
-//! and no neighbour term — so [`TextMetrics`] carries everything a measure needs and nothing that
-//! needs `&mut`. That table is `Arc`-shared with [`UiFontAtlas`](super::atlas::UiFontAtlas) rather
-//! than copied, so the answer a Lua call gets mid-tick and the answer the extract pass computes are
-//! not merely equal — they are the same lookup in the same table.
+//! `GetStringWidth` from its font engine *inline* and ours could not: measuring needed the atlas,
+//! and the atlas only met the VM at the frame boundary. What closes the gap is that the client's
+//! width law is a **table**, not a computation — a sum of per-glyph steps with no kerning and no
+//! neighbour term — so a measure needs only the face, the raster size, and the characters.
+//!
+//! **The same engine, not a copy of it.** This holds the very [`TextEngine`] the render path holds,
+//! behind the same lock, so the answer a Lua call gets mid-tick and the answer the extract pass
+//! computes are not merely equal — they are the same lookup in the same table. That property used
+//! to be bought by making the table immutable and `Arc`-sharing it; since decision 1342 the table
+//! fills on demand, so the sharing has to carry mutation, and the lock is how. A measure fills only
+//! the **metrics** half ([`TextEngine::ensure_metrics`]): a string that is measured and never drawn
+//! costs a shaping, never a raster and never a texture page.
 //!
 //! **One body, both callers.** [`measure_request`] is the whole of it; the batch pass
 //! (`ui_script::extract::measure_fontstrings`) and [`AtlasMeasurer`] both call it and neither has
 //! any measuring logic of its own. That is the trait's own contract, kept structurally rather than
 //! by discipline.
 
-use std::sync::Arc;
+use std::sync::{Arc, Mutex};
 
 use benilla_ui::script::{MeasureRequest, TextMeasure};
 
-use super::atlas::TextMetrics;
+use super::engine::TextEngine;
 
 /// Answer one [`MeasureRequest`]: `(laid_out_w, laid_out_h, natural_w)` in the region's own
 /// frame-local units.
@@ -29,7 +34,7 @@ use super::atlas::TextMetrics;
 /// raster size — and the answer divides the whole product back out, because integer-stepped glyph
 /// advances do not commute with scaling (see [`MeasureRequest::scale`]).
 pub(crate) fn measure_request(
-    metrics: &TextMetrics,
+    e: &mut TextEngine,
     seam: f32,
     r: &MeasureRequest,
 ) -> (f32, f32, f32) {
@@ -41,47 +46,50 @@ pub(crate) fn measure_request(
         // frame-local UI units below.
         height: super::drawn_px(r.height, r.text_height, rs),
         // The TRUE outline: THICK biases the client's step law (+1px per glyph — GlyphStepBase
-        // 0x5ca2b0, THICK-only per outline-bake-tint.md) and any outline adds the +2r line pitch,
-        // so measure must see it.
+        // 0x5ca2b0, THICK-only per outline-bake-tint.md), so measure must see it.
         outline: r.outline,
-        paint_halo: true,     // measure never paints; irrelevant here
         alpha_gradient: None, // alpha never changes metrics
     };
     let wrap = r.wrap_width.map(|w| w * rs);
-    let (w, h) = super::measure_text(metrics, &r.text, wrap, spec());
+    let (w, h) = super::measure_text(e, &r.text, wrap, spec());
     // …and the NATURAL width, which is what `GetStringWidth` answers with (the reference measures
     // its getter's string with no wrap constraint — wow-re `fontstring-overflow.md`, "The
     // measurement echo"). A second pass only for the regions that actually carry a declared width;
     // for the rest the two are one number.
     let natural = if wrap.is_some() {
-        super::measure_text(metrics, &r.text, None, spec()).0
+        super::measure_text(e, &r.text, None, spec()).0
     } else {
         w
     };
     (w / rs, h / rs, natural / rs)
 }
 
-/// The measurer installed into the VM — the shared [`TextMetrics`] plus the host's current screen
-/// seam.
+/// The measurer installed into the VM — the shared engine plus the host's current screen seam.
 ///
-/// **Rebuilt, not mutated, when the seam moves.** A measurer is only correct for the raster
-/// environment it was made under (glyph advances step to whole *physical* pixels), so the host
-/// installs a fresh one at exactly the moment it calls
+/// **Rebuilt, not mutated, when the seam moves.** A measurer is only correct for the seam it was
+/// made under (the seam multiplies into every requested height before it becomes a raster size), so
+/// the host installs a fresh one at exactly the moment it calls
 /// [`UiScript::forget_text_metrics`](benilla_ui::script::UiScript::forget_text_metrics) — the same
 /// edge, for the same reason. Building one is an `Arc` clone and an `f32`.
 pub(crate) struct AtlasMeasurer {
-    metrics: Arc<TextMetrics>,
+    engine: Arc<Mutex<TextEngine>>,
     seam: f32,
 }
 
 impl AtlasMeasurer {
-    pub(crate) fn new(metrics: Arc<TextMetrics>, seam: f32) -> Self {
-        Self { metrics, seam }
+    pub(crate) fn new(engine: Arc<Mutex<TextEngine>>, seam: f32) -> Self {
+        Self { engine, seam }
     }
 }
 
 impl TextMeasure for AtlasMeasurer {
     fn measure(&mut self, req: &MeasureRequest) -> (f32, f32, f32) {
-        measure_request(&self.metrics, self.seam, req)
+        // Taken and released inside this call. Nothing on the app side may hold the engine lock
+        // across a VM tick, because a tick can land here (see `ui_text::engine`'s lock discipline).
+        let mut e = self
+            .engine
+            .lock()
+            .unwrap_or_else(std::sync::PoisonError::into_inner);
+        measure_request(&mut e, self.seam, req)
     }
 }
diff --git a/crates/benilla-app/src/ui_text/mod.rs b/crates/benilla-app/src/ui_text/mod.rs
index 81021a20..0ff1c30b 100644
--- a/crates/benilla-app/src/ui_text/mod.rs
+++ b/crates/benilla-app/src/ui_text/mod.rs
@@ -1,24 +1,29 @@
-//! Text rendering for `QuadContent::Text` (decision 0068 §2): a glyph atlas baked from the client's
-//! own TTFs, shaped through `cosmic-text` 0.16, emitted as [`crate::ui_pass::UiQuad`]s the quad pass
-//! draws with no special case. Ported from `probes/text-glyph/src/{font,atlas,markup,layout}.rs`
-//! (screenshot-verified there, 2026-07-02) into the real render path; the port's only structural change
-//! is the font source (the app's own [`WorldAssets`] patch chain, not a probe-local `Chain::open`) and
-//! the output type (this crate's real `UiQuad`, not the probe's mirror struct).
