diff --git a/Cargo.lock b/Cargo.lock
index 057db491..f775f249 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -624,6 +624,7 @@ dependencies = [
  "num-bigint",
  "rand 0.8.6",
  "sha1",
+ "strum",
 ]
 
 [[package]]
@@ -6138,6 +6139,28 @@ version = "0.11.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7da8b5736845d9f2fcb837ea5d9e2628564b3b043a70948a3f0b778838c5fb4f"
 
+[[package]]
+name = "strum"
+version = "0.26.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8fec0f0aef304996cf250b31b5a10dee7980c85da9d759361292b8bca5a18f06"
+dependencies = [
+ "strum_macros",
+]
+
+[[package]]
+name = "strum_macros"
+version = "0.26.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4c6bee85a5a24955dc440386795aa378cd9cf82acd5f764469152d2270e581be"
+dependencies = [
+ "heck",
+ "proc-macro2",
+ "quote",
+ "rustversion",
+ "syn",
+]
+
 [[package]]
 name = "svg_fmt"
 version = "0.4.5"
diff --git a/Cargo.toml b/Cargo.toml
index 78a166f7..0552b3cc 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -12,6 +12,16 @@ authors = ["sam <samuv.eth@gmail.com>"]
 # since day one, enacted at the 0530 debt sweep). Per-crate feature additions stay in the crate.
 # `image` deliberately stays per-crate: its default-features/feature sets differ per consumer,
 # and a workspace default-features choice can't be subtracted from downstream.
+# **Lint policy** (decision 2266 §C4). `too_many_arguments` is a readability lint for plain
+# functions; on a Bevy system the parameter list IS the scheduler's dependency declaration, and
+# a system that reads eight resources has eight parameters by construction. The lint had fired
+# 364 times in this workspace and been allowed 364 times, 281 of them on systems — a lint whose
+# every verdict is overridden is not a gate, it is a tax on adding a system. Allowed once here;
+# the per-site attributes are gone. `type_complexity` stays on: it fires on shapes a type alias
+# or a `SystemParam` bundle genuinely fixes.
+[workspace.lints.clippy]
+too_many_arguments = "allow"
+
 [workspace.dependencies]
 anyhow = "1.0.102"
 # bevy's `default` is `["2d", "3d", "ui"]`, and every one of those three pulls `audio`
diff --git a/README.md b/README.md
index 6fd67597..aa6f4c9d 100644
--- a/README.md
+++ b/README.md
@@ -51,8 +51,8 @@ benilla is done when a 1.12.1 player can do everything here that they could in t
 client, it looks and feels the same, and it runs from a download on Windows, Linux and macOS.
 No dates; the order is what is likely, not a promise.
 
-- Battlegrounds and meeting stones, then the long tail of small features that separates a
-  working client from a finished one.
+- Battlegrounds, then the long tail of small features that separates a working client from a
+  finished one.
 - Addons, options and performance, ongoing.
 - The no-brainer fixes from VanillaFixes, SuperWoW and the like.
 - Playable downloads for Windows, Linux and macOS. Linux first.
diff --git a/crates/benilla-adt/Cargo.toml b/crates/benilla-adt/Cargo.toml
index 698998c3..10ad7516 100644
--- a/crates/benilla-adt/Cargo.toml
+++ b/crates/benilla-adt/Cargo.toml
@@ -5,5 +5,8 @@ edition.workspace = true
 license.workspace = true
 description = "ADT terrain-tile reader for WoW 1.12.1 (build 5875) — in-repo, decision 0021"
 
+[lints]
+workspace = true
+
 [dependencies]
 benilla-bytes = { path = "../benilla-bytes" }
diff --git a/crates/benilla-app/Cargo.toml b/crates/benilla-app/Cargo.toml
index 26b841c3..18380dad 100644
--- a/crates/benilla-app/Cargo.toml
+++ b/crates/benilla-app/Cargo.toml
@@ -5,6 +5,9 @@ edition.workspace = true
 license.workspace = true
 description = "The Bevy app as a library: everything but the build-id stamp, which lives in the `benilla` launcher shim so a commit dirties ~30 lines instead of this crate (decision 0993)"
 
+[lints]
+workspace = true
+
 [features]
 # **The dev/player seam** (decisions 0026 + 1173). Default-ON, so every ordinary `cargo run`,
 # capture, probe and gate builds exactly what it built before. `--no-default-features` compiles
diff --git a/crates/benilla-app/src/area.rs b/crates/benilla-app/src/area.rs
index ed799f45..756e323b 100644
--- a/crates/benilla-app/src/area.rs
+++ b/crates/benilla-app/src/area.rs
@@ -145,7 +145,6 @@ fn elect_event(cache: &ZoneCache, next: &ZoneSignal) -> Option<&'static str> {
 /// indoor override), the PvP tuple, write the host globals, then fire the elected zone event
 /// and — independently, like the client's second site — `MINIMAP_ZONE_CHANGED` when the
 /// subzone-else-zone line changed.
-#[allow(clippy::too_many_arguments)]
 fn feed_zone_events(
     script: Option<NonSendMut<UiScript>>,
     world: benilla_world::world_point::WorldPoint,
diff --git a/crates/benilla-app/src/area_trigger.rs b/crates/benilla-app/src/area_trigger.rs
index e9e09a39..4e3f74f7 100644
--- a/crates/benilla-app/src/area_trigger.rs
+++ b/crates/benilla-app/src/area_trigger.rs
@@ -112,7 +112,7 @@ impl Plugin for AreaTriggerPlugin {
                 Update,
                 check_area_triggers
                     .in_set(WorldStage::Stream)
-                    .run_if(in_state(crate::char_select::ClientState::InWorld)),
+                    .in_set(crate::char_select::InWorldGated),
             );
     }
 }
diff --git a/crates/benilla-app/src/aura_visual.rs b/crates/benilla-app/src/aura_visual.rs
index f67a42cf..693fe426 100644
--- a/crates/benilla-app/src/aura_visual.rs
+++ b/crates/benilla-app/src/aura_visual.rs
@@ -742,7 +742,6 @@ type AuraParts<'w, 's> = Query<
 /// Note the swap keys on the *instance* alpha only: a batch whose own animated colour alpha dips is
 /// a per-batch quantity the reference combines separately, and forcing those onto a blend pass would
 /// change every existing unit's look.
-#[allow(clippy::too_many_arguments)] // one Bevy system's full input set
 pub(crate) fn apply_aura_alpha(
     time: Res<Time>,
     mut commands: Commands,
@@ -842,7 +841,6 @@ fn author_cards(
 /// property that its attached models render off (the same reason
 /// [`benilla_world::model_fade::apply_despawn_fade`] and the self feather both walk descendants, not
 /// children).
-#[allow(clippy::too_many_arguments)] // the author's full channel set, threaded down the walk
 fn author_descendants(
     entity: Entity,
     alpha: f32,
diff --git a/crates/benilla-app/src/aura_visual/tests.rs b/crates/benilla-app/src/aura_visual/tests.rs
index 65b5b748..6512b1a0 100644
--- a/crates/benilla-app/src/aura_visual/tests.rs
+++ b/crates/benilla-app/src/aura_visual/tests.rs
@@ -244,6 +244,7 @@ fn app_with_chains() -> App {
     let mut app = App::new();
     app.add_plugins(MinimalPlugins);
     app.add_message::<crate::creature_anim::SpellKitFx>();
+    app.add_message::<crate::net::FieldChanged>();
     app.add_message::<crate::creature_anim::SpellKitSound>();
     app.add_message::<AuraProc>();
     app.add_message::<crate::creature_anim::BaseAnimRecompute>();
@@ -354,7 +355,9 @@ fn a_proc_only_state_kit_arms_stealth_translucency() {
     let stealthed = ObjectFields::from_pairs(&[(47, STEALTH), (95, 0x0E)]);
     let unit = app
         .world_mut()
-        .spawn(crate::net::ObjectStore(stealthed))
+        .spawn(crate::net::ObjectStore(
+            stealthed.into_created(benilla_protocol::messages::ObjectType::Unit),
+        ))
         .id();
     app.update();
 
@@ -368,11 +371,12 @@ fn a_proc_only_state_kit_arms_stealth_translucency() {
     assert!(n.head_tint().is_none(), "kit 312 carries no tint");
 
     // The aura drops: the node goes and the target ramps back to opaque.
-    app.world_mut()
-        .entity_mut(unit)
-        .insert(crate::net::ObjectStore(ObjectFields::from_pairs(&[(
-            95, 0,
-        )])));
+    crate::net::apply_fields_for_test(
+        app.world_mut(),
+        unit,
+        ObjectFields::from_pairs(&[(95, 0)])
+            .into_created(benilla_protocol::messages::ObjectType::Unit),
+    );
     app.update();
     let n = app.world().entity(unit).get::<AuraNodes>().unwrap();
     assert!(n.alpha.is_empty(), "reaped on the aura-remove edge");
@@ -386,10 +390,10 @@ fn a_kit_with_both_procs_installs_both_nodes() {
     let mut app = app_with_chains();
     let unit = app
         .world_mut()
-        .spawn(crate::net::ObjectStore(ObjectFields::from_pairs(&[
-            (47, GHOST),
-            (95, 0x0E),
-        ])))
+        .spawn(crate::net::ObjectStore(
+            ObjectFields::from_pairs(&[(47, GHOST), (95, 0x0E)])
+                .into_created(benilla_protocol::messages::ObjectType::Unit),
+        ))
         .id();
     app.update();
 
@@ -404,7 +408,12 @@ fn a_kit_with_both_procs_installs_both_nodes() {
 fn two_auras_stack_and_unstack_through_the_slots() {
     let mut app = app_with_chains();
     let both = ObjectFields::from_pairs(&[(47, STEALTH), (48, GHOST), (95, 0xEE)]);
-    let unit = app.world_mut().spawn(crate::net::ObjectStore(both)).id();
+    let unit = app
+        .world_mut()
+        .spawn(crate::net::ObjectStore(
+            both.into_created(benilla_protocol::messages::ObjectType::Unit),
+        ))
+        .id();
     app.update();
     let n = app.world().entity(unit).get::<AuraNodes>().unwrap();
     assert!(
@@ -413,12 +422,12 @@ fn two_auras_stack_and_unstack_through_the_slots() {
     );
 
     // Stealth alone drops (slot 0 cleared, slot 1 still occupied).
-    app.world_mut()
-        .entity_mut(unit)
-        .insert(crate::net::ObjectStore(ObjectFields::from_pairs(&[
-            (48, GHOST),
-            (95, 0xE0),
-        ])));
+    crate::net::apply_fields_for_test(
+        app.world_mut(),
+        unit,
+        ObjectFields::from_pairs(&[(48, GHOST), (95, 0xE0)])
+            .into_created(benilla_protocol::messages::ObjectType::Unit),
+    );
     app.update();
     let n = app.world().entity(unit).get::<AuraNodes>().unwrap();
     assert_eq!(n.alpha.as_slice(), [(GHOST, 0.5)]);
@@ -458,10 +467,10 @@ fn an_unmodelled_proc_only_kit_arms_nothing() {
 
     let unit = app
         .world_mut()
-        .spawn(crate::net::ObjectStore(ObjectFields::from_pairs(&[
-            (47, SAP),
-            (95, 0x0E),
-        ])))
+        .spawn(crate::net::ObjectStore(
+            ObjectFields::from_pairs(&[(47, SAP), (95, 0x0E)])
+                .into_created(benilla_protocol::messages::ObjectType::Unit),
+        ))
         .id();
     app.update();
     assert!(
@@ -606,7 +615,10 @@ fn the_ghost_tint_reaches_the_instance_table_and_clears_with_the_aura() {
     let unit = app
         .world_mut()
         .spawn((
-            crate::net::ObjectStore(ObjectFields::from_pairs(&[(47, GHOST), (95, 0x0E)])),
+            crate::net::ObjectStore(
+                ObjectFields::from_pairs(&[(47, GHOST), (95, 0x0E)])
+                    .into_created(benilla_protocol::messages::ObjectType::Unit),
+            ),
             skin,
         ))
         .id();
@@ -623,11 +635,12 @@ fn the_ghost_tint_reaches_the_instance_table_and_clears_with_the_aura() {
 
     // The aura leaves its slot: the reference drops the tint node (`0x5ff320`) with no ease, and the
     // channel goes back to identity — which is the shader's no-op word, not a colour.
-    app.world_mut()
-        .entity_mut(unit)
-        .insert(crate::net::ObjectStore(ObjectFields::from_pairs(&[(
-            95, 0x00,
-        )])));
+    crate::net::apply_fields_for_test(
+        app.world_mut(),
+        unit,
+        ObjectFields::from_pairs(&[(95, 0x00)])
+            .into_created(benilla_protocol::messages::ObjectType::Unit),
+    );
     app.update();
     let tints = app
         .world()
@@ -663,7 +676,10 @@ fn a_rigged_attachment_inherits_its_wearers_tint_through_the_model_chain() {
     let unit = app
         .world_mut()
         .spawn((
-            crate::net::ObjectStore(ObjectFields::from_pairs(&[(47, GHOST), (95, 0x0E)])),
+            crate::net::ObjectStore(
+                ObjectFields::from_pairs(&[(47, GHOST), (95, 0x0E)])
+                    .into_created(benilla_protocol::messages::ObjectType::Unit),
+            ),
             body,
         ))
         .id();
@@ -683,11 +699,12 @@ fn a_rigged_attachment_inherits_its_wearers_tint_through_the_model_chain() {
     );
 
     // The aura drops: both ends of the chain go back to identity, not just the unit's own slot.
-    app.world_mut()
-        .entity_mut(unit)
-        .insert(crate::net::ObjectStore(ObjectFields::from_pairs(&[(
-            95, 0x00,
-        )])));
+    crate::net::apply_fields_for_test(
+        app.world_mut(),
+        unit,
+        ObjectFields::from_pairs(&[(95, 0x00)])
+            .into_created(benilla_protocol::messages::ObjectType::Unit),
+    );
     app.update();
     let tints = app
         .world()
@@ -721,7 +738,10 @@ fn an_unchained_rig_inherits_nothing() {
     };
     let loose_slot = loose.slot;
     app.world_mut().spawn((
-        crate::net::ObjectStore(ObjectFields::from_pairs(&[(47, GHOST), (95, 0x0E)])),
+        crate::net::ObjectStore(
+            ObjectFields::from_pairs(&[(47, GHOST), (95, 0x0E)])
+                .into_created(benilla_protocol::messages::ObjectType::Unit),
+        ),
         body,
     ));
     app.world_mut().spawn(loose);
@@ -753,7 +773,10 @@ fn the_rig_free_hook_clears_a_dead_units_tint() {
     let unit = app
         .world_mut()
         .spawn((
-            crate::net::ObjectStore(ObjectFields::from_pairs(&[(47, GHOST), (95, 0x0E)])),
+            crate::net::ObjectStore(
+                ObjectFields::from_pairs(&[(47, GHOST), (95, 0x0E)])
+                    .into_created(benilla_protocol::messages::ObjectType::Unit),
+            ),
             skin,
         ))
         .id();
@@ -821,7 +844,10 @@ fn ice_block_holds_the_clocks_and_the_drop_lets_them_go() {
     let unit = app
         .world_mut()
         .spawn((
-            crate::net::ObjectStore(ObjectFields::from_pairs(&[(47, ICE_BLOCK), (95, 0x0E)])),
+            crate::net::ObjectStore(
+                ObjectFields::from_pairs(&[(47, ICE_BLOCK), (95, 0x0E)])
+                    .into_created(benilla_protocol::messages::ObjectType::Unit),
+            ),
             rig_playing(&[(4, 1.35), (54, 1.0)]),
         ))
         .id();
@@ -841,11 +867,12 @@ fn ice_block_holds_the_clocks_and_the_drop_lets_them_go() {
     app.update(); // idempotent
 
     // The aura leaves the slots.
-    app.world_mut()
-        .entity_mut(unit)
-        .insert(crate::net::ObjectStore(ObjectFields::from_pairs(&[(
-            95, 0,
-        )])));
+    crate::net::apply_fields_for_test(
+        app.world_mut(),
+        unit,
+        ObjectFields::from_pairs(&[(95, 0)])
+            .into_created(benilla_protocol::messages::ObjectType::Unit),
+    );
     app.update();
     assert!(app
         .world()
@@ -875,7 +902,10 @@ fn a_clip_armed_under_the_freeze_comes_back_at_its_own_speed() {
     let unit = app
         .world_mut()
         .spawn((
-            crate::net::ObjectStore(ObjectFields::from_pairs(&[(47, ICE_BLOCK), (95, 0x0E)])),
+            crate::net::ObjectStore(
+                ObjectFields::from_pairs(&[(47, ICE_BLOCK), (95, 0x0E)])
+                    .into_created(benilla_protocol::messages::ObjectType::Unit),
+            ),
             rig_playing(&[(4, 1.35), (54, 1.0)]),
         ))
         .id();
@@ -902,11 +932,12 @@ fn a_clip_armed_under_the_freeze_comes_back_at_its_own_speed() {
     app.update();
     assert!(clip(&app, unit, 156).0, "held on arrival");
 
-    app.world_mut()
-        .entity_mut(unit)
-        .insert(crate::net::ObjectStore(ObjectFields::from_pairs(&[(
-            95, 0,
-        )])));
+    crate::net::apply_fields_for_test(
+        app.world_mut(),
+        unit,
+        ObjectFields::from_pairs(&[(95, 0)])
+            .into_created(benilla_protocol::messages::ObjectType::Unit),
+    );
     app.update();
     assert!(!clip(&app, unit, 156).0);
     assert_eq!(
@@ -928,7 +959,10 @@ fn the_freeze_reaches_the_mount_body() {
     let unit = app
         .world_mut()
         .spawn((
-            crate::net::ObjectStore(ObjectFields::from_pairs(&[(47, ICE_BLOCK), (95, 0x0E)])),
+            crate::net::ObjectStore(
+                ObjectFields::from_pairs(&[(47, ICE_BLOCK), (95, 0x0E)])
+                    .into_created(benilla_protocol::messages::ObjectType::Unit),
+            ),
             rig_playing(&[(91, 1.0), (54, 1.0)]),
             crate::entities::mount::MountChild(mount),
         ))
@@ -938,11 +972,12 @@ fn the_freeze_reaches_the_mount_body() {
     assert!(clip(&app, unit, 91).0, "the rider");
     assert!(clip(&app, mount, 5).0, "and the mount under them");
 
-    app.world_mut()
-        .entity_mut(unit)
-        .insert(crate::net::ObjectStore(ObjectFields::from_pairs(&[(
-            95, 0,
-        )])));
+    crate::net::apply_fields_for_test(
+        app.world_mut(),
+        unit,
+        ObjectFields::from_pairs(&[(95, 0)])
+            .into_created(benilla_protocol::messages::ObjectType::Unit),
+    );
     app.update();
     assert!(!clip(&app, mount, 5).0);
     assert_eq!(clip(&app, mount, 5).1, 2.0);
@@ -956,7 +991,10 @@ fn an_aura_without_the_proc_never_touches_a_clock() {
     let unit = app
         .world_mut()
         .spawn((
-            crate::net::ObjectStore(ObjectFields::from_pairs(&[(47, STEALTH), (95, 0x0E)])),
+            crate::net::ObjectStore(
+                ObjectFields::from_pairs(&[(47, STEALTH), (95, 0x0E)])
+                    .into_created(benilla_protocol::messages::ObjectType::Unit),
+            ),
             rig_playing(&[(4, 1.35), (54, 1.0)]),
         ))
         .id();
diff --git a/crates/benilla-app/src/bindings.rs b/crates/benilla-app/src/bindings.rs
index 61aec3d8..6379fd1e 100644
--- a/crates/benilla-app/src/bindings.rs
+++ b/crates/benilla-app/src/bindings.rs
@@ -49,7 +49,7 @@ use bevy::prelude::*;
 use benilla_ui::script::keybind::{AddonBindingBody, KeybindCommand, KeybindRequest};
 use benilla_ui::script::UiScript;
 
-use crate::char_select::ClientState;
+use crate::char_select::InWorldGated;
 use crate::ui_script::{PlayerUiHover, PointerOverUiPanel, UiKeyboardCapture};
 
 pub(crate) mod chord;
@@ -221,9 +221,10 @@ impl Plugin for BindingsPlugin {
                         .chain()
                         .in_set(crate::ui_script::UiInput)
                         .in_set(BindingSet)
-                        .before(benilla_world::schedule::WorldStage::Input)
-                        .run_if(in_state(ClientState::InWorld)),
-                    drain_binding_requests,
+                        .in_set(InWorldGated),
+                    // After the tick: the requests are Lua's own (`SaveBindings`, `RunBinding`),
+                    // queued by handlers the tick dispatched, and a save must not wait a frame.
+                    drain_binding_requests.after(crate::ui_script::UiInput),
                 ),
             );
     }
@@ -435,7 +436,6 @@ fn sync_dispatch(script: Option<NonSendMut<UiScript>>, mut dispatch: ResMut<Bind
 
 /// The dispatch pass — see the module doc. Runs right after the UI key feed (same frame's
 /// capture gate), before `WorldStage::Input` (a bound key must act this frame, once).
-#[allow(clippy::too_many_arguments)]
 fn latch_and_dispatch(
     script: Option<NonSendMut<UiScript>>,
     mut keyboard: MessageReader<KeyboardInput>,
diff --git a/crates/benilla-app/src/bindings/commands.rs b/crates/benilla-app/src/bindings/commands.rs
index 4f3ddde4..68ba9173 100644
--- a/crates/benilla-app/src/bindings/commands.rs
+++ b/crates/benilla-app/src/bindings/commands.rs
@@ -2254,7 +2254,7 @@ mod tests {
 
     /// The install's own `Bindings.xml`, parsed — `None` (and a skipped test) without a client.
     fn install_bindings() -> Option<Vec<benilla_ui::bindings_xml::AddonBinding>> {
-        let data = benilla_formats::wow_data()?;
+        let data = benilla_formats::wow_data_or_skip!(None);
         let mut chain = benilla_formats::open_chain(&data).expect("open the 1.12 patch chain");
         let xml = String::from_utf8_lossy(
             &chain
diff --git a/crates/benilla-app/src/blob_shadow.rs b/crates/benilla-app/src/blob_shadow.rs
index 5ec8207d..cacc5293 100644
--- a/crates/benilla-app/src/blob_shadow.rs
+++ b/crates/benilla-app/src/blob_shadow.rs
@@ -233,7 +233,7 @@ fn sync_shadows(
 
 /// Re-project each shadow whose inputs moved; clear it when the box degenerates, the fade
 /// reaches zero, or no receiving surface is in the box (the reference's no-ground gate).
-#[allow(clippy::too_many_arguments, clippy::type_complexity)]
+#[allow(clippy::type_complexity)]
 fn update_shadows(
     video: Res<crate::video::VideoConfig>,
     time: Res<Time>,
diff --git a/crates/benilla-app/src/bowstring.rs b/crates/benilla-app/src/bowstring.rs
index c8068a47..617a477d 100644
--- a/crates/benilla-app/src/bowstring.rs
+++ b/crates/benilla-app/src/bowstring.rs
@@ -7,10 +7,14 @@
 //!
 //! Benilla's transcription draws the two segments through Bevy's gizmo lines — the same
 //! immediate-mode screen-space-width primitive class as the client's GX lines. Named
-//! deviations (decision record): the string color/width are INFERRED (the callback emits a
-//! packed vertex color the round didn't decode — a dark cord is used); the bow prop is not yet
-//! animated (BowPull/BowRelease bend the limbs and carry the tips with them in the ref — our
-//! anchors ride the static prop frame, so the limbs stay straight while the middle draws).
+//! deviation (decision record): the string color/width are INFERRED (the callback emits a
+//! packed vertex color the round didn't decode — a dark cord is used).
+//!
+//! **The tips are POSED** (decision 2281). The bow prop animates — `$BWP` arms BowPull(160) on the
+//! prop's own model and `$BWR` returns it to Stand(0) — so the `$WTT`/`$WTB` markers ride limb
+//! bones that bend through the draw. Composing them through the prop's rigid root frame instead
+//! (which is all this file could do while the prop rested at bind pose) leaves the chord pinned to
+//! the un-bent limb tips while the mesh around it moves: the string would visibly leave the bow.
 
 use bevy::prelude::*;
 
@@ -28,15 +32,21 @@ const HAND_ARROW: u16 = 0x23;
 pub(crate) struct Bowstring {
     /// The unit wearing the bow — the HandArrow middle vertex and nock latch live on it.
     pub(crate) owner: Entity,
-    /// The `$WTT` top / `$WTB` bottom anchors, model-local Bevy space (the prop root's frame).
-    pub(crate) top: Vec3,
-    pub(crate) bottom: Vec3,
+    /// The `$WTT` top / `$WTB` bottom anchors as `(bone, model-local Bevy offset)` — the bone is
+    /// load-bearing on an animated prop (see the module note): the limb tips move with the draw.
+    pub(crate) top: (u16, Vec3),
+    pub(crate) bottom: (u16, Vec3),
 }
 
 /// Draw every visible bow's string (per frame, post-propagation so the prop/joint frames are
 /// this frame's). Two segments: tip → middle → tip.
 fn draw_bowstrings(
-    bows: Query<(&Bowstring, &GlobalTransform, &InheritedVisibility)>,
+    bows: Query<(
+        &Bowstring,
+        &GlobalTransform,
+        &InheritedVisibility,
+        Option<&benilla_world::rig_anim::RigPose>,
+    )>,
     owners: Query<(
         &BoneAttach,
         &benilla_world::rig_anim::RigPose,
@@ -47,12 +57,19 @@ fn draw_bowstrings(
 ) {
     // A dark waxed-cord tone; the ref's packed vertex color is not decoded (INFERRED, §G2).
     const STRING_COLOR: Color = Color::srgb(0.12, 0.10, 0.08);
-    for (bs, prop, vis) in &bows {
+    for (bs, prop, vis, flex) in &bows {
         if !vis.get() {
             continue;
         }
-        let top = prop.transform_point(bs.top);
-        let bottom = prop.transform_point(bs.bottom);
+        // The prop's own pose when it flexes (`joints_root` IS this entity, so its
+        // `GlobalTransform` is the frame `posed_point` wants); its rigid frame otherwise, which is
+        // the same answer for a bow standing at bind pose.
+        let tip = |(bone, offset): (u16, Vec3)| {
+            flex.and_then(|p| p.posed_point(prop, bone, offset))
+                .unwrap_or_else(|| prop.transform_point(offset))
+        };
+        let top = tip(bs.top);
+        let bottom = tip(bs.bottom);
         // The middle control point: the owner's HandArrow attach world position while the nock
         // latch holds (the drawn string follows the hand), else the relaxed straight chord.
         let middle = owners
diff --git a/crates/benilla-app/src/camera_shake.rs b/crates/benilla-app/src/camera_shake.rs
index 439f14cd..2394a9f3 100644
--- a/crates/benilla-app/src/camera_shake.rs
+++ b/crates/benilla-app/src/camera_shake.rs
@@ -284,7 +284,6 @@ fn load_shakes(mut commands: Commands, assets: Option<Res<WorldAssets>>) {
 struct Shakes(CameraShakeCatalog);
 
 /// Enqueue a shake for each qualifying footfall and death thud on the frame's event stream.
-#[allow(clippy::too_many_arguments)]
 fn fire_shakes(
     mut events: MessageReader<AnimSoundEvent>,
     time: Res<Time>,
diff --git a/crates/benilla-app/src/capture/fixtures.rs b/crates/benilla-app/src/capture/fixtures.rs
index 634a4d11..ab191c6c 100644
--- a/crates/benilla-app/src/capture/fixtures.rs
+++ b/crates/benilla-app/src/capture/fixtures.rs
@@ -33,7 +33,6 @@ const SUBJECT_YAW: f32 = 2.36;
 /// feeds then push it into the VM during the settle window exactly as live wire data would. Item
 /// icons resolve through the offline `ItemDisplayCatalog` (display ids chosen from entries that
 /// catalog is known to carry); names land directly in the caches (no server to ask).
-#[allow(clippy::too_many_arguments)]
 pub(super) fn seed_ui_fixture(
     mut ctx: ResMut<CaptureCtx>,
     mut commands: Commands,
diff --git a/crates/benilla-app/src/capture/fxview.rs b/crates/benilla-app/src/capture/fxview.rs
index e3e2e1e9..2d6d59cb 100644
--- a/crates/benilla-app/src/capture/fxview.rs
+++ b/crates/benilla-app/src/capture/fxview.rs
@@ -12,7 +12,7 @@ use super::{FxViewRequest, FxViewState, FXVIEW_POS};
 use crate::creature_anim::FxStage;
 use crate::entities::display::{empty_shell, ModelHandle};
 use crate::entities::spell_fx::{
-    attach_effect_visuals, EffectHost, FxTintAnims, SpellFx, FALLBACK_SPAN,
+    attach_effect_visuals, EffectHost, FxMaterials, FxTintAnims, SpellFx, FALLBACK_SPAN,
 };
 
 /// The `fxview` unit lane's synthetic guid (`WOW_FX_DISPLAY`) — a high-word `0xF130` creature guid
@@ -29,7 +29,6 @@ const FXVIEW_GO_GUID: u64 = (0xF110u64 << 48) | 0xFC0FEE;
 /// through the same [`attach_effect_visuals`] body the game uses, and (for missiles) fly the
 /// root along its facing so trails extend. Inert outside fxview captures (the request resource
 /// only exists then).
-#[allow(clippy::too_many_arguments)]
 pub(crate) fn drive_fx_view(
     req: Option<Res<FxViewRequest>>,
     state: Option<ResMut<FxViewState>>,
@@ -39,6 +38,8 @@ pub(crate) fn drive_fx_view(
     time: Res<Time>,
     mut wow_materials: ResMut<Assets<WowModelMaterial>>,
     mut tint_reg: ResMut<FxTintAnims>,
+    mut uv_reg: ResMut<benilla_world::doodad_anim::UvAnimMaterials>,
+    mut anim_table: ResMut<benilla_world::mat_anim_table::MatAnimTable>,
     ibps: Res<Assets<bevy::mesh::skinning::SkinnedMeshInverseBindposes>>,
     mut palettes: ResMut<benilla_world::rig_palette::RigPalettes>,
     spatial: avian3d::prelude::SpatialQuery,
@@ -216,8 +217,12 @@ pub(crate) fn drive_fx_view(
             } else {
                 FxStage::OneShot
             }),
-            &mut wow_materials,
-            &mut tint_reg,
+            &mut FxMaterials {
+                store: &mut wow_materials,
+                tint: &mut tint_reg,
+                uv: &mut uv_reg,
+                table: &mut anim_table,
+            },
             &ibps,
             &mut palettes,
             None, // the fixture previews a kit effect on its model's own `Stand`
diff --git a/crates/benilla-app/src/capture/live_shot.rs b/crates/benilla-app/src/capture/live_shot.rs
index 066e1a0a..2f83bf35 100644
--- a/crates/benilla-app/src/capture/live_shot.rs
+++ b/crates/benilla-app/src/capture/live_shot.rs
@@ -126,7 +126,7 @@ fn burst_path(out: &str, index: u32, count: u32) -> String {
 /// filter instead of the scene. That cost a whole B38 session: eight bursts and three retracted
 /// mechanisms measured on a corpse, because the images still looked like a plausible frame. A loud
 /// no-op is worth far more than a burst that has to be recognised as garbage after the fact.
-#[allow(clippy::too_many_arguments, clippy::type_complexity)] // one Bevy system's full input set
+#[allow(clippy::type_complexity)] // one Bevy system's full input set
 fn fire_live_shot(
     mut shot: ResMut<LiveShot>,
     time: ProbeClock,
@@ -134,7 +134,7 @@ fn fire_live_shot(
     self_q: Query<&ObjectStore, With<SelfPlayer>>,
     subjects: Query<(&Guid, &Transform), (With<NetEntity>, Without<SelfPlayer>)>,
     camera: Query<(&Camera, &Transform), With<WorldCamera>>,
-    mut names: ResMut<NameCache>,
+    names: Res<NameCache>,
     net_commands: Res<NetCommands>,
     mut refused: Local<bool>,
     mut next_require_warn: Local<f32>,
diff --git a/crates/benilla-app/src/capture/mod.rs b/crates/benilla-app/src/capture/mod.rs
index cfd1a3cf..891a1d8b 100644
--- a/crates/benilla-app/src/capture/mod.rs
+++ b/crates/benilla-app/src/capture/mod.rs
@@ -92,6 +92,7 @@ mod phase_probe;
 mod pick_probe;
 mod probe_auction;
 mod probe_bank;
+mod probe_bg;
 mod probe_bg_queue;
 mod probe_binder;
 mod probe_book;
@@ -101,6 +102,7 @@ mod probe_charter;
 mod probe_chest;
 mod probe_clam;
 mod probe_crossing;
+pub(crate) mod probe_env;
 mod probe_gm_ticket;
 mod probe_goquest;
 mod probe_guard_poi;
@@ -110,6 +112,7 @@ mod probe_model_camera;
 mod probe_partner;
 mod probe_rig;
 mod probe_service;
+mod probe_stone;
 mod probe_taxi;
 mod probe_vendor_swap;
 mod probes;
@@ -122,6 +125,7 @@ pub(crate) use phase_probe::PhaseProbePlugin;
 pub(crate) use pick_probe::PickProbePlugin;
 pub(crate) use probe_auction::ProbeAuctionPlugin;
 pub(crate) use probe_bank::ProbeBankPlugin;
+pub(crate) use probe_bg::ProbeBgPlugin;
 pub(crate) use probe_bg_queue::ProbeBgQueuePlugin;
 pub(crate) use probe_binder::ProbeBinderPlugin;
 pub(crate) use probe_book::ProbeBookPlugin;
@@ -140,6 +144,7 @@ pub(crate) use probe_model_camera::ProbeModelCameraPlugin;
 pub(crate) use probe_partner::ProbePartnerPlugin;
 pub(crate) use probe_rig::ProbeRigPlugin;
 pub(crate) use probe_service::ProbeServicePlugin;
+pub(crate) use probe_stone::ProbeStonePlugin;
 pub(crate) use probe_taxi::ProbeTaxiPlugin;
 pub(crate) use probe_vendor_swap::ProbeVendorSwapPlugin;
 pub(crate) use probes::{
@@ -912,7 +917,6 @@ impl Plugin for CapturePlugin {
 /// Each frame, force the deterministic capture conditions: pinned time-of-day, no perf HUD, and the
 /// fixed camera pose. Runs in `WorldStage::Present` (after `control` is gated off and after terrain
 /// streaming reads the camera), so the harness is the sole, stable author of the view.
-#[allow(clippy::too_many_arguments)]
 fn pin_scene(
     ctx: Res<CaptureCtx>,
     mut debug: ResMut<DebugState>,
@@ -992,7 +996,8 @@ fn hold_clock(mut clock: ResMut<Time<Virtual>>) {
 
 /// The three scene-population queries the `FPS_PROBE` line prints — bundled because they are one
 /// concern (how much world is resident, and how much of it survived the cull) and because
-/// `drive_capture` sits against Bevy's 16-parameter ceiling, which `cvars::KnobParams` hit first.
+/// `drive_capture` sits against Bevy's 16-parameter ceiling, which the CVar host's old knob
+/// bundle hit first (retired by 2303).
 #[derive(bevy::ecs::system::SystemParam)]
 pub(crate) struct ProbeCensus<'w, 's> {
     particles: Query<'w, 's, &'static benilla_world::particles::ParticleEmitter>,
@@ -1001,7 +1006,6 @@ pub(crate) struct ProbeCensus<'w, 's> {
 }
 
 /// Drive the capture lifecycle: wait for streaming, settle, screenshot, exit.
-#[allow(clippy::too_many_arguments)]
 fn drive_capture(
     mut ctx: ResMut<CaptureCtx>,
     mut watch: ResMut<FrameWatch>,
diff --git a/crates/benilla-app/src/capture/probe_auction.rs b/crates/benilla-app/src/capture/probe_auction.rs
index 351c7f14..b8955717 100644
--- a/crates/benilla-app/src/capture/probe_auction.rs
+++ b/crates/benilla-app/src/capture/probe_auction.rs
@@ -447,7 +447,7 @@ fn error_name(error: u32) -> &'static str {
     }
 }
 
-#[allow(clippy::too_many_arguments, clippy::too_many_lines)]
+#[allow(clippy::too_many_lines)]
 fn auction_probe(
     time: ProbeClock,
     mut probe: ResMut<AuctionProbe>,
diff --git a/crates/benilla-app/src/capture/probe_bank.rs b/crates/benilla-app/src/capture/probe_bank.rs
index 713977a0..690fa924 100644
--- a/crates/benilla-app/src/capture/probe_bank.rs
+++ b/crates/benilla-app/src/capture/probe_bank.rs
@@ -202,7 +202,6 @@ fn find_bank_slot(store: &ObjectStore, guid: u64) -> Option<u8> {
     (0..24u8).find(|&i| store.0.player_bank_slot(i) == Some(guid))
 }
 
