diff --git a/crates/benilla-app/src/area.rs b/crates/benilla-app/src/area.rs
index b3f15232..6145b931 100644
--- a/crates/benilla-app/src/area.rs
+++ b/crates/benilla-app/src/area.rs
@@ -83,6 +83,13 @@ fn load_area_table(mut commands: Commands, assets: Option<Res<WorldAssets>>) {
 /// What the client's zone-text cache holds — the compare targets of `0x494780` (zone id + the
 /// two display strings), the minimap line's own cache (`0x494970`), and the indoor dedup pair
 /// (`[0x868608]` prev-indoor / `[0x86860c]` prev WMO-area row id).
+///
+/// Held as a [`crate::ui_script::VmMemo`], which is not a deviation from that BSS model but the
+/// completion of it: the cache's whole purpose is deduping what was last *pushed into the VM*, and
+/// the VM is built at world entry and destroyed at the character screen (decision 1290). A fresh VM
+/// is the client's own fresh BSS — the zeroed cache below is exactly the state the real client is in
+/// at that moment, so the first resolve of every login is a NEW_AREA with the globals written, which
+/// is what the zone splash and the minimap line need.
 #[derive(Default)]
 struct ZoneCache {
     /// `None` = never resolved (the zeroed BSS cache: the first resolve is a NEW_AREA).
@@ -134,11 +141,12 @@ fn feed_zone_events(
     areas: Option<Res<AreaTableRes>>,
     factions: Option<Res<Factions>>,
     self_store: Query<&ObjectStore, With<SelfPlayer>>,
-    mut cache: Local<ZoneCache>,
+    mut cache: Local<crate::ui_script::VmMemo<ZoneCache>>,
 ) {
     let (Some(mut script), Some(areas)) = (script, areas) else {
         return;
     };
+    let cache = cache.get(&script);
     let Some(leaf) = world.area() else { return };
     let Some(leaf_row) = areas.0.get(leaf) else {
         // An id the catalog doesn't know stays unpublished (keep the last real state, like the
@@ -228,7 +236,7 @@ fn feed_zone_events(
         signal.subzone_text.clone()
     };
 
-    let event = elect_event(&cache, &signal);
+    let event = elect_event(cache, &signal);
     let minimap_changed = cache.minimap_text != minimap_text;
     if event.is_none() && !minimap_changed {
         return;
diff --git a/crates/benilla-app/src/bindings.rs b/crates/benilla-app/src/bindings.rs
index 19939ab3..a3c465ba 100644
--- a/crates/benilla-app/src/bindings.rs
+++ b/crates/benilla-app/src/bindings.rs
@@ -83,7 +83,10 @@ struct BindingDispatch {
     /// order — re-snapshotted with the map, so the two can never disagree about what an index
     /// means. Empty in every session with no addon bindings, which is every session today.
     addons: Vec<AddonBindingBody>,
-    seen_generation: Option<u64>,
+    /// The engine table's generation this map was built from. **Session-keyed** (1290): a fresh VM
+    /// restarts its counter at 0, so a bare memo could hold a higher number than the live VM will
+    /// ever reach and gate the rebuild off for the whole session.
+    seen_generation: crate::ui_script::VmMemo<Option<u64>>,
 }
 
 impl BindingDispatch {
@@ -171,7 +174,8 @@ impl BindingsState {
 struct BindingFiles {
     account: Option<std::path::PathBuf>,
     character: Option<std::path::PathBuf>,
-    identity: Option<(String, String)>,
+    /// Whose set 2 is loaded — **in the VM that is live now**. See [`load_character_bindings`].
+    identity: crate::ui_script::VmMemo<Option<(String, String)>>,
 }
 
 /// Label for this module's systems inside [`crate::ui_script::UiInput`] — the UI key feed is
@@ -187,12 +191,15 @@ impl Plugin for BindingsPlugin {
         app.init_resource::<BindingDispatch>()
             .init_resource::<BindingsState>()
             .init_resource::<BindingFiles>()
-            // PostStartup like the macro catalog: needs the VM, which lands at the Startup
-            // schedule boundary.
-            .add_systems(PostStartup, seed_bindings)
             .add_systems(
                 Update,
                 (
+                    // Once per **VM**, not once per process (decision 1290): a login builds a
+                    // fresh one, and an unseeded VM has no command registry at all —
+                    // `sync_dispatch` would build an empty map and every keybind in the session
+                    // would be dead. Hence `Update` with a session-keyed claim rather than
+                    // `PostStartup`, ordered ahead of the pair that reads what it registers.
+                    seed_bindings.before(sync_dispatch),
                     (sync_dispatch, latch_and_dispatch)
                         .chain()
                         .in_set(crate::ui_script::UiInput)
@@ -221,10 +228,17 @@ pub(crate) fn registry_commands() -> Vec<KeybindCommand> {
         .collect()
 }
 
-/// Register the command registry with the engine table and seed the account set from disk —
-/// boot-time, before any window opens.
-fn seed_bindings(script: Option<NonSendMut<UiScript>>, mut files: ResMut<BindingFiles>) {
+/// Register the command registry with the engine table and seed the account set from disk — once
+/// per VM, before any window opens.
+fn seed_bindings(
+    script: Option<NonSendMut<UiScript>>,
+    mut files: ResMut<BindingFiles>,
+    mut seeded: Local<crate::ui_script::VmMemo<bool>>,
+) {
     let Some(mut script) = script else { return };
+    if !seeded.claim(&script) {
+        return;
+    }
     script.register_bindings(&registry_commands());
     files.account = crate::local_state::bindings_account_path();
     if let Some(overrides) = read_diff(&files.account) {
@@ -260,11 +274,13 @@ fn load_character_bindings(
     let Some(id) = crate::ui_macro::identity(&roster) else {
         return;
     };
-    if files.identity.as_ref() == Some(&id) {
+    // Session-keyed (1290): re-entering the world as the SAME character still meets a fresh VM
+    // with no set 2 in it, so "same identity" is only a reason to skip within one VM.
+    if files.identity.get(&script).as_ref() == Some(&id) {
         return;
     }
     files.character = crate::local_state::bindings_character_path(&id.0, &id.1);
-    files.identity = Some(id);
+    *files.identity.get(&script) = Some(id);
     match read_diff(&files.character) {
         Some(overrides) => {
             script.seed_binding_set(2, Some(store::resolve(&overrides)));
@@ -314,10 +330,10 @@ fn save_bindings(script: Option<NonSendMut<UiScript>>, files: Res<BindingFiles>)
 fn sync_dispatch(script: Option<NonSendMut<UiScript>>, mut dispatch: ResMut<BindingDispatch>) {
     let Some(mut script) = script else { return };
     let generation = script.keybinds_generation();
-    if dispatch.seen_generation == Some(generation) {
+    if *dispatch.seen_generation.get(&script) == Some(generation) {
         return;
     }
-    dispatch.seen_generation = Some(generation);
+    *dispatch.seen_generation.get(&script) = Some(generation);
     dispatch.map.clear();
     // The addon table first: it is what the names the registry does not know resolve into. Before
     // 1188 phase 4 an unknown name hit the `continue` below and the binding silently never fired
@@ -622,7 +638,7 @@ impl BindingDispatch {
         Self {
             map,
             addons: Vec::new(),
-            seen_generation: None,
+            seen_generation: crate::ui_script::VmMemo::default(),
         }
     }
 }
diff --git a/crates/benilla-app/src/capture/probe_castcancel.rs b/crates/benilla-app/src/capture/probe_castcancel.rs
index 7a8a5c00..7a195d04 100644
--- a/crates/benilla-app/src/capture/probe_castcancel.rs
+++ b/crates/benilla-app/src/capture/probe_castcancel.rs
@@ -53,7 +53,7 @@ fn bar_timeline(
     time: ProbeClock,
     script: Option<NonSend<benilla_ui::script::UiScript>>,
     self_player: Query<(), With<SelfPlayer>>,
-    mut last: Local<String>,
+    mut last: Local<crate::ui_script::VmMemo<String>>,
 ) {
     if self_player.is_empty() {
         return;
@@ -61,6 +61,10 @@ fn bar_timeline(
     let Some(script) = script else {
         return;
     };
+    // Session-keyed (1290) even though this is harness code: the phase string is read *out of* the
+    // VM, so a stale one would swallow the first transition of the next login — the exact event
+    // this probe exists to timestamp.
+    let last = last.get(&script);
     let Ok(state) = script.eval::<String>(BAR_PHASE_CHUNK) else {
         return;
     };
diff --git a/crates/benilla-app/src/capture/probes/live_fps.rs b/crates/benilla-app/src/capture/probes/live_fps.rs
index 9b0ce627..f410cb6e 100644
--- a/crates/benilla-app/src/capture/probes/live_fps.rs
+++ b/crates/benilla-app/src/capture/probes/live_fps.rs
@@ -253,6 +253,20 @@ fn drive_live_fps(
                 (Some(room), Some(w)) => format!(" room={room} windows={w}"),
                 _ => String::new(),
             };
+            // Beside `room=`, because the two answer the same question from opposite ends:
+            // `room=none` says the camera claims no interior, `sky=` says whether some building's
+            // PVS is painting its own backdrop over the world anyway.
+            let sky = seen
+                .sky
+                .as_deref()
+                .map(|s| format!(" sky={s}"))
+                .unwrap_or_default();
+            // The effect stream's other half. `emitters=`/`particles=` above count quad clouds
+            // only, so a screen full of ribbon trails reads as an empty scene without this.
+            let ribbons = seen
+                .ribbons
+                .map(|(n, d)| format!(" ribbons={n} ribbons_drawn={d}"))
+                .unwrap_or_default();
             let culled = match seen.cull.as_ref() {
                 Some(v) => format!(
                     " cull_windows={} cull_frusta={} cull_tested={} cull_hidden={} \
@@ -275,7 +289,7 @@ fn drive_live_fps(
                 seen.mats, seen.meshes, seen.images, seen.uv_anims, seen.tint_anims,
             );
             println!(
-                "FPS_PROBE scenario=live frames={} mean_ms={mean:.2} p50_ms={:.2} p95_ms={:.2} p99_ms={:.2} max_ms={:.2} fps={:.1} emitters={} active={} particles={} submeshes={} drawn={} streamed={} parked={} entities={}{rigs}{residency_line} px={}x{}{cpu}{sys}{present} occluded_frames={}{at_pin}{gate}{culled}",
+                "FPS_PROBE scenario=live frames={} mean_ms={mean:.2} p50_ms={:.2} p95_ms={:.2} p99_ms={:.2} max_ms={:.2} fps={:.1} emitters={} active={} particles={} submeshes={} drawn={} streamed={} parked={} entities={}{rigs}{residency_line} px={}x{}{cpu}{sys}{present} occluded_frames={}{at_pin}{gate}{sky}{ribbons}{culled}",
                 v.len(),
                 at(0.50),
                 at(0.95),
diff --git a/crates/benilla-app/src/char_select/mod.rs b/crates/benilla-app/src/char_select/mod.rs
index 44e7b25d..dcea5783 100644
--- a/crates/benilla-app/src/char_select/mod.rs
+++ b/crates/benilla-app/src/char_select/mod.rs
@@ -386,8 +386,6 @@ fn back_on_disconnect(
     mut msgs: MessageReader<crate::net::DisconnectedMessage>,
     mut roster: ResMut<Roster>,
     mut next: ResMut<NextState<ClientState>>,
-    mut ui_hover: ResMut<crate::ui_script::PlayerUiHover>,
-    mut ui_keys: ResMut<crate::ui_script::UiKeyboardCapture>,
 ) {
     if !msgs.read().any(|m| m.session_over) {
         return;
@@ -396,25 +394,23 @@ fn back_on_disconnect(
     // auto-answer the *next* roster — sending the player straight back into the world they were
     // just thrown out of, without ever seeing the screen.
     roster.pending_pick = None;
-    ui_hover.0 = None;
-    ui_keys.0 = false;
     next.set(ClientState::Login);
 }
 
 /// A confirmed `/logout` → back to the glue layer, pick cleared (the follow-up roster must be
-/// shown, not auto-answered). Also releases the in-world UI's input latches — `feed_ui_input`
-/// stops running outside `InWorld`, so whatever it last wrote would otherwise stick.
+/// shown, not auto-answered).
+///
+/// The in-world UI's input latches are released by [`crate::ui_script::end_ui_session`], on the
+/// `OnExit(InWorld)` edge this transition causes: they stick because `feed_ui_input` stops running
+/// outside `InWorld`, which is a fact about the edge and not about *why* we left it — so both this
+/// path and the disconnect above get it from one place (1290).
 fn back_on_logout(
     mut msgs: MessageReader<LoggedOutMessage>,
     mut roster: ResMut<Roster>,
     mut next: ResMut<NextState<ClientState>>,
-    mut ui_hover: ResMut<crate::ui_script::PlayerUiHover>,
-    mut ui_keys: ResMut<crate::ui_script::UiKeyboardCapture>,
 ) {
     if msgs.read().next().is_some() {
         roster.pending_pick = None;
-        ui_hover.0 = None;
-        ui_keys.0 = false;
         next.set(ClientState::CharSelect);
     }
 }
@@ -512,14 +508,26 @@ fn debug_logout_smoke(
             *phase = 2;
         }
         2 if *state.get() == ClientState::CharSelect => {
-            info!(
-                "logout-smoke: back at character select — {} tiles resident (must be 0)",
-                streamer.residency().1
-            );
+            info!("logout-smoke: back at character select — lingering");
             (*phase, *mark) = (3, now);
         }
+        // **The residency reading belongs HERE, not on arrival.** It used to print on the first
+        // frame at CharSelect and report "25 tiles resident (must be 0)" every single run — a
+        // permanent, alarming, wrong number. `release_world` runs ~150 ms later (it hangs off the
+        // world-live falling edge, not the state edge), so the probe was reading the count before
+        // the thing it is checking had happened, and reporting the world it had just left.
+        //
+        // It cost more than a wrong line: 1291 wrote the reading up as a live contradiction of
+        // 0777's release-world claim, on the strength of it reproducing identically on an older
+        // commit — which it did, because an instrument that measures too early does that reliably.
+        // A number that is always wrong teaches everyone to skip the line (0777's own lesson about
+        // tripwires nobody trips, from the other end).
         3 if now - *mark > 4.0 => match roster.chars.first().map(|c| (c.guid, c.name.clone())) {
             Some((guid, name)) => {
+                info!(
+                    "logout-smoke: {} tiles resident after the release (must be 0)",
+                    streamer.residency().1
+                );
                 info!("logout-smoke: re-entering the world as {name}");
                 send_pick(&mut roster, &pick, guid);
                 (*phase, *mark) = (4, now);
diff --git a/crates/benilla-app/src/cursor.rs b/crates/benilla-app/src/cursor.rs
index 33ab3410..aca20555 100644
--- a/crates/benilla-app/src/cursor.rs
+++ b/crates/benilla-app/src/cursor.rs
@@ -180,12 +180,19 @@ fn drive_displayed_cursor(
     script: Option<bevy::ecs::system::NonSendMut<benilla_ui::script::UiScript>>,
     // The base last applied by the UI-entry restore below — `None` while the pointer is over the
     // world, so re-entering the UI always restores once.
-    mut last: Local<Option<crate::target::WorldCursor>>,
+    mut last: Local<crate::ui_script::VmMemo<Option<crate::target::WorldCursor>>>,
     mut displayed: ResMut<DisplayedCursor>,
 ) {
     use crate::target::{CursorKind, WorldCursor};
     use benilla_ui::script::UiCursorMode;
 
+    // A VM memo — the restore edge below is armed by `take_cursor_write`, a VM read — but unlike
+    // every other feed this system still drives the cursor with **no VM at all** (the character
+    // screen: the VM lives for one login, decision 1290). `get_for` is the shape for exactly that:
+    // no VM is a session in its own right, so the base restore re-arms once on each side of the
+    // glue phase instead of every frame inside it.
+    let last = last.get_for(script.as_deref());
+
     // **The BASE mode is not a constant** (`0xbe2c4c`, wow-re cursor-system.md §7: *"it is
     // independently mutable — e.g. a spell-cancel flow parks it at Cast(2)"*), and that is the
     // piece B208 kept missing. `ResetCursor` restores *the value of this cell*, not a hardcoded
@@ -345,7 +352,10 @@ mod other {
         mut images: ResMut<Assets<Image>>,
         mut payload_cursors: ResMut<PayloadCursorImages>,
         window: Option<Single<Entity, With<PrimaryWindow>>>,
-        mut current: Local<Option<String>>,
+        // The key of the cursor we last handed the window — the macOS arm's `last_set` under the
+        // same name, because it is the same fact: OS state, not memory about the VM, so it is not a
+        // [`crate::ui_script::VmMemo`] and does not re-seat at a new login (decision 1290's sweep).
+        mut last_set: Local<Option<String>>,
         mut decode_failed: Local<HashSet<String>>,
     ) {
         let Some(window) = window else {
@@ -353,7 +363,7 @@ mod other {
         };
         let held_icon = script.as_ref().and_then(|s| payload_icon(s));
         if let Some(icon) = held_icon {
-            if current.as_deref() == Some(icon.as_str()) {
+            if last_set.as_deref() == Some(icon.as_str()) {
                 return; // already showing this icon
             }
             if !payload_cursors.0.contains_key(&icon) && !decode_failed.contains(&icon) {
@@ -373,7 +383,7 @@ mod other {
             }
             if let Some(handle) = payload_cursors.0.get(&icon) {
                 set_custom_cursor(&mut commands, *window, handle.clone());
-                *current = Some(icon);
+                *last_set = Some(icon);
                 return;
             }
             // Decode failed (or still pending catalogs): fall through to the mode cursor below.
@@ -383,7 +393,7 @@ mod other {
             return;
         };
         let stem = cursor.0.stem();
-        if current.as_deref() == Some(stem.as_str()) {
+        if last_set.as_deref() == Some(stem.as_str()) {
             return;
         }
         let handle = cursors
@@ -394,7 +404,7 @@ mod other {
         if let Some(handle) = handle {
             set_custom_cursor(&mut commands, *window, handle.clone());
         }
-        *current = Some(stem);
+        *last_set = Some(stem);
     }
 