+//! Text rendering for `QuadContent::Text` (decision 0068 §2): an on-demand glyph cache over the
+//! client's own TTFs, shaped through `cosmic-text` 0.16, emitted as [`crate::ui_pass::UiQuad`]s the
+//! quad pass draws with no special case.
+//!
+//! - [`engine`] — the cache: faces, the size law, and the two lookup tables everything else reads.
+//! - [`pack`] — the texture the cells live in, and how they get there.
+//! - [`outline`] — the client's outline blit recipe, run per cell.
+//! - [`layout`] — the emit pass, and (in `layout::measure`) the width law, the wrap and the
+//!   ellipsis seam.
+//! - [`measurer`] — the same engine, as the script VM holds it for a synchronous `GetStringWidth`.
 //!
 //! ## Font objects (decision 0084) and remaining v1 simplifications
 //!
 //! - **Per-`FontString` size + face.** [`QuadContent::Text`] now carries the resolved `{ font, height }`
-//!   from the engine's font registry (`Fonts.xml`'s named virtual `<Font>` objects). The atlas bakes
-//!   every registered client TTF at each of [`FONT_SIZES`]; [`layout_text_quads`] selects the face by
-//!   `font` path (via [`UiFontAtlas::path_to_family`]) and the nearest baked size. A `FontString` with
-//!   no font object falls back to Friz Quadrata at [`DEFAULT_FONT_SIZE`] (the pre-0084 behavior).
-//! - **DPI-aware bake.** The atlas is baked at `logical_size × Window::scale_factor` (physical
-//!   resolution), and [`layout_text_quads`]/[`measure_text`] shape at that physical size, divide the
-//!   metrics back to logical, and snap glyph origins to the physical-pixel grid — so a baked cell
-//!   draws one texel per device pixel instead of a half-res bitmap upscaled by a retina framebuffer.
-//! - **Outlines are rasterized** as the classic bitmap outline: [`layout_text_quads`] stamps each
-//!   glyph's baked coverage in black over a filled `r×r` neighbourhood (`r=1` NORMAL, `r=2` THICK)
-//!   behind the fill — `cosmic-text` has no native outline. The Number* fonts (action-bar
+//!   from the engine's font registry (`Fonts.xml`'s named virtual `<Font>` objects). A `FontString`
+//!   with no font object falls back to Friz Quadrata at [`DEFAULT_FONT_SIZE`] (the pre-0084 behavior).
+//! - **One exact raster size, on demand** (decision 1342). A logical height becomes the integer
+//!   device-pixel size it will be drawn at (`round(height × scale_factor)` — the client's own
+//!   `0x5ca030` law), and the glyphs for that size are rasterized the first time anything asks for
+//!   them. There is no size ladder, no snapping, and no rescale of finished quads: the size a
+//!   string is measured at, rasterized at, and drawn at is one number. See [`engine`] for what that
+//!   replaced and why.
+//! - **Outlines are one composite cell.** An outlined glyph's black ring and its fill are
+//!   rasterized together into a single cell and blitted once — the client's own baked-outline
+//!   architecture (`glyph_blit_aa_outline 0x5cea30`; see [`outline`]), which is what makes an
+//!   outlined string fade as one thing instead of blackening. The Number* fonts (action-bar
 //!   hotkeys/counts) carry it.
 //! - **`justifyH` and `justifyV` are honored** (see [`layout_text_quads`]): lines justify
 //!   horizontally per line, and the line block vertically (default MIDDLE, the client's
@@ -29,34 +34,42 @@
 //!
 //! ## The metric-fidelity seam
 //!
-//! [`layout_text_quads`] shapes every run through `cosmic-text`'s shaper for glyph SELECTION and
-//! rasterization, but the pen now **advances by the client's own step law** (wow-re
-//! `system/font`): per glyph, `floor(advance) + 1` px (`rasterize_glyph` 0x5d1120's
+//! `cosmic-text`'s shaper is used for glyph SELECTION and rasterization, **one character at a
+//! time** ([`engine::TextEngine::ensure_char`]); the pen then **advances by the client's own step
+//! law** (wow-re `system/font`): per glyph, `floor(advance) + 1` px (`rasterize_glyph` 0x5d1120's
 //! `out[5] = (FT_advance>>6)+1.0`), plus another `+1` for a **THICK**-outlined font only
 //! (`GlyphStepBase` 0x5ca2b0 biases solely under the THICK flag — `outline-bake-tint.md`,
 //! correcting this module's earlier any-outline reading) — the extra tracking that makes real
-//! client text read wider/denser than raw font metrics. Remaining divergences, all confined here: kerning is dropped (the client applies only
-//! negative pair kerns and rounds — ~0 at UI sizes), the law is applied at logical ppem (the
-//! 768-window reference look), and glyph BITMAPS are cosmic/swash unhinted coverage where the
+//! client text read wider/denser than raw font metrics.
+//!
+//! Per character is not a shortcut; it is the law. The client's `ComputeStep` (0x5ca2d0) has no
+//! neighbour term, so a string's width is a pure function of its characters — which is what lets
+//! one table answer a measure and a draw, and what lets a measure be answered from inside a Lua
+//! call. It is a property of the FONTS that the decomposition holds (no ligatures, no contextual
+//! substitution in these four faces), so it is asserted directly rather than assumed:
+//! `engine::differential_tests`.
+//!
+//! Remaining divergences, all confined here: kerning is dropped entirely (the client applies only
+//! *negative* pair kerns and rounds — ~0 at UI sizes; the test that pins the width law also pins
+//! that this is what we are doing), and glyph BITMAPS are cosmic/swash unhinted coverage where the
 //! client runs 2004-era FreeType with hinting flags (0x208a/0x20c2) — slightly slimmer stems at
 //! small sizes. A future bit-exact replacement (wow-re's font kernel) only changes this module;
-//! nothing in its callers moves.
+//! nothing in its callers moves. The deliberate *rendering* divergences — where the client stretches
+//! a cell and we rasterize the true size — are named in [`engine`]'s module doc.
 
-mod atlas;
+mod engine;
 mod layout;
 mod markup;
 mod measurer;
+mod outline;
+mod pack;
 
-pub(crate) use atlas::{UiFontAtlas, UiTextPlugin};
+pub(crate) use engine::{UiFontAtlas, UiTextPlugin};
 
 use benilla_ui::script::Outline;
 use benilla_ui::widget::RegionHandle;
 pub(crate) use measurer::{measure_request, AtlasMeasurer};
 
-/// The width law itself, for the differential test that pins it to the pre-table shaped sum
-/// (`atlas::metrics_tests`). Not a production seam — every caller goes through [`measure_text`].