-#[allow(clippy::too_many_arguments)]
 fn bank_probe(
     time: ProbeClock,
     mut probe: ResMut<BankProbe>,
diff --git a/crates/benilla-app/src/capture/probe_bg.rs b/crates/benilla-app/src/capture/probe_bg.rs
new file mode 100644
index 00000000..1757b83a
--- /dev/null
+++ b/crates/benilla-app/src/capture/probe_bg.rs
@@ -0,0 +1,1509 @@
+//! The **inside-a-battleground** live probe (`WOW_PROBE_BG=wsg|ab|av`) — the instrument that turns
+//! "does a battleground work?" from a question nobody can answer into a census anyone can read.
+//! Inert without the env.
+//!
+//! ## Why this exists
+//!
+//! Decisions 1963 / 1972 / 1974 / 1980 built the whole battleground **interface** — the queue, the
+//! list window, the scoreboard, the always-up readout, the map blips, forty-odd Lua verbs — and
+//! every one of them off the reference's own FrameXML. What none of them could build is the thing
+//! on the far side of the port button: **nothing in this tree has ever entered map 489, 529 or
+//! 30.** `ProbeBgQueuePlugin` stops at the queue by design (it is 2232's login-burst fixture);
+//! the terrain, the world states, the objects, the spirit guides and the match's own end have
+//! never been observed at all. So the gaps are not *known* to be gaps — they are unmeasured, and
+//! an unmeasured subsystem is where a "should work by construction" quietly isn't.
+//!
+//! This probe is the measurement. It walks the real player road — level, greet a battlemaster on
+//! the wire, queue, take the port through the **stock Lua verb** the reference's own dialog calls
+//! — and then, from inside, prints a structured census every [`CENSUS_EVERY`] until
+//! [`census_samples`] are in. Every later battleground round is judged against these lines.
+//!
+//! ## The one server-side lever, and why it is needed — and why it is turned back off
+//!
+//! A battleground does not start until `min_players_per_team` bodies are queued on each side —
+//! four for Warsong Gulch on this server's patch, twenty for Alterac Valley
+//! (`mangos.battleground_template`). One probe can never reach that. vmangos has the lever built
+//! in: **`.debug bg`** toggles `BattleGroundMgr::m_testing`, and `BattleGroundQueue::CheckNormalMatch`
+//! then starts a battleground as soon as *either* side has one player
+//! (`BattleGroundMgr.cpp:557/623/756`). It is `SEC_ADMINISTRATOR` (6), exactly what a probe account
+//! holds, and it is **in-memory only** — `m_testing` is initialised `false` in the manager's
+//! constructor, so a server restart clears it whatever happens here.
+//!
+//! `.debug bg` is a **toggle, not a set**, and it announces itself to the whole realm
+//! (`LANG_DEBUG_BG_ON`/`_OFF`). Both facts are reported on the probe's own lines so a run that
+//! started from the wrong state reads as such rather than as a broken queue.
+//!
+//! **The lever is tracked by PARITY, not by state** ([`BgProbe::toggles_sent`]), and put back by
+//! [`leave_testing_as_found`] — which every road to [`Phase::Done`] goes through, failures
+//! included. "What is it now?" can only be answered by a world-text reply that may never arrive;
+//! "how far from where I found it?" needs no reply at all. It is restored **as soon as the probe
+//! is inside the instance**, because that is the moment the lever has finished its job: it is
+//! needed for `CheckNormalMatch` to *form* the match, not to run one.
+//!
+//! Leaving it on also makes a solo battleground unendable: vmangos decrements its premature-finish
+//! countdown inside an `else if (!sBattleGroundMgr.isTesting())` branch (`BattleGround.cpp:337`),
+//! so while testing is on the countdown is armed and then **frozen**. Decision 2290 said the
+//! opposite, from reading `GetPrematureFinishTime()` without the branch that consumes it; 2296
+//! corrects it, having watched a run sit in Warsong Gulch for 492 s with `GetBattlefieldWinner()`
+//! nil the whole way.
+//!
+//! ## What the census reports, and why each column is there
+//!
+//! | column | the question it answers |
+//! |---|---|
+//! | `map` / `area` | did the worldport land, and does the terrain know where we are? |
+//! | `pos` | is the body at the battleground's own start location, or at the origin? |
+//! | `terrain` | [`WorldLoadProgress`] — did map 489's ADTs stream, or is the ground missing? |
+//! | `ents` | units / players / gameobjects / dynamic / corpses actually mirrored into the ECS |
+//! | `gos` | the gameobject **entries** in range — the flags, the doors, the banners |
+//! | `states` | the raw world-state table and its scope: the score, the flag carriers, the timer |
+//! | `alwaysup` | `GetNumWorldStateUI()` — what the reference's readout would actually draw |
+//! | `status` | `GetBattlefieldStatus(1..3)`, straight out of the VM |
+//! | `score` | `GetNumBattlefieldScores()` / `GetBattlefieldWinner()` |
+//! | `guide` | the nearest `SPIRITGUIDE`-flagged unit — the graveyard's resurrect wave |
+//! | `dropped` | every opcode the codec threw on the floor, by name |
+//! | `events` | the Lua event tap's window — or an explicit "the tap is broken", never silence |
+//! | `mapinfo` | (at Report) `GetMapInfo()` and the overlay/landmark counts — whether the battle
+//!   map has anything to **draw**, which `IsShown()` cannot tell you |
+//!
+//! There is deliberately **no `lua` column**; see the note at the end of [`census`] for why the one
+//! that used to be here could not measure what it claimed.
+//!
+//! ## What this probe cannot see
+//!
+//! It calls [`crate::ui_chat::idle::LastInput::stamp_present`] every frame, which suppresses the
+//! whole idle band — auto-sit, auto-AFK and camp alike (`ui_chat::idle::idle_action`). That is
+//! deliberate and necessary (see the note at the top of [`bg_probe`]), but it means the one
+//! long-running instrument that otherwise sits still for minutes can never exercise the idle
+//! handler. A regression there has to be caught somewhere else.
+//!
+//! ## The run recipe
+//!
+//! ```sh
+//! cd <slot> && WOW_USER=probe7 WOW_PASS=pprobe7 WOW_CHAR=Probeseven \
+//!   WOW_UNATTENDED=1 WOW_NOSOUND=1 WOW_GM=off WOW_PROBE_BG=wsg \
+//!   timeout 600 cargo run -p benilla 2>&1 | grep -E 'PROBE bg:'
+//! ```
+//!
+//! Raise the `timeout` with [`census_samples`]: a default run needs ~5 min including login, and a
+//! run sized to reach a match's ending needs ~10.
+//!
+//! `WOW_GM=off` is not optional here: GM mode re-templates the body's faction to 35, and a
+//! battleground is the one place where every reaction, every objective and the server's own team
+//! assignment reads off it (0649, 0679).
+//!
+//! Non-combat — the probe never attacks and never stands anywhere contested; with one player in
+//! the instance there is nobody to fight. Pair with the SLOT-KEYED probe identity
+//! (`method.md`, "The local vmangos server").
+
+use bevy::ecs::system::NonSendMut;
+use bevy::prelude::*;
+
+use benilla_ui::script::UiScript;
+use benilla_world::terrain_stream::{CurrentArea, WorldLoadProgress};
+use benilla_world::world_map::CurrentMap;
+
+use super::probes::ProbeClock;
+use crate::net::{
+    ChatKind, ClientCommand, DroppedOpcodes, Guid, NetCommands, NetEntity, ObjectStore, SelfPlayer,
+};
+use crate::player::Player;
+use crate::target::cursor_mode::npc_flags;
+use crate::ui_battlefield::Battlefield;
+use crate::ui_dialog_verbs::BattlefieldQueue;
+use crate::world_state::WorldStates;
+
+/// One battleground's fixtures: what to queue for, and which battlemaster to greet.
+///
+/// All three battlemasters stand within ~35 yd of each other in Stormwind's PvP alcove, so one
+/// `.go` reaches any of them — which is why the probe finds its NPC by **creature entry** off the
+/// guid rather than by "the nearest battlemaster", a predicate that would pick whichever of the
+/// three streamed in first.
+struct Arena {
+    /// `WOW_PROBE_BG`'s value.
+    key: &'static str,
+    /// The Map.dbc row — what `CMSG_BATTLEMASTER_JOIN` carries and what the worldport must land on.
+    map: u32,
+    /// The battlemaster's `creature_template.entry` (vmangos `battlemaster_entry`).
+    npc_entry: u32,
+    /// That NPC's display name, for the probe's own lines.
+    npc_name: &'static str,
+    /// Its spawn — the `.go xyz` target (vmangos `creature`, map 0, Stormwind).
+    at: [f32; 3],
+    /// The objective this battleground's **flag leg** goes for: the gameobject entry to click and
+    /// where it stands on the battleground map (vmangos `gameobject`). `None` for a battleground
+    /// whose objective is not a single clickable flag.
+    flag: Option<(u32, [f32; 3])>,
+}
+
+/// The three 1.12 battlegrounds. Levels are not per-arena: [`QUEUE_LEVEL`] clears every bracket
+/// floor on every content patch, so the probe never has to know which patch the server runs.
+const ARENAS: [Arena; 3] = [
+    Arena {
+        key: "wsg",
+        map: 489,
+        npc_entry: 14981,
+        npc_name: "Elfarran",
+        at: [-8454.62, 318.85, 120.97],
+        // The **Warsong Flag** at the Horde base — the one an Alliance body carries. Our own
+        // Silverwing Flag (179830) is the capture point, not the pickup.
+        flag: Some((179831, [916.02, 1434.40, 345.41])),
+    },
+    Arena {
+        key: "ab",
+        map: 529,
+        npc_entry: 15008,
+        npc_name: "Lady Hoteshem",
+        at: [-8420.48, 328.71, 120.89],
+        // Arathi Basin's objective is five capturable banners, not a carried flag.
+        flag: None,
+    },
+    Arena {
+        key: "av",
+        map: 30,
+        npc_entry: 7410,
+        npc_name: "Thelman Slatefist",
+        at: [-8424.55, 342.81, 120.89],
+        // Alterac Valley's are towers, graveyards and captains.
+        flag: None,
+    },
+];
+
+/// The level the probe body is raised to.
+///
+/// 60 rather than the 25 `probe_bg_queue` uses, because Alterac Valley's floor is **51** on every
+/// patch that ships it and the bracket is checked at the HELLO — a body under it is refused there,
+/// silently, so the list never arrives and the failure reads like a broken client.
+const QUEUE_LEVEL: u32 = 60;
+
+/// How many times to drop and re-take the queue before giving up (see the `Joined` arm).
+const MAX_REJOINS: u32 = 3;
+
+/// The `.go`'s settle radius before the battlemaster scan. Not a gate — the server applies its own
+/// interaction check; this only keeps the probe from greeting a battlemaster it has not reached.
+const NEAR_YD: f32 = 20.0;
+
+/// `PLAYER_FLAGS_GM` — the bit that says the body carries GM mode's faction-35 re-template
+/// (`crate::probe_shield` names the same constant).
+const PLAYER_FLAGS_GM: u32 = 0x0000_0008;
+
+/// How long the exit waits for the battleground leave to land before going anyway. The teleport
+/// out is a server round trip plus a worldport; five seconds is far more than a local server needs
+/// and is a backstop, not a budget.
+const LEAVE_GRACE: f64 = 5.0;
+
+/// How long to wait for `probe_shield`'s `.gm off` to land before refusing the run.
+///
+/// **Sized by that module's own sequencing, not by guesswork** — five seconds was measured as too
+/// tight and refused a run that had `WOW_GM=off` set and was about to comply. `probe_shield` waits
+/// up to `NAME_WAIT_SECS` (3 s) for the body's name to resolve, then spaces its commands
+/// `STEP_SECS` (0.8 s) apart with the god line *before* the `.gm off` (the shield must be up first,
+/// 0679), and the flag only clears once the server's field update comes back. Twenty seconds
+/// clears all of that with room, and still fails fast against a run that is never going to comply.
+const GM_DROP_WAIT: f64 = 20.0;
+
+/// How long to keep listening for `.debug bg`'s world-text reply before giving up and saying so.
+///
+/// The reply crosses the network, the chat pipeline and the Lua event dispatch before it reaches
+/// the tap. The old code took **one** destructive look 1.5 s after the send, which is both too
+/// narrow to be reliable and, being a single sample, unable to tell "not yet" from "never".
+const TOGGLE_REPLY_WINDOW: f64 = 6.0;
+
+/// How often a census line is printed once inside.
+const CENSUS_EVERY: f64 = 12.0;
+
+/// How many census samples to take before reporting and leaving.
+///
+/// **Sized by the preparation phase, not by taste.** A battleground does not begin when you land
+/// in it: vmangos holds every arrival behind closed doors for `BG_START_DELAY_2M` = **120 s**
+/// (`BattleGround.cpp:248`, the four `BG_STARTING_EVENT_*` steps at 2 min / 1 min / 30 s / go),
+/// and `.debug bg` does not shorten it. A window that ended before then would census nothing but
+/// the pen and report it as the whole battleground.
+///
+/// Twelve × 12 s = **144 s**: the full prep, the doors dropping at ~116 s, and two samples past
+/// them, which leaves room for the flag and graveyard legs inside the same run. Reaching the
+/// *ending* is a different window — see [`census_samples`].
+const CENSUS_SAMPLES_DEFAULT: u32 = 12;
+
+/// The census sample count, overridable with `WOW_PROBE_BG_SAMPLES`.
+///
+/// The default covers the preparation phase and the doors. **The reason it is a dial** is the end
+/// of a match: with one body inside, vmangos starts its `BattleGround.PrematureFinishTimer` (5 min,
+/// because `CreateNewBattleGround` reads `min_players_per_team` from the template and not from the
+/// testing override, so a solo match is permanently under-populated) and then ends the battleground
+/// **with no winner** — `WINNER_NONE` = 2, not a team (`BattleGroundDefines.h:204`).
+///
+/// **Sizing it is arithmetic, not taste.** The countdown is armed when the battleground reaches
+/// `STATUS_IN_PROGRESS` — the doors, ≈T+120 s — and runs 300 s from there, so the ending lands at
+/// ≈T+420 s ≈ **35 samples**. `WOW_PROBE_BG_SAMPLES=36` reaches it; the 30 this doc used to
+/// recommend stops 60 s short and reports "the match never ended", which reads as a defect rather
+/// than as a window that was too small.
+///
+/// **Alterac Valley can never be ended this way at all**: the whole premature-finish block is
+/// guarded by `GetTypeID() != BATTLEGROUND_AV` (`BattleGround.cpp:318`).
+///
+/// A value below 1 is meaningless and is clamped to 1 — the first sample is also where the testing
+/// lever is put back, and a run that never censuses never restores it.
+fn census_samples() -> u32 {
+    std::env::var("WOW_PROBE_BG_SAMPLES")
+        .ok()
+        .and_then(|v| v.parse().ok())
+        .unwrap_or(CENSUS_SAMPLES_DEFAULT)
+        .max(1)
+}
+
+/// How often the ghost leg samples, and for how long. The battleground resurrect wave is a 30 s
+/// server cycle (`BattleGround::Update`'s `m_lastResurrectTime`), so eleven 4 s samples cover a
+/// full wave and a little of the next — enough to see the clock arm, tick down, and fire.
+const GHOST_SAMPLE_EVERY: f64 = 4.0;
+/// See [`GHOST_SAMPLE_EVERY`].
+const GHOST_SAMPLES: u32 = 11;
+
+/// How many 3 s samples the flag leg takes after the use.
+const FLAG_SAMPLES: u32 = 5;
+
+/// `SPIRITGUIDE` — `UNIT_NPC_FLAGS` bit 6, the flag the reference's area-spirit-healer acquire
+/// scan keys on (wow-re `interact-dead-fork-and-npc-service-ladder.md` §C row 6).
+const NPC_FLAG_SPIRITGUIDE: u32 = 1 << 6;
+
+/// The **event tap** — a Lua frame the probe installs on entry that records every battleground
+/// event the reference's own interface listens for, with its `arg1`.
+///
+/// This exists because the first run's finding could not be read off the log at all. vmangos sends
+/// three `CHAT_MSG_BG_SYSTEM_NEUTRAL` lines during the countdown (`BattleGround.cpp:383/392/400`,
+/// the one-minute / half-minute / has-begun `m_startMessageIds`) and a `SMSG_PLAY_SOUND`
+/// (`PlaySoundToAll(SOUND_BG_START)`), and **nothing appeared** — but an absent log line is not an
+/// absent event, because a chat kind that reaches the VM logs nothing on the way. Silence in a log
+/// is not evidence; a tap on the event itself is.
+///
+/// It is written in the reference's own Lua dialect (`this`/`event`/`arg1` globals in `OnEvent`,
+/// no `ipairs` over a literal) so it exercises the same road a 1.12 addon would.
+const EVENT_TAP: &str = r#"
+BenillaBgLog = {};
+BenillaBgTap = CreateFrame("Frame");
+BenillaBgTap:SetScript("OnEvent", function()
+    table.insert(BenillaBgLog, event .. "(" .. tostring(arg1) .. ")");
+end);
+BenillaBgTap:RegisterEvent("CHAT_MSG_BG_SYSTEM_NEUTRAL");
+BenillaBgTap:RegisterEvent("CHAT_MSG_BG_SYSTEM_ALLIANCE");
+BenillaBgTap:RegisterEvent("CHAT_MSG_BG_SYSTEM_HORDE");
+BenillaBgTap:RegisterEvent("CHAT_MSG_SYSTEM");
+BenillaBgTap:RegisterEvent("CHAT_MSG_MONSTER_YELL");
+BenillaBgTap:RegisterEvent("UPDATE_WORLD_STATES");
+BenillaBgTap:RegisterEvent("UPDATE_BATTLEFIELD_STATUS");
+BenillaBgTap:RegisterEvent("UPDATE_BATTLEFIELD_SCORE");
+BenillaBgTap:RegisterEvent("AREA_SPIRIT_HEALER_IN_RANGE");
+BenillaBgTap:RegisterEvent("AREA_SPIRIT_HEALER_OUT_OF_RANGE");
+BenillaBgTap:RegisterEvent("PLAYER_DEAD");
+BenillaBgTap:RegisterEvent("PLAYER_UNGHOST");
+BenillaBgTap:RegisterEvent("PLAYER_ALIVE");
+BenillaBgTap:RegisterEvent("ZONE_CHANGED_NEW_AREA");
+"#;
+
+/// Drain the tap: everything it recorded since the last census, then empty it.
+///
+/// **It reports the tap's own liveness first**, and that is not decoration. `BenillaBgLog` is set
+/// on `EVENT_TAP`'s first line, so a tap that raised *after* that line — or a tap installed into a
+/// VM that has since been thrown away and minted fresh — leaves a table that drains cleanly to `""`
+/// forever. An empty string would then be indistinguishable from "the battleground fired nothing",
+/// which is the one answer this instrument must never give by accident. The sentinel makes the
+/// difference readable, and [`bg_probe`] re-installs on seeing it.
+const TAP_GONE: &str = "<tap-gone>";
+
+/// See [`TAP_GONE`]: both globals are checked, because the frame is what actually receives events
+/// and the table is what holds them — either one missing means the readings are not trustworthy.
+const EVENT_DRAIN: &str = r#"
+local out = "";
+if not BenillaBgLog or not BenillaBgTap then return "<tap-gone>" end
+for i = 1, table.getn(BenillaBgLog) do out = out .. "  " .. BenillaBgLog[i]; end
+BenillaBgLog = {};
+return out;
+"#;
+
+pub(crate) struct ProbeBgPlugin;
+
+impl Plugin for ProbeBgPlugin {
+    fn build(&self, app: &mut App) {
+        app.init_resource::<BgProbe>()
+            .add_systems(Update, (bg_probe, bg_probe_exit).chain());
+    }
+}
+
+#[derive(Resource, Default)]
+struct BgProbe {
+    phase: Phase,
+    /// The Lua event tap is in and believed live. **Not a latch** — the drain re-checks the tap's
+    /// own global every sample and clears this if the VM went away underneath it, because the
+    /// interface VM is minted fresh on every world entry (`ui_script::lifecycle::mint_entry_vm`)
+    /// and a tap installed into the boot VM is silently gone after the port. A dead tap that still
+    /// reads `tap_installed` prints `EVENTS  (none)` forever, which is the exact inversion this
+    /// instrument exists to avoid.
+    tap_installed: bool,
+    /// The tap raised on install and cannot be trusted. Kept apart from `tap_installed` so an
+    /// `EVENTS` line can say *"the tap is broken"* rather than *"the battleground fired nothing"*.
+    tap_broken: bool,
+    /// **How many `.debug bg` toggles this run has sent — parity, not state.**
+    ///
+    /// `.debug bg` is a toggle, so "what is it now?" is the wrong question and the one the old code
+    /// asked: it can only be answered by reading a world-text reply that may never arrive. "How far
+    /// from where I found it?" is always answerable, needs no reply, and is what a restore actually
+    /// needs. An odd count means this run left the lever flipped and owes the realm one more send;
+    /// an even count means it is already as found — including the normal road, where the run turns
+    /// testing on to queue and off again once inside.
+    toggles_sent: u32,
+    /// What the tap last said the lever reads: `Some(true)` = on ("…for debugging"), `Some(false)` =
+    /// off ("…normal playercount"), `None` = no reply seen yet. Consumed once so a second pass
+    /// cannot re-decide on a stale marker.
+    testing_seen: Option<bool>,
+    /// The lever was **read back** as on before the join, rather than merely assumed. The `Joined`
+    /// failure text says which, because "the flag was confirmed ON, so look elsewhere" sends the
+    /// reader past the actual suspect when nothing was ever confirmed.
+    testing_confirmed: bool,
+    /// How many times the queue has been dropped and re-taken (see the `Joined` arm).
+    rejoins: u32,
+    /// The `AppExit` has been written — `Done` is re-entered every frame until the app actually
+    /// stops, and a second exit write would be noise.
+    exited: bool,
+    /// When [`Phase::Done`] was first seen, so the exit can wait for the leave to land.
+    done_at: Option<f64>,
+    /// When the `Wait` arm first saw a body, so the GM-mode gate can time out rather than hang.
+    waiting_since: Option<f64>,
+    /// Events drained before the first census (during the toggle read-back and the queue road).
+    /// Carried rather than discarded: the old code threw them away and then attributed them to the
+    /// first 12 s census window, which is a reading about the wrong interval.
+    pending_events: String,
+}
+
+/// `Wait` → (levelled, hop sent) `Hopped` → (`.debug bg` sent) `Toggled` → (reply read, testing
+/// confirmed on, battlemaster greeted) `Greeted` →
+/// (join sent) `Joined` → (the port taken) `Ported` → (map 489 reached) `Inside` →
+/// (`.die` sent) `Dying` → (released, ghost at the graveyard) `Ghost` → `Done`.
+#[derive(Default, PartialEq)]
+enum Phase {
+    #[default]
+    Wait,
+    Hopped {
+        sent_at: f64,
+    },
+    Toggled {
+        sent_at: f64,
+        corrected: bool,
+    },
+    /// Looking for the battlemaster, **after** the testing lever is settled. Split out of `Toggled`
+    /// so the reply read happens once: the old code re-ran its destructive drain every frame of the
+    /// 15 s scan, which threw away every tap event that arrived during it and re-printed a
+    /// "TESTING unread" warning over the "TESTING on" line it had already printed.
+    Scanning {
+        since: f64,
+    },
+    Greeted {
+        master: u64,
+        sent_at: f64,
+    },
+    Joined {
+        sent_at: f64,
+    },
+    Rejoining {
+        at: f64,
+    },
+    Ported {
+        sent_at: f64,
+    },
+    Inside {
+        entered_at: f64,
+        next_census: f64,
+        samples: u32,
+    },
+    FlagHop {
+        at: f64,
+    },
+    FlagUsed {
+        at: f64,
+        samples: u32,
+    },
+    Dying {
+        sent_at: f64,
+    },
+    Ghost {
+        released_at: f64,
+        next_sample: f64,
+        samples: u32,
+    },
+    Done,
+}
+
+/// Which battleground this run is for — `WOW_PROBE_BG`'s value, defaulting to Warsong Gulch (the
+/// smallest, fastest and the only one whose objectives fit in one census window).
+fn arena() -> &'static Arena {
+    let want = std::env::var("WOW_PROBE_BG").unwrap_or_default();
+    ARENAS
+        .iter()
+        .find(|a| a.key.eq_ignore_ascii_case(&want))
+        .unwrap_or(&ARENAS[0])
+}
+
+/// A GM dot-command on the real chat wire; every reply is echoed by `net` as
+/// `server says — …`, so a command that did nothing is visible as such.
+fn gm(net: &NetCommands, text: impl Into<String>) {
+    let _ = net.0.send(ClientCommand::Chat {
+        kind: ChatKind::Say,
+        target: None,
+        text: text.into(),
+    });
+}
+
+/// Drain the event tap, distinguishing its three outcomes rather than flattening them to `""`.
+///
+/// Returns the events, or a bracketed reason. A `TAP_GONE` sentinel also **clears
+/// `tap_installed`**, so the next frame re-installs into whatever VM is live now — which is the
+/// self-heal for the one-frame world-entry window where the tap can land in a boot VM that is
+/// about to be discarded (`ui_script::lifecycle`).
+fn drain_events(probe: &mut BgProbe, script: &mut UiScript) -> String {
+    match script.eval::<String>(EVENT_DRAIN) {
+        Ok(s) if s.trim() == TAP_GONE => {
+            probe.tap_installed = false;
+            format!("  {TAP_GONE} — the VM was replaced under the tap; re-installing")
+        }
+        Ok(s) => s,
+        Err(e) => format!("  <drain raised: {e}>"),
+    }
+}
+
+/// Put the realm's `.debug bg` lever back if **this run** is the one that moved it.
+///
+/// Every road to [`Phase::Done`] goes through this, and that is the whole point. `.debug bg` is a
+/// realm-global, in-memory toggle (`BattleGroundMgr::ToggleTesting`) that announces itself to every
+/// player in the world, and it is a **toggle, not a set** — so a run that ends without restoring it
+/// hands the next run the opposite of what it expects. That is not hypothetical: it is how runs 2,
+/// 4 and 5 of this probe failed (2290 §2). The old code restored it at exactly one place, an
+/// equality test on the census counter, which every failure path and every
+/// `WOW_PROBE_BG_SAMPLES < DOORS_SAMPLE` run skipped silently.
+fn leave_testing_as_found(probe: &mut BgProbe, net: &NetCommands) {
+    if probe.toggles_sent % 2 == 1 {
+        info!(
+            "PROBE bg: TESTING — {} toggle(s) sent this run; one more puts the realm's \
+             `.debug bg` lever back as found",
+            probe.toggles_sent
+        );
+        toggle_testing(probe, net);
+    } else {
+        info!(
+            "PROBE bg: TESTING — {} toggle(s) sent this run; the lever is already as found",
+            probe.toggles_sent
+        );
+    }
+}
+
+/// Send `.debug bg` and count it. **Every** send goes through here — the parity in
+/// [`leave_testing_as_found`] is only as good as the counting.
+fn toggle_testing(probe: &mut BgProbe, net: &NetCommands) {
+    probe.toggles_sent += 1;
+    gm(net, ".debug bg");
+}
+
+/// End the run, restoring anything this run changed on the server first.
+fn finish(probe: &mut BgProbe, net: &NetCommands) {
+    leave_testing_as_found(probe, net);
+    probe.phase = Phase::Done;
+}
+
+/// A world state, distinguishing **absent** from **zero**.
+///
+/// [`WorldStates::get`] is reference-faithful: a key the server never sent reads `0`, because that
+/// is what the real client's table does. That is right for the client and wrong for an instrument —
+/// `ws2338=0` reads as a well-formed "the flag is at its base" when it actually means "no
+/// `SMSG_INIT_WORLD_STATES` ever carried this key". vmangos writes only 1 or 2 into the flag rows
+/// (`BattleGroundWS.cpp:509-515`, all eight call sites), so a `0` there is *always* a missing
+/// reading — and the person reading the log is exactly the person who does not know that yet.
+fn ws(states: &WorldStates, key: u32) -> String {
+    states
+        .pairs()
+        .find(|(k, _)| *k == key)
+        .map_or_else(|| "absent".to_string(), |(_, v)| v.to_string())
+}
+
+// One Bevy system's full input set — the guard-poi probe's shape, plus the census reads.
+#[allow(clippy::too_many_arguments)]
+fn bg_probe(
+    time: ProbeClock,
+    mut probe: ResMut<BgProbe>,
+    me: Query<&ObjectStore, With<SelfPlayer>>,
+    player: Res<Player>,
+    battlefield: Res<Battlefield>,
+    queue: Res<BattlefieldQueue>,
+    units: Query<(&Guid, &NetEntity, &ObjectStore, &Transform), Without<SelfPlayer>>,
+    net: Res<NetCommands>,
+    map: Option<Res<CurrentMap>>,
+    area: Option<Res<CurrentArea>>,
+    load: Option<Res<WorldLoadProgress>>,
+    states: Res<WorldStates>,
+    dropped: Res<DroppedOpcodes>,
+    go_templates: Res<crate::go_templates::GameObjectTemplates>,
+    mut idle: ResMut<crate::ui_chat::idle::LastInput>,
+    mut script: Option<NonSendMut<UiScript>>,
+) {
+    let Ok(store) = me.single() else {
+        return;
+    };
+    let arena = arena();
+    let now = time.elapsed_secs_f64();
+
+    // **This probe stands in for a player who is AT the keyboard.** benilla implements the
+    // reference's idle handler faithfully (`ui_chat::idle`: auto-sit then auto-AFK at 300 000 ms
+    // of no input), and vmangos removes an AFK player from a battleground outright
+    // (`Player::ToggleAFK` → `LeaveBattleground`). Two correct behaviours, one on each side, and
+    // together they eject an unattended probe five minutes in — which is exactly what the first
+    // long run hit: at t=300 s the census read Stormwind, not Warsong Gulch, and the chat said
+    // "You are now AFK". A battleground match cannot be watched to its end without this.
+    idle.stamp_present(std::time::Duration::from_secs_f64(now));
+
+    // **The tap goes in as soon as there is a VM to put it in, and not before.** The probe's own
+    // first frame is a world-entry frame: the in-game interface has not materialized yet, so an
+    // install at Setup gets `no VM` and every later `EVENTS` line reads `(none)` — which looks
+    // exactly like "the battleground fired no events" and is the most misleading answer this
+    // instrument could give. Retried every frame until it lands; one bool test once it has.
+    if !probe.tap_installed {
+        if let Some(script) = script.as_deref_mut() {
+            match script.eval::<()>(EVENT_TAP) {
+                Ok(()) => {
+                    probe.tap_installed = true;
+                    info!("PROBE bg: TAP installed");
+                }
+                Err(e) => {
+                    probe.tap_installed = true; // a raise will not fix itself; say so once
+                    probe.tap_broken = true; // …and every later EVENTS line says so too
+                    error!("PROBE bg: TAP FAILURE — {e}");
+                }
+            }
+        }
+    }
+
+    match probe.phase {
+        Phase::Wait => {
+            // **GM mode makes every objective in this probe fail silently, so refuse to start in
+            // it.** vmangos's `Player::CanUseBattleGroundObject` opens with
+            // `if (IsGameMaster()) return false;` (`Player.cpp:20576`), which means the flag click,
+            // the Arathi Basin banners and Alterac Valley's towers are all rejected server-side
+            // with no reply — while the queue, the port, the census, the world states and the
+            // scoreboard all keep working perfectly. That is the worst possible failure shape: a
+            // run that looks 90% right and is wrong exactly where the objectives are.
+            //
+            // MEASURED, by getting it wrong: a run without `WOW_GM=off` reached the Warsong Flag at
+            // 1.8 yd, sent `CMSG_GAMEOBJ_USE`, and reported `ws2339=1` with no banner aura and no
+            // `CHAT_MSG_BG_SYSTEM_ALLIANCE` — indistinguishable, from the probe's own lines, from a
+            // client that cannot pick up flags. `probe_shield` drops GM mode when `WOW_GM=off` is
+            // set (0679), so this WAITS for the flag to clear rather than refusing outright: the
+            // shield arms and drops GM a few hundred ms into the world, after this arm first runs.
+            if store.0.player_flags() & PLAYER_FLAGS_GM != 0 {
+                let since = *probe.waiting_since.get_or_insert(now);
+                if now - since < GM_DROP_WAIT {
+                    return;
+                }
+                error!(
+                    "PROBE bg: FAILURE — GM mode is still on after {GM_DROP_WAIT:.0}s. A \
+                     battleground is the one place it cannot be left on: \
+                     `CanUseBattleGroundObject` refuses a GM outright (vmangos \
+                     `Player.cpp:20576`), so every objective fails silently while the queue, the \
+                     port, the census and the scoreboard all keep working. Re-run with \
+                     `WOW_GM=off` — and if it WAS set, look for `probe-shield:` lines: the drop \
+                     is sequenced behind the shield and a refused command shows up there."
+                );
+                finish(&mut probe, &net);
+                return;
+            }
+            // Revive first, unconditionally: `CanInteractWithNPC` refuses a dead player outright,
+            // and the refusal surfaces as an anticheat line about an "invalid creature" — which
+            // reads like a wrong guid, not like a corpse (`probe_bg_queue`'s note).
+            gm(&net, ".revive");
+            // **Wait for the real level rather than assuming one.** `unit_level()` is `None` until
+            // `UNIT_FIELD_LEVEL` is in the store, and this arm fires on the first frame the
+            // `SelfPlayer` entity is queryable. Reading a missing field as `0` sends
+            // `.levelup 60` to a body that may already be 60 — which makes it **120**, above every
+            // bracket ceiling (`battleground_template.max_lvl = 60`), and the run then dies at
+            // `Greeted` blaming a level *under* the floor. A missing reading is not a zero.
+            let Some(level) = store.0.unit_level() else {
+                return;
+            };
+            if level < QUEUE_LEVEL {
+                gm(&net, format!(".levelup {}", QUEUE_LEVEL - level));
+            }
+            // **Deserter first.** Leaving a battleground any way but "the match ended" earns
+            // spell **26013** (vmangos `Player.cpp:2178/18816`, `Battleground.CastDeserter`
+            // defaults true), and `HandleBattlemasterJoinOpcode` then refuses the join outright
+            // (`BG_GROUPJOIN_DESERTERS`) — so the *second* run of this probe never queues at all,
+            // and reads as "the queue is broken" rather than "the last run left a debuff". Found
+            // the hard way; cleared unconditionally, because a body without it does not care.
+            gm(&net, ".unaura 26013");
+            let [x, y, z] = arena.at;
+            info!(
+                "PROBE bg: SETUP arena={} map={} level>={QUEUE_LEVEL} master={}({})",
+                arena.key, arena.map, arena.npc_name, arena.npc_entry,
+            );
+            gm(&net, format!(".go xyz {x} {y} {z} 0"));
+            probe.phase = Phase::Hopped { sent_at: now };
+        }
+        Phase::Hopped { sent_at } => {
+            if now - sent_at < 3.0 {
+                return; // post-teleport settle: let the battlemasters stream in
+            }
+            // **The lever goes here, not in Setup, and its reply is read before anything queues.**
+            // `.debug bg` is a TOGGLE (`BattleGroundMgr::ToggleTesting`), so a blind send is not
+            // idempotent and a run that died before its own undo flips the next one the wrong way.
+            // Correcting it *after* joining does not work either, and that is the part worth
+            // writing down: vmangos evaluates a queue only when something SCHEDULES an update
+            // (`BattleGroundMgr::Update` drains `m_queueUpdateScheduler`, which a join or a leave
+            // fills — `BattleGroundMgr.cpp:1005-1028`). Flipping the flag under a queue entry that
+            // is already sitting there schedules nothing, so the entry waits forever. Hence: get
+            // the flag right first, then join once.
+            toggle_testing(&mut probe, &net);
+            probe.phase = Phase::Toggled {
+                sent_at: now,
+                corrected: false,
+            };
+        }
+        Phase::Toggled { sent_at, corrected } => {
+            // **Drain every frame and keep what comes back**, rather than taking one destructive
+            // look 1.5 s in. The reply is a world text that crosses the network, reaches the chat
+            // pipeline and then the tap; a single window wide enough to be reliable is wider than
+            // one worth waiting on every run, and a single window narrow enough to be quick misses
+            // the reply often enough to matter — a missed reply is how this probe misdiagnoses
+            // itself. Anything drained here that is *not* the reply is kept for the first census
+            // instead of being thrown on the floor.
+            if let Some(s) = script.as_deref_mut() {
+                let seen = drain_events(&mut probe, s);
+                // The LAST marker in the chunk wins, because both can appear in one drain when the
+                // correcting send's reply arrives alongside the first. `contains` cannot express
+                // that and was the reason a corrected run could read its own first reply again.
+                let on = seen.rfind("debugging");
+                let off = seen.rfind("normal playercount");
+                match (on, off) {
+                    (Some(a), Some(b)) => probe.testing_seen = Some(a > b),
+                    (Some(_), None) => probe.testing_seen = Some(true),
+                    (None, Some(_)) => probe.testing_seen = Some(false),
+                    (None, None) => {}
+                }
+                probe.pending_events.push_str(&seen);
+            }
+            match probe.testing_seen.take() {
+                Some(true) => {
+                    info!(
+                        "PROBE bg: TESTING on (1v0) — confirmed from the tap after {:.1}s",
+                        now - sent_at
+                    );
+                    probe.testing_confirmed = true;
+                    probe.phase = Phase::Scanning { since: now };
+                }
+                Some(false) if corrected => {
+                    error!(
+                        "PROBE bg: FAILURE — `.debug bg` reads OFF after two sends; the account \
+                         may be below SEC_ADMINISTRATOR (6) for it"
+                    );
+                    finish(&mut probe, &net);
+                }
+                Some(false) => {
+                    info!("PROBE bg: TESTING was on; that send turned it OFF — sending once more");
+                    toggle_testing(&mut probe, &net);
+                    probe.phase = Phase::Toggled {
+                        sent_at: now,
+                        corrected: true,
+                    };
+                }
+                None if now - sent_at > TOGGLE_REPLY_WINDOW => {
+                    // Unread is a THIRD outcome, and it is carried forward rather than rounded to
+                    // "on": the `Joined` failure text used to assert the flag "was confirmed ON
+                    // before the join" even on this path, sending the reader to look at Deserter
+                    // and brackets when the lever was the actual suspect.
+                    warn!(
+                        "PROBE bg: TESTING unread — no `.debug bg` reply reached the tap in \
+                         {TOGGLE_REPLY_WINDOW:.0}s; continuing, but if the queue never pops, this \
+                         is the first thing to doubt"
+                    );
+                    probe.phase = Phase::Scanning { since: now };
+                }
+                // Still inside the window: stay in `Toggled` and look again next frame.
+                None => {}
+            }
+        }
+        Phase::Scanning { since: sent_at } => {
+            let here = player.pos;
+            // By ENTRY, not by "the nearest battlemaster": all three stand in one alcove.
+            let master = units.iter().find(|(guid, kind, store, tf)| {
+                kind.kind == benilla_protocol::EntityKind::Unit
+                    && store.0.unit_npc_flags() & npc_flags::BATTLEMASTER != 0
+                    && benilla_protocol::guid::entry(guid.0) == Some(arena.npc_entry)
+                    && tf.translation.distance(here) < NEAR_YD
+            });
+            if let Some((guid, ..)) = master {
+                info!(
+                    "PROBE bg: GREETING {} ({:#x}) on the wire",
+                    arena.npc_name, guid.0
+                );
+                let _ = net.0.send(ClientCommand::BattlemasterHello { npc: guid.0 });
+                probe.phase = Phase::Greeted {
+                    master: guid.0,
+                    sent_at: now,
+                };
+            } else if now - sent_at > 15.0 {
+                error!(
+                    "PROBE bg: FAILURE — {} (entry {}) never streamed within {NEAR_YD:.0} yd in 15 s",
+                    arena.npc_name, arena.npc_entry
+                );
+                finish(&mut probe, &net);
+            }
+        }
+        Phase::Greeted { master, sent_at } => {
+            // Waiting for the LIST, not for a clock: its guid is the one the join must quote, and
+            // its arrival is the proof the level gate was cleared.
+            if battlefield.battlemaster() == Some(master) {
+                info!("PROBE bg: LISTED — queueing for map {}", arena.map);
+                let _ = net.0.send(ClientCommand::BattlemasterJoin {
+                    battlemaster: master,
+                    map_id: arena.map,
+                    instance_id: 0,
+                    as_group: false,
+                });
+                probe.phase = Phase::Joined { sent_at: now };
+            } else if now - sent_at > 8.0 {
+                error!(
+                    "PROBE bg: FAILURE — no SMSG_BATTLEFIELD_LIST 8 s after the hello \
+                     (a level under the bracket floor is refused here, silently)"
+                );
+                finish(&mut probe, &net);
+            }
+        }
+        Phase::Joined { sent_at } => {
+            // Status 2 is "your battleground is ready, confirm within the deadline". The probe
+            // takes it through the STOCK VERB, not through a hand-built packet: the whole point
+            // is that the reference's own dialog road works.
+            // **Matched on the MAP as well as the status**, because a slot is not ours just because
+            // it is ready. A killed run can leave this character queued for another battleground,
+            // and vmangos re-sends that `SMSG_BATTLEFIELD_STATUS` at login — so a status-2 slot for
+            // Arathi Basin would be taken here, port the body into map 529, and the `Ported` arm
+            // would then time out complaining that the map "is still 529, not 489". The cause would
+            // read as a broken worldport; it is a stale queue entry the probe confirmed on purpose.
+            let ready = queue.slots().iter().position(|s| {
+                s.as_ref()
+                    .is_some_and(|(st, _)| st.status == 2 && st.map_id == arena.map)
+            });
+            if let Some(index) = ready {
+                let slot = index + 1; // the verbs are 1-based
+                info!("PROBE bg: CONFIRM — slot {slot} is ready; AcceptBattlefieldPort({slot}, 1)");
+                if let Some(script) = script {
+                    if let Err(e) = script.eval::<()>(&format!("AcceptBattlefieldPort({slot}, 1)"))
+                    {
+                        error!("PROBE bg: FAILURE — AcceptBattlefieldPort raised: {e}");
+                        finish(&mut probe, &net);
+                        return;
+                    }
+                } else {
+                    error!("PROBE bg: FAILURE — no VM to take the port through");
+                    finish(&mut probe, &net);
+                    return;
+                }
+                probe.phase = Phase::Ported { sent_at: now };
+            } else if now - sent_at > 12.0 && probe.rejoins < MAX_REJOINS {
+                // **Leave the queue and join again.** vmangos evaluates a queue only when
+                // something SCHEDULES an update, and a queue entry that was scheduled once and
+                // did not match just sits there — no timer re-examines it
+                // (`BattleGroundMgr::Update` drains `m_queueUpdateScheduler` and nothing refills
+                // it on its own, `BattleGroundMgr.cpp:1005`). Whatever left the server's
+                // bookkeeping unable to match this entry, a fresh one gets a fresh evaluation.
+                // Both halves are real client verbs: `AcceptBattlefieldPort(slot, 0)` is the
+                // queue's own decline, which no other probe or test here has ever walked.
+                probe.rejoins += 1;
+                let slot = queue
+                    .slots()
+                    .iter()
+                    .position(|s| s.is_some())
+                    .map_or(1, |i| i + 1);
+                info!(
+                    "PROBE bg: REJOIN {} — nothing popped in 12 s; \
+                     AcceptBattlefieldPort({slot}, 0) then queueing again",
+                    probe.rejoins
+                );
+                if let Some(script) = script.as_deref_mut() {
+                    let _ = script.eval::<()>(&format!("AcceptBattlefieldPort({slot}, 0)"));
+                }
+                probe.phase = Phase::Rejoining { at: now };
+            } else if now - sent_at > 30.0 {
+                let slots: Vec<String> = queue
+                    .slots()
+                    .iter()
+                    .map(|s| {
+                        s.as_ref().map_or_else(
+                            || "-".into(),
+                            |(st, _)| format!("{}:{}", st.map_id, st.status),
+                        )
+                    })
+                    .collect();
+                error!(
+                    "PROBE bg: FAILURE — no slot reached status 2 in 30 s (slots: {}). {} \
+                     Also worth checking: Deserter (26013) on the body, a bracket the server \
+                     refused, or a battleground this body is still registered in from a killed run.",
+                    slots.join(" "),
+                    if probe.testing_confirmed {
+                        "The testing flag was READ BACK as on before the join, so the cause is \
+                         probably not that."
+                    } else {
+                        "The testing flag was NEVER READ BACK (no `.debug bg` reply reached the \
+                         tap), so it is the first suspect: a previous run that died before its \
+                         own restore leaves the lever inverted, and a queue entry is only ever \
+                         evaluated when a join or a leave schedules it."
+                    },
+                );
+                finish(&mut probe, &net);
+            }
+        }
+        Phase::Ported { sent_at } => {
+            let here = map.as_ref().map_or(0, |m| m.0);
+            if here == arena.map {
+                info!(
+                    "PROBE bg: ENTERED map {} after {:.1}s — census every {CENSUS_EVERY:.0}s × {}",
+                    arena.map,
+                    now - sent_at,
+                    census_samples(),
+                );
+                probe.phase = Phase::Inside {
+                    entered_at: now,
+                    next_census: now + CENSUS_EVERY,
+                    samples: 0,
+                };
+            } else if now - sent_at > 30.0 {
+                error!(
+                    "PROBE bg: FAILURE — 30 s after the port the map is still {here}, not {}",
+                    arena.map
+                );
+                finish(&mut probe, &net);
+            }
+        }
+        Phase::Inside {
+            entered_at,
+            next_census,
+            samples,
+        } => {
+            if now < next_census {
+                return;
+            }
+            let Some(mut script) = script else {
+                error!("PROBE bg: FAILURE — the VM went away inside the battleground");
+                finish(&mut probe, &net);
+                return;
+            };
+            // Drained HERE, not inside `census`, so the tap's self-heal can reach `probe` — and so
+            // everything the tap caught on the queue road is attributed to the window it actually
+            // happened in rather than being folded into the first census.
+            let mut events = std::mem::take(&mut probe.pending_events);
+            events.push_str(&drain_events(&mut probe, &mut script));
+            let tap_broken = probe.tap_broken;
+            census(
+                now - entered_at,
+                arena,
+                &player,
+                &units,
+                map.as_deref(),
+                area.as_deref(),
+                load.as_deref(),
+                &states,
+                &dropped,
+                &go_templates,
+                &queue,
+                &mut script,
+                &events,
+                tap_broken,
+            );
+            let samples = samples + 1;
+
+            // **Once inside, the lever has done its job — put it back immediately.**
+            //
+            // It was an equality test on `DOORS_SAMPLE` (11), and that was wrong twice over. Any
+            // `WOW_PROBE_BG_SAMPLES` below 11 — a documented, user-facing dial — skipped it
+            // entirely and left the realm-global flag flipped for the next run, which is the exact
+            // breakage 2290 §2 records as having cost runs 2, 4 and 5. And there was no reason to
+            // wait: the flag is needed only for `CheckNormalMatch` to *form* the match, which has
+            // already happened by the time we are standing in it. vmangos arms the premature
+            // countdown when the battleground reaches `STATUS_IN_PROGRESS` (the doors) and
+            // decrements it inside `else if (!sBattleGroundMgr.isTesting())` (`BattleGround.cpp:337`),
+            // so restoring it now simply lets that clock run from the doors rather than from
+            // sample 11 — twelve seconds *earlier* to an ending, not later.
+            if samples == 1 {
+                info!(
+                    "PROBE bg: TESTING — inside the instance; the lever has done its job and the \
+                     premature-finish countdown is frozen while it is on"
+                );
+                leave_testing_as_found(&mut probe, &net);
+            }
+
+            if samples >= census_samples() {
+                // **The graveyard leg.** `.die` is the one thing that clears the probe's god
+                // shield by design (0677), so a probe CAN die on purpose; a battleground death is
+                // also the only place the area-spirit-healer arc (2291) is reachable at all, and
+                // a mechanism that has never been watched fire is not a mechanism anyone should
+                // claim. Non-combat: nothing kills us, we ask to be dead.
+                match arena.flag {
+                    Some((entry, [x, y, z])) => {
+                        info!("PROBE bg: FLAG — hopping to {entry} at ({x}, {y}, {z}) to take it");
+                        gm(&net, format!(".go xyz {x} {y} {z} {}", arena.map));
+                        probe.phase = Phase::FlagHop { at: now };
+                    }
+                    None => {
+                        info!("PROBE bg: FLAG — none for this battleground; on to the graveyard");
+                        gm(&net, ".die");
+                        probe.phase = Phase::Dying { sent_at: now };
+                    }
+                }
+            } else {
+                probe.phase = Phase::Inside {
+                    entered_at,
+                    next_census: now + CENSUS_EVERY,
+                    samples,
+                };
+            }
+        }
+        Phase::Rejoining { at } => {
+            if now - at < 2.0 {
+                return; // let the decline land and the slot clear
+            }
+            let Some(master) = battlefield.battlemaster() else {
+                error!("PROBE bg: FAILURE — the battlemaster list went away before the rejoin");
+                finish(&mut probe, &net);
+                return;
+            };
+            let _ = net.0.send(ClientCommand::BattlemasterJoin {
+                battlemaster: master,
+                map_id: arena.map,
+                instance_id: 0,
+                as_group: false,
+            });
+            probe.phase = Phase::Joined { sent_at: now };
+        }
+        Phase::FlagHop { at } => {
+            if now - at < 4.0 {
+                return; // the hop crosses the map; let the far base stream in
+            }
+            let Some((entry, _)) = arena.flag else {
+                finish(&mut probe, &net);
+                return;
+            };
+            let found = units.iter().find(|(guid, kind, _, tf)| {
+                kind.kind == benilla_protocol::EntityKind::GameObject
+                    && benilla_protocol::guid::entry(guid.0) == Some(entry)
+                    && tf.translation.distance(player.pos) < 15.0
+            });
+            match found {
+                Some((guid, _, _, tf)) => {
+                    // What the click's own GameObject ladder would decide, reported rather than
+                    // assumed: a FLAGSTAND carries no lock, so `resolve_go_action` takes its
+                    // `Use` arm and the packet is `CMSG_GAMEOBJ_USE` — the one sent here.
+                    let lock = go_templates.get(guid.0).map_or(u32::MAX, |t| t.lock_id);
+                    info!(
+                        "PROBE bg: FLAG {entry} streamed at {:.1} yd, lock_id={lock} — CMSG_GAMEOBJ_USE",
+                        tf.translation.distance(player.pos)
+                    );
+                    let _ = net.0.send(ClientCommand::GameObjUse { guid: guid.0 });
+                    probe.phase = Phase::FlagUsed {
+                        at: now,
+                        samples: 0,
+                    };
+                }
+                None if now - at > 20.0 => {
+                    error!("PROBE bg: FLAG FAILURE — {entry} never streamed within 15 yd in 20 s");
+                    gm(&net, ".die");
+                    probe.phase = Phase::Dying { sent_at: now };
+                }
+                None => {}
+            }
+        }
+        Phase::FlagUsed { at, samples } => {
+            if now - at < f64::from(samples + 1) * 3.0 {
+                return;
+            }
+            let Some(mut script) = script else {
+                error!("PROBE bg: FAILURE — the VM went away during the flag leg");
+                finish(&mut probe, &net);
+                return;
+            };
+            // **The two readings that say the flag is on the body.** World state 2339 is the
+            // ALLIANCE readout row's icon selector, and it is only ever 1 or 2 — 2 meaning the
+            // flag that row is about is being carried (vmangos `BattleGroundWS.cpp:512` and
+            // `FillInitialWorldStates` 713-722). It is **not** the four-value `m_flagState` enum,
+            // which never reaches the client at all; that distinction is why a census reading
+            // `2338=1 2339=1` for a whole match is correct rather than a stuck value. The aura is
+            // the other half: what the reference actually draws on the body.
+            let auras = script
+                .eval::<String>(
+                    r#"
+                    local out = "";
+                    for i = 1, 16 do
+                        local t = UnitBuff("player", i);
+                        if t then out = out .. " " .. t; end
+                    end
+                    return out;
+                    "#,
+                )
+                .unwrap_or_else(|e| format!("<raised: {e}>"));
+            let events = drain_events(&mut probe, &mut script);
+            info!(
+                "PROBE bg: FLAG t={:.0}s ws2338={} ws2339={} captures={}/{} buffs=[{}]{}",
+                now - at,
+                ws(&states, 2338),
+                ws(&states, 2339),
+                ws(&states, 1581),
+                ws(&states, 1582),
+                auras.trim(),
+                if events.trim().is_empty() {
+                    String::new()
+                } else {
+                    format!(" events={events}")
+                },
+            );
+            let samples = samples + 1;
+            if samples >= FLAG_SAMPLES {
+                info!("PROBE bg: FLAG done — on to the graveyard");
+                gm(&net, ".die");
+                probe.phase = Phase::Dying { sent_at: now };
+            } else {
+                probe.phase = Phase::FlagUsed { at, samples };
+            }
+        }
+        Phase::Dying { sent_at } => {
+            if store.0.unit_is_dead() {
+                info!("PROBE bg: DEAD — releasing (CMSG_REPOP_REQUEST)");
+                let _ = net.0.send(ClientCommand::RepopRequest);
+                probe.phase = Phase::Ghost {
+                    released_at: now,
+                    next_sample: now + GHOST_SAMPLE_EVERY,
+                    samples: 0,
+                };
+            } else if now - sent_at > 15.0 {
+                error!(
+                    "PROBE bg: FAILURE — still alive 15 s after `.die` (is the shield re-armed?)"
+                );
+                finish(&mut probe, &net);
+            }
+        }
+        Phase::Ghost {
+            released_at,
+            next_sample,
+            samples,
+        } => {
+            if now < next_sample {
+                return;
+            }
+            let Some(mut script) = script else {
+                finish(&mut probe, &net);
+                return;
+            };
+            // The whole point of this leg, in four readings: are we a ghost, is a spirit guide in
+            // range, did the engine adopt it (`GetAreaSpiritHealerTime` is non-zero only once
+            // `SMSG_AREA_SPIRIT_HEALER_TIME` answered the query the adopt sent), and did the
+            // stock dialog's event fire.
+            let ghost = store.0.player_is_ghost();
+            let nearest = units
+                .iter()
+                .filter(|(_, k, st, _)| {
+                    k.kind == benilla_protocol::EntityKind::Unit
+                        && st.0.unit_npc_flags() & NPC_FLAG_SPIRITGUIDE != 0
+                })
+                .map(|(g, _, _, tf)| (g.0, tf.translation.distance(player.pos)))
+                .min_by(|a, b| a.1.total_cmp(&b.1));
+            let wave = script
+                .eval::<String>(
+                    "return tostring(GetAreaSpiritHealerTime()) .. \" popup=\" .. \
+                     tostring(StaticPopup_Visible and StaticPopup_Visible(\"AREA_SPIRIT_HEAL\"))",
+                )
+                .unwrap_or_else(|e| format!("<raised: {e}>"));
+            let events = drain_events(&mut probe, &mut script);
+            info!(
+                "PROBE bg: GHOST t={:.0}s ghost={ghost} pos=({:.0},{:.0},{:.0}) area={:?} guide={} wave={wave}{}",
+                now - released_at,
+                player.pos.x,
+                player.pos.y,
+                player.pos.z,
+                area.as_deref().and_then(|a| a.0),
+                nearest.map_or_else(|| "none".to_string(), |(g, d)| format!("{g:#x}@{d:.1}yd")),
+                if events.trim().is_empty() {
+                    String::new()
+                } else {
+                    format!(" events={events}")
+                },
+            );
+            let samples = samples + 1;
+            if samples >= GHOST_SAMPLES {
+                // Take the wave if one is offered — the verb that was permanently silent before
+                // 2291, and the only way back to the world from a battleground graveyard.
+                match script.eval::<()>("AcceptAreaSpiritHeal()") {
+                    Ok(()) => info!("PROBE bg: GHOST AcceptAreaSpiritHeal() sent"),
+                    Err(e) => error!("PROBE bg: GHOST AcceptAreaSpiritHeal() raised: {e}"),
+                }
+                report(arena, &net, &queue, &mut script);
+                finish(&mut probe, &net);
+            } else {
+                probe.phase = Phase::Ghost {
+                    released_at,
+                    next_sample: now + GHOST_SAMPLE_EVERY,
+                    samples,
+                };
+            }
+        }
+        Phase::Done => {}
+    }
+}
+
+/// **Reaching `Done` ends the process.** This probe was the one live probe here without it
+/// (`probe_auction`'s tail and `ProbeExitPlugin::fire_probe_exit` are the established shape), so
+/// the client simply idled at `Done` until whatever external `timeout` wrapped the run killed it:
+/// a four-minute Warsong Gulch census cost a fifteen-minute wall clock, and a sequence of runs
+/// spent most of its time watching a finished probe stand still.
+///
+/// It is its own system rather than an arm of [`bg_probe`] only because that system is already at
+/// Bevy's parameter ceiling — there is nothing conditional about the split.
+///
+/// **It waits for the leave to land before it goes**, and that wait is the whole reason this is not
+/// a one-liner. [`report`] ends by teleporting the body out to map 0, and `AppExit` stops the
+/// Update schedule — so exiting on the next frame can cut the connection before the worldport
+/// completes and strand the body **inside a live battleground**, which is precisely the poisoned
+/// state this probe warns the next run about. So: leave first, confirmed by the map actually
+/// changing, then exit; with [`LEAVE_GRACE`] as the backstop for a leave that never lands, because
+/// hanging forever would be worse than logging out somewhere awkward.
+///
+/// The polite `AppExit` plus a hard backstop on its own OS thread is the pattern, not belt and
+/// braces: `AppExit` stops the Update schedule, so an in-schedule backstop could never fire, and a
+/// net/winit teardown hang would otherwise leave a zombie client holding the probe account.
+fn bg_probe_exit(
+    time: ProbeClock,
+    mut probe: ResMut<BgProbe>,
+    map: Option<Res<CurrentMap>>,
+    mut exit: MessageWriter<AppExit>,
+) {
+    if probe.phase != Phase::Done || probe.exited {
+        return;
+    }
+    let now = time.elapsed_secs_f64();
+    let since = *probe.done_at.get_or_insert(now);
+    let left = map.as_ref().is_none_or(|m| m.0 != arena().map);
+    if !left && now - since < LEAVE_GRACE {
+        return;
+    }
+    if !left {
+        warn!(
+            "PROBE bg: still on map {} {LEAVE_GRACE:.0}s after the leave — exiting anyway, but \
+             this body may still be registered in the battleground",
+            arena().map
+        );
+    }
+    probe.exited = true;
+    info!("PROBE bg: exiting");
+    exit.write(AppExit::Success);
+    std::thread::spawn(|| {
+        std::thread::sleep(std::time::Duration::from_secs(5));
+        warn!("PROBE bg: still alive 5s after AppExit — hard exit");
+        std::process::exit(0);
+    });
+}
+
+/// One census sample — eleven greppable `PROBE bg:` lines describing everything the client can see
+/// from inside the battleground. Deliberately verbose: this is the first look anyone has had, and
+/// a column nobody needed is cheaper than a round trip for one that was left out.
+#[allow(clippy::too_many_arguments)]
+fn census(
+    t: f64,
+    arena: &Arena,
+    player: &Player,
+    units: &Query<(&Guid, &NetEntity, &ObjectStore, &Transform), Without<SelfPlayer>>,
+    map: Option<&CurrentMap>,
+    area: Option<&CurrentArea>,
+    load: Option<&WorldLoadProgress>,
+    states: &WorldStates,
+    dropped: &DroppedOpcodes,
+    go_templates: &crate::go_templates::GameObjectTemplates,
+    queue: &BattlefieldQueue,
+    script: &mut UiScript,
+    events: &str,
+    tap_broken: bool,
+) {
+    use benilla_protocol::EntityKind as K;
+
+    let p = player.pos;
+    let terrain = load.map_or_else(
+        || "no-progress".to_string(),
+        |l| {
+            format!(
+                "{}/{} focus={} scene={} colliders={}",
+                l.ready, l.total, l.focus_resident, l.scene_ready, l.colliders_pending
+            )
+        },
+    );
+    info!(
+        // `map=none` rather than `map=0`: 0 is Eastern Kingdoms, a real answer, and printing it
+        // for "there is no `CurrentMap` resource" is the same missing-reads-as-a-value mistake
+        // the world-state column had.
+        "PROBE bg: CENSUS t={t:.0}s map={} area={:?} pos=({:.0},{:.0},{:.0}) terrain={terrain}",
+        map.map_or_else(|| "none".to_string(), |m| m.0.to_string()),
+        area.and_then(|a| a.0),
+        p.x,
+        p.y,
+        p.z,
+    );
+
+    // Entities, by kind — "is there a world here at all?"
+    let (mut u, mut pl, mut go, mut dy, mut co) = (0, 0, 0, 0, 0);
+    let mut go_entries: Vec<(u32, Option<String>)> = Vec::new();
+    let mut nearest_guide: Option<(u64, f32)> = None;
+    for (guid, kind, store, tf) in units.iter() {
+        match kind.kind {
+            K::Unit => {
+                u += 1;
+                if store.0.unit_npc_flags() & NPC_FLAG_SPIRITGUIDE != 0 {
+                    let d = tf.translation.distance(p);
+                    if nearest_guide.is_none_or(|(_, best)| d < best) {
+                        nearest_guide = Some((guid.0, d));
+                    }
+                }
+            }
+            K::Player => pl += 1,
+            K::GameObject => {
+                go += 1;
+                if let Some(e) = benilla_protocol::guid::entry(guid.0) {
+                    // The NAME, not just the entry: "179918" is a number to look up in a database
+                    // and `Doodad_PortcullisActive01` is the battleground's gate. The cache is the
+                    // ask-once `GAMEOBJECT_QUERY` store (0239) the client already fills for every
+                    // GO that streams in, so this costs nothing and answers for free.
+                    go_entries.push((e, go_templates.get(guid.0).map(|t| t.name.clone())));
+                }
+            }
+            K::DynamicObject => dy += 1,
+            K::Corpse => co += 1,
+            K::Other => {}
+        }
+    }
+    go_entries.sort_unstable();
+    let mut counted: Vec<String> = Vec::new();
+    let mut i = 0;
+    while i < go_entries.len() {
+        let (e, ref name) = go_entries[i];
+        let n = go_entries[i..].iter().take_while(|(x, _)| *x == e).count();
+        let label = name
+            .as_deref()
+            .map_or_else(|| e.to_string(), |n| format!("{e}:{n}"));
+        counted.push(if n > 1 {
+            format!("{label}×{n}")
+        } else {
+            label
+        });
+        i += n;
+    }
+    info!("PROBE bg: ENTS units={u} players={pl} gos={go} dyn={dy} corpses={co}");
+    info!(
+        "PROBE bg: GOS [{}]",
+        if counted.is_empty() {
+            "none".to_string()
+        } else {
+            counted.join(" ")
+        }
+    );
+    info!(
+        "PROBE bg: GUIDE {}",
+        nearest_guide.map_or_else(
+            || "none in range".to_string(),
+            |(g, d)| format!("{g:#x} at {d:.1} yd")
+        )
+    );
+
+    // The world-state table — the battleground's whole score, as raw dwords.
+    let mut pairs: Vec<(u32, i32)> = states.pairs().collect();
+    pairs.sort_unstable_by_key(|(k, _)| *k);
+    info!(
+        "PROBE bg: STATES scope={:?} n={} [{}]",
+        states.scope(),
+        pairs.len(),
+        pairs
+            .iter()
+            .map(|(k, v)| format!("{k}={v}"))
+            .collect::<Vec<_>>()
+            .join(" ")
+    );
+
+    // What the reference's own readout would draw, straight out of the VM.
+    let alwaysup = script
+        .eval::<String>(
+            r#"
+            local n = GetNumWorldStateUI()
+            local out = tostring(n)
+            for i = 1, n do
+                local ui, state, hidden, text, icon = GetWorldStateUIInfo(i)
+                out = out .. " | " .. tostring(state) .. " '" .. tostring(text) .. "' icon=" .. tostring(icon)
+            end
+            return out
+            "#,
+        )
+        .unwrap_or_else(|e| format!("<raised: {e}>"));
+    info!("PROBE bg: ALWAYSUP {alwaysup}");
+
+    let status = script
+        .eval::<String>(
+            r#"
+            local out = ""
+            for i = 1, 3 do
+                local s, name, id, lo, hi = GetBattlefieldStatus(i)
+                out = out .. i .. "=" .. tostring(s) .. "/" .. tostring(name) .. "/" .. tostring(id) .. " "
+            end
+            return out .. "runtime=" .. tostring(GetBattlefieldInstanceRunTime())
+            "#,
+        )
+        .unwrap_or_else(|e| format!("<raised: {e}>"));
+    info!(
+        "PROBE bg: STATUS {status} active_map={:?}",
+        queue.active_map()
+    );
+
+    let score = script
+        .eval::<String>(
+            r#"
+            RequestBattlefieldScoreData()
+            return tostring(GetNumBattlefieldScores()) .. " winner=" .. tostring(GetBattlefieldWinner())
+            "#,
+        )
+        .unwrap_or_else(|e| format!("<raised: {e}>"));
+    info!("PROBE bg: SCORE n={score}");
+
+    // **The wire-coverage tally** — every opcode the codec threw on the floor, by name. This is
+    // the column the first run did not have and most needed: a battleground that sends something
+    // benilla has no arm for is invisible in every other reading here, and reads as "nothing
+    // happened" rather than as a gap. `DroppedOpcodes` is never cleared, so the numbers are
+    // cumulative over the whole session — a row that grows between samples is the finding.
+    let mut drops: Vec<(u16, u64, u64)> = dropped
+        .0
+        .iter()
+        .map(|(&op, t)| (op, t.unknown, t.unparseable))
+        .collect();
+    drops.sort_unstable_by_key(|(op, _, _)| *op);
+    info!(
+        "PROBE bg: DROPPED [{}]",
+        if drops.is_empty() {
+            "none".to_string()
+        } else {
+            drops
+                .iter()
+                .map(|(op, unk, bad)| {
+                    let name = benilla_protocol::messages::opcode_name(*op)
+                        .map_or_else(|| format!("{op:#06x}"), str::to_string);
+                    format!("{name}:unknown={unk},unparseable={bad}")
+                })
+                .collect::<Vec<_>>()
+                .join(" ")
+        }
+    );
+
+    // The event tap's window (see `EVENT_TAP`): what the VM was actually told since the last
+    // sample. An empty window while the server is running the start countdown is a finding —
+    // **provided the tap is alive**, which is why a broken tap says so instead of printing
+    // `(none)`. "The battleground fired nothing" and "nobody was listening" are opposite
+    // conclusions and used to produce identical lines.
+    info!(
+        "PROBE bg: EVENTS{}",
+        if tap_broken {
+            "  <tap broken — see TAP FAILURE above; this is NOT 'no events'>".to_string()
+        } else if events.trim().is_empty() {
+            "  (none)".to_string()
+        } else {
+            events.to_string()
+        }
+    );
+
+    // **No `LUA` column, deliberately.** It used to print `LUA clean` off `take_errors()`, which
+    // reads as "the interface raised nothing inside a battleground for the last 12 s". It cannot
+    // mean that: `take_errors` is a DRAIN, and two systems already drain it every frame
+    // (`ui_script::input` and `ui_script::extract::extract`), so this call could only ever see
+    // whatever our own `eval`s in this same frame had just raised. A column that reports a 12 s
+    // window while measuring a fraction of one frame is worse than no column, because it reads as
+    // evidence. Engine-side Lua raises appear as `WARN ui_script:` lines — grep for those.
+    let _ = (arena, script);
+}
+
+/// The run's last act: drive the two battleground windows the census cannot reach by watching
+/// (they are opened by a keybind, never by an event), then put the server's testing toggle back
+/// and leave the battleground the way a player does.
+fn report(arena: &Arena, net: &NetCommands, queue: &BattlefieldQueue, script: &mut UiScript) {
+    // The scoreboard and the battlefield minimap: both are LoadOnDemand-shaped roads nothing in
+    // this tree has ever walked. A raise here is the finding.
+    // **Read both windows BEFORE toggling them.** The scoreboard shows itself when a match ends —
+    // `WorldStateScoreFrame_Update` does `if (GetBattlefieldWinner()) then ShowUIPanel(...)`,
+    // driven by `UPDATE_BATTLEFIELD_SCORE` — so after a real ending the toggle below *hides* it,
+    // and reading only the post-toggle state reports `IsShown=nil` for the run where the feature
+    // worked. That is the wrong way round, and it cost a round of inference to notice.
+    //
+    // Through `getglobal`, because `BattlefieldMinimap` is LoadOnDemand: indexing it before the
+    // toggle that loads it is a nil-index raise, and "not loaded yet" is a reading, not an error.
+    // **Does the battle map have anything to draw?** `IsShown()` alone cannot say: the stock
+    // `BattlefieldMinimap_Update` bails on its fourth line when `GetMapInfo()` is nil, so a window
+    // that is up and completely empty reports exactly the same `IsShown=1` as one full of terrain.
+    // These four readings are the difference, and they are the ones the minimap round never took.
+    let mapinfo = script
+        .eval::<String>(
+            r#"
+            local f, sx, sy, ox, oy = GetMapInfo();
+            return "file=" .. tostring(f)
+                .. " continent=" .. tostring(GetCurrentMapContinent())
+                .. " zone=" .. tostring(GetCurrentMapZone())
+                .. " overlays=" .. tostring(GetNumMapOverlays())
+                .. " landmarks=" .. tostring(GetNumMapLandmarks());
+            "#,
+        )
+        .unwrap_or_else(|e| format!("<raised: {e}>"));
+    info!("PROBE bg: MAPINFO {mapinfo}");
+
+    for name in ["WorldStateScoreFrame", "BattlefieldMinimap"] {
+        let shown = script
+            .eval::<String>(&format!(
+                "local f = getglobal(\"{name}\")                  if not f then return \"not-loaded\" end return tostring(f:IsShown())"
+            ))
+            .unwrap_or_else(|e| format!("<raised: {e}>"));
+        info!("PROBE bg: BEFORE-TOGGLE {name}:IsShown={shown}");
+    }
+    for (what, chunk) in [
+        ("SCOREFRAME", "ToggleWorldStateScoreFrame()"),
+        ("BFMINIMAP", "ToggleBattlefieldMinimap()"),
+    ] {
+        match script.eval::<()>(chunk) {
+            Ok(()) => {
+                let shown = script
+                    .eval::<String>(&format!(
+                        "return tostring({}:IsShown())",
+                        if what == "SCOREFRAME" {
+                            "WorldStateScoreFrame"
+                        } else {
+                            "BattlefieldMinimap"
+                        }
+                    ))
+                    .unwrap_or_else(|e| format!("<raised: {e}>"));
+                info!("PROBE bg: {what} {chunk} ok, IsShown={shown}");
+            }
+            Err(e) => error!("PROBE bg: {what} FAILURE — {chunk} raised: {e}"),
+        }
+    }
+    for e in script.take_errors() {
+        error!("PROBE bg: LUA ERROR {e}");
+    }
+
+    // `LeaveBattlefield` is gated client-side on the scoreboard's "ended" byte (1972), so while a
+    // match is live the verb is correctly silent — which means the honest way out is the same one
+    // a player uses when they give up on a battleground: the GM teleport home. The queue slot the
+    // server still holds is cleared by the leave it sends on the map change.
+    info!(
+        "PROBE bg: LEAVING map {} (active_map={:?})",
+        arena.map,
+        queue.active_map()
+    );
+    let _ = script.eval::<()>("LeaveBattlefield()");
+    // **NOT `.recall`.** vmangos saves the recall point on *every* `.go`
+    // (`HandleGoHelper` → `SaveRecallPosition()`, `TeleportCommands.cpp:755`), so the flag leg's
+    // `.go xyz … 489` overwrote it with a position **inside the battleground**. `.recall` then
+    // resolves to the same map and `Player::TeleportTo` takes its near-teleport arm — the probe
+    // printed `LEAVING map 489` and went nowhere, leaving the body logged out inside a live
+    // instance and the queue slot uncleared. That is the poisoned state the `Joined` failure text
+    // warns the *next* run about, manufactured by this one. An explicit hop to the battlemaster
+    // alcove on map 0 is a real map change, which is what clears the slot.
+    let [x, y, z] = arena.at;
+    gm(net, format!(".go xyz {x} {y} {z} 0"));
+    info!("PROBE bg: DONE");
+}
diff --git a/crates/benilla-app/src/capture/probe_bg_queue.rs b/crates/benilla-app/src/capture/probe_bg_queue.rs
index b1da1fdd..88633915 100644
--- a/crates/benilla-app/src/capture/probe_bg_queue.rs
+++ b/crates/benilla-app/src/capture/probe_bg_queue.rs
@@ -95,7 +95,6 @@ enum Phase {
 }
 