     /// The shared `CustomCursor::Image` insert — hotspot `(0, 0)`: the vanilla mode cursors' active
@@ -484,6 +494,11 @@ mod macos {
         mode: Res<super::DisplayedCursor>,
         rig: Res<CameraControl>,
         mut focus: MessageReader<bevy::window::WindowFocused>,
+        // None of the `Local`s below is a [`crate::ui_script::VmMemo`], deliberately (decision
+        // 1290's sweep): every one of them remembers something about the **OS** — what we last told
+        // AppKit, which BLPs failed to decode, whether the pointer rects are off — and the OS keeps
+        // that state across the VM's death and rebirth, so re-seating them at a new login would
+        // re-assert a cursor nothing changed.
         mut was_looking: Local<bool>,
         mut rects_disabled: Local<bool>,
         mut decode_failed: Local<HashSet<String>>,
diff --git a/crates/benilla-app/src/cvars.rs b/crates/benilla-app/src/cvars.rs
index 7de89161..7ef207f8 100644
--- a/crates/benilla-app/src/cvars.rs
+++ b/crates/benilla-app/src/cvars.rs
@@ -144,8 +144,11 @@ pub(crate) struct CvarPersist {
     file: BTreeMap<String, String>,
     /// Lowercased names whose value came from an env var this session (never saved).
     env_overridden: HashSet<String>,
-    /// The engine table has been registered + seeded (once, when the VM first exists).
-    registered: bool,
+    /// The engine table has been registered + seeded — **once per VM**, not once per process
+    /// (decision 1290). A login builds a fresh VM, so the seed has to happen again: an
+    /// unregistered table answers every `GetCVar` with nil, and [`save_config`] composes
+    /// `config.toml` out of that same table.
+    registered: crate::ui_script::VmMemo<bool>,
     /// A change since the last save; `last_change` drives the one-quiet-second debounce.
     dirty: bool,
     last_change: Option<Instant>,
@@ -343,7 +346,7 @@ fn sync_cvars(
     let Some(mut script) = script else {
         return;
     };
-    if !persist.registered {
+    if persist.registered.claim(&script) {
         script.register_cvars(REGISTERED.iter().copied());
         let flag = |b: bool| if b { "1" } else { "0" }.to_string();
         let session: [(&str, String); 23] = [
@@ -377,7 +380,6 @@ fn sync_cvars(
         for (name, value) in session {
             script.set_cvar_host(name, &value);
         }
-        persist.registered = true;
     }
     // Take the changes BEFORE touching the knobs: constructing `Knobs` deref-muts every knob
     // resource, which trips Bevy change detection even when nothing is written — and the
@@ -462,6 +464,16 @@ fn save_config(
         return;
     };
     let snapshot = script.cvars_snapshot();
+    // **An empty table is not a player who cleared their settings.** The file is composed from the
+    // VM's live table, so a VM whose table was never registered would compose the player's
+    // `config.toml` back out *stripped* — a silent, irreversible loss of everything they had set.
+    // The seed above is what keeps that from happening; this is the floor under it, because the
+    // failure is one-way and the next regression in that seed must not be able to reach the disk.
+    if snapshot.is_empty() {
+        warn!("config: the VM has no registered cvars — refusing to compose the file from nothing");
+        persist.dirty = false; // nothing to save, and retrying every frame changes nothing
+        return;
+    }
     let cvars = compose_file(&persist.file, &persist.env_overridden, &snapshot);
     let body = toml::to_string(&LocalConfig {
         cvars: cvars.clone(),
diff --git a/crates/benilla-app/src/entities/attach/mod.rs b/crates/benilla-app/src/entities/attach/mod.rs
index 7adf453d..7585f63e 100644
--- a/crates/benilla-app/src/entities/attach/mod.rs
+++ b/crates/benilla-app/src/entities/attach/mod.rs
@@ -833,6 +833,7 @@ pub(super) fn attach_entity_visuals(
                         benilla_world::ribbons::RibbonSeq::Host(entity),
                         // The unit's own render alpha gates its trail (0827).
                         Some(entity),
+                        None, // a streamed unit belongs to no building's doodad set
                     );
                 }
             }
diff --git a/crates/benilla-app/src/entities/equipment/spawn.rs b/crates/benilla-app/src/entities/equipment/spawn.rs
index 301a6da1..0600b6f9 100644
--- a/crates/benilla-app/src/entities/equipment/spawn.rs
+++ b/crates/benilla-app/src/entities/equipment/spawn.rs
@@ -665,6 +665,7 @@ fn spawn_slot(
             // Its own model instance — chained to the wearer above — so an enchant streamer is
             // gone with the avatar in first person and absent until the body is shown (0827/0833).
             Some(root),
+            None, // a carried item belongs to no building's doodad set
         );
     }
     debug!(
diff --git a/crates/benilla-app/src/entities/spell_fx/mod.rs b/crates/benilla-app/src/entities/spell_fx/mod.rs
index c92b1438..bdffcaf2 100644
--- a/crates/benilla-app/src/entities/spell_fx/mod.rs
+++ b/crates/benilla-app/src/entities/spell_fx/mod.rs
@@ -466,6 +466,7 @@ pub(crate) fn attach_effect_visuals(
             // This instance's own model alpha, chained to its host (0827/0833): a standalone
             // instance has none above it and draws exactly as before.
             Some(root),
+            None, // an effect instance belongs to no building's doodad set
         );
     }
     true
diff --git a/crates/benilla-app/src/entities/wmo_props.rs b/crates/benilla-app/src/entities/wmo_props.rs
index f4966650..e3bdc060 100644
--- a/crates/benilla-app/src/entities/wmo_props.rs
+++ b/crates/benilla-app/src/entities/wmo_props.rs
@@ -370,6 +370,12 @@ pub(super) fn spawn_wmo_gameobject_props(
                         benilla_world::ribbons::RibbonSeq::Host(entity),
                         // No model-alpha source: a placed prop / effect instance is always drawn (0827).
                         None,
+                        // A GameObject's props ride the GameObject, not a portal-culled placement:
+                        // this WMO is the boat, and nothing floods it. (Its off-map hide reaches
+                        // the trail no better than before — a `Visibility`-hidden transport still
+                        // trails. No 1.12 transport prop authors a ribbon, so nothing renders it
+                        // today; it is named in decision 1289's residuals rather than guessed at.)
+                        None,
                     )
                     .is_some()
                     {
diff --git a/crates/benilla-app/src/minimap/blips/mod.rs b/crates/benilla-app/src/minimap/blips/mod.rs
index 46259140..3e92bef3 100644
--- a/crates/benilla-app/src/minimap/blips/mod.rs
+++ b/crates/benilla-app/src/minimap/blips/mod.rs
@@ -383,11 +383,12 @@ pub(super) fn drive_blip_tooltip(
     hover: Res<MinimapBlipHover>,
     mut names: ResMut<NameCache>,
     commands: Res<NetCommands>,
-    mut last: Local<Option<(String, Vec2)>>,
+    mut last: Local<crate::ui_script::VmMemo<Option<(String, Vec2)>>>,
 ) {
     let Some(mut script) = script else {
         return;
     };
+    let last = last.get(&script);
     let show = match &*hover {
         MinimapBlipHover::None => None,
         MinimapBlipHover::Landmark(name, at) => Some((name.clone(), *at, false)),
diff --git a/crates/benilla-app/src/minimap/mod.rs b/crates/benilla-app/src/minimap/mod.rs
index 1382287e..6707b115 100644
--- a/crates/benilla-app/src/minimap/mod.rs
+++ b/crates/benilla-app/src/minimap/mod.rs
@@ -701,9 +701,10 @@ fn emit_minimap(
 fn feed_minimap_inside(
     script: Option<bevy::ecs::system::NonSendMut<benilla_ui::script::UiScript>>,
     world: benilla_world::world_point::WorldPoint,
-    mut was_inside: Local<Option<bool>>,
+    mut was_inside: Local<crate::ui_script::VmMemo<Option<bool>>>,
 ) {
     let Some(mut script) = script else { return };
+    let was_inside = was_inside.get(&script);
     let inside = world.interior().is_some();
     script.set_minimap_inside(inside);
     if *was_inside != Some(inside) {
@@ -720,9 +721,10 @@ fn feed_minimap_inside(
 fn feed_game_time(
     script: Option<bevy::ecs::system::NonSendMut<benilla_ui::script::UiScript>>,
     time: Res<crate::net::ServerTime>,
-    mut last: Local<Option<u32>>,
+    mut last: Local<crate::ui_script::VmMemo<Option<u32>>>,
 ) {
     let Some(script) = script else { return };
+    let last = last.get(&script);
     let Some(gt) = time.0 else { return };
     let minute = gt.minute_of_day();
     if *last == Some(minute) {
diff --git a/crates/benilla-app/src/sound/ui.rs b/crates/benilla-app/src/sound/ui.rs
index b04e9e56..55deb23d 100644
--- a/crates/benilla-app/src/sound/ui.rs
+++ b/crates/benilla-app/src/sound/ui.rs
@@ -154,7 +154,7 @@ enum CursorGesture {
 #[allow(clippy::too_many_arguments)]
 fn play_item_gesture_sounds(
     script: Option<NonSend<UiScript>>,
-    mut prev: Local<Option<CursorPayload>>,
+    mut prev: Local<crate::ui_script::VmMemo<Option<CursorPayload>>>,
     mut items: ResMut<Items>,
     displays: Option<Res<ItemDisplays>>,
     sounds: Option<Res<ItemSounds>>,
@@ -165,6 +165,7 @@ fn play_item_gesture_sounds(
     net: Res<NetCommands>,
 ) {
     let Some(script) = script else { return };
+    let prev = prev.get(&script);
     let now = script.cursor_payload();
     if *prev == now {
         return;
diff --git a/crates/benilla-app/src/ui_action/feed.rs b/crates/benilla-app/src/ui_action/feed.rs
index 3fead072..7852aad0 100644
--- a/crates/benilla-app/src/ui_action/feed.rs
+++ b/crates/benilla-app/src/ui_action/feed.rs
@@ -52,6 +52,17 @@ pub(super) const MISSING_ITEM_ICON: &str = "Interface\\Icons\\INV_Misc_QuestionM
 pub(super) struct FeedMemory {
     pushed: HashMap<u32, ActionSlot>,
     bonus_offset: u8,
+    /// **Has the identity resolve run against the VM this memory is about?**
+    ///
+    /// Wrapping the memory in `VmMemo` (1290) makes a login's fresh VM reset `pushed` — but the
+    /// diff that reads `pushed` lives *inside* the gate below, and every other input to that gate
+    /// is host-side and survives the VM. `dirty` is false, and both `template_epoch` and
+    /// `macro_generation` can legitimately match the reset memory's zeros. The bar would then be
+    /// fed nothing at all, for the whole session.
+    ///
+    /// So the gate takes the memory's own freshness as an input. It is not a fourth *reason* to
+    /// re-resolve; it is the statement that a resolve is only valid for the VM it ran against.
+    resolved: bool,
     /// The [`Items::template_epoch`] the last identity resolve ran at — the feed's half of the
     /// landed-template redisplay (decision 0660). An advance re-resolves, exactly like a bar edit.
     template_epoch: u64,
@@ -74,11 +85,12 @@ pub(super) fn feed_actions(
     icons: Option<Res<ItemDisplays>>,
     sub_classes: Option<Res<crate::ui_items::ItemSubClasses>>,
     commands: Res<NetCommands>,
-    mut memory: Local<FeedMemory>,
+    mut memory: Local<crate::ui_script::VmMemo<FeedMemory>>,
 ) {
     let Some(mut script) = script else {
         return;
     };
+    let memory = memory.get(&script);
 
     // Rejected casts surface as the client's red error line (UI_ERROR_MESSAGE → the errors
     // frame), resolved through the byte-verified two-layer display ([`cast_fail`]) against the
@@ -246,11 +258,13 @@ pub(super) fn feed_actions(
     // The epoch is the second input, so a landed answer redisplays like the ref's DBCACHECALLBACK.
     let template_epoch = items.template_epoch();
     let macro_generation = script.macros_generation();
-    if actions.dirty
+    if !memory.resolved
+        || actions.dirty
         || template_epoch != memory.template_epoch
         || macro_generation != memory.macro_generation
     {
         actions.dirty = false;
+        memory.resolved = true;
         memory.template_epoch = template_epoch;
         memory.macro_generation = macro_generation;
         // Cloned once per re-resolve, never per frame: the gate above is a `u64` compare.
diff --git a/crates/benilla-app/src/ui_action/state.rs b/crates/benilla-app/src/ui_action/state.rs
index e19ddda4..b4b38c49 100644
--- a/crates/benilla-app/src/ui_action/state.rs
+++ b/crates/benilla-app/src/ui_action/state.rs
@@ -321,11 +321,12 @@ pub(super) fn feed_action_state(
     reputations: Res<crate::net::Reputations>,
     mut items: ResMut<Items>,
     commands: Res<NetCommands>,
-    mut memory: Local<StateMemory>,
+    mut memory: Local<crate::ui_script::VmMemo<StateMemory>>,
 ) {
     let Some(mut script) = script else {
         return;
     };
+    let memory = memory.get(&script);
     let now = Instant::now();
     // The frame's atomic clock pair — `ui_triple`'s conversion base: every cooldown is pushed as
     // its absolute start on the GetTime clock, derived through the ONE lawful pair
diff --git a/crates/benilla-app/src/ui_action/targeting/mod.rs b/crates/benilla-app/src/ui_action/targeting/mod.rs
index 26652325..e53fb1fc 100644
--- a/crates/benilla-app/src/ui_action/targeting/mod.rs
+++ b/crates/benilla-app/src/ui_action/targeting/mod.rs
@@ -246,10 +246,11 @@ pub(crate) fn cancel_targeting_on_right_press(
 /// a cancel-and-rearm in one frame still counts as a change.
 pub(crate) fn feed_targeting_to_vm(
     targeting: Res<SpellTargeting>,
-    mut last: Local<Option<u32>>,
+    mut last: Local<crate::ui_script::VmMemo<Option<u32>>>,
     script: Option<NonSendMut<benilla_ui::script::UiScript>>,
 ) {
     if let Some(mut script) = script {
+        let last = last.get(&script);
         script.set_spell_targeting(targeting.active());
         script.set_item_pick_armed(targeting.wants(TargetingWants::Item));
         // `SpellCanTargetUnit`'s answer (`0x6e6460`'s unit leg). Derived from the word rather than
diff --git a/crates/benilla-app/src/ui_bank.rs b/crates/benilla-app/src/ui_bank.rs
index 12b49b88..50214627 100644
--- a/crates/benilla-app/src/ui_bank.rs
+++ b/crates/benilla-app/src/ui_bank.rs
@@ -133,12 +133,14 @@ fn feed_bank(
     commands: Res<NetCommands>,
     mut names: ResMut<NameCache>,
     mut errors: ResMut<BankErrors>,
-    mut last: Local<Option<BankState>>,
-    mut last_banker: Local<Option<u64>>,
+    mut last: Local<crate::ui_script::VmMemo<Option<BankState>>>,
+    mut last_banker: Local<crate::ui_script::VmMemo<Option<u64>>>,
 ) {
     let Some(mut script) = script else {
         return;
     };
+    let last = last.get(&script);
+    let last_banker = last_banker.get(&script);
     // Purchase refusals surface as the client's red error line.
     for result in errors.0.drain(..) {
         if let Some(text) = bank_slot_error_text(result) {
diff --git a/crates/benilla-app/src/ui_char.rs b/crates/benilla-app/src/ui_char.rs
index c5d6025e..3a859c50 100644
--- a/crates/benilla-app/src/ui_char.rs
+++ b/crates/benilla-app/src/ui_char.rs
@@ -96,6 +96,11 @@ impl Plugin for UiCharPlugin {
     }
 }
 
