the unit frames are the reference's own, and the water has motes in it

- the player, party, target and pet frames are the reference's own files (`BuffFrame`, `UnitFrame`, `CombatFeedback`, `PlayerFrame`, `PartyFrame`, `TargetFrame`, `PetFrame`, in the reference's toc order) — our 2741-line `UnitFrames.xml` and our `PartyFrame.xml` are deleted; four engine verbs built for them (`PartialPlayTime`, `NoPlayTime`, `UnitPlayerControlled`, `UnitIsCivilian`, each answering 1/nil), the whole-UI load bracketed in the counted sound-suppression scope `0x48fbf0` self-brackets (the reference fires a `PlaySound` during load and throws it away), and `GetBillingTimeRested` read off `SMSG_AUTH_RESPONSE`'s third billing field rather than hardcoded; the differences the stock files bring are pinned rather than papered — `PlayerFrame` never hides, an unresolved name is BLANK not "Unknown", the target frame has no numerals at all (a bar hover pops the unit tooltip instead)
- what the swap surfaced, each a hard break under the stock files: `UnitBuff`/`UnitDebuff` returned the Classic Era ten-value tuple, name first, where 1.12 returns two and three values TEXTURE first (`0x519500`/`0x5198f0`) — a raise twice per `UNIT_AURA` on any debuffed target, and all 184 corpus call sites bind the 1.12 shape; the power events are named per resource (`UNIT_MANA`/`RAGE`/`FOCUS`/`ENERGY`/`HAPPINESS` and their MAX twins) and we fired the Era pair, so no mana, rage or energy bar could live-update; `SetRaidTarget` is the engine verb and `SetRaidTargetIcon` the FrameXML toggle wrapper — we had registered the wrapper's name on the engine's body, so every raid mark in the unit popup raised
- the underwater drift cloud: the reference draws a fixed 4000-mote field whenever the camera eye is inside a liquid — not a particle system, nothing spawns, ages or dies; a population scattered once into a 30 yd camera-relative cube, advected by the camera's own motion plus a gust and wrapped, so the field stands still in the world; benilla had the murk and nothing in it; a dry frame commits no draw, and the submerged one is bounded by the reference's own 666-quad cap (633–644 of 4000 measured live, which is the expected survivor count of a uniform cube through the 90° cone — an independent check on population, distribution and cone at once)

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

crates/benilla-protocol/src/world/session.rs

@@ -90,6 +90,10 @@ pub struct WorldSession {
     /// vmangos drops any chat whose language the character doesn't know (dot-commands included) —
     /// hardcoded Common silently ate every Horde character's chat and commands once.
     chat_language: u32,
+    /// The rested billing minutes the admitting `SMSG_AUTH_RESPONSE` carried, or `0` when its body
+    /// was too short for the billing group. Read by [`Self::billing_time_rested`]; see decision
+    /// 1820 for why `0` rather than the client's own uninitialised-global behaviour.
+    billing_time_rested: u32,
 }
 
 impl WorldSession {
@@ -178,6 +182,7 @@ impl WorldSession {
             crypto,
             roster_races: Default::default(),
             chat_language: messages::LANGUAGE_COMMON,
+            billing_time_rested: 0,
         };
 
         // 4. Wait for SMSG_AUTH_RESPONSE. Usually the first encrypted packet, but not always first
@@ -191,7 +196,17 @@ impl WorldSession {
         // honest message at the login screen.
         loop {
             match session.recv()? {
-                ServerPacket::AuthResponse { result, .. } if result == messages::AUTH_OK => break,
+                ServerPacket::AuthResponse {
+                    result,
+                    billing_time_rested,
+                    ..
+                } if result == messages::AUTH_OK => {
+                    // The admitting packet is the only one that counts: a queue packet carries the
+                    // group too, but the client re-reads it on every AUTH_RESPONSE and the last one
+                    // wins, which is this one.
+                    session.billing_time_rested = billing_time_rested.unwrap_or(0);
+                    break;
+                }
                 // **Queued, not refused** — the realm is full and we keep our place in line. Report
                 // the position and go back to reading; the server re-sends as we move up and ends
                 // the wait with an `AUTH_OK`. Treating this as an ending (which it was until now)
@@ -199,6 +214,7 @@ impl WorldSession {
                 ServerPacket::AuthResponse {
                     result,
                     queue_position,
+                    ..
                 } if result == messages::AUTH_WAIT_QUEUE => {
                     if !queued {
                         queued = true;
@@ -230,6 +246,17 @@ impl WorldSession {
         Ok(session)
     }
 
+    /// The account's accumulated **rested billing minutes**, from the `SMSG_AUTH_RESPONSE` that
+    /// admitted this session — what `GetBillingTimeRested()` reports (decision 1820).
+    ///
+    /// Against vmangos this is always `0`: the server hardcodes `uint32(0)` for the field
+    /// (`World.cpp:331`, and `:380` for the queue packet), guarded on a build newer than 1.7.1,
+    /// which 1.12 is. It is read from the wire rather than assumed so that a server which does
+    /// populate it is reported honestly.
+    pub fn billing_time_rested(&self) -> u32 {
+        self.billing_time_rested
+    }
+
     /// Set a read timeout on the underlying socket (e.g. so a debug read-loop can stop when the
     /// world goes quiet). `None` clears it (blocking reads).
     pub fn set_read_timeout(&self, timeout: Option<std::time::Duration>) -> Result<()> {