 // One Bevy system's full input set (the guard-poi probe's shape).
-#[allow(clippy::too_many_arguments)]
 fn bg_queue_probe(
     time: ProbeClock,
     mut probe: ResMut<BgQueueProbe>,
diff --git a/crates/benilla-app/src/capture/probe_binder.rs b/crates/benilla-app/src/capture/probe_binder.rs
index d19b7de1..4d0af702 100644
--- a/crates/benilla-app/src/capture/probe_binder.rs
+++ b/crates/benilla-app/src/capture/probe_binder.rs
@@ -267,7 +267,6 @@ fn vm_bind_location(script: &UiScript) -> String {
         .unwrap_or_default()
 }
 
-#[allow(clippy::too_many_arguments)]
 fn binder_probe(
     time: ProbeClock,
     mut probe: ResMut<BinderProbe>,
diff --git a/crates/benilla-app/src/capture/probe_book.rs b/crates/benilla-app/src/capture/probe_book.rs
index c216d8a0..3100747d 100644
--- a/crates/benilla-app/src/capture/probe_book.rs
+++ b/crates/benilla-app/src/capture/probe_book.rs
@@ -234,7 +234,6 @@ fn report(label: &str, s: &[Sample]) {
     );
 }
 
-#[allow(clippy::too_many_arguments)]
 fn book_probe(
     time: ProbeClock,
     mut probe: ResMut<BookProbe>,
diff --git a/crates/benilla-app/src/capture/probe_cam.rs b/crates/benilla-app/src/capture/probe_cam.rs
index b9db33e2..350f9fd8 100644
--- a/crates/benilla-app/src/capture/probe_cam.rs
+++ b/crates/benilla-app/src/capture/probe_cam.rs
@@ -141,7 +141,7 @@ impl Plugin for ProbeCamPlugin {
             drive_probe_cam
                 .in_set(WorldStage::Input)
                 .before(crate::player::PlayerControlSet)
-                .run_if(in_state(crate::char_select::ClientState::InWorld)),
+                .in_set(crate::char_select::InWorldGated),
         );
     }
 }
diff --git a/crates/benilla-app/src/capture/probe_charter.rs b/crates/benilla-app/src/capture/probe_charter.rs
index 73c5520b..5fce6ffa 100644
--- a/crates/benilla-app/src/capture/probe_charter.rs
+++ b/crates/benilla-app/src/capture/probe_charter.rs
@@ -453,13 +453,12 @@ fn probe_guild_name(prefix: &str) -> String {
     format!("{prefix} {secs:08}")
 }
 
-#[allow(clippy::too_many_arguments)]
 fn charter_probe(
     time: ProbeClock,
     mut probe: ResMut<CharterProbe>,
     gossip: Res<GossipState>,
     registrar: Res<GuildRegistrarState>,
-    mut items: ResMut<Items>,
+    items: Res<Items>,
     script: Option<NonSendMut<UiScript>>,
     self_q: Query<&ObjectStore, With<SelfPlayer>>,
     player: Res<Player>,
diff --git a/crates/benilla-app/src/capture/probe_chest.rs b/crates/benilla-app/src/capture/probe_chest.rs
index 18012eff..275a1d2e 100644
--- a/crates/benilla-app/src/capture/probe_chest.rs
+++ b/crates/benilla-app/src/capture/probe_chest.rs
@@ -211,7 +211,6 @@ fn report(label: &str, expect: u16, seen: &[Option<u16>]) -> u32 {
     }
 }
 
-#[allow(clippy::too_many_arguments)]
 fn chest_probe(
     time: ProbeClock,
     mut probe: ResMut<ChestProbe>,
diff --git a/crates/benilla-app/src/capture/probe_clam.rs b/crates/benilla-app/src/capture/probe_clam.rs
index bf7af8df..fc31c1ff 100644
--- a/crates/benilla-app/src/capture/probe_clam.rs
+++ b/crates/benilla-app/src/capture/probe_clam.rs
@@ -184,7 +184,7 @@ fn window_open(script: &UiScript, loot: &LootState) -> bool {
 fn find_in_backpack(
     store: &ObjectStore,
     entry: u32,
-    items: &mut Items,
+    items: &Items,
     net: &NetCommands,
 ) -> Option<(u64, u32)> {
     let (i, guid) = (0..16u8)
@@ -204,13 +204,12 @@ fn find_in_backpack(
         .map(|_| (guid, u32::from(i) + 1))
 }
 
-#[allow(clippy::too_many_arguments)]
 fn clam_probe(
     time: ProbeClock,
     mut probe: ResMut<ClamProbe>,
     script: Option<NonSendMut<UiScript>>,
     self_store: Query<&ObjectStore, With<SelfPlayer>>,
-    mut items: ResMut<Items>,
+    items: Res<Items>,
     mut cfg: ResMut<LootConfig>,
     loot: Res<LootState>,
     latch: Res<LootLatch>,
@@ -241,7 +240,7 @@ fn clam_probe(
             probe.phase = Phase::Stocking { sent_at: now };
         }
         Phase::Stocking { sent_at } => {
-            if let Some((guid, slot)) = find_in_backpack(store, entry, &mut items, &net) {
+            if let Some((guid, slot)) = find_in_backpack(store, entry, &items, &net) {
                 info!(
                     "PROBE_CLAM: item {entry} is guid {guid:#x} in backpack slot {slot} — \
                      sampling {CONTROL_FRAMES} control frames with it UNCLICKED"
diff --git a/crates/benilla-app/src/capture/probe_env.rs b/crates/benilla-app/src/capture/probe_env.rs
new file mode 100644
index 00000000..cf37ede9
--- /dev/null
+++ b/crates/benilla-app/src/capture/probe_env.rs
@@ -0,0 +1,567 @@
+//! The probe fleet's **environment registry** — every `WOW_PROBE*` variable the app reads, in one
+//! table the code is checked against in both directions (decision 2265 §A5).
+//!
+//! The set used to live in three places that could not see each other: the read sites (one per
+//! variable, spread over the fleet), a hand-kept arming list in `dev.rs` for the un-occludable
+//! window ([`super::ProbeFocusPlugin`], decision 0906), and nothing at all that said what the
+//! fleet accepts. The arming list is the one that bit: 0906's rule is that *every* scripted
+//! probe defends itself against the macOS occlusion throttle, and the list had drifted to ten of
+//! the twenty-five variables that schedule on the wall clock — a mail or auction probe launched
+//! exactly as the method prescribes ran covered, at ~1 fps, measuring garbage.
+//!
+//! So the list is now a **column** here ([`ProbeVar::wall_clock`]), the arming reads the column,
+//! and two structural tests below keep the table honest: every `"WOW_PROBE…"` string literal in
+//! the crate is a row, every row is a literal somewhere other than this file, and every value
+//! `WOW_PROBE` itself dispatches on is in [`PROBE_NAMES`]. `WOW_PROBE=list` prints it.
+//!
+//! What this is **not**: a dispatcher. The variables keep their own read sites and their own
+//! shapes — several carry free-form values (Lua chunks, chat lines with spaces and `=`, `A>B`
+//! drag specs) and several combine in one run — so folding them into one variable would need an
+//! escaping mini-language and would change the launch line every session uses. The defect was
+//! the drift, and a registry is the whole cure for drift.
+
+/// One probe-fleet environment variable.
+pub(crate) struct ProbeVar {
+    /// The variable, exactly as the read site spells it.
+    pub name: &'static str,
+    /// One line: the value shape and what setting it does, from the comment at the read site.
+    pub purpose: &'static str,
+    /// Whether the variable **schedules on elapsed real time** — its script fires at `<secs>`
+    /// marks, integrates a rate per frame, or steps a phase machine on `Time<Real>` — so the run
+    /// is only right while frames keep arriving at full rate.
+    ///
+    /// Why it matters (decision 0906): macOS drops a fully covered window to ~1 fps drawables,
+    /// and on such a window a wall-clock probe does not measure slowly, it **runs the wrong
+    /// script** — one leg fired `W@16` and `Space@19` in the same frame and jumped from a
+    /// standstill; another integrated its camera at 125 yd/s for 500 and never crossed the
+    /// radius it was testing (0794). Every `true` row therefore arms
+    /// [`super::ProbeFocusPlugin`] from `dev.rs`, which keeps the probe window un-occludable
+    /// (and, for a run that draws no pixels, parks it small in a corner — decision 1148).
+    ///
+    /// A `false` row is a flag or a modifier: a `_AT`/`_STEP`/`_KEEP` rides its parent's
+    /// arming, a pricing lever changes *what* a run draws rather than *when*, and a state
+    /// machine that advances on wire replies (the char-create probe) has no clock to be robbed of.
+    pub wall_clock: bool,
+}
+
+/// Every `WOW_PROBE*` variable the app reads. Grouped by the probe that owns each; the order is
+/// the order `WOW_PROBE=list` prints.
+pub(crate) const PROBE_VARS: &[ProbeVar] = &[
+    // ── The variable itself, and the run shell every scripted probe rides ────────────────────
+    ProbeVar {
+        name: "WOW_PROBE",
+        purpose: "<name> — a value-dispatched live probe (see the names below); `list` prints this table",
+        // Five of the six values step a phase machine on `time.elapsed_secs` (melee's 3 s swing
+        // cadence, crossing/taxi/guardpoi's phases, castcancel's press-at-t); `partner` answers
+        // invites the frame they land, but rides the same variable.
+        wall_clock: true,
+    },
+    ProbeVar {
+        name: "WOW_PROBE_EXIT_AT",
+        purpose: "<secs> — exit the app after N wall seconds; bounds any scripted live probe's lifetime",
+        // Fires on `ProbeClock` at `<secs>`, and it is the one probe variable a trace-only run
+        // sets on its own (`WOW_MOVE_TRACE`/`WOW_STREAM_TRACE` legs, method.md) — 0794's
+        // throttled camera leg was exactly such a run.
+        wall_clock: true,
+    },
+    ProbeVar {
+        name: "WOW_PROBE_PARK",
+        purpose: "corner|edge|off — where the un-occludable probe window sits, and whether it is pinned on top",
+        // A dial ON the occlusion defence itself, not a schedule.
+        wall_clock: false,
+    },
+    ProbeVar {
+        name: "WOW_PROBE_RESIZE",
+        purpose: "\"<secs>:<W>x<H>\" — resize the primary window mid-run (the headless fullscreen-toggle stand-in)",
+        // Fires on `ProbeClock` at `<secs>`.
+        wall_clock: true,
+    },
+    // ── The actuation channels: chat, keys, Lua, pointer ─────────────────────────────────────
+    ProbeVar {
+        name: "WOW_PROBE_CHAT",
+        purpose: "\"<line>[;<line>…]\" — send each line as chat once in-world; the park-the-probe-anywhere instrument (`.go xyz …`)",
+        // Line `n` is due at `at + every * n` on `ProbeClock`.
+        wall_clock: true,
+    },
+    ProbeVar {
+        name: "WOW_PROBE_CHAT_AT",
+        purpose: "<secs> — when the first chat line goes out (default 8)",
+        wall_clock: false,
+    },
+    ProbeVar {
+        name: "WOW_PROBE_CHAT_EVERY",
+        purpose: "<secs> — space the chat lines apart instead of one burst (do X, wait, then do Y)",
+        wall_clock: false,
+    },
+    ProbeVar {
+        name: "WOW_PROBE_KEY",
+        purpose: "\"<key>@<secs>[:<hold>][;…]\" — synthesize key presses once in-world (a jump, a mount flourish, a held W)",
+        // Each tap fires at its `@<secs>` and releases `<hold>` later, on `ProbeClock`.
+        wall_clock: true,
+    },
+    ProbeVar {
+        name: "WOW_PROBE_LUA",
+        purpose: "\"<chunk>\" — run a Lua chunk in the live UI VM once per world entry (the press-the-button-headlessly instrument)",
+        // First fire at `_AT` seconds, re-armed `_AGAIN` seconds into every later world entry.
+        wall_clock: true,
+    },
+    ProbeVar {
+        name: "WOW_PROBE_LUA_AT",
+        purpose: "<secs> — when the chunk runs after the first world entry (default 10)",
+        wall_clock: false,
+    },
+    ProbeVar {
+        name: "WOW_PROBE_LUA_AGAIN",
+        purpose: "<secs> — how long after every LATER world entry (a relog) the chunk runs again (default 4)",
+        wall_clock: false,
+    },
+    ProbeVar {
+        name: "WOW_PROBE_HOVER",
+        purpose: "\"<frame>[;<frame>…]\" — sweep the real pointer across the named frames' centres, pressing nothing",
+        // Starts at `_AT`, one move per `_STEP` seconds, alternating on `_DUTY` — all wall seconds.
+        wall_clock: true,
+    },
+    ProbeVar {
+        name: "WOW_PROBE_HOVER_AT",
+        purpose: "<secs> — when the sweep starts (default 14)",
+        wall_clock: false,
+    },
+    ProbeVar {
+        name: "WOW_PROBE_HOVER_STEP",
+        purpose: "<secs> — seconds per pointer move (default 0.25; ~0.016 sweeps at frame rate, the director's gesture)",
+        wall_clock: false,
+    },
+    ProbeVar {
+        name: "WOW_PROBE_HOVER_JITTER",
+        purpose: "<px> — walk the pointer inside a px box each step so it moves while the hovered frame stays put",
+        wall_clock: false,
+    },
+    ProbeVar {
+        name: "WOW_PROBE_HOVER_DUTY",
+        purpose: "<on>:<off> — sweep for `on` seconds, park over nothing for `off`, repeat (a leg that alternates can be read)",
+        wall_clock: false,
+    },
+    ProbeVar {
+        name: "WOW_PROBE_DRAG",
+        purpose: "\"<From>><To>[;…]\" — drag one named frame onto another through the real pointer path, one gesture step per frame",
+        // Starts at `_AT`, advances one step per `_STEP` seconds, on `ProbeClock`.
+        wall_clock: true,
+    },
+    ProbeVar {
+        name: "WOW_PROBE_DRAG_AT",
+        purpose: "<secs> — when the first drag starts (default 14)",
+        wall_clock: false,
+    },
+    ProbeVar {
+        name: "WOW_PROBE_DRAG_STEP",
+        purpose: "<secs> — seconds per gesture step (default 0.1); a press and release in one frame is a click, not a drag",
+        wall_clock: false,
+    },
+    ProbeVar {
+        name: "WOW_PROBE_DRAG_LUA",
+        purpose: "\"<chunk>\" — a Lua chunk evaluated after each drag whose string result is logged as the report",
+        wall_clock: false,
+    },
+    // ── The scripted controller inputs (decisions 0621/0653) ────────────────────────────────
+    ProbeVar {
+        name: "WOW_PROBE_LOOK",
+        purpose: "\"<deg_per_sec>@<start_s>:<duration_s>[;…]\" — the scripted mouse-turn: turn the avatar's aim at a rate for a while",
+        // `90°/s for 6 s` has to produce 540° whatever the frame rate did; integrates rate × dt
+        // between `at` and `until` on `ProbeClock`.
+        wall_clock: true,
+    },
+    ProbeVar {
+        name: "WOW_PROBE_PITCH",
+        purpose: "\"<deg>@<start_s>[:<deg_per_sec>][;…]\" — the scripted dive: aim a swimming avatar's nose up or down (+up)",
+        // A dive scripted to reach 30° by second 25 has to reach it at second 25, and it is the
+        // one script that can be a run's only actuator (a drifting swimmer needs no keys).
+        wall_clock: true,
+    },
+    ProbeVar {
+        name: "WOW_PROBE_CAM",
+        purpose: "\"<yaw_deg>,<pitch_deg>[,<dist_yd>]@<start_s>[:<pan_deg_per_s>][;…]\" — park the third-person camera at absolute poses",
+        // Each pose takes over at its `@<start>` and pans at its rate from then, on `ProbeClock`.
+        wall_clock: true,
+    },
+    // ── The FPS probe's dials (`WOW_LIVE_FPS`, the capture harness) ─────────────────────────
+    ProbeVar {
+        name: "WOW_PROBE_UNCAP",
+        purpose: "immediate|vsync — the FPS probe's present mode instead of the measured-best AutoNoVsync",
+        wall_clock: false,
+    },
+    ProbeVar {
+        name: "WOW_PROBE_VSYNC",
+        purpose: "1 — keep vsync ON in the FPS probe: it then measures the present ceiling the display grants this window",
+        wall_clock: false,
+    },
+    // ── The pricing levers and traces: change what a run draws or logs, never when ───────────
+    ProbeVar {
+        name: "WOW_PROBE_UI_ONE_TEX",
+        purpose: "1 — pricing lever: split UI runs on state flags alone, ignoring texture identity (the draw-count ceiling an atlas would reach)",
+        wall_clock: false,
+    },
+    ProbeVar {
+        name: "WOW_PROBE_SHARED_SKIN",
+        purpose: "1 — pricing lever: share character-skin materials across bodies (see `char_skin::build_char_skin_materials`)",
+        wall_clock: false,
+    },
+    ProbeVar {
+        name: "WOW_PROBE_NAME_TRACE",
+        purpose: "1 — per-frame NAME_TRACE lines for the self player's plate seat (a smoothness question is measured, never eyeballed)",
+        wall_clock: false,
+    },
+    // ── The `=1` live probes: each parks the body somewhere real and steps a phase machine ───
+    // Every one below reads `time.elapsed_secs_f64()` into a `since`/`now` phase machine —
+    // waits, settles and timeouts in wall seconds — so each arms the occlusion defence.
+    ProbeVar {
+        name: "WOW_PROBE_BG_SAMPLES",
+        purpose: "n — how many 12 s census samples WOW_PROBE_BG takes inside the battleground (default 12; ~30 reaches vmangos's 5-minute premature finish, i.e. the end of a match)",
+        wall_clock: false,
+    },
+    ProbeVar {
+        name: "WOW_PROBE_BG",
+        purpose: "wsg|ab|av — queue for that battleground, take the port through the stock verb and census the instance from inside",
+        wall_clock: true,
+    },
+    ProbeVar {
+        name: "WOW_PROBE_BGQUEUE",
+        purpose: "1 — level past the bracket floor, greet Stormwind's Warsong Gulch battlemaster and queue through his list",
+        wall_clock: true,
+    },
+    ProbeVar {
+        name: "WOW_PROBE_MAIL",
+        purpose: "1 — GM-mail the probe's own character, open the Goldshire mailbox and drive inbox/take/send/delete through the VM",
+        wall_clock: true,
+    },
+    ProbeVar {
+        name: "WOW_PROBE_AUCTION",
+        purpose: "1 — GM-hop to a Stormwind auctioneer and drive browse/throttle/sell/owner-list/cancel through the VM",
+        wall_clock: true,
+    },
+    ProbeVar {
+        name: "WOW_PROBE_BANK",
+        purpose: "1 — GM-hop to a pure banker and drive the six-opcode bank wire (activate/deposit/withdraw/buy-slot/refusal)",
+        wall_clock: true,
+    },
+    ProbeVar {
+        name: "WOW_PROBE_BINDER",
+        purpose: "1 — GM-hop to an innkeeper, select the bind row and answer the confirm through the VM's own ConfirmBinder()",
+        wall_clock: true,
+    },
+    ProbeVar {
+        name: "WOW_PROBE_SERVICE",
+        purpose: "1 — right-click four real NPCs, one per UNIT_NPC_FLAGS shape, and report the service-ladder arm and the window that opened",
+        wall_clock: true,
+    },
+    ProbeVar {
+        name: "WOW_PROBE_VENDOR_SWAP",
+        purpose: "1 — open one Goldshire vendor over the other's window and read the `npc` token, title and portrait at MERCHANT_SHOW",
+        wall_clock: true,
+    },
+    ProbeVar {
+        name: "WOW_PROBE_MODEL_CAMERA",
+        purpose: "1 — build a plain <Model> pane on a camera-bearing file and read the renderer's camera and root back",
+        wall_clock: true,
+    },
+    ProbeVar {
+        name: "WOW_PROBE_GMTICKET",
+        purpose: "1 — drive the five-opcode GM ticket wire through the VM (status, clean slate, file, edit, abandon)",
+        wall_clock: true,
+    },
+    ProbeVar {
+        name: "WOW_PROBE_CHARTER",
+        purpose: "1 — buy a guild charter at the Stormwind registrar, open it with a real bag right-click and rename it",
+        wall_clock: true,
+    },
+    ProbeVar {
+        name: "WOW_PROBE_BOOK",
+        purpose: "1 — teleport to the Old Town plaque and measure what the item-text reader costs per frame, closed vs open (B240)",
+        wall_clock: true,
+    },
+    ProbeVar {
+        name: "WOW_PROBE_STONE",
+        purpose: "1 or <x>,<y>,<z>[,<map>] — join a real meeting stone on the click's own route and read the queue back out of the live VM",
+        wall_clock: true,
+    },
+    ProbeVar {
+        name: "WOW_PROBE_CHEST",
+        purpose: "1 or <x>,<y>,<z>[,<map>] — open a real chest on the click's own route and report the self anim id before/during/after",
+        wall_clock: true,
+    },
+    ProbeVar {
+        name: "WOW_PROBE_GOQUEST",
+        purpose: "1 or <x>,<y>,<z>[,<map>] — park at a GameObject questgiver and report the dialog status below and above MinLevel",
+        wall_clock: true,
+    },
+    ProbeVar {
+        name: "WOW_PROBE_CLAM",
+        purpose: "1 or <entry> — stock an openable item, right-click it through UseContainerItem and report whether a loot window opens",
+        wall_clock: true,
+    },
+    // ── Modifiers of the value-dispatched probes ────────────────────────────────────────────
+    ProbeVar {
+        name: "WOW_PROBE_DOCK",
+        purpose: "x,y,z[,map] — the dock `WOW_PROBE=crossing` boards from (map defaults to 0 and must be sent)",
+        wall_clock: false,
+    },
+    // ── The character-select probe: advances on wire replies, not on a clock ───────────────
+    ProbeVar {
+        name: "WOW_PROBE_CHARCREATE",
+        purpose: "\"<name>[,race,class,gender[,skin,face,hair,haircolor,facial]]\" — create (and delete) a character at select over the wire",
+        // A roster/result state machine: `AwaitingRoster` → create → result byte → delete →
+        // result byte, each step on the reply that arrives. No clock read anywhere in it.
+        wall_clock: false,
+    },
+    ProbeVar {
+        name: "WOW_PROBE_CHARCREATE_KEEP",
+        purpose: "1 — keep the character the probe created instead of deleting it",
+        wall_clock: false,
+    },
+];
+
+/// The named values of `WOW_PROBE` itself, `(value, purpose)` — the one place they are listed.
+/// `dev.rs` dispatches on the literals (one plugin per value) and `lib.rs` answers `list`
+/// before any window opens; the test below keeps both in step with this table.
+pub(crate) const PROBE_NAMES: &[(&str, &str)] = &[
+    ("list", "print this table and exit, before any window opens"),
+    (
+        "melee",
+        "auto-fight the nearest enemy so the dbg-trace sink can record the combat-text timeline",
+    ),
+    (
+        "partner",
+        "the second client that says yes: auto-accept every group invite and duel challenge (0434/0637)",
+    ),
+    (
+        "crossing",
+        "board a cross-continent boat and report the map seam surviving (0455)",
+    ),
+    (
+        "taxi",
+        "open the flight-master menu on the wire and ride Stormwind → Sentinel Hill to a verdict (0484)",
+    ),
+    (
+        "guardpoi",
+        "ask a Stormwind guard for the weapons trainer and check the SMSG_GOSSIP_POI marker field by field",
+    ),
+    (
+        "castcancel",
+        "hearth and press W mid-cast — the local self-cancel's end-to-end timing instrument",
+    ),
+];
+
+/// The variables whose presence arms the un-occludable probe window — the `wall_clock` column.
+pub(crate) fn wall_clock_vars() -> impl Iterator<Item = &'static str> {
+    PROBE_VARS.iter().filter(|v| v.wall_clock).map(|v| v.name)
+}
+
+/// `WOW_PROBE=list` — print the registry, one variable per line, then the named values.
+pub(crate) fn print() {
+    println!("The probe fleet's environment (capture::probe_env, decision 2265 §A5).");
+    println!(
+        "wall-clock: the variable schedules on elapsed real time and arms the un-occludable probe"
+    );
+    println!("window (ProbeFocusPlugin, decision 0906) — covered, such a run drops to ~1 fps and");
+    println!("executes the wrong script.");
+    println!();
+    println!("{:<26} {:<10} PURPOSE", "VARIABLE", "WALL-CLOCK");
+    for v in PROBE_VARS {
+        let wc = if v.wall_clock { "yes" } else { "-" };
+        println!("{:<26} {:<10} {}", v.name, wc, v.purpose);
+    }
+    println!();
+    println!("WOW_PROBE=<name>:");
+    for (name, purpose) in PROBE_NAMES {
+        println!("  {name:<12} {purpose}");
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    /// This file's own path under `src/` — excluded from both scans, since its table and its
+    /// tests are the one place the literals are *supposed* to appear without being read.
+    const SELF: &str = "capture/probe_env.rs";
+
+    /// **The table cannot drift from the code, in either direction** (decision 2265 §A5).
+    ///
+    /// Every `"WOW_PROBE…"` string literal in the crate must be a row here — a variable the
+    /// fleet reads that the registry does not know is exactly the hand-maintained gap this
+    /// module replaced — and every row must be a literal somewhere other than this file, or the
+    /// registry is describing a variable nothing reads. String literals only: doc comments
+    /// write the backticked form and are skipped by line.
+    #[test]
+    fn every_probe_variable_is_registered_and_every_registered_variable_is_read() {
+        let registered: Vec<&str> = PROBE_VARS.iter().map(|v| v.name).collect();
+        for (i, name) in registered.iter().enumerate() {
+            assert!(
+                !registered[..i].contains(name),
+                "`{name}` is registered twice"
+            );
+            assert!(
+                name.starts_with("WOW_PROBE"),
+                "`{name}` is not a probe variable — the registry is `WOW_PROBE*` only"
+            );
+        }
+
+        let mut read: Vec<(String, String)> = Vec::new(); // (literal, file)
+        for (rel, text) in crate_sources() {
+            if rel == SELF {
+                continue;
+            }
+            for lit in probe_literals(&text) {
+                read.push((lit, rel.clone()));
+            }
+        }
+
+        let unregistered: Vec<String> = read
+            .iter()
+            .filter(|(lit, _)| !registered.contains(&lit.as_str()))
+            .map(|(lit, file)| format!("{file}: \"{lit}\""))
+            .collect();
+        assert!(
+            unregistered.is_empty(),
+            "these `WOW_PROBE…` literals are read but not in `PROBE_VARS` — add a row (name, \
+             purpose from the read site's comment, and whether it schedules on the wall clock):\n  {}",
+            unregistered.join("\n  ")
+        );
+
+        let unread: Vec<&str> = registered
+            .iter()
+            .copied()
+            .filter(|name| !read.iter().any(|(lit, _)| lit == name))
+            .collect();
+        assert!(
+            unread.is_empty(),
+            "these `PROBE_VARS` rows are not a string literal anywhere else in the crate — \
+             nothing reads them; drop the row or restore the read site:\n  {}",
+            unread.join("\n  ")
+        );
+    }
+
+    /// **`WOW_PROBE`'s named values are listed once.** Every `Ok("<name>")` the code compares
+    /// `WOW_PROBE`'s value against (the `dev.rs` plugin dispatch, the `lib.rs` `list` exit) must
+    /// be a `PROBE_NAMES` row, and every row must be dispatched on — so `WOW_PROBE=list` prints
+    /// the values that exist, not the ones someone remembered.
+    #[test]
+    fn every_dispatched_probe_name_is_listed_and_every_listed_name_is_dispatched() {
+        let listed: Vec<&str> = PROBE_NAMES.iter().map(|(n, _)| *n).collect();
+        for (i, name) in listed.iter().enumerate() {
+            assert!(!listed[..i].contains(name), "`{name}` is listed twice");
+        }
+
+        let mut dispatched: Vec<(String, String)> = Vec::new(); // (value, file)
+        for (rel, text) in crate_sources() {
+            if rel == SELF {
+                continue;
+            }
+            for value in dispatched_probe_values(&text) {
+                dispatched.push((value, rel.clone()));
+            }
+        }
+        assert!(
+            !dispatched.is_empty(),
+            "no `WOW_PROBE` value dispatch found anywhere — the scanner has lost its needle"
+        );
+
+        let unlisted: Vec<String> = dispatched
+            .iter()
+            .filter(|(v, _)| !listed.contains(&v.as_str()))
+            .map(|(v, file)| format!("{file}: WOW_PROBE={v}"))
+            .collect();
+        assert!(
+            unlisted.is_empty(),
+            "these `WOW_PROBE` values are dispatched on but not in `PROBE_NAMES`:\n  {}",
+            unlisted.join("\n  ")
+        );
+
+        let undispatched: Vec<&str> = listed
+            .iter()
+            .copied()
+            .filter(|name| !dispatched.iter().any(|(v, _)| v == name))
+            .collect();
+        assert!(
+            undispatched.is_empty(),
+            "these `PROBE_NAMES` rows are not dispatched on anywhere (`var(\"WOW_PROBE\")… == \
+             Ok(\"<name>\")`):\n  {}",
+            undispatched.join("\n  ")
+        );
+    }
+
+    /// Every `.rs` under this crate's `src/`, as `(path under src/, text)`.
+    fn crate_sources() -> Vec<(String, String)> {
+        let src = std::path::Path::new(env!("CARGO_MANIFEST_DIR")).join("src");
+        let mut out = Vec::new();
+        let mut stack = vec![src.clone()];
+        while let Some(dir) = stack.pop() {
+            for entry in std::fs::read_dir(&dir).expect("crate source dir is readable") {
+                let path = entry.expect("dir entry").path();
+                if path.is_dir() {
+                    stack.push(path);
+                } else if path.extension().is_some_and(|e| e == "rs") {
+                    let rel = path
+                        .strip_prefix(&src)
+                        .expect("under src")
+                        .to_string_lossy()
+                        .replace('\\', "/");
+                    let text = std::fs::read_to_string(&path).expect("source is readable");
+                    out.push((rel, text));
+                }
+            }
+        }
+        out.sort();
+        out
+    }
+
+    /// The source with every comment line (`//`, `///`, `//!`) dropped — the scans below want
+    /// code, and a doc comment quoting a variable is not a read of it.
+    fn code_lines(text: &str) -> String {
+        text.lines()
+            .filter(|l| !l.trim_start().starts_with("//"))
+            .collect::<Vec<_>>()
+            .join("\n")
+    }
+
+    /// Every `"WOW_PROBE[A-Z0-9_]*"` string literal in the code — the whole literal, quote to
+    /// quote, so a variable named inside a longer message is not a match.
+    fn probe_literals(text: &str) -> Vec<String> {
+        let code = code_lines(text);
+        let mut out = Vec::new();
+        let mut rest = code.as_str();
+        while let Some(i) = rest.find("\"WOW_PROBE") {
+            let after = &rest[i + 1..];
+            let end = after
+                .find(|c: char| !(c.is_ascii_uppercase() || c.is_ascii_digit() || c == '_'))
+                .unwrap_or(after.len());
+            if after[end..].starts_with('"') {
+                out.push(after[..end].to_string());
+            }
+            rest = &rest[i + 1..];
+        }
+        out
+    }
+
+    /// Every value the code compares `WOW_PROBE` against: `var("WOW_PROBE")` followed, within the
+    /// same expression, by `Ok("<value>")`.
+    fn dispatched_probe_values(text: &str) -> Vec<String> {
+        let code = code_lines(text);
+        let needle = "var(\"WOW_PROBE\")";
+        let mut out = Vec::new();
+        let mut rest = code.as_str();
+        while let Some(i) = rest.find(needle) {
+            let after = &rest[i + needle.len()..];
+            // The comparison sits right after the read: `.as_deref() == Ok("…")`. Bound the
+            // look-ahead so a bare `is_ok()` gate is not paired with some later `Ok("…")`.
+            let window = &after[..after.len().min(48)];
+            if let Some(j) = window.find("Ok(\"") {
+                let value = &after[j + 4..];
+                if let Some(k) = value.find('"') {
+                    out.push(value[..k].to_string());
+                }
+            }
+            rest = after;
+        }
+        out
+    }
+}
diff --git a/crates/benilla-app/src/capture/probe_goquest.rs b/crates/benilla-app/src/capture/probe_goquest.rs
index 9a8cd6c8..60d3c61a 100644
--- a/crates/benilla-app/src/capture/probe_goquest.rs
+++ b/crates/benilla-app/src/capture/probe_goquest.rs
@@ -211,7 +211,6 @@ fn report(label: &str, expect: u32, seen: Option<u32>) -> u32 {
     }
 }
 
-#[allow(clippy::too_many_arguments)]
 fn goquest_probe(
     time: ProbeClock,
     mut probe: ResMut<GoQuestProbe>,
diff --git a/crates/benilla-app/src/capture/probe_guard_poi.rs b/crates/benilla-app/src/capture/probe_guard_poi.rs
index 983b16d1..c734517f 100644
--- a/crates/benilla-app/src/capture/probe_guard_poi.rs
+++ b/crates/benilla-app/src/capture/probe_guard_poi.rs
@@ -73,7 +73,6 @@ enum Phase {
 }
 
 // One Bevy system's full input set (the taxi-probe shape).
-#[allow(clippy::too_many_arguments)]
 fn guard_poi_probe(
     time: ProbeClock,
     mut probe: ResMut<GuardPoiProbe>,
diff --git a/crates/benilla-app/src/capture/probe_look.rs b/crates/benilla-app/src/capture/probe_look.rs
index e4895ac9..0a74d92f 100644
--- a/crates/benilla-app/src/capture/probe_look.rs
+++ b/crates/benilla-app/src/capture/probe_look.rs
@@ -110,7 +110,7 @@ impl Plugin for ProbeLookPlugin {
             drive_probe_look
                 .in_set(WorldStage::Input)
                 .before(crate::player::PlayerControlSet)
-                .run_if(in_state(crate::char_select::ClientState::InWorld)),
+                .in_set(crate::char_select::InWorldGated),
         );
     }
 }
diff --git a/crates/benilla-app/src/capture/probe_mail.rs b/crates/benilla-app/src/capture/probe_mail.rs
index 80a1e585..85c747fd 100644
--- a/crates/benilla-app/src/capture/probe_mail.rs
+++ b/crates/benilla-app/src/capture/probe_mail.rs
@@ -222,7 +222,6 @@ fn last_event(script: &UiScript) -> String {
         .unwrap_or_default()
 }
 
-#[allow(clippy::too_many_arguments)]
 fn mail_probe(
     time: ProbeClock,
     mut probe: ResMut<MailProbe>,
@@ -378,7 +377,7 @@ fn mail_probe(
             };
             let landed = entry_of(&mail, letter_id).and_then(|e| {
                 (e.item_text_id != 0)
-                    .then(|| mail.bodies.get(&e.item_text_id).cloned())
+                    .then(|| mail.bodies.get(e.item_text_id).cloned())
                     .flatten()
                     .map(|body| (body, e.checked & CHECKED_READ != 0))
             });
diff --git a/crates/benilla-app/src/capture/probe_model_camera.rs b/crates/benilla-app/src/capture/probe_model_camera.rs
index 03a73f14..ce8f6c22 100644
--- a/crates/benilla-app/src/capture/probe_model_camera.rs
+++ b/crates/benilla-app/src/capture/probe_model_camera.rs
@@ -203,7 +203,6 @@ fn shoot(commands: &mut Commands, name: &str) {
         .observe(save_to_disk(path));
 }
 
-#[allow(clippy::too_many_arguments)]
 fn model_camera_probe(
     mut commands: Commands,
     time: ProbeClock,
diff --git a/crates/benilla-app/src/capture/probe_pitch.rs b/crates/benilla-app/src/capture/probe_pitch.rs
index d985c461..8957be1a 100644
--- a/crates/benilla-app/src/capture/probe_pitch.rs
+++ b/crates/benilla-app/src/capture/probe_pitch.rs
@@ -126,7 +126,7 @@ impl Plugin for ProbePitchPlugin {
             drive_probe_pitch
                 .in_set(WorldStage::Input)
                 .before(crate::player::PlayerControlSet)
-                .run_if(in_state(crate::char_select::ClientState::InWorld)),
+                .in_set(crate::char_select::InWorldGated),
         );
     }
 }
diff --git a/crates/benilla-app/src/capture/probe_rig.rs b/crates/benilla-app/src/capture/probe_rig.rs
index 31765f71..d3323213 100644
--- a/crates/benilla-app/src/capture/probe_rig.rs
+++ b/crates/benilla-app/src/capture/probe_rig.rs
@@ -295,7 +295,6 @@ struct Rig {
 }
 
 /// The whole rig: find-or-create the body at select, enter as it, then apply the state batch.
-#[allow(clippy::too_many_arguments)]
 fn drive_rig(
     mut rig: ResMut<Rig>,
     mut roster: ResMut<Roster>,
diff --git a/crates/benilla-app/src/capture/probe_service.rs b/crates/benilla-app/src/capture/probe_service.rs
index 9cb26d7e..eb32d358 100644
--- a/crates/benilla-app/src/capture/probe_service.rs
+++ b/crates/benilla-app/src/capture/probe_service.rs
@@ -340,7 +340,6 @@ fn open_window(
     None
 }
 
-#[allow(clippy::too_many_arguments)]
 fn service_probe(
     time: ProbeClock,
     mut probe: ResMut<ServiceProbe>,
@@ -519,6 +518,9 @@ fn service_probe(
                     let why: &str = match other {
                         ServiceAction::AskBinder => "CONFIRM_BINDER, no packet",
                         ServiceAction::AskSpiritHealer => "CONFIRM_XP_LOSS, no packet",
+                        ServiceAction::AcquireSpiritGuide => {
+                            "adopts the area spirit healer; the packet leaves from the cache"
+                        }
                         ServiceAction::Silent(w) => w,
                         ServiceAction::Send(_) | ServiceAction::SellFromCursor(_) => {
                             unreachable!()
diff --git a/crates/benilla-app/src/capture/probe_stone.rs b/crates/benilla-app/src/capture/probe_stone.rs
new file mode 100644
index 00000000..30e15036
--- /dev/null
+++ b/crates/benilla-app/src/capture/probe_stone.rs
@@ -0,0 +1,432 @@
+//! The meeting-stone live probe (`WOW_PROBE_STONE=1`) — decision 2283's instrument: **can a
+//! player actually get into the LFG queue, and does everything downstream of that light up?**
+//!
+//! Until 2283 a right-click on a meeting stone sent `CMSG_GAMEOBJ_USE`, which vmangos' own
+//! `GameObject::Use` answers with an explicit `return` for type 23. So the whole receiving half —
+//! the two globals, the five-way status table, `MEETINGSTONE_CHANGED`, the stock
+//! `MiniMapMeetingStoneFrame` — had been built and tested against synthetic packets and had never
+//! once run off a real one. This probe is what closes that: it drives the click's own route and
+//! then reads the answer out of the **live VM**, not out of our own state.
+//!
+//! **Why a probe and not a capture:** none of this is a picture. Every reading here is a number or
+//! a Lua truth value — the queued area id, `IsInMeetingStoneQueue()`, whether the stock minimap
+//! button is shown — so the verdict needs no eye in the loop (`method.md` step 4).
+//!
+//! **Where it enters the chain, exactly.** It writes the very
+//! [`MeetingStoneUse`] the click ladder writes, so everything **downstream** of that seam runs
+//! for real — the validator, `CMSG 0x292`, the server, `SMSG 0x295`, the feed, the two globals,
+//! the stock frame. It does **not** cover the mouse hit-test or the shared gates *above* the seam
+//! (highlightable, mounted, range); those are the click test's
+//! (`target::click::tests::a_right_click_on_a_meeting_stone_joins_it_and_sends_no_gameobj_use`).
+//! Neither alone closes the chain; together they do.
+//!
+//! ## The five legs, in order
+//!
+//! 1. **CONTROL** — parked at the stone, nothing clicked: `IsInMeetingStoneQueue()` must be `nil`
+//!    and the stock icon hidden. A probe that only ever sees the queued state cannot tell a fix
+//!    from a stuck flag.
+//! 2. **REFUSED** — the body demoted **below** the stone's `data[0]`, then clicked: the client's
+//!    own level refusal must fire, and **nothing** may reach the wire. This is the one of the four
+//!    refusals the server does not duplicate — `HandleMeetingStoneJoinOpcode` never looks at the
+//!    stone's level band — so if our copy is wrong, the server queues a level-1 character for
+//!    Deadmines and nobody notices.
+//! 3. **JOINED** — the body levelled **into** the band, then clicked: `SMSG 0x295` must arrive with
+//!    this stone's own `data[2]`, `IsInMeetingStoneQueue()` must answer the number `1`,
+//!    `GetMeetingStoneStatusText()` a real string, and `MiniMapMeetingStoneFrame` must be shown.
+//! 4. **DARKENED** — with that queue held, the stone's own `highlightable` slot must now refuse it
+//!    ([`crate::target::cursor_mode::meeting_stone_queued`] over the live area): the stone you are
+//!    queued at stops being clickable, which is the whole of `0x5f6990`.
+//! 5. **LEFT** — `CancelMeetingStoneRequest()` through the live VM: back to `nil`, icon hidden.
+//!
+//! ## The run recipe
+//!
+//! ```text
+//! WOW_NOSOUND=1 WOW_UNATTENDED=1 WOW_USER=probe3 WOW_PASS=pprobe3 WOW_CHAR=Probethree \
+//!     WOW_PROBE_STONE=1 cargo run -q -p benilla
+//! ```
+//! (the slot-keyed probe identity — `pool-N` → `probeN`/`pprobeN`/`Probe<N-spelled>`, `method.md`
+//! "The local vmangos server"). `WOW_PROBE_STONE=<x>,<y>,<z>[,<map>]` aims it elsewhere.
+//!
+//! **It leaves the probe body at the stone's minimum level**, deliberately and without putting it
+//! back: the level is the probe's own instrument (leg 2 needs one side of the band and leg 3 the
+//! other), and a probe character's level is scratch. Grep `PROBE_STONE:` for the verdict; the
+//! probe self-exits when it lands.
+
+use bevy::prelude::*;
+
+use benilla_protocol::EntityKind;
+use benilla_ui::script::UiScript;
+
+use super::probes::ProbeClock;
+use crate::go_templates::{GameObjectTemplates, MeetingStoneTemplate};
+use crate::net::{ChatKind, ClientCommand, Guid, NetCommands, NetEntity, ObjectStore, SelfPlayer};
+use crate::player::Player;
+use crate::target::cursor_mode::meeting_stone_queued;
+use crate::ui_dialog_verbs::{MeetingStone, MeetingStoneUse};
+
+/// The probe's default object: the **Stockade** meeting stone in Stormwind (`gameobject.guid`
+/// 26635, template 179595 — `data[0..2] = 24, 32, 717`). Chosen because it is a plain unpooled
+/// spawn in a capital, its level band is narrow enough that a level-1 body is comfortably outside
+/// it, and area 717 resolves to a real `AreaTable` row, so the status text comes out a sentence
+/// ("Looking for more for The Stockade") rather than the `UNKNOWN` fallback — which makes the
+/// JOINED leg's `text=yes` mean the whole rebuild ran, not just that a string exists.
+const STONE_AT: [f32; 4] = [-8810.5, 798.0, 98.2, 0.0];
+/// `GAMEOBJECT_TYPE_MEETINGSTONE`.
+const GO_TYPE_MEETINGSTONE: i32 = 23;
+/// The level leg 2 demotes to — below every shipped stone's `data[0]`.
+const LEVEL_BELOW: u32 = 1;
+
+const SCAN_RANGE: f32 = 30.0;
+const SETTLE_SECS: f64 = 6.0;
+const SCAN_TIMEOUT_SECS: f64 = 30.0;
+const LEVEL_TIMEOUT_SECS: f64 = 20.0;
+/// How long a refusal is given to *not* happen. The join round trip below is the same server, so
+/// anything that was going to arrive has arrived.
+const REFUSAL_WINDOW_SECS: f64 = 6.0;
+const QUEUE_TIMEOUT_SECS: f64 = 20.0;
+
+type NearbyObject = (
+    &'static Guid,
+    &'static NetEntity,
+    &'static ObjectStore,
+    &'static Transform,
+);
+
+pub(crate) struct ProbeStonePlugin;
+
+impl Plugin for ProbeStonePlugin {
+    fn build(&self, app: &mut App) {
+        app.init_resource::<StoneProbe>()
+            .add_systems(Update, stone_probe);
+    }
+}
+
+#[derive(Resource, Default)]
+struct StoneProbe {
+    phase: Phase,
+    stone: Option<u64>,
+    tmpl: Option<MeetingStoneTemplate>,
+    fails: u32,
+    exited: bool,
+    /// What each leg actually read, for the DONE line.
+    joined_area: u32,
+    status_text: Option<String>,
+    icon_shown: bool,
+    darkened: bool,
+}
+
+#[derive(Default, Clone, Copy, PartialEq)]
+enum Phase {
+    #[default]
+    Wait,
+    Settling {
+        sent_at: f64,
+    },
+    /// The stone is in range; waiting for its ask-once template to answer.
+    WaitTemplate {
+        since: f64,
+    },
+    Control,
+    /// `.character level` issued; waiting for the store to report it. `join` says which leg the
+    /// click that follows belongs to — **not** the level value, because a stone whose `data[0]`
+    /// is 1 would make the two indistinguishable and loop the probe forever.
+    WaitLevel {
+        want: u32,
+        since: f64,
+        join: bool,
+    },
+    /// Clicked below the band; waiting out the window in which nothing may happen.
+    Refused {
+        since: f64,
+    },
+    /// Clicked in the band; waiting for `SMSG 0x295`.
+    WaitQueue {
+        since: f64,
+    },
+    Joined,
+    /// `CancelMeetingStoneRequest()` issued; waiting for the queue to clear.
+    WaitLeft {
+        since: f64,
+    },
+    Done,
+}
+
+/// Where the probe is aimed: `WOW_PROBE_STONE=<x>,<y>,<z>[,<map>]`, else [`STONE_AT`]. Anything
+/// unparseable falls back to the default rather than failing the run — the common value is `1`.
+fn target() -> [f32; 4] {
+    let Ok(raw) = std::env::var("WOW_PROBE_STONE") else {
+        return STONE_AT;
+    };
+    let parts: Vec<f32> = raw
+        .split(',')
+        .filter_map(|s| s.trim().parse().ok())
+        .collect();
+    match parts.len() {
+        3 => [parts[0], parts[1], parts[2], STONE_AT[3]],
+        4 => [parts[0], parts[1], parts[2], parts[3]],
+        _ => STONE_AT,
+    }
+}
+
+/// One leg's verdict line. `got == want` is the whole test; the line says both either way, so a
+/// failure reads as a measurement rather than as an assertion name.
+fn check(label: &str, want: &str, got: &str) -> u32 {
+    if want == got {
+        info!("PROBE_STONE: {label:<9} PASS — {got}");
+        0
+    } else {
+        error!("PROBE_STONE: {label:<9} FAIL — wanted {want}, read {got}");
+        1
+    }
+}
+
+/// The three live VM readings every leg is written in, asked of the **stock files**: the two
+/// bindings `Minimap.xml` calls, and whether its button is actually up.
+fn vm_state(script: &UiScript) -> (bool, Option<String>, bool) {
+    let queued = script
+        .eval::<bool>("return IsInMeetingStoneQueue() and true or false")
+        .unwrap_or(false);
+    let text = script
+        .eval::<String>("return GetMeetingStoneStatusText()")
+        .ok();
+    let shown = script
+        .eval::<bool>(
+            "return MiniMapMeetingStoneFrame and MiniMapMeetingStoneFrame:IsShown() and true or false",
+        )
+        .unwrap_or(false);
+    (queued, text, shown)
+}
+
+#[allow(clippy::too_many_arguments)]
+fn stone_probe(
+    time: ProbeClock,
+    mut probe: ResMut<StoneProbe>,
+    script: Option<NonSendMut<UiScript>>,
+    self_store: Query<&ObjectStore, With<SelfPlayer>>,
+    player: Res<Player>,
+    objects: Query<NearbyObject, Without<SelfPlayer>>,
+    templates: Res<GameObjectTemplates>,
+    queue: Res<MeetingStone>,
+    mut uses: MessageWriter<MeetingStoneUse>,
+    net: Res<NetCommands>,
+    mut exit: MessageWriter<AppExit>,
+) {
+    let Ok(store) = self_store.single() else {
+        return; // not in-world yet
+    };
+    let Some(script) = script else {
+        return; // no UI VM this build — nothing this probe can read
+    };
+    let now = time.elapsed_secs_f64();
+    let level = store.0.unit_level().unwrap_or(0);
+
+    match probe.phase {
+        Phase::Wait => {
+            let [x, y, z, map] = target();
+            info!("PROBE_STONE: heading to the meeting stone ({x} {y} {z} map {map})");
+            let _ = net.0.send(ClientCommand::Chat {
+                kind: ChatKind::Say,
+                target: None,
+                text: format!(".go xyz {x} {y} {z} {map}"),
+            });
+            probe.phase = Phase::Settling { sent_at: now };
+        }
+        Phase::Settling { sent_at } => {
+            if now - sent_at < SETTLE_SECS {
+                return;
+            }
+            let me = player.pos;
+            let found = objects.iter().find(|(_, net_e, store, tf)| {
+                net_e.kind == EntityKind::GameObject
+                    && store.0.gameobject_type_id() == GO_TYPE_MEETINGSTONE
+                    && tf.translation.distance(me) < SCAN_RANGE
+            });
+            if let Some((guid, ..)) = found {
+                info!("PROBE_STONE: stone {:#x} in range", guid.0);
+                probe.stone = Some(guid.0);
+                probe.phase = Phase::WaitTemplate { since: now };
+            } else if now - sent_at > SCAN_TIMEOUT_SECS {
+                error!(
+                    "PROBE_STONE: FAIL — no type-{GO_TYPE_MEETINGSTONE} GameObject within \
+                     {SCAN_RANGE} yd in {SCAN_TIMEOUT_SECS}s. This is NOT a passing run"
+                );
+                probe.fails += 1;
+                probe.phase = Phase::Done;
+            }
+        }
+        Phase::WaitTemplate { since } => {
+            let Some(guid) = probe.stone else {
+                probe.phase = Phase::Done;
+                return;
+            };
+            if let Some(t) = templates.get(guid).and_then(|t| t.meeting_stone) {
+                info!(
+                    "PROBE_STONE: template answered — levels {}..={}, area {}",
+                    t.min_level, t.max_level, t.area
+                );
+                probe.tmpl = Some(t);
+                probe.phase = Phase::Control;
+            } else if now - since > SCAN_TIMEOUT_SECS {
+                error!(
+                    "PROBE_STONE: FAIL — the stone's GAMEOBJECT_QUERY never answered in \
+                     {SCAN_TIMEOUT_SECS}s; the level band cannot be read"
+                );
+                probe.fails += 1;
+                probe.phase = Phase::Done;
+            }
+        }
+        Phase::Control => {
+            let (queued, _, shown) = vm_state(&script);
+            probe.fails += check(
+                "CONTROL",
+                "unqueued icon=false",
+                &format!("{}queued icon={shown}", if queued { "" } else { "un" }),
+            );
+            info!("PROBE_STONE: demoting to level {LEVEL_BELOW} for the refusal leg");
+            let _ = net.0.send(ClientCommand::Chat {
+                kind: ChatKind::Say,
+                target: None,
+                text: format!(".character level {LEVEL_BELOW}"),
+            });
+            probe.phase = Phase::WaitLevel {
+                want: LEVEL_BELOW,
+                since: now,
+                join: false,
+            };
+        }
+        Phase::WaitLevel { want, since, join } => {
+            if level == want {
+                let guid = probe.stone.unwrap_or_default();
+                uses.write(MeetingStoneUse { go_guid: guid });
+                if join {
+                    info!("PROBE_STONE: level {level} — clicking INSIDE the band");
+                    probe.phase = Phase::WaitQueue { since: now };
+                } else {
+                    info!(
+                        "PROBE_STONE: level {level} — clicking BELOW the band; nothing may go out"
+                    );
+                    probe.phase = Phase::Refused { since: now };
+                }
+            } else if now - since > LEVEL_TIMEOUT_SECS {
+                error!(
+                    "PROBE_STONE: FAIL — `.character level {want}` never took (still {level}) in \
+                     {LEVEL_TIMEOUT_SECS}s. Check the account's GM level: the command needs \
+                     SEC_DEVELOPER 5 and a probe account is 6"
+                );
+                probe.fails += 1;
+                probe.phase = Phase::Done;
+            }
+        }
+        Phase::Refused { since } => {
+            if now - since < REFUSAL_WINDOW_SECS {
+                return;
+            }
+            let (queued, _, shown) = vm_state(&script);
+            probe.fails += check(
+                "REFUSED",
+                "area=0 unqueued icon=false",
+                &format!(
+                    "area={} {}queued icon={shown}",
+                    queue.area,
+                    if queued { "" } else { "un" }
+                ),
+            );
+            // `.character level 0` is not a level; a template that ships `data[0] = 0` means
+            // "no floor", which for this leg is simply level 1.
+            let want = probe.tmpl.map_or(1, |t| t.min_level.max(1));
+            info!("PROBE_STONE: levelling to {want} for the join leg");
+            let _ = net.0.send(ClientCommand::Chat {
+                kind: ChatKind::Say,
+                target: None,
+                text: format!(".character level {want}"),
+            });
+            probe.phase = Phase::WaitLevel {
+                want,
+                since: now,
+                join: true,
+            };
+        }
+        Phase::WaitQueue { since } => {
+            if queue.area != 0 {
+                probe.joined_area = queue.area;
+                probe.phase = Phase::Joined;
+            } else if now - since > QUEUE_TIMEOUT_SECS {
+                error!(
+                    "PROBE_STONE: FAIL — no SMSG 0x295 within {QUEUE_TIMEOUT_SECS}s of the join. \
+                     Either CMSG 0x292 never left, or the server refused it (it re-checks leader / \
+                     raid / full and interact distance, never the level band)"
+                );
+                probe.fails += 1;
+                probe.phase = Phase::Done;
+            }
+        }
+        Phase::Joined => {
+            let (queued, text, shown) = vm_state(&script);
+            probe.status_text = text.clone();
+            probe.icon_shown = shown;
+            let area = probe.tmpl.map_or(0, |t| t.area);
+            probe.fails += check(
+                "JOINED",
+                &format!("area={area} queued icon=true text=yes"),
+                &format!(
+                    "area={} {}queued icon={shown} text={}",
+                    probe.joined_area,
+                    if queued { "" } else { "un" },
+                    if text.is_some() { "yes" } else { "no" }
+                ),
+            );
+            // Leg 4 — `0x5f6990` over the LIVE queue: this stone is now the one we are queued at,
+            // so its highlightable slot must refuse it.
+            probe.darkened = meeting_stone_queued(Some(area), queue.area);
+            probe.fails += check("DARKENED", "true", &probe.darkened.to_string());
+            info!("PROBE_STONE: leaving through the live VM's own CancelMeetingStoneRequest()");
+            let _ = script.eval::<()>("CancelMeetingStoneRequest()");
+            probe.phase = Phase::WaitLeft { since: now };
+        }
+        Phase::WaitLeft { since } => {
+            if queue.area == 0 {
+                let (queued, _, shown) = vm_state(&script);
+                probe.fails += check(
+                    "LEFT",
+                    "area=0 unqueued icon=false",
+                    &format!(
+                        "area={} {}queued icon={shown}",
+                        queue.area,
+                        if queued { "" } else { "un" }
+                    ),
+                );
+                probe.phase = Phase::Done;
+            } else if now - since > QUEUE_TIMEOUT_SECS {
+                error!(
+                    "PROBE_STONE: FAIL — still queued at {} {QUEUE_TIMEOUT_SECS}s after \
+                     CancelMeetingStoneRequest()",
+                    queue.area
+                );
+                probe.fails += 1;
+                probe.phase = Phase::Done;
+            }
+        }
+        Phase::Done => {
+            if probe.exited {
+                return;
+            }
+            probe.exited = true;
+            info!(
+                "PROBE_STONE: DONE stone={:#x} band={:?} area={} icon={} darkened={} text={:?} fail={}",
+                probe.stone.unwrap_or_default(),
+                probe.tmpl.map(|t| (t.min_level, t.max_level)),
+                probe.joined_area,
+                probe.icon_shown,
+                probe.darkened,
+                probe.status_text,
+                probe.fails,
+            );
+            exit.write(AppExit::Success);
+            std::thread::spawn(|| {
+                std::thread::sleep(std::time::Duration::from_secs(5));
+                warn!("PROBE_STONE: still alive 5s after AppExit — hard exit");
+                std::process::exit(0);
+            });
+        }
+    }
+}
diff --git a/crates/benilla-app/src/capture/probe_taxi.rs b/crates/benilla-app/src/capture/probe_taxi.rs
index 2a59965e..ca7d2139 100644
--- a/crates/benilla-app/src/capture/probe_taxi.rs
+++ b/crates/benilla-app/src/capture/probe_taxi.rs
@@ -145,7 +145,7 @@ fn load_expectations(mut probe: ResMut<TaxiProbe>, world_assets: Option<Res<Worl
 }
 