+/// The skill block [`watch_skill_ups`] last announced: the self guid it was read off, and that
+/// character's `skillId → value` map — the diff base for both the chat lines and the event.
+/// `None` = nothing announced yet.
+type SkillBlock = Option<(u64, std::collections::HashMap<u16, u16>)>;
+
 /// The client-generated skill-up feedback (decision 0437, landed with phase 2): the server sends
 /// NO skill-up message at all — skills mutate only as `PLAYER_SKILL_INFO` descriptor deltas
 /// (verified at the vmangos source: no chat send anywhere in `UpdateSkill*`/`SetSkill`) — so the
@@ -112,11 +117,19 @@ fn watch_skill_ups(
     self_store: Query<&ObjectStore, With<SelfPlayer>>,
     skill_lines: Option<Res<crate::ui_spellbook::SkillLines>>,
     mut chat: ResMut<crate::ui_chat::ChatLog>,
-    mut prev: Local<Option<(u64, std::collections::HashMap<u16, u16>)>>,
+    mut prev: Local<crate::ui_script::VmMemo<SkillBlock>>,
 ) {
     let (Some(guid), Ok(store)) = (self_guid.0, self_store.single()) else {
         return;
     };
+    // The memo is about the VM — it gates `SKILL_LINES_CHANGED`, the pane's only repaint wire — so
+    // it re-seeds with the VM (decision 1290). With no VM there is nothing to announce to and
+    // nothing worth remembering: the diff would only queue chat lines for a VM that does not exist
+    // yet, which is a stale skill-up replayed at the next login. The next VM re-seeds silently.
+    let Some(mut script) = script else {
+        return;
+    };
+    let prev = prev.get(&script);
     let mut cur = std::collections::HashMap::new();
     for i in 0..PLAYER_SKILL_SLOTS {
         if let Some(s) = store.0.player_skill(i) {
@@ -131,16 +144,12 @@ fn watch_skill_ups(
             if cur.is_empty() {
                 return;
             }
-            if let Some(mut script) = script {
-                script.fire_event("SKILL_LINES_CHANGED", vec![]);
-            }
+            script.fire_event("SKILL_LINES_CHANGED", vec![]);
             *prev = Some((guid, cur));
         }
         Some((prev_guid, _)) if *prev_guid != guid => {
             // A different character logged in — re-seed, never diff across characters.
-            if let Some(mut script) = script {
-                script.fire_event("SKILL_LINES_CHANGED", vec![]);
-            }
+            script.fire_event("SKILL_LINES_CHANGED", vec![]);
             *prev = Some((guid, cur));
         }
         Some((_, prev_map)) => {
@@ -178,9 +187,7 @@ fn watch_skill_ups(
                     _ => {}
                 }
             }
-            if let Some(mut script) = script {
-                script.fire_event("SKILL_LINES_CHANGED", vec![]);
-            }
+            script.fire_event("SKILL_LINES_CHANGED", vec![]);
             *prev = Some((guid, cur));
         }
     }
@@ -203,11 +210,12 @@ fn feed_skills(
     script: Option<NonSendMut<UiScript>>,
     self_store: Query<&ObjectStore, With<SelfPlayer>>,
     skill_lines: Option<Res<crate::ui_spellbook::SkillLines>>,
-    mut last: Local<Option<SkillsState>>,
+    mut last: Local<crate::ui_script::VmMemo<Option<SkillsState>>>,
 ) {
     let Some(mut script) = script else {
         return;
     };
+    let last = last.get(&script);
     let (Ok(store), Some(skill_lines)) = (self_store.single(), skill_lines.as_deref()) else {
         return;
     };
diff --git a/crates/benilla-app/src/ui_craft.rs b/crates/benilla-app/src/ui_craft.rs
index 7ff25c3b..43097b23 100644
--- a/crates/benilla-app/src/ui_craft.rs
+++ b/crates/benilla-app/src/ui_craft.rs
@@ -143,11 +143,12 @@ fn feed_craft(
     self_store: Query<&ObjectStore, With<SelfPlayer>>,
     mut items: ResMut<Items>,
     commands: Res<NetCommands>,
-    mut last: Local<Option<CraftState>>,
+    mut last: Local<crate::ui_script::VmMemo<Option<CraftState>>>,
 ) {
     let Some(mut script) = script else {
         return;
     };
+    let last = last.get(&script);
     let fresh = (|| -> Option<CraftState> {
         let line = open.line?;
         let craft_type = open.craft_type;
diff --git a/crates/benilla-app/src/ui_duel.rs b/crates/benilla-app/src/ui_duel.rs
index 6f4b6334..c0c97ab7 100644
--- a/crates/benilla-app/src/ui_duel.rs
+++ b/crates/benilla-app/src/ui_duel.rs
@@ -228,11 +228,12 @@ fn feed_duel(
     mut duel: ResMut<DuelState>,
     mut names: ResMut<NameCache>,
     commands: Res<NetCommands>,
-    mut fed: Local<FedDuel>,
+    mut fed: Local<crate::ui_script::VmMemo<FedDuel>>,
 ) {
     let Some(mut script) = script else {
         return;
     };
+    let fed = fed.get(&script);
 
     // DUEL_REQUESTED(challengerName) — held until the name resolves (module doc, deviation 2).
     if let Some(guid) = duel.challenger {
diff --git a/crates/benilla-app/src/ui_gossip.rs b/crates/benilla-app/src/ui_gossip.rs
index 56971183..afa058bd 100644
--- a/crates/benilla-app/src/ui_gossip.rs
+++ b/crates/benilla-app/src/ui_gossip.rs
@@ -189,13 +189,16 @@ fn feed_gossip(
     mut names: ResMut<NameCache>,
     commands: Res<NetCommands>,
     states: Res<crate::world_state::WorldStates>,
-    mut last: Local<Option<GossipMenu>>,
-    mut last_name: Local<Option<String>>,
-    mut last_npc: Local<Option<u64>>,
+    mut last: Local<crate::ui_script::VmMemo<Option<GossipMenu>>>,
+    mut last_name: Local<crate::ui_script::VmMemo<Option<String>>>,
+    mut last_npc: Local<crate::ui_script::VmMemo<Option<u64>>>,
 ) {
     let Some(mut script) = script else {
         return;
     };
+    let last = last.get(&script);
+    let last_name = last_name.get(&script);
+    let last_npc = last_npc.get(&script);
     let mut fresh = snapshot(&state);
     // Expand the greeting's chat-text macros ($N/$B/$G/$<n>w) client-side, as the real client does.
     if let Some(greeting) = fresh.as_mut().and_then(|m| m.greeting.as_mut()) {
diff --git a/crates/benilla-app/src/ui_items/feed.rs b/crates/benilla-app/src/ui_items/feed.rs
index 1898ac57..55549375 100644
--- a/crates/benilla-app/src/ui_items/feed.rs
+++ b/crates/benilla-app/src/ui_items/feed.rs
@@ -216,11 +216,14 @@ pub(super) fn feed_item_sets(
     commands: Res<NetCommands>,
     spells: Option<Res<crate::ui_action::Spells>>,
     skill_lines: Option<Res<crate::ui_spellbook::SkillLines>>,
-    mut pending: Local<std::collections::HashMap<u32, benilla_ui::script::ItemSetView>>,
+    mut pending: Local<
+        crate::ui_script::VmMemo<std::collections::HashMap<u32, benilla_ui::script::ItemSetView>>,
+    >,
 ) {
     let Some(mut script) = script else {
         return;
     };
+    let pending = pending.get(&script);
     for id in script.take_item_set_asks() {
         pending.entry(id).or_default();
     }
@@ -304,12 +307,14 @@ pub(super) fn feed_item_stats(
     // ItemDisplayInfo icons the bag slots already resolve through.
     classes: Option<Res<super::ItemClasses>>,
     icons: Option<Res<ItemDisplays>>,
-    mut pending: Local<std::collections::HashSet<u32>>,
-    mut last_home: Local<Option<String>>,
+    mut pending: Local<crate::ui_script::VmMemo<std::collections::HashSet<u32>>>,
+    mut last_home: Local<crate::ui_script::VmMemo<Option<String>>>,
 ) {
     let Some(mut script) = script else {
         return;
     };
+    let pending = pending.get(&script);
+    let last_home = last_home.get(&script);
     // **`GetBindLocation()`'s push, and it happens BEFORE the early return below.**
     //
     // The name resolution lives here because this system already owns it for the hearthstone's
@@ -375,11 +380,12 @@ pub(super) fn feed_player_req(
     factions: Option<Res<crate::target::Factions>>,
     actions: Res<crate::ui_action::PlayerActions>,
     spells: Option<Res<crate::ui_action::Spells>>,
-    mut last: Local<Option<benilla_ui::script::PlayerReqState>>,
+    mut last: Local<crate::ui_script::VmMemo<Option<benilla_ui::script::PlayerReqState>>>,
 ) {
     let Some(mut script) = script else {
         return;
     };
+    let last = last.get(&script);
     let Some(store) = self_q.iter().next() else {
         return;
     };
@@ -614,11 +620,12 @@ pub(super) fn feed_containers(
     mut lock_cleared: ResMut<LockClearedByFailure>,
     mut names: ResMut<crate::names::NameCache>,
     clock: Res<crate::ui_script::UiClock>,
-    mut memory: Local<FeedMemory>,
+    mut memory: Local<crate::ui_script::VmMemo<FeedMemory>>,
 ) {
     let Some(mut script) = script else {
         return;
     };
+    let memory = memory.get(&script);
     // The frame's atomic clock pair (`crate::ui_script::UiClock`): the slot resolves read the
     // cooldown store and convert triples through ONE coherent instant, so a running cooldown's
     // pushed start is frame-stable (the resource's own doc).
diff --git a/crates/benilla-app/src/ui_loot.rs b/crates/benilla-app/src/ui_loot.rs
index 572e6975..b55d93db 100644
--- a/crates/benilla-app/src/ui_loot.rs
+++ b/crates/benilla-app/src/ui_loot.rs
@@ -586,7 +586,7 @@ fn feed_loot(
     commands: Res<NetCommands>,
     mut errors: ResMut<LootErrors>,
     mut chat: ResMut<crate::ui_chat::ChatLog>,
-    mut last: Local<Option<LootSnapshot>>,
+    mut last: Local<crate::ui_script::VmMemo<Option<LootSnapshot>>>,
     cfg: Res<LootConfig>,
     keys: Res<ButtonInput<KeyCode>>,
     mut pickup: MessageWriter<crate::sound::LootPickupSound>,
@@ -594,6 +594,7 @@ fn feed_loot(
     let Some(mut script) = script else {
         return;
     };
+    let last = last.get(&script);
     // Loot refusals + "You receive …" lines migrate to the chat window (decision 0084's chat arc):
     // refusals as informational SYSTEM-yellow lines, receive lines as LOOT-green. The ErrorsFrame
     // keeps only the cast/equip red toasts.
diff --git a/crates/benilla-app/src/ui_loot_roll.rs b/crates/benilla-app/src/ui_loot_roll.rs
index 4d469efc..095c7804 100644
--- a/crates/benilla-app/src/ui_loot_roll.rs
+++ b/crates/benilla-app/src/ui_loot_roll.rs
@@ -448,13 +448,14 @@ fn feed_loot_rolls(
     self_guid: Res<SelfGuid>,
     mut chat: ResMut<ChatLog>,
     time: Res<Time>,
-    mut last: Local<LootRollsState>,
+    mut last: Local<crate::ui_script::VmMemo<LootRollsState>>,
 ) {
     rolls.tick(time.delta().as_millis() as u32);
 
     let Some(mut script) = script else {
         return;
     };
+    let last = last.get(&script);
     drain_lines(
         &mut rolls,
         self_guid.0,
@@ -469,7 +470,7 @@ fn feed_loot_rolls(
     // same `start()` call that queued `opened`, so pushing after would hand every fresh roll an
     // empty lookup. Same order as ui_loot's window feed, for the same reason.
     let fresh = snapshot(&rolls, &mut items, icons.as_deref(), &commands);
-    let changed = repainted(&last, &fresh);
+    let changed = repainted(last, &fresh);
     if fresh != *last {
         script.set_loot_rolls(fresh.clone());
         *last = fresh;
diff --git a/crates/benilla-app/src/ui_macro/mod.rs b/crates/benilla-app/src/ui_macro/mod.rs
index 06c0f313..9e785b35 100644
--- a/crates/benilla-app/src/ui_macro/mod.rs
+++ b/crates/benilla-app/src/ui_macro/mod.rs
@@ -36,8 +36,9 @@ pub(crate) struct MacroFiles {
     account: Option<std::path::PathBuf>,
     character: Option<std::path::PathBuf>,
     /// The `(realm, character)` the [`Self::character`] path was built for — the reload trigger
-    /// when a `/logout` brings a different character back into the world.
-    identity: Option<(String, String)>,
+    /// when a `/logout` brings a different character back into the world. Session-keyed (1290),
+    /// because the *same* character coming back still meets a fresh VM with an empty macro table.
+    identity: crate::ui_script::VmMemo<Option<(String, String)>>,
 }
 
 /// Macro index → the spell it casts — benilla's `[rec+0x564]` (wow-re
@@ -54,16 +55,16 @@ impl Plugin for UiMacroPlugin {
     fn build(&self, app: &mut App) {
         app.init_resource::<MacroFiles>()
             .init_resource::<MacroBoundSpells>()
-            // `PostStartup`, not `Startup.after(AssetSet::Open)` — the same reason
-            // `crate::ui_chat::commands::build_slash_commands` sits there: this needs BOTH the
-            // patch chain and the VM, and the VM is inserted by another `Startup` system whose
-            // `insert_non_send_resource` only lands at the schedule boundary. Ordered after
-            // `AssetSet::Open` alone, this ran before the VM existed and silently pushed no icon
-            // list at all (caught on a clean capture run: the boot line never appeared).
-            .add_systems(PostStartup, load_icon_catalog)
             .add_systems(
                 Update,
                 (
+                    // Once per **VM** (decision 1290), and in `Update` rather than `PostStartup`:
+                    // this needs BOTH the patch chain and the VM, and a login builds a fresh VM
+                    // whose icon chooser stays empty until it runs again. `PostStartup` was the
+                    // old answer to the ordering half alone — after `AssetSet::Open` this ran
+                    // before the VM existed and silently pushed no icon list at all — and a
+                    // session-keyed claim answers both halves at once.
+                    load_icon_catalog,
                     // Before the action feeds read it (they run in `UnitFeed`), so a macro edited
                     // this frame reports its new spell's cooldown the same frame.
                     rebind_macro_spells.before(crate::ui_unit::UnitFeed),
@@ -85,10 +86,17 @@ impl Plugin for UiMacroPlugin {
 /// two prefixes ([`benilla_formats::load_macro_icons`], where the byte citations live). A failed
 /// load leaves the list empty: the popup then shows no icons and `MacroPopupOkayButton_Update`
 /// keeps OKAY disabled, which is a visible, diagnosable failure rather than a silent one.
-fn load_icon_catalog(script: Option<NonSendMut<UiScript>>, assets: Option<Res<WorldAssets>>) {
+fn load_icon_catalog(
+    script: Option<NonSendMut<UiScript>>,
+    assets: Option<Res<WorldAssets>>,
+    mut seeded: Local<crate::ui_script::VmMemo<bool>>,
+) {
     let (Some(mut script), Some(assets)) = (script, assets) else {
         return;
     };
+    if !seeded.claim(&script) {
+        return;
+    }
     let loaded = {
         let mut chain = assets.chain.lock_recover();
         benilla_formats::load_macro_icons(&mut chain)
@@ -124,13 +132,13 @@ fn load_macros(
 ) {
     let Some(mut script) = script else { return };
     let Some(id) = identity(&roster) else { return };
-    if files.identity.as_ref() == Some(&id) {
-        return; // already loaded for this character
+    if files.identity.get(&script).as_ref() == Some(&id) {
+        return; // already loaded for this character, into the VM that is live now
     }
     let (realm, character) = (&id.0, &id.1);
     files.account = crate::local_state::macros_account_path();
     files.character = crate::local_state::macros_character_path(realm, character);
-    files.identity = Some(id.clone());
+    *files.identity.get(&script) = Some(id.clone());
 
     let read = |path: &Option<std::path::PathBuf>| -> Vec<benilla_ui::script::MacroView> {
         let Some(path) = path else { return Vec::new() };
@@ -194,11 +202,14 @@ fn rebind_macro_spells(
     actions: Res<crate::ui_action::PlayerActions>,
     table: Option<Res<crate::ui_chat::commands::SlashCommands>>,
     mut bound: ResMut<MacroBoundSpells>,
-    mut last_generation: Local<Option<u64>>,
+    mut last_generation: Local<crate::ui_script::VmMemo<Option<u64>>>,
 ) {
     let (Some(script), Some(table)) = (script, table) else {
         return;
     };
+    // Session-keyed (1290): a fresh VM restarts its macro generation at 0, so a bare memo could
+    // hold a *higher* number than the live VM will ever reach and gate this off for the session.
+    let last_generation = last_generation.get(&script);
     let generation = script.macros_generation();
     if *last_generation == Some(generation) && !actions.is_changed() {
         return;
diff --git a/crates/benilla-app/src/ui_mail/mod.rs b/crates/benilla-app/src/ui_mail/mod.rs
index 52408302..23221fe8 100644
--- a/crates/benilla-app/src/ui_mail/mod.rs
+++ b/crates/benilla-app/src/ui_mail/mod.rs
@@ -393,9 +393,9 @@ fn feed_mail(
     commands: Res<NetCommands>,
     mut pending: ResMut<MailPending>,
     time: Res<Time>,
-    mut last: Local<Option<MailState>>,
-    mut last_mailbox: Local<Option<u64>>,
-    mut last_has_new_mail: Local<bool>,
+    mut last: Local<crate::ui_script::VmMemo<Option<MailState>>>,
+    mut last_mailbox: Local<crate::ui_script::VmMemo<Option<u64>>>,
+    mut last_has_new_mail: Local<crate::ui_script::VmMemo<bool>>,
     // The `$`-macro subject for the letter body: the local player, as at every panel seam.
     self_q: Query<(&crate::net::ObjectStore, &crate::net::Guid), With<crate::net::SelfPlayer>>,
     states: Res<crate::world_state::WorldStates>,
@@ -403,6 +403,9 @@ fn feed_mail(
     let Some(mut script) = script else {
         return;
     };
+    let last = last.get(&script);
+    let last_mailbox = last_mailbox.get(&script);
+    let last_has_new_mail = last_has_new_mail.get(&script);
 