-#[cfg(test)]
-pub(crate) use layout::measure_line_width_for_test;
 pub(crate) use layout::{
     ellipsize_to_fit, layout_text_quads, layout_text_quads_links, line_advances, line_origin,
     line_rows, measure_text, measure_wrapped_rows, FontSpec, Justify, UI_SEAT_NUDGE,
@@ -262,7 +275,6 @@ mod ellipsis_memo_tests {
             path,
             height,
             outline,
-            paint_halo: true,
             alpha_gradient: None,
         }
     }
diff --git a/crates/benilla-app/src/ui_text/outline.rs b/crates/benilla-app/src/ui_text/outline.rs
new file mode 100644
index 00000000..d6f0aaa7
--- /dev/null
+++ b/crates/benilla-app/src/ui_text/outline.rs
@@ -0,0 +1,210 @@
+//! **The outline blit recipe** — the client's baked-outline architecture, byte-for-byte.
+//!
+//! An outlined font (`outline="NORMAL"/"THICK"`, the Number* fonts) does not draw a ring and a fill
+//! as two things. The real client composites both into **one** atlas cell and blits it once
+//! (`glyph_blit_aa_outline 0x5cea30`, dispatched by `0x5cf310` off the font flags at
+//! `[CGxFont+0x180]`), which is what makes an outlined string fade correctly: one quad, one alpha,
+//! ring and fill thinning together. Stamping a ring behind a fill instead — which this codebase did
+//! before the composite cell — blackens mid-fade on the `α(1−α)` compositing term.
+//!
+//! Under the size ladder these variants had to be **planned**: a census walked the shipped
+//! `Fonts.xml` registry for every `(face, size, radius)` triple anything could ask for, baked those,
+//! and left any unplanned runtime combination to a legacy stamped-halo fallback. On demand
+//! (decision 1342) there is nothing to plan and no fallback to keep: a radius that is asked for is a
+//! radius that is rasterized, so the composite cell is now the only outline path there is.
+
+/// The cell radius for a font's outline flag: the ring reach in **logical** px (`r=1` NORMAL,
+/// `r=2` THICK) and the glyph cache key's variant discriminant.
+pub(super) fn radius_of(outline: benilla_ui::script::Outline) -> u8 {
+    match outline {
+        benilla_ui::script::Outline::None => 0,
+        benilla_ui::script::Outline::Normal => 1,
+        benilla_ui::script::Outline::Thick => 2,
+    }
+}
+
+/// The client's AA neighbour-count → outline-alpha LUT (`DAT_0080a8ec`, wow-re
+/// `system/font/scratch/outline-bake-tint.md`, §5 double-pair + difftests, commit `f80ce699`):
+/// index = the number of marked cells in the in-bounds 3×3 box (centre included), value = the
+/// 4-bit alpha, here pre-widened to 8-bit (`nibble × 17`).
+const AA_NEIGHBOUR_LUT: [u8; 10] = [0, 17, 17, 51, 85, 119, 153, 187, 221, 255];
+
+/// Composite one glyph's coverage bitmap into an **outlined cell** — the byte recipe of the
+/// client's AA-outline blit (`glyph_blit_aa_outline 0x5cea30`, dispatched by `0x5cf310`; wow-re
+/// `outline-bake-tint.md`, difftested emulation `wow-5875-re/crates/font/src/raster.rs`):
+///
+/// 1. **Mark** every texel with non-zero coverage.
+/// 2. **Dilate** iteratively — each pass marks every virgin texel 8-adjacent to a marked one.
+///    The binary runs 1 pass for NORMAL, 2 for THICK; we run `r × round(dpi)` so the ring keeps
+///    its logical weight under the device-resolution raster (at `dpi = 1` this IS the byte recipe;
+///    the finer grid at retina is the same deliberate resolution upgrade as the raster itself).
+/// 3. **Alpha** per texel = [`AA_NEIGHBOUR_LUT`]`[count of marked cells in the in-bounds 3×3
+///    box]` — the ring AND the fill edge take the same neighbourhood-graded alpha (interior = 9
+///    marked ⇒ opaque; a THICK ring's outer corners grade down to ~⅓ — the real softer outer edge).
+/// 4. **Pack**: unmarked ⇒ transparent; zero-coverage (pure ring) ⇒ black at the LUT alpha; else
+///    `RGB = the coverage as gray` (the fill ramps *toward the ring's black* at AA edges — not
+///    white-with-thin-alpha) at the LUT alpha. The binary quantizes to ARGB4444; we keep 8-bit
+///    (same law, no banding — the one deliberate widening, like the LUT `×17`).
+///
+/// Draw-side law this feeds (same note, prongs 2–3): one quad per glyph, vertex color MODULATE —
+/// white fill takes the text tint, black ring stays black — and ONE alpha per pass, so a frame fade
+/// thins ring+fill together (no `α(1−α)` blackening, the defect the stamped halos had).
+///
+/// Returns `(rgba, out_w, out_h, pad)`: the cell grows by `pad = r·round(dpi)` texels each side
+/// (the binary's cell `em+2/+4` and origin col `1/2`, generalized); the caller shifts bearings by
+/// `pad`. The advance is untouched — the step law owns tracking (THICK `+1`, NORMAL none).
+pub(super) fn outlined_cell(
+    cov: &[u8],
+    w: u32,
+    h: u32,
+    r: u8,
+    dpi: f32,
+) -> (Vec<u8>, u32, u32, u32) {
+    let passes = (u32::from(r) * (dpi.round().max(1.0) as u32)).max(1);
+    let pad = passes;
+    let (out_w, out_h) = (w + 2 * pad, h + 2 * pad);
+    let cells = (out_w * out_h) as usize;
+
+    // 1. Mark coverage into the map (1 = glyph ink), coverage kept alongside for the pack.
+    let mut map = vec![0u8; cells];
+    for row in 0..h {
+        for col in 0..w {
+            if cov[(row * w + col) as usize] != 0 {
+                map[((row + pad) * out_w + (col + pad)) as usize] = 1;
+            }
+        }
+    }
+
+    // 2. Iterative 8-neighbour dilation: pass k marks virgin cells adjacent to any marked cell
+    //    (the binary's mask-1-write-2 / mask-3-write-4 passes, generalized to k marks).
+    for pass in 0..passes {
+        let mark = (pass + 2) as u8; // 1 = ink, 2.. = ring generations
+        for row in 0..out_h {
+            for col in 0..out_w {
+                let c = (row * out_w + col) as usize;
+                if map[c] != 0 {
+                    continue;
+                }
+                'probe: for dr in -1i32..=1 {
+                    for dc in -1i32..=1 {
+                        let (rr, cc) = (row as i32 + dr, col as i32 + dc);
+                        if rr < 0 || rr >= out_h as i32 || cc < 0 || cc >= out_w as i32 {
+                            continue;
+                        }
+                        let n = map[(rr as u32 * out_w + cc as u32) as usize];
+                        if n != 0 && n < mark {
+                            map[c] = mark;
+                            break 'probe;
+                        }
+                    }
+                }
+            }
+        }
+    }
+
+    // 3.+4. Neighbourhood-count alpha + pack.