 // One Bevy system's full input set (the crossing-probe shape) + its self query tuple.
-#[allow(clippy::too_many_arguments, clippy::type_complexity)]
+#[allow(clippy::type_complexity)]
 fn taxi_probe(
     time: ProbeClock,
     mut probe: ResMut<TaxiProbe>,
diff --git a/crates/benilla-app/src/capture/probe_vendor_swap.rs b/crates/benilla-app/src/capture/probe_vendor_swap.rs
index 36f759b7..6093fd07 100644
--- a/crates/benilla-app/src/capture/probe_vendor_swap.rs
+++ b/crates/benilla-app/src/capture/probe_vendor_swap.rs
@@ -163,13 +163,12 @@ fn clear_log(script: &UiScript) {
     }
 }
 
-#[allow(clippy::too_many_arguments)]
 fn vendor_swap_probe(
     time: ProbeClock,
     mut probe: ResMut<VendorSwapProbe>,
     merchant: Res<MerchantOpen>,
     script: Option<NonSendMut<UiScript>>,
-    mut names: ResMut<NameCache>,
+    names: Res<NameCache>,
     panes: Res<BoothPanes>,
     images: Res<PortraitImages>,
     self_player: Query<(), With<SelfPlayer>>,
@@ -220,7 +219,7 @@ fn vendor_swap_probe(
             let (brog, dobbins) = (find(BROG_ENTRY), find(DOBBINS_ENTRY));
             // Both names must be cached before the legs read them back out of the VM — the
             // ask-once resolve is what the unit feed itself would send on the open frame.
-            let mut named = |g: Option<u64>| g.is_some_and(|g| names.resolve(g, &net).is_some());
+            let named = |g: Option<u64>| g.is_some_and(|g| names.resolve(g, &net).is_some());
             let (brog_named, dobbins_named) = (named(brog), named(dobbins));
             if brog_named && dobbins_named {
                 probe.brog = brog;
diff --git a/crates/benilla-app/src/capture/probes/dress_census.rs b/crates/benilla-app/src/capture/probes/dress_census.rs
index 1c369ae1..72e192ff 100644
--- a/crates/benilla-app/src/capture/probes/dress_census.rs
+++ b/crates/benilla-app/src/capture/probes/dress_census.rs
@@ -82,7 +82,6 @@ type DressQuery = (
 );
 
 /// One line per streamed player within [`DEFAULT_RADIUS`], contradictions first.
-#[allow(clippy::too_many_arguments)]
 fn fire_dress_census(
     mut probe: ResMut<DressCensus>,
     time: ProbeClock,
diff --git a/crates/benilla-app/src/capture/probes/ground_census.rs b/crates/benilla-app/src/capture/probes/ground_census.rs
index b48b749b..6d3c677c 100644
--- a/crates/benilla-app/src/capture/probes/ground_census.rs
+++ b/crates/benilla-app/src/capture/probes/ground_census.rs
@@ -114,7 +114,6 @@ type CensusQuery = (
 
 /// One census line per [`ground_derived`] body within [`GroundCensus::radius`] of ours, worst drop
 /// first, under a summary line naming the count that matters.
-#[allow(clippy::too_many_arguments)] // one Bevy system's full input set
 fn fire_ground_census(
     mut probe: ResMut<GroundCensus>,
     time: ProbeClock,
@@ -122,7 +121,7 @@ fn fire_ground_census(
     // reader back to the server's own tables to answer it — and the cache is already warm: it is
     // asked at first *sight* for every unit that streams in. A `None` is a name still in flight,
     // never a missing one.
-    mut names: ResMut<NameCache>,
+    names: Res<NameCache>,
     net_commands: Res<NetCommands>,
     world: benilla_world::collision::WorldCollision,
     point: benilla_world::world_point::WorldPoint,
diff --git a/crates/benilla-app/src/capture/probes/jitter.rs b/crates/benilla-app/src/capture/probes/jitter.rs
index 25e72d07..7ab7967b 100644
--- a/crates/benilla-app/src/capture/probes/jitter.rs
+++ b/crates/benilla-app/src/capture/probes/jitter.rs
@@ -242,7 +242,6 @@ fn palette_probes(rows: &[Mat4], binds: &[Vec3], radii: &[f32]) -> Vec<Vec3> {
 }
 
 /// One `JIT` line per frame for the subject: the three terms' Δ and Δ², in mm and in pixels.
-#[allow(clippy::too_many_arguments)] // one param per term the reading has to separate
 fn sample_jitter(
     mut meter: ResMut<JitterMeter>,
     time: ProbeClock,
diff --git a/crates/benilla-app/src/capture/probes/live_fps.rs b/crates/benilla-app/src/capture/probes/live_fps.rs
index ae892e24..55031b94 100644
--- a/crates/benilla-app/src/capture/probes/live_fps.rs
+++ b/crates/benilla-app/src/capture/probes/live_fps.rs
@@ -204,7 +204,6 @@ struct SamplePin<'w, 's> {
 
 /// Wait for in-world + the delay, uncap, warm, sample, print, exit — the live twin of the
 /// harness probe's `Phase::ProbeWarmup`/`Probing` arms.
-#[allow(clippy::too_many_arguments)]
 fn drive_live_fps(
     mut probe: ResMut<LiveFps>,
     time: Res<Time<bevy::time::Real>>,
diff --git a/crates/benilla-app/src/capture/probes/reveal.rs b/crates/benilla-app/src/capture/probes/reveal.rs
index abab995b..46eed249 100644
--- a/crates/benilla-app/src/capture/probes/reveal.rs
+++ b/crates/benilla-app/src/capture/probes/reveal.rs
@@ -72,7 +72,6 @@ impl Plugin for RevealAuditPlugin {
     }
 }
 
-#[allow(clippy::too_many_arguments)]
 fn drive_reveal_audit(
     mut audit: ResMut<RevealAudit>,
     progress: Res<WorldLoadProgress>,
diff --git a/crates/benilla-app/src/capture/probes/visual_census.rs b/crates/benilla-app/src/capture/probes/visual_census.rs
index fee14f3c..2b91ae03 100644
--- a/crates/benilla-app/src/capture/probes/visual_census.rs
+++ b/crates/benilla-app/src/capture/probes/visual_census.rs
@@ -120,7 +120,6 @@ type VisualQuery = (
 
 /// One line per streamed entity within [`UnitVisuals::radius`] of the body — cubes first, then
 /// everything else — under a summary line naming the count that matters.
-#[allow(clippy::too_many_arguments)] // one Bevy system's full input set
 fn fire_unit_visuals(
     mut probe: ResMut<UnitVisuals>,
     time: ProbeClock,
diff --git a/crates/benilla-app/src/char_create/mod.rs b/crates/benilla-app/src/char_create/mod.rs
index b2a22bab..820dc3fd 100644
--- a/crates/benilla-app/src/char_create/mod.rs
+++ b/crates/benilla-app/src/char_create/mod.rs
@@ -379,7 +379,6 @@ fn class_file(class: u8) -> &'static str {
 /// Its own resource rather than a [`CreateSelection`] field on purpose: ticking it there would trip
 /// that resource's change detection every frame and defeat `refresh_dynamic`'s `is_changed` gate,
 /// re-running the whole dial/panel/icon refresh 60× a second.
-#[allow(clippy::too_many_arguments)]
 fn create_input(
     buttons: Query<(Entity, &CreateAction)>,
     clicks: Res<crate::glue::GlueClicks>,
diff --git a/crates/benilla-app/src/char_create/refresh.rs b/crates/benilla-app/src/char_create/refresh.rs
index ca301ca9..508d0f19 100644
--- a/crates/benilla-app/src/char_create/refresh.rs
+++ b/crates/benilla-app/src/char_create/refresh.rs
@@ -23,7 +23,7 @@ use crate::glue::widgets::{FallbackFace, GlueDisabled, Hilight, HoverLabel, Lock
 
 /// Refill everything that follows the selection — icon rects, dial labels, info texts, faction
 /// tints, class-slot mapping — on selection change or a fresh spawn.
-#[allow(clippy::too_many_arguments, clippy::type_complexity)]
+#[allow(clippy::type_complexity)]
 pub(super) fn refresh_dynamic(
     sel: Res<CreateSelection>,
     catalog: Option<Res<CharCreate>>,
@@ -224,7 +224,7 @@ pub(super) fn refresh_dynamic(
 /// latch while a create is in flight. The screen-agnostic passes — up/down art swaps, the glue
 /// buttons' art + caption color, outline mirroring — are [`crate::glue`]'s, registered beside
 /// this in the plugin chain.
-#[allow(clippy::type_complexity, clippy::too_many_arguments)]
+#[allow(clippy::type_complexity)]
 pub(super) fn refresh_hover(
     sel: Res<CreateSelection>,
     catalog: Option<Res<CharCreate>>,
diff --git a/crates/benilla-app/src/char_create/screen.rs b/crates/benilla-app/src/char_create/screen.rs
index d0c52211..720d20e6 100644
--- a/crates/benilla-app/src/char_create/screen.rs
+++ b/crates/benilla-app/src/char_create/screen.rs
@@ -37,7 +37,6 @@ const SCREEN_Z: i32 = 1100;
 
 // ── Spawn ────────────────────────────────────────────────────────────────────────────────────────
 
-#[allow(clippy::too_many_arguments)]
 pub(super) fn enter_create(
     mut commands: Commands,
     assets: Res<AssetServer>,
diff --git a/crates/benilla-app/src/char_select/addons.rs b/crates/benilla-app/src/char_select/addons.rs
index fb3dccf1..5038798a 100644
--- a/crates/benilla-app/src/char_select/addons.rs
+++ b/crates/benilla-app/src/char_select/addons.rs
@@ -516,13 +516,13 @@ fn status_label<'a>(strings: &'a GlueStrings, token: &'a str) -> &'a str {
 }
 
 /// Flip the *Load out of date AddOns* box: the `checkAddonVersion` CVar **inverted** (1292 §2,
-/// byte-verified — ticked = `"0"`). Written through [`UiScript::set_cvar_engine`] so it rides the
-/// change queue like a Lua `SetCVar` and the host's sync persists it (the minimap-zoom pattern) —
-/// nothing else to do: the statuses repaint from [`drive_addons_panel`]'s per-frame mirror, no
-/// rescan, because the gate re-reads the flag per query (1292 §2.2).
-fn toggle_force_load(script: &mut UiScript) {
-    let checking = script.cvar("checkAddonVersion").is_none_or(|v| v != "0");
-    script.set_cvar_engine("checkAddonVersion", if checking { "0" } else { "1" });
+/// byte-verified — ticked = `"0"`). A host write into the registry (2303), which is what
+/// persists it and what the VM's mirror learns — nothing else to do: the statuses repaint from
+/// [`drive_addons_panel`]'s per-frame mirror, no rescan, because the gate re-reads the flag per
+/// query (1292 §2.2).
+fn toggle_force_load(cvars: &mut crate::cvars::Cvars) {
+    let checking = cvars.addon_version_check();
+    cvars.set("checkAddonVersion", if checking { "0" } else { "1" });
 }
 
 /// The panel's clickable parts.
@@ -572,14 +572,14 @@ pub(super) struct ScrollBand;
 ///
 /// Ordered before the select screen's own click handling so a click that lands on the panel is
 /// never also read as a click on the screen behind it.
-#[allow(clippy::too_many_arguments)]
 pub(super) fn drive_addons_panel(
     mut commands: Commands,
     mut panel: ResMut<AddonsPanel>,
     art: Res<GlueArt>,
     assets: Res<AssetServer>,
     strings: Option<Res<GlueStrings>>,
-    mut script: Option<NonSendMut<UiScript>>,
+    script: Option<NonSendMut<UiScript>>,
+    mut cvars: ResMut<crate::cvars::Cvars>,
     keys: Res<ButtonInput<KeyCode>>,
     mouse: Res<ButtonInput<MouseButton>>,
     mut wheel: MessageReader<bevy::input::mouse::MouseWheel>,
@@ -642,9 +642,7 @@ pub(super) fn drive_addons_panel(
             AddonsAction::ForceLoad => {
                 // No VM (a bare test world / a capture): nothing to write to and nothing the
                 // walk would read differently — the box is inert, honestly.
-                if let Some(script) = script.as_deref_mut() {
-                    toggle_force_load(script);
-                }
+                toggle_force_load(&mut cvars);
             }
         }
     }
@@ -1599,7 +1597,6 @@ fn spawn_panel(
 /// the row's TOPLEFT at (−14, 0), spawned as the row strip's child so the anchor is structural.
 /// `## URL` rides as an extra line (1197: information, not a launch button). A MIXED checkbox
 /// hover shows `ENABLED_FOR_SOME` alone — the reference's GlueTooltip split, on the same box.
-#[allow(clippy::too_many_arguments)]
 fn spawn_tooltip(
     parent: &mut ChildSpawnerCommands,
     art: &GlueArt,
@@ -2009,28 +2006,36 @@ mod tests {
         let _ = std::fs::remove_dir_all(&tmp);
     }
 
-    /// The force-load box IS the `checkAddonVersion` CVar inverted, and a toggle goes through
-    /// the engine write ([`UiScript::set_cvar_engine`]) so it rides the change queue — that is
-    /// the whole persistence story (the host's sync drains the queue and dirties the config);
-    /// the panel itself only repaints from its per-frame mirror, rescanning nothing (1292 §2.2).
+    /// The force-load box IS the `checkAddonVersion` CVar inverted, and a toggle is a host
+    /// write into the registry (2303) — that is the whole persistence story (the write dirties
+    /// the config and reaches the VM's mirror through the outbox); the panel itself only
+    /// repaints from its per-frame mirror, rescanning nothing (1292 §2.2).
     #[test]
-    fn the_force_load_box_flips_the_cvar_through_the_engine_queue() {
-        let mut script = UiScript::new().unwrap();
-        script.register_cvars([("checkAddonVersion", "1")]);
+    fn the_force_load_box_flips_the_cvar_in_the_registry() {
+        let mut cvars = crate::cvars::Cvars::default();
+        assert!(
+            cvars.addon_version_check(),
+            "the registrar default: check ON"
+        );
 
-        toggle_force_load(&mut script);
+        toggle_force_load(&mut cvars);
         assert_eq!(
-            script.take_cvar_changes(),
-            vec![("checkAddonVersion".to_string(), "0".to_string())],
+            cvars.get("checkAddonVersion"),
+            Some("0"),
             "tick: check ON (\"1\") flips to \"0\" — box ticked = version gate open"
         );
-        assert_eq!(script.cvar("checkAddonVersion").as_deref(), Some("0"));
-
-        toggle_force_load(&mut script);
+        assert!(!cvars.addon_version_check());
         assert_eq!(
-            script.take_cvar_changes(),
-            vec![("checkAddonVersion".to_string(), "1".to_string())],
-            "untick: back to the registrar default, and the queue carries it again"
+            cvars.take_events().len(),
+            1,
+            "a host write is an accepted move — the config dirties and the mirror learns it"
+        );
+
+        toggle_force_load(&mut cvars);
+        assert_eq!(
+            cvars.get("checkAddonVersion"),
+            Some("1"),
+            "untick: back to the registrar default"
         );
     }
 
diff --git a/crates/benilla-app/src/char_select/dialog.rs b/crates/benilla-app/src/char_select/dialog.rs
index 57f49258..132c6c81 100644
--- a/crates/benilla-app/src/char_select/dialog.rs
+++ b/crates/benilla-app/src/char_select/dialog.rs
@@ -88,7 +88,7 @@ struct DialogUi;
 /// Okay (enabled only while the typed text matches) sends the delete; Cancel/Esc close; Enter
 /// confirms when armed. Runs before the list refresh so a successful delete's roster update
 /// repaints the same frame it lands.
-#[allow(clippy::too_many_arguments, clippy::type_complexity)]
+#[allow(clippy::type_complexity)]
 pub(super) fn drive_delete_dialog(
     mut commands: Commands,
     mut dialog: ResMut<DeleteDialog>,
diff --git a/crates/benilla-app/src/char_select/input.rs b/crates/benilla-app/src/char_select/input.rs
index 97224ae7..3e92c724 100644
--- a/crates/benilla-app/src/char_select/input.rs
+++ b/crates/benilla-app/src/char_select/input.rs
@@ -24,7 +24,7 @@ const DOUBLE_CLICK_SECS: f32 = 0.4;
 /// back/escape (return to the login screen — decision 0539, retiring 0465 §6's exit-the-client
 /// collapse), arrow-key cycling. Inert while the delete dialog is up (it owns the keyboard and
 /// sits over the buttons).
-#[allow(clippy::too_many_arguments, clippy::type_complexity)]
+#[allow(clippy::type_complexity)]
 pub(super) fn select_input(
     buttons: Query<(Entity, &SelectAction)>,
     clicks: Res<crate::glue::GlueClicks>,
diff --git a/crates/benilla-app/src/char_select/mod.rs b/crates/benilla-app/src/char_select/mod.rs
index 767218d1..45210095 100644
--- a/crates/benilla-app/src/char_select/mod.rs
+++ b/crates/benilla-app/src/char_select/mod.rs
@@ -65,6 +65,20 @@ pub(crate) enum ClientState {
     InWorld,
 }
 
+/// **The one "only while in the world" gate** (decision 2265 §C3). A system that has no business
+/// at a glue screen — an input reader, a world-packet feed, a per-character file watcher — joins
+/// this set instead of carrying its own `run_if(in_state(ClientState::InWorld))`: twenty-odd
+/// copies of that condition said one thing in twenty-odd places, and the condition a set carries
+/// ANDs with a member's own, so a member keeps whatever else it needs (the controller's
+/// capture-mode gate, say) and the conversion is exact.
+///
+/// Configured once, in [`CharSelectPlugin`] — the state's home — for `Update`, the only schedule
+/// a member lives in. A member in another schedule means configuring the set *there* as well
+/// (a set's conditions are per schedule; an unconfigured set gates nothing), never a fresh
+/// `run_if` at the site.
+#[derive(SystemSet, Debug, Clone, Copy, PartialEq, Eq, Hash)]
+pub(crate) struct InWorldGated;
+
 /// The character-select subsystem: the state machine + the select screen.
 pub(crate) struct CharSelectPlugin {
     /// The screen this session opens on.
@@ -94,6 +108,8 @@ fn publish_world_live(
 impl Plugin for CharSelectPlugin {
     fn build(&self, app: &mut App) {
         app.insert_state(self.start)
+            // The in-world gate, configured beside the state it reads (see [`InWorldGated`]).
+            .configure_sets(Update, InWorldGated.run_if(in_state(ClientState::InWorld)))
             .init_resource::<Roster>()
             // **The engine's world-existence bit** (1160's wire (b)): the session owner is this
             // module, so this module tells the world whether there is one. Ordered ahead of every
@@ -105,8 +121,14 @@ impl Plugin for CharSelectPlugin {
             )
             .init_resource::<dialog::DeleteDialog>()
             .init_resource::<addons::AddonsPanel>()
-            .add_systems(OnEnter(ClientState::CharSelect), screen::enter_select)
-            .add_systems(OnExit(ClientState::CharSelect), screen::exit_select)
+            .add_systems(
+                OnEnter(ClientState::CharSelect),
+                (screen::enter_select, stamp_select_entry),
+            )
+            .add_systems(
+                OnExit(ClientState::CharSelect),
+                (screen::exit_select, clear_select_entry),
+            )
             .add_systems(Update, (debug_glue_roundtrip, debug_logout_smoke))
             .add_systems(
                 Update,
@@ -151,6 +173,11 @@ impl Plugin for CharSelectPlugin {
                     )
                         .chain()
                         .before(crate::glue::GlueVisuals)
+                        // After the UI tick: one member holds the VM (the addons panel reads
+                        // the manifest through it), and every VM holder in `Update` declares
+                        // its side of the tick (decision 2304). A glue screen has no push the
+                        // tick must see, so the whole chain takes the drain side.
+                        .after(crate::ui_script::UiInput)
                         .run_if(in_state(ClientState::CharSelect)),
                 )
                     .chain()
@@ -385,9 +412,9 @@ fn last_character_row(value: &str) -> Option<usize> {
 /// Out of range falls back to the **first** row, never to the nearest one: a character deleted
 /// since you last played, or a realm with fewer characters, puts you at the top of the list rather
 /// than beside where the old row used to be.
-fn remembered_row(persist: &crate::cvars::CvarPersist, len: usize) -> usize {
-    persist
-        .stored(CVAR_LAST_CHARACTER)
+fn remembered_row(cvars: &crate::cvars::Cvars, len: usize) -> usize {
+    cvars
+        .get(CVAR_LAST_CHARACTER)
         .and_then(last_character_row)
         .filter(|&row| row < len)
         .unwrap_or(0)
@@ -401,42 +428,28 @@ fn remembered_row(persist: &crate::cvars::CvarPersist, len: usize) -> usize {
 /// and clicks and arrow keys reach `0x472740` without ever going near it. [`Roster::pending_pick`]
 /// is exactly that moment for us, so [`Roster::pending_index`] is what this reads.
 ///
-/// The write goes through [`UiScript::set_cvar_engine`] so it rides the change queue like a Lua
-/// `SetCVar` and the host's sync persists it — the minimap-zoom pattern (1131), already used from
-/// this screen by the AddOns panel's force-load box (1293). **One divergence, stated:** the
+/// The write is a host write into the registry ([`crate::cvars::Cvars::set`]), which is what
+/// persists it and what the VM's mirror learns (2303) — the shape the AddOns panel's force-load
+/// box uses from this same screen (1293). **One divergence, stated:** the
 /// reference flushes `Config.wtf` synchronously in the same call (`0x46b6f6`), while ours reaches
 /// disk on the exit edge with every other CVar (1528) — so a crash between entering the world and
 /// quitting loses the memory, where the reference would not. That is the CVar store's shape, not
 /// this key's, and changing it is an autosave design (1528's own "what this does NOT fix").
 fn persist_last_character(
     roster: Res<Roster>,
-    mut script: Option<NonSendMut<benilla_ui::script::UiScript>>,
-    // Memory about the VM's CVar table, so it dies with the VM (decision 1290). A bare `Local`
-    // here would be betting that `cvars::sync_cvars`'s per-VM seed carries this key into the next
-    // table — true today, and exactly the "correct against one VM, silently wrong against the
-    // next" shape 1290 built its structural gate to refuse. `get_for` because this system also
-    // runs while there is no VM at all.
-    mut mirrored: Local<crate::ui_script::VmMemo<Option<usize>>>,
+    mut cvars: ResMut<crate::cvars::Cvars>,
+    // A plain `Local` is honest here since 2303: the registry outlives every VM, so the row
+    // written once stays written — the per-VM memo this used to need was betting on the seed.
+    mut mirrored: Local<Option<usize>>,
 ) {
     let Some(row) = roster.pending_index() else {
         return; // nobody is entering the world — nothing to remember
     };
-    let mirrored = mirrored.get_for(script.as_deref());
     if *mirrored == Some(row) {
         return;
     }
-    let Some(script) = script.as_deref_mut() else {
-        return;
-    };
-    script.set_cvar_engine(CVAR_LAST_CHARACTER, &last_character_value(row));
-    // Latch only once the table actually took it. An engine write to a name the host has not
-    // registered yet is a deliberate silent no-op (`script::cvars::set_from_engine`), and the
-    // per-VM seed that registers it runs in `cvars::sync_cvars` — a sibling `Update` system with
-    // no ordering against this one. Latching on the frame the write was dropped would swallow
-    // exactly one entry, and it would be the session's first.
-    if script.cvar(CVAR_LAST_CHARACTER).is_some() {
-        *mirrored = Some(row);
-    }
+    cvars.set(CVAR_LAST_CHARACTER, &last_character_value(row));
+    *mirrored = Some(row);
 }
 
 /// Ask the parked IO thread to log in as `guid` (the pick channel) and remember it as pending.
@@ -456,11 +469,11 @@ fn apply_roster_policy(
     mut msgs: MessageReader<CharListMessage>,
     mut roster: ResMut<Roster>,
     pick: Res<CharPick>,
-    // The remembered row (decision 1622) — read off the persist state rather than the VM's table
-    // because it is a value the *file* owns and the session only mirrors, and because reading it
+    // The remembered row (decision 1622) — read off the registry rather than the VM's table
+    // because the registry is the store that outlives every VM (2303), and because reading it
     // here keeps this system send-able. It is consulted exactly once per process: `selected` is
     // `None` only before the first roster lands.
-    persist: Res<crate::cvars::CvarPersist>,
+    cvars: Res<crate::cvars::Cvars>,
     // Is the character pick already spoken for? Present only when a rig is driving this run
     // (decision 1174's always-present run fact) — absent in every ordinary run, which is the
     // player answer and the one this screen was written for.
@@ -521,7 +534,7 @@ fn apply_roster_policy(
             // reference reads the CVar in the char-list rebuild itself (`0x4724d0` → `0x472740`),
             // not once at startup, so the screen always opens on whoever you last entered the
             // world as. Out of range falls back to the first row; see `remembered_row`.
-            let row = remembered_row(&persist, roster.chars.len());
+            let row = remembered_row(&cvars, roster.chars.len());
             // Greppable, and it names the character rather than only the index: "the first row
             // happened to be right" and "the memory worked" are the same picture on screen, and
             // this line is the only thing that tells them apart in a log.
@@ -783,7 +796,6 @@ fn debug_glue_roundtrip(
 /// hand-written `AppExit` from `Update` skipped that question for this smoke's whole life, and the
 /// bug it would have caught — every saved variable, every addon file and the camera pose lost on
 /// every window close — shipped underneath it.
-#[allow(clippy::too_many_arguments)] // a smoke test that drives the whole round trip
 fn debug_logout_smoke(
     state: Res<State<ClientState>>,
     player: Res<crate::player::Player>,
@@ -822,7 +834,7 @@ fn debug_logout_smoke(
         // world-live falling edge, not the state edge), so the probe was reading the count before
         // the thing it is checking had happened, and reporting the world it had just left.
         //
-        // It cost more than a wrong line: 1291 wrote the reading up as a live contradiction of
+        // It cost more than a wrong line: 2277 wrote the reading up as a live contradiction of
         // 0777's release-world claim, on the strength of it reproducing identically on an older
         // commit — which it did, because an instrument that measures too early does that reliably.
         // A number that is always wrong teaches everyone to skip the line (0777's own lesson about
@@ -844,7 +856,7 @@ fn debug_logout_smoke(
         },
         4 if *state.get() == ClientState::InWorld && player.active && now - *mark > 3.0 => {
             // **The suppressor reading is the point of the second entry, not a decoration on it**
-            // (B306, decision 1542). This leg has crossed the boundary on every run since 1291 and
+            // (B306, decision 1542). This leg has crossed the boundary on every run since 2277 and
             // could only ever report that it *happened* — tiles, UI rebuilds, error counts — none
             // of which a character who re-entered unable to move would disturb. `scripts/smoke.sh`
             // fails on anything but `none`, and separately reports whether the run's logout was
@@ -954,6 +966,31 @@ fn debug_select_walk(
     }
 }
 
+/// When the select screen came up: `Time::elapsed_secs()` at `OnEnter(CharSelect)`, gone again
+/// at `OnExit`. The one clock the screen's "a few seconds after the screen is up" instruments
+/// ([`debug_select_dialog`], [`debug_select_addons`], [`debug_select_shot`]) measure from, in
+/// place of a `Local` each stamped on its own first run (decision 2265 §C3). Those three run
+/// under `in_state(CharSelect)` in `Update`, so the resource is always there when they read it.
+#[derive(Resource, Clone, Copy)]
+struct CharSelectEnteredAt(f32);
+
+impl CharSelectEnteredAt {
+    /// Seconds the screen has been up.
+    fn elapsed(&self, time: &Time) -> f32 {
+        time.elapsed_secs() - self.0
+    }
+}
+
+/// `OnEnter(CharSelect)`: stamp the screen's entry.
+fn stamp_select_entry(mut commands: Commands, time: Res<Time>) {
+    commands.insert_resource(CharSelectEnteredAt(time.elapsed_secs()));
+}
+
+/// `OnExit(CharSelect)`: the screen is down, so is its clock.
+fn clear_select_entry(mut commands: Commands) {
+    commands.remove_resource::<CharSelectEnteredAt>();
+}
+
 /// The shot instrument's delete-dialog dial (`WOW_CHARSELECT_DIALOG=<typed>`): open the
 /// typed-confirm dialog for the selected character a few seconds after the screen is up, with
 /// `<typed>` pre-typed (may be empty) — so the dialog's geometry (the ChatInputBorder edit box,
@@ -963,7 +1000,7 @@ fn debug_select_dialog(
     roster: Res<Roster>,
     mut dialog: ResMut<dialog::DeleteDialog>,
     time: Res<Time>,
-    mut entered_at: Local<Option<f32>>,
+    entered_at: Res<CharSelectEnteredAt>,
     mut done: Local<bool>,
 ) {
     if *done {
@@ -973,8 +1010,7 @@ fn debug_select_dialog(
         *done = true;
         return;
     };
-    let start = *entered_at.get_or_insert(time.elapsed_secs());
-    if time.elapsed_secs() - start < 4.0 {
+    if entered_at.elapsed(&time) < 4.0 {
         return;
     }
     let Some(c) = roster.selected_char() else {
@@ -995,7 +1031,7 @@ fn debug_select_addons(
     roster: Res<Roster>,
     mut panel: ResMut<addons::AddonsPanel>,
     time: Res<Time>,
-    mut entered_at: Local<Option<f32>>,
+    entered_at: Res<CharSelectEnteredAt>,
     mut done: Local<bool>,
 ) {
     if *done {
@@ -1005,8 +1041,7 @@ fn debug_select_addons(
         *done = true;
         return;
     }
-    let start = *entered_at.get_or_insert(time.elapsed_secs());
-    if time.elapsed_secs() - start < 4.0 {
+    if entered_at.elapsed(&time) < 4.0 {
         return;
     }
     if roster.chars.is_empty() {
@@ -1041,7 +1076,7 @@ const SELECT_SHOT_AT: f32 = 8.0;
 fn debug_select_shot(
     mut commands: Commands,
     time: Res<Time>,
-    mut entered_at: Local<Option<f32>>,
+    entered_at: Res<CharSelectEnteredAt>,
     mut done: Local<bool>,
 ) {
     if *done {
@@ -1055,8 +1090,7 @@ fn debug_select_shot(
         .ok()
         .and_then(|v| v.parse::<f32>().ok())
         .unwrap_or(SELECT_SHOT_AT);
-    let start = *entered_at.get_or_insert(time.elapsed_secs());
-    if time.elapsed_secs() - start < at {
+    if entered_at.elapsed(&time) < at {
         return;
     }
     use bevy::render::view::screenshot::{save_to_disk, Screenshot};
@@ -1405,8 +1439,8 @@ mod tests {
             .init_resource::<Roster>()
             .insert_resource(CharPick(tx))
             .insert_resource(match stored {
-                Some(v) => crate::cvars::CvarPersist::with_stored(CVAR_LAST_CHARACTER, v),
-                None => crate::cvars::CvarPersist::default(),
+                Some(v) => crate::cvars::Cvars::with_value(CVAR_LAST_CHARACTER, v),
+                None => crate::cvars::Cvars::default(),
             })
             .add_message::<CharListMessage>()
             .add_message::<AppExit>()
@@ -1528,10 +1562,7 @@ mod tests {
         app.add_plugins(MinimalPlugins)
             .init_resource::<Roster>()
             .insert_resource(CharPick(tx))
-            .insert_resource(crate::cvars::CvarPersist::with_stored(
-                CVAR_LAST_CHARACTER,
-                "0",
-            ))
+            .insert_resource(crate::cvars::Cvars::with_value(CVAR_LAST_CHARACTER, "0"))
             .add_message::<CharListMessage>()
             .add_message::<AppExit>()
             .add_systems(Update, apply_roster_policy);
@@ -1581,14 +1612,11 @@ mod tests {
     #[test]
     fn only_entering_the_world_writes_the_cvar() {
         let (tx, _rx) = crossbeam_channel::unbounded();
-        let script = benilla_ui::script::UiScript::new().unwrap();
-        script.register_cvars([(CVAR_LAST_CHARACTER, "0")]);
-
         let mut app = App::new();
         app.add_plugins(MinimalPlugins)
             .init_resource::<Roster>()
+            .init_resource::<crate::cvars::Cvars>()
             .insert_resource(CharPick(tx))
-            .insert_non_send_resource(script)
             .add_systems(Update, persist_last_character);
         {
             let mut roster = app.world_mut().resource_mut::<Roster>();
@@ -1602,96 +1630,35 @@ mod tests {
         }
         app.update();
         assert!(
-            app.world_mut()
-                .non_send_resource_mut::<benilla_ui::script::UiScript>()
-                .take_cvar_changes()
-                .is_empty(),
+            !app.world().resource::<crate::cvars::Cvars>().has_events(),
             "a selection alone must NOT be remembered — the reference writes nothing here",
         );
 
         // …and now Enter World, on the row that was selected.
         app.world_mut().resource_mut::<Roster>().pending_pick = Some(2);
         app.update();
+        let moved: Vec<(String, String)> = app
+            .world_mut()
+            .resource_mut::<crate::cvars::Cvars>()
+            .take_events()
+            .into_iter()
+            .map(|e| (e.name, e.new))
+            .collect();
         assert_eq!(
-            app.world_mut()
-                .non_send_resource_mut::<benilla_ui::script::UiScript>()
-                .take_cvar_changes(),
+            moved,
             vec![(CVAR_LAST_CHARACTER.to_string(), "1".to_string())],
-            "guid 2 sits at row 1, and the row is what rides the queue",
+            "guid 2 sits at row 1, and the row is what the registry took",
         );
-    }
-
-    /// **The 1290 property, at this call site.** A login replaces the VM, and the memo of "the
-    /// table already says 1" must die with it — otherwise the mirror stays quiet against a table
-    /// that has never been told, and the memory survives only for as long as some *other* module
-    /// happens to carry the key across (`cvars::sync_cvars`'s saved-base seed does, today).
-    #[test]
-    fn a_replaced_vm_is_told_the_remembered_row_again() {
-        let (tx, _rx) = crossbeam_channel::unbounded();
-        let fresh = || {
-            let s = benilla_ui::script::UiScript::new().unwrap();
-            s.register_cvars([(CVAR_LAST_CHARACTER, "0")]);
-            s
-        };
-        let mut app = App::new();
-        app.add_plugins(MinimalPlugins)
-            .init_resource::<Roster>()
-            .insert_resource(CharPick(tx))
-            .insert_non_send_resource(fresh())
-            .add_systems(Update, persist_last_character);
-        {
-            let mut roster = app.world_mut().resource_mut::<Roster>();
-            roster.chars = vec![character(1, "Kerwind"), character(2, "Xero")];
-            roster.pending_pick = Some(2);
-        }
+        // Steady frames stay quiet, and the next VM is seeded from the registry — which is what
+        // replaced the per-VM memo this system used to carry (1290's property, now held by the
+        // store outliving the VM, 2303).
         app.update();
-        app.update(); // steady frames stay quiet — the memo does its job within one VM
-
-        // The login edge: `ui_script::lifecycle` drops the VM and installs a boot VM in its place.
-        app.world_mut()
-            .insert_non_send_resource::<benilla_ui::script::UiScript>(fresh());
-        app.update();
-
-        assert_eq!(
-            app.world_mut()
-                .non_send_resource_mut::<benilla_ui::script::UiScript>()
-                .take_cvar_changes(),
-            vec![(CVAR_LAST_CHARACTER.to_string(), "1".to_string())],
-            "the new VM's table must be told the row too — a memo that outlived the old one \
-             would leave this table on its default and lose the memory at quit",
-        );
-    }
-
-    /// The write must survive the frame in which the host has not registered its table yet: an
-    /// engine write to an unregistered name is a deliberate silent no-op, so latching on it would
-    /// swallow the session's FIRST entry — the one launch-to-launch memory exists for.
-    #[test]
-    fn an_entry_made_before_the_cvar_table_exists_is_not_lost() {
-        let (tx, _rx) = crossbeam_channel::unbounded();
-        let mut app = App::new();
-        app.add_plugins(MinimalPlugins)
-            .init_resource::<Roster>()
-            .insert_resource(CharPick(tx))
-            .insert_non_send_resource(benilla_ui::script::UiScript::new().unwrap())
-            .add_systems(Update, persist_last_character);
-        {
-            let mut roster = app.world_mut().resource_mut::<Roster>();
-            roster.chars = vec![character(1, "Kerwind"), character(2, "Xero")];
-            roster.pending_pick = Some(2);
-        }
-
-        app.update(); // the table has no such name yet — the write is dropped
-        app.world_mut()
-            .non_send_resource_mut::<benilla_ui::script::UiScript>()
-            .register_cvars([(CVAR_LAST_CHARACTER, "0")]);
-        app.update(); // ...and the next frame must still catch it up
-
-        assert_eq!(
-            app.world_mut()
-                .non_send_resource_mut::<benilla_ui::script::UiScript>()
-                .take_cvar_changes(),
-            vec![(CVAR_LAST_CHARACTER.to_string(), "1".to_string())],
-        );
+        let cvars = app.world().resource::<crate::cvars::Cvars>();
+        assert!(!cvars.has_events());
+        assert!(cvars
+            .vm_seed()
+            .iter()
+            .any(|r| r.name == CVAR_LAST_CHARACTER && r.value == "1"));
     }
 
     /// The reverse arrival order (result first, roster after) stays armed and is answered by the
diff --git a/crates/benilla-app/src/char_select/refresh.rs b/crates/benilla-app/src/char_select/refresh.rs
index a540dc2d..3d60f2d4 100644
--- a/crates/benilla-app/src/char_select/refresh.rs
+++ b/crates/benilla-app/src/char_select/refresh.rs
@@ -18,7 +18,7 @@ use super::{class_name, Roster};
 /// Refill the row texts + visibility, the selected name, and the realm banner whenever the roster
 /// changes (a fresh enum, a selection move) — or when the screen was just (re)spawned (returning
 /// from the create screen finds an unchanged roster; the fresh, empty tree must still fill).
-#[allow(clippy::type_complexity, clippy::too_many_arguments)]
+#[allow(clippy::type_complexity)]
 pub(super) fn refresh_list(
     roster: Res<Roster>,
     areas: Option<Res<AreaTableRes>>,
diff --git a/crates/benilla-app/src/char_select/screen.rs b/crates/benilla-app/src/char_select/screen.rs
index 337ea530..7a8f64c7 100644
--- a/crates/benilla-app/src/char_select/screen.rs
+++ b/crates/benilla-app/src/char_select/screen.rs
@@ -98,7 +98,6 @@ pub(super) fn enter_select(mut preview: ResMut<GluePreview>) {
 /// Spawn the screen tree once its prerequisites exist — and upgrade an artless early spawn the
 /// moment the client art lands (despawn + respawn; the tree is cheap and static). With no client
 /// data at all the artless tree still spawns after a short grace (the graceful-absence posture).
-#[allow(clippy::too_many_arguments)]
 pub(super) fn materialize_screen(
     mut commands: Commands,
     existing: Query<(Entity, &CharSelectUi)>,
@@ -148,7 +147,6 @@ pub(super) fn materialize_screen(
     }
 }
 
-#[allow(clippy::too_many_arguments)]
 fn spawn_screen(
     commands: &mut Commands,
     assets: &AssetServer,
diff --git a/crates/benilla-app/src/chat_bubble.rs b/crates/benilla-app/src/chat_bubble.rs
index db334cd5..e7c21bc0 100644
--- a/crates/benilla-app/src/chat_bubble.rs
+++ b/crates/benilla-app/src/chat_bubble.rs
@@ -376,7 +376,7 @@ fn load_bubble_art(
 /// pieces, tail, wrapped chatType-colored text — bottom-seated on the projected anchor.
 /// Runs after [`VPlateSet`] (the spawn gate reads this frame's plate verdict), inside the
 /// [`UiQuadAppend`] window.
-#[allow(clippy::too_many_arguments, clippy::type_complexity)] // one Bevy system's full input set
+#[allow(clippy::type_complexity)] // one Bevy system's full input set
 fn drive_bubbles(
     mut queue: ResMut<BubbleQueue>,
     mut bubbles: ResMut<Bubbles>,
@@ -609,7 +609,6 @@ struct Pending {
 
 /// Append one bubble's draw list: the Backdrop pieces (bg fill inset by the border-unit +
 /// the 8-piece edge), the tail square, and the wrapped, centered, chatType-colored text.
-#[allow(clippy::too_many_arguments)] // the draw inputs + the jitter trace's decomposition
 fn draw_bubble(
     atlas: &mut UiFontAtlas,
     quads: &mut UiQuads,
@@ -813,8 +812,18 @@ pub(crate) struct BubbleSet;
 
 pub(crate) struct ChatBubblePlugin;
 
+/// The two bubble switches' change callback (1139, 2303): flags, like every other pair.
+pub(crate) fn on_cvar(ev: On<crate::cvars::CvarChanged>, mut bubbles: ResMut<BubbleConfig>) {
+    match ev.key().as_str() {
+        "chatbubbles" => bubbles.all = ev.flag(),
+        "chatbubblesparty" => bubbles.party = ev.flag(),
+        _ => {}
+    }
+}
+
 impl Plugin for ChatBubblePlugin {
     fn build(&self, app: &mut App) {
+        app.add_observer(on_cvar);
         app.init_resource::<BubbleQueue>()
             .init_resource::<BubbleConfig>()
             .init_resource::<Bubbles>()
diff --git a/crates/benilla-app/src/chr_classes.rs b/crates/benilla-app/src/chr_classes.rs
index 69b5c1ac..098754f6 100644
--- a/crates/benilla-app/src/chr_classes.rs
+++ b/crates/benilla-app/src/chr_classes.rs
@@ -1,14 +1,16 @@
 //! `ChrClasses.dbc`, loaded once and read by everything that asks the client a question about a
 //! class.
 //!
-//! Two consumers today and they are unrelated to each other — [`crate::ui_pet_book`] wants field
-//! 4's pet name token, `UnitHasRelicSlot` wants field 16's relic flag — which is exactly why the
-//! table does not live inside either of them. It used to live in the pet book, back when the pet
+//! Three consumers today and they are unrelated to each other — [`crate::ui_pet_book`] wants field
+//! 4's pet name token, `UnitHasRelicSlot` wants field 16's relic flag, and
+//! [`crate::spell_mods`] wants field 15's class spell-family — which is exactly why the
+//! table does not live inside any of them. It used to live in the pet book, back when the pet
 //! token was the only column anyone read.
 //!
-//! The resource is **absent**, not empty, when the load fails. Both readers then fall to the
-//! reference's own degraded answer (`"PET"` for the token, no relic slot for any class), so a
-//! missing table costs a warlock the word "Demon" and a paladin their relic branches rather than
+//! The resource is **absent**, not empty, when the load fails. Every reader then falls to the
+//! reference's own degraded answer (`"PET"` for the token, no relic slot for any class, family 0
+//! — which the modifier gate's first conjunct refuses), so a missing table costs a warlock the
+//! word "Demon", a paladin their relic branches and everyone their talent modifiers rather than
 //! taking the client down.
 
 use bevy::prelude::*;
@@ -39,8 +41,9 @@ fn load_chr_classes(mut commands: Commands, assets: Option<Res<WorldAssets>>) {
         Ok(table) => commands.insert_resource(ChrClassTable(table)),
         Err(e) => warn!(
             "chr_classes: ChrClasses.dbc failed to load — every pet book tab reads the client's \
-             own \"PET\" fallback, so a warlock's says Pet rather than Demon, and no class reads \
-             as having a relic slot: {e:#}"
+             own \"PET\" fallback, so a warlock's says Pet rather than Demon, no class reads \
+             as having a relic slot, and no talent spell modifier can apply (the gate has no \
+             class family to match): {e:#}"
         ),
     }
 }
diff --git a/crates/benilla-app/src/combat_text/mod.rs b/crates/benilla-app/src/combat_text/mod.rs
index 7a3f2c59..d4cdacb9 100644
--- a/crates/benilla-app/src/combat_text/mod.rs
+++ b/crates/benilla-app/src/combat_text/mod.rs
@@ -233,7 +233,6 @@ fn free_slot(texts: &[WorldText], anchor: Entity) -> Option<u8> {
 /// living into glyph quads appended to [`UiQuads`] after the script extract. Ordering (the
 /// [`UiQuadAppend`] set, after [`UiInput`]) guarantees the mesh rebuild never lands between the
 /// script's replace and our append — see `ui_pass`.
-#[allow(clippy::too_many_arguments)] // one Bevy system's full input set
 pub(crate) fn float_combat_text(
     mut spawns: MessageReader<CombatTextSpawn>,
     mut texts: ResMut<WorldTexts>,
@@ -586,10 +585,21 @@ fn melee_impact_text(
 /// inside the append window the mesh rebuild waits on).
 pub(crate) struct CombatTextPlugin;
 