     // Take/return/delete failures surface as the client's red error line (the equip/cast path shape).
     for text in std::mem::take(&mut mail.errors) {
diff --git a/crates/benilla-app/src/ui_merchant.rs b/crates/benilla-app/src/ui_merchant.rs
index 8e209807..e3ed3670 100644
--- a/crates/benilla-app/src/ui_merchant.rs
+++ b/crates/benilla-app/src/ui_merchant.rs
@@ -411,14 +411,18 @@ fn feed_merchant(
     tables: Option<Res<RepairTables>>,
     mut names: ResMut<NameCache>,
     mut errors: ResMut<MerchantErrors>,
-    mut last: Local<Option<MerchantState>>,
-    mut last_money: Local<Option<u64>>,
-    mut last_name: Local<Option<String>>,
-    mut last_vendor: Local<Option<u64>>,
+    mut last: Local<crate::ui_script::VmMemo<Option<MerchantState>>>,
+    mut last_money: Local<crate::ui_script::VmMemo<Option<u64>>>,
+    mut last_name: Local<crate::ui_script::VmMemo<Option<String>>>,
+    mut last_vendor: Local<crate::ui_script::VmMemo<Option<u64>>>,
 ) {
     let Some(mut script) = script else {
         return;
     };
+    let last = last.get(&script);
+    let last_money = last_money.get(&script);
+    let last_name = last_name.get(&script);
+    let last_vendor = last_vendor.get(&script);
     // Refusals surface as the client's red error line (the equip/cast path's exact shape).
     for refusal in errors.0.drain(..) {
         let text = match refusal {
diff --git a/crates/benilla-app/src/ui_party/feed.rs b/crates/benilla-app/src/ui_party/feed.rs
index 2abc2b09..0280246c 100644
--- a/crates/benilla-app/src/ui_party/feed.rs
+++ b/crates/benilla-app/src/ui_party/feed.rs
@@ -58,11 +58,12 @@ pub(super) fn feed_party(
     // the instruments, and naming it from a game module would push it across the world-API wall
     // (`tests/world_api_wall.rs`, decision 1164) for a value this already answers.
     here: benilla_world::world_point::WorldPoint,
-    mut fed: Local<FedParty>,
+    mut fed: Local<crate::ui_script::VmMemo<FedParty>>,
 ) {
     let Some(mut script) = script else {
         return;
     };
+    let fed = fed.get(&script);
     let self_pair = self_q.iter().next();
     let self_guid = self_pair.map(|(g, _)| g.0);
     // The party's PvP faction group (decision 0646 §1): our own. A 1.12 party is always one
diff --git a/crates/benilla-app/src/ui_pet/bar.rs b/crates/benilla-app/src/ui_pet/bar.rs
index 89eeca0f..bbdf48cb 100644
--- a/crates/benilla-app/src/ui_pet/bar.rs
+++ b/crates/benilla-app/src/ui_pet/bar.rs
@@ -268,11 +268,12 @@ pub(super) fn feed_pet_bar(
     clock: Res<crate::ui_script::UiClock>,
     index: Res<GuidIndex>,
     stores: Query<&ObjectStore>,
-    mut memory: Local<PetBarMemory>,
+    mut memory: Local<crate::ui_script::VmMemo<PetBarMemory>>,
 ) {
     let Some(mut script) = script else {
         return;
     };
+    let memory = memory.get(&script);
     let now = Instant::now();
     let (anchor, ui_now) = (clock.anchor, clock.ui_now);
     let has_bar = bar.has_bar();
diff --git a/crates/benilla-app/src/ui_pet/unit.rs b/crates/benilla-app/src/ui_pet/unit.rs
index bf66b540..03062e61 100644
--- a/crates/benilla-app/src/ui_pet/unit.rs
+++ b/crates/benilla-app/src/ui_pet/unit.rs
@@ -61,13 +61,14 @@ pub(super) fn feed_pet_unit(
     pet: PetUnit,
     mut names: ResMut<NameCache>,
     commands: Res<NetCommands>,
-    mut memory: Local<PetUnitMemory>,
+    mut memory: Local<crate::ui_script::VmMemo<PetUnitMemory>>,
 ) {
     let Some(mut script) = script else {
         return;
     };
+    let memory = memory.get(&script);
     let pet_guid = bar.spells.pet_guid;
-    watch_name_timestamp(pet_guid, &mut script, &pet, &mut names, &mut memory);
+    watch_name_timestamp(pet_guid, &mut script, &pet, &mut names, memory);
     // A bar whose unit has not streamed yet (or has left) pushes nothing: `UnitExists("pet")` then
     // reads false and the frame hides, which is honest — we have the guid but none of the fields
     // the frame draws.
diff --git a/crates/benilla-app/src/ui_pet_book.rs b/crates/benilla-app/src/ui_pet_book.rs
index 38136c92..1200c248 100644
--- a/crates/benilla-app/src/ui_pet_book.rs
+++ b/crates/benilla-app/src/ui_pet_book.rs
@@ -121,11 +121,12 @@ fn feed_pet_book(
     index: Res<GuidIndex>,
     stores: Query<&ObjectStore>,
     clock: Res<crate::ui_script::UiClock>,
-    mut memory: Local<FeedMemory>,
+    mut memory: Local<crate::ui_script::VmMemo<FeedMemory>>,
 ) {
     let Some(mut script) = script else {
         return;
     };
+    let memory = memory.get(&script);
     // Nothing to resolve a name/icon/passive from yet — try again once Spell.dbc lands. Unlike the
     // bar (which can still draw its command tokens), a book with no catalog has no slots at all.
     let Some(spells) = spells.as_deref() else {
diff --git a/crates/benilla-app/src/ui_pet_doll.rs b/crates/benilla-app/src/ui_pet_doll.rs
index ffcae213..6822140b 100644
--- a/crates/benilla-app/src/ui_pet_doll.rs
+++ b/crates/benilla-app/src/ui_pet_doll.rs
@@ -53,11 +53,12 @@ fn feed_pet_doll(
     bar: Res<PetBar>,
     pet: PetUnit,
     mut booth: ResMut<PetDollBooth>,
-    mut last: Local<Option<UnitCombatStats>>,
+    mut last: Local<crate::ui_script::VmMemo<Option<UnitCombatStats>>>,
 ) {
     let Some(mut script) = script else {
         return;
     };
+    let last = last.get(&script);
     // The pane's rotate buttons own the yaw; the booth mirrors it (the inspect pane's arrangement,
     // decision 0631 §4). Written every frame, pet or no pet — a stale yaw would snap the model the
     // moment one is summoned.
diff --git a/crates/benilla-app/src/ui_pet_stats.rs b/crates/benilla-app/src/ui_pet_stats.rs
index 71c31cbb..415e179a 100644
--- a/crates/benilla-app/src/ui_pet_stats.rs
+++ b/crates/benilla-app/src/ui_pet_stats.rs
@@ -235,11 +235,12 @@ fn feed_pet_stats(
     family_tables: Option<Res<PetFamilyTables>>,
     mut names: ResMut<NameCache>,
     commands: Res<NetCommands>,
-    mut last: Local<Option<(bool, PetStats)>>,
+    mut last: Local<crate::ui_script::VmMemo<Option<(bool, PetStats)>>>,
 ) {
     let Some(mut script) = script else {
         return;
     };
+    let last = last.get(&script);
     let store = pet.store(bar.spells.pet_guid);
     let family = family_for(store, &mut names, &commands, family_tables.as_deref());
     let fresh = stats_for(store, self_store.iter().next(), tables.as_deref(), family);
diff --git a/crates/benilla-app/src/ui_quest.rs b/crates/benilla-app/src/ui_quest.rs
index 95cd55ac..eb64fa6b 100644
--- a/crates/benilla-app/src/ui_quest.rs
+++ b/crates/benilla-app/src/ui_quest.rs
@@ -436,13 +436,16 @@ fn feed_quest(
     states: Res<crate::world_state::WorldStates>,
     self_q: Query<(&ObjectStore, &Guid), With<SelfPlayer>>,
     mut chat: ResMut<ChatLog>,
-    mut last: Local<Option<QuestState>>,
-    mut last_name: Local<Option<String>>,
-    mut last_npc: Local<Option<u64>>,
+    mut last: Local<crate::ui_script::VmMemo<Option<QuestState>>>,
+    mut last_name: Local<crate::ui_script::VmMemo<Option<String>>>,
+    mut last_npc: Local<crate::ui_script::VmMemo<Option<u64>>>,
 ) {
     let Some(mut script) = script else {
         return;
     };
+    let last = last.get(&script);
+    let last_name = last_name.get(&script);
+    let last_npc = last_npc.get(&script);
     // The turn-in fanfare (QUESTCOMPLETED → iQuestComplete.wav): the client's C++ plays it on the
     // QUEST_COMPLETE packet itself — no Lua handler owns it, so the feed queues it directly.
     if giver.take_completed_fanfare() {
diff --git a/crates/benilla-app/src/ui_quest_log.rs b/crates/benilla-app/src/ui_quest_log.rs
index 0e921a6a..07eb0a63 100644
--- a/crates/benilla-app/src/ui_quest_log.rs
+++ b/crates/benilla-app/src/ui_quest_log.rs
@@ -422,12 +422,14 @@ fn feed_quest_log(
     commands: Res<NetCommands>,
     header_names: Option<Res<QuestHeaderNamesRes>>,
     states: Res<crate::world_state::WorldStates>,
-    mut last: Local<QuestLogState>,
-    mut prior_quest_ids: Local<Option<HashSet<u32>>>,
+    mut last: Local<crate::ui_script::VmMemo<QuestLogState>>,
+    mut prior_quest_ids: Local<crate::ui_script::VmMemo<Option<HashSet<u32>>>>,
 ) {
     let Some(mut script) = script else {
         return;
     };
+    let last = last.get(&script);
+    let prior_quest_ids = prior_quest_ids.get(&script);
     let Some((store, _)) = self_q.iter().next() else {
         // No self player streamed yet — nothing to show; `last` stays at its (empty) default, so
         // this is a no-op rather than a repeated empty push.
@@ -608,7 +610,7 @@ fn feed_quest_log(
     //    minutes when you achieve a quest objective") runs off this, a deliberate
     //    intent-over-letter divergence from the ref's broken chain (QuestLogFrame.xml's
     //    auto-watch comment; decision record with this fold-back).
-    let progressed = quests_with_progressed_objectives(&last, &fresh);
+    let progressed = quests_with_progressed_objectives(last, &fresh);
     script.set_quest_log(fresh.clone());
     script.fire_event("QUEST_LOG_UPDATE", vec![]);
     if !progressed.is_empty() {
diff --git a/crates/benilla-app/src/ui_reputation.rs b/crates/benilla-app/src/ui_reputation.rs
index b523d141..2bc23dbe 100644
--- a/crates/benilla-app/src/ui_reputation.rs
+++ b/crates/benilla-app/src/ui_reputation.rs
@@ -109,6 +109,11 @@ pub(crate) fn reputation_row(
     })
 }
 
+/// The two cheap inputs [`feed_reputation`]'s gate watches by value — `(race, class, watched
+/// faction id)`; the other two are resources, watched with Bevy's own change detection. `None` =
+/// not yet read.
+type ReputationInputs = Option<(u8, u8, Option<u32>)>;
+
 /// Push the snapshot when one of its inputs moves, and fire `UPDATE_FACTION` when the result
 /// actually differs — the whole-snapshot-replace seam [`crate::ui_char::feed_skills`] established,
 /// with one addition.
@@ -129,12 +134,14 @@ fn feed_reputation(
     self_store: Query<&ObjectStore, With<SelfPlayer>>,
     reputations: Res<Reputations>,
     factions: Option<Res<Factions>>,
-    mut last: Local<Option<ReputationState>>,
-    mut last_inputs: Local<Option<(u8, u8, Option<u32>)>>,
+    mut last: Local<crate::ui_script::VmMemo<Option<ReputationState>>>,
+    mut last_inputs: Local<crate::ui_script::VmMemo<ReputationInputs>>,
 ) {
     let Some(mut script) = script else {
         return;
     };
+    let last = last.get(&script);
+    let last_inputs = last_inputs.get(&script);
     let (Ok(store), Some(factions_res)) = (self_store.single(), factions.as_ref()) else {
         return;
     };
diff --git a/crates/benilla-app/src/ui_script/extract/mod.rs b/crates/benilla-app/src/ui_script/extract/mod.rs
index 5cf0986d..f476e69e 100644
--- a/crates/benilla-app/src/ui_script/extract/mod.rs
+++ b/crates/benilla-app/src/ui_script/extract/mod.rs
@@ -77,6 +77,11 @@ pub(super) fn drive_script(
     // The seam scale the engine's text-metric caches were answered under. When `s` moves (window
     // resize / fullscreen toggle / uiScale change), every cached measure is stale — see the
     // invalidation below.
+    //
+    // Deliberately NOT a `VmMemo` (decision 1290's sweep): this is a fact about the RASTER, not
+    // about what the VM has been told, and it stays true across the VM's death and rebirth. A fresh
+    // VM has no cached measures to invalidate and no measurer at all, and the re-seat below already
+    // catches that on its own test (`!script.has_text_measurer()`).
     mut last_seam: Local<f32>,
     // The uiScale dial folded into the seam scale (decision 0584).
     ui_scale: Res<super::UiScaleCvar>,
@@ -86,7 +91,12 @@ pub(super) fn drive_script(
     // caches are monotone path→handle, so equal inputs reproduce the same `UiQuads` the diff
     // would then discard. Capture mode never skips (the harness wants exact per-frame output,
     // including the cursor-icon quad's live mouse position).
-    mut prev: Local<GateInputs>,
+    //
+    // A [`crate::ui_script::VmMemo`] because a skip is not only a quad-conversion skip: it also skips
+    // `set_link_spans` and the minimap-slot / booth-pane refills, which are pushes INTO the VM. The
+    // VM lives for one login (decision 1290), so a fresh VM must never be gated on what the previous
+    // one extracted — its first frame is always a real conversion.
+    mut prev: Local<crate::ui_script::VmMemo<GateInputs>>,
     // This frame's phase split, published for whoever asked (the `[ui-cost]` line, `hover_log`).
     mut ui_cost: ResMut<super::UiFrameCost>,
 ) {
@@ -94,6 +104,7 @@ pub(super) fn drive_script(
     let Some(mut script) = script else {
         return;
     };
+    let prev = prev.get(&script);
     let Ok(window) = window.single() else {
         return;
     };
diff --git a/crates/benilla-app/src/ui_script/mod.rs b/crates/benilla-app/src/ui_script/mod.rs
index 64c9f82f..9d9206e9 100644
--- a/crates/benilla-app/src/ui_script/mod.rs
+++ b/crates/benilla-app/src/ui_script/mod.rs
@@ -38,6 +38,12 @@ mod manifest;
 /// transcribing it — the rule, the list, and the licensing reason are that module's header.
 mod reference_ui;
 
+/// What the host remembers about the VM, and how it forgets — the one mechanism that stops a seed
+/// or a change-memo outliving the VM it was written against (decision 1290).
+mod session;
+
+pub(crate) use session::VmMemo;
+
 // The manifest's loaders read as `ui_script::…` at every call site, including the tests' `super::`.
 // `load_default_ui` is no longer test-only: the addon harness (1188 phase 6) loads the whole
 // shipped interface under each surveyed addon, because roughly half of what an addon calls is
@@ -253,7 +259,6 @@ impl Plugin for UiScriptPlugin {
             .init_resource::<PlayerUiClickConsumed>()
             .init_resource::<CursorPayloadHeld>()
             .init_resource::<UiClock>()
-            .init_resource::<IngameUiLoaded>()
             .init_resource::<AddOnIdentity>()
             // After `AssetSet::Open` so the patch chain exists at boot: the VM's first load is
             // the real `GlobalStrings.lua` (the reference's own FrameXML order), which the
@@ -270,7 +275,7 @@ impl Plugin for UiScriptPlugin {
             // has them.
             .add_systems(
                 OnExit(crate::char_select::ClientState::InWorld),
-                shutdown_on_session_end,
+                end_ui_session,
             )
             .add_systems(Update, shutdown_on_exit)
             // `GetFramerate()`'s host half (decision 1195), before the VM ticks so an `OnUpdate`
@@ -338,21 +343,44 @@ fn arbitrate_pointer_over_ui(
 }
 
 fn setup_script(world: &mut World) {
+    install_boot_vm(world);
+}
+
+/// Build a **boot VM** and install it: a Lua state carrying the strings, the emote tokens and the
+/// font-object registry, and no frames at all.
+///
+/// This is the state the client sits at outside the world — the login and character screens — and
+/// the state a world entry loads the in-game UI *onto* ([`load_ingame_ui_on_world_entry`]). It is
+/// installed twice over a session: once at `Startup`, and again at every [`end_ui_session`], which
+/// is what makes a second login a genuine second load rather than a re-entry into the first
+/// login's Lua state.
+///
+/// ONLY the font-object registry at boot (1051). The glyph atlas bakes once, on the first `Update`,
+/// from `script.font_objects()` — and our native glue screens share that one atlas, so the registry
+/// has to exist before the login screen or in-game text loses its outlined variants and its
+/// registry-declared sizes for the whole session. The other 55 files are in-game UI and load at
+/// world entry ([`load_ingame_ui`]); the reference splits at exactly this seam, with GlueXML
+/// carrying its own `GlueFonts.xml`.
+///
+/// **Since 1290 this runs per login, and that is load-bearing rather than incidental.** The
+/// reference re-loads `Fonts.xml` on every rebuild and *must*: `0x48fbf0`'s toc loop has no
+/// already-loaded gate, and both halves of a font object die with the old session — the Lua handle
+/// with `_G`, and the native `CSimpleFont` registry with the frame-script owner (`0x7839c0`, torn
+/// down at `0x490c97`). Because [`end_ui_session`] routes every login through here, every session's
+/// VM gets the registry and every `inherits="GameFontNormal"` in FrameXML resolves. A design that
+/// dropped the VM and skipped index 0 on the in-game load would fail exactly there — verified in
+/// wow-re's §5 for this change (1291).
+fn install_boot_vm(world: &mut World) {
     let script = match UiScript::new() {
         Ok(s) => s,
         Err(e) => {
             error!("ui_script: VM init failed: {e}");
+            world.remove_non_send_resource::<UiScript>();
             return;
         }
     };
     load_global_strings(world, &script);
     load_emote_tokens(world, &script);
-    // ONLY the font-object registry at boot (1051). The glyph atlas bakes once, on the first
-    // `Update`, from `script.font_objects()` — and our native glue screens share that one atlas, so
-    // the registry has to exist before the login screen or in-game text loses its outlined variants
-    // and its registry-declared sizes for the whole session. The other 55 files are in-game UI and
-    // load at world entry ([`load_ingame_ui`]); the reference splits at exactly this seam, with
-    // GlueXML carrying its own `GlueFonts.xml`.
     if ui_wanted(world) {
         // Errors are already logged per file as they happen; the returned list is the test-side
         // assertion (`shipped_xml_tests`), not a second reporting channel.
@@ -368,23 +396,25 @@ fn ui_wanted(world: &World) -> bool {
         || std::env::var("WOW_CAPTURE_UI").as_deref() == Ok("1")
 }
 