+    let mut rgba = vec![0u8; cells * 4];
+    for row in 0..out_h {
+        for col in 0..out_w {
+            let c = (row * out_w + col) as usize;
+            if map[c] == 0 {
+                continue;
+            }
+            let mut count = 0usize;
+            for dr in -1i32..=1 {
+                for dc in -1i32..=1 {
+                    let (rr, cc) = (row as i32 + dr, col as i32 + dc);
+                    if rr < 0 || rr >= out_h as i32 || cc < 0 || cc >= out_w as i32 {
+                        continue;
+                    }
+                    if map[(rr as u32 * out_w + cc as u32) as usize] != 0 {
+                        count += 1;
+                    }
+                }
+            }
+            let alpha = AA_NEIGHBOUR_LUT[count];
+            let fill = if row >= pad && row < pad + h && col >= pad && col < pad + w {
+                cov[((row - pad) * w + (col - pad)) as usize]
+            } else {
+                0
+            };
+            let idx = c * 4;
+            // Pure ring: black. Fill: the coverage as gray (ramps toward the ring at AA edges).
+            rgba[idx] = fill;
+            rgba[idx + 1] = fill;
+            rgba[idx + 2] = fill;
+            rgba[idx + 3] = alpha;
+        }
+    }
+    (rgba, out_w, out_h, pad)
+}
+
+#[cfg(test)]
+mod outlined_cell_tests {
+    use super::*;
+
+    /// Read texel (x, y) of an RGBA cell.
+    fn px(rgba: &[u8], w: u32, x: u32, y: u32) -> [u8; 4] {
+        let i = ((y * w + x) * 4) as usize;
+        [rgba[i], rgba[i + 1], rgba[i + 2], rgba[i + 3]]
+    }
+
+    #[test]
+    fn normal_ring_takes_the_lut_grades() {
+        // A 1×1 fully-inked glyph, NORMAL (1 pass), dpi 1 → a 3×3 cell, all 9 texels marked.
+        // Per the byte recipe the alpha is AA_NEIGHBOUR_LUT[in-bounds 3×3 marked count]:
+        // centre 9 → 255, edge-mid 6 → 153, corner 4 → 85 — the graded ring, not hard black.
+        let (rgba, w, h, pad) = outlined_cell(&[255], 1, 1, 1, 1.0);
+        assert_eq!((w, h, pad), (3, 3, 1));
+        assert_eq!(px(&rgba, w, 1, 1), [255, 255, 255, 255], "fill core");
+        assert_eq!(px(&rgba, w, 1, 0), [0, 0, 0, 153], "edge-mid ring: count 6");
+        assert_eq!(px(&rgba, w, 0, 1), [0, 0, 0, 153]);
+        assert_eq!(px(&rgba, w, 0, 0), [0, 0, 0, 85], "corner ring: count 4");
+        assert_eq!(px(&rgba, w, 2, 2), [0, 0, 0, 85]);
+    }
+
+    #[test]
+    fn thick_outer_ring_is_the_soft_second_pass() {
+        // THICK = a second dilation pass (the binary's mask-3→4 pass): 5×5, all marked; the
+        // inner ring sits fully surrounded (count 9 → opaque) while the outer edge grades
+        // 153/85 — the real client's softer THICK outer edge.
+        let (rgba, w, h, pad) = outlined_cell(&[255], 1, 1, 2, 1.0);
+        assert_eq!((w, h, pad), (5, 5, 2));
+        assert_eq!(px(&rgba, w, 2, 2), [255, 255, 255, 255], "fill core");
+        assert_eq!(
+            px(&rgba, w, 1, 1),
+            [0, 0, 0, 255],
+            "inner ring: fully surrounded"
+        );
+        assert_eq!(
+            px(&rgba, w, 2, 0),
+            [0, 0, 0, 153],
+            "outer edge-mid: count 6"
+        );
+        assert_eq!(px(&rgba, w, 0, 0), [0, 0, 0, 85], "outer corner: count 4");
+    }
+
+    #[test]
+    fn retina_scales_the_pass_count_with_the_raster() {
+        // dpi 2, NORMAL: 2 passes ⇒ a 2-physical-px (1 logical) ring, dense — the iterative
+        // dilation leaves no stride holes (the legacy stamp offsets did).
+        let (rgba, w, h, pad) = outlined_cell(&[255], 1, 1, 1, 2.0);
+        assert_eq!((w, h, pad), (5, 5, 2));
+        assert_eq!(px(&rgba, w, 2, 2), [255, 255, 255, 255]);
+        assert_ne!(px(&rgba, w, 1, 1)[3], 0, "no hole inside the 2-px ring");
+        assert_eq!(px(&rgba, w, 0, 0), [0, 0, 0, 85]);
+    }
+
+    #[test]
+    fn aa_fill_ramps_gray_toward_the_ring() {
+        // Half coverage (128): the fill texel takes the coverage as GRAY at the LUT alpha —
+        // the byte recipe's `RGB = coverage, A = LUT[count]` — never white-with-thin-alpha.
+        let (rgba, w, _, _) = outlined_cell(&[128], 1, 1, 1, 1.0);
+        assert_eq!(
+            px(&rgba, w, 1, 1),
+            [128, 128, 128, 255],
+            "gray fill, LUT alpha"
+        );
+        assert_eq!(px(&rgba, w, 1, 0), [0, 0, 0, 153], "ring stays black");
+    }
+}
diff --git a/crates/benilla-app/src/ui_text/pack.rs b/crates/benilla-app/src/ui_text/pack.rs
new file mode 100644
index 00000000..6ce17024
--- /dev/null
+++ b/crates/benilla-app/src/ui_text/pack.rs
@@ -0,0 +1,367 @@
+//! The glyph cache's texture — one shelf-packed sheet, and the sub-rect uploads that carry each
+//! new cell to the GPU.
+//!
+//! **Why it never repacks.** The cache fills on demand ([`super::engine::TextEngine`]), so cells
+//! arrive one at a time forever; the allocator's job is to hand each one a permanent home.
+//! Permanent is the load-bearing word: a cell's UV is copied into places this module cannot reach —
+//! most sharply into the overhead-name meshes' `ATTRIBUTE_UV_0` ([`crate::nameplates`]), which
+//! persist on the GPU across frames. So the sheet is **append-only**: it is packed into shelves, it
+//! is never compacted, and a UV is normalized against the sheet's FIXED side length rather than
+//! against how full it happens to be. (The old whole-charset bake normalized against a packed
+//! height that moved with the size ladder, which is why a re-bake turned every cached nameplate
+//! mesh into fragments of other letters — decision 1339's fault 2.)
+//!