+/// The damage-text rows' change callback (decision 2303): three flags.
+pub(crate) fn on_cvar(ev: On<crate::cvars::CvarChanged>, mut gates: ResMut<DamageTextGates>) {
+    match ev.key().as_str() {
+        "combatdamage" => gates.combat_damage = ev.flag(),
+        "petmeleedamage" => gates.pet_melee = ev.flag(),
+        "petspelldamage" => gates.pet_spell = ev.flag(),
+        _ => {}
+    }
+}
+
 impl Plugin for CombatTextPlugin {
     fn build(&self, app: &mut App) {
         // The Update append window (see [`UiQuadAppend`]): after the camera controller, and
         // projecting through the camera's FRESH Transform (not the stale propagated global).
+        app.add_observer(on_cvar);
         app.init_resource::<WorldTexts>()
             .init_resource::<DamageTextFont>()
             .init_resource::<DamageTextGates>()
diff --git a/crates/benilla-app/src/console.rs b/crates/benilla-app/src/console.rs
new file mode 100644
index 00000000..00bb6a44
--- /dev/null
+++ b/crates/benilla-app/src/console.rs
@@ -0,0 +1,412 @@
+//! The in-game **console command registry** (decision 2303) — the reference's `ConsoleCommand`
+//! table, host side: `ConsoleCommandRegister 0x63f9e0` over a `TSExplicitList<CONSOLECOMMAND>`,
+//! with parse / register / lookup / execute (wow-re `console/console.md`, the upper band). A
+//! subsystem registers its commands from its own plugin ([`ConsoleCommandApp::console_command`]),
+//! the way each of the reference's registers into the one table, and `/console <line>` reaches
+//! [`execute`] through the chat drain.
+//!
+//! **A CVar is a command too.** The reference's `CVar::Register` installs a per-CVar command
+//! under the CVar's own name (`0x63dde0`): a bare name prints `CVar "%s" is "%s"`, a name with a
+//! value sets it. So does this — over [`Cvars`] — after the registered commands, which is the
+//! reference's own lookup order. The four commands `ConsoleVar.cpp`'s `Initialize` registers
+//! (`set`, `cvar_reset`, `cvar_default`, `cvarlist`) are the built-ins [`ConsolePlugin`] adds,
+//! plus `help`, which the reference's registry runtime owns.
+//!
+//! There is no console screen here — the drop-down that `` ` `` toggles in the reference — so a
+//! command's output is a system line in the chat frame. That is the seam `/console` already
+//! used; the registry is what the arm match behind it became.
+
+use std::collections::BTreeMap;
+
+use bevy::prelude::*;
+
+use crate::cvars::{Cvars, SetOutcome};
+
+/// A command's body: the whole world, the argument tail after the command name (trimmed), and
+/// the lines to print in return.
+pub(crate) type ConsoleHandler = fn(&mut World, &str) -> Vec<String>;
+
+#[derive(Clone, Copy)]
+struct ConsoleCommand {
+    /// The registered spelling, as `help` prints it.
+    name: &'static str,
+    help: &'static str,
+    run: ConsoleHandler,
+}
+
+/// The registry — lowercased name → command, in name order.
+#[derive(Resource, Default)]
+pub(crate) struct ConsoleCommands {
+    by_key: BTreeMap<String, ConsoleCommand>,
+}
+
+/// `app.console_command(name, help, handler)` — a subsystem registering its own command from
+/// its plugin, the reference's `ConsoleCommandRegister`.
+pub(crate) trait ConsoleCommandApp {
+    fn console_command(
+        &mut self,
+        name: &'static str,
+        help: &'static str,
+        run: ConsoleHandler,
+    ) -> &mut Self;
+}
+
+impl ConsoleCommandApp for App {
+    fn console_command(
+        &mut self,
+        name: &'static str,
+        help: &'static str,
+        run: ConsoleHandler,
+    ) -> &mut Self {
+        let mut table = self.world_mut().get_resource_or_init::<ConsoleCommands>();
+        let key = name.to_ascii_lowercase();
+        // Two registrations of one name is a wiring bug, never a runtime condition — and the
+        // reference's registry would silently shadow one with the other.
+        assert!(
+            !table.by_key.contains_key(&key),
+            "console command {name:?} registered twice"
+        );
+        table.by_key.insert(key, ConsoleCommand { name, help, run });
+        self
+    }
+}
+
+/// The built-ins: the reference's four `ConsoleVar.cpp` commands and `help`.
+pub(crate) struct ConsolePlugin;
+
+impl Plugin for ConsolePlugin {
+    fn build(&self, app: &mut App) {
+        app.init_resource::<ConsoleCommands>()
+            .console_command("set", "Set the value of a CVar.", set)
+            .console_command("cvar_reset", "Reset a CVar to its default.", cvar_default)
+            .console_command("cvar_default", "Reset a CVar to its default.", cvar_default)
+            .console_command(
+                "cvarlist",
+                "List the CVars, optionally matching a string.",
+                cvarlist,
+            )
+            .console_command("help", "List the console commands, or describe one.", help);
+    }
+}
+
+/// Run one console line — the reference's `ConsoleCommandExecute`: the first token is a command
+/// name (case-insensitive), the rest is its argument tail. A registered command runs; else a
+/// registered CVar answers as its per-CVar command does; else the line is reported as unknown.
+/// Returns the lines to print.
+///
+/// A CVar write here is applied **at once** — its observers run before this returns — which is
+/// the reference's shape (the callback runs inside `CVar::Set`), and what makes a typed
+/// `/console farclip 500` visible on the next frame rather than the one after.
+pub(crate) fn execute(world: &mut World, line: &str) -> Vec<String> {
+    let line = line.trim();
+    let (name, args) = line
+        .split_once(char::is_whitespace)
+        .map_or((line, ""), |(n, a)| (n, a.trim()));
+    if name.is_empty() {
+        return vec!["console: no command given (`help` lists the commands)".to_string()];
+    }
+    let command = world
+        .get_resource::<ConsoleCommands>()
+        .and_then(|t| t.by_key.get(&name.to_ascii_lowercase()).copied());
+    if let Some(command) = command {
+        return (command.run)(world, args);
+    }
+    if world
+        .get_resource::<Cvars>()
+        .is_some_and(|c| c.row(name).is_some())
+    {
+        return if args.is_empty() {
+            vec![print_cvar(world, name)]
+        } else {
+            set_cvar(world, name, args)
+        };
+    }
+    vec![format!(
+        "console: '{name}' is not a command or a CVar (`help` lists the commands)"
+    )]
+}
+
+/// `CVar "%s" is "%s"` — the per-CVar command's empty-argument arm (`0x63dde0`), with the
+/// staged value beside it when one is waiting for the latch boundary.
+fn print_cvar(world: &World, name: &str) -> String {
+    let cvars = world.resource::<Cvars>();
+    let Some(row) = cvars.row(name) else {
+        return format!("console: no CVar named '{name}'");
+    };
+    match &row.pending {
+        Some(staged) => format!(
+            "CVar \"{}\" is \"{}\" (\"{staged}\" staged until the next RestartGx)",
+            row.name, row.value
+        ),
+        None => format!("CVar \"{}\" is \"{}\"", row.name, row.value),
+    }
+}
+
+/// A write through the registry, its observers run, and the outcome said back.
+fn set_cvar(world: &mut World, name: &str, value: &str) -> Vec<String> {
+    let (outcome, events) = {
+        let mut cvars = world.resource_mut::<Cvars>();
+        let outcome = cvars.set(name, value);
+        (outcome, cvars.take_events())
+    };
+    for event in events {
+        world.trigger(event);
+    }
+    match outcome {
+        SetOutcome::Unknown => vec![format!("console: no CVar named '{name}'")],
+        SetOutcome::Refused => vec![format!(
+            "console: '{value}' is not a number, and {name} takes one"
+        )],
+        SetOutcome::Unchanged | SetOutcome::Changed => Vec::new(),
+        SetOutcome::Staged => vec![format!(
+            "{name} staged as \"{value}\" — applies at the next RestartGx"
+        )],
+    }
+}
+
+/// `set <name> <value>` — the reference's `0x63d500`. **One stated divergence:** the reference
+/// registers an unknown name as a new category-5 record, invisible to Lua; ours refuses it,
+/// because a row nothing reads is exactly what the registry's honest-tree rule exists to keep
+/// out, and `config.toml` preserves an unknown key on its own.
+fn set(world: &mut World, args: &str) -> Vec<String> {
+    let (name, value) = args
+        .split_once(char::is_whitespace)
+        .map_or((args, ""), |(n, v)| (n, v.trim()));
+    if name.is_empty() || value.is_empty() {
+        return vec!["usage: set <cvar> <value>".to_string()];
+    }
+    set_cvar(world, name, value)
+}
+
+/// `cvar_reset <name>` / `cvar_default <name>` — the reference's `0x63d590`/`0x63d640`. One
+/// body for both: our rows carry no separate reset value, so the reset target is the default.
+fn cvar_default(world: &mut World, args: &str) -> Vec<String> {
+    let name = args.split_whitespace().next().unwrap_or("");
+    if name.is_empty() {
+        return vec!["usage: cvar_default <cvar>".to_string()];
+    }
+    let default = world
+        .resource::<Cvars>()
+        .default_of(name)
+        .map(str::to_string);
+    let Some(default) = default else {
+        return vec![format!("console: no CVar named '{name}'")];
+    };
+    set_cvar(world, name, &default)
+}
+
+/// `cvarlist [match]` — the reference's `0x63d6f0`, in a format of our own: one line per row,
+/// the value, the default when the value moved, the staged value when one is waiting, and
+/// whether the session owns the row or an addon declared it.
+fn cvarlist(world: &mut World, args: &str) -> Vec<String> {
+    let wanted = args.split_whitespace().next().map(str::to_ascii_lowercase);
+    let cvars = world.resource::<Cvars>();
+    let mut rows: Vec<_> = cvars
+        .rows()
+        .filter(|r| {
+            wanted
+                .as_deref()
+                .is_none_or(|w| r.name.to_ascii_lowercase().contains(w))
+        })
+        .collect();
+    rows.sort_by_key(|r| r.name.to_ascii_lowercase());
+    let mut out: Vec<String> = rows
+        .iter()
+        .map(|r| {
+            let mut line = format!("{} = \"{}\"", r.name, r.value);
+            if r.value != r.default {
+                line.push_str(&format!(" (default \"{}\")", r.default));
+            }
+            if let Some(staged) = &r.pending {
+                line.push_str(&format!(" [staged \"{staged}\"]"));
+            }
+            if cvars.is_session_owned(&r.name) {
+                line.push_str(" [session]");
+            }
+            if r.addon {
+                line.push_str(" [addon]");
+            }
+            line
+        })
+        .collect();
+    out.push(format!("{} CVar(s)", rows.len()));
+    out
+}
+
+/// `help [command]` — the registry's own listing.
+fn help(world: &mut World, args: &str) -> Vec<String> {
+    let table = world.resource::<ConsoleCommands>();
+    let wanted = args.split_whitespace().next();
+    match wanted {
+        Some(name) => match table.by_key.get(&name.to_ascii_lowercase()) {
+            Some(c) => vec![format!("{} — {}", c.name, c.help)],
+            None => vec![format!("console: no command named '{name}'")],
+        },
+        None => {
+            let mut out: Vec<String> = table
+                .by_key
+                .values()
+                .map(|c| format!("{} — {}", c.name, c.help))
+                .collect();
+            out.push(
+                "…and every CVar by name: `<cvar>` prints it, `<cvar> <value>` sets it".into(),
+            );
+            out
+        }
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn console_app() -> App {
+        let mut app = App::new();
+        app.add_plugins(bevy::MinimalPlugins)
+            .init_resource::<Cvars>()
+            .add_plugins(ConsolePlugin);
+        app
+    }
+
+    fn run(app: &mut App, line: &str) -> Vec<String> {
+        execute(app.world_mut(), line)
+    }
+
+    /// **The lookup order is the reference's**: a registered command first, then the CVar's own
+    /// per-name command (bare name prints, a value sets), then unknown — case-insensitively at
+    /// every step, like the engine's own table lookup.
+    #[test]
+    fn a_line_is_a_command_then_a_cvar_then_unknown() {
+        let mut app = console_app();
+        assert_eq!(
+            run(&mut app, "MusicVolume"),
+            vec!["CVar \"MusicVolume\" is \"0.4\"".to_string()]
+        );
+        assert!(
+            run(&mut app, "musicvolume 0.7").is_empty(),
+            "a set is quiet"
+        );
+        assert_eq!(
+            app.world().resource::<Cvars>().get("MusicVolume"),
+            Some("0.7")
+        );
+        assert_eq!(
+            run(&mut app, "SET MusicVolume 0.2"),
+            Vec::<String>::new(),
+            "`set` is a registered command, matched case-insensitively"
+        );
+        assert_eq!(
+            app.world().resource::<Cvars>().get("MusicVolume"),
+            Some("0.2")
+        );
+        assert_eq!(
+            run(&mut app, "cvar_default musicVolume"),
+            Vec::<String>::new()
+        );
+        assert_eq!(
+            app.world().resource::<Cvars>().get("MusicVolume"),
+            Some("0.4")
+        );
+        assert_eq!(
+            run(&mut app, "nosuchthing 1"),
+            vec![
+                "console: 'nosuchthing' is not a command or a CVar (`help` lists the commands)"
+                    .to_string()
+            ]
+        );
+        assert_eq!(
+            run(&mut app, "set nosuchthing 1"),
+            vec!["console: no CVar named 'nosuchthing'".to_string()],
+            "the stated divergence: no record conjured at the console"
+        );
+        assert_eq!(
+            run(&mut app, "MusicVolume wat"),
+            vec!["console: 'wat' is not a number, and MusicVolume takes one".to_string()]
+        );
+        assert_eq!(
+            run(&mut app, "  "),
+            vec!["console: no command given (`help` lists the commands)".to_string()]
+        );
+    }
+
+    /// A write to a latched row says it is staged, prints as staged, and the list shows it.
+    #[test]
+    fn a_latched_cvar_reports_its_stage() {
+        let mut app = console_app();
+        assert_eq!(
+            run(&mut app, "gxVSync 0"),
+            vec!["gxVSync staged as \"0\" — applies at the next RestartGx".to_string()]
+        );
+        assert_eq!(
+            run(&mut app, "gxvsync"),
+            vec!["CVar \"gxVSync\" is \"1\" (\"0\" staged until the next RestartGx)".to_string()]
+        );
+        let list = run(&mut app, "cvarlist gxv");
+        assert_eq!(
+            list,
+            vec![
+                "gxVSync = \"1\" [staged \"0\"]".to_string(),
+                "1 CVar(s)".to_string()
+            ]
+        );
+    }
+
+    /// `cvarlist` marks a moved value with its default, a session-owned row, and an addon's.
+    #[test]
+    fn cvarlist_says_where_each_row_stands() {
+        let mut app = console_app();
+        {
+            let mut cvars = app.world_mut().resource_mut::<Cvars>();
+            cvars.set("farclip", "500");
+            cvars.own_for_session("uiScale", Some("1.2"));
+            cvars.learn_addon_row("myAddonKnob", "7");
+        }
+        let list = run(&mut app, "cvarlist");
+        assert!(
+            list.contains(&"farclip = \"500\" (default \"350\")".to_string()),
+            "{list:?}"
+        );
+        assert!(
+            list.contains(&"uiScale = \"1.2\" (default \"0.9\") [session]".to_string()),
+            "{list:?}"
+        );
+        assert!(
+            list.contains(&"myAddonKnob = \"7\" [addon]".to_string()),
+            "{list:?}"
+        );
+        assert!(list.last().unwrap().ends_with(" CVar(s)"));
+        let some = run(&mut app, "cvarlist FARCLIP");
+        assert_eq!(some.len(), 2, "matched case-insensitively: {some:?}");
+    }
+
+    /// `help` lists what is registered, and a subsystem's registration is one call.
+    #[test]
+    fn help_lists_the_registry_and_a_registration_is_one_call() {
+        fn shout(_: &mut World, args: &str) -> Vec<String> {
+            vec![format!("{}!", args.to_ascii_uppercase())]
+        }
+        let mut app = console_app();
+        app.console_command("shout", "Shout the argument back.", shout);
+        assert_eq!(
+            run(&mut app, "Shout hello there"),
+            vec!["HELLO THERE!".to_string()]
+        );
+        let listing = run(&mut app, "help");
+        assert!(listing.contains(&"shout — Shout the argument back.".to_string()));
+        assert!(listing.contains(&"set — Set the value of a CVar.".to_string()));
+        assert_eq!(
+            run(&mut app, "help cvarlist"),
+            vec!["cvarlist — List the CVars, optionally matching a string.".to_string()]
+        );
+    }
+
+    #[test]
+    #[should_panic(expected = "registered twice")]
+    fn a_name_registered_twice_is_a_wiring_bug() {
+        fn nothing(_: &mut World, _: &str) -> Vec<String> {
+            Vec::new()
+        }
+        let mut app = console_app();
+        app.console_command("set", "again", nothing);
+    }
+}
diff --git a/crates/benilla-app/src/cooldowns.rs b/crates/benilla-app/src/cooldowns.rs
index 54f294a4..0400e5d7 100644
--- a/crates/benilla-app/src/cooldowns.rs
+++ b/crates/benilla-app/src/cooldowns.rs
@@ -175,7 +175,6 @@ impl Cooldowns {
     /// used to do made the GO insert of any cooldown-carrying spell (Frost Nova) overwrite its
     /// own running GCD node — the whole bar's pie flashed and died ~100 ms after the press,
     /// while cooldown-less spells (Arcane Explosion) kept theirs (decision 0947).
-    #[allow(clippy::too_many_arguments)] // the SPELLHISTORY node's own field list
     fn add(
         &mut self,
         spell_id: u32,
diff --git a/crates/benilla-app/src/crash.rs b/crates/benilla-app/src/crash.rs
new file mode 100644
index 00000000..96a5644e
--- /dev/null
+++ b/crates/benilla-app/src/crash.rs
@@ -0,0 +1,236 @@
+//! **A crash leaves an artefact** (decision 2266 §B2).
+//!
+//! Until this module, a panic printed to stderr and the process was gone — and with it everything
+//! a reporter could have attached. The only log sink was the terminal; a packaged Windows build
+//! has no console; of bug B390's four reporters one attached a backtrace, because he had set
+//! `RUST_BACKTRACE=1` on his own. `shutdown.rs` says the other half out loud: *"A crash, a
+//! `SIGKILL`, a wedged teardown. Nothing survives those."*
+//!
+//! [`install`] chains a panic hook in front of Rust's default one. The default still prints to
+//! stderr exactly as before (so every log a session already greps keeps reading the same); then
+//! the report goes to **`benilla-config/Diagnostics/crash-<unix-seconds>.txt`**, resolved through
+//! [`crate::local_state`] like every other file benilla writes (the one-folder rule, 0954/1175 —
+//! never a platform log dir, never beside the install). The file carries: the build id (the sha
+//! is the version, `build_id`), the time and the uptime, the thread, the panic's location and
+//! payload, a backtrace captured **regardless of `RUST_BACKTRACE`**, and the last
+//! [`benilla_world::log_ring::CAPACITY`] log lines — the minute before, which is what turns a
+//! symptom into a story. The path is printed to stderr as the last line, so "attach the file it
+//! names" is the whole instruction to a reporter.
+//!
+//! **What it does not cover, said out loud.** A non-unwinding panic — an allocation failure's
+//! abort, a `panic` inside a `Drop` during unwinding, a foreign frame — never reaches any hook;
+//! B390's own was one (`thread caused non-unwinding panic. aborting.`). The hook covers the
+//! unwinding class (B88, B130, B260, B383's shape: four of the six panics the ledger holds).
+//! Flushing saved variables and the CVar diff from inside a panic is a second, riskier item —
+//! the world is half-torn by then — and is deliberately not bundled here (2265 §B2).
+//!
+//! A hermetic capture run (`local_state::home()` answers `None`) writes no file and loses
+//! nothing: the harness already has stderr.
+
+use std::fmt::Write as _;
+use std::panic::PanicHookInfo;
+use std::path::{Path, PathBuf};
+use std::sync::atomic::{AtomicBool, Ordering};
+use std::time::{Duration, Instant, SystemTime, UNIX_EPOCH};
+
+use crate::BuildId;
+
+/// Chain the crash-report hook in front of the current panic hook. Called once, from
+/// [`crate::run`], before the `App` exists — a panic while plugins build is still a crash.
+pub(crate) fn install(build: BuildId) {
+    let started = Instant::now();
+    let previous = std::panic::take_hook();
+    std::panic::set_hook(Box::new(move |info| {
+        previous(info);
+        report(info, build, started.elapsed());
+    }));
+}
+
+/// `WOW_CRASH_INJECT=<at_secs>` — one deliberate main-thread panic, mid-run: the standing test
+/// affordance for this module, in the shape of `perf::stall`'s injectors and armed beside them.
+/// The end-to-end falsifier is a run with it set: the process must die with a
+/// `crash-<unix>.txt` whose log tail ends in the `crash-inject` line below.
+pub(crate) fn arm_injector(app: &mut bevy::prelude::App) {
+    use bevy::prelude::*;
+    if let Some(at) = std::env::var("WOW_CRASH_INJECT")
+        .ok()
+        .and_then(|v| v.parse::<f32>().ok())
+    {
+        app.insert_resource(CrashInject { at });
+        app.add_systems(Update, crash_inject);
+    }
+}
+
+#[derive(bevy::prelude::Resource)]
+struct CrashInject {
+    at: f32,
+}
+
+fn crash_inject(
+    inject: bevy::prelude::Res<CrashInject>,
+    time: bevy::prelude::Res<bevy::prelude::Time<bevy::time::Real>>,
+) {
+    if time.elapsed_secs() >= inject.at {
+        bevy::log::warn!(
+            "crash-inject: panicking the main thread at {:.1} s",
+            inject.at
+        );
+        panic!("crash-inject: deliberate panic (WOW_CRASH_INJECT)");
+    }
+}
+
+/// Re-entrancy latch: a panic *inside* the hook (a poisoned lock, a failed write) must not
+/// recurse into it. Never cleared on purpose — after one report the process is on its way out,
+/// and a second panic's report would only overwrite the useful one with a worse one.
+static REPORTING: AtomicBool = AtomicBool::new(false);
+
+fn report(info: &PanicHookInfo<'_>, build: BuildId, uptime: Duration) {
+    if REPORTING.swap(true, Ordering::SeqCst) {
+        return;
+    }
+    let Some(dir) = crate::local_state::diagnostics_dir() else {
+        return;
+    };
+    let payload = if let Some(s) = info.payload().downcast_ref::<&str>() {
+        (*s).to_owned()
+    } else if let Some(s) = info.payload().downcast_ref::<String>() {
+        s.clone()
+    } else {
+        "<non-string panic payload>".to_owned()
+    };
+    let location = info
+        .location()
+        .map(|l| format!("{}:{}:{}", l.file(), l.line(), l.column()))
+        .unwrap_or_else(|| "<unknown>".to_owned());
+    let thread = std::thread::current();
+    let text = render(&Report {
+        build,
+        unix: SystemTime::now()
+            .duration_since(UNIX_EPOCH)
+            .map(|d| d.as_secs())
+            .unwrap_or(0),
+        uptime,
+        thread: thread.name().unwrap_or("<unnamed>"),
+        location: &location,
+        payload: &payload,
+        backtrace: &std::backtrace::Backtrace::force_capture().to_string(),
+        log: &benilla_world::log_ring::recent(),
+    });
+    if let Some(path) = write(&dir, &text) {
+        eprintln!("crash report written to {}", path.display());
+    }
+}
+
+/// Everything the report says, gathered before rendering so the renderer is a pure function the
+/// test can drive without panicking.
+struct Report<'a> {
+    build: BuildId,
+    unix: u64,
+    uptime: Duration,
+    thread: &'a str,
+    location: &'a str,
+    payload: &'a str,
+    backtrace: &'a str,
+    log: &'a [String],
+}
+
+fn render(r: &Report<'_>) -> String {
+    let mut out = String::new();
+    let _ = writeln!(out, "benilla crash report");
+    let _ = writeln!(
+        out,
+        "build:     {} (sha {})",
+        r.build.summary(),
+        r.build.sha
+    );
+    let _ = writeln!(
+        out,
+        "time:      {} unix, {:.1} s after launch",
+        r.unix,
+        r.uptime.as_secs_f64()
+    );
+    let _ = writeln!(
+        out,
+        "platform:  {} {}",
+        std::env::consts::OS,
+        std::env::consts::ARCH
+    );
+    let _ = writeln!(out, "thread:    {}", r.thread);
+    let _ = writeln!(out, "at:        {}", r.location);
+    let _ = writeln!(out, "panic:     {}", r.payload);
+    let _ = writeln!(out, "\nbacktrace:\n{}", r.backtrace);
+    let _ = writeln!(out, "last {} log lines (oldest first):", r.log.len());
+    for line in r.log {
+        let _ = writeln!(out, "{line}");
+    }
+    out
+}
+
+/// Write the report under `dir` as `crash-<unix>.txt`, creating the folder on demand (an empty
+/// `Diagnostics/` on every run would be this instrument advertising itself, `perf::stall`'s
+/// reason). Plain `fs::write`, not `local_state::write_atomic`: the process is dying, and a
+/// half-written report beats none.
+fn write(dir: &Path, text: &str) -> Option<PathBuf> {
+    let unix = SystemTime::now()
+        .duration_since(UNIX_EPOCH)
+        .map(|d| d.as_secs())
+        .unwrap_or(0);
+    let path = dir.join(format!("crash-{unix}.txt"));
+    std::fs::create_dir_all(dir).ok()?;
+    std::fs::write(&path, text).ok()?;
+    Some(path)
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    const BUILD: BuildId = BuildId {
+        sha: "0123456789abcdef0123456789abcdef01234567",
+        short: "0123456",
+        date: "2026-09-16",
+        profile: "debug",
+    };
+
+    /// The report names the build, the place, the payload and the log — the four things a
+    /// reporter cannot reconstruct after the fact — and lands in the folder it was given.
+    #[test]
+    fn a_report_carries_the_build_the_place_the_payload_and_the_log() {
+        let log = vec!["+  1.000s  INFO benilla_app::net: entered world".to_owned()];
+        let text = render(&Report {
+            build: BUILD,
+            unix: 1_800_000_000,
+            uptime: Duration::from_millis(12_345),
+            thread: "main",
+            location: "crates/benilla-app/src/net/apply.rs:100:5",
+            payload: "index out of bounds: the len is 3 but the index is 7",
+            backtrace: "   0: benilla_app::net::apply::apply_net_updates",
+            log: &log,
+        });
+        for needle in [
+            "sha 0123456789abcdef0123456789abcdef01234567",
+            "0123456 · 2026-09-16 · debug",
+            "12.3 s after launch",
+            "thread:    main",
+            "at:        crates/benilla-app/src/net/apply.rs:100:5",
+            "panic:     index out of bounds: the len is 3 but the index is 7",
+            "apply_net_updates",
+            "last 1 log lines",
+            "entered world",
+        ] {
+            assert!(text.contains(needle), "missing {needle:?} in:\n{text}");
+        }
+
+        let dir = std::env::temp_dir().join(format!("benilla-crash-test-{}", std::process::id()));
+        let _ = std::fs::remove_dir_all(&dir);
+        let path = write(&dir, &text).expect("report written");
+        assert!(path.starts_with(&dir), "{}", path.display());
+        assert!(path
+            .file_name()
+            .unwrap()
+            .to_string_lossy()
+            .starts_with("crash-"));
+        assert_eq!(std::fs::read_to_string(&path).unwrap(), text);
+        let _ = std::fs::remove_dir_all(&dir);
+    }
+}
diff --git a/crates/benilla-app/src/creature_anim.rs b/crates/benilla-app/src/creature_anim.rs
index 44e741a7..fcfec173 100644
--- a/crates/benilla-app/src/creature_anim.rs
+++ b/crates/benilla-app/src/creature_anim.rs
@@ -390,7 +390,6 @@ pub(crate) fn stop_attack_local(
 /// `0x6131d9`). `0x5ecb70`'s own validator legs — the target's alive-or-feign + `CanAttack
 /// 0x606980` walk, and the `[0xb4b3e4]` world gate — stay with the callers that already compute
 /// them (`target::scan`'s `new_attackable`, the drain's `attack_actor_refusal`).
-#[allow(clippy::too_many_arguments)] // the tail writes four sinks; the alternative is a bundle
 pub(crate) fn start_attack_local(
     entity: Entity,
     target: u64,
@@ -444,7 +443,6 @@ pub(crate) fn start_attack_local(
 /// `[0xb4b3e4]` — the reference's second condition on the stop arm, a world/session global also
 /// tested at `0x5ecbc0` — is unmodelled; nothing in benilla can be false there while a press is
 /// being drained.
-#[allow(clippy::too_many_arguments)] // the seams' write set, minus the bundle a caller can't hold
 pub(crate) fn toggle_attack_local(
     entity: Entity,
     target: u64,
@@ -1265,6 +1263,26 @@ impl Plugin for CreatureAnimPlugin {
                     // entity-visuals chain so the arrow appears/vanishes the frame the keyframe
                     // lands, not one behind.
                     drive_nock_latch,
+                    // …and, off the same two keys, the RANGED PROP's own clip (decision 2281):
+                    // the bow's limbs bend on `$BWP`, and on `$BWR` a gun fires the muzzle blast
+                    // its BowRelease(161) sequence carries. Beside the latch because the reference
+                    // arms both from one handler each, and ahead of the entity-visuals chain so the
+                    // prop's pose is this frame's before the rider lane reads it.
+                    crate::ranged_flex::flex_ranged_props
+                        // The per-sequence material samplers (`SeqHosts`) ask an anim host which
+                        // slot it is playing; a prop that armed 161 this frame must be answering
+                        // for 161, not for last frame's Stand. The chain's own `.before(
+                        // EntityVisualsSet)` does not reach them — they hang off `ModelVisSet`.
+                        .before(benilla_world::model_render::ModelVisSet),
+                    // …and the un-nock's reset (`0x60f59d`), which the reference reaches from the
+                    // SAME `$BWR` it just armed on. It must run AFTER the arm, or its skip-while-
+                    // releasing guard has nothing to read and a gun's blast is cancelled on the
+                    // frame it starts — the chain gives it that order by construction.
+                    crate::ranged_flex::reset_ranged_props_on_unnock
+                        // Same edge as the arm above, and for the same reason: this writes the
+                        // prop's player too, and the per-sequence material samplers must answer
+                        // for the clip it leaves armed.
+                        .before(benilla_world::model_render::ModelVisSet),
                     // …and the `$BTH` puff off the same scan: another SpellKitFx writer, so it
                     // belongs ahead of the entity-visuals chain like its `arm_*_fx` siblings.
                     fire_breath,
@@ -1392,6 +1410,7 @@ mod nock_latch_tests {
             entity: unit,
             ident: *b"$BWP",
             data: 0,
+            anim_id: 0,
             pos: None,
         });
         app.update();
@@ -1403,6 +1422,7 @@ mod nock_latch_tests {
             entity: unit,
             ident: *b"$BWR",
             data: 0,
+            anim_id: 0,
             pos: None,
         });
         app.update();
@@ -1417,6 +1437,7 @@ mod nock_latch_tests {
             entity: bare,
             ident: *b"$BWP",
             data: 0,
+            anim_id: 0,
             pos: None,
         });
         app.update();
diff --git a/crates/benilla-app/src/creature_anim/blood.rs b/crates/benilla-app/src/creature_anim/blood.rs
index 2d6a6cba..3c647eb8 100644
--- a/crates/benilla-app/src/creature_anim/blood.rs
+++ b/crates/benilla-app/src/creature_anim/blood.rs
@@ -68,7 +68,6 @@ pub(super) fn load_blood_tables(mut commands: Commands, assets: Option<Res<World
 /// `info` and every fired spurt at `debug`, so "I never see blood" localizes to a link in one
 /// fight instead of a code audit (no drop lines at all ⇒ the break is upstream, in the
 /// [`SwingImpact`] feed itself).
-#[allow(clippy::too_many_arguments)] // one Bevy system's full input set
 pub(super) fn blood_spurts(
     mut swings: MessageReader<SwingImpact>,
     transforms: Query<&Transform>,
diff --git a/crates/benilla-app/src/creature_anim/breath.rs b/crates/benilla-app/src/creature_anim/breath.rs
index 602196e5..41884c36 100644
--- a/crates/benilla-app/src/creature_anim/breath.rs
+++ b/crates/benilla-app/src/creature_anim/breath.rs
@@ -141,7 +141,6 @@ pub(super) struct LastPuff(EntityHashMap<f32>);
 ///
 /// A unit seen for the first time has no [`BreathEnv`] and is classified at once, so a unit that
 /// streams in inside a cold zone breathes on its next idle loop rather than up to 10 s later.
-#[allow(clippy::too_many_arguments)] // one system's full input set
 pub(super) fn classify_breath(
     mut commands: Commands,
     time: Res<Time>,
@@ -184,7 +183,6 @@ pub(super) fn classify_breath(
 /// off the mount — so the **puff goes on the event's own entity** (its mouth), while the unit
 /// state the ladder reads (drunk, the environment) comes from the composite's **root**, exactly
 /// as the footfall visuals split them.
-#[allow(clippy::too_many_arguments)] // one system's full input set
 pub(super) fn fire_breath(
     mut events: MessageReader<AnimSoundEvent>,
     time: Res<Time>,
diff --git a/crates/benilla-app/src/creature_anim/driver.rs b/crates/benilla-app/src/creature_anim/driver.rs
index 605be562..c8d894a4 100644
--- a/crates/benilla-app/src/creature_anim/driver.rs
+++ b/crates/benilla-app/src/creature_anim/driver.rs
@@ -263,7 +263,7 @@ fn transplant_up(
 /// enter/loop/exit the Special states (jump, sit/sleep/kneel) as one-shot-bracketed loops, play the
 /// per-packet melee swings as preemptible one-shots, and cross-fade the gaits (the engaged Ready
 /// idle among them).
-#[allow(clippy::type_complexity, clippy::too_many_arguments)]
+#[allow(clippy::type_complexity)]
 pub(super) fn drive_animations(
     mut commands: Commands,
     mut units: Query<(
@@ -363,7 +363,7 @@ pub(super) fn drive_animations(
     ),
     // The variation roll's LCG state (decision 0114 — the client's single CRT `_rand` stream,
     // shared by every play; [`select::msvc_rand`]).
-    mut rng: Local<u32>,
+    mut rng: ResMut<benilla_assets::AnimRng>,
     // The SELF unit's last-written anim state line of the `WOW_MOVE_TRACE` debug trace (the
     // diff-only filter; see the trace block after the mode machine).
     mut anim_trace_last: Local<std::collections::HashMap<Entity, String>>,
@@ -685,9 +685,7 @@ pub(super) fn drive_animations(
                     let c = if first {
                         c
                     } else {
-                        anims
-                            .pick_variation(c.anim_id, select::msvc_rand(&mut rng))
-                            .unwrap_or(c)
+                        anims.pick_variation(c.anim_id, rng.draw()).unwrap_or(c)
                     };
                     let active =
                         tr.play(&mut player, c.node, Duration::from_secs_f32(c.blend_time));
diff --git a/crates/benilla-app/src/creature_anim/driver/mode.rs b/crates/benilla-app/src/creature_anim/driver/mode.rs
index 824874e3..2cabfee6 100644
--- a/crates/benilla-app/src/creature_anim/driver/mode.rs
+++ b/crates/benilla-app/src/creature_anim/driver/mode.rs
@@ -63,7 +63,7 @@ pub(super) fn run(
     drv: &mut AnimDriver,
     tr: &mut AnimationTransitions,
     player: &mut AnimationPlayer,
-    rng: &mut u32,
+    rng: &mut benilla_assets::AnimRng,
 ) {
     let Frame {
         entity,
@@ -579,7 +579,7 @@ pub(super) fn run(
                         // gait it WRAPPED to its head at completion — the frames + cross-fade
                         // against the restarted reach-to-quiver were the director's "jumps
                         // back to the start the moment it gets fully pulled", in every build
-                        // that replayed a pull (trace-caught, decision 0412). The clamp IS the
+                        // that replayed a pull (trace-caught, decision 2276). The clamp IS the
                         // drawn pose; nothing follows it (0994).
                         // Loot 50 is likewise authored clamp — one 0.5 s kneel-down that must
                         // FREEZE in the rummage pose; as Forever it would wrap back to standing
diff --git a/crates/benilla-app/src/creature_anim/driver/play.rs b/crates/benilla-app/src/creature_anim/driver/play.rs
index 52a7c81f..72237cd7 100644
--- a/crates/benilla-app/src/creature_anim/driver/play.rs
+++ b/crates/benilla-app/src/creature_anim/driver/play.rs
@@ -144,7 +144,7 @@ pub(super) fn cut_loop(
     anims: &ModelAnimations,
     id: u16,
     catalog: Option<&AnimDataCatalog>,
-    rng: &mut u32,
+    rng: &mut benilla_assets::AnimRng,
     window: &mut Option<(bevy::animation::graph::AnimationNodeIndex, u32)>,
 ) {
     let Some(head) = find_resolved(anims, id, catalog) else {
@@ -178,12 +178,12 @@ fn arm(
 pub(super) fn roll_oneshot<'a>(
     anims: &'a ModelAnimations,
     head: &'a AnimClip,
-    rng: &mut u32,
+    rng: &mut benilla_assets::AnimRng,
 ) -> (&'a AnimClip, RepeatAnimation) {
     let c = anims
-        .pick_variation(head.anim_id, select::msvc_rand(rng))
+        .pick_variation(head.anim_id, rng.draw())
         .unwrap_or(head);
-    let repeat = match select::replay_count(c.replay, select::msvc_rand(rng)) {
+    let repeat = match rng.replay_count(c.replay) {
         r if r > 1 => RepeatAnimation::Count(r),
         _ => RepeatAnimation::Never,
     };
@@ -201,11 +201,11 @@ pub(super) fn pick_loop_variation<'a>(
     anims: &'a ModelAnimations,
     head: &'a AnimClip,
     relaxed: bool,
-    rng: &mut u32,
+    rng: &mut benilla_assets::AnimRng,
 ) -> &'a AnimClip {
     if relaxed {
         anims
-            .pick_variation(head.anim_id, select::msvc_rand(rng))
+            .pick_variation(head.anim_id, rng.draw())
             .unwrap_or(head)
     } else {
         head
@@ -222,10 +222,10 @@ pub(super) fn roll_loop<'a>(
     anims: &'a ModelAnimations,
     head: &'a AnimClip,
     relaxed: bool,
-    rng: &mut u32,
+    rng: &mut benilla_assets::AnimRng,
 ) -> (&'a AnimClip, u32) {
     let c = pick_loop_variation(anims, head, relaxed, rng);
-    let r = select::replay_count(c.replay, select::msvc_rand(rng));
+    let r = rng.replay_count(c.replay);
     (c, r)
 }
 
@@ -237,7 +237,6 @@ pub(super) fn roll_loop<'a>(
 /// decision 0123) **and its budget** ([`roll_loop`] — decision 0516), publishing the armed
 /// `(node, R)` into `window` for the watchdog's advance; a one-shot arm clears it (its budget is
 /// the `Count` repeat — no window outlives the arm).
-#[allow(clippy::too_many_arguments)] // the resolve+roll+play primitive's full input set
 pub(super) fn play(
     lock: &mut BaseAnimLock,
     tr: &mut AnimationTransitions,
@@ -248,7 +247,7 @@ pub(super) fn play(
     relaxed: bool,
     rate: f32,
     catalog: Option<&AnimDataCatalog>,
-    rng: &mut u32,
+    rng: &mut benilla_assets::AnimRng,
     window: &mut Option<(bevy::animation::graph::AnimationNodeIndex, u32)>,
 ) {
     // The lock's guard is `PlayAnimation`'s **front door**, above the arm helper that draws the
@@ -382,7 +381,6 @@ pub(super) fn holds_own_clip(
 /// and settles through [`Mode::Entering`]; **Fall has no enter** — the client plays the Fall(40)
 /// loop directly the tick FALLINGFAR latches (`0x602c40`) — so it goes straight to
 /// [`Mode::Looping`] with a looping play.
-#[allow(clippy::too_many_arguments)]
 pub(super) fn enter_special(
     lock: &mut BaseAnimLock,
     sp: Special,
@@ -391,7 +389,7 @@ pub(super) fn enter_special(
     player: &mut AnimationPlayer,
     anims: &ModelAnimations,
     catalog: Option<&AnimDataCatalog>,
-    rng: &mut u32,
+    rng: &mut benilla_assets::AnimRng,
     window: &mut Option<(bevy::animation::graph::AnimationNodeIndex, u32)>,
 ) -> Mode {
     if sp == Special::Fall {
@@ -434,7 +432,6 @@ pub(super) fn enter_special(
 /// started moving drops straight to the gait, letting the cross-fade carry the half-pose into the
 /// walk; an airborne state landing plays its [`jump_land_pick`]; otherwise `sp` plays its graceful
 /// exit one-shot, which [`super::drive_animations`] then waits out. Returns the mode to adopt.
-#[allow(clippy::too_many_arguments)]
 pub(super) fn leave_special(
     lock: &mut BaseAnimLock,
     sp: Special,
@@ -446,7 +443,7 @@ pub(super) fn leave_special(
     player: &mut AnimationPlayer,
     anims: &ModelAnimations,
     catalog: Option<&AnimDataCatalog>,
-    rng: &mut u32,
+    rng: &mut benilla_assets::AnimRng,
     window: &mut Option<(bevy::animation::graph::AnimationNodeIndex, u32)>,
     frozen: &mut Option<bevy::animation::graph::AnimationNodeIndex>,
 ) -> Mode {
diff --git a/crates/benilla-app/src/creature_anim/driver/tests.rs b/crates/benilla-app/src/creature_anim/driver/tests.rs
index cbbafff4..718c7c78 100644
--- a/crates/benilla-app/src/creature_anim/driver/tests.rs
+++ b/crates/benilla-app/src/creature_anim/driver/tests.rs
@@ -147,6 +147,8 @@ fn advance(app: &mut App, ms: u64) {
 
 fn app() -> App {
     let mut app = App::new();
+    // The client's ONE `rand()` stream (2301) — the play's variation and replay rolls.
+    app.init_resource::<benilla_assets::AnimRng>();
     // Asset + animation plugins so tests with REAL clip assets (the watchdog test) get Bevy's
     // `advance_animations` ticking completions; units without a graph handle are skipped by it,
     // so the asset-less tenants are unaffected.
diff --git a/crates/benilla-app/src/creature_anim/driver/wound.rs b/crates/benilla-app/src/creature_anim/driver/wound.rs
index eab2530f..b19b7df4 100644
--- a/crates/benilla-app/src/creature_anim/driver/wound.rs
+++ b/crates/benilla-app/src/creature_anim/driver/wound.rs
@@ -115,14 +115,13 @@ pub(super) fn wound_evict(
 /// sheath reconcile and the event scan. `id` is the wound anim to lay (8–10), already resolved
 /// by the caller — melee by severity/engagement ([`select::wound_anim`]), a spell impact by its
 /// kit's own column ([`WoundEdge`]).
-#[allow(clippy::too_many_arguments)] // the trigger's full live-state + rng input set
 pub(super) fn wound_trigger(
     entity: Entity,
     drv: &mut AnimDriver,
     player: &mut AnimationPlayer,
     anims: &ModelAnimations,
     catalog: Option<&AnimDataCatalog>,
-    rng: &mut u32,
+    rng: &mut benilla_assets::AnimRng,
     id: u16,
     mv: &MovementState,
     mounted: bool,
@@ -137,7 +136,7 @@ pub(super) fn wound_trigger(
         // (`end = clock`, expired on arrival) — skip. No resolvable clip at all is the
         // `0x711a20` asset-presence abort.
         let clip = find_resolved(anims, id, catalog)
-            .and_then(|h| anims.pick_variation(h.anim_id, select::msvc_rand(rng)))
+            .and_then(|h| anims.pick_variation(h.anim_id, rng.draw()))
             .filter(|c| c.duration > 0.0);
         let node = clip.and_then(|c| {
             if full {
diff --git a/crates/benilla-app/src/creature_anim/events.rs b/crates/benilla-app/src/creature_anim/events.rs
index 3856af4c..aa907f2d 100644
--- a/crates/benilla-app/src/creature_anim/events.rs
+++ b/crates/benilla-app/src/creature_anim/events.rs
@@ -21,6 +21,15 @@ pub(crate) struct AnimSoundEvent {
     pub(crate) ident: [u8; 4],
     /// The tag payload (a SoundEntries id for `$SND`/`$DSL`/`$DSO`; 0 otherwise).
     pub(crate) data: u32,
+    /// The `AnimationData.dbc` id of the **clip that fired the key**.
+    ///
+    /// This is the reference's `0x5fdb50` answer at the instant a handler runs: that helper reads
+    /// the model's currently-playing animation id, and a key fires from a clip the model is
+    /// playing, at that key's own time in it. Two dispatch arms branch on it — the `$BWR` weapon
+    /// family fork (`0x5fcfb0` bow {46,105,109} vs `0x5fcfd0` rifle {49,106,110}, decision 2281) —
+    /// and carrying it here is what lets them ask without re-deriving "what is this unit playing"
+    /// from a player whose one-shot overlays outrank its base clip in weight.
+    pub(crate) anim_id: u16,
     /// **Where the key fired** — the reference's own `placementMatrix · (boneMatrix[event.bone] ·
     /// event.position)`, resolved here at the fire and carried by value exactly as the M2 event
     /// kernel `0x719370` snapshots it into the deferred callback record that every dispatcher
@@ -361,6 +370,7 @@ pub(crate) fn scan_events(
                     entity,
                     ident: e.ident,
                     data: e.data,
+                    anim_id: clip.anim_id,
                     pos: Some(pos),
                 });
             }
diff --git a/crates/benilla-app/src/creature_anim/impact.rs b/crates/benilla-app/src/creature_anim/impact.rs
index 318f7208..83ddeb85 100644
--- a/crates/benilla-app/src/creature_anim/impact.rs
+++ b/crates/benilla-app/src/creature_anim/impact.rs
@@ -144,7 +144,6 @@ fn is_whiff(victim_state: u32) -> bool {
 /// Cache swings, consume impact tags, dispatch `$CPP` defenses, flush on supersede/attack-stop,
 /// silently drop records whose attacker despawned (the client's dtor clears without flushing).
 /// Ordered after [`super::events::fire_anim_events`] so a tag fires the same frame it's crossed.
-#[allow(clippy::too_many_arguments)]
 pub(super) fn route_swing_impacts(
     mut swings: MessageReader<SwingMessage>,
     mut events: MessageReader<AnimSoundEvent>,
@@ -319,6 +318,7 @@ mod tests {
             entity,
             ident,
             data: 0,
+            anim_id: 0,
             pos: None,
         });
         app.update();
diff --git a/crates/benilla-app/src/creature_anim/lod.rs b/crates/benilla-app/src/creature_anim/lod.rs
index eb637c41..856fe94f 100644
--- a/crates/benilla-app/src/creature_anim/lod.rs
+++ b/crates/benilla-app/src/creature_anim/lod.rs
@@ -90,7 +90,7 @@ const FALLBACK_RADIUS: f32 = 6.0;
 /// frame. Exempt: the body we drive (the camera rides its attachment-17 pivot, and it must keep
 /// animating faded-out in first person) and its mount child. `WOW_NO_ANIM_LOD=1` disables
 /// parking — the live-probe A/B lever; `WOW_NO_ROOM_LOD=1` disables only the room leg.
-#[allow(clippy::type_complexity, clippy::too_many_arguments)] // one Bevy system's full input set
+#[allow(clippy::type_complexity)] // one Bevy system's full input set
 pub(super) fn gate_rig_animation(
     time: Res<Time>,
     cam: Query<&Frustum, With<WorldCamera>>,
diff --git a/crates/benilla-app/src/creature_anim/select.rs b/crates/benilla-app/src/creature_anim/select.rs
index dc6c451e..cc429e62 100644
--- a/crates/benilla-app/src/creature_anim/select.rs
+++ b/crates/benilla-app/src/creature_anim/select.rs
@@ -1005,32 +1005,6 @@ pub(crate) fn blend_lambda(remaining_frac: f32) -> f32 {
     (3.0 - 2.0 * t) * t * t
 }
 
-/// The client's `_rand` — the MSVCRT LCG (`state × 214013 + 2531011`, output `(state >> 16) &
-/// 0x7fff`; byte-verified wow-re `rf36-rand-stub.md` at `0x7400e5`) — the roll feeding op4's
-/// per-play **variation pick** (`ModelAnimations::pick_variation`) and its **replay-count roll**
-/// ([`replay_count`] — the second `_rand` site). Owned exactly rather than delegating to a host
-/// RNG, per the determinism guidance in the same note; one stream shared by every play, like the
-/// client's single CRT stream.
-pub(crate) fn msvc_rand(state: &mut u32) -> u16 {
-    *state = state.wrapping_mul(214013).wrapping_add(2531011);
-    ((*state >> 16) & 0x7fff) as u16
-}
-
-/// The per-arm **replay-count roll** (wow-re `loop-replay-fidget.md`, op4's second `_rand` site
-/// `0x712692..0x7126cd`): `R = max(1, min + ⌊roll·(max−min)/32768⌋)` from the sequence's
-/// `(minReplay, maxReplay)`. The client multiplies `R` into the play window (`0x7126d8`) — a
-/// clamp-flag one-shot runs its timeline `R` times before freezing; loop-flag sequences ignore it.
-/// Benilla expresses the same window as a repeat count on the one-shot play. `(0, 0)` → 1.
-pub(super) fn replay_count(replay: (u32, u32), roll: u16) -> u32 {
-    let (min, max) = replay;
-    let extra = if max > min {
-        (u64::from(roll) * u64::from(max - min) / 32768) as u32
-    } else {
-        0
-    };
-    (min + extra).max(1)
-}
-
 /// The engaged standing idle (decision 0073 — the `0x5fd360` arm's weapon-class Ready pick,
 /// `0x5fcdc0`). Note the buckets differ from the swing table: fist **and** dagger ready as 1H.
 pub(super) fn ready_anim(main: Option<(u8, u8)>) -> u16 {
diff --git a/crates/benilla-app/src/creature_anim/select/tests.rs b/crates/benilla-app/src/creature_anim/select/tests.rs
index 57826ed1..0b88eab4 100644
--- a/crates/benilla-app/src/creature_anim/select/tests.rs
+++ b/crates/benilla-app/src/creature_anim/select/tests.rs
@@ -834,36 +834,6 @@ fn wound_weight_decays_smoothstep_to_zero() {
     assert!((wound_weight(1.0, 9.0) - 27.0).abs() < 1e-4);
 }
 
-#[test]
-fn msvc_rand_is_the_crt_lcg() {
-    // srand(1)'s canonical first outputs: 41, 18467, 6334 — the exact MSVCRT stream the client's
-    // variation roll consumes (wow-re rf36-rand-stub.md).
-    let mut state = 1u32;
-    assert_eq!(msvc_rand(&mut state), 41);
-    assert_eq!(msvc_rand(&mut state), 18467);
-    assert_eq!(msvc_rand(&mut state), 6334);
-    // Output stays in the client's 0..0x7fff roll domain.
-    let mut state = 0xdead_beefu32;
-    for _ in 0..100 {
-        assert!(msvc_rand(&mut state) <= 0x7fff);
-    }
-}
-
-#[test]
-fn replay_count_rolls_the_window_multiplier() {
-    // (0,0) — the overwhelming majority — always 1.
-    assert_eq!(replay_count((0, 0), 0), 1);
-    assert_eq!(replay_count((0, 0), 0x7fff), 1);
-    // A fixed authored count passes through (clamped ≥ 1).
-    assert_eq!(replay_count((3, 3), 0x7fff), 3);
-    // A range: R = min + ⌊roll·(max−min)/32768⌋ — max is approached, never exceeded.
-    assert_eq!(replay_count((2, 4), 0), 2);
-    assert_eq!(replay_count((2, 4), 16384), 3);
-    assert_eq!(replay_count((2, 4), 0x7fff), 3); // ⌊32767·2/32768⌋ = 1
-                                                 // Malformed (max < min) degrades to min.
-    assert_eq!(replay_count((5, 2), 0x7fff), 5);
-}
-
 #[test]
 fn defense_anim_matches_the_byte_lut() {
     // Decision 0279: the `0x60ec98` LUT read off WoW.exe — dagger parries 1H (unlike its swing),
diff --git a/crates/benilla-app/src/creature_anim/sheath.rs b/crates/benilla-app/src/creature_anim/sheath.rs
index 79275c10..1161911f 100644
--- a/crates/benilla-app/src/creature_anim/sheath.rs
+++ b/crates/benilla-app/src/creature_anim/sheath.rs
@@ -341,7 +341,6 @@ fn arm_leg(
 /// gets at most one masked overlay, and [`VisualSheath`] holds that arm's pre-swap placement until
 /// its clip reaches the authored `$SHL`/`$SHR` moment. An arm whose leg has no playable clip
 /// snaps; no arm playing anything at all → no ceremony, and the whole transition snaps.
-#[allow(clippy::too_many_arguments)]
 pub(super) fn start_sheath_ceremony(
     commands: &mut Commands,
     entity: Entity,
@@ -380,7 +379,6 @@ pub(super) fn start_sheath_ceremony(
 /// [`sheath_phase2`] so it can reach for the new weapon. The ceremony ends when every arm has run
 /// out of legs, at which point [`VisualSheath`] is dropped and the resolver falls back to the
 /// committed state.
-#[allow(clippy::too_many_arguments)]
 pub(super) fn advance_sheath_ceremony(
     commands: &mut Commands,
     entity: Entity,
diff --git a/crates/benilla-app/src/creature_anim/spell_visual.rs b/crates/benilla-app/src/creature_anim/spell_visual.rs
index 7ca516ae..26197d15 100644
--- a/crates/benilla-app/src/creature_anim/spell_visual.rs
+++ b/crates/benilla-app/src/creature_anim/spell_visual.rs
@@ -19,7 +19,7 @@ use benilla_protocol::EntityKind;
 use crate::aura_visual::AuraProc;
 use crate::entities::ItemDisplays;
 use crate::items::Items;
-use crate::net::{NetCommands, NetEntity, ObjectStore};
+use crate::net::{FieldChanged, NetCommands, NetEntity, ObjectStore};
 use benilla_assets::{LockRecover, WorldAssets};
 
 use super::{
@@ -334,7 +334,7 @@ pub(super) fn load_spell_visuals(mut commands: Commands, assets: Option<Res<Worl
 #[derive(bevy::ecs::system::SystemParam)]
 pub(super) struct WeaponVisualSrc<'w, 's> {
     displays: Option<Res<'w, ItemDisplays>>,
-    items: Option<ResMut<'w, Items>>,
+    items: Option<Res<'w, Items>>,
     net: Option<Res<'w, NetCommands>>,
     units: Query<'w, 's, (Option<&'static NetEntity>, &'static ObjectStore)>,
 }
@@ -355,7 +355,7 @@ impl WeaponVisualSrc<'_, '_> {
             EntityKind::Player => s
                 .player_visible_item_entry(17)
                 .filter(|e| *e != 0)
-                .and_then(|entry| self.items.as_deref_mut()?.held(entry, self.net.as_deref()?))
+                .and_then(|entry| self.items.as_deref()?.held(entry, self.net.as_deref()?))
                 .map(|t| t.display_info_id),
             _ => None,
         }
@@ -765,7 +765,6 @@ fn play_impact(
 ///   have no packet, decision 0099): field set → the **channel** kit's anim as the hold + its
 ///   sound once at start; field cleared → hold drops. The per-entity edge cache is the dedup the
 ///   client gets from its per-tick armed-id guard — a held channel never restarts its clip.
-#[allow(clippy::too_many_arguments)]
 pub(super) fn route_cast_visuals(
     mut commands: Commands,
     mut events: MessageReader<CastEvent>,
@@ -1323,15 +1322,24 @@ pub(super) fn route_cast_visuals(
 /// exactly that bug: Stealth's kit 312 carries no models, no anim and no attach at all (its whole
 /// visual is one proc-14 CharProc), so an effects-only test dropped it and the character showed
 /// nothing.
-#[allow(clippy::too_many_arguments)] // one Bevy system's full input set
+/// The reference's one aura watch: `UNIT_FIELD_AURA` + `UNIT_FIELD_AURAFLAGS` as a single
+/// registration — `0x604d00`, registered `604226 mov edx,0xa4` / `604221 push 0xd8` for class 3
+/// (wow-re `object-layer.md`): field offset `0xa4` = dword 41 past the 6 OBJECT fields =
+/// `FIELD_UNIT_AURA`, length `0xd8` bytes = 54 dwords = the 48 slot ids and the 6 packed flag words.
+const AURA_WATCH_BASE: u16 = benilla_protocol::field::FIELD_UNIT_AURA;
+const AURA_WATCH_SPAN: u16 = 54;
+
 pub(crate) fn arm_aura_state_fx(
-    // The slot diff below is a pure function of the store's aura fields, so it re-runs only when
-    // the store was written — `arm_level_up_fx`'s idiom (decision 1357's sibling gate): at the
-    // LBRS pin this was ~800 full aura-slot walks/frame re-deriving an unchanged answer. The
+    // The slot diff below is a pure function of the store's aura fields, so it re-runs for a unit
+    // only when one of THOSE moved — the field edges inside the reference's own aura watch span
+    // (decision 2297; before that, any store write: at the LBRS pin ~800 full aura-slot walks per
+    // frame re-deriving an unchanged answer, most of them health ticks) — and on the unit's first
+    // sight, because a standing aura is a STATE the streamed-in unit wears, not an edge. The
     // unfiltered twin runs exactly once per DBC-resource arrival: a unit that streamed in before
-    // `SpellVisuals`/`Spells` landed carries standing auras no store write will re-announce.
+    // `SpellVisuals`/`Spells` landed carries standing auras no edge will re-announce.
     units: Query<(Entity, &ObjectStore)>,
-    changed: Query<(Entity, &ObjectStore), Changed<ObjectStore>>,
+    arrived: Query<Entity, Added<ObjectStore>>,
+    mut edges: MessageReader<FieldChanged>,
     visuals: Option<Res<SpellVisuals>>,
     spells: Option<Res<crate::ui_action::Spells>>,
     mut fx: MessageWriter<SpellKitFx>,
@@ -1348,7 +1356,17 @@ pub(crate) fn arm_aura_state_fx(
     let scan = if full_sweep {
         units.iter().collect::<Vec<_>>()
     } else {
-        changed.iter().collect::<Vec<_>>()
+        let mut due: EntityHashSet = arrived.iter().collect();
+        due.extend(
+            edges
+                .read()
+                .filter(|e| {
+                    e.unit_array_slot(AURA_WATCH_BASE, AURA_WATCH_SPAN)
+                        .is_some()
+                })
+                .map(|e| e.entity),
+        );
+        due.into_iter().filter_map(|e| units.get(e).ok()).collect()
     };
     for (entity, store) in scan {
         let prev = armed.entry(entity).or_default();
@@ -1454,14 +1472,17 @@ pub(crate) fn arm_aura_state_fx(
 /// [`LOOT_FX_KEY`] — the client hangs loot art on the same `Effect_C` node type its spell
 /// visuals use, so sharing the one attach body is the faithful shape.
 pub(super) fn arm_loot_fx(
-    // Dead+lootable is a pure function of store fields — the same `Changed<ObjectStore>` gate as
-    // `arm_level_up_fx` below and `arm_aura_state_fx` above, with the same one-shot full sweep
-    // when the DBC resource lands after units already streamed in. `NetEntity` splits the two
-    // predicates: a **unit** answers `UNIT_DYNFLAG_LOOTABLE`, a **corpse object** answers its own
+    // Dead+lootable is a pure function of four store fields, so a unit is re-read on a field
+    // edge on any of them and on first sight (a body that streams in lootable wears the sparkle —
+    // the reference arms it at build, `0x5d6e30`, and re-arms off the field's own mirror handler),
+    // with the same one-shot full sweep as `arm_aura_state_fx` when the DBC resource lands after
+    // units already streamed in (decision 2297). `NetEntity` splits the two predicates: a **unit**
+    // answers `UNIT_DYNFLAG_LOOTABLE`, a **corpse object** answers its own
     // `CORPSE_FIELD_DYNAMIC_FLAGS` bit 0 (decision 1723) — different fields at different indices,
-    // and a corpse descriptor has no UNIT block to ask at all.
+    // and a corpse descriptor has no UNIT block to ask at all; the edge's `kind` keeps them apart.
     units: Query<(Entity, &ObjectStore, &crate::net::NetEntity)>,
-    changed: Query<(Entity, &ObjectStore, &crate::net::NetEntity), Changed<ObjectStore>>,
+    arrived: Query<Entity, Added<ObjectStore>>,
+    mut edges: MessageReader<FieldChanged>,
     visuals: Option<Res<SpellVisuals>>,
     mut fx: MessageWriter<SpellKitFx>,
     mut armed: Local<EntityHashSet>,
@@ -1474,7 +1495,24 @@ pub(super) fn arm_loot_fx(
     let scan = if full_sweep {
         units.iter().collect::<Vec<_>>()
     } else {
-        changed.iter().collect::<Vec<_>>()
+        use benilla_protocol::field::{
+            FIELD_CORPSE_DYNAMIC_FLAGS, FIELD_UNIT_DYNAMIC_FLAGS, FIELD_UNIT_HEALTH,
+            FIELD_UNIT_MAXHEALTH,
+        };
+        let mut due: EntityHashSet = arrived.iter().collect();
+        due.extend(
+            edges
+                .read()
+                .filter(|e| {
+                    e.unit_field(FIELD_UNIT_DYNAMIC_FLAGS)
+                        || e.unit_field(FIELD_UNIT_HEALTH)
+                        || e.unit_field(FIELD_UNIT_MAXHEALTH)
+                        || (e.kind == benilla_protocol::messages::ObjectType::Corpse
+                            && e.index == FIELD_CORPSE_DYNAMIC_FLAGS)
+                })
+                .map(|e| e.entity),
+        );
+        due.into_iter().filter_map(|e| units.get(e).ok()).collect()
     };
     for (entity, store, net) in scan {
         // The **corpse object**'s own sparkle (wow-re `corpse-decal-and-loot-sparkle.md` §Q2, §5
@@ -1539,51 +1577,46 @@ pub(super) fn arm_loot_fx(
 /// `UNIT_FIELD_LEVEL` **change** on any streamed unit (the client's descriptor change-watcher
 /// `CMirrorHandler 0x6045b0` → `SpawnHardcodedEffect(5)`) spawns [`LEVEL_UP_EFFECT`]
 /// (`Spells\LevelUp\LevelUp.mdl`) at the base attach — the ding visual is DECOUPLED from
-/// `SMSG_LEVELUP_INFO`, so anyone leveling nearby flashes too. First sight of a unit arms
-/// silently (it streamed in *carrying* a level, it didn't just gain one). The instance
-/// self-terminates on its own 1.867 s clip (spell id 0, the kit-push stage-0 shape — no reap
-/// key needed, unlike the persistent loot sparkle above), and its **sound is the model's own**
-/// `$SND(888)` event → `Sound\Spells\LevelUp.wav`, fired by
+/// `SMSG_LEVELUP_INFO`, so anyone leveling nearby flashes too. A unit that streams in
+/// *carrying* a level didn't just gain one — and the field-edge stream is create-suppressed, so
+/// that needs no memory here (decision 2297; this was the first `Local<EntityHashMap>` shadow
+/// to go). The instance self-terminates on its own 1.867 s clip (spell id 0, the kit-push
+/// stage-0 shape — no reap key needed, unlike the persistent loot sparkle above), and its
+/// **sound is the model's own** `$SND(888)` event → `Sound\Spells\LevelUp.wav`, fired by
 /// `crate::entities::spell_fx`'s event-track scanner.
 pub(super) fn arm_level_up_fx(
-    changed: Query<(Entity, &ObjectStore), Changed<ObjectStore>>,
-    units: Query<(), With<ObjectStore>>,
+    mut edges: MessageReader<FieldChanged>,
     visuals: Option<Res<SpellVisuals>>,
-    mut levels: Local<EntityHashMap<u32>>,
     mut fx: MessageWriter<SpellKitFx>,
 ) {
-    for (entity, store) in &changed {
-        let Some(level) = store.0.unit_level() else {
+    for e in edges.read() {
+        if !e.unit_field(benilla_protocol::field::FIELD_UNIT_LEVEL) {
             continue;
-        };
-        match levels.insert(entity, level) {
-            Some(prev) if prev != level => {
-                let Some((effect, path)) = visuals
-                    .as_ref()
-                    .and_then(|v| v.0.hardcoded_effect(LEVEL_UP_EFFECT))
-                else {
-                    continue; // no client data / no such row (the DBC-resource degrade shape)
-                };
-                debug!("anim: level {prev} → {level}, the ding flashes ({entity})");
-                fx.write(SpellKitFx::Begin {
-                    entity,
-                    spell_id: 0,
-                    persistent: false,
-                    class: FxClass::Hold,
-                    // The ding self-terminates on its own 1.867 s clip — the stage-0 shape.
-                    stage: FxStage::OneShot,
-                    effects: vec![FxSlot {
-                        tag: HARDCODED_FX_ATTACH,
-                        effect,
-                        path: path.to_string(),
-                    }],
-                });
-            }
-            _ => {} // first sight arms; an unchanged write is a no-op
         }
+        let Some((effect, path)) = visuals
+            .as_ref()
+            .and_then(|v| v.0.hardcoded_effect(LEVEL_UP_EFFECT))
+        else {
+            continue; // no client data / no such row (the DBC-resource degrade shape)
+        };
+        debug!(
+            "anim: level {} → {}, the ding flashes ({})",
+            e.old, e.new, e.entity
+        );
+        fx.write(SpellKitFx::Begin {
+            entity: e.entity,
+            spell_id: 0,
+            persistent: false,
+            class: FxClass::Hold,
+            // The ding self-terminates on its own 1.867 s clip — the stage-0 shape.
+            stage: FxStage::OneShot,
+            effects: vec![FxSlot {
+                tag: HARDCODED_FX_ATTACH,
+                effect,
+                path: path.to_string(),
+            }],
+        });
     }
-    // Streamed units despawn on range-out — drop their level memory with them.
-    levels.retain(|e, _| units.contains(*e));
 }
 