-/// Has the in-game UI been materialized this process? The load is **once per process**, not once
-/// per world entry: nothing tears the frame tree down on `OnExit(InWorld)` yet, so a re-entry after
-/// `/logout` must not stack a second copy of every window.
+/// `OnEnter(InWorld)`: materialize the in-game UI for **this** session.
 ///
-/// The reference *does* tear down and rebuild (`ClientDestroyGame 0x401ee0` ↔ `0x401570`, and its
-/// `ReloadUI` is verified end to end doing exactly that). Matching it is the follow-on; this latch
-/// is what makes the move safe without it, and is the thing to delete when the teardown lands.
-#[derive(Resource, Default)]
-pub(crate) struct IngameUiLoaded(pub(crate) bool);
-
-/// `OnEnter(InWorld)`: materialize the in-game UI, once.
+/// **Once per world entry, not once per process** (decision 1290). The reference builds the whole
+/// in-game UI at `CGGameUI::Initialize 0x48fbf0` and destroys it again at `0x490bd0` on the way
+/// out, so every login runs every addon's file scope afresh — and that file scope is where the
+/// corpus reads the character it is looking at (`local currentPlayer = UnitName("player")`, the
+/// idiom [`seat_from_roster`] already documents). While this was latched per process, a second
+/// login kept the first login's captured name: the director's "the selected one is always
+/// Onewarrior no matter what char I log into", and, worse, its saved variables went to the first
+/// character's file. [`world_entry_tests`] holds both ends.
+///
+/// The load runs onto the fresh boot VM [`end_ui_session`] left behind (or, on the first login,
+/// `Startup`'s) — so nothing here has to unpick the previous session; there is nothing to unpick.
 ///
 /// Safe on the state edge only because 1038 moved the initial transition after `PostStartup` — a
 /// capture boots straight into `InWorld`, so before that this would have run ahead of
 /// [`benilla_assets::AssetSet::Open`] and loaded against no patch chain.
 fn load_ingame_ui_on_world_entry(world: &mut World) {
-    if world.resource::<IngameUiLoaded>().0 || !ui_wanted(world) {
+    if !ui_wanted(world) {
         return;
     }
     let Some(mut script) = world.remove_non_send_resource::<UiScript>() else {
@@ -427,7 +457,6 @@ fn load_ingame_ui_on_world_entry(world: &mut World) {
     finish_ui_load(&mut script);
     world.insert_non_send_resource(script);
     world.insert_resource(AddOnIdentity(identity));
-    world.resource_mut::<IngameUiLoaded>().0 = true;
 }
 
 /// The `"player"` snapshot the UI loads **under**, built from the roster row of the pick in
@@ -525,8 +554,19 @@ pub(crate) struct AddOnIdentity(pub(crate) Option<(String, String)>);
 /// carves as (`system/ui/ui.md`):
 ///
 /// > `PLAYER_LEAVING_WORLD` (273) → **`PLAYER_LOGOUT`** (271, `0x490c2a`) → `layout-cache.txt` →
-/// > **the flat saved file** (`0x490c7e`) → **the per-addon files** (`0x490c83`) → `AddOns.txt` →
-/// > destroy the Lua state
+/// > **the flat saved file** (`0x490c7e`) → **the per-addon files** (`0x490c83`) → `AddOns.txt`
+/// > (`0x490c88`) → destroy the frame-script owner (`0x490c97`) → nil all 216 C bindings out of
+/// > `_G` (`0x490cba` → `0x490ce0`)
+///
+/// **The last step is not "destroy the Lua state"** — which is what three of wow-re's own notes
+/// said, until this client's teardown made the question load-bearing and a §5 cross-check settled
+/// it (`system/ui/scratch/lua-state-lifecycle.md`; 1291). `0x490c97` is the frame-script owner's
+/// scalar-deleting destructor — the widget tree and the native virtual-font registry — and the Lua
+/// state outlives it. The state is closed and re-opened at `0x703b80`, which reaches `InitLua` by a
+/// **tail-`jmp`** (`0x703b8e`) rather than a call, which is exactly why a call-census missed it.
+/// Its three callers are `UI_Init 0x48fbf0` (at its *head*), `ShutdownGame 0x491180`, and the glue
+/// builder `0x46a7b0` — so a logout/login cycle runs through four distinct states, and the glue
+/// screen gets its own.
 ///
 /// **`PLAYER_LOGOUT` fires before any write, and that is the point**: it is an addon's last chance
 /// to mutate a saved global, so a handler that stores "where I left off" runs while the write is
@@ -548,11 +588,54 @@ pub(crate) fn shutdown_ui_state(script: &mut UiScript, identity: Option<&(String
 }
 
 /// `OnExit(InWorld)`: a `/logout` back to the glue, or a disconnect — two of the reference's five
-/// roots.
-fn shutdown_on_session_end(script: Option<NonSendMut<UiScript>>, id: Res<AddOnIdentity>) {
-    if let Some(mut script) = script {
-        shutdown_ui_state(&mut script, id.0.as_ref());
+/// roots — and, with the writes done, **the end of this session's Lua state**.
+///
+/// The reference's own shutdown ends by destroying the state (`0x490bd0`'s tail, after
+/// `AddOns.txt`); ours ends by replacing it with a fresh boot VM ([`install_boot_vm`]), which is the
+/// same guarantee expressed the way our two-phase load wants it — the character screen still needs
+/// a font-object registry for the shared glyph atlas, and the next login needs somewhere to load
+/// onto. What matters is that **no frame, no global and no addon upvalue crosses this edge**: that
+/// is what makes the next login a real login (decision 1290) instead of a re-entry into the
+/// previous character's UI.
+///
+/// Exclusive rather than a `NonSendMut` system because it both drops and installs a `NonSend`, and
+/// because the shutdown writes must be ordered against each other — see [`shutdown_ui_state`].
+pub(crate) fn end_ui_session(world: &mut World) {
+    let identity = world
+        .get_resource::<AddOnIdentity>()
+        .and_then(|id| id.0.clone());
+    if let Some(mut script) = world.get_non_send_resource_mut::<UiScript>() {
+        shutdown_ui_state(&mut script, identity.as_ref());
     }
+    world.insert_resource(AddOnIdentity(None));
+
+    // **Everything the host is holding that came OUT of the dying VM goes with it.** A change memo
+    // handles itself — it is keyed on [`benilla_ui::script::UiScript::session`] ([`VmMemo`]) — but
+    // these are plain values other systems read through `Res<…>`, with no VM in hand to key
+    // against, so the edge clears them. Each is a fact about a frame tree that is about to stop
+    // existing: a hovered frame id, the minimap's extracted hole, a payload the cursor is carrying,
+    // and the VM-relative clock the cooldown conversions run through.
+    //
+    // The two input latches were cleared by `char_select`'s logout and disconnect handlers, one
+    // copy each. They belong here: the reason they need clearing is that `feed_ui_input` stops
+    // running outside `InWorld`, which is this edge and nothing to do with *why* we left it.
+    if let Some(mut hover) = world.get_resource_mut::<PlayerUiHover>() {
+        hover.0 = None;
+    }
+    if let Some(mut keys) = world.get_resource_mut::<UiKeyboardCapture>() {
+        keys.0 = false;
+    }
+    if let Some(mut held) = world.get_resource_mut::<CursorPayloadHeld>() {
+        *held = CursorPayloadHeld::default();
+    }
+    if let Some(mut minimap) = world.get_resource_mut::<crate::minimap::MinimapWidget>() {
+        minimap.0 = None;
+    }
+    if let Some(mut clock) = world.get_resource_mut::<UiClock>() {
+        *clock = UiClock::default();
+    }
+
+    install_boot_vm(world);
 }
 
 /// `AppExit`: quitting the client — the quit / application-exit roots. Reads the message rather
@@ -590,10 +673,11 @@ fn shutdown_on_exit(
 ///
 /// **`PLAYER_LOGIN` is the conditional one; `PLAYER_ENTERING_WORLD` is not.** The cascade fires
 /// the former only when `[0xb4e260]` is set, and only the FrameXML-loader path sets it, clearing
-/// it immediately after — so it means "the UI came up", once, which is exactly the
-/// [`IngameUiLoaded`] latch this sits behind. `PLAYER_ENTERING_WORLD` keeps its own per-entry
-/// latch in [`crate::ui_unit`] and still lands after this, since it waits on the self descriptor
-/// arriving over the wire.
+/// it immediately after — so it means "the UI came up". That is once per **UI build**, which since
+/// 1290 is once per world entry here too: this runs from
+/// [`load_ingame_ui_on_world_entry`], on the same edge that built the tree.
+/// `PLAYER_ENTERING_WORLD` keeps its own per-entry latch in [`crate::ui_unit`] and still lands
+/// after this, since it waits on the self descriptor arriving over the wire.
 pub(crate) fn finish_ui_load(script: &mut UiScript) {
     crate::ui_saved::load_saved_variables(script);
     script.fire_event("PLAYER_LOGIN", vec![]);
@@ -707,7 +791,7 @@ pub(crate) fn is_emote_token_line(line: &str) -> bool {
 /// no avatar in a server-less capture) and fire the initial events once — proving the full chain
 /// end-to-end on a screenshot: snapshot → `Unit*` bindings → Lua `OnEvent` → bars + text, for both
 /// unit frames (the target one included, so captures regression-test its show-on-target path).
-fn demo_unit_feed(script: Option<NonSendMut<UiScript>>, mut fired: Local<bool>) {
+fn demo_unit_feed(script: Option<NonSendMut<UiScript>>, mut fired: Local<VmMemo<bool>>) {
     /// The synthetic target's guid — a creature-family high part, so nothing mistakes it for a
     /// player. Only its *distinctness* matters.
     const DEMO_TARGET_GUID: u64 = 0xF130_0000_0000_0001;
@@ -715,6 +799,9 @@ fn demo_unit_feed(script: Option<NonSendMut<UiScript>>, mut fired: Local<bool>)
     let Some(mut script) = script else {
         return;
     };
+    // Session-keyed like every other seed (1290): the one-shot below is `PLAYER_ENTERING_WORLD`
+    // and the bar seeds, which a fresh VM needs again.
+    let fired = fired.get(&script);
     // TEMP DEBUG (WOW_CAPTURE_REHOVER=1): re-fire the world hover EVERY frame — the live
     // flapping-raycast simulation for the under-sized-plate investigation.
     if std::env::var("WOW_CAPTURE_REHOVER").as_deref() == Ok("1") {
@@ -1106,6 +1193,11 @@ mod shipped_xml_tests;
 #[cfg(test)]
 mod bagnon_render_tests;
 