+//! ## The upload path, and why it is not the obvious one
+//!
+//! The obvious way to add a cell in Bevy is to mutate the sheet's `Image` through
+//! `Assets::get_mut`. That is wrong here, for a reason that has nothing to do with cost. In Bevy
+//! 0.18.1 `Assets::get_mut` queues `AssetEvent::Modified`, `extract_render_asset` deep-clones the
+//! whole `Image`, and `GpuImage::prepare_asset` calls `create_texture_with_data` — it **allocates a
+//! new `wgpu::Texture`** and never consults the previous one. Meanwhile [`crate::ui_pass`]'s
+//! material pool is keyed on `AssetId<Image>` and its `AsBindGroup` bind group is rebuilt only when
+//! the *material* asset changes; nothing in Bevy invalidates a `Material2d` bind group when an
+//! `Image` it references is modified. A full re-upload would therefore leave the UI sampling a dead
+//! texture through a cached bind group, while the stale view pinned the old allocation alive. (That
+//! is also why the old bake published a brand-new `Handle<Image>` every time: the handle churn was
+//! a workaround for the missing invalidation — and the thing that made every atlas-derived cache in
+//! the app go stale at once, on every window resize.)
+//!
+//! So cells go up as **sub-rect `RenderQueue::write_texture` writes into the existing texture**, the
+//! way glyphon does it. Texture identity never moves, so there is nothing to invalidate: a handle
+//! minted once is correct for the life of the process. The sheet is created data-less
+//! ([`Image::new_uninit`] — a GPU texture with no CPU mirror, lazily zero-initialized by wgpu), and
+//! `Assets::get_mut` must **never** be called on it: a stray `Modified` would hand us a fresh blank
+//! texture and silently erase every glyph.
+//!
+//! ## One sheet, not a growing set of pages
+//!
+//! The real client keeps up to 8 pages per font (`CGxFont+0x18c`), and pages are the obvious answer
+//! to "what happens when it fills". We keep one, because **the world pass binds one texture per
+//! mesh**: a nameplate's glyph UVs are baked into a single `Mesh` with a single
+//! `StandardMaterial`, so a name whose letters straddled two pages would need its mesh split and
+//! its material set doubled — real complexity in [`crate::nameplates`] to serve an event that would
+//! fire when a page boundary happened to fall inside one font's cell run. Growing the sheet is not
+//! an alternative either: a grown texture is a *new* texture, which is the identity change this
+//! whole path exists to avoid.
+//!
+//! So [`Sheet::reset`] is the eviction policy: when the shelves fill, drop everything at once and
+//! refill from what is actually on screen. A shelf allocator cannot reclaim an interior cell, so
+//! there is no piecemeal eviction to reach for, and the thing that fills the sheet is not glyph
+//! variety but **raster-size churn** — every window resize retires a whole set of cells nothing will
+//! ask for again. Dropping all of them is exactly right. It is the only event that can move a UV,
+//! which is why it is a frame-boundary operation with a generation counter attached; see
+//! [`super::engine::TextEngine::note_exhausted`].
+
+use bevy::asset::RenderAssetUsages;
+use bevy::image::Image;
+use bevy::math::Rect;
+use bevy::prelude::*;
+use bevy::render::render_resource::{Extent3d, TextureDimension, TextureFormat};
+
+/// The sheet's side length in **physical texels**. 2048² of RGBA8 is 16 MB of VRAM, allocated the
+/// first time a glyph is drawn and never reallocated.
+///
+/// Sized by how long it postpones a [reset][Sheet::reset]. At ~110 texels for a typical body-text
+/// cell (an 8×11 glyph plus its padding) a sheet holds tens of thousands of cells — order a hundred
+/// distinct `(face, raster size)` sets, where one window size in one session uses a handful. The
+/// occupancy instrument (`WOW_GLYPH_CACHE=1`) exists so this number gets re-chosen from a
+/// measurement rather than from an argument.
+pub(super) const SHEET_SIZE: u32 = 2048;
+
+/// Padding between neighbouring cells, in texels — one row/column left untouched, so a bilinear tap
+/// at a cell edge cannot reach into its neighbour.
+const PAD: u32 = 1;
+
+/// A cell's texel payload, in the two shapes the rasterizer produces.
+pub(super) enum Cell<'a> {
+    /// One byte per texel: coverage, expanded to white × alpha (the vertex color supplies the ink).
+    Coverage(&'a [u8]),
+    /// Four bytes per texel, straight alpha: a pre-composited outlined cell (black ring + white
+    /// fill), taken verbatim.
+    Rgba(&'a [u8]),
+}
+
+/// One cell's texels, waiting for the render world to write them into the sheet.
+pub(super) struct CellUpload {
+    pub(super) image: AssetId<Image>,
+    pub(super) x: u32,
+    pub(super) y: u32,
+    pub(super) w: u32,
+    pub(super) h: u32,
+    pub(super) rgba: Vec<u8>,
+}
+
+/// The glyph sheet: one texture, a shelf cursor, and the pending uploads.
+pub(super) struct Sheet {
+    /// Reserved up front, before any pixels exist, because the engine that allocates cells lives
+    /// behind a lock the script VM reaches into mid-tick and can never hold `Assets<Image>`.
+    handle: Handle<Image>,
+    /// Whether the `Image` asset exists yet. Announced once, on the first cell.
+    created: bool,
+    announce: bool,
+    /// Left edge of the next cell on the current shelf.
+    cursor_x: u32,
+    /// Top edge of the current shelf.
+    cursor_y: u32,
+    /// Tallest cell placed on the current shelf.
+    row_h: u32,
+    uploads: Vec<CellUpload>,
+}
+
+impl Sheet {
+    /// Reserve the handle. Costs nothing but an id: no texels are allocated and no `Image` asset
+    /// exists until a cell actually lands.
+    pub(super) fn new(images: &Assets<Image>) -> Self {
+        Self {
+            handle: images.reserve_handle(),
+            created: false,
+            announce: false,
+            cursor_x: 0,
+            cursor_y: 0,
+            row_h: 0,
+            uploads: Vec::new(),
+        }
+    }
+
+    /// The texture every glyph quad samples.
+    pub(super) fn handle(&self) -> Handle<Image> {
+        self.handle.clone()
+    }
+
+    /// Place one cell and queue its texels. `None` means the sheet is full (or the cell could never
+    /// fit) — the caller's cue to ask for a reset, and to draw nothing for this glyph meanwhile,
+    /// which is a missing letter for at most one frame.
+    pub(super) fn alloc(&mut self, w: u32, h: u32, cell: &Cell<'_>) -> Option<Rect> {
+        if w == 0 || h == 0 || w > SHEET_SIZE || h > SHEET_SIZE {
+            return None; // a zero-ink glyph (a space), or a cell bigger than the whole sheet
+        }
+        // Walked on a copy of the cursor and committed only on success, so a cell too tall for
+        // the remaining height does not close the open shelf on its way out — a narrower or
+        // shorter one behind it can still land there.