 /// The **mount poof** — the cloud the director reports seeing at mount-up and we never drew.
@@ -1617,45 +1650,41 @@ pub(super) fn arm_level_up_fx(
 /// today (the mounted gate refuses a second mount spell) and bounded at "one extra puff", so it
 /// is named rather than modelled.
 pub(super) fn arm_mount_poof_fx(
-    changed: Query<(Entity, &ObjectStore), Changed<ObjectStore>>,
-    units: Query<(), With<ObjectStore>>,
+    mut edges: MessageReader<FieldChanged>,
     visuals: Option<Res<SpellVisuals>>,
-    mut displays: Local<EntityHashMap<u32>>,
     mut fx: MessageWriter<SpellKitFx>,
 ) {
-    for (entity, store) in &changed {
-        let mount_display = store.0.unit_mount_display_id();
-        match displays.insert(entity, mount_display) {
-            // The build leg's gate is on the NEW value, so a dismount (`mount_display == 0`)
-            // spawns nothing — and first sight arms silently, exactly like the ding: a unit that
-            // streams in already mounted did not just mount.
-            Some(prev) if prev != mount_display && mount_display != 0 => {
-                let Some((effect, path)) = visuals
-                    .as_ref()
-                    .and_then(|v| v.0.hardcoded_effect(MOUNT_POOF_EFFECT))
-                else {
-                    continue; // no client data / no such row (the DBC-resource degrade shape)
-                };
-                debug!("anim: mount display {prev} → {mount_display}, the poof puffs ({entity})");
-                fx.write(SpellKitFx::Begin {
-                    entity,
-                    spell_id: 0,
-                    persistent: false,
-                    class: FxClass::Hold,
-                    // `0x5fbf50` — destroy at the first completion; the shipped model runs 2.8 s.
-                    stage: FxStage::OneShot,
-                    effects: vec![FxSlot {
-                        tag: HARDCODED_FX_ATTACH,
-                        effect,
-                        path: path.to_string(),
-                    }],
-                });
-            }
-            _ => {}
+    for e in edges.read() {
+        // The build leg's gate is on the NEW value, so a dismount (`new == 0`) spawns nothing —
+        // and a unit that streams in already mounted did not just mount, which the
+        // create-suppressed edge stream says for us, exactly as for the ding (2297).
+        if !e.unit_field(benilla_protocol::field::FIELD_UNIT_MOUNTDISPLAYID) || e.new == 0 {
+            continue;
         }
+        let Some((effect, path)) = visuals
+            .as_ref()
+            .and_then(|v| v.0.hardcoded_effect(MOUNT_POOF_EFFECT))
+        else {
+            continue; // no client data / no such row (the DBC-resource degrade shape)
+        };
+        debug!(
+            "anim: mount display {} → {}, the poof puffs ({})",
+            e.old, e.new, e.entity
+        );
+        fx.write(SpellKitFx::Begin {
+            entity: e.entity,
+            spell_id: 0,
+            persistent: false,
+            class: FxClass::Hold,
+            // `0x5fbf50` — destroy at the first completion; the shipped model runs 2.8 s.
+            stage: FxStage::OneShot,
+            effects: vec![FxSlot {
+                tag: HARDCODED_FX_ATTACH,
+                effect,
+                path: path.to_string(),
+            }],
+        });
     }
-    // Streamed units despawn on range-out — drop their mount memory with them.
-    displays.retain(|e, _| units.contains(*e));
 }
 
 /// The one-slot **pending-morph latch** — the reference's `[unit+0xd54]`, a `SpellRec*` (wow-re
@@ -1689,52 +1718,40 @@ fn is_morph_spell(spells: &crate::ui_action::Spells, spell_id: u32) -> bool {
     })
 }
 
-/// Arm [`MorphLatch`] from the aura-slot diff — the reference's TWO arm sites folded into the
-/// one place benilla sees both edges: the aura-add watcher and the aura-remove handler's tail
+/// Arm [`MorphLatch`] from the aura-slot edges — the reference's TWO arm sites folded into the
+/// one place benilla sees both: the aura-add watcher and the aura-remove handler's tail
 /// (`0x6123ad`) both call `0x5ff0c0(spellId)`, and a later arm overwrites an earlier one (one
-/// slot). First sight of a unit seeds the diff baseline silently — the reference's watchers
-/// fire on VALUES deltas, never on create, so a druid streaming in mid-form must not latch.
-/// Keyed to its own full-slot diff rather than [`arm_aura_state_fx`]'s `armed` map, which
-/// tracks only state-kit spells — the form spells carry none.
+/// slot). Each `UNIT_FIELD_AURA` slot edge is one dword of `0x604d00`'s watch (decision 2297):
+/// its old spell is a REMOVE arm, its new spell an ADD arm — remove first, add second, so a
+/// form→form swap in one slot latches the form being ENTERED (both resolve to the same cloud
+/// family regardless). A unit's first sight emits no edge, so a druid streaming in mid-form does
+/// not latch — the reference's watchers fire on VALUES deltas, never on create.
 pub(super) fn arm_morph_latch(
-    units: Query<(Entity, &ObjectStore)>,
-    changed: Query<(Entity, &ObjectStore), Changed<ObjectStore>>,
+    units: Query<(), With<ObjectStore>>,
+    mut edges: MessageReader<FieldChanged>,
     spells: Option<Res<crate::ui_action::Spells>>,
     mut latch: ResMut<MorphLatch>,
-    mut seen: Local<EntityHashMap<Vec<u32>>>,
 ) {
-    for (entity, store) in &changed {
-        let mut cur: Vec<u32> = store.0.unit_auras().map(|a| a.spell_id).collect();
-        cur.sort_unstable();
-        cur.dedup();
-        match seen.entry(entity) {
-            bevy::platform::collections::hash_map::Entry::Vacant(e) => {
-                e.insert(cur); // first sight arms silently
+    if let Some(spells) = spells.as_deref() {
+        for e in edges.read() {
+            if e.unit_array_slot(
+                benilla_protocol::field::FIELD_UNIT_AURA,
+                u16::from(benilla_protocol::messages::UNIT_AURA_SLOTS),
+            )
+            .is_none()
+            {
+                continue;
             }
-            bevy::platform::collections::hash_map::Entry::Occupied(mut e) => {
-                let prev = e.get_mut();
-                if *prev == cur {
-                    continue; // some other field moved
+            for spell_id in [e.old, e.new] {
+                if spell_id != 0 && is_morph_spell(spells, spell_id) {
+                    debug!("anim: morph latch armed ({}, spell {spell_id})", e.entity);
+                    latch.0.insert(e.entity, spell_id);
                 }
-                if let Some(spells) = spells.as_deref() {
-                    // Remove edges first, add edges second: a form→form swap latches the form
-                    // being ENTERED (both resolve to the same cloud family regardless).
-                    let removed = prev.iter().filter(|s| cur.binary_search(s).is_err());
-                    let added = cur.iter().filter(|s| prev.binary_search(s).is_err());
-                    for &spell_id in removed.chain(added) {
-                        if is_morph_spell(spells, spell_id) {
-                            debug!("anim: morph latch armed ({entity}, spell {spell_id})");
-                            latch.0.insert(entity, spell_id);
-                        }
-                    }
-                }
-                *prev = cur;
             }
         }
     }
-    // Streamed units despawn on range-out — the latch and the baseline die with them.
+    // Streamed units despawn on range-out — the latch dies with them.
     latch.0.retain(|e, _| units.contains(*e));
-    seen.retain(|e, _| units.contains(*e));
 }
 
 /// The rebuild's **impact-kit replay** — the tail of the reference's `0x60abe0` (wow-re
@@ -1748,7 +1765,6 @@ pub(super) fn arm_morph_latch(
 /// cold-cache shift-in — whose SPELL_GO impact instance was still PENDING at the drain and thus
 /// survived — briefly runs that instance and the replay's twin together (one denser cloud, once
 /// per session per model; the warm-cache GO instance dies in the drain like the reference's).
-#[allow(clippy::too_many_arguments)] // one Bevy system's full input set
 pub(super) fn replay_morph_kit(
     mut swaps: MessageReader<crate::entities::DisplaySwapped>,
     visuals: Option<Res<SpellVisuals>>,
diff --git a/crates/benilla-app/src/creature_anim/spell_visual/tests.rs b/crates/benilla-app/src/creature_anim/spell_visual/tests.rs
index ffa27d95..b8aec7fd 100644
--- a/crates/benilla-app/src/creature_anim/spell_visual/tests.rs
+++ b/crates/benilla-app/src/creature_anim/spell_visual/tests.rs
@@ -47,6 +47,7 @@ fn app() -> App {
         .add_message::<crate::weapon_trail::TrailArm>()
         .add_message::<super::BaseAnimRecompute>()
         .add_message::<SpellKitFx>()
+        .add_message::<crate::net::FieldChanged>()
         .add_message::<MissileSpawn>()
         .add_message::<crate::entities::dest_fx::GroundBurst>()
         .add_message::<super::ChainProcPlay>()
@@ -210,6 +211,7 @@ fn precast_kit_sound_rings_once_at_start() {
         .add_message::<crate::weapon_trail::TrailArm>()
         .add_message::<super::BaseAnimRecompute>()
         .add_message::<SpellKitFx>()
+        .add_message::<crate::net::FieldChanged>()
         .add_message::<MissileSpawn>()
         .add_message::<crate::entities::dest_fx::GroundBurst>()
         .add_message::<super::ChainProcPlay>()
@@ -489,6 +491,7 @@ fn aura_state_kit_arms_persistent_and_reaps_on_aura_end() {
     let mut app = App::new();
     app.add_plugins(MinimalPlugins);
     app.add_message::<SpellKitFx>();
+    app.add_message::<crate::net::FieldChanged>();
     // The watcher's other fan-outs: the kit's CharProc edges (`crate::aura_visual`) and its
     // sound leg (0852). Food's kit 409 carries neither, so nothing is asserted here — the
     // messages just have to exist for the writers.
@@ -553,7 +556,12 @@ fn aura_state_kit_arms_persistent_and_reaps_on_aura_end() {
     let eating = ObjectFields::from_pairs(&[(47, FOOD), (95, 0x0E)]);
     let fasted = ObjectFields::from_pairs(&[(95, 0)]);
 
-    let unit = app.world_mut().spawn(crate::net::ObjectStore(eating)).id();
+    let unit = app
+        .world_mut()
+        .spawn(crate::net::ObjectStore(
+            eating.into_created(benilla_protocol::messages::ObjectType::Unit),
+        ))
+        .id();
     app.update();
     {
         let log = &app.world().resource::<FxLog>().0;
@@ -591,9 +599,11 @@ fn aura_state_kit_arms_persistent_and_reaps_on_aura_end() {
     );
 
     // The aura leaves the slots: one AuraState reap.
-    app.world_mut()
-        .entity_mut(unit)
-        .insert(crate::net::ObjectStore(fasted));
+    crate::net::apply_fields_for_test(
+        app.world_mut(),
+        unit,
+        fasted.into_created(benilla_protocol::messages::ObjectType::Unit),
+    );
     app.update();
     {
         let log = &app.world().resource::<FxLog>().0;
@@ -639,6 +649,7 @@ fn a_harmful_go_wounds_each_hit_once_and_a_missile_arrival_always() {
         .add_message::<crate::weapon_trail::TrailArm>()
         .add_message::<super::BaseAnimRecompute>()
         .add_message::<SpellKitFx>()
+        .add_message::<crate::net::FieldChanged>()
         .add_message::<MissileSpawn>()
         .add_message::<crate::entities::dest_fx::GroundBurst>()
         .add_message::<super::ChainProcPlay>()
@@ -747,6 +758,7 @@ fn missile_spawn_defers_iff_the_cast_kit_animates() {
         .add_message::<crate::weapon_trail::TrailArm>()
         .add_message::<super::BaseAnimRecompute>()
         .add_message::<SpellKitFx>()
+        .add_message::<crate::net::FieldChanged>()
         .add_message::<MissileSpawn>()
         .add_message::<crate::entities::dest_fx::GroundBurst>()
         .add_message::<super::ChainProcPlay>()
@@ -861,6 +873,7 @@ fn a_targetless_dest_go_spawns_a_ground_missile_whose_arrival_sounds_at_the_poin
         .add_message::<crate::weapon_trail::TrailArm>()
         .add_message::<super::BaseAnimRecompute>()
         .add_message::<SpellKitFx>()
+        .add_message::<crate::net::FieldChanged>()
         .add_message::<MissileSpawn>()
         .add_message::<crate::entities::dest_fx::GroundBurst>()
         .add_message::<super::ChainProcPlay>()
@@ -1055,6 +1068,7 @@ fn the_mount_poof_puffs_on_the_build_leg_only() {
     let mut app = App::new();
     app.add_plugins(MinimalPlugins);
     app.add_message::<SpellKitFx>();
+    app.add_message::<crate::net::FieldChanged>();
     app.insert_resource(SpellVisuals(
         SpellVisualCatalog::from_tables(HashMap::new(), HashMap::new()).with_hardcoded(
             "HARDCODED Mount Poof",
@@ -1064,10 +1078,14 @@ fn the_mount_poof_puffs_on_the_build_leg_only() {
     ));
     app.add_systems(Update, super::arm_mount_poof_fx);
 
-    let store =
-        |v: u32| crate::net::ObjectStore(ObjectFields::from_pairs(&[(FIELD_MOUNTDISPLAYID, v)]));
-    // Streams in ALREADY mounted: first sight arms the memory, silently.
-    let unit = app.world_mut().spawn(store(2404)).id();
+    let fields = |v: u32| ObjectFields::from_pairs(&[(FIELD_MOUNTDISPLAYID, v)]);
+    // Streams in ALREADY mounted: the create block is no edge (decision 2297), so silence.
+    let unit = app
+        .world_mut()
+        .spawn(crate::net::ObjectStore(
+            fields(2404).into_created(benilla_protocol::messages::ObjectType::Unit),
+        ))
+        .id();
     app.update();
     let puffs = |app: &mut App| -> Vec<super::FxSlot> {
         let mut out = Vec::new();
@@ -1090,12 +1108,12 @@ fn the_mount_poof_puffs_on_the_build_leg_only() {
     );
 
     // Dismount — the NEW value is 0, so the build leg (and the whole allocation) is skipped.
-    app.world_mut().entity_mut(unit).insert(store(0));
+    crate::net::apply_fields_for_test(app.world_mut(), unit, fields(0));
     app.update();
     assert!(puffs(&mut app).is_empty(), "no poof on the way down");
 
     // Mount: 0 → N.
-    app.world_mut().entity_mut(unit).insert(store(2404));
+    crate::net::apply_fields_for_test(app.world_mut(), unit, fields(2404));
     app.update();
     assert_eq!(
         puffs(&mut app),
@@ -1108,12 +1126,12 @@ fn the_mount_poof_puffs_on_the_build_leg_only() {
     );
 
     // A steady mounted frame is not an edge — the watcher fires on the field CHANGING.
-    app.world_mut().entity_mut(unit).insert(store(2404));
+    crate::net::apply_fields_for_test(app.world_mut(), unit, fields(2404));
     app.update();
     assert!(puffs(&mut app).is_empty(), "no re-puff while just riding");
 
     // A swap (N → N′) is a change, and the reference rebuilds and puffs again.
-    app.world_mut().entity_mut(unit).insert(store(2405));
+    crate::net::apply_fields_for_test(app.world_mut(), unit, fields(2405));
     app.update();
     assert_eq!(
         puffs(&mut app),
@@ -1234,7 +1252,8 @@ fn a_kit_with_a_chain_char_proc_asks_for_a_beam_from_both_dispatcher_sites() {
     let channeller = app
         .world_mut()
         .spawn(crate::net::ObjectStore(
-            benilla_protocol::ObjectFields::from_pairs(&[(144, BEAM_SPELL)]),
+            benilla_protocol::ObjectFields::from_pairs(&[(144, BEAM_SPELL)])
+                .into_created(benilla_protocol::messages::ObjectType::Unit),
         ))
         .id();
     app.update();
@@ -1351,6 +1370,7 @@ fn real_shooter(weapon: &RealRanged) -> Option<(App, Entity)> {
         .add_message::<crate::weapon_trail::TrailArm>()
         .add_message::<super::BaseAnimRecompute>()
         .add_message::<SpellKitFx>()
+        .add_message::<crate::net::FieldChanged>()
         .add_message::<MissileSpawn>()
         .add_message::<crate::entities::dest_fx::GroundBurst>()
         .add_message::<super::ChainProcPlay>()
@@ -1523,11 +1543,12 @@ fn a_shooter_with_no_ranged_weapon_resolves_no_clip_at_all() {
         return;
     };
     // Strip the equipment field — the wire's "nothing in slot 17".
-    app.world_mut()
-        .entity_mut(unit)
-        .insert(crate::net::ObjectStore(
-            benilla_protocol::ObjectFields::from_pairs(&[(VISIBLE_RANGED_ENTRY_FIELD, 0)]),
-        ));
+    crate::net::apply_fields_for_test(
+        app.world_mut(),
+        unit,
+        benilla_protocol::ObjectFields::from_pairs(&[(VISIBLE_RANGED_ENTRY_FIELD, 0)])
+            .into_created(benilla_protocol::messages::ObjectType::Unit),
+    );
     app.world_mut()
         .write_message(cast_event(unit, AUTO_SHOT, CastEventKind::Start));
     app.world_mut()
@@ -1580,6 +1601,7 @@ fn a_state_kits_anim_is_a_recompute_and_never_a_second_play() {
         .add_message::<crate::weapon_trail::TrailArm>()
         .add_message::<super::BaseAnimRecompute>()
         .add_message::<SpellKitFx>()
+        .add_message::<crate::net::FieldChanged>()
         .add_message::<MissileSpawn>()
         .add_message::<crate::entities::dest_fx::GroundBurst>()
         .add_message::<super::ChainProcPlay>()
@@ -1678,6 +1700,7 @@ fn an_anim_only_state_kit_still_arms_on_the_aura_add_edge() {
     let mut app = App::new();
     app.add_plugins(MinimalPlugins);
     app.add_message::<SpellKitFx>()
+        .add_message::<crate::net::FieldChanged>()
         .add_message::<crate::aura_visual::AuraProc>()
         .add_message::<SpellKitSound>()
         .add_message::<super::BaseAnimRecompute>();
@@ -1711,10 +1734,10 @@ fn an_anim_only_state_kit_still_arms_on_the_aura_add_edge() {
 
     let unit = app
         .world_mut()
-        .spawn(crate::net::ObjectStore(ObjectFields::from_pairs(&[
-            (47, SPELL),
-            (95, 0x0E),
-        ])))
+        .spawn(crate::net::ObjectStore(
+            ObjectFields::from_pairs(&[(47, SPELL), (95, 0x0E)])
+                .into_created(benilla_protocol::messages::ObjectType::Unit),
+        ))
         .id();
     app.update();
 
diff --git a/crates/benilla-app/src/cursor.rs b/crates/benilla-app/src/cursor.rs
index 805ca1ae..57617f70 100644
--- a/crates/benilla-app/src/cursor.rs
+++ b/crates/benilla-app/src/cursor.rs
@@ -336,11 +336,23 @@ impl Plugin for CursorPlugin {
         app.init_resource::<DisplayedCursor>();
         #[cfg(target_os = "macos")]
         app.add_systems(Startup, macos::setup.after(AssetSet::Open))
-            .add_systems(Update, (drive_displayed_cursor, macos::drive).chain());
+            .add_systems(
+                Update,
+                (drive_displayed_cursor, macos::drive)
+                    .chain()
+                    // After the tick: a FrameXML `SetCursor` made this frame is read here.
+                    .after(crate::ui_script::UiInput),
+            );
         #[cfg(not(target_os = "macos"))]
         app.init_resource::<other::PayloadCursorImages>()
             .add_systems(Startup, other::setup.after(AssetSet::Open))
-            .add_systems(Update, (drive_displayed_cursor, other::drive).chain());
+            .add_systems(
+                Update,
+                (drive_displayed_cursor, other::drive)
+                    .chain()
+                    // After the tick: a FrameXML `SetCursor` made this frame is read here.
+                    .after(crate::ui_script::UiInput),
+            );
     }
 }
 
@@ -388,7 +400,6 @@ mod other {
     /// Each frame: while a cursor payload with a resolved icon is held, show ITS 32×32 hardware
     /// cursor (decoded/downsampled on first use, then cached by path); otherwise swap to the
     /// classified mode (base-stem fallback, then Point, then OS) — unchanged from before 0216 §5.
-    #[allow(clippy::too_many_arguments)]
     pub(super) fn drive(
         mut commands: Commands,
         cursor: Res<super::DisplayedCursor>,
@@ -543,7 +554,6 @@ mod macos {
     /// §5, decoded/downsampled to 32×32 on first use and cached by path) if one is held and
     /// resolved, else the classified mode (base-stem fallback, then Point); on entering/leaving
     /// mouselook, hide/show it via the app-global hide counter.
-    #[allow(clippy::too_many_arguments)]
     pub(super) fn drive(
         cursors: Option<NonSend<NativeCursors>>,
         mut payload_cursors: NonSendMut<PayloadCursors>,
diff --git a/crates/benilla-app/src/cvars.rs b/crates/benilla-app/src/cvars.rs
index f66669ed..0615c76b 100644
--- a/crates/benilla-app/src/cvars.rs
+++ b/crates/benilla-app/src/cvars.rs
@@ -1,67 +1,61 @@
-//! benilla's **CVar host** — registration, knob sync, and the client's first persistence
-//! (decision 0954). The engine holds the table and the Lua API ([`benilla_ui::script`]'s
-//! `GetCVar`/`SetCVar`); this module is everything host-side:
+//! benilla's **CVar registry** — the client's configuration store, host side (decisions 0954,
+//! 2303). The reference keeps every player setting in one engine-side table
+//! (`ConsoleVar.cpp`, a `TSHashTable<CVar>` of 0xc4-byte records: name, value, default, the
+//! latch slot, and a change callback the owning subsystem hands `CVar::Register 0x63db90`).
+//! This module is that table: [`Cvars`] holds the live value of every registered row, it is
+//! what survives a VM replacement, and it is what `config.toml` is composed from. The script VM
+//! carries a **mirror** of it for Lua's synchronous `GetCVar`/`SetCVar`
+//! ([`benilla_ui::script::UiScript::seed_cvars`]); the mirror's writes ride a queue back here.
 //!
 //! - **The registered set** ([`REGISTERED`]): only vars something actually reads — a host knob,
-//!   or (since 1140) a live Lua consumer, which is the same rule seen from the UI side and the
-//!   only refinement the honest-tree law has needed.
-//!
-//!   **A row's default is the REFERENCE's default** (decision 1804), and every row says where it
-//!   stands against it — that is [`Registered::reference`], a mandatory third column with no
-//!   "unknown" variant, so a new row cannot be added without answering the question. Two tests
-//!   hold it: one checks each row's claim in both directions (a `Same` that drifted, *and* a
-//!   `Deviates` that quietly came back into agreement), the other pins the deviation set as a
-//!   readable list. Beside that, and unchanged, each default is still **welded to the code
-//!   constant it mirrors** — `SoundConfig`, `NameConfig`, `ZoomLimit` and the rest — so the CVar
-//!   table and the knob it feeds cannot drift apart either.
+//!   or (since 1140) a live Lua consumer. **A row's default is the REFERENCE's default**
+//!   (decision 1804), and every row says where it stands against it — [`Registered::reference`],
+//!   a mandatory column with no "unknown" variant. Two tests hold it: one checks each row's claim
+//!   in both directions, the other pins the deviation set as a readable list. A row the reference
+//!   **latches** (flag bit1 at its register site) says so with [`Registered::latched`]; a
+//!   structural test insists every row has a reader somewhere in the source.
 //!
 //!   **The reference column has one source**: wow-re's
 //!   `system/cvar/scratch/registered-defaults-census.md` and the regenerable manifest beside it,
 //!   `re/cvar/cvar-register-sites.tsv` — all 214 of the reference's `CVar::Register` sites with
-//!   name, help, flags, default string, callback, category and record global. 1804 dispatched the
-//!   §5 round that built it; a new row looks its answer up there rather than re-deriving it, and a
-//!   row that disagrees with it is a contradiction to resolve before it lands (`method.md`).
-//! - **Boot**: read `benilla-config/config.toml` ([`crate::local_state`]) and apply it to the knob
-//!   resources; when the UI VM exists, register the table and push the resolved session values
-//!   so `GetCVar` answers what the client is actually doing.
-//! - **Sync**: drain Lua `SetCVar` changes into the knob resources each frame and mark the
-//!   config dirty.
+//!   name, help, flags, default string, callback, category and record global. A new row looks
+//!   its answer up there rather than re-deriving it.
+//!
+//! - **The change callback is a Bevy observer** ([`CvarChanged`]). An accepted move of a row's
+//!   applied value is triggered as one event, and the subsystem that owns the knob observes it
+//!   beside the knob (`sound::on_cvar`, `video::on_cvar`, …), writing only its own resource — so
+//!   `Res::is_changed()` on a knob is honest again, which the 32-resource bundle this replaced
+//!   could not offer (it deref-mutted every knob on every write; three consumers carried the
+//!   written workaround). The registry never applies anything itself: it has no knob, and no arm.
+//!
+//! - **The latch** ([`Row::pending`]): a write to a latched row is staged, `GetCVar` keeps
+//!   answering the applied value, and nothing fires until [`Cvars::commit_latched`] — which is
+//!   the reference's `CVar::Update 0x63e060`, called for the `gx*` rows from inside `RestartGx`
+//!   (the video window's Okay). A staged value that is never committed is dropped at exit, as
+//!   the reference's is (`SaveConfig` writes `rec+0x20`, the applied value).
+//!
+//! - **Boot**: read `benilla-config/config.toml` ([`crate::local_state`]) into the registry and
+//!   fire the observers synchronously, before anything ordered after [`CvarLoad`] runs; when the
+//!   UI VM exists, seed its mirror from the registry so `GetCVar` answers what the client is doing.
+//! - **Sync**: per frame, drain the VM's registrations and writes into the registry, push the
+//!   registry's own writes into the mirror, and trigger the accepted moves.
 //! - **Save**: dirty + one quiet second → rewrite `config.toml` atomically (and flush on
 //!   `AppExit`). The file holds **only values that moved off their default** — a diff, not a
-//!   dump — plus any entries this build doesn't know (a newer build's keys survive a downgrade;
-//!   same posture for a hand-added key: preserved verbatim, warned once).
+//!   dump — plus any entries this build doesn't know (a newer build's keys, an addon's before it
+//!   registers them: preserved verbatim, warned once).
 //!
 //! **Env overrides win for the session and never touch the file**: `WOW_UI_SCALE`/`WOW_FARCLIP`
-//! beat the loaded config (they exist to make taste iteration a relaunch — pinning one into the
-//! config would make the A/B sticky), the session runs and saves around them, and the file keeps
-//! whatever it already said for those keys.
+//! and their siblings beat the loaded config (they exist to make taste iteration a relaunch —
+//! pinning one into the config would make the A/B sticky), the session runs and saves around
+//! them, and the file keeps whatever it already said for those keys ([`Cvars::own_for_session`]).
 
-use std::collections::{BTreeMap, HashSet};
+use std::collections::{BTreeMap, HashMap, HashSet};
 use std::time::Instant;
 
 use bevy::prelude::*;
 
-use crate::chat_bubble::BubbleConfig;
-use crate::minimap::MinimapZoom;
-use crate::nameplates::NameConfig;
-use crate::player::camera::{
-    FollowConfig, FollowStyle, LookConfig, ZoomLimit, CAMERA_SPEED_RANGE, FOLLOW_SPEED_RANGE,
-    MOUSE_SPEED_RANGE,
-};
-use crate::portrait::PaneRate;
-use crate::sound::SoundConfig;
-use crate::target::ClickConfig;
-use crate::ui_chat::combat::UnitClass as CombatClass;
-use crate::ui_loot::LootConfig;
-use crate::ui_script::UiScaleCvar;
-use crate::video::VideoConfig;
-use crate::vplates::VPlateMode;
-use crate::shadow_core::SHADOW_DISTANCE_RANGE;
-use crate::world_backdrop::{RenderScale, RENDER_SCALE_RANGE};
-use benilla_ui::script::UiScript;
-use benilla_ui::widget::MINIMAP_ZOOM_LEVELS;
-use benilla_world::clutter::ClutterConfig;
-use benilla_world::view::{MsaaSetting, ViewDistance, FARCLIP_RANGE, MSAA_RANGE};
+use crate::ui_script::VmMemo;
+use benilla_ui::script::{SeededCvar, UiScript};
 
 /// One host-backed CVar: its registered name, benilla's shipped default, and — the column that
 /// exists so a divergence is a *decision* rather than an accident — **what the reference ships**
@@ -89,6 +83,21 @@ pub(crate) struct Registered {
     /// choice above it, never a value this client acts on.
     #[allow(dead_code)]
     pub(crate) reference: Reference,
+    /// The reference registers it with flag bit1 (`rec+0x1c & 0x2`, decision 2303): a write is
+    /// staged in [`Row::pending`] and applied only at the latch boundary
+    /// ([`Cvars::commit_latched`]). Read off `re/cvar/cvar-register-sites.tsv`'s `flags` column
+    /// (2 or 3); a test pins the set.
+    pub(crate) latched: bool,
+}
+
+impl Registered {
+    /// Mark the row latched — see [`Registered::latched`].
+    pub(crate) const fn latched(self) -> Self {
+        Self {
+            latched: true,
+            ..self
+        }
+    }
 }
 
 /// benilla's default, weighed against the reference's own.
@@ -144,6 +153,7 @@ const fn same(name: &'static str, default: &'static str) -> Registered {
         name,
         default,
         reference: Reference::Same(default),
+        latched: false,
     }
 }
 
@@ -159,6 +169,7 @@ const fn overridden(
         name,
         default,
         reference: Reference::Overridden { registered, why },
+        latched: false,
     }
 }
 
@@ -174,6 +185,7 @@ const fn deviates(
         name,
         default,
         reference: Reference::Deviates { value, why },
+        latched: false,
     }
 }
 
@@ -183,6 +195,7 @@ const fn ours(name: &'static str, default: &'static str, why: &'static str) -> R
         name,
         default,
         reference: Reference::Ours(why),
+        latched: false,
     }
 }
 
@@ -215,7 +228,7 @@ pub(crate) const REGISTERED: &[Registered] = &[
     // The address of the logon server — the reference's own CVar, byte-verified in `WoW.exe`
     // (the registration's string neighbours are `realmlist.wtf`, "Address of realm list server"
     // and `us.logon.worldofwarcraft.com:3724`; wow-re `mpq/scratch/startup-order-A.md` row 62).
-    // A **string** row, so it is matched ahead of the numeric parse in `apply_to_knobs`.
+    // A **string** row: the registry takes any string for it, and `realmlist::on_cvar` judges it.
     // The default diverges knowingly — see `realmlist::DEFAULT_REALMLIST`.
     deviates(
         crate::realmlist::CVAR_REALMLIST,
@@ -290,7 +303,7 @@ pub(crate) const REGISTERED: &[Registered] = &[
     // larger of its two, because the stall the crackle was measured from was a whole IO cycle
     // long and the depth exists to hide the next one. Applies at the next launch, like the
     // reference's.
-    same("SoundBufferSize", "100"),
+    same("SoundBufferSize", "100").latched(),
     // The output limiter (1551) — benilla's own, not a 1.12 CVar. The reference needs no such DSP
     // (its mix is FMOD 3's and its headroom lives in the SFX-bus auto-duck); benilla sums into f32
     // behind a hard clamp, and every WoW SFX is mastered to full scale, so two overlapping kits
@@ -652,7 +665,7 @@ pub(crate) const REGISTERED: &[Registered] = &[
     // hold honestly rather than by picking a number that merely looks right.
     //
     // The validator is `0x50c000` → `0x50b330`, range [0.1, 360], and it **rejects rather than
-    // clamps** — `apply_to_knobs` does the same below, which is why these two do not use the
+    // clamps** — `player::camera::on_cvar` does the same, which is why these two do not use the
     // clamping shape every other numeric row uses.
     same("cameraYawMoveSpeed", "180"),
     same("cameraPitchMoveSpeed", "90"),
@@ -664,8 +677,8 @@ pub(crate) const REGISTERED: &[Registered] = &[
     // **The spelling is FrameXML's, not the binary's**, and that is deliberate: `WoW.exe` holds
     // `mouseSpeed` (capital S, register site `0x402c7b`) while `UIOptionsFrame.lua`'s slider
     // writes `cvar = "mousespeed"`. The reference reconciles them by looking CVars up
-    // case-insensitively (`SStrCmpI`, wow-re `cvar/cvar.md`), and so do we (`apply_to_knobs`
-    // lowercases first), so both spellings answer. We take the one the interface uses, because
+    // case-insensitively (`SStrCmpI`, wow-re `cvar/cvar.md`), and so do we (the registry and
+    // every observer lowercase first), so both spellings answer. We take the one the interface uses, because
     // that is the one an addon will type.
     //
     // **The VALUE agrees and the MECHANISM does not** (wow-re
@@ -846,7 +859,7 @@ pub(crate) const REGISTERED: &[Registered] = &[
     // byte-verified (wow-re `addon-version-gate.md` §1.1: the key appears in Config.wtf exactly
     // while force-load is on and vanishes when it is turned off, `SaveConfig 0x63d980`'s
     // skip-default rule). No host knob: its consumers are the load walk (via the persisted value,
-    // [`CvarPersist::addon_version_check`]) and the gate's live per-query read in the VM.
+    // [`Cvars::addon_version_check`]) and the gate's live per-query read in the VM.
     same("checkAddonVersion", "1"),
     // **Which graphics API this run is actually on** (2151) — 1.12's own `gxApi`, byte-read at
     // `0x63a833`: name `0x842a64`, default string `0x864f7c` `"direct3d"`, help "graphics api",
@@ -880,7 +893,8 @@ pub(crate) const REGISTERED: &[Registered] = &[
         "direct3d",
         "2151: descriptive, not a selector — benilla renders through wgpu, which has no D3D9 \
          backend and no chooser; the value is the live adapter's own and is never persisted",
-    ),
+    )
+    .latched(),
     // Vertical Sync — 1.12's own `gxVSync`, the Video Options checkbox at index 5
     // (`OptionsFrame.lua`'s `OptionsFrameCheckButtons["VERTICAL_SYNC"]`, in the install's
     // FrameXML). The knob is [`crate::video::VideoConfig::vsync`], which the window's
@@ -893,13 +907,30 @@ pub(crate) const REGISTERED: &[Registered] = &[
     // Two knowing departures from the reference row, both stated on [`crate::video`]: its
     // `gxRestart = 1` does not apply (wgpu swaps the presentation interval live, so the box takes
     // effect on click), and `$WOW_NOVSYNC=1` overrides it session-only, below.
-    same("gxVSync", "1"),
+    same("gxVSync", "1").latched(),
     // Benilla's opt-in realtime shadow-map path, split into two INDEPENDENT lanes over one shared
     // shadow rig (one sun / one map). `worldShadows` = the static world (trees, buildings, foliage)
     // casts realtime shadows and baked MCSH terrain shadows switch off; `characterShadows` =
     // players/NPCs/creatures/mounts cast realtime silhouettes instead of the legacy oval blob.
-    same("worldShadows", "1"),
-    same("characterShadows", "1"),
+    //
+    // `ours(...)`, not `same(...)`: the reference has no realtime shadow at all — it bakes MCSH
+    // into the terrain and draws an oval under every unit — so there is no registered default for
+    // these two to agree with, and claiming `Same` would put a false entry in the one column
+    // [`Reference`] exists to keep honest. (They read `same("…", "1")` until the 2303 registry
+    // port; the default string is unchanged.)
+    ours(
+        "worldShadows",
+        "1",
+        "benilla's own: the static world (trees, buildings, alpha-tested foliage) casts a realtime \
+         shadow and the baked MCSH terrain shadows stand aside; the reference bakes and has no \
+         such switch",
+    ),
+    ours(
+        "characterShadows",
+        "1",
+        "benilla's own: units cast a realtime silhouette instead of the reference's oval blob \
+         decal, which is all 1.12 has and is therefore not a setting there",
+    ),
     // Realtime-shadow render distance in yards (the shadow-map cascade range + caster reach).
     // benilla's own — the reference has no realtime shadow to size. Clamped to SHADOW_DISTANCE_RANGE.
     ours(
@@ -1143,14 +1174,14 @@ pub(crate) const REGISTERED: &[Registered] = &[
     // caught its own instrument publishing a single arm mid-round). benilla is enUS-only, so `"0"`
     // is the answer here; the note exists so the next reader does not take a locale-conditional
     // default for an unconditional one.
-    same("gxWindow", "0"),
+    same("gxWindow", "0").latched(),
     // The **windowed** size, `gxResolution` — 1.12's own CVar name, narrowed to half its job.
     // There it is the display mode *and* the backbuffer; here it is only what "windowed" means,
     // because fullscreen is the monitor's own size and we expose no mode list to pick from (the
     // deviation decision 1092 already records for `GxAspect`, unchanged by 1627).
     //
-    // A **string** CVar, like it is in the reference — the one row [`apply_to_knobs`] has to match
-    // ahead of its numeric parse. Default is the 1600×900 that was the client's only size before
+    // A **string** CVar, like it is in the reference — the registry takes any string for it and
+    // `video::on_cvar` parses it. Default is the 1600×900 that was the client's only size before
     // 1627, so a windowed run is bit-for-bit where it was.
     deviates(
         "gxResolution",
@@ -1158,7 +1189,8 @@ pub(crate) const REGISTERED: &[Registered] = &[
         "640x480",
         "1627: narrowed to the WINDOWED size only — fullscreen is the monitor's own and we expose \
          no mode list, and 640x480 is not a window anyone would ship a client at",
-    ),
+    )
+    .latched(),
     // The body panes' half-rate render (decision 1444) — **benilla's own CVar**, no 1.12
     // counterpart: the reference draws its doll inside the main pass (no second view exists to
     // rate-limit), while our RTT booths (1069) re-run the render graph per pane per frame. "1" =
@@ -1178,15 +1210,14 @@ pub(crate) const REGISTERED: &[Registered] = &[
     // The select screen's memory of who you last entered the world as (decision 1622) — 1.12's
     // own `lastCharacterIndex`, help string "Last character selected". **No host knob**: the live
     // value is the character screen's own state ([`crate::char_select::Roster::pending_index`]),
-    // which this row only mirrors — the `statusBarText` posture, and why the arm in
-    // [`apply_to_knobs`] is empty.
+    // which this row only mirrors — the `statusBarText` posture, and why no observer watches it.
     //
     // Registered **"0"**, byte-read rather than chosen: `CVar::Register` at `0x402d93` pushes
     // default string `0x82e570` = "0", category 4, and caches the CVar* at `[0x882674]`. The value
     // is a **0-based** row (the engine's selection cell `[0x83856c]` under `"%d"`), so "0" is the
     // FIRST character and not a "no memory" sentinel — which is exactly why a stock `Config.wtf`
     // has no such line until you have played somebody other than your first character
-    // (`SaveConfig 0x63d980` skips values equal to their default; `compose_file` does the same).
+    // (`SaveConfig 0x63d980` skips values equal to their default; [`Cvars::compose`] does the same).
     // Multisample antialiasing — 1.12's own `gxMultisample`, registered at `0x63a950` with help
     // "multisample antialiasing" and flags `3` = registered | **latched**. The knob is
     // [`benilla_world::view::MsaaSetting`], read once at the world camera's spawn; its doc carries
@@ -1204,7 +1235,7 @@ pub(crate) const REGISTERED: &[Registered] = &[
     // Latched means a change is PENDING until the next launch — the reference's own callback
     // echoes "set pending gxRestart" — so this row persists and `GetCVar` answers it, while the
     // camera keeps what it was born with. `$WOW_MSAA` overrides it session-only, below.
-    same("gxMultisample", "1"),
+    same("gxMultisample", "1").latched(),
     // The multisample triple's other two thirds. The reference's Video dropdown formats all three
     // into one row (`MULTISAMPLING_FORMAT_STRING` = "%d-bit color %d-bit depth %dx multisample")
     // and `GetCurrentMultisampleFormat 0x48c580` looks up all three by name to find which row is
@@ -1224,13 +1255,15 @@ pub(crate) const REGISTERED: &[Registered] = &[
         "16",
         "1643: these describe, they do not steer — the pair is our swapchain's own, and every \
          format `MsaaFormats` publishes carries it",
-    ),
+    )
+    .latched(),
     deviates(
         "gxDepthBits",
         "32",
         "16",
         "1643: as `gxColorBits` — the depth half of the same descriptive pair",
-    ),
+    )
+    .latched(),
     // **The texture filter policy** — 1.12's own `trilinear` and `anisotropic`, over
     // `benilla_assets::TexFilterSetting`. The defaults are the reference's registered strings, and
     // benilla had neither CVar: it hardcoded trilinear + aniso 8 at every sampler it built, which
@@ -1354,12 +1387,97 @@ struct LocalConfig {
     cvars: BTreeMap<String, String>,
 }
 
-/// The persistence state: what the file said, which keys the environment overrides this
-/// session, and the dirty/debounce pair.
-#[derive(Resource, Default)]
-pub(crate) struct CvarPersist {
-    /// The file's `[cvars]` entries, verbatim spelling — the merge base every save starts from
-    /// (unknown keys ride through untouched, session-owned keys keep their stored value).
+// ─── The registry ────────────────────────────────────────────────────────────────────────────
+
+/// **One accepted move of a CVar's applied value** — the reference's change callback, as the
+/// Bevy event it is (decision 2303). Triggered by the registry's flushers for every write that
+/// changed a row's applied value (a Lua `SetCVar`, a `/console` line, a host write, a committed
+/// latch, and the loaded file at boot); observed by the subsystem that owns the knob, beside the
+/// knob, writing only its own resource.
+///
+/// Not fired for a write that changed nothing, for a staged (latched) value, or for a session
+/// override taking a row (the knob already read the env).
+#[derive(Event, Clone, Debug, PartialEq, Eq)]
+pub(crate) struct CvarChanged {
+    /// The registered spelling (`MasterVolume`).
+    pub(crate) name: String,
+    pub(crate) old: String,
+    pub(crate) new: String,
+}
+
+impl CvarChanged {
+    /// Case-insensitive, like every lookup the client makes.
+    pub(crate) fn is(&self, name: &str) -> bool {
+        self.name.eq_ignore_ascii_case(name)
+    }
+
+    /// The lowercased name — what an observer's `match` arms are spelled in.
+    pub(crate) fn key(&self) -> String {
+        self.name.to_ascii_lowercase()
+    }
+
+    /// The new value as a number. **The registry refuses an unparseable write to a numeric
+    /// row** ([`Cvars::set`]), so on a row whose default is a number this is never a fallback;
+    /// on a string row it is `0`, and an observer for a string row reads [`Self::new`] instead.
+    pub(crate) fn num(&self) -> f32 {
+        self.new.trim().parse().unwrap_or(0.0)
+    }
+
+    /// The new value as the client's flag: int-parse, then `!= 0`.
+    pub(crate) fn flag(&self) -> bool {
+        self.num() != 0.0
+    }
+}
+
+/// One row of the live registry — the reference's `CVar` record, the parts benilla keeps.
+#[derive(Clone, Debug)]
+pub(crate) struct Row {
+    /// The registered spelling.
+    pub(crate) name: String,
+    pub(crate) default: String,
+    /// The **applied** value: what `GetCVar` answers and what the file is composed from.
+    pub(crate) value: String,
+    /// A latched row's staged value (`rec+0x38`), applied by [`Cvars::commit_latched`].
+    pub(crate) pending: Option<String>,
+    /// [`Registered::latched`] — the reference's flag bit1.
+    pub(crate) latched: bool,
+    /// Declared by an addon's `RegisterCVar` rather than by [`REGISTERED`] (decision 1195): it
+    /// persists like any other row, and it is re-seeded into every later VM so the addon's own
+    /// re-declaration finds it and no-ops.
+    pub(crate) addon: bool,
+}
+
+impl Row {
+    /// A row whose default parses as a number holds numbers — the registry refuses a write
+    /// that does not parse ([`Cvars::set`]), so a numeric observer can trust [`CvarChanged::num`].
+    fn numeric(&self) -> bool {
+        self.default.trim().parse::<f32>().is_ok()
+    }
+}
+
+/// What a write did.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub(crate) enum SetOutcome {
+    /// No such row (warned).
+    Unknown,
+    /// A numeric row, and the value does not parse — refused, the applied value stands (warned).
+    Refused,
+    /// Already the applied value (or already the staged one).
+    Unchanged,
+    /// A latched row: staged, not applied; nothing fires until the commit.
+    Staged,
+    /// Applied: a [`CvarChanged`] is queued for the next flush and the config is dirty.
+    Changed,
+}
+
+/// **The registry** — the engine-side CVar table. See the module doc.
+#[derive(Resource)]
+pub(crate) struct Cvars {
+    rows: Vec<Row>,
+    /// Lowercased name → row.
+    index: HashMap<String, usize>,
+    /// The file's `[cvars]` entries, verbatim spelling — the merge base every save starts from:
+    /// unknown keys ride through untouched, session-owned keys keep their stored value.
     file: BTreeMap<String, String>,
     /// Lowercased names this SESSION owns rather than the player — never saved, and the file's
     /// own entry for them is left exactly as it was found.
@@ -1368,67 +1486,387 @@ pub(crate) struct CvarPersist {
     /// that stuck in `config.toml` would make an A/B or an instrument run sticky across
     /// relaunches. `gxApi` (2151) is the member that is not — it is owned by the session because
     /// it is a fact about the *machine* (the render adapter's backend), which is nobody's setting
-    /// to persist. The field was `env_overridden` until it gained that one.
+    /// to persist.
     session_owned: HashSet<String>,
-    /// The engine table has been registered + seeded — **once per VM**, not once per process
-    /// (decision 1290). A login builds a fresh VM, so the seed has to happen again: an
-    /// unregistered table answers every `GetCVar` with nil, and [`save_config`] composes
-    /// `config.toml` out of that same table.
-    registered: crate::ui_script::VmMemo<bool>,
+    /// Accepted moves not yet triggered — flushed by [`sync_cvars`] every frame, synchronously by
+    /// the boot load and the session-edge fold, and by any caller that wants its observers to
+    /// have run before its own dependents ([`Cvars::take_events`]).
+    events: Vec<CvarChanged>,
+    /// Host-side writes the VM's mirror has not seen yet — pushed by [`sync_cvars`] as host
+    /// writes (no echo). Cleared by a seed, which carries the whole table anyway.
+    outbox: Vec<(String, String)>,
     /// A change since the last save; `last_change` drives the one-quiet-second debounce.
     dirty: bool,
     last_change: Option<Instant>,
 }
 