+/// The UI's per-world-entry lifecycle: teardown at the character screen, a genuine second load at
+/// the next login (decision 1290).
+#[cfg(test)]
+mod world_entry_tests;
+
 #[cfg(test)]
 mod seam_scale_tests {
     use super::seam_scale;
diff --git a/crates/benilla-app/src/ui_script/session.rs b/crates/benilla-app/src/ui_script/session.rs
new file mode 100644
index 00000000..d23e20f1
--- /dev/null
+++ b/crates/benilla-app/src/ui_script/session.rs
@@ -0,0 +1,289 @@
+//! **What the host remembers about the VM, and how it forgets.**
+//!
+//! The UI VM does not live for the process — it is built at world entry and destroyed at the
+//! character screen, once per login (decision 1290, the reference's `0x48fbf0` ↔ `0x490bd0`). That
+//! makes every host-side "I already told the VM about this" a claim with an expiry date, and there
+//! are two kinds of them:
+//!
+//! - **seeds** — a registry, a catalog, a keybinding set: pushed once, because pushing it is
+//!   expensive and its content does not change. A `bool` latch, or a `PostStartup` system, which is
+//!   the same latch written in the scheduler.
+//! - **change memos** — "these are the action slots I last pushed", so an unchanged frame costs
+//!   nothing. A `Local<FeedMemory>`, near-universally.
+//!
+//! Both are *correct* against one VM and *silently wrong* against the next, and the failure has no
+//! error path: the push simply does not happen, and the window is empty. Session 2's action bar,
+//! bags, spellbook, keybinds and macros all failed exactly this way, and one of them — the CVar
+//! table — failed worse than empty: `save_config` composes `config.toml` from the VM's snapshot, so
+//! an unseeded VM would have written the player's settings file back out **stripped**.
+//!
+//! [`VmMemo`] is the one mechanism for both. It keys the memory on
+//! [`UiScript::session`] — a VM-side identity, not a host-side counter someone must remember to
+//! bump — so a memory written against a dead VM cannot be read at all. The failure mode inverts:
+//! forgetting to use it is visible (the memo is a plain `Local` again), while using it and being
+//! wrong costs one redundant push per login.
+
+use benilla_ui::script::UiScript;
+
+/// A host-side memory about the UI VM — **valid only for the VM it was written against**.
+///
+/// Wrap the memo type and read it through [`VmMemo::get`]; against a VM other than the one that
+/// last wrote it, the memo resets to `T::default()` first. The wrapped type is unchanged, so the
+/// call sites keep their own shape:
+///
+/// ```ignore
+/// mut memory: Local<VmMemo<FeedMemory>>,
+/// // …
+/// let memory = memory.get(&script);
+/// if memory.pushed.get(&id) != Some(&slot) { /* push */ }
+/// ```
+pub(crate) struct VmMemo<T> {
+    /// The VM this memory is about. `0` is "no VM" — [`UiScript::session`] hands out from 1, so a
+    /// freshly defaulted memo matches nothing, and the first read of every session is a miss.
+    session: u64,
+    inner: T,
+}
+
+impl<T: Default> Default for VmMemo<T> {
+    fn default() -> Self {
+        Self {
+            session: 0,
+            inner: T::default(),
+        }
+    }
+}
+
+impl<T: Default> VmMemo<T> {
+    /// The memory — **cleared first if this is a different VM** than the one that wrote it.
+    pub(crate) fn get(&mut self, script: &UiScript) -> &mut T {
+        self.get_for(Some(script))
+    }
+
+    /// [`VmMemo::get`] for a system that also runs with **no VM** — the character screen, where the
+    /// session's Lua state does not exist (1290).
+    ///
+    /// "No VM" is a session in its own right, and it is session `0`: the memory resets once on the
+    /// way into it and once on the way out, and holds in between. Reaching for a scratch default
+    /// each frame instead would quietly turn the memo off for the whole glue phase.
+    pub(crate) fn get_for(&mut self, script: Option<&UiScript>) -> &mut T {
+        let now = script.map_or(0, UiScript::session);
+        if self.session != now {
+            self.session = now;
+            self.inner = T::default();
+        }
+        &mut self.inner
+    }
+}
+
+impl VmMemo<bool> {
+    /// **True exactly once per VM** — the seed shape: `if seeded.claim(&script) { …push the
+    /// registry… }`.
+    pub(crate) fn claim(&mut self, script: &UiScript) -> bool {
+        let done = self.get(script);
+        if *done {
+            false
+        } else {
+            *done = true;
+            true
+        }
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    /// The property the whole mechanism rests on: a memo written against one VM is not readable
+    /// from the next, and a seed claimed in one session is claimable again in the one after.
+    #[test]
+    fn a_memo_does_not_survive_the_vm_it_was_written_against() {
+        let first = UiScript::new().expect("VM");
+        let second = UiScript::new().expect("VM");
+        assert_ne!(
+            first.session(),
+            second.session(),
+            "every VM gets its own identity"
+        );
+
+        let mut memo: VmMemo<Vec<u32>> = VmMemo::default();
+        memo.get(&first).push(7);
+        assert_eq!(memo.get(&first), &vec![7], "…and keeps it within one VM");
+        assert!(
+            memo.get(&second).is_empty(),
+            "a memo about the previous VM reads as empty against the next one"
+        );
+        assert!(
+            memo.get(&first).is_empty(),
+            "and moving back does not resurrect it — the memory is gone, not shelved"
+        );
+    }
+
+    #[test]
+    fn a_seed_is_claimed_once_per_vm() {
+        let first = UiScript::new().expect("VM");
+        let second = UiScript::new().expect("VM");
+        let mut seeded = VmMemo::<bool>::default();
+
+        assert!(seeded.claim(&first), "the first VM needs seeding");
+        assert!(!seeded.claim(&first), "…and only once");
+        assert!(seeded.claim(&second), "the next VM needs it again");
+        assert!(!seeded.claim(&second));
+    }
+
+    /// **The rule, enforced instead of remembered.**
+    ///
+    /// A feed that memoizes what it pushed into the VM and does *not* key that memo on the session
+    /// fails in the one way nothing catches: it pushes nothing into the new VM, the window is
+    /// empty, and no error is raised anywhere. There is no runtime signal to test for — which is
+    /// exactly why the check has to be structural.
+    ///
+    /// So: a `Local<…>` in the parameter list of a system that also takes the VM must be a
+    /// [`VmMemo`], or be named in [`EXEMPT`] with the reason it is not host-memory-about-the-VM.
+    /// Adding a feed the ordinary way passes; adding one with a bare `Local` fails here, at the
+    /// line, before it can reach a login.
+    #[test]
+    fn a_local_in_a_system_that_holds_the_vm_is_keyed_on_the_session() {
+        let src = std::path::Path::new(env!("CARGO_MANIFEST_DIR")).join("src");
+        let mut offenders = Vec::new();
+        for file in rust_files(&src) {
+            let text = std::fs::read_to_string(&file).expect("readable source");
+            if !text.contains("UiScript") {
+                continue; // no VM in this file, so no memory about one
+            }
+            let rel = file
+                .strip_prefix(&src)
+                .unwrap_or(&file)
+                .to_string_lossy()
+                .replace('\\', "/");
+            for params in fn_parameter_lists(&text) {
+                if !params.contains("UiScript") {
+                    continue;
+                }
+                for (name, ty) in locals_in(params) {
+                    if ty.contains("VmMemo") || EXEMPT.contains(&(rel.as_str(), name.as_str())) {
+                        continue;
+                    }
+                    offenders.push(format!("{rel}: `{name}: Local<{ty}>`"));
+                }
+            }
+        }
+        assert!(
+            offenders.is_empty(),
+            "these memos outlive the VM they are about — wrap them in \
+             `crate::ui_script::VmMemo<…>` and read them through `.get(&script)`, or add them to \
+             `EXEMPT` with the reason they are not memory about the VM (decision 1290):\n  {}",
+            offenders.join("\n  ")
+        );
+    }
+
+    /// `Local`s that live in a system holding the VM but are **not memory about the VM**, each with
+    /// the reason. Keyed `(path under src/, parameter name)`.
+    const EXEMPT: &[(&str, &str)] = &[
+        // A raster fact (the screen seam), not a VM push. The measurer beside it deliberately
+        // re-seats off `!script.has_text_measurer()` — it interrogates the VM instead of a memo,
+        // which is the same guarantee arrived at the other way.
+        ("ui_script/extract/mod.rs", "last_seam"),
+        // Pushed unconditionally every frame; there is nothing remembered to go stale.
+        ("ui_script/mod.rs", "smoothed"),
+        // The cursor systems, both platform arms: these track the OS cursor and an `NSCursor` raw
+        // pointer. The OS keeps that state across the VM's death and rebirth, so re-seating them at
+        // a login would re-assert a cursor nothing changed. (`last_set` is the key we last handed
+        // the window — the same fact under the same name on both arms.)
+        ("cursor.rs", "was_looking"),
+        ("cursor.rs", "rects_disabled"),
+        ("cursor.rs", "decode_failed"),
+        ("cursor.rs", "last_set"),
+        ("cursor.rs", "last_ptr"),
+    ];
+
+    /// Every `.rs` file under `root`, recursively.
+    fn rust_files(root: &std::path::Path) -> Vec<std::path::PathBuf> {
+        let mut out = Vec::new();
+        let mut stack = vec![root.to_path_buf()];
+        while let Some(dir) = stack.pop() {
+            let Ok(entries) = std::fs::read_dir(&dir) else {
+                continue;
+            };
+            for entry in entries.flatten() {
+                let path = entry.path();
+                if path.is_dir() {
+                    stack.push(path);
+                } else if path.extension().is_some_and(|e| e == "rs") {
+                    out.push(path);
+                }
+            }
+        }
+        out
+    }
+
+    /// The parenthesised parameter list of every `fn` in `text`, by paren matching — so the scan
+    /// sees a signature rather than a whole body, and a `Local` in some unrelated expression
+    /// cannot be mistaken for a system parameter.
+    fn fn_parameter_lists(text: &str) -> Vec<&str> {
+        let bytes = text.as_bytes();
+        let mut out = Vec::new();
+        for (i, _) in text.match_indices("fn ") {
+            // `fn` must start a word: `…_fn (` and `Fn(` are not declarations.
+            if i > 0 && (bytes[i - 1].is_ascii_alphanumeric() || bytes[i - 1] == b'_') {
+                continue;
+            }
+            let Some(open) = text[i..].find('(').map(|o| i + o) else {
+                continue;
+            };
+            // A generic parameter list can carry parens, but never before the argument list's `(`
+            // in the shapes this codebase writes; a `<` with an unbalanced `(` would just scan on.
+            let mut depth = 0usize;
+            let mut close = None;
+            for (j, c) in text[open..].char_indices() {
+                match c {
+                    '(' => depth += 1,
+                    ')' => {
+                        depth -= 1;
+                        if depth == 0 {
+                            close = Some(open + j);
+                            break;
+                        }
+                    }
+                    _ => {}
+                }
+            }
+            if let Some(close) = close {
+                out.push(&text[open + 1..close]);
+            }
+        }
+        out
+    }
+
+    /// Every `name: Local<Ty>` in a parameter list, as `(name, Ty)` — angle-bracket matched, so a
+    /// nested generic comes back whole.
+    fn locals_in(params: &str) -> Vec<(String, String)> {
+        let mut out = Vec::new();
+        for (i, _) in params.match_indices("Local<") {
+            let open = i + "Local<".len();
+            let mut depth = 1usize;
+            let mut close = None;
+            for (j, c) in params[open..].char_indices() {
+                match c {
+                    '<' => depth += 1,
+                    '>' => {
+                        depth -= 1;
+                        if depth == 0 {
+                            close = Some(open + j);
+                            break;
+                        }
+                    }
+                    _ => {}
+                }
+            }
+            let Some(close) = close else { continue };
+            // Walk back over `: ` and `mut ` to the parameter's own name.
+            let head = params[..i].trim_end().trim_end_matches(':').trim_end();
+            let name = head
+                .rsplit(|c: char| c == ',' || c == '(' || c.is_whitespace())
+                .find(|s| !s.is_empty() && *s != "mut")
+                .unwrap_or("<unnamed>");
+            out.push((name.to_string(), params[open..close].trim().to_string()));
+        }
+        out
+    }
+}
diff --git a/crates/benilla-app/src/ui_script/world_entry_tests.rs b/crates/benilla-app/src/ui_script/world_entry_tests.rs
new file mode 100644
index 00000000..b0df9720
--- /dev/null
+++ b/crates/benilla-app/src/ui_script/world_entry_tests.rs
@@ -0,0 +1,300 @@
+//! **"The selected one is always Onewarrior no matter what char I log into."** — the director's
+//! character-switch report, reproduced at the edge that causes it.
+//!
+//! ## Why this file exists
+//!
+//! The symptom arrived as a dropdown bug: Bagnon's character menu never moved its checkmark off
+//! whoever the session started as. It is not a dropdown bug and it is not Bagnon's. Every addon on
+//! the machine reads the live character **once, at file scope** — `local currentPlayer =
+//! UnitName("player")` is the corpus idiom, not an idiosyncrasy — and until this landed the file
+//! scope ran exactly once per **process**. Logging out to the character screen and back in kept the
+//! same VM, so nothing re-read it.
+//!
+//! The tests here drive the two real edges — [`super::load_ingame_ui_on_world_entry`] and
+//! [`super::end_ui_session`] — over a planted addon that captures the name the same way, and assert
+//! the second login sees the second character. Reverting the rebuild makes
+//! [`the_second_login_runs_addon_file_scope_under_the_second_character`] report `Onehunter`, which
+//! is the director's screenshot in one string.
+//!
+//! Nothing here needs the client install or the addon corpus: the probe addon is written into a
+//! hermetic `BENILLA_HOME` by the test itself.
+
+use bevy::prelude::*;
+
+use crate::char_select::Roster;
+use crate::local_state::test_env::{EnvGuard, ENV_LOCK};
+
+/// **Bagnon's own idiom**, reduced to the one line that carries the bug: the live character's name,
+/// read once while the file runs, and parked where the test can see it.
+///
+/// `SwitchProbeLoads` counts file-scope runs *within one VM*, so a rebuild resets it to 1 — that
+/// number is what tells a re-entry apart from a second load stacked onto the same state.
+const PROBE_LUA: &str = "\
+local currentPlayer = UnitName(\"player\")
+SwitchProbeFileScope = currentPlayer
+SwitchProbeLoads = (SwitchProbeLoads or 0) + 1
+SwitchProbeDB = { who = currentPlayer }
+";
+
+/// …and it declares that table as a per-character saved variable, so the shutdown writes a real
+/// file — which is what [`quitting_from_the_character_screen_does_not_blank_the_session_it_wrote`]
+/// watches.
+const PROBE_TOC: &str = "\
+## Interface: 11200
+## SavedVariablesPerCharacter: SwitchProbeDB
+SwitchProbe.lua
+";
+
+/// A roster with a pick in flight, named — the state a world entry actually runs in
+/// ([`super::seat_from_roster`] reads exactly this).
+fn roster_named(name: &str, guid: u64) -> Roster {
+    let row = benilla_protocol::Character {
+        guid,
+        name: name.into(),
+        race: 1,  // Human → Alliance
+        class: 1, // Warrior
+        gender: 0,
+        level: 60,
+        skin: 0,
+        face: 0,
+        hair_style: 0,
+        hair_color: 0,
+        facial_hair: 0,
+        zone: 0,
+        map: 0,
+        position: benilla_protocol::wire::Vector3d {
+            x: 0.0,
+            y: 0.0,
+            z: 0.0,
+        },
+        flags: 0,
+        equipment: [benilla_protocol::CharEnumItem::default(); 19],
+    };
+    Roster::with_pending_pick(vec![row], guid)
+}
+
+/// A hermetic state folder holding one addon — the probe — and the guards that point the whole
+/// client at it. Every guard must outlive the world.
+fn hermetic_probe(tag: &str) -> (std::path::PathBuf, EnvGuard, EnvGuard) {
+    // The pid keeps two concurrent `benilla_app` test binaries out of each other's tree, the same
+    // reason `addons::tests::hermetic_root` carries one.
+    let tmp =
+        std::env::temp_dir().join(format!("benilla-world-entry-{tag}-{}", std::process::id()));
+    let _ = std::fs::remove_dir_all(&tmp);
+    let home = tmp.join("benilla-config");
+    let dir = home.join("AddOns").join("SwitchProbe");
+    std::fs::create_dir_all(&dir).expect("probe addon dir");
+    std::fs::write(dir.join("SwitchProbe.toc"), PROBE_TOC).expect("probe toc");
+    std::fs::write(dir.join("SwitchProbe.lua"), PROBE_LUA).expect("probe lua");
+    let capture = EnvGuard::unset("WOW_CAPTURE");
+    let benilla_home = EnvGuard::set("BENILLA_HOME", home.to_str().expect("utf-8 temp path"));
+    (tmp, capture, benilla_home)
+}
+
+/// The world a session boots into: `Startup` has run ([`super::setup_script`]), so there is a VM
+/// carrying the font registry and nothing else.
+fn booted_world() -> World {
+    let mut world = World::new();
+    world.init_resource::<super::AddOnIdentity>();
+    world.init_resource::<crate::minimap::MinimapZoom>();
+    super::setup_script(&mut world);
+    world
+}
+
+/// One login, driven exactly as the app drives it: the roster carries the pick, then the world-entry
+/// edge runs.
+fn log_in_as(world: &mut World, name: &str, guid: u64) {
+    world.insert_resource(roster_named(name, guid));
+    super::load_ingame_ui_on_world_entry(world);
+}
+
+/// What the probe addon captured at file scope this session — `None` if it never ran.
+fn probe_saw(world: &World) -> Option<String> {
+    world
+        .get_non_send_resource::<benilla_ui::script::UiScript>()
+        .and_then(|s| s.eval::<Option<String>>("SwitchProbeFileScope").ok())
+        .flatten()
+}
+
+/// Is a named frame our own FrameXML creates present in the live VM?
+fn frame_exists(world: &World, name: &str) -> bool {
+    world
+        .get_non_send_resource::<benilla_ui::script::UiScript>()
+        .and_then(|s| s.eval::<bool>(&format!("return {name} ~= nil")).ok())
+        .unwrap_or(false)
+}
+
+/// How many times the probe's file scope ran **in the VM that is live now**.
+fn probe_loads(world: &World) -> u32 {
+    world
+        .get_non_send_resource::<benilla_ui::script::UiScript>()
+        .and_then(|s| s.eval::<Option<u32>>("SwitchProbeLoads").ok())
+        .flatten()
+        .unwrap_or(0)
+}
+
+/// **The director's report.** Log in as one character, log out to the character screen, log in as
+/// another: the second character's addons must see the second character.
+///
+/// Pre-fix this asserts `Onehunter` on the second login — the whole bug, in one string.
+#[test]
+fn the_second_login_runs_addon_file_scope_under_the_second_character() {
+    let _l = ENV_LOCK
+        .lock()
+        .unwrap_or_else(std::sync::PoisonError::into_inner);
+    let (tmp, _c, _h) = hermetic_probe("switch");
+    let mut world = booted_world();
+
+    log_in_as(&mut world, "Onehunter", 1);
+    assert_eq!(
+        probe_saw(&world).as_deref(),
+        Some("Onehunter"),
+        "the first login's addon file scope reads the first character"
+    );
+
+    super::end_ui_session(&mut world);
+    log_in_as(&mut world, "Onewarrior", 2);
+
+    assert_eq!(
+        probe_saw(&world).as_deref(),
+        Some("Onewarrior"),
+        "the second login's addon file scope must read the SECOND character — this is the \
+         director's \"always Onewarrior\" report, from the other side"
+    );
+    assert_eq!(
+        probe_loads(&world),
+        1,
+        "the second session is a FRESH VM, not the first one loaded twice — a second load stacked \
+         onto the live state would count 2 and would have two of every frame"
+    );
+
+    drop(world);
+    let _ = std::fs::remove_dir_all(&tmp);
+}
+
+/// The identity the shutdown writes under follows the character, so a logout does not file the
+/// second character's saved variables under the first one's name.
+///
+/// This is the data-corruption half of the same bug: with the load latched, `AddOnIdentity` was
+/// only ever written on the first entry, so every later session's `SavedVariables` went into the
+/// first character's folder.
+#[test]
+fn the_addon_identity_follows_the_character() {
+    let _l = ENV_LOCK
+        .lock()
+        .unwrap_or_else(std::sync::PoisonError::into_inner);
+    let (tmp, _c, _h) = hermetic_probe("identity");
+    let mut world = booted_world();
+
+    log_in_as(&mut world, "Onehunter", 1);
+    let first = world.resource::<super::AddOnIdentity>().0.clone();
+    super::end_ui_session(&mut world);
+    log_in_as(&mut world, "Onewarrior", 2);
+    let second = world.resource::<super::AddOnIdentity>().0.clone();
+
+    assert_ne!(
+        first, second,
+        "the enable-state / saved-variables identity is re-resolved per login"
+    );
+    assert_eq!(
+        second.as_ref().map(|(_, c)| c.as_str()),
+        Some("Onewarrior"),
+        "and it names the character actually logged in"
+    );
+
+    drop(world);
+    let _ = std::fs::remove_dir_all(&tmp);
+}
+
+/// **Quitting from the character screen must not blank what the session already wrote.**
+///
+/// The client's shutdown runs from five roots, and two of them can fire in sequence: a `/logout`
+/// ends the session, and then the player quits from the character screen — where `AppExit` runs
+/// [`super::shutdown_ui_state`] again, now against a boot VM with no addon in it. Writing the saved
+/// variables *from* that VM would compose every file from nothing.
+///
+/// It does not, and this pins why: the three write paths each refuse an empty source
+/// (`ui_saved::save` on `names.is_empty()`, `save_enable_state` on `states.is_empty()` — its own
+/// comment already called an empty write a wipe — and `save_addon_variables` because a boot VM
+/// declares no variable sets to iterate). The reference reaches the same place with an explicit
+/// guard (`0x401ee0`'s `ds:0x882734` test: "logout then quit writes once, not twice"); ours falls
+/// out of the writers having nothing to say, which is only a *safe* answer for as long as those
+/// guards hold. Hence a test rather than a comment.
+#[test]
+fn quitting_from_the_character_screen_does_not_blank_the_session_it_wrote() {
+    let _l = ENV_LOCK
+        .lock()
+        .unwrap_or_else(std::sync::PoisonError::into_inner);
+    let (tmp, _c, _h) = hermetic_probe("quit");
+    let mut world = booted_world();
+
+    log_in_as(&mut world, "Onehunter", 1);
+    super::end_ui_session(&mut world);
+
+    let saved = crate::local_state::addon_saved_character_dir("Realm", "Onehunter")
+        .expect("a hermetic home resolves the per-character saved dir")
+        .join("SwitchProbe.lua");
+    let after_logout = std::fs::read_to_string(&saved).expect("the logout wrote the addon's file");
+    assert!(
+        after_logout.contains("Onehunter"),
+        "…and wrote the character it belonged to: {after_logout}"
+    );
+
+    // Now quit — `shutdown_on_exit`'s body, against the boot VM the logout left behind.
+    let identity = world.resource::<super::AddOnIdentity>().0.clone();
+    let mut script = world
+        .remove_non_send_resource::<benilla_ui::script::UiScript>()
+        .expect("a boot VM is live at the character screen");
+    super::shutdown_ui_state(&mut script, identity.as_ref());
+
+    assert_eq!(
+        std::fs::read_to_string(&saved).ok().as_deref(),
+        Some(after_logout.as_str()),
+        "the quit pass wrote nothing — the session's file is byte-identical"
+    );
+
+    drop(world);
+    let _ = std::fs::remove_dir_all(&tmp);
+}
+
+/// Between a logout and the next login there is **no in-game UI at all** — the character screen is
+/// native, and the previous session's frame tree must not survive behind it.
+///
+/// 1051 measured what that costs when it does: probed under login-screen conditions the in-game
+/// tree emits 193 quads, invisible only because the glue screen's opaque node covers them.
+#[test]
+fn logging_out_leaves_no_in_game_frames_behind() {
+    let _l = ENV_LOCK
+        .lock()
+        .unwrap_or_else(std::sync::PoisonError::into_inner);
+    let (tmp, _c, _h) = hermetic_probe("teardown");
+    let mut world = booted_world();
+
+    log_in_as(&mut world, "Onehunter", 1);
+    assert!(
+        probe_saw(&world).is_some(),
+        "the session under test actually loaded"
+    );
+
+    super::end_ui_session(&mut world);
+
+    assert_eq!(
+        probe_saw(&world),
+        None,
+        "the session's Lua state is gone at the character screen"
+    );
+    assert!(
+        !frame_exists(&world, "PlayerFrame"),
+        "and so is the in-game frame tree — 1051 measured 193 quads' worth of it surviving \
+         behind the glue screen's opaque node"
+    );
+    assert!(
+        world
+            .get_non_send_resource::<benilla_ui::script::UiScript>()
+            .is_some(),
+        "a boot VM stays: the character screen's text still bakes off the shared font registry"
+    );
+
+    drop(world);
+    let _ = std::fs::remove_dir_all(&tmp);
+}
diff --git a/crates/benilla-app/src/ui_shapeshift.rs b/crates/benilla-app/src/ui_shapeshift.rs
index b4a4bf61..2d52d71c 100644
--- a/crates/benilla-app/src/ui_shapeshift.rs
+++ b/crates/benilla-app/src/ui_shapeshift.rs
@@ -95,11 +95,12 @@ fn feed_shapeshift_bar(
     mut items: ResMut<Items>,
     commands: Res<NetCommands>,
     clock: Res<crate::ui_script::UiClock>,
-    mut memory: Local<StanceMemory>,
+    mut memory: Local<crate::ui_script::VmMemo<StanceMemory>>,
 ) {
     let Some(mut script) = script else {
         return;
     };
+    let memory = memory.get(&script);
     let Some(spells) = spells else {
         return;
     };
diff --git a/crates/benilla-app/src/ui_social/feed.rs b/crates/benilla-app/src/ui_social/feed.rs
index ac558f8b..fc09b9b4 100644
--- a/crates/benilla-app/src/ui_social/feed.rs
+++ b/crates/benilla-app/src/ui_social/feed.rs
@@ -46,11 +46,12 @@ pub(super) fn feed_social(
     areas: Option<Res<AreaTableRes>>,
     commands: Res<NetCommands>,
     mut chat_log: ResMut<ChatLog>,
-    mut fed: Local<FedSocial>,
+    mut fed: Local<crate::ui_script::VmMemo<FedSocial>>,
 ) {
     let Some(mut script) = script else {
         return;
     };
+    let fed = fed.get(&script);
     let areas = areas.as_deref().map(|a| &a.0);
 