+        let (mut x, mut y, mut row_h) = (self.cursor_x, self.cursor_y, self.row_h);
+        if x + w > SHEET_SIZE {
+            x = 0; // next shelf
+            y += row_h + PAD;
+            row_h = 0;
+        }
+        if y + h > SHEET_SIZE {
+            return None;
+        }
+        self.cursor_x = x + w + PAD;
+        self.cursor_y = y;
+        self.row_h = row_h.max(h);
+
+        let rgba = match cell {
+            // Plain coverage: white × alpha, so the vertex color is the ink color.
+            Cell::Coverage(cov) => {
+                let mut out = vec![255u8; (w * h * 4) as usize];
+                for (i, &a) in cov.iter().enumerate().take((w * h) as usize) {
+                    out[i * 4 + 3] = a;
+                }
+                out
+            }
+            // Pre-composited outlined cell: verbatim (black ring, white fill).
+            Cell::Rgba(rgba) => rgba[..(w * h * 4) as usize].to_vec(),
+        };
+        if !self.created {
+            self.created = true;
+            self.announce = true;
+        }
+        self.uploads.push(CellUpload {
+            image: self.handle.id(),
+            x,
+            y,
+            w,
+            h,
+            rgba,
+        });
+        // Normalized against the FIXED side, never against how full the sheet is — the whole reason
+        // a cached UV stays valid for the life of the texture (module doc).
+        let s = SHEET_SIZE as f32;
+        Some(Rect::new(
+            x as f32 / s,
+            y as f32 / s,
+            (x + w) as f32 / s,
+            (y + h) as f32 / s,
+        ))
+    }
+
+    /// Take whether the `Image` asset still has to be created, and the cells waiting to be written.
+    pub(super) fn take_pending(&mut self) -> (bool, Vec<CellUpload>) {
+        (
+            std::mem::take(&mut self.announce),
+            std::mem::take(&mut self.uploads),
+        )
+    }
+
+    /// Free every shelf. The texture, its handle and its texels all survive — only the allocator's
+    /// memory of what is where resets, so a quad emitted before the reset keeps drawing correctly
+    /// until its own re-emit replaces it. The caller owns telling the world; see the generation
+    /// counter on [`super::engine::TextEngine`].
+    pub(super) fn reset(&mut self) {
+        self.cursor_x = 0;
+        self.cursor_y = 0;
+        self.row_h = 0;
+    }
+
+    /// `(texels committed, texels available)` — the occupancy instrument's numbers. Committed
+    /// counts closed shelves whole plus the open one, i.e. it includes inter-cell padding and shelf
+    /// slack, which is the honest answer to "how full is it".
+    pub(super) fn occupancy(&self) -> (u64, u64) {
+        let used = u64::from(self.cursor_y) * u64::from(SHEET_SIZE)
+            + u64::from(self.cursor_x) * u64::from(self.row_h);
+        (used, u64::from(SHEET_SIZE) * u64::from(SHEET_SIZE))
+    }
+}
+
+/// The sheet's `Image`: a GPU texture with **no CPU mirror** (`data: None`), lazily zero-initialized
+/// by wgpu and thereafter written only by sub-rect `write_texture`. Straight (non-premultiplied)
+/// alpha in sRGB, matching what the quad pass has always sampled.
+///
+/// `MAIN_WORLD | RENDER_WORLD` rather than `RENDER_WORLD` alone: a `RENDER_WORLD`-only image has its
+/// data taken on first extract and cannot be re-extracted. There is no data to take here, so the
+/// usage costs nothing and leaves a device-lost recreate possible.
+pub(super) fn sheet_image() -> Image {
+    Image::new_uninit(
+        Extent3d {
+            width: SHEET_SIZE,
+            height: SHEET_SIZE,
+            depth_or_array_layers: 1,
+        },
+        TextureDimension::D2,
+        TextureFormat::Rgba8UnormSrgb,
+        RenderAssetUsages::MAIN_WORLD | RenderAssetUsages::RENDER_WORLD,
+    )
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn sheet() -> Sheet {
+        // The handle is the only thing `Assets` is consulted for, and a bare `Assets` needs no app.
+        Sheet::new(&Assets::<Image>::default())
+    }
+
+    fn cov(w: u32, h: u32) -> Vec<u8> {
+        vec![255u8; (w * h) as usize]
+    }
+
+    /// A cell's UV normalizes against the fixed side, so it is the same rect no matter what lands
+    /// afterwards. This is the property the nameplate meshes bake into the GPU, and the one whose
+    /// absence made a re-bake draw letters as fragments of other letters (1339).
+    #[test]
+    fn a_uv_is_fixed_against_the_sheet_and_never_moves() {
+        let mut s = sheet();
+        let c = cov(8, 11);
+        let first = s.alloc(8, 11, &Cell::Coverage(&c)).expect("room");
+        let side = SHEET_SIZE as f32;
+        assert_eq!(first, Rect::new(0.0, 0.0, 8.0 / side, 11.0 / side));
+        for _ in 0..2000 {
+            s.alloc(8, 11, &Cell::Coverage(&c)).expect("room");
+        }
+        // Nothing repacked: the first cell's texels are still where its UV says they are.
+        let (_, uploads) = s.take_pending();
+        assert_eq!((uploads[0].x, uploads[0].y), (0, 0));
+        assert_eq!((uploads[0].w, uploads[0].h), (8, 11));
+    }
+
+    /// Coverage becomes white × alpha; a composited cell goes up verbatim. The upload IS the
+    /// texture write, so this is where that conversion has to be right.
+    #[test]
+    fn coverage_uploads_as_white_times_alpha() {
+        let mut s = sheet();
+        s.alloc(2, 1, &Cell::Coverage(&[0, 128])).expect("room");
+        let (_, uploads) = s.take_pending();
+        assert_eq!(uploads[0].rgba, vec![255, 255, 255, 0, 255, 255, 255, 128]);
+
+        let mut s = sheet();
+        let ring = vec![0u8, 0, 0, 153, 200, 200, 200, 255];
+        s.alloc(2, 1, &Cell::Rgba(&ring)).expect("room");
+        let (_, uploads) = s.take_pending();
+        assert_eq!(uploads[0].rgba, ring, "a composited cell is not re-tinted");
+    }
+
+    /// Shelves wrap downward when a cell will not fit beside its neighbour, and the sheet refuses
+    /// rather than overrunning its own bounds.
+    #[test]
+    fn shelves_wrap_downward_and_the_sheet_eventually_refuses() {
+        let mut s = sheet();
+        // Just under half the sheet wide, so exactly two fit on a shelf and the third must wrap.