-impl CvarPersist {
-    /// The saved-base pairs a VM's table is seeded from — the file's entries minus the ones the
-    /// session owns ([`CvarPersist::session_owned`]), which are never persisted.
-    ///
-    /// Extracted so `ui_script::lifecycle`'s world-entry edge can run the same seed before the
-    /// interface loads (decision 2115): the reference's own `UIOptionsFrame.xml` reads two CVars
-    /// in its dropdowns' `OnLoad`, and a `/reloadui` builds a fresh VM and loads the whole
-    /// interface before [`sync_cvars`]'s `Update` claim gets a turn. The ORDER at both call sites
-    /// is this first, `register_cvars` second (1291) — reversed, a reload resets every knobless
-    /// CVar to its factory value.
-    pub(crate) fn saved_base(&self) -> impl Iterator<Item = (String, String)> + '_ {
-        self.file
-            .iter()
-            .filter(|(k, _)| !self.session_owned.contains(&k.to_ascii_lowercase()))
-            .map(|(k, v)| (k.clone(), v.clone()))
-    }
-
-    /// One CVar as `config.toml` holds it — matched case-insensitively, so a hand-edited
-    /// spelling still answers.
-    ///
-    /// Read from the persist state rather than from the VM's table for the callers that want a
-    /// value **before, or outside, a registered table**: the addon load walk runs while the VM's
-    /// CVar table does not exist yet (registration is a per-VM `Update` seed, 1291), and the
-    /// select screen wants its remembered row the moment a roster lands, from a system that has
-    /// no business holding the VM (1622). The 1291 fold keeps this current across VM
-    /// replacements, so it is the value the reference's live read would see.
-    pub(crate) fn stored(&self, name: &str) -> Option<&str> {
-        self.file
-            .iter()
-            .find(|(k, _)| k.eq_ignore_ascii_case(name))
-            .map(|(_, v)| v.as_str())
-    }
-
-    /// A persist state that already holds one stored value — a launch whose `config.toml` said
-    /// so, without a file. `#[cfg(test)]` and `pub(crate)` because [`Self::file`] is private:
-    /// `char_select`'s restore test drives the real [`apply_roster_policy`] over a real remembered
-    /// row rather than a copy of its logic (the `Roster::with_pending_pick` posture).
-    #[cfg(test)]
-    pub(crate) fn with_stored(name: &str, value: &str) -> Self {
-        Self {
-            file: BTreeMap::from([(name.to_string(), value.to_string())]),
-            ..Self::default()
+impl Default for Cvars {
+    fn default() -> Self {
+        let mut cvars = Self {
+            rows: Vec::with_capacity(REGISTERED.len()),
+            index: HashMap::with_capacity(REGISTERED.len()),
+            file: BTreeMap::new(),
+            session_owned: HashSet::new(),
+            events: Vec::new(),
+            outbox: Vec::new(),
+            dirty: false,
+            last_change: None,
+        };
+        for r in REGISTERED {
+            cvars.insert_row(Row {
+                name: r.name.to_string(),
+                default: r.default.to_string(),
+                value: r.default.to_string(),
+                pending: None,
+                latched: r.latched,
+                addon: false,
+            });
         }
+        cvars
+    }
+}
+
+impl Cvars {
+    fn insert_row(&mut self, row: Row) {
+        let key = row.name.to_ascii_lowercase();
+        debug_assert!(
+            !self.index.contains_key(&key),
+            "{}: registered twice",
+            row.name
+        );
+        self.index.insert(key, self.rows.len());
+        self.rows.push(row);
+    }
+
+    fn slot(&self, name: &str) -> Option<usize> {
+        self.index.get(&name.to_ascii_lowercase()).copied()
+    }
+
+    /// The row, matched case-insensitively.
+    pub(crate) fn row(&self, name: &str) -> Option<&Row> {
+        self.slot(name).map(|i| &self.rows[i])
+    }
+
+    /// Every row, in registration order.
+    pub(crate) fn rows(&self) -> impl Iterator<Item = &Row> {
+        self.rows.iter()
+    }
+
+    /// The applied value.
+    pub(crate) fn get(&self, name: &str) -> Option<&str> {
+        self.row(name).map(|r| r.value.as_str())
+    }
+
+    /// The applied value as a number, `None` for an unknown row or a non-numeric value.
+    pub(crate) fn num(&self, name: &str) -> Option<f32> {
+        self.get(name).and_then(|v| v.trim().parse().ok())
+    }
+
+    /// The applied value as the client's flag (int-parse, `!= 0`), `None` for an unknown row.
+    pub(crate) fn flag(&self, name: &str) -> Option<bool> {
+        self.num(name).map(|v| v != 0.0)
+    }
+
+    /// The registered default.
+    pub(crate) fn default_of(&self, name: &str) -> Option<&str> {
+        self.row(name).map(|r| r.default.as_str())
+    }
+
+    /// Whether this session owns the row rather than the player.
+    pub(crate) fn is_session_owned(&self, name: &str) -> bool {
+        self.session_owned.contains(&name.to_ascii_lowercase())
     }
 
     /// The persisted `checkAddonVersion` (decision 1292) — what the addon load walk gates on.
-    /// Absent = the registrar default: check ON.
+    /// The registrar default is check ON.
     pub(crate) fn addon_version_check(&self) -> bool {
-        self.stored("checkAddonVersion").is_none_or(|v| v != "0")
+        self.flag("checkAddonVersion").unwrap_or(true)
+    }
+
+    fn touch(&mut self) {
+        self.dirty = true;
+        self.last_change = Some(Instant::now());
+    }
+
+    /// The write, from either side of the VM boundary. `from_vm` is a write the mirror has
+    /// already made (a Lua `SetCVar`, `ConsoleExec`, an engine verb), so it is not echoed back;
+    /// a refusal IS pushed back, because the mirror stored what this refused.
+    fn write(&mut self, name: &str, value: &str, from_vm: bool) -> SetOutcome {
+        let Some(i) = self.slot(name) else {
+            warn!("cvar {name}: not registered — write ignored");
+            return SetOutcome::Unknown;
+        };
+        let row = &mut self.rows[i];
+        if row.numeric() && value.trim().parse::<f32>().is_err() {
+            warn!(
+                "cvar {}: unparseable value '{value}' refused (still {:?})",
+                row.name, row.value
+            );
+            if from_vm {
+                self.outbox.push((row.name.clone(), row.value.clone()));
+            }
+            return SetOutcome::Refused;
+        }
+        if row.latched {
+            // The reference's `Set 0x63df50` on flag bit1: `latchedValue` takes the string and
+            // `InternalSet` does not run — no dirty, no callback. Staging the applied value
+            // back clears the stage.
+            // The stage lives HERE, not in the mirror: the VM only ever learns applied values
+            // (a host write into the mirror IS a commit there), so a host-side stage is not
+            // echoed — `GetCVar` keeps answering the applied value either way, and the commit
+            // below is what reaches the VM.
+            let staged = (value != row.value).then(|| value.to_string());
+            if row.pending == staged {
+                return SetOutcome::Unchanged;
+            }
+            row.pending = staged;
+            return if row.pending.is_some() {
+                SetOutcome::Staged
+            } else {
+                SetOutcome::Unchanged // the stage cleared: the boundary has nothing to do
+            };
+        }
+        if row.value == value {
+            return SetOutcome::Unchanged;
+        }
+        let old = std::mem::replace(&mut row.value, value.to_string());
+        let name = row.name.clone();
+        self.events.push(CvarChanged {
+            name: name.clone(),
+            old,
+            new: value.to_string(),
+        });
+        if !from_vm {
+            self.outbox.push((name, value.to_string()));
+        }
+        self.touch();
+        SetOutcome::Changed
+    }
+
+    /// **A host-side write** — the counterpart of a Lua `SetCVar`, for the engine's own values:
+    /// the minimap zoom, the camera views, the remembered character, the loading screen's tip
+    /// cursor. Mirrored into the VM, persisted, and observed like any other write.
+    pub(crate) fn set(&mut self, name: &str, value: &str) -> SetOutcome {
+        self.write(name, value, false)
+    }
+
+    /// A write the VM's mirror already made — drained from its change queue.
+    pub(crate) fn set_from_vm(&mut self, name: &str, value: &str) -> SetOutcome {
+        self.write(name, value, true)
+    }
+
+    /// **The table follows a value the engine already applied** — a mirror, not a write: the
+    /// applied value moves, the config dirties, the VM's mirror learns it, and **no observer
+    /// fires**, because the knob is already there. For a second registered spelling of one knob
+    /// (`WorldDetail`/`frillDensity`, 2151) — an observer that answered its sibling's move with a
+    /// full write would queue an event that lands one flush later, by which time the row may
+    /// have moved again, and the stale event would win. Returns whether the row moved.
+    pub(crate) fn mirror(&mut self, name: &str, value: &str) -> bool {
+        let Some(i) = self.slot(name) else {
+            warn!("cvar {name}: not registered — mirror ignored");
+            return false;
+        };
+        let row = &mut self.rows[i];
+        if row.value == value {
+            return false;
+        }
+        row.value = value.to_string();
+        row.pending = None;
+        self.outbox.push((row.name.clone(), value.to_string()));
+        self.touch();
+        true
+    }
+
+    /// **The latch boundary** — the reference's `CVar::Update 0x63e060`: every staged value
+    /// becomes the applied one, fires, persists, and reaches the mirror. Returns how many moved.
+    /// Called for the `gx*` rows from `RestartGx` ([`crate::video`]); a row nothing ever commits
+    /// (`SoundBufferSize`, `gxApi`) holds its stage until exit, and loses it there, as the
+    /// reference does.
+    pub(crate) fn commit_latched(&mut self) -> usize {
+        let mut moved = 0;
+        for row in &mut self.rows {
+            let Some(staged) = row.pending.take() else {
+                continue;
+            };
+            if staged == row.value {
+                continue;
+            }
+            let old = std::mem::replace(&mut row.value, staged.clone());
+            self.events.push(CvarChanged {
+                name: row.name.clone(),
+                old,
+                new: staged.clone(),
+            });
+            self.outbox.push((row.name.clone(), staged));
+            moved += 1;
+        }
+        if moved > 0 {
+            self.touch();
+        }
+        moved
+    }
+
+    /// **This session owns the row**: an env lever or the machine's own fact took it, so it is
+    /// never saved and the file's entry for it is left alone. `value` is what the row answers
+    /// this session — `None` marks the row without moving it (the resource is absent, so the
+    /// registered default is the truth). No observer fires: the knob already read the env.
+    pub(crate) fn own_for_session(&mut self, name: &str, value: Option<&str>) {
+        let key = name.to_ascii_lowercase();
+        self.session_owned.insert(key.clone());
+        let Some(value) = value else {
+            return;
+        };
+        let Some(&i) = self.index.get(&key) else {
+            warn!("cvar {name}: not registered — session value ignored");
+            return;
+        };
+        let row = &mut self.rows[i];
+        if row.value != value {
+            row.value = value.to_string();
+            row.pending = None;
+            self.outbox.push((row.name.clone(), value.to_string()));
+        }
+    }
+
+    /// An addon's `RegisterCVar` (decision 1195), reported by the VM: a row of its own, starting
+    /// at the file's value for that name when it carries one (the 1291 bridge, now on the store
+    /// that survives the VM), else at the declared default. A name already registered — the
+    /// client's own, or the same addon's earlier declaration — is the no-op it always was.
+    pub(crate) fn learn_addon_row(&mut self, name: &str, default: &str) {
+        if self.slot(name).is_some() {
+            return;
+        }
+        let saved = self
+            .file
+            .iter()
+            .find(|(k, _)| k.eq_ignore_ascii_case(name))
+            .map(|(_, v)| v.clone());
+        self.insert_row(Row {
+            name: name.to_string(),
+            default: default.to_string(),
+            value: saved.unwrap_or_else(|| default.to_string()),
+            pending: None,
+            latched: false,
+            addon: true,
+        });
+    }
+
+    /// Fold the file in: every known, player-owned key becomes its row's applied value (an
+    /// accepted move, so the observers hear it — the reference's `Register` on a record
+    /// `Config.wtf` already created calls the callback with the file's value); an unknown key is
+    /// preserved for the save and warned once; a session-owned key is skipped and the file keeps
+    /// it. Loading is not a change: nothing is dirtied.
+    fn load_file(&mut self, file: BTreeMap<String, String>) {
+        for (name, value) in &file {
+            let key = name.to_ascii_lowercase();
+            let Some(&i) = self.index.get(&key) else {
+                warn!("config: unknown cvar '{name}' — preserved, not applied");
+                continue;
+            };
+            if self.session_owned.contains(&key) {
+                info!("config: {name} is owned by this session, not the file (file value kept)");
+                continue;
+            }
+            let row = &mut self.rows[i];
+            if row.numeric() && value.trim().parse::<f32>().is_err() {
+                warn!("config: {name}: unparseable value '{value}' ignored");
+                continue;
+            }
+            if row.value == *value {
+                continue;
+            }
+            let old = std::mem::replace(&mut row.value, value.clone());
+            self.events.push(CvarChanged {
+                name: row.name.clone(),
+                old,
+                new: value.clone(),
+            });
+        }
+        self.file = file;
+    }
+
+    /// The file's entries no row claims — a newer build's keys, or an addon's before it
+    /// registers them this session. Handed to the VM as its saved base, so an addon's
+    /// `RegisterCVar` starts at the player's value (decision 1291).
+    pub(crate) fn orphans(&self) -> Vec<(String, String)> {
+        self.file
+            .iter()
+            .filter(|(k, _)| !self.index.contains_key(&k.to_ascii_lowercase()))
+            .map(|(k, v)| (k.clone(), v.clone()))
+            .collect()
+    }
+
+    /// The whole table as a VM's mirror is seeded from it.
+    pub(crate) fn vm_seed(&self) -> Vec<SeededCvar> {
+        self.rows
+            .iter()
+            .map(|r| SeededCvar {
+                name: r.name.clone(),
+                value: r.value.clone(),
+                default: r.default.clone(),
+                latched: r.latched,
+            })
+            .collect()
+    }
+
+    /// Whether a flush has something to trigger — read before taking, so a quiet frame never
+    /// deref-muts the registry.
+    pub(crate) fn has_events(&self) -> bool {
+        !self.events.is_empty()
+    }
+
+    /// The accepted moves since the last flush — the caller triggers each one.
+    pub(crate) fn take_events(&mut self) -> Vec<CvarChanged> {
+        std::mem::take(&mut self.events)
+    }
+
+    fn has_outbox(&self) -> bool {
+        !self.outbox.is_empty()
+    }
+
+    fn take_outbox(&mut self) -> Vec<(String, String)> {
+        std::mem::take(&mut self.outbox)
+    }
+
+    /// Compose the file to save: the previous file as the merge base, every row that moved off
+    /// its default written (the **applied** value — a staged one is not the player's setting
+    /// yet), every one back at its default removed — session-owned keys and unknown keys
+    /// untouched.
+    fn compose(&self) -> BTreeMap<String, String> {
+        let mut out = self.file.clone();
+        for row in &self.rows {
+            let key = row.name.to_ascii_lowercase();
+            if self.session_owned.contains(&key) {
+                continue;
+            }
+            // Match any existing entry case-insensitively so a hand-edited spelling doesn't fork.
+            let existing = out
+                .keys()
+                .find(|k| k.eq_ignore_ascii_case(&row.name))
+                .cloned();
+            if row.value == row.default {
+                if let Some(k) = existing {
+                    out.remove(&k);
+                }
+            } else {
+                out.insert(
+                    existing.unwrap_or_else(|| row.name.clone()),
+                    row.value.clone(),
+                );
+            }
+        }
+        out
+    }
+
+    /// A registry that already holds one stored value — a launch whose `config.toml` said so,
+    /// without a file. For the tests that drive a real consumer over a real remembered row
+    /// (`char_select`'s restore test) rather than a copy of its logic.
+    #[cfg(test)]
+    pub(crate) fn with_value(name: &str, value: &str) -> Self {
+        let mut cvars = Self::default();
+        cvars.load_file(BTreeMap::from([(name.to_string(), value.to_string())]));
+        cvars.events.clear();
+        cvars
     }
 }
 
@@ -1436,7 +1874,8 @@ impl CvarPersist {
 /// short enough that a crash loses one gesture, not a session ("write-on-change, debounced").
 const SAVE_QUIET: std::time::Duration = std::time::Duration::from_secs(1);
 
-/// The startup fold of `config.toml` into the knob resources ([`load_config`]).
+/// The startup fold of `config.toml` into the registry and, through the observers, the knobs
+/// ([`load_config`]).
 ///
 /// A set rather than a bare system because one knob is **read once and never again**: the world
 /// camera takes its `Msaa` at spawn (decision 1629, the reference's latched `gxMultisample`), so
@@ -1456,14 +1895,18 @@ pub(crate) struct CvarPlugin;
 
 impl Plugin for CvarPlugin {
     fn build(&self, app: &mut App) {
-        app.init_resource::<CvarPersist>()
+        app.init_resource::<Cvars>()
             .add_systems(
                 Startup,
                 (load_config, publish_filter_policy)
                     .chain()
                     .in_set(CvarLoad),
             )
-            .add_systems(Update, sync_cvars);
+            // After the tick (decision 2304): a `SetCVar` the interface made this frame reaches
+            // the registry — and its observers — before the frame's drains read it. The video
+            // window's Okay is the case: `SetCVar` per changed row, then `RestartGx()`, in one
+            // handler; `video::drain_restart_gx` orders after this so the commit finds the stage.
+            .add_systems(Update, sync_cvars.after(crate::ui_script::UiInput));
         // **The flush is on the exit edge, not beside its feed** (decision 1528). It used to be
         // `(sync_cvars, save_config).chain()` in `Update`, which made the "or the app exiting"
         // half of its own gate dead on the exit a player actually causes: the close button's
@@ -1474,648 +1917,124 @@ impl Plugin for CvarPlugin {
     }
 }
 
-/// The knob resources as a **SystemParam** — the one census, fetched once, shared by all three
-/// entry points ([`load_config`], [`sync_cvars`], [`fold_dying_vm_cvars`]).
+/// **What the environment took for this session, and what it set it to** — read off the knobs
+/// the env levers already seeded (`RenderScale::default()` reads `$WOW_RENDER_SCALE`, and so
+/// on), so the registry answers `GetCVar` with the value the client is actually running at.
 ///
-/// It exists because the census had grown past Bevy's **16-param ceiling**: with fifteen knobs,
-/// `sync_cvars` (script + persist + knobs) and the fold's `SystemState` both stopped compiling the
-/// moment the plate toggles landed. Re-typing the list at every call site was already the shape
-/// that made a new knob a four-place edit; bundling it makes a new knob one field here, one field
-/// on [`Knobs`], and one arm in [`apply_to_knobs`], and the ceiling stops being reachable.
-#[derive(bevy::ecs::system::SystemParam)]
-pub(crate) struct KnobParams<'w> {
-    sound: ResMut<'w, SoundConfig>,
-    scale: ResMut<'w, UiScaleCvar>,
-    view: ResMut<'w, ViewDistance>,
-    msaa: ResMut<'w, MsaaSetting>,
-    msaa_formats: Res<'w, benilla_world::view::MsaaFormats>,
-    look: ResMut<'w, LookConfig>,
-    click: ResMut<'w, ClickConfig>,
-    loot: ResMut<'w, LootConfig>,
-    names: ResMut<'w, NameConfig>,
-    plates: ResMut<'w, VPlateMode>,
-    clutter: ResMut<'w, ClutterConfig>,
-    weather: ResMut<'w, benilla_world::weather::WeatherState>,
-    display_gamma: ResMut<'w, crate::ui_gamma::DisplayGamma>,
-    minimap: ResMut<'w, MinimapZoom>,
-    bubbles: ResMut<'w, BubbleConfig>,
-    zoom: ResMut<'w, ZoomLimit>,
-    follow: ResMut<'w, FollowConfig>,
-    camera_opts: ResMut<'w, crate::player::camera_dynamics::CameraOptions>,
-    video: ResMut<'w, VideoConfig>,
-    render_scale: ResMut<'w, RenderScale>,
-    tex_filter: ResMut<'w, benilla_assets::TexFilterSetting>,
-    pane_rate: ResMut<'w, PaneRate>,
-    guild_notify: ResMut<'w, crate::ui_guild::GuildMemberNotify>,
-    text_filter: ResMut<'w, crate::text_filter::TextFilterSwitches>,
-    game_tip: ResMut<'w, crate::game_tip::GameTipSetting>,
-    block_trades: ResMut<'w, crate::ui_trade::BlockTrades>,
-    auto_self_cast: ResMut<'w, crate::ui_action::AutoSelfCast>,
-    realmlist: ResMut<'w, crate::realmlist::Realmlist>,
-    fps_journal: ResMut<'w, crate::perf::FpsJournalSetting>,
-    assist_attack: ResMut<'w, crate::target::AssistAttack>,
-    combat_ranges: ResMut<'w, crate::ui_chat::combat::CombatLogRanges>,
-    damage_text: ResMut<'w, crate::combat_text::DamageTextGates>,
-    log_periodic: ResMut<'w, crate::ui_chat::combat::LogPeriodicSpells>,
-}
-
-impl KnobParams<'_> {
-    /// Borrow the set as [`Knobs`] for a write.
-    ///
-    /// **Deref-muts every resource, so call it only when a change is actually being applied**
-    /// (0992's change-detection trap: the clutter re-scatter watches `is_changed::<ClutterConfig>`,
-    /// and a set built on every frame — or before the change queue is known to be non-empty —
-    /// re-scattered the world on every MasterVolume drag tick). Reading a field off `self`
-    /// directly, as the session seed does, goes through `Deref` and flags nothing.
-    fn knobs(&mut self) -> Knobs<'_> {
-        Knobs {
-            sound: &mut self.sound,
-            scale: &mut self.scale,
-            view: &mut self.view,
-            msaa: &mut self.msaa,
-            msaa_formats: &self.msaa_formats,
-            look: &mut self.look,
-            click: &mut self.click,
-            loot: &mut self.loot,
-            names: &mut self.names,
-            plates: &mut self.plates,
-            clutter: &mut self.clutter,
-            weather: &mut self.weather,
-            display_gamma: &mut self.display_gamma,
-            minimap: &mut self.minimap,
-            bubbles: &mut self.bubbles,
-            zoom: &mut self.zoom,
-            follow: &mut self.follow,
-            camera_opts: &mut self.camera_opts,
-            video: &mut self.video,
-            render_scale: &mut self.render_scale,
-            tex_filter: &mut self.tex_filter,
-            pane_rate: &mut self.pane_rate,
-            guild_notify: &mut self.guild_notify,
-            text_filter: &mut self.text_filter,
-            game_tip: &mut self.game_tip,
-            block_trades: &mut self.block_trades,
-            auto_self_cast: &mut self.auto_self_cast,
-            realmlist: &mut self.realmlist,
-            fps_journal: &mut self.fps_journal,
-            assist_attack: &mut self.assist_attack,
-            combat_ranges: &mut self.combat_ranges,
-            damage_text: &mut self.damage_text,
-            log_periodic: &mut self.log_periodic,
-        }
+/// This is the (iv) residue 2265 named: each lever here is one the env still reaches through a
+/// resource's `Default` rather than through a `category: debug` row of this table, and each
+/// line goes the day its lever does. A lever whose resource is absent (a stripped test app)
+/// still marks its row session-owned — the file must not apply over an env the caller set.
+fn session_values(world: &World) -> Vec<(&'static str, Option<String>)> {
+    let set = |k: &str| std::env::var_os(k).is_some();
+    let flag = |b: bool| if b { "1" } else { "0" }.to_string();
+    let mut out: Vec<(&'static str, Option<String>)> = Vec::new();
+    if set("WOW_UI_SCALE") {
+        let v = world.get_resource::<crate::ui_script::UiScaleCvar>();
+        out.push(("uiScale", v.map(|s| s.0.to_string())));
     }
-}
-
-/// The knob resources one CVar write can land on, bundled so [`apply_to_knobs`] and its two
-/// callers grow together (a new knob is one field + one arm).
-struct Knobs<'a> {
-    sound: &'a mut SoundConfig,
-    scale: &'a mut UiScaleCvar,
-    view: &'a mut ViewDistance,
-    msaa: &'a mut MsaaSetting,
-    /// What the device actually offers — the ceiling `gxMultisample` is clamped to (1643).
-    msaa_formats: &'a benilla_world::view::MsaaFormats,
-    look: &'a mut LookConfig,
-    click: &'a mut ClickConfig,
-    loot: &'a mut LootConfig,
-    names: &'a mut NameConfig,
-    plates: &'a mut VPlateMode,
-    clutter: &'a mut ClutterConfig,
-    /// The weather driver's own state — `weatherDensity` writes ONE byte of it
-    /// ([`benilla_world::weather::WeatherState::weather_density`]), the particle-density
-    /// step; every other field on it is the wire's, not a setting's (2181).
-    weather: &'a mut benilla_world::weather::WeatherState,
-    /// The display-brightness ramp the UI lane's decode applies (2182).
-    display_gamma: &'a mut crate::ui_gamma::DisplayGamma,
-    minimap: &'a mut MinimapZoom,
-    bubbles: &'a mut BubbleConfig,
-    zoom: &'a mut ZoomLimit,
-    follow: &'a mut FollowConfig,
-    camera_opts: &'a mut crate::player::camera_dynamics::CameraOptions,
-    video: &'a mut VideoConfig,
-    render_scale: &'a mut RenderScale,
-    tex_filter: &'a mut benilla_assets::TexFilterSetting,
-    pane_rate: &'a mut PaneRate,
-    guild_notify: &'a mut crate::ui_guild::GuildMemberNotify,
-    text_filter: &'a mut crate::text_filter::TextFilterSwitches,
-    game_tip: &'a mut crate::game_tip::GameTipSetting,
-    block_trades: &'a mut crate::ui_trade::BlockTrades,
-    auto_self_cast: &'a mut crate::ui_action::AutoSelfCast,
-    realmlist: &'a mut crate::realmlist::Realmlist,
-    fps_journal: &'a mut crate::perf::FpsJournalSetting,
-    assist_attack: &'a mut crate::target::AssistAttack,
-    combat_ranges: &'a mut crate::ui_chat::combat::CombatLogRanges,
-    damage_text: &'a mut crate::combat_text::DamageTextGates,
-    log_periodic: &'a mut crate::ui_chat::combat::LogPeriodicSpells,
-}
-
-/// **The string-valued rows**, matched ahead of the numeric parse every other row goes through —
-/// which would reject them as bad values. `gxResolution` was the first (decision 1627) and its
-/// comment named this as the shape a second one would join rather than a second special case
-/// somewhere else; `realmList` (1667) is the second, `realmName` the third. Every arm shares the
-/// numeric miss's posture below: known key, bad value — consumed, with a warn, and the resource
-/// keeps its truth.
-///
-/// **Split out of [`apply_to_knobs`] so the table can be held to it.** The claim
-/// "a string row without an arm here is a CVar the client will never honour" was written beside
-/// [`the_string_valued_cvars_are_the_realm_and_the_windowed_size`] and then not enforced:
-/// `realmName` shipped with no arm, so every launch after the first connect warned
-/// `cvar realmName: unparseable value 'VMaNGOS' ignored` on the way past the numeric parse. As a
-/// separate `bool` this is something a test can call for every non-numeric row in the table, which
-/// is what [`every_string_valued_row_is_claimed_before_the_numeric_parse`] now does.
-fn apply_string_valued(key: &str, name: &str, value: &str, knobs: &mut Knobs) -> bool {
-    if !is_string_valued(key) {
-        return false;
-    }
-    match key {
-        "gxresolution" => match crate::video::parse_resolution(value) {
-            Some(size) => knobs.video.windowed = size,
-            None => warn!("cvar {name}: unparseable value '{value}' ignored"),
-        },
-        "realmlist" => match crate::realmlist::normalize(value) {
-            Some(address) => knobs.realmlist.set(&address),
-            None => warn!("cvar {name}: unusable realmlist '{value}' ignored"),
-        },
-        // No host knob, and none wanted: the live realm name is written from the session
-        // (`ui_script::addons::load_third_party`), and the persisted one reaches `GetCVar` through
-        // `set_cvar_saved_base` without passing here at all. Claimed anyway — the `statusBarText`
-        // posture — so the value is CONSUMED rather than falling to a numeric parse that can only
-        // reject it, and so a toggle still dirties the config.
-        "realmname" => {}
-        // Descriptive, not a knob (2151): the live value is the render adapter's backend, pushed
-        // into the table by [`sync_cvars`]. Claimed for the same reason `realmname` is — so a
-        // write is CONSUMED rather than falling to a numeric parse that can only reject it — and
-        // it goes no further: the reference latches this CVar for the next `GxDevCreate`, and we
-        // have no device to re-create it on. `load_config` marks it session-owned, so the write
-        // also never reaches `config.toml`.
-        "gxapi" => {}
-        _ => {}
-    }
-    true
-}
-
-/// Which keys [`apply_string_valued`] claims — lowercased, and split out from the arms so a test
-/// can hold the TABLE to it without building a `Knobs`. The claim it makes possible: every
-/// registered row whose default does not parse as a number is named here
-/// ([`every_string_valued_row_is_claimed_before_the_numeric_parse`]).
-fn is_string_valued(key: &str) -> bool {
-    matches!(key, "gxapi" | "gxresolution" | "realmlist" | "realmname")
-}
-
-/// Apply one CVar to its knob resource (parse + the knob's own clamp). `false` = not a knob this
-/// build knows (the caller decides whether that warns or rides through).
-fn apply_to_knobs(name: &str, value: &str, knobs: &mut Knobs) -> bool {
-    let key = name.to_ascii_lowercase();
-    if apply_string_valued(&key, name, value, knobs) {
-        return true;
-    }
-    let Ok(v) = value.parse::<f32>() else {
-        warn!("cvar {name}: unparseable value '{value}' ignored");
-        return true; // known key, bad value — consumed, resource keeps its truth
-    };
-    match key.as_str() {
-        "mastervolume" => knobs.sound.master = v.clamp(0.0, 1.0),
-        "soundvolume" => knobs.sound.sfx = v.clamp(0.0, 1.0),
-        "musicvolume" => knobs.sound.music = v.clamp(0.0, 1.0),
-        "ambiencevolume" => knobs.sound.ambience = v.clamp(0.0, 1.0),
-        // The enables are 0/1 flags; the client's own parse is int + `!= 0`.
-        "mastersoundeffects" => knobs.sound.enabled = v != 0.0,
-        "enablemusic" => knobs.sound.music_enabled = v != 0.0,
-        "enableambience" => knobs.sound.ambience_enabled = v != 0.0,
-        "enableerrorspeech" => knobs.sound.error_speech = v != 0.0,
-        "sound_enablesoundwhengameisinbg" => knobs.sound.background_sound = v != 0.0,
-        // The client's own parse for this one is literally `!= 0` too (`0x4574d0`: `setne al`).
-        "soundreverb" => knobs.sound.reverb = v != 0.0,
-        "soundoutputlimiter" => knobs.sound.limiter = v != 0.0,
-        "soundlisteneratcharacter" => knobs.sound.listener_at_character = v != 0.0,
-        "emotesounds" => knobs.sound.emote_sounds = v != 0.0,
-        "soundzonemusicnodelay" => knobs.sound.zone_music_no_delay = v != 0.0,
-        "uiscale" => knobs.scale.0 = v.clamp(0.5, 1.5),
-        "farclip" => knobs.view.farclip = v.clamp(*FARCLIP_RANGE.start(), *FARCLIP_RANGE.end()),
-        // The reference REFUSES an out-of-range write here rather than clamping (`0x688d90` echoes
-        // "NearClip must be in range 0.01 - 0.33" and returns 0). We clamp, which is this table's
-        // standing posture for every range — the consumer clamps at its own edge.
-        "nearclip" => knobs.view.set_nearclip(v),
-        "deselectonclick" => knobs.click.deselect_on_click = v != 0.0,
-        "autoselfcast" => knobs.auto_self_cast.0 = v != 0.0,
-        "assistattack" => knobs.assist_attack.0 = v != 0.0,
-        // The sixteen camera-view CVars have no knob to apply to: `CameraViews` is their writer,
-        // not their reader (it seeds itself from the persisted file at startup, and `SaveView`
-        // writes back). They are claimed here so the table's own "not a knob this build knows"
-        // warning stays meaningful — an unclaimed name would look like a typo every session.
-        _ if crate::player::camera_view::is_view_cvar(name) => {}
-        "mouseinvertpitch" => knobs.look.invert_pitch = v != 0.0,
-        "cameradistancemaxfactor" => knobs.zoom.set_factor(v),
-        // The three stops are 1 Smart / 2 Always / 3 Never; anything else reads as the registrar
-        // default rather than as a dead camera (`FollowStyle::from_cvar`).
-        "camerasmoothstyle" => knobs.follow.style = FollowStyle::from_cvar(v),
-        // Its sibling selector — the one the reference swaps in for the externally-driven states.
-        "camerasmoothtrackingstyle" => knobs.follow.tracking_style = FollowStyle::from_cvar(v),
-        // The auto-follow rate, clamped to 1.12's own AUTO_FOLLOW_SPEED slider range.
-        "camerayawsmoothspeed" => {
-            knobs.follow.yaw_speed =
-                v.clamp(*FOLLOW_SPEED_RANGE.start(), *FOLLOW_SPEED_RANGE.end());
-        }
-        // The 1.12 slider's own range; an off-grid hand-edit rides between stops, like the others.
-        "mousespeed" => {
-            knobs.look.sensitivity = v.clamp(*MOUSE_SPEED_RANGE.start(), *MOUSE_SPEED_RANGE.end());
-        }
-        // The reference's `0x50b330` validator REJECTS an out-of-range value rather than clamping
-        // it: it prints `Value out of range (%f - %f)` and `CVar::Set` never stores, so the old
-        // value stands. That is a different posture from every clamping row above, and it is the
-        // faithful one — a script writing 1e9 gets a refusal, not a silently pinned camera.
-        "camerayawmovespeed" | "camerapitchmovespeed" => {
-            if !CAMERA_SPEED_RANGE.contains(&v) {
-                warn!(
-                    "cvar {name}: value out of range ({} - {}) — ignored",
-                    CAMERA_SPEED_RANGE.start(),
-                    CAMERA_SPEED_RANGE.end()
-                );
-                return true;
-            }
-            if key == "camerayawmovespeed" {
-                knobs.look.yaw_speed = v;
-            } else {
-                knobs.look.pitch_speed = v;
-            }
-        }
-        "combatdamage" => knobs.damage_text.combat_damage = v != 0.0,
-        "petmeleedamage" => knobs.damage_text.pet_melee = v != 0.0,
-        "petspelldamage" => knobs.damage_text.pet_spell = v != 0.0,
-        "combatlogperiodicspells" => knobs.log_periodic.0 = v != 0.0,
-        // The combat log's eight display ranges (yards, the CVar's float field). One arm for all
-        // of them: `CombatLogRanges::set` walks the class table through `UnitClass::range_cvar`,
-        // so the seven names live in exactly one place and this arm cannot drift from them.
-        _ if knobs.combat_ranges.set(name, v) => {}
-        "autolootdefault" => knobs.loot.auto_loot = v != 0.0,
-        "unitnameplayer" => knobs.names.player = v != 0.0,
-        "unitnamenpc" => knobs.names.npc = v != 0.0,
-        "unitnameown" => knobs.names.own = v != 0.0,
-        "unitnameplayerguild" => knobs.names.player_guild = v != 0.0,
-        // The camera options (2149). The three numeric ones take the value straight: the
-        // reference's own validator on them is `0x50b330`'s range REFUSAL, which lives in
-        // `benilla_ui`'s `SetCVar` path, not here.
-        "camerapivot" => knobs.camera_opts.pivot = v != 0.0,
-        "camerawatercollision" => knobs.camera_opts.water_collision = v != 0.0,
-        "camerapivotdxmax" => knobs.camera_opts.pivot_dx_max = v,
-        "camerapivotdymin" => knobs.camera_opts.pivot_dy_min = v,
-        "cameratargetsmoothspeed" => knobs.camera_opts.target_smooth_speed = v,
-        "cameraterraintilt" => knobs.camera_opts.terrain_tilt = v != 0.0,
-        "cameragroundsmoothspeed" => knobs.camera_opts.ground_smooth_speed = v,
-        "cameraterraintilttimemin" => knobs.camera_opts.tilt_time_min = v,
-        "cameraterraintilttimemax" => knobs.camera_opts.tilt_time_max = v,
-        "camerabobbing" => knobs.camera_opts.bobbing = v != 0.0,
-        "camerabobbinglramplitude" => knobs.camera_opts.bob_lr_amplitude = v,
-        "camerabobbingudamplitude" => knobs.camera_opts.bob_ud_amplitude = v,
-        "camerabobbingfrequency" => knobs.camera_opts.bob_frequency = v,
-        "camerabobbingsmoothspeed" => knobs.camera_opts.bob_smooth_speed = v,
-        // The two V-plate toggles — the bitmask's two bits, flags like every other checkbox.
-        // Lowercased here like every arm; `VPlateMode`'s consts carry the registered spelling.
-        "nameplateshowenemies" => knobs.plates.enemies = v != 0.0,
-        "nameplateshowfriends" => knobs.plates.friends = v != 0.0,
-        // Two CVars with no HOST knob, because their consumers are Lua (1140, B230). Known — so
-        // the caller dirties the config and the value persists — with nothing to apply this side.
-        "statusbartext" | "ubertooltips" => {}
-        // The two bubble switches (1139) — flags, like every other pair here.
-        "showgametips" => knobs.game_tip.show = v != 0.0,
-        // The cursor, not a preference — a hand-edited or downgraded value lands here verbatim and
-        // `game_tip::raise` clamps it, which is the reference's own tolerance (`0x46b682`).
-        "gametip" => knobs.game_tip.next = v as i64,
-        "profanityfilter" => knobs.text_filter.profanity = v != 0.0,
-        "spamfilter" => knobs.text_filter.spam = v != 0.0,
-        "chatbubbles" => knobs.bubbles.all = v != 0.0,
-        "chatbubblesparty" => knobs.bubbles.party = v != 0.0,
-        // The loot-roll detail switch (1589) — a flag over the roll-line composer's two shapes.
-        "showlootspam" => knobs.loot.show_loot_spam = v != 0.0,
-        // Guild Member Alert (1589) — conjunct 2 of the sign-on/sign-off line's condition.
-        "guildmembernotify" => knobs.guild_notify.0 = v != 0.0,
-        "blocktrades" => knobs.block_trades.0 = v != 0.0,
-        // The panel's 0/1/2 lands as the density multiplier ×1/×2/×3; the clamp is the 1.12
-        // slider's own range (an off-grid hand-edit rides between stops, like every slider).
-        "worlddetail" => knobs.clutter.density = v.clamp(0.0, 2.0) + 1.0,
-        // The SAME knob in the reference's own cells-per-chunk (2151), with the reference's own
-        // `[1, 256]` clamp rather than the stop's — `ClutterConfig::set_frill_density` carries
-        // both, and `terrain_stream::rescatter_clutter` re-scatters the loaded tiles off the
-        // resulting density change exactly as it does for the row above (0992's setter law, which
-        // is the callback's own chunk rebuild).
-        "frilldensity" => knobs.clutter.set_frill_density(v),
-        // Weather Intensity, the panel's 0..3 step 1 (2181). The reference's callback is
-        // `0x67b870`, a jump table (`0x67b8e8`) mapping 0/1/2/3 onto the quality cells
-        // {0.1, 0.33, 0.66, 1.0} in `[0x8680ec]` (wow-re
-        // `cvar/scratch/graphics-cost-cvar-census.md` §4). What that table does with an
-        // off-grid int is NOT carved, so the clamp here is this table's own standing
-        // posture rather than a fidelity claim — and it costs nothing either way, because
-        // `WeatherState::density_gain` already `.min(3)`s its own index.
-        "weatherdensity" => knobs.weather.weather_density = v.trunc().clamp(0.0, 3.0) as u8,
-        // Brightness (2182). The clamp is OURS and the reference has none — the reason it
-        // costs one is on [`crate::ui_gamma::GAMMA_RANGE`], and nothing a player can reach
-        // from the panel meets it.
-        "gamma" => {
-            knobs.display_gamma.0 = v.clamp(
-                *crate::ui_gamma::GAMMA_RANGE.start(),
-                *crate::ui_gamma::GAMMA_RANGE.end(),
-            )
-        }
-        // The two zoom indices (1131) clamp exactly like the client's `set_zoom` (`0x6daa10`:
-        // clamp at 5) — the widget clamps again on the way in, so a hand-edited level lands
-        // in range whichever path it takes.
-        "minimapzoom" => knobs.minimap.outdoor = zoom_index(v),
-        "minimapinsidezoom" => knobs.minimap.inside = zoom_index(v),
-        // The addon version gate (1292): no host knob — the load walk reads the persisted value
-        // and the gate reads the live table — but a KNOWN key, so a toggle dirties the config
-        // and persists (the statusBarText posture).
-        "checkaddonversion" => {}
-        // The remembered character row (1622) — same posture again: the live value is the select
-        // screen's own, which writes this key rather than reading it back. Known, so entering the
-        // world dirties the config and the memory survives to the next launch.
-        "lastcharacterindex" => {}
-        // Vertical Sync — a flag like every other checkbox here. `video::apply_present_mode`
-        // watches the value and pushes it to the window; nothing else reads it.
-        "gxvsync" => knobs.video.vsync = v != 0.0,
-        "worldshadows" => knobs.video.world_shadows = v != 0.0,
-        "charactershadows" => knobs.video.character_shadows = v != 0.0,
-        "shadowdistance" => {
-            knobs.video.shadow_distance =
-                v.clamp(*SHADOW_DISTANCE_RANGE.start(), *SHADOW_DISTANCE_RANGE.end());
-        }
-        // MONKEY (sun shadow perf): the five cost dials, clamped at the edge like every numeric row
-        // here. `shadowMapSize` SNAPS onto the power-of-two ladder rather than clamping into a
-        // range — an off-ladder value is not a weaker setting, it is one Bevy silently rounds UP
-        // into a bigger and slower map than the one that was typed.
-        "shadowmapsize" => {
-            knobs.video.shadow_map_size =
-                crate::shadow_core::clamp_shadow_map_size(v.max(0.0) as u32);
-        }
-        "shadowfilter" => {
-            knobs.video.shadow_filter =
-                (v.max(0.0) as u32).min(crate::shadow_core::MAX_SHADOW_FILTER);
-        }
-        // `0` is MEANINGFUL on both rate rows (the pre-cvar every-frame rebuild), so they floor at
-        // 0 rather than at 1 — the shadow off-switches are `characterShadows` / `worldShadows`.
-        "charactershadowrate" => {
-            knobs.video.character_shadow_rate =
-                (v.max(0.0) as u32).min(crate::shadow_core::MAX_SHADOW_RATE);
-        }
-        "worldshadowrate" => {
-            knobs.video.world_shadow_rate =
-                (v.max(0.0) as u32).min(crate::shadow_core::MAX_SHADOW_RATE);
-        }
-        "shadowcasterreach" => {
-            knobs.video.shadow_caster_reach = v.clamp(
-                *crate::shadow_core::CASTER_REACH_RANGE.start(),
-                *crate::shadow_core::CASTER_REACH_RANGE.end(),
-            );
-        }
-        // MONKEY (dynamic interiors): the interior lane's on/off + knobs, clamped at the edge like
-        // every other numeric row. `dynamic_interior::bridge` publishes them to benilla-world.
-        "interiorlight" => knobs.video.interior_light = v != 0.0,
-        "interiorambient" => knobs.video.interior_ambient = v.clamp(0.0, 1.0),
-        "interiorfill" => knobs.video.interior_fill = v.clamp(0.0, 2.0),
-        "interiorexposure" => knobs.video.interior_exposure = v.clamp(0.25, 8.0),
-        // MONKEY (interior attenuation): the authored-window scale. `0` is a MEANINGFUL value here
-        // (the window off), so the range floors at 0 rather than at a small positive.
-        "interiorattenscale" => knobs.video.interior_atten_scale = v.clamp(0.0, 8.0),
-        "interiorroomgate" => knobs.video.interior_room_gate = v != 0.0,
-        "interiorshadows" => knobs.video.interior_shadows = v != 0.0,
-        // MONKEY (outdoor torch shadows): a flag like every other checkbox here. Live — the lane
-        // reads `VideoConfig` every frame, so `0` fades the outdoor shadows out (the slots evict
-        // through the same cross-fade a walked-away fixture does) and `1` fades them back in.
-        "exteriorshadows" => knobs.video.exterior_shadows = v != 0.0,
-        // MONKEY (torch caster selection): the working-set size and the PCF radius, clamped at the
-        // edge like every other numeric row. `casters` floors at 1, not 0 — `interiorShadows 0` is
-        // already the off switch, and a 0 here would be a second, confusing one.
-        "interiorshadowcasters" => {
-            knobs.video.interior_shadow_casters = (v.max(1.0) as u32).clamp(1, 16);
-        }
-        // MONKEY (static torch cache): zero is useful for static-only rooms.
-        "interiorshadowdynamic" => knobs.video.interior_shadow_dynamic = (v.max(1.0) as u32).clamp(1, crate::torch_shadow::MAX_TORCH_DYNAMIC as u32), // MONKEY (live bank rank): 1..8.
-        // MONKEY (torch lane perf): the moving-caster regather cadence in Hz. `0` is MEANINGFUL
-        // here (every frame -- the behaviour before the gate), so unlike `casters` this floors at
-        // 0 rather than at 1. Ceiling 240 so a typo cannot ask for a per-frame rebuild AND a
-        // divide by a huge number; anything at or above the frame rate is already "every frame".
-        "interiorshadowentityrate" => {
-            knobs.video.interior_shadow_entity_rate = (v.max(0.0) as u32).min(240);
-        }
-        "interiorshadowsoft" => knobs.video.interior_shadow_soft = v.clamp(0.5, 3.0),
-        // MONKEY (shadow floor): 0 IS meaningful (shadows off), so this floors at 0, not at a
-        // minimum-useful value; 1 is the pre-feature pitch black.
-        "torchshadowstrength" => knobs.video.torch_shadow_strength = v.clamp(0.0, 1.0),
-        "interiordebug" => knobs.video.interior_debug = (v.max(0.0) as u32).min(4),
-        // MONKEY (darkness gains): the two dim dials, clamped at the edge like every numeric row
-        // here. The floor is 0.2 rather than 0: a true 0 would be indistinguishable from a broken
-        // light pack (black world / black room), and the off switch people actually want is `1`.
-        "nightgain" => knobs.video.night_gain = v.clamp(0.2, 1.5),
-        "interiorgain" => knobs.video.interior_gain = v.clamp(0.2, 1.5),
-        // MONKEY (enclosed day floor): 0 IS meaningful here (it restores the pre-feature look
-        // exactly), unlike the two dim dials above whose 0 would be a broken-looking world.
-        "interiordaylight" => knobs.video.interior_daylight = v.clamp(0.0, 1.0),
-        // MONKEY (bake floor): 0 IS meaningful here too (it restores the pre-feature look exactly).
-        // The upper clamp matters more than usual: the packer multiplies this by `interiorGain`
-        // (up to 1.5) and rides the product in a lane fraction that must stay under 0.5 after
-        // scaling, so a value that escaped this clamp would reach the world-shadow flag it shares
-        // a lane with. `pack_bake_lane` clamps the product too — belt and braces, one at each end.
-        "interiorbakefloor" => knobs.video.interior_bake_floor = v.clamp(0.0, 1.0),
-        // MONKEY (fire GO lights): the synthesised-fire gain, clamped at the edge like the rest.
-        "firelightgain" => knobs.video.fire_light_gain = v.clamp(0.0, 4.0),
-        // MONKEY (spellLightGain): the spell lane's gain, same range and same edge clamp — and `0`
-        // is meaningful here (the lane off) exactly as it is for the fire gain above.
-        "spelllightgain" => knobs.video.spell_light_gain = v.clamp(0.0, 4.0),
-        // MONKEY (flame flicker): 0..2 — the amplitudes are authored at 1, and 2 is the deliberate
-        // over-drive for judging the shape. Clamped at the edge like every knob here.
-        "fireflicker" => knobs.video.fire_flicker = v.clamp(0.0, 2.0),
-        // Display mode (1627) — a flag like every other checkbox here, and the reference's own
-        // polarity: `1` is WINDOWED (the row is "Windowed Mode"). `video::apply_window_mode`
-        // watches the value and pushes it to the window; nothing else reads it.
-        "gxwindow" => knobs.video.display = crate::video::display_from_flag(v),
-        // The body panes' half-rate render (1444) — a flag like every other checkbox here.
-        "boothhalfrate" => knobs.pane_rate.half = v != 0.0,
-        // Render scale (1639). Clamped at the knob's edge like every other numeric row; the
-        // backdrop re-sizes on the next frame and the world camera's target factor follows it
-        // in the same pass, which is what keeps the pick rays where they were.
-        "renderscale" => {
-            knobs.render_scale.0 = v.clamp(*RENDER_SCALE_RANGE.start(), *RENDER_SCALE_RANGE.end());
-        }
-        // The FPS journal switch (2008): a flag, the client's int-parse + `!= 0`. The journal
-        // system reads the knob every frame, so the file opens on the next second and closes
-        // the second it is turned off.
-        "fpsjournal" => knobs.fps_journal.0 = v != 0.0,
-        // Multisampling (1629) — the reference's own `atoi`-then-clamp `[1, 16]` at `0x63b250`.
-        // Writing the knob live is faithful, not a bug: the CVar holds the PENDING value (latched),
-        // and nothing reads this resource after the world camera's spawn.
-        "gxmultisample" => {
-            // TWO ceilings, and the second one was missing until 1643. The reference's own
-            // `atoi`-then-clamp `[1, 16]` comes first; then the DEVICE's, because a count this
-            // GPU does not offer is not a setting that degrades — it is a wgpu validation error
-            // that kills the render thread on frame one ("Sample count 8 is not supported by
-            // format Rgba16Float on this device", 2026-08-26).
-            //
-            // `MsaaSupportPlugin::finish` already clamped, but it runs once, before the first
-            // update — so it saw `MsaaSetting::default()` and never the value `load_config` was
-            // about to fold in from `config.toml`. A config written on a machine that offers 8x
-            // and opened on one that stops at 4 therefore reached the camera untouched. Clamping
-            // at the WRITE covers every writer there is: the file, a Lua `SetCVar`, the dropdown,
-            // and the Defaults button.
-            let asked = (v as u32).clamp(*MSAA_RANGE.start(), *MSAA_RANGE.end());
-            let granted = knobs.msaa_formats.clamp(asked);
-            if granted != asked {
-                // At `warn`, the same posture as the seed clamp: the player asked for something
-                // and did not get it, and this is the only place that fact exists.
-                warn!(
-                    "cvar {name}: this GPU does not offer {asked}x multisampling — using {granted}x"
-                );
-            }
-            knobs.msaa.samples = granted;
-        }
-        // The filter policy's two halves. Both write the PENDING value — latched, like
-        // `gxMultisample`: the process policy is published once at the end of `load_config` and
-        // nothing reads this resource afterwards. `anisotropic` takes the reference's own
-        // parse-then-clamp `[1, 16]` (`0x689110`); `trilinear` is a flag like every other.
-        "trilinear" => knobs.tex_filter.trilinear = v != 0.0,
-        "anisotropic" => {
-            knobs.tex_filter.aniso = (v as u32).clamp(
-                *benilla_assets::ANISO_RANGE.start(),
-                *benilla_assets::ANISO_RANGE.end(),
-            )
-        }
-        _ => return false,
-    }
-    true
-}
-
-/// Freeze the texture filter policy for the process, and say what it resolved to.
-///
-/// **A separate system, chained after [`load_config`], deliberately.** `load_config` returns early
-/// on an absent or malformed file, and the policy has to be published on every one of those paths:
-/// the sampler lanes are an async `AssetLoader` and a set of ordinary systems, none of which can
-/// read a resource the others own, so a run that never published would be reading
-/// [`benilla_assets::tex_filter`]'s fallback while a player's `config.toml` said otherwise.
-///
-/// The log line is not decoration — it is the same reasoning as `video::log_display_session`
-/// (1627). Every filtering report this client will get comes from a machine nobody here can run,
-/// and "which mode was that run actually in" must be readable off the log a player pastes rather
-/// than reasoned about.
-fn publish_filter_policy(filter: Res<benilla_assets::TexFilterSetting>) {
-    benilla_assets::publish_tex_filter(*filter);
-    let mode = filter.mode();
-    let name = match mode {
-        3 => "bilinear + nearest-mip select, aniso off",
-        4 => "trilinear, aniso off",
-        _ => "trilinear + aniso",
-    };
-    info!(
-        "texture filter: mode {mode} ({name}) — trilinear={} anisotropic={}",
-        u8::from(filter.trilinear),
-        filter.aniso
-    );
-}
-
-/// A stored minimap zoom level → a valid index: truncate to int and clamp into
-/// `[0, MINIMAP_ZOOM_LEVELS)`, the client's own `set_zoom` clamp.
-fn zoom_index(v: f32) -> u8 {
-    v.clamp(0.0, f32::from(MINIMAP_ZOOM_LEVELS - 1)) as u8
-}
-
-/// The two registered spellings of `ClutterConfig::density`, lowercased (2151) — `WorldDetail`'s
-/// panel stop and `frillDensity`'s cells-per-chunk.
-///
-/// Named as a **pair**, because that is the thing about them that is easy to get wrong: anything
-/// which takes the knob for the session has to take *both* keys. `$WOW_CLUTTER_DENSITY` marked
-/// only `worlddetail` for exactly as long as it was the only spelling, and the moment the second
-/// row landed that would have let an A/B lever ride into `config.toml` through the other name and
-/// pin itself on every later launch.
-const CLUTTER_DENSITY_CVARS: [&str; 2] = ["worlddetail", "frilldensity"];
-
-/// Startup: read `benilla-config/config.toml` (absent file = all defaults, not an error) and apply it
-/// to the knob resources — except the keys this session owns rather than the player
-/// ([`CvarPersist::session_owned`]): an env lever's resource has already read the variable in its
-/// `Default`, and `gxApi` is the machine's own. The VM does not exist yet; [`sync_cvars`] seeds
-/// the table when it does.
-fn load_config(mut persist: ResMut<CvarPersist>, mut params: KnobParams) {
-    let mut knobs = params.knobs();
-    if std::env::var_os("WOW_UI_SCALE").is_some() {
-        persist.session_owned.insert("uiscale".into());
-    }
-    if std::env::var_os("WOW_FARCLIP").is_some() {
-        persist.session_owned.insert("farclip".into());
+    if set("WOW_FARCLIP") {
+        let v = world.get_resource::<benilla_world::view::ViewDistance>();
+        out.push(("farclip", v.map(|s| s.farclip.to_string())));
     }
     // The clutter A/B env drives the same knob WorldDetail lands on — same session-only law, over
-    // BOTH of that knob's spellings ([`CLUTTER_DENSITY_CVARS`]).
-    if std::env::var_os("WOW_CLUTTER_DENSITY").is_some() {
-        for key in CLUTTER_DENSITY_CVARS {
-            persist.session_owned.insert(key.into());
-        }
+    // BOTH of that knob's spellings ([`CLUTTER_DENSITY_CVARS`]). An off-grid multiplier seeds
+    // off-grid honestly: the dropdown shows the raw number and checks nothing (the 0959
+    // out-of-range posture, dropdown-flavored).
+    if set("WOW_CLUTTER_DENSITY") {
+        let v = world.get_resource::<benilla_world::clutter::ClutterConfig>();
+        out.push(("WorldDetail", v.map(|c| (c.density - 1.0).to_string())));
+        out.push(("frillDensity", v.map(|c| c.frill_density().to_string())));
     }
     // `$WOW_NOVSYNC=1` is the measurement uncap: session-only, exactly like the taste-iteration
     // overrides above. Pinning it into the config would make an instrument run sticky.
     if crate::video::novsync_env() {
-        persist.session_owned.insert("gxvsync".into());
+        let v = world.get_resource::<crate::video::VideoConfig>();
+        out.push(("gxVSync", v.map(|c| flag(c.vsync))));
     }
     // The filter policy's A/B levers, under the same law: pricing mode 3 against mode 5 on one
     // machine in one session is exactly what these are for, and a value that stuck in
     // `config.toml` would silently denominate every later reading.
-    if std::env::var_os("WOW_TRILINEAR").is_some() {
-        persist.session_owned.insert("trilinear".into());
+    let tex = world.get_resource::<benilla_assets::TexFilterSetting>();
+    if set("WOW_TRILINEAR") {
+        out.push(("trilinear", tex.map(|t| flag(t.trilinear))));
     }
-    if std::env::var_os("WOW_ANISO").is_some() {
-        persist.session_owned.insert("anisotropic".into());
+    if set("WOW_ANISO") {
+        out.push(("anisotropic", tex.map(|t| t.aniso.to_string())));
     }
     // `$WOW_WIN`, a capture scenario, or any instrumented run owns the window's geometry for the
     // session (decision 1627), so the two CVars that would otherwise move it mid-run are
-    // session-only under exactly the same law as the four above.
+    // session-only under exactly the same law as the levers above.
     if crate::video::windowed_env() {
-        persist.session_owned.insert("gxwindow".into());
-        persist.session_owned.insert("gxresolution".into());
+        let v = world.get_resource::<crate::video::VideoConfig>();
+        out.push((
+            "gxWindow",
+            v.map(|c| flag(c.display == crate::video::DisplayMode::Windowed)),
+        ));
+        out.push((
+            "gxResolution",
+            v.map(|c| format!("{}x{}", c.windowed.x, c.windowed.y)),
+        ));
     }
-    // `$WOW_MSAA` is the multisampling A/B lever (1629), session-only under the same law as every
-    // override above: a value pinned into the file would make a measurement sticky across
-    // relaunches.
-    if std::env::var_os("WOW_MSAA").is_some() {
-        persist.session_owned.insert("gxmultisample".into());
+    // `$WOW_MSAA` is the multisampling A/B lever (1629); `$WOW_RENDER_SCALE` the render-scale one
+    // (1639), doubly session-only because it is also the supersampling instrument this machine
+    // prices pixels with, and an instrument run that pinned 4× into the file would come back at
+    // 4× the next time the client opened.
+    if set("WOW_MSAA") {
+        let v = world.get_resource::<benilla_world::view::MsaaSetting>();
+        out.push(("gxMultisample", v.map(|m| m.samples.to_string())));
     }
-    // `$WOW_RENDER_SCALE` is the render-scale A/B lever (1639), and doubly session-only: it is
-    // also the supersampling instrument this machine prices pixels with, and an instrument run
-    // that pinned 4× into the file would come back at 4× the next time the client opened.
-    if std::env::var_os("WOW_RENDER_SCALE").is_some() {
-        persist.session_owned.insert("renderscale".into());
+    if set("WOW_RENDER_SCALE") {
+        let v = world.get_resource::<crate::world_backdrop::RenderScale>();
+        out.push(("renderScale", v.map(|r| r.0.to_string())));
     }
     // `$WOW_HOST` is the realmlist for the session (1667) — every probe, smoke run and harness leg
     // sets it, and a value pinned into the file would silently repoint the player's client at
     // whatever a test dialed. `Realmlist::default()` has already taken it; this keeps it off disk.
-    if std::env::var_os("WOW_HOST").is_some() {
-        persist.session_owned.insert("realmlist".into());
+    if set("WOW_HOST") {
+        let v = world.get_resource::<crate::realmlist::Realmlist>();
+        out.push((
+            crate::realmlist::CVAR_REALMLIST,
+            v.map(|r| r.address().to_string()),
+        ));
     }
-    // The one member with no env var behind it (2151): `gxApi` reports the render adapter's
-    // backend, which is a fact about the machine rather than a setting the player chose. It is
-    // pushed live by `sync_cvars` on every launch, so persisting it could only ever write a name
-    // that the next launch overwrites — or, worse, a stale one that outlives the GPU it described.
-    persist.session_owned.insert("gxapi".into());
-    let cvars = match stored_config() {
-        StoredConfig::Absent => return, // no file, hermetic capture, or no install
-        StoredConfig::Bad(msg) => {
-            // A malformed file is preserved, not clobbered: nothing loads, but nothing saves
-            // over it either until a change actually happens — and the warn names the file.
-            warn!("{msg}");
-            return;
+    out
+}
+
+/// Startup: mark what the session owns, read `benilla-config/config.toml` (absent file = all
+/// defaults, not an error) into the registry, and **fire the observers here and now** — this is
+/// exclusive so that everything ordered after [`CvarLoad`] finds its knob already written, the
+/// way the reference's subsystems find their callback already run by the time they read a
+/// record. The VM does not exist yet; [`sync_cvars`] seeds its mirror when it does.
+fn load_config(world: &mut World) {
+    let session = session_values(world);
+    let stored = stored_config();
+    let events = {
+        let mut cvars = world.resource_mut::<Cvars>();
+        for (name, value) in session {
+            cvars.own_for_session(name, value.as_deref());
         }
-        StoredConfig::Table(t) => t,
+        // The one member with no env var behind it (2151): `gxApi` reports the render adapter's
+        // backend, which is a fact about the machine rather than a setting the player chose. It
+        // is pushed live by [`sync_cvars`] once the adapter exists, so persisting it could only
+        // ever write a name that the next launch overwrites — or, worse, a stale one that
+        // outlives the GPU it described.
+        cvars.own_for_session("gxApi", None);
+        match stored {
+            StoredConfig::Absent => {} // no file, hermetic capture, or no install
+            StoredConfig::Bad(msg) => {
+                // A malformed file is preserved, not clobbered: nothing loads, but nothing
+                // saves over it either until a change actually happens — and the warn names
+                // the file.
+                warn!("{msg}");
+            }
+            StoredConfig::Table(table) => cvars.load_file(table),
+        }
+        cvars.take_events()
     };
-    let known: HashSet<String> = REGISTERED
-        .iter()
-        .map(|r| r.name.to_ascii_lowercase())
-        .collect();
-    for (name, value) in &cvars {
-        let key = name.to_ascii_lowercase();
-        if !known.contains(&key) {
-            warn!("config: unknown cvar '{name}' — preserved, not applied");
-            continue;
-        }
-        if persist.session_owned.contains(&key) {
-            info!("config: {name} is owned by this session, not the file (file value kept)");
-            continue;
-        }
-        apply_to_knobs(name, value, &mut knobs);
+    for event in events {
+        world.trigger(event);
     }
-    persist.file = cvars;
 }
 