     // The owed system lines first: a line about a friend who just went offline should land before
diff --git a/crates/benilla-app/src/ui_spellbook.rs b/crates/benilla-app/src/ui_spellbook.rs
index 90814b2a..a3aadfca 100644
--- a/crates/benilla-app/src/ui_spellbook.rs
+++ b/crates/benilla-app/src/ui_spellbook.rs
@@ -131,11 +131,12 @@ fn feed_spellbook(
     commands: Res<NetCommands>,
     cooldowns: Res<crate::cooldowns::Cooldowns>,
     clock: Res<crate::ui_script::UiClock>,
-    mut memory: Local<FeedMemory>,
+    mut memory: Local<crate::ui_script::VmMemo<FeedMemory>>,
 ) {
     let Some(mut script) = script else {
         return;
     };
+    let memory = memory.get(&script);
     // Nothing to resolve a name/icon/passive from yet — try again once Spell.dbc lands.
     let Some(spells) = spells.as_deref() else {
         return;
diff --git a/crates/benilla-app/src/ui_talent.rs b/crates/benilla-app/src/ui_talent.rs
index 8500cbea..505f6ddc 100644
--- a/crates/benilla-app/src/ui_talent.rs
+++ b/crates/benilla-app/src/ui_talent.rs
@@ -97,11 +97,12 @@ fn feed_talents(
     spells: Option<Res<Spells>>,
     self_q: Query<&ObjectStore, With<SelfPlayer>>,
     mut chat: ResMut<ChatLog>,
-    mut memory: Local<FeedMemory>,
+    mut memory: Local<crate::ui_script::VmMemo<FeedMemory>>,
 ) {
     let Some(mut script) = script else {
         return;
     };
+    let memory = memory.get(&script);
     let (Some(talents), Some(spells)) = (talents.as_deref(), spells.as_deref()) else {
         return;
     };
diff --git a/crates/benilla-app/src/ui_taxi/mod.rs b/crates/benilla-app/src/ui_taxi/mod.rs
index 23a31dae..e96cc8b8 100644
--- a/crates/benilla-app/src/ui_taxi/mod.rs
+++ b/crates/benilla-app/src/ui_taxi/mod.rs
@@ -185,13 +185,16 @@ fn feed_taxi(
     mut names: ResMut<NameCache>,
     commands: Res<NetCommands>,
     mut cache: ResMut<TaxiRouteCache>,
-    mut last: Local<Option<TaxiUiState>>,
-    mut last_name: Local<Option<String>>,
-    mut last_riding: Local<Option<bool>>,
+    mut last: Local<crate::ui_script::VmMemo<Option<TaxiUiState>>>,
+    mut last_name: Local<crate::ui_script::VmMemo<Option<String>>>,
+    mut last_riding: Local<crate::ui_script::VmMemo<Option<bool>>>,
 ) {
     let Some(mut script) = script else {
         return;
     };
+    let last = last.get(&script);
+    let last_name = last_name.get(&script);
+    let last_riding = last_riding.get(&script);
 
     // The activate verdict (SMSG_ACTIVATETAXIREPLY), staged by the net bridge: a refusal surfaces
     // on the red error line (the trainer/merchant UI_ERROR_MESSAGE pattern); OK clears the map —
diff --git a/crates/benilla-app/src/ui_tooltip/mod.rs b/crates/benilla-app/src/ui_tooltip/mod.rs
index a125413d..cb4b9eb0 100644
--- a/crates/benilla-app/src/ui_tooltip/mod.rs
+++ b/crates/benilla-app/src/ui_tooltip/mod.rs
@@ -354,11 +354,12 @@ fn feed_spell_tooltips(
     mut items: ResMut<Items>,
     sub_classes: Option<Res<crate::ui_items::ItemSubClasses>>,
     commands: Res<NetCommands>,
-    mut memory: Local<SpellFeedMemory>,
+    mut memory: Local<crate::ui_script::VmMemo<SpellFeedMemory>>,
 ) {
     let Some(mut script) = script else {
         return;
     };
+    let memory = memory.get(&script);
     let Some(spells) = spells.as_deref() else {
         return;
     };
@@ -592,12 +593,14 @@ fn drive_mouseover_tooltip(
     player_actions: Res<crate::ui_action::PlayerActions>,
     // The cursor seat crosses the VM seam (0582/0584): the anchor below is UI units, not px.
     ui_scale: Res<crate::ui_script::UiScaleCvar>,
-    mut last: Local<LastHover>,
-    mut last_lines: Local<Option<UnitState>>,
+    mut last: Local<crate::ui_script::VmMemo<LastHover>>,
+    mut last_lines: Local<crate::ui_script::VmMemo<Option<UnitState>>>,
 ) {
     let Some(mut script) = script else {
         return;
     };
+    let last = last.get(&script);
+    let last_lines = last_lines.get(&script);
     let self_store = self_q.iter().next();
 
     // The hovered UNIT's snapshot (a hovered non-unit resolves no store here).
diff --git a/crates/benilla-app/src/ui_trade.rs b/crates/benilla-app/src/ui_trade.rs
index 33a0a2db..c73776f3 100644
--- a/crates/benilla-app/src/ui_trade.rs
+++ b/crates/benilla-app/src/ui_trade.rs
@@ -345,14 +345,18 @@ fn feed_trade(
     icons: Option<Res<ItemDisplays>>,
     mut names: ResMut<NameCache>,
     commands: Res<NetCommands>,
-    mut last: Local<Option<TradeState>>,
-    mut last_open: Local<bool>,
-    mut last_accept: Local<(bool, bool)>,
-    mut last_player_gold: Local<u32>,
+    mut last: Local<crate::ui_script::VmMemo<Option<TradeState>>>,
+    mut last_open: Local<crate::ui_script::VmMemo<bool>>,
+    mut last_accept: Local<crate::ui_script::VmMemo<(bool, bool)>>,
+    mut last_player_gold: Local<crate::ui_script::VmMemo<u32>>,
 ) {
     let Some(mut script) = script else {
         return;
     };
+    let last = last.get(&script);
+    let last_open = last_open.get(&script);
+    let last_accept = last_accept.get(&script);
+    let last_player_gold = last_player_gold.get(&script);
 
     let fresh = snapshot(&trade, &mut items, icons.as_deref(), &mut names, &commands);
     let opened = !*last_open && trade.is_open();
diff --git a/crates/benilla-app/src/ui_tradeskill.rs b/crates/benilla-app/src/ui_tradeskill.rs
index fac5b1f4..e5237e47 100644
--- a/crates/benilla-app/src/ui_tradeskill.rs
+++ b/crates/benilla-app/src/ui_tradeskill.rs
@@ -362,11 +362,12 @@ fn feed_trade_skill(
     mut items: ResMut<Items>,
     commands: Res<NetCommands>,
     cooldowns: Res<crate::cooldowns::Cooldowns>,
-    mut last: Local<Option<TradeSkillState>>,
+    mut last: Local<crate::ui_script::VmMemo<Option<TradeSkillState>>>,
 ) {
     let Some(mut script) = script else {
         return;
     };
+    let last = last.get(&script);
     let fresh = (|| -> Option<TradeSkillState> {
         let line = open.line?;
         let spells = spells.as_deref()?;
diff --git a/crates/benilla-app/src/ui_trainer/mod.rs b/crates/benilla-app/src/ui_trainer/mod.rs
index 360a7659..f50411dd 100644
--- a/crates/benilla-app/src/ui_trainer/mod.rs
+++ b/crates/benilla-app/src/ui_trainer/mod.rs
@@ -319,13 +319,16 @@ fn feed_trainer(
     mut errors: ResMut<TrainerErrors>,
     commands: Res<NetCommands>,
     mut names: ResMut<NameCache>,
-    mut last: Local<Option<TrainerState>>,
-    mut last_trainer: Local<Option<u64>>,
-    mut last_name: Local<Option<String>>,
+    mut last: Local<crate::ui_script::VmMemo<Option<TrainerState>>>,
+    mut last_trainer: Local<crate::ui_script::VmMemo<Option<u64>>>,
+    mut last_name: Local<crate::ui_script::VmMemo<Option<String>>>,
 ) {
     let Some(mut script) = script else {
         return;
     };
+    let last = last.get(&script);
+    let last_trainer = last_trainer.get(&script);
+    let last_name = last_name.get(&script);
     // Refusals surface as the client's red error line (the merchant/equip/cast path's exact shape).
     for code in errors.0.drain(..) {
         script.fire_event(
diff --git a/crates/benilla-app/src/ui_unit.rs b/crates/benilla-app/src/ui_unit.rs
index b0e8d778..3e435842 100644
--- a/crates/benilla-app/src/ui_unit.rs
+++ b/crates/benilla-app/src/ui_unit.rs
@@ -150,7 +150,10 @@ impl Plugin for UiUnitPlugin {
         )
         .add_systems(Update, drain_pvp_toggles.after(UiInput))
         .add_systems(Update, feed_default_language.in_set(UnitFeed))
-        .add_systems(PostStartup, (load_exhaustion_rows, load_default_languages));
+        // `load_exhaustion_rows` pushes into the VM, so it runs per VM in `Update` (1290);
+        // `load_default_languages` only builds a Bevy resource and stays a one-shot.
+        .add_systems(Update, load_exhaustion_rows)
+        .add_systems(PostStartup, load_default_languages);
     }
 }
 
@@ -194,11 +197,12 @@ fn feed_default_language(
     script: Option<NonSendMut<UiScript>>,
     self_q: Query<&ObjectStore, With<SelfPlayer>>,
     langs: Option<Res<DefaultLanguagesRes>>,
-    mut pushed: Local<Option<Option<String>>>,
+    mut pushed: Local<crate::ui_script::VmMemo<Option<Option<String>>>>,
 ) {
     let Some(mut script) = script else {
         return;
     };
+    let pushed = pushed.get(&script);
     let name = self_q
         .iter()
         .next()
@@ -212,17 +216,25 @@ fn feed_default_language(
     }
 }
 
-/// Seed the VM's Exhaustion.dbc table once at startup — the rest bindings' data
+/// Seed the VM's Exhaustion.dbc table once per VM — the rest bindings' data
 /// ([`benilla_ui::script::UiScript::set_exhaustion_rows`]; the ui_macro icon-catalog shape).
 /// A failed load keeps the model's shipped-table fallback, so the rest surface still behaves
 /// like the shipped enUS client rather than going dark.
+///
+/// Per VM rather than per process (1290) for the reason every seed here is: a login builds a fresh
+/// VM, and this one degrades quietly — the fallback table is close enough that nobody would notice
+/// it had stopped being seeded.
 fn load_exhaustion_rows(
     script: Option<NonSendMut<UiScript>>,
     assets: Option<Res<benilla_assets::WorldAssets>>,
+    mut seeded: Local<crate::ui_script::VmMemo<bool>>,
 ) {
     let (Some(mut script), Some(assets)) = (script, assets) else {
         return;
     };
+    if !seeded.claim(&script) {
+        return;
+    }
     let loaded = {
         use benilla_assets::LockRecover;
         let mut chain = assets.chain.lock_recover();
@@ -909,9 +921,9 @@ fn feed_units(
     // is structural for every consumer.
     //
     // The absent arm is the world-EXIT edge (logout / char switch — the self entity despawns
-    // with the streamed world): the real client fires this event on *every* world entry (it
-    // tears the whole UI down between them; the once-per-process frame tree is our documented
-    // interim, `IngameUiLoaded`), so re-arm the fire and forget the player-global diff
+    // with the streamed world): the real client fires this event on *every* world entry, and
+    // since 1290 so do we — the frame tree is torn down and rebuilt across that edge, the way
+    // the reference does it. So re-arm the fire and forget the player-global diff
     // memories. Forgetting them makes every next-login first sighting re-seed SILENTLY — the
     // byte-verified fresh-CREATE notify silence (1098 §4), now holding per entry: without it a
     // 60→1 char switch latched the max-level rail shown over a level-1 body (1106's live
diff --git a/crates/benilla-app/src/ui_world_map.rs b/crates/benilla-app/src/ui_world_map.rs
index c538152f..3f18ad26 100644
--- a/crates/benilla-app/src/ui_world_map.rs
+++ b/crates/benilla-app/src/ui_world_map.rs
@@ -71,23 +71,24 @@ fn zone_rect(a: &WorldMapArea) -> ZoneRect {
 /// Build + push the static catalog once the patch chain, the VM, and the Map.dbc catalog all
 /// exist (Update-gated rather than Startup-ordered, like every feed that needs the script).
 fn load_world_map_ui(
-    mut done: Local<bool>,
+    mut done: Local<crate::ui_script::VmMemo<bool>>,
     script: Option<NonSendMut<UiScript>>,
     world_assets: Option<ResMut<WorldAssets>>,
     maps: Option<Res<MapCatalogRes>>,
     areas: Option<Res<crate::area::AreaTableRes>>,
     mut commands: Commands,
 ) {
-    if *done {
-        return;
-    }
     let (Some(mut script), Some(assets), Some(maps), Some(areas)) =
         (script, world_assets, maps, areas)
     else {
         return;
     };
+    // Once per **VM** (1290), not once per process: the catalog is static, the VM it is pushed
+    // into is not — a login builds a fresh one, and without this the map window has no continents.
+    if !done.claim(&script) {
+        return;
+    }
     let areas = &areas.0;
-    *done = true;
 
     let mut chain = assets.chain.lock_recover();
     let loaded = load_world_map_area_catalog(&mut chain).and_then(|wma| {
@@ -253,11 +254,12 @@ fn feed_world_map(
     self_q: Query<&ObjectStore, With<SelfPlayer>>,
     areas: Option<Res<crate::area::AreaTableRes>>,
     death_net: Res<crate::death::DeathNet>,
-    mut last_explored: Local<Option<Vec<u32>>>,
+    mut last_explored: Local<crate::ui_script::VmMemo<Option<Vec<u32>>>>,
 ) {
     let (Some(mut script), Some(data), Some(map), Some(areas)) = (script, data, map, areas) else {
         return;
     };
+    let last_explored = last_explored.get(&script);
 
     // The discovery bitset (PLAYER_EXPLORED_ZONES, PRIVATE — only our own avatar carries it):
     // push on change (including the first stream-in); the engine setter queues the
diff --git a/crates/benilla-ui/src/script/mod.rs b/crates/benilla-ui/src/script/mod.rs
index ab04d9b6..63713f96 100644
--- a/crates/benilla-ui/src/script/mod.rs
+++ b/crates/benilla-ui/src/script/mod.rs
@@ -421,8 +421,14 @@ pub struct UiScript {
     /// ([`UiScript::set_instruction_budget`]). `Arc` because the hook callback outlives this
     /// borrow; `Relaxed` because nothing orders against it — it is a bound, not a clock.
     instructions: std::sync::Arc<std::sync::atomic::AtomicU64>,
+    /// **This VM's identity** — see [`UiScript::session`].
+    session: u64,
 }
 
+/// Hands out [`UiScript::session`] ids. Process-global and monotone, so an id is never reused and
+/// two of them can be compared without holding either VM.
+static NEXT_SESSION: std::sync::atomic::AtomicU64 = std::sync::atomic::AtomicU64::new(1);
+
 /// How often the instruction hook fires — the resolution of an instruction budget.
 ///
 /// mlua's own documentation warns that a low value "can incur a very high overhead", and nothing
@@ -524,6 +530,7 @@ impl UiScript {
         let s = UiScript {
             lua,
             instructions: std::sync::Arc::new(std::sync::atomic::AtomicU64::new(0)),
+            session: NEXT_SESSION.fetch_add(1, std::sync::atomic::Ordering::Relaxed),
         };
         Ok(s)
     }
@@ -535,6 +542,21 @@ impl UiScript {
         &self.lua
     }
 