+        let (w, h) = (SHEET_SIZE / 2 - PAD, 64);
+        let c = cov(w, h);
+        let first = s.alloc(w, h, &Cell::Coverage(&c)).expect("first");
+        let second = s.alloc(w, h, &Cell::Coverage(&c)).expect("second");
+        let third = s.alloc(w, h, &Cell::Coverage(&c)).expect("third");
+        assert_eq!(first.min.y, second.min.y, "the first two share a shelf");
+        assert!(second.min.x > first.min.x, "…side by side");
+        assert!(
+            third.min.y > first.min.y,
+            "the third wrapped to the next shelf"
+        );
+
+        // …and it fills rather than growing. The bound is generous; what matters is that the loop
+        // terminates at all, which is the property a growable allocator would not have.
+        let mut placed = 3usize;
+        while s.alloc(w, h, &Cell::Coverage(&c)).is_some() {
+            placed += 1;
+            assert!(placed < 10_000, "the sheet must fill, not grow");
+        }
+        let (used, total) = s.occupancy();
+        assert!(
+            used * 10 > total * 9,
+            "the shelves should be ~full at refusal, not fragmented away: {used}/{total}"
+        );
+    }
+
+    /// A cell taller or wider than the sheet can never be placed, and says so instead of silently
+    /// corrupting a neighbour — without consuming shelf space finding out.
+    #[test]
+    fn an_oversized_or_empty_cell_is_refused_for_free() {
+        let mut s = sheet();
+        let c = cov(4, 4);
+        assert!(s.alloc(SHEET_SIZE + 1, 4, &Cell::Coverage(&c)).is_none());
+        assert!(s.alloc(4, SHEET_SIZE + 1, &Cell::Coverage(&c)).is_none());
+        assert!(s.alloc(0, 0, &Cell::Coverage(&[])).is_none());
+        assert_eq!(s.occupancy().0, 0);
+        assert!(s.take_pending().1.is_empty());
+    }
+
+    /// The `Image` is announced for creation exactly once — the asset is created on the first cell
+    /// and written into ever after. Announcing it twice would recreate the texture and erase
+    /// everything on it.
+    #[test]
+    fn the_texture_is_announced_for_creation_exactly_once() {
+        let mut s = sheet();
+        let c = cov(8, 11);
+        s.alloc(8, 11, &Cell::Coverage(&c)).expect("room");
+        let (announce, uploads) = s.take_pending();
+        assert!(announce, "created on the first cell");
+        assert_eq!(uploads.len(), 1);
+        s.alloc(8, 11, &Cell::Coverage(&c)).expect("room");
+        let (announce, uploads) = s.take_pending();
+        assert!(!announce, "…and never again");
+        assert_eq!(uploads.len(), 1, "but the cell still goes up");
+    }
+
+    /// A reset frees the shelves and keeps everything the GPU knows about — the handle, and the
+    /// texels themselves. A quad emitted before the reset keeps drawing correctly.
+    #[test]
+    fn a_reset_frees_the_shelves_and_keeps_the_texture() {
+        let mut s = sheet();
+        let c = cov(8, 11);
+        s.alloc(8, 11, &Cell::Coverage(&c)).expect("room");
+        let handle = s.handle();
+        assert!(s.take_pending().0);
+        assert!(s.occupancy().0 > 0);
+
+        s.reset();
+        assert_eq!(s.occupancy().0, 0, "the shelves are free");
+        assert_eq!(s.handle(), handle, "the texture survives");
+        // Critically: no re-announcement. Re-creating the image would blank the sheet.
+        s.alloc(8, 11, &Cell::Coverage(&c)).expect("room");
+        let (announce, uploads) = s.take_pending();
+        assert!(!announce, "a reset must not recreate the texture");
+        assert_eq!((uploads[0].x, uploads[0].y), (0, 0), "the shelf is reused");
+    }
+}
diff --git a/crates/benilla-app/src/vplates.rs b/crates/benilla-app/src/vplates.rs
index 2b144348..7492242f 100644
--- a/crates/benilla-app/src/vplates.rs
+++ b/crates/benilla-app/src/vplates.rs
@@ -12,7 +12,10 @@
 //!   occlusion** (a 2-D overlay — plates draw through walls); snap, no smoothing. Anti-overlap
 //!   there *is*, since 0367 found the shared solver ([`crate::smart_rect`]) — this file's older
 //!   "no anti-overlap" was the census that missed it. And the sphere is bounded by the frustum:
-//!   the unit must be **in view** ([`in_view`]), or its plate is not seated at all.
+//!   the unit must be **in view** ([`crate::ui_pass::project_overlay`]) or the reference
+//!   **destroys** the plate outright (`0x60f600`, before the 20-yard cull — wow-re
+//!   `nameplate-offscreen-cull.md`, §5-VERIFIED 2026-08-15); it is never clamped in from
+//!   off-screen, which is what ours did (1341/1344).
 //!   (The friendly-totem exclusion waits on totems existing.)
 //! - **Anchor**: the same overhead head point (`0x608640`, [`overhead_anchor`]) **+ 2/3 yd**
 //!   (`[0x80abfc]`), projected per frame (`0x483ee0`); the plate's **TOP-CENTER** lands on the
@@ -252,31 +255,6 @@ fn device_snap(v: f32, scale: f32) -> f32 {
     (v * scale).round() / scale
 }
 
-/// **Is the unit in view?** — the gate between the 20-yd sphere and the seat.
-///
-/// The plate gate is a 20-yard *sphere*; the view is a 45° frustum, so most of what the sphere
-/// admits is beside or behind you. That would be harmless if an off-screen desire simply drew
-/// off-screen — but the seat's on-screen clamp ([`crate::smart_rect`]'s `normalize`, the ref's
-/// `0x509e20`) does not merely tidy a plate straddling an edge: it **translates a rect from
-/// anywhere bodily onto the screen**. Without this gate a unit two screens off to the side got a
-/// phantom plate pinned to the border — measured walking Goldshire at 1440×810 (the `vpl` trace,
-/// [`drive_vplates`]): **30% of every drawn plate while moving, two thirds while standing still**.
-/// They are not passive either: each claims bucket 0, so the anti-overlap solve pushed the plates
-/// of units you *can* see off phantoms you cannot, and they were live hover targets through
-/// [`PlateRects`].
-///
-/// That was the whole of the reported jitter — 26% of frame-steps moved a plate more than 4 px
-/// past its own projected motion, up to 300 px in a single frame, and 90% of those involved a
-/// phantom (after: 3.5% and 51 px, which is the solver's own documented snap-back). The projection
-/// is smooth throughout — median frame-to-frame acceleration 0.05 px — so none of it was ever a
-/// camera or an anchor problem.
-///
-/// The clamp keeps its job: a plate whose unit *is* in view still gets pulled fully inside the
-/// border, which is what it is for.
-fn in_view(screen: Vec2, viewport: Vec2) -> bool {
-    (0.0..=viewport.x).contains(&screen.x) && (0.0..=viewport.y).contains(&screen.y)
-}
-
 /// The knee of the plate's gx basis — **a director-pinned DEVIATION from the byte law**
 /// (0185/0186). The real client's plates grow diagonal-linear without limit (wow-re §9,
 /// byte-closed: ~294 px plate + em-29 name at 2560×1440, bilinear-softened) — the director
@@ -578,11 +556,16 @@ fn drive_vplates(
         if !friendly && store.is_some_and(|s| s.0.unit_reads_dead()) {
             continue;
         }
-        // Project the plate point: the overhead anchor + 2/3 yd, per frame, no smoothing. Behind
-        // the camera the projection itself fails and the plate is gone. (This comment used to
-        // claim "the plate has no clamp — offscreen is gone", which had not been true since the
-        // seat gained the solver's on-screen normalize: offscreen was dragged to the border. The
-        // gate below is what makes the sentence true again.)
+        // Project the plate point: the overhead anchor + 2/3 yd, per frame, no smoothing — and
+        // honour the projector's ACCEPT verdict ([`crate::ui_pass::project_overlay`]): behind the
+        // camera or outside the viewport, there is no plate. That is the reference's own law, and
+        // a hard one — `0x60f600` **destroys** the plate frame on a false verdict, before it ever
+        // reaches the seat (wow-re `nameplate-offscreen-cull.md`, §5-VERIFIED 2026-08-15).
+        //
+        // Ours instead ran an off-screen point into the seat, whose clamp translates a rect from
+        // anywhere bodily onto the screen: **30% of every drawn plate** was a unit nobody could
+        // see, pinned to a border, claiming bucket space and shoving the plates of units you can
+        // (1341 — two thirds of them while standing still, and 90% of the reported jitter).
         let anchor = overhead_anchor(
             entity,
             tf,
@@ -591,13 +574,11 @@ fn drive_vplates(
             &anchor_q.2,
             &anchor_q.3,
         );
-        let Ok(screen) = cam.world_to_viewport(&cam_tf, anchor + Vec3::Y * PLATE_LIFT) else {
+        let Some(screen) =
+            crate::ui_pass::project_overlay(cam, &cam_tf, anchor + Vec3::Y * PLATE_LIFT, viewport)
+        else {
             continue;
         };
-        // …and the unit has to be in view ([`in_view`]).
-        if !in_view(screen, viewport) {
-            continue;
-        }
         cands.push((
             screen.distance_squared(sort_pt),
             screen,
@@ -880,15 +861,15 @@ fn plate_text(
     color: [f32; 4],
     trace: bool,
 ) {
-    // Shape at the nearest baked atlas size, then rescale the quads to the exact target em
-    // around the anchor (the combat_text unbaked-size recipe) — plate ems are window-derived
-    // (8 at 768, 11 at 1080, [`text_px`]) and mostly absent from the baked set.
-    let shaped = atlas.snap_size(px);
+    // Laid out AT the target em. Plate ems are window-derived (8 at 768, 11 at 1080,
+    // [`text_px`]) and so landed on almost nothing in the old fixed size ladder: every plate on
+    // screen used to be shaped at the nearest rung and rescaled about the anchor. Since decision
+    // 1342 the raster follows the request, so the rescale — and its sub-pixel scatter — is gone.
+    let mut e = atlas.lock();
     let spec = FontSpec {
         path: None,
-        height: Some(shaped),
+        height: Some(px),
         outline: Outline::None,
-        paint_halo: true,
         alpha_gradient: None,
     };
     let justify = Justify {
@@ -896,7 +877,7 @@ fn plate_text(
         v: JustifyV::Middle,
     };
     let mut main = layout_text_quads(
-        atlas,
+        &mut e,
         text,
         Rect::from_center_size(anchor, Vec2::ZERO),
         color,
@@ -904,18 +885,10 @@ fn plate_text(
         Z_TEXT,
         spec,
     );
+    drop(e);
     if main.is_empty() {
         return;
     }
-    let s = px / shaped;
-    for q in main.iter_mut() {
-        q.rect = Rect::new(
-            anchor.x + (q.rect.min.x - anchor.x) * s,
-            anchor.y + (q.rect.min.y - anchor.y) * s,
-            anchor.x + (q.rect.max.x - anchor.x) * s,
-            anchor.y + (q.rect.max.y - anchor.y) * s,
-        );
-    }
     // Seat by measured INK, then the shadow is the same run offset one step right+down.
     let dy = {
         let bottom = main.iter().map(|q| q.rect.max.y).fold(f32::MIN, f32::max);
@@ -956,7 +929,7 @@ fn plate_text(
             y1 = y1.max(q.rect.max.y);
         }
         eprintln!(
-            "vplate-trace: text {text:?} px={px:.1} shaped={shaped:.1} ink=({x0:.1},{y0:.1})..({x1:.1},{y1:.1}) anchor=({:.1},{:.1})",
+            "vplate-trace: text {text:?} px={px:.1} ink=({x0:.1},{y0:.1})..({x1:.1},{y1:.1}) anchor=({:.1},{:.1})",
             anchor.x, anchor.y
         );
     }
@@ -1024,27 +997,6 @@ mod tests {
         assert_eq!(CON_GREEN[1], 178.0 / 255.0);
     }
 
-    /// The in-view gate: the 20-yd sphere reaches far outside the frustum, and everything it
-    /// admits from out there used to be dragged onto a screen border by the seat's clamp. The
-    /// bounds are inclusive — a unit exactly on the edge is still in view, and the clamp (not this)
-    /// is what keeps its plate fully inside.
-    #[test]
-    fn only_a_unit_in_view_gets_a_plate() {
-        let vp = Vec2::new(1440.0, 810.0);
-        assert!(in_view(Vec2::new(720.0, 405.0), vp));
-        assert!(in_view(Vec2::ZERO, vp), "the corner is in view");
-        assert!(in_view(vp, vp), "so is the far corner");
-        for out in [
-            Vec2::new(-0.5, 405.0),    // off left
-            Vec2::new(1440.5, 405.0),  // off right
-            Vec2::new(720.0, -0.5),    // above
-            Vec2::new(720.0, 810.5),   // below
-            Vec2::new(1409.0, 1332.0), // the measured phantom: two thirds of a screen below
-        ] {
-            assert!(!in_view(out, vp), "{out:?} is not on screen");
-        }
-    }
-
     /// The snap is on the DEVICE grid, not the logical one. At the 2× scale we develop on, a
     /// logical `round()` moved the plate two physical pixels at a time; this moves it one, which
     /// is the smallest step that still lands the border blit on a texel boundary. Pinned so the