+    /// **Which VM this is** — a fresh number for every [`UiScript::new`], never reused.
+    ///
+    /// The client destroys its Lua state at logout and builds another at the next world entry
+    /// (the reference's own `0x490bd0` ↔ `0x48fbf0` pair), so a host that remembers *what it last
+    /// pushed into the VM* is remembering something that may no longer exist. Anything the host
+    /// seeded — a registry, a catalog, a change-detection memo — is only valid for the session it
+    /// was seeded into, and this number is what says so.
+    ///
+    /// A host keying its memory on this cannot go stale by omission: a new VM simply does not
+    /// match, so the seed happens again. That is the property, and it is why this is a VM-side fact
+    /// rather than a host-side counter the host must remember to bump.
+    pub fn session(&self) -> u64 {
+        self.session
+    }
+
     /// **Bound how long a chunk may run, so an infinite loop reports instead of hanging.**
     ///
     /// A missing capability in this engine has always been a silently WRONG ANSWER — a setter that
diff --git a/crates/benilla-world/src/ribbons.rs b/crates/benilla-world/src/ribbons.rs
index 1dbe02ee..c9604deb 100644
--- a/crates/benilla-world/src/ribbons.rs
+++ b/crates/benilla-world/src/ribbons.rs
@@ -33,6 +33,44 @@ use crate::view::WorldCamera;
 /// ring capacity is `ceil(rate·lifetime)+2`; shipped trails sit far below this).
 const MAX_EDGES: usize = 512;
 
+/// **What the ribbon lane did this frame** — live trails, and how many of them wrote a strip.
+///
+/// The parallel of [`crate::exterior_cull::ExteriorCullVerdict`], and here for the same reason: a
+/// trail carries no [`crate::model_render::ModelPart`] and no
+/// [`crate::particles::ParticleEmitter`], so it is invisible to the visibility census AND to the
+/// particle census. Ninety Caverns-of-Time energy trails burning across a Tanaris hillside read,
+/// on every instrument we had, as a scene with nothing in it.
+#[derive(Resource, Default)]
+pub struct RibbonVerdict {
+    /// Trails alive this frame (streaming or draining).
+    pub trails: usize,
+    /// …and how many committed a strip into the shared effect stream.
+    pub drawn: usize,
+}
+
+/// **May a trail draw, given the rooms it belongs to?** — the room half of the draw gate, pure and
+/// total so the rule is pinned by tests without an ECS (the [`crate::model_fade`] pattern that
+/// [`crate::particles::EmitterFade::in_draw_set`] already follows).
+///
+/// - No room ([`RibbonTrail::room`] `None`) — not a building's prop. Admitted; nothing claims it.
+/// - A room whose placement is resident — [`WmoGroupVis::drawn_by`], the same predicate the prop's
+///   own submeshes are culled by, so the trail and its mesh can never disagree.
+/// - A room whose placement is **gone** — refused. This is the one place the ribbon lane must NOT
+///   take the cull's usual fail-open arm: a trail outlives its building by the frame between the
+///   placement despawning and the owner cascade reaching the trail, and one frame of an additive
+///   strip hanging where a building used to be is a bright artefact, where one frame of a missing
+///   trail is nothing at all. `crate::wmo_sky`'s skybox resolve refuses on the same asymmetry.
+fn room_admits(
+    room: Option<&crate::wmo_portal::WmoGroupVis>,
+    instance: Option<&crate::wmo_portal::WmoPortalInstance>,
+) -> bool {
+    match (room, instance) {
+        (None, _) => true,
+        (Some(r), Some(inst)) => r.drawn_by(inst),
+        (Some(_), None) => false,
+    }
+}
+
 /// One committed trail edge: the vertex pair across the node, world (Bevy) space, and its birth
 /// time on the shared clock.
 struct Edge {
@@ -89,6 +127,23 @@ pub struct RibbonTrail {
     /// particle's, and inventing a ramp on top of a gate would be building past the evidence.
     /// `None` ⇒ always drawn (a placed prop, an effect instance).
     alpha_src: Option<Entity>,
+    /// The **rooms whose visibility this trail rides** — a WMO prop's own
+    /// [`crate::wmo_portal::WmoGroupVis`], carried by value because a trail entity must not hold
+    /// that component (it would enlist the trail in `apply_model_visibility`'s group query, a
+    /// second `Visibility` writer on an entity whose `Visibility` nobody reads — decision 0025).
+    ///
+    /// It exists because **a trail is one of its model's emitters, and the reference draws a
+    /// WMO's props out of each VISIBLE group's own MODR list** (`0x695aa0` from the visible-group
+    /// walk `0x698720`, decision 0689) — a prop in a culled room is never instantiated, so it
+    /// trails nothing. We culled the prop's *mesh* and left its ribbons streaming, which is the
+    /// same omission decision 0786 fixed one lane over for particle emitters, and the same shape
+    /// as 1283's shadow/nameplate/picker: a rider that never asked whether its owner was in the
+    /// scene. Standing in Tanaris, Caverns of Time's twelve energy-trail props kept ninety
+    /// additive trails burning up through 200 yd of rock (decision 1289).
+    ///
+    /// `None` = not a building's prop (an ADT map doodad, a creature, a missile, a held item):
+    /// nothing claims it, so nothing gates it here.
+    room: Option<crate::wmo_portal::WmoGroupVis>,
     /// Committed edges, newest at the back. The live head (the current node) is appended at
     /// render time only, so the trail always connects to the emitter between commits.
     edges: VecDeque<Edge>,
@@ -156,6 +211,7 @@ pub fn spawn_ribbon(
     owner_scale: f32,
     seq: RibbonSeq,
     alpha_src: Option<Entity>,
+    room: Option<crate::wmo_portal::WmoGroupVis>,
 ) -> Option<Entity> {
     // Perf-bisect kill-switch: $WOW_NO_PARTICLES also spawns no ribbons (one switch, whole family).
     if std::env::var_os("WOW_NO_PARTICLES").is_some() {
@@ -192,6 +248,7 @@ pub fn spawn_ribbon(
                     owner: Some(owner),
                     seq,
                     alpha_src,
+                    room,
                     edges: VecDeque::new(),
                     accumulator: 0.0,
                     age: 0.0,
@@ -229,6 +286,9 @@ pub(crate) fn simulate_ribbons(
     // The water-plane interleave inputs — a trail is one of the model's emitters and classifies
     // above/below water like the quad clouds ([`crate::particles::far_side_of_water`]).
     interleave: crate::particles::WaterInterleave,
+    // The per-frame portal PVS, for the room gate ([`RibbonTrail::room`]).
+    portal_instances: Query<&crate::wmo_portal::WmoPortalInstance>,
+    mut verdict: ResMut<RibbonVerdict>,
     mut trails: Query<(
         Entity,
         &mut RibbonTrail,
@@ -236,6 +296,7 @@ pub(crate) fn simulate_ribbons(
         &mut GlobalTransform,
     )>,
 ) {
+    *verdict = RibbonVerdict::default();
     let Ok(cam) = world_cam.single() else {
         return;
     };
@@ -248,6 +309,7 @@ pub(crate) fn simulate_ribbons(
             owner,
             seq,
             alpha_src,
+            room,
             edges,
             accumulator,
             age,
@@ -285,6 +347,7 @@ pub(crate) fn simulate_ribbons(
             commands.entity(entity).despawn();
             continue;
         }
+        verdict.trails += 1;
 
         // The `+0xc0` **enable** gate, sampled LIVE against the sequence the host is playing.
         // SETTLED at the bytes (wow-re `ribbon-emitter-spec.md` §7, closed — the dispatch this
@@ -406,6 +469,16 @@ pub(crate) fn simulate_ribbons(
         if alpha_src.is_some_and(|e| model_alphas.get(e) <= 1e-3) {
             continue;
         }
+        // …and the room gate, for the same reason one line up and with the same shape as `lit`:
+        // the sim above still ran, only the DRAW is skipped, so walking back into the room resumes
+        // mid-strip instead of from empty ([`RibbonTrail::room`]).
+        if !room_admits(
+            room.as_ref(),
+            room.as_ref()
+                .and_then(|r| portal_instances.get(r.instance).ok()),
+        ) {
+            continue;
+        }
         let n = edges.len() + usize::from(head.is_some());
         if n < 2 {
             continue;
@@ -449,6 +522,7 @@ pub(crate) fn simulate_ribbons(
                 ((now - e.born) / def.edge_lifetime).clamp(0.0, 1.0),
             ));
         }
+        verdict.drawn += 1;
         let start = quads.begin();
         for w in pairs.windows(2) {
             let ((t0, b0, a0), (t1, b1, a1)) = (w[0], w[1]);
@@ -520,7 +594,7 @@ impl Plugin for RibbonPlugin {
         // PostUpdate, after the billboard joint palette — same law and reason as the particle
         // sim: a trail node on a billboarded/animated bone must sample the frame the palette
         // just wrote (see `billboard_joint_palette`'s consumer note).
-        app.add_systems(
+        app.init_resource::<RibbonVerdict>().add_systems(
             PostUpdate,
             simulate_ribbons
                 .in_set(crate::billboard::BillboardPlace)
@@ -532,7 +606,52 @@ impl Plugin for RibbonPlugin {
 
 #[cfg(test)]
 mod tests {
-    use super::gravity_step;
+    use super::{gravity_step, room_admits};
+    use crate::wmo_portal::{WmoGroupVis, WmoPortalInstance};
+    use bevy::math::Affine3A;
+    use bevy::prelude::*;
+
+    /// **A trail is one of its model's emitters, so it rides the rooms its model is drawn by.**
+    ///
+    /// The reference instantiates a WMO's props out of each VISIBLE group's own MODR list
+    /// (`0x695aa0` from the visible-group walk `0x698720`, decision 0689) — a prop in a culled
+    /// room is never created, so it trails nothing. Our prop's *mesh* was culled by exactly this
+    /// predicate and its ribbons were not, which is how Caverns of Time's twelve energy-trail
+    /// props kept ninety additive strips burning up through 200 yd of rock into Tanaris while
+    /// every one of their submeshes was correctly hidden (decision 1289).
+    #[test]
+    fn a_prop_in_a_culled_room_trails_nothing_and_an_orphan_trail_refuses() {
+        let inst = |visible: Vec<bool>| WmoPortalInstance {
+            handle: Handle::default(),
+            world_from_local: Affine3A::IDENTITY,
+            name_set: 0,
+            liquid_visited: vec![false; visible.len()],
+            flooded: vec![None; visible.len()],
+            visible,
+        };
+        let room = |groups: &[u16]| WmoGroupVis {
+            instance: Entity::PLACEHOLDER,
+            groups: groups.into(),
+        };
+        let cot = inst(vec![true, false, false]);
+
+        // Not a building's prop at all — an ADT map doodad, a creature, a held item's streak.
+        assert!(room_admits(None, None), "an unclaimed trail is never gated");
+        // The room the flood reached draws; the ones it did not, do not.
+        assert!(room_admits(Some(&room(&[0])), Some(&cot)));
+        assert!(!room_admits(Some(&room(&[1, 2])), Some(&cot)));
+        // A prop several rooms name draws while ANY of them is visible — the same
+        // `drawn_by` law the submeshes take, which is the point of sharing the predicate.
+        assert!(room_admits(Some(&room(&[1, 0])), Some(&cot)));
+
+        // …and the asymmetry that must NOT be the cull's usual fail-open: a trail whose
+        // placement has despawned refuses, rather than drawing one last frame through the hole
+        // where a building used to be.
+        assert!(
+            !room_admits(Some(&room(&[0])), None),
+            "an orphaned trail draws nothing"
+        );
+    }
 
     /// The per-frame gravity term telescopes to the closed form the bytes imply: stepping
     /// `gravity · ((2·age) + dt) · dt` and advancing `age` by `dt` leaves an edge exactly
diff --git a/crates/benilla-world/src/terrain_stream/spawn/fx.rs b/crates/benilla-world/src/terrain_stream/spawn/fx.rs
index 8263b2a5..82438ff6 100644
--- a/crates/benilla-world/src/terrain_stream/spawn/fx.rs
+++ b/crates/benilla-world/src/terrain_stream/spawn/fx.rs
@@ -193,6 +193,10 @@ pub(super) fn spawn_ribbons_for(
     joints: Option<&[Entity]>,
     arm: Option<Entity>,
     fallback_owner: Option<Entity>,
+    // The rooms this placement is drawn by, for a WMO prop — `None` for an ADT map doodad. The
+    // trail's own gate, because a trail rides a joint or a submesh and neither of those states it
+    // ([`crate::ribbons::RibbonTrail::room`]).
+    room: Option<crate::wmo_portal::WmoGroupVis>,
 ) {
     for rb in ribbons {
         let (owner, use_pivot) = match joints.and_then(|js| js.get(rb.def.bone as usize)).copied() {
@@ -217,6 +221,7 @@ pub(super) fn spawn_ribbons_for(
             ),
             // No model-alpha source: a placed prop / effect instance is always drawn (0827).
             None,
+            room.clone(),
         );
     }
 }
diff --git a/crates/benilla-world/src/terrain_stream/spawn/mod.rs b/crates/benilla-world/src/terrain_stream/spawn/mod.rs
index 506c6da3..a34d95d1 100644
--- a/crates/benilla-world/src/terrain_stream/spawn/mod.rs
+++ b/crates/benilla-world/src/terrain_stream/spawn/mod.rs
@@ -231,6 +231,7 @@ pub(super) fn spawn_loaded_placements(
                         host.as_ref().map(|h| h.joints.as_slice()),
                         host.as_ref().and_then(|h| h.arm),
                         ents.first().copied(),
+                        None, // an ADT map doodad belongs to no building
                     );
                     spawn_lights_for(&mut commands, &m.lights, p.transform, &mut ents);
                     tag_world_object(
@@ -622,6 +623,14 @@ pub(super) fn spawn_loaded_placements(
                 host.as_ref().map(|h| h.joints.as_slice()),
                 host.as_ref().and_then(|h| h.arm),
                 ents.first().copied(),
+                // The prop's own rooms — the trail is gated by them exactly as the submeshes
+                // above are, because it is one of this model's emitters (decision 1289).
+                portal_instance
+                    .filter(|_| !d.groups.is_empty())
+                    .map(|instance| WmoGroupVis {
+                        instance,
+                        groups: d.groups.clone(),
+                    }),
             );
             spawn_lights_for(&mut commands, &m.lights, d.transform, &mut ents);
             tag_world_object(
diff --git a/crates/benilla-world/src/world_census.rs b/crates/benilla-world/src/world_census.rs
index ccec7288..d8d07e66 100644
--- a/crates/benilla-world/src/world_census.rs
+++ b/crates/benilla-world/src/world_census.rs
@@ -50,6 +50,11 @@ pub struct WorldCensus<'w, 's> {
     claim: Option<Res<'w, CameraInteriorClaim>>,
     windows: Option<Res<'w, ExteriorWindows>>,
     verdict: Option<Res<'w, ExteriorCullVerdict>>,
+    /// Which backdrop is drawing — the gradient dome, or a building's own MOSB sky
+    /// ([`crate::wmo_sky`]). Optional for the same reason as the portal terms above.
+    skybox: Option<Res<'w, crate::wmo_sky::CameraWmoSkybox>>,
+    /// The ribbon lane's own verdict — the third effect population, counted nowhere else.
+    ribbons: Option<Res<'w, crate::ribbons::RibbonVerdict>>,
     mats: Res<'w, Assets<WowModelMaterial>>,
     meshes: Res<'w, Assets<Mesh>>,
     images: Res<'w, Assets<bevy::image::Image>>,
@@ -89,11 +94,24 @@ pub struct CensusReport {
     pub emitters: usize,
     pub active_emitters: usize,
     pub particles: usize,
+    /// Ribbon trails alive, and how many wrote a strip — `None` if the lane is not installed.
+    /// The `emitters`/`particles` pair above covers only the QUAD half of the effect stream;
+    /// trails are the other half and had no counter at all.
+    pub ribbons: Option<(usize, usize)>,
     /// The WMO group the camera claims — `"g07"`, or `"none"` over open world. `None` when the
     /// portal system is not installed at all, which is a different statement from "not indoors".
     pub room: Option<String>,
     /// `"unrestricted"`, or the number of window sub-frusta. `None` with [`CensusReport::room`].
     pub windows: Option<String>,
+    /// The backdrop actually drawing: `"dome"` for the `Light.dbc` gradient, else the WMO skybox
+    /// model a building's PVS asked for. `None` when the WMO-sky lane is not installed.
+    ///
+    /// Here because a skybox is the one draw that can repaint the whole frame while being
+    /// invisible to every other line in this report: its batches carry no [`ModelPart`], so they
+    /// are not in `submeshes`, not in `drawn`, not in `kinds`, and not in `labels`. Standing
+    /// outdoors in Tanaris with a purple sky and no purple *object* on any list is exactly the
+    /// state that has to be readable, and before this it was not.
+    pub sky: Option<String>,
     /// What the exterior cull did this frame, `None` if it did not run.
     pub cull: Option<CullTerms>,
     /// Resident asset counts — the leak meter. A tour probe reading the same counts as a fresh
@@ -225,6 +243,11 @@ impl WorldCensus<'_, '_> {
             None => (None, None),
         };
 
+        let sky = self.skybox.as_ref().map(|s| {
+            s.0.as_deref()
+                .map_or_else(|| "dome".to_string(), str::to_ascii_lowercase)
+        });
+
         CensusReport {
             submeshes,
             drawn,
@@ -240,6 +263,8 @@ impl WorldCensus<'_, '_> {
             particles,
             room,
             windows,
+            sky,
+            ribbons: self.ribbons.as_deref().map(|r| (r.trails, r.drawn)),
             cull: self.verdict.as_deref().map(|v| CullTerms {
                 windows: v
                     .windows