 /// What the one read of `config.toml` found.
@@ -2164,8 +2083,8 @@ fn stored_config() -> StoredConfig {
 /// One CVar as `config.toml` holds it, matched case-insensitively — **before the `App` exists**
 /// (decision 1627).
 ///
-/// Every other consumer wants [`CvarPersist::stored`], which answers from the same values once
-/// they are a resource and stays current across a VM replacement (1291). This one exists for the
+/// Every other consumer wants [`Cvars::get`], which answers from the registry once it is a
+/// resource and stays current across a VM replacement (1291). This one exists for the
 /// single caller that cannot wait for a resource: the primary window has to be *built* with its
 /// display mode already resolved.
 pub(crate) fn boot_cvar(name: &str) -> Option<String> {
@@ -2178,79 +2097,83 @@ pub(crate) fn boot_cvar(name: &str) -> Option<String> {
     }
 }
 
-/// Per frame: seed the VM's table once it exists (registered set + the RESOLVED session values,
-/// so `GetCVar` reflects env overrides and the loaded config alike), then drain Lua `SetCVar`
-/// changes into the knob resources and mark the config dirty.
-fn sync_cvars(
+/// Per frame: seed the VM's mirror once it exists (the registered set at its live values, so
+/// `GetCVar` reflects env overrides and the loaded config alike), drain the VM's registrations
+/// and writes into the registry, push the registry's own writes into the mirror, and trigger
+/// every accepted move for its observers.
+pub(crate) fn sync_cvars(
     script: Option<NonSendMut<UiScript>>,
-    mut persist: ResMut<CvarPersist>,
-    mut params: KnobParams,
+    mut cvars: ResMut<Cvars>,
     adapter: Option<Res<bevy::render::renderer::RenderAdapterInfo>>,
+    msaa_formats: Option<Res<benilla_world::view::MsaaFormats>>,
+    mut seeded: Local<VmMemo<bool>>,
+    mut commands: Commands,
 ) {
+    // **The machine's, not the player's** (2151): the live render backend, so `GetCVar` and
+    // pfUI's system tooltip answer what this run is actually on. Absent in a headless app with
+    // no renderer, where the registered `""` stands and says so.
+    if let Some(adapter) = adapter.as_deref() {
+        let backend = adapter.backend.to_str();
+        if cvars.get("gxApi") != Some(backend) {
+            cvars.own_for_session("gxApi", Some(backend));
+        }
+    }
     let Some(mut script) = script else {
+        // Nothing to mirror into; a later VM is seeded from the table, which carries it all.
+        if cvars.has_outbox() {
+            cvars.take_outbox();
+        }
+        if cvars.has_events() {
+            for event in cvars.take_events() {
+                commands.trigger(event);
+            }
+        }
         return;
     };
-    if persist.registered.claim(&script) {
-        // Read-only borrows for the seed: field access through `ResMut`'s `Deref` flags nothing,
-        // which is the half of 0992's change-detection trap this system has to keep.
-        let KnobParams {
-            camera_opts,
-            sound,
-            scale,
-            view,
-            look,
-            click,
-            loot,
-            names,
-            plates,
-            clutter,
-            weather,
-            display_gamma,
-            minimap,
-            bubbles,
-            zoom,
-            follow,
-            video,
-            render_scale,
-            pane_rate,
-            guild_notify,
-            block_trades,
-            auto_self_cast,
-            text_filter,
-            game_tip,
-            msaa,
-            msaa_formats,
-            tex_filter,
-            realmlist,
-            fps_journal,
-            assist_attack,
-            combat_ranges,
-            damage_text,
-            log_periodic,
-        } = &params;
-        // The config file's values go in FIRST (decision 1291): registration — ours below, or an
-        // addon's `RegisterCVar` later — starts a key at its saved value. This is what carries a
-        // knobless CVar (`statusBarText`) and an addon-declared one across a VM replacement; the
-        // knob-derived session rows below still win for every key a host knob backs, and an
-        // env-overridden key keeps its env value the same way (its knob carries it).
-        script.set_cvar_saved_base(persist.saved_base().collect::<Vec<_>>());
-        script.register_cvars(registered_pairs());
+    // **The VM's writes first, the seed second.** A fresh VM loads the whole interface before
+    // this system's first turn against it, and an addon's `SetCVar` at load is already in the
+    // queue by then; seeding first would overwrite the mirror with the registry's older value
+    // and then apply the write to the registry alone, leaving `GetCVar` a frame behind for the
+    // rest of the session. Registrations before writes: an addon declares a row and sets it in
+    // the same breath.
+    let registrations = script.take_cvar_registrations();
+    let changes = script.take_cvar_changes();
+    if !registrations.is_empty() || !changes.is_empty() {
+        for (name, default) in registrations {
+            cvars.learn_addon_row(&name, &default);
+        }
+        for (name, value) in changes {
+            cvars.set_from_vm(&name, &value);
+        }
+    }
+    if seeded.claim(&script) {
+        // The file's unclaimed entries go in FIRST (decision 1291): an addon's `RegisterCVar`
+        // later starts its key at the saved value. Then the table itself, at its live values.
+        script.set_cvar_saved_base(cvars.orphans());
+        script.seed_cvars(cvars.vm_seed());
+        if cvars.has_outbox() {
+            cvars.take_outbox(); // the seed just carried everything
+        }
         // The Video dropdown's menu — what this device actually accepts, enumerated once at
         // `finish()` by `view::MsaaSupportPlugin` (decision 1631) and handed over whole. Pushed
         // here rather than owned by the VM because the list is a fact about the render adapter,
         // which `benilla-ui` has no way to ask and should not grow one.
         script.set_multisample_formats(
             msaa_formats
-                .formats
-                .iter()
-                .map(
-                    |&(color_bits, depth_bits, samples)| benilla_ui::script::MultisampleFormat {
-                        color_bits,
-                        depth_bits,
-                        samples,
-                    },
-                )
-                .collect(),
+                .as_deref()
+                .map(|f| {
+                    f.formats
+                        .iter()
+                        .map(|&(color_bits, depth_bits, samples)| {
+                            benilla_ui::script::MultisampleFormat {
+                                color_bits,
+                                depth_bits,
+                                samples,
+                            }
+                        })
+                        .collect()
+                })
+                .unwrap_or_default(),
         );
         // **What `GetVideoCaps` answers with** (decision 2177) — the seven values the stock video
         // window's `OptionsFrame_Load` destructures. Pushed beside the multisample list because it
@@ -2283,334 +2206,61 @@ fn sync_cvars(
             max_anisotropy: *benilla_assets::ANISO_RANGE.end(),
             hardware_cursor: true,
         });
-        let flag = |b: bool| if b { "1" } else { "0" }.to_string();
-        let session: [(&str, String); 116] = [
-            ("MasterVolume", sound.master.to_string()),
-            ("SoundVolume", sound.sfx.to_string()),
-            ("MusicVolume", sound.music.to_string()),
-            ("AmbienceVolume", sound.ambience.to_string()),
-            ("MasterSoundEffects", flag(sound.enabled)),
-            ("EnableMusic", flag(sound.music_enabled)),
-            ("EnableAmbience", flag(sound.ambience_enabled)),
-            ("EnableErrorSpeech", flag(sound.error_speech)),
-            (
-                "Sound_EnableSoundWhenGameIsInBG",
-                flag(sound.background_sound),
-            ),
-            ("SoundReverb", flag(sound.reverb)),
-            ("SoundOutputLimiter", flag(sound.limiter)),
-            (
-                "SoundListenerAtCharacter",
-                flag(sound.listener_at_character),
-            ),
-            ("EmoteSounds", flag(sound.emote_sounds)),
-            ("SoundZoneMusicNoDelay", flag(sound.zone_music_no_delay)),
-            ("uiScale", scale.0.to_string()),
-            ("farclip", view.farclip.to_string()),
-            ("nearclip", view.nearclip.to_string()),
-            ("deselectOnClick", flag(click.deselect_on_click)),
-            ("autoSelfCast", flag(auto_self_cast.0)),
-            ("assistAttack", flag(assist_attack.0)),
-            ("mouseInvertPitch", flag(look.invert_pitch)),
-            ("mousespeed", look.sensitivity.to_string()),
-            ("cameraYawMoveSpeed", look.yaw_speed.to_string()),
-            ("cameraPitchMoveSpeed", look.pitch_speed.to_string()),
-            ("cameraDistanceMaxFactor", zoom.factor().to_string()),
-            ("cameraSmoothStyle", follow.style.cvar().to_string()),
-            (
-                "cameraSmoothTrackingStyle",
-                follow.tracking_style.cvar().to_string(),
-            ),
-            ("cameraYawSmoothSpeed", follow.yaw_speed.to_string()),
-            ("cameraPivot", flag(camera_opts.pivot)),
-            ("cameraPivotDXMax", camera_opts.pivot_dx_max.to_string()),
-            ("cameraPivotDYMin", camera_opts.pivot_dy_min.to_string()),
-            (
-                "cameraTargetSmoothSpeed",
-                camera_opts.target_smooth_speed.to_string(),
-            ),
-            ("cameraWaterCollision", flag(camera_opts.water_collision)),
-            ("cameraTerrainTilt", flag(camera_opts.terrain_tilt)),
-            (
-                "cameraGroundSmoothSpeed",
-                camera_opts.ground_smooth_speed.to_string(),
-            ),
-            (
-                "cameraTerrainTiltTimeMin",
-                camera_opts.tilt_time_min.to_string(),
-            ),
-            (
-                "cameraTerrainTiltTimeMax",
-                camera_opts.tilt_time_max.to_string(),
-            ),
-            ("cameraBobbing", flag(camera_opts.bobbing)),
-            (
-                "cameraBobbingLRAmplitude",
-                camera_opts.bob_lr_amplitude.to_string(),
-            ),
-            (
-                "cameraBobbingUDAmplitude",
-                camera_opts.bob_ud_amplitude.to_string(),
-            ),
-            (
-                "cameraBobbingFrequency",
-                camera_opts.bob_frequency.to_string(),
-            ),
-            (
-                "cameraBobbingSmoothSpeed",
-                camera_opts.bob_smooth_speed.to_string(),
-            ),
-            ("autoLootDefault", flag(loot.auto_loot)),
-            ("showLootSpam", flag(loot.show_loot_spam)),
-            ("guildMemberNotify", flag(guild_notify.0)),
-            ("BlockTrades", flag(block_trades.0)),
-            ("UnitNamePlayer", flag(names.player)),
-            ("UnitNameNPC", flag(names.npc)),
-            ("UnitNameOwn", flag(names.own)),
-            ("UnitNamePlayerGuild", flag(names.player_guild)),
-            (crate::vplates::CVAR_ENEMIES, flag(plates.enemies)),
-            (crate::vplates::CVAR_FRIENDS, flag(plates.friends)),
-            // The session density on the panel scale (×1..×3 → 0..2). An env-driven off-grid
-            // multiplier seeds off-grid honestly — the dropdown shows the raw number, checks
-            // nothing (the 0959 out-of-range posture, dropdown-flavored). A console
-            // `frillDensity` past the top stop reads off-grid here for the same reason, which is
-            // the reference's own inconsistency between its two writers (2151).
-            ("WorldDetail", (clutter.density - 1.0).to_string()),
-            // …and the same density in the reference's own cells-per-chunk (2151).
-            ("frillDensity", clutter.frill_density().to_string()),
-            ("weatherDensity", weather.weather_density.to_string()),
-            // Six decimals, matching `SetGamma`'s own `"%f"` — see the row's comment.
-            ("gamma", format!("{:.6}", display_gamma.0)),
-            ("ChatBubbles", flag(bubbles.all)),
-            ("ChatBubblesParty", flag(bubbles.party)),
-            ("profanityFilter", flag(text_filter.profanity)),
-            ("spamFilter", flag(text_filter.spam)),
-            ("showGameTips", flag(game_tip.show)),
-            ("gameTip", game_tip.next.to_string()),
-            ("minimapZoom", minimap.outdoor.to_string()),
-            ("minimapInsideZoom", minimap.inside.to_string()),
-            // **The machine's, not the player's** (2151): the live render backend, so `GetCVar`
-            // and pfUI's system tooltip answer what this run is actually on. `None` only in a
-            // headless app with no renderer, where the registered `""` stands and says so.
-            (
-                "gxApi",
-                adapter
-                    .as_ref()
-                    .map_or_else(String::new, |a| a.backend.to_str().to_string()),
-            ),
-            ("gxVSync", flag(video.vsync)),
-            ("worldShadows", flag(video.world_shadows)),
-            ("characterShadows", flag(video.character_shadows)),
-            ("shadowDistance", video.shadow_distance.to_string()),
-            ("shadowMapSize", video.shadow_map_size.to_string()),
-            ("shadowFilter", video.shadow_filter.to_string()),
-            ("characterShadowRate", video.character_shadow_rate.to_string()),
-            ("worldShadowRate", video.world_shadow_rate.to_string()),
-            ("shadowCasterReach", video.shadow_caster_reach.to_string()),
-            ("interiorLight", flag(video.interior_light)),
-            ("interiorAmbient", video.interior_ambient.to_string()),
-            ("interiorFill", video.interior_fill.to_string()),
-            ("interiorExposure", video.interior_exposure.to_string()),
-            ("interiorAttenScale", video.interior_atten_scale.to_string()),
-            ("interiorRoomGate", flag(video.interior_room_gate)),
-            ("interiorShadows", flag(video.interior_shadows)),
-            ("exteriorShadows", flag(video.exterior_shadows)),
-            (
-                "interiorShadowCasters",
-                video.interior_shadow_casters.to_string(),
-            ),
-            ("interiorShadowDynamic", video.interior_shadow_dynamic.to_string()),
-            (
-                "interiorShadowEntityRate",
-                video.interior_shadow_entity_rate.to_string(),
-            ),
-            ("interiorShadowSoft", video.interior_shadow_soft.to_string()),
-            ("torchShadowStrength", video.torch_shadow_strength.to_string()),
-            ("interiorDebug", video.interior_debug.to_string()),
-            ("nightGain", video.night_gain.to_string()),
-            ("interiorGain", video.interior_gain.to_string()),
-            ("interiorDaylight", video.interior_daylight.to_string()),
-            ("interiorBakeFloor", video.interior_bake_floor.to_string()),
-            ("fireLightGain", video.fire_light_gain.to_string()),
-            ("spellLightGain", video.spell_light_gain.to_string()),
-            ("fireFlicker", video.fire_flicker.to_string()),
-            // The reference's polarity: the CVar is `gxWindow`, so `1` is the WINDOWED state.
-            (
-                "gxWindow",
-                flag(video.display == crate::video::DisplayMode::Windowed),
-            ),
-            // The one string-valued row, composed in the reference's spelling.
-            (
-                "gxResolution",
-                format!("{}x{}", video.windowed.x, video.windowed.y),
-            ),
-            ("boothHalfRate", flag(pane_rate.half)),
-            ("renderScale", render_scale.0.to_string()),
-            ("gxMultisample", msaa.samples.to_string()),
-            ("trilinear", flag(tex_filter.trilinear)),
-            ("anisotropic", tex_filter.aniso.to_string()),
-            ("fpsJournal", flag(fps_journal.0)),
-            // The other string-valued row (1667): what the next logon attempt will actually dial,
-            // including a `$WOW_HOST` the player never typed.
-            (
-                crate::realmlist::CVAR_REALMLIST,
-                realmlist.address().to_string(),
-            ),
-            // The combat log's eight display ranges, off the live table — written out one class at
-            // a time rather than composed in a loop, because this array is the readable census of
-            // what a session's `GetCVar` answers and a loop would hide eight rows inside one.
-            (
-                "CombatLogRangeParty",
-                combat_ranges.class(CombatClass::Party).to_string(),
-            ),
-            (
-                "CombatLogRangePartyPet",
-                combat_ranges.class(CombatClass::PartyPet).to_string(),
-            ),
-            (
-                "CombatLogRangeFriendlyPlayers",
-                combat_ranges.class(CombatClass::FriendlyPlayer).to_string(),
-            ),
-            (
-                "CombatLogRangeFriendlyPlayersPets",
-                combat_ranges.class(CombatClass::FriendlyPet).to_string(),
-            ),
-            (
-                "CombatLogRangeHostilePlayers",
-                combat_ranges.class(CombatClass::HostilePlayer).to_string(),
-            ),
-            (
-                "CombatLogRangeHostilePlayersPets",
-                combat_ranges.class(CombatClass::HostilePet).to_string(),
-            ),
-            (
-                "CombatLogRangeCreature",
-                combat_ranges.class(CombatClass::Creature).to_string(),
-            ),
-            (
-                crate::ui_chat::combat::DEATH_LOG_RANGE_CVAR,
-                combat_ranges.death().to_string(),
-            ),
-            ("CombatDamage", flag(damage_text.combat_damage)),
-            ("PetMeleeDamage", flag(damage_text.pet_melee)),
-            ("PetSpellDamage", flag(damage_text.pet_spell)),
-            (
-                crate::ui_chat::combat::LOG_PERIODIC_CVAR,
-                flag(log_periodic.0),
-            ),
-        ];
-        for (name, value) in session {
-            script.set_cvar_host(name, &value);
+    }
+    if cvars.has_outbox() {
+        for (name, value) in cvars.take_outbox() {
+            script.set_cvar_host(&name, &value);
         }
     }
-    // Take the changes BEFORE touching the knobs: constructing `Knobs` deref-muts every knob
-    // resource, which trips Bevy change detection even when nothing is written — and the
-    // clutter re-scatter is downstream of exactly that signal staying honest (0992).
-    let changes = script.take_cvar_changes();
-    if changes.is_empty() {
-        return;
-    }
-    let mut knobs = params.knobs();
-    for (name, value) in changes {
-        if apply_to_knobs(&name, &value, &mut knobs) {
-            persist.dirty = true;
-            persist.last_change = Some(Instant::now());
+    if cvars.has_events() {
+        for event in cvars.take_events() {
+            commands.trigger(event);
         }
     }
 }
 
-/// **A HOST-side CVar write that persists** — the counterpart to a Lua `SetCVar`, for the one CVar
-/// the engine itself owns: `gameTip`, the loading screen's cursor (2077).
-///
-/// It has to go through the VM's table rather than through the knob alone, because
-/// [`save_config`] composes the file from `cvars_snapshot()` — the knob is only ever *seeded* into
-/// a VM at claim time, so a host write that stops at the knob is invisible to the file and the
-/// cursor resets every launch. Marking dirty here is what arms the debounced save.
-pub(crate) fn write_host_cvar(
-    script: &mut UiScript,
-    persist: &mut CvarPersist,
-    name: &str,
-    value: &str,
-) {
-    script.set_cvar_host(name, value);
-    persist.dirty = true;
-    persist.last_change = Some(Instant::now());
-}
-
-/// Fold the dying VM's CVar table into the persist state — the session edge's half of decision
+/// Fold the dying VM's last writes into the registry — the session edge's half of decision
 /// 1291's bridge (the seed in [`sync_cvars`] is the other). Called from
 /// [`crate::ui_script::end_ui_session`] **after** the shutdown events (an addon's
 /// `PLAYER_LOGOUT` handler may `SetCVar`, and in the reference that write lands in an
 /// engine-side store that survives) and **before** the VM is replaced.
 ///
-/// Two steps, both about the writes the per-frame sync never got to see:
-/// 1. drain the dying VM's change queue into the host knobs — a `SetCVar` in the final frame
-///    would otherwise be overwritten by the stale knob when the next VM's seed runs;
-/// 2. fold the table into `persist.file` with the same compose the saver uses, so the next VM's
-///    saved base — and the next save — both start from what the player actually set.
-///
-/// `dirty` is left alone: if nothing changed, the fold is an identity; if something did, the
-/// change that did it already marked the config dirty.
+/// The registry IS the store that survives, so there is nothing to copy back: only the writes
+/// the per-frame sync never got to see — a `SetCVar` in the final frame would otherwise be
+/// overwritten by the stale value when the next VM's seed runs. The observers fire here, so the
+/// knobs are current before the next VM is even built.
 pub(crate) fn fold_dying_vm_cvars(world: &mut World) {
-    // A world with no persist state has no file to bridge — a test world or a stripped scenario
-    // that never added the plugin. It is checked up front because the knob set below is fetched
-    // NON-optionally, and the two facts are one: any world carrying `CvarPersist` carries every
-    // knob too (the plugin's own `load_config`/`sync_cvars` take them the same way, and would
-    // have panicked at startup otherwise).
-    if !world.contains_resource::<CvarPersist>() {
+    // A world with no registry has no file to bridge — a test world or a stripped scenario that
+    // never added the plugin.
+    if !world.contains_resource::<Cvars>() {
         return;
     }
-    let mut state: bevy::ecs::system::SystemState<(
-        Option<NonSendMut<UiScript>>,
-        ResMut<CvarPersist>,
-        KnobParams,
-    )> = bevy::ecs::system::SystemState::new(world);
-    let (script, mut persist, mut params) = state.get_mut(world);
-    let Some(mut script) = script else {
-        return;
+    let (registrations, changes) = {
+        let Some(mut script) = world.get_non_send_resource_mut::<UiScript>() else {
+            return;
+        };
+        (script.take_cvar_registrations(), script.take_cvar_changes())
     };
-    let changes = script.take_cvar_changes();
-    if !changes.is_empty() {
-        let mut knobs = params.knobs();
+    let events = {
+        let mut cvars = world.resource_mut::<Cvars>();
+        for (name, default) in registrations {
+            cvars.learn_addon_row(&name, &default);
+        }
         for (name, value) in changes {
-            if apply_to_knobs(&name, &value, &mut knobs) {
-                persist.dirty = true;
-                persist.last_change = Some(Instant::now());
-            }
+            cvars.set_from_vm(&name, &value);
         }
-    }
-    let snapshot = script.cvars_snapshot();
-    if snapshot.is_empty() {
-        return; // a VM that never registered (a capture) has nothing to say about the file
-    }
-    persist.file = compose_file(&persist.file, &persist.session_owned, &snapshot);
-}
-
-/// Compose the file to save: the previous file as the merge base, every registered var that
-/// moved off its default written, every one back at its default removed — session-owned keys
-/// untouched (that value is the env's or the machine's, not the player's).
-fn compose_file(
-    previous: &BTreeMap<String, String>,
-    session_owned: &HashSet<String>,
-    snapshot: &[(String, String, String)],
-) -> BTreeMap<String, String> {
-    let mut out = previous.clone();
-    for (name, value, default) in snapshot {
-        let key = name.to_ascii_lowercase();
-        if session_owned.contains(&key) {
-            continue;
+        if cvars.has_outbox() {
+            cvars.take_outbox(); // the VM this was for is going away
         }
-        // Match any existing entry case-insensitively so a hand-edited spelling doesn't fork.
-        let existing = out.keys().find(|k| k.eq_ignore_ascii_case(name)).cloned();
-        if value == default {
-            if let Some(k) = existing {
-                out.remove(&k);
-            }
+        if cvars.has_events() {
+            cvars.take_events()
         } else {
-            out.insert(existing.unwrap_or_else(|| name.clone()), value.clone());
+            Vec::new()
         }
+    };
+    for event in events {
+        world.trigger(event);
     }
-    out
 }
 
 /// The file's header comment — where these values come from and where the law lives.
@@ -2619,59 +2269,86 @@ const HEADER: &str = "\
 # Managed by the client; hand edits are read on next launch and preserved on save.
 ";
 
-/// Dirty + one quiet second (or the app exiting) → rewrite `config.toml` atomically.
-fn save_config(
-    script: Option<NonSendMut<UiScript>>,
-    mut persist: ResMut<CvarPersist>,
-    mut exits: MessageReader<AppExit>,
-) {
+/// Dirty + one quiet second (or the app exiting) → rewrite `config.toml` atomically, from the
+/// registry — the store, not the VM's mirror, so a session with no VM at all (the glue screens,
+/// a headless run) saves exactly what it changed.
+fn save_config(mut cvars: ResMut<Cvars>, mut exits: MessageReader<AppExit>) {
     let exiting = exits.read().next().is_some();
-    if !persist.dirty {
+    if !cvars.dirty {
         return;
     }
-    let quiet = persist
-        .last_change
-        .is_none_or(|t| t.elapsed() >= SAVE_QUIET);
+    let quiet = cvars.last_change.is_none_or(|t| t.elapsed() >= SAVE_QUIET);
     if !(quiet || exiting) {
         return;
     }
-    let Some(script) = script else { return };
     let Some(path) = crate::local_state::config_path() else {
-        persist.dirty = false; // hermetic/session-only: nothing to write, stop retrying
+        cvars.dirty = false; // hermetic/session-only: nothing to write, stop retrying
         return;
     };
-    let snapshot = script.cvars_snapshot();
-    // **An empty table is not a player who cleared their settings.** The file is composed from the
-    // VM's live table, so a VM whose table was never registered would compose the player's
-    // `config.toml` back out *stripped* — a silent, irreversible loss of everything they had set.
-    // The seed above is what keeps that from happening; this is the floor under it, because the
-    // failure is one-way and the next regression in that seed must not be able to reach the disk.
-    if snapshot.is_empty() {
-        warn!("config: the VM has no registered cvars — refusing to compose the file from nothing");
-        persist.dirty = false; // nothing to save, and retrying every frame changes nothing
-        return;
-    }
-    let cvars = compose_file(&persist.file, &persist.session_owned, &snapshot);
+    let file = cvars.compose();
     let body = toml::to_string(&LocalConfig {
-        cvars: cvars.clone(),
+        cvars: file.clone(),
     })
     .expect("string map serializes");
     match crate::local_state::write_atomic(&path, &format!("{HEADER}{body}")) {
         Ok(()) => {
-            persist.file = cvars;
-            persist.dirty = false;
+            cvars.file = file;
+            cvars.dirty = false;
         }
         Err(e) => {
             warn!("config: cannot write {}: {e}", path.display());
-            persist.dirty = false; // don't retry every frame into the same error
+            cvars.dirty = false; // don't retry every frame into the same error
         }
     }
 }
 
+/// Freeze the texture filter policy for the process, and say what it resolved to.
+///
+/// **A separate system, chained after [`load_config`], deliberately.** `load_config` returns early
+/// on an absent or malformed file, and the policy has to be published on every one of those paths:
+/// the sampler lanes are an async `AssetLoader` and a set of ordinary systems, none of which can
+/// read a resource the others own, so a run that never published would be reading
+/// [`benilla_assets::tex_filter`]'s fallback while a player's `config.toml` said otherwise.
+///
+/// The log line is not decoration — it is the same reasoning as `video::log_display_session`
+/// (1627). Every filtering report this client will get comes from a machine nobody here can run,
+/// and "which mode was that run actually in" must be readable off the log a player pastes rather
+/// than reasoned about.
+fn publish_filter_policy(filter: Res<benilla_assets::TexFilterSetting>) {
+    benilla_assets::publish_tex_filter(*filter);
+    let mode = filter.mode();
+    let name = match mode {
+        3 => "bilinear + nearest-mip select, aniso off",
+        4 => "trilinear, aniso off",
+        _ => "trilinear + aniso",
+    };
+    info!(
+        "texture filter: mode {mode} ({name}) — trilinear={} anisotropic={}",
+        u8::from(filter.trilinear),
+        filter.aniso
+    );
+}
+
 #[cfg(test)]
 mod tests {
     use super::*;
-    use crate::ui_script::DEFAULT_UI_SCALE;
+    use crate::chat_bubble::BubbleConfig;
+    use crate::minimap::MinimapZoom;
+    use crate::nameplates::NameConfig;
+    use crate::player::camera::{
+        FollowConfig, FollowStyle, LookConfig, ZoomLimit, FOLLOW_SPEED_RANGE,
+    };
+    use crate::portrait::PaneRate;
+    use crate::sound::SoundConfig;
+    use crate::target::ClickConfig;
+    use crate::ui_loot::LootConfig;
+    use crate::ui_script::{UiScaleCvar, DEFAULT_UI_SCALE};
+    use crate::video::VideoConfig;
+    use crate::vplates::VPlateMode;
+    use crate::world_backdrop::{RenderScale, RENDER_SCALE_RANGE};
+    use benilla_ui::widget::MINIMAP_ZOOM_LEVELS;
+    use benilla_world::clutter::ClutterConfig;
+    use benilla_world::view::{MsaaSetting, ViewDistance, FARCLIP_RANGE, MSAA_RANGE};
 
     /// **The standard, enforced: a benilla option's default IS the reference's** (decision 1804)
     /// — every row's [`Reference`] column stands up.
@@ -2972,44 +2649,85 @@ mod tests {
         // VSync welds to the video knob, which in turn welds to the window literal's boot
         // mode (`video::tests`) — so the registered "1" cannot drift from what we ship.
         assert_eq!(d["gxVSync"] != 0.0, VideoConfig::default().vsync);
-        assert_eq!(
-            d["worldShadows"] != 0.0,
-            VideoConfig::default().world_shadows
-        );
-        assert_eq!(
-            d["characterShadows"] != 0.0,
-            VideoConfig::default().character_shadows
-        );
-        // MONKEY (sun shadow perf): the five cost dials weld to the video knob's shipped defaults
-        // exactly like the two flags above — a registered row that drifts from what the rig
-        // actually runs is a setting that reads one way in the config and behaves another.
+        // ── MONKEY (lighting): the weld for the dynamic light + shadow system's whole row set ──
+        //
+        // **All 29, as one census, with the count asserted.** Every one of them lands on
+        // `VideoConfig` and is read from there per frame (`shadow_core::update_shadows`,
+        // `dynamic_interior::bridge`, `torch_shadow`), so a registered default that drifts from
+        // the struct's literal is a setting that reads one way in `config.toml` and renders
+        // another — invisible until someone compares a fresh install against a configured one.
+        // Spelling the table out rather than asserting a favourite handful is what makes "added
+        // a row, forgot its weld" fail HERE: the length check below is the gate.
         let shadows = VideoConfig::default();
-        assert_eq!(d["shadowMapSize"], shadows.shadow_map_size as f32);
-        assert_eq!(d["shadowFilter"], shadows.shadow_filter as f32);
-        assert_eq!(d["characterShadowRate"], shadows.character_shadow_rate as f32);
-        assert_eq!(d["worldShadowRate"], shadows.world_shadow_rate as f32);
-        assert_eq!(d["shadowCasterReach"], shadows.shadow_caster_reach);
-        // MONKEY (darkness gains): the two dim dials weld to the same knob for the same reason —
-        // the registered default IS what the light packer runs with until a config says otherwise,
-        // and a row that drifts is a setting that reads one way in the config and renders another.
-        assert_eq!(d["nightGain"], shadows.night_gain);
-        assert_eq!(d["interiorGain"], shadows.interior_gain);
-        // MONKEY (lighting debug panel): pin the requested dimmer baseline as well as the weld.
-        assert_eq!(d["interiorGain"], 0.5);
-        // MONKEY (enclosed day floor): same weld, same reason.
-        assert_eq!(d["interiorDaylight"], shadows.interior_daylight);
-        // MONKEY (bake floor): same weld, same reason — and pin the calibrated value, because the
-        // measurement the default stands on (the inn's door band at 0.108 x tex, candle-lit
-        // surfaces under +10 %) is only true at this number.
-        assert_eq!(d["interiorBakeFloor"], shadows.interior_bake_floor);
+        let flag = |b: bool| if b { 1.0 } else { 0.0 };
+        let lighting: [(&str, f32); 29] = [
+            // The two sun lanes and the cascade they share.
+            ("worldShadows", flag(shadows.world_shadows)),
+            ("characterShadows", flag(shadows.character_shadows)),
+            ("shadowDistance", shadows.shadow_distance),
+            // MONKEY (sun shadow perf): the five cost dials.
+            ("shadowMapSize", shadows.shadow_map_size as f32),
+            ("shadowFilter", shadows.shadow_filter as f32),
+            ("characterShadowRate", shadows.character_shadow_rate as f32),
+            ("worldShadowRate", shadows.world_shadow_rate as f32),
+            ("shadowCasterReach", shadows.shadow_caster_reach),
+            // MONKEY (dynamic interiors): the room lane's switch and its light law.
+            ("interiorLight", flag(shadows.interior_light)),
+            ("interiorAmbient", shadows.interior_ambient),
+            ("interiorFill", shadows.interior_fill),
+            ("interiorExposure", shadows.interior_exposure),
+            ("interiorAttenScale", shadows.interior_atten_scale),
+            ("interiorRoomGate", flag(shadows.interior_room_gate)),
+            ("interiorDebug", shadows.interior_debug as f32),
+            // MONKEY (torch shadows): the cube-map lane, indoors and out.
+            ("interiorShadows", flag(shadows.interior_shadows)),
+            ("exteriorShadows", flag(shadows.exterior_shadows)),
+            (
+                "interiorShadowCasters",
+                shadows.interior_shadow_casters as f32,
+            ),
+            (
+                "interiorShadowDynamic",
+                shadows.interior_shadow_dynamic as f32,
+            ),
+            (
+                "interiorShadowEntityRate",
+                shadows.interior_shadow_entity_rate as f32,
+            ),
+            ("interiorShadowSoft", shadows.interior_shadow_soft),
+            ("torchShadowStrength", shadows.torch_shadow_strength),
+            // MONKEY (darkness gains) / (enclosed day floor) / (bake floor): the four level dials.
+            ("nightGain", shadows.night_gain),
+            ("interiorGain", shadows.interior_gain),
+            ("interiorDaylight", shadows.interior_daylight),
+            ("interiorBakeFloor", shadows.interior_bake_floor),
+            // MONKEY (fire GO lights) / (spellLightGain) / (flame flicker): the invented lanes.
+            ("fireLightGain", shadows.fire_light_gain),
+            ("spellLightGain", shadows.spell_light_gain),
+            ("fireFlicker", shadows.fire_flicker),
+        ];
+        for (name, want) in lighting {
+            assert_eq!(d[name], want, "{name}: registered default left the knob");
+        }
+        // …and the census IS the row set. A name here that nothing registers would weld against a
+        // row the client does not have; the length is the other half — 29 rows, 29 welds.
+        let welded: std::collections::BTreeSet<&str> = lighting.iter().map(|(n, _)| *n).collect();
+        assert_eq!(welded.len(), 29, "the lighting lane welds 29 distinct rows");
+        for name in &welded {
+            assert!(
+                REGISTERED.iter().any(|r| r.name == *name),
+                "{name}: welded but not registered"
+            );
+        }
+        // Three of them are CALIBRATED rather than chosen, so the weld alone is not enough — it
+        // would pass just as happily if a tuning session left the struct's literal wherever it was
+        // last dragged in the debug panel. These pin the measured numbers themselves.
+        assert_eq!(d["interiorGain"], 0.5, "MONKEY (lighting debug panel)");
+        // MONKEY (bake floor): the inn's black door band measured up to 0.108 x tex with
+        // candle-lit surfaces moving under +10 % — only true at this number.
         assert_eq!(d["interiorBakeFloor"], 0.12);
-        // MONKEY (fire GO lights) / MONKEY (spellLightGain): the two invented-light gains weld the
-        // same way. Both ship at 1 — the point of each is that it is a DIAL, not a default look —
-        // and the pin below is what keeps a tuning session from leaving one of them shipped at the
-        // value it was last dragged to in the debug panel.
-        assert_eq!(d["fireLightGain"], shadows.fire_light_gain);
-        assert_eq!(d["spellLightGain"], shadows.spell_light_gain);
         assert_eq!(d["spellLightGain"], 1.0, "the spell lane ships neutral");
+        // ── end MONKEY (lighting) ─────────────────────────────────────────────────────────────
         // The pane half-rate (1444) welds to the portrait knob's shipped default.
         assert_eq!(d["boothHalfRate"] != 0.0, PaneRate::default().half);
         // Render scale (1639) welds to OFF. Not a taste default: the whole tree of visual
@@ -3018,278 +2736,215 @@ mod tests {
         assert_eq!(d["renderScale"], 1.0);
     }
 
+    /// **Every arm, through the registry and its observers.** The old central `apply_to_knobs`
+    /// match is gone (2303); each arm lives beside the knob it writes, and this drives the whole
+    /// set through a real `App` — a host write, the observers firing synchronously — so a knob
+    /// whose observer forgot an arm, or clamps differently from what its row promises, fails here.
+    ///
+    /// `apply` crosses the latch boundary at once, so the arms are what is under test; the latch
+    /// itself has its own test.
     #[test]
-    fn apply_parses_clamps_and_reports_unknowns() {
-        let mut sound = SoundConfig::default();
-        let mut scale = UiScaleCvar(0.9);
-        let mut view = ViewDistance {
-            farclip: 350.0,
-            nearclip: benilla_world::view::NEARCLIP_DEFAULT,
-        };
-        let mut look = LookConfig::default();
-        let mut click = ClickConfig::default();
-        let mut loot = LootConfig::default();
-        let mut names = NameConfig::default();
-        let mut plates = VPlateMode::default();
-        let mut assist_attack = crate::target::AssistAttack::default();
-        let mut combat_ranges = crate::ui_chat::combat::CombatLogRanges::default();
-        let mut damage_text = crate::combat_text::DamageTextGates::default();
-        let mut log_periodic = crate::ui_chat::combat::LogPeriodicSpells::default();
-        // Literal fields, not Default: ClutterConfig::default() reads the env A/B vars.
-        let mut clutter = ClutterConfig {
-            density: 3.0,
-            scale: 1.0,
-            alpha_ref: 0.5,
-            fade_far: 70.0,
-        };
-        let mut weather = benilla_world::weather::WeatherState::default();
-        let mut display_gamma = crate::ui_gamma::DisplayGamma::default();
-        let mut minimap = MinimapZoom::default();
-        let mut bubbles = BubbleConfig::default();
-        let mut zoom = ZoomLimit::default();
-        let mut follow = FollowConfig::default();
-        let mut video = VideoConfig::default();
-        let mut pane_rate = PaneRate::default();
-        let mut guild_notify = crate::ui_guild::GuildMemberNotify::default();
-        let mut block_trades = crate::ui_trade::BlockTrades::default();
-        // Literal, not Default: MsaaSetting::default() reads $WOW_MSAA.
-        let mut msaa = MsaaSetting { samples: 1 };
-        // What an Apple GPU answers for the trio we render into (Rgba16Float / Depth32Float /
-        // the swapchain). 8 and 16 are NOT in it — which is the whole point below.
-        let msaa_formats = benilla_world::view::MsaaFormats {
-            formats: vec![(32, 32, 1), (32, 32, 2), (32, 32, 4)],
-        };
-        // Literal for the same reason: RenderScale::default() reads $WOW_RENDER_SCALE.
-        let mut render_scale = RenderScale(1.0);
-        // Literal for the same reason again (1642): TexFilterSetting::default() reads
-        // $WOW_TRILINEAR / $WOW_ANISO. These are what ships (1645).
-        let mut tex_filter = benilla_assets::TexFilterSetting {
-            trilinear: true,
-            aniso: 1,
-        };
-        // Literal for the same reason once more (1667): Realmlist::default() reads $WOW_HOST, and
-        // a shell that happens to export it must not decide what this test asserts against.
-        let mut realmlist =
-            crate::realmlist::Realmlist::unpinned(crate::realmlist::DEFAULT_REALMLIST);
-        let mut auto_self_cast = crate::ui_action::AutoSelfCast::default();
-        let mut fps_journal = crate::perf::FpsJournalSetting::default();
-        let mut text_filter = crate::text_filter::TextFilterSwitches::default();
-        let mut game_tip = crate::game_tip::GameTipSetting::default();
-        let mut camera_opts = crate::player::camera_dynamics::CameraOptions::default();
-        let mut knobs = Knobs {
-            camera_opts: &mut camera_opts,
-            sound: &mut sound,
-            auto_self_cast: &mut auto_self_cast,
-            text_filter: &mut text_filter,
-            game_tip: &mut game_tip,
-            scale: &mut scale,
-            view: &mut view,
-            look: &mut look,
-            click: &mut click,
-            loot: &mut loot,
-            names: &mut names,
-            plates: &mut plates,
-            clutter: &mut clutter,
-            weather: &mut weather,
-            display_gamma: &mut display_gamma,
-            minimap: &mut minimap,
-            bubbles: &mut bubbles,
-            zoom: &mut zoom,
-            follow: &mut follow,
-            video: &mut video,
-            render_scale: &mut render_scale,
-            pane_rate: &mut pane_rate,
-            guild_notify: &mut guild_notify,
-            block_trades: &mut block_trades,
-            msaa: &mut msaa,
-            tex_filter: &mut tex_filter,
-            msaa_formats: &msaa_formats,
-            realmlist: &mut realmlist,
-            fps_journal: &mut fps_journal,
-            assist_attack: &mut assist_attack,
-            combat_ranges: &mut combat_ranges,
-            damage_text: &mut damage_text,
-            log_periodic: &mut log_periodic,
-        };
-        assert!(apply_to_knobs("MusicVolume", "0.7", &mut knobs));
-        assert_eq!(knobs.sound.music, 0.7);
+    fn the_observers_apply_every_arm() {
+        let mut app = cvar_app();
+        apply(&mut app, "MusicVolume", "0.7");
+        assert_eq!(res::<SoundConfig>(&app).music, 0.7);
         // The second string-valued row (1667): it must reach the knob rather than being rejected
         // by the numeric parse every other row goes through, and a value that is not an address
         // must be consumed (known key) while leaving the knob's truth alone.
-        assert!(apply_to_knobs(
-            "realmList",
-            "logon.example.org:3724",
-            &mut knobs
-        ));
-        assert_eq!(knobs.realmlist.address(), "logon.example.org:3724");
-        assert!(apply_to_knobs(
+        apply(&mut app, "realmList", "logon.example.org:3724");
+        assert_eq!(
+            res::<crate::realmlist::Realmlist>(&app).address(),
+            "logon.example.org:3724"
+        );
+        apply(
+            &mut app,
             "realmlist",
             r#"SET realmlist "elsewhere.example.org""#,
-            &mut knobs
-        ));
-        assert_eq!(knobs.realmlist.address(), "elsewhere.example.org");
-        assert!(apply_to_knobs("realmList", "not an address", &mut knobs));
+        );
         assert_eq!(
-            knobs.realmlist.address(),
+            res::<crate::realmlist::Realmlist>(&app).address(),
+            "elsewhere.example.org"
+        );
+        apply(&mut app, "realmList", "not an address");
+        assert_eq!(
+            res::<crate::realmlist::Realmlist>(&app).address(),
             "elsewhere.example.org",
             "a known key with a bad value is consumed, and the resource keeps its truth",
         );
         // Clamps are the knob's own: volume to [0,1], farclip to FARCLIP_RANGE.
-        assert!(apply_to_knobs("mastervolume", "7", &mut knobs));
-        assert_eq!(knobs.sound.master, 1.0);
-        assert!(apply_to_knobs("farclip", "50", &mut knobs));
-        assert_eq!(knobs.view.farclip, *FARCLIP_RANGE.start());
+        apply(&mut app, "mastervolume", "7");
+        assert_eq!(res::<SoundConfig>(&app).master, 1.0);
+        apply(&mut app, "farclip", "50");
+        assert_eq!(res::<ViewDistance>(&app).farclip, *FARCLIP_RANGE.start());
         // `nearclip` clamps to the reference's own callback bounds `[0.01, 0.33]` (`0x688d90`),
         // both ends. pfUI's extended stops write 0.06..0.30, so its whole range passes untouched.
-        assert!(apply_to_knobs("nearclip", "0.001", &mut knobs));
+        apply(&mut app, "nearclip", "0.001");
         assert_eq!(
-            knobs.view.nearclip, 0.01,
+            res::<ViewDistance>(&app).nearclip,
+            0.01,
             "[0x8029d0], the callback's low bound"
         );
-        assert!(apply_to_knobs("nearclip", "9", &mut knobs));
-        assert_eq!(knobs.view.nearclip, 0.33, "[0x808300], its high bound");
-        assert!(apply_to_knobs("nearclip", "0.3", &mut knobs));
-        assert_eq!(knobs.view.nearclip, 0.3);
+        apply(&mut app, "nearclip", "9");
+        assert_eq!(
+            res::<ViewDistance>(&app).nearclip,
+            0.33,
+            "[0x808300], its high bound"
+        );
+        apply(&mut app, "nearclip", "0.3");
+        assert_eq!(res::<ViewDistance>(&app).nearclip, 0.3);
         // Multisampling clamps to the reference's own [1, 16] and takes an int the way its `atoi`
         // does — the value reaching the camera is a sample COUNT, where 1 is none (1629).
-        assert!(apply_to_knobs("gxMultisample", "4", &mut knobs));
-        assert_eq!(knobs.msaa.samples, 4);
+        apply(&mut app, "gxMultisample", "4");
+        assert_eq!(res::<MsaaSetting>(&app).samples, 4);
         // The filter policy's two rows: `anisotropic` takes the reference's own [1, 16] clamp,
         // `trilinear` is a flag. Both write the pending value; the process policy is already
         // published by the time either can be typed (1642).
-        assert!(apply_to_knobs("anisotropic", "99", &mut knobs));
-        assert_eq!(knobs.tex_filter.aniso, *benilla_assets::ANISO_RANGE.end());
-        assert!(apply_to_knobs("anisotropic", "0", &mut knobs));
-        assert_eq!(knobs.tex_filter.aniso, *benilla_assets::ANISO_RANGE.start());
+        apply(&mut app, "anisotropic", "99");
+        assert_eq!(
+            res::<benilla_assets::TexFilterSetting>(&app).aniso,
+            *benilla_assets::ANISO_RANGE.end()
+        );
+        apply(&mut app, "anisotropic", "0");
+        assert_eq!(
+            res::<benilla_assets::TexFilterSetting>(&app).aniso,
+            *benilla_assets::ANISO_RANGE.start()
+        );
         // Both directions: the knob starts at what ships (on), so only the flip to 0 proves the
         // arm does anything.
-        assert!(apply_to_knobs("trilinear", "0", &mut knobs));
-        assert!(!knobs.tex_filter.trilinear);
-        assert!(apply_to_knobs("trilinear", "1", &mut knobs));
-        assert!(knobs.tex_filter.trilinear);
+        apply(&mut app, "trilinear", "0");
+        assert!(!res::<benilla_assets::TexFilterSetting>(&app).trilinear);
+        apply(&mut app, "trilinear", "1");
+        assert!(res::<benilla_assets::TexFilterSetting>(&app).trilinear);
         // **The DEVICE's ceiling, not the reference's** (decision 1643). 99 clamps to the
         // reference's 16 and then to the 4 this GPU offers — before 1643 it stopped at 16 and the
         // camera was handed a sample count wgpu refuses, killing the render thread on frame one.
-        assert!(apply_to_knobs("gxmultisample", "99", &mut knobs));
-        assert_eq!(knobs.msaa.samples, 4);
+        apply(&mut app, "gxmultisample", "99");
+        assert_eq!(res::<MsaaSetting>(&app).samples, 4);
         // The realistic route in: a config written where 8x exists, opened where it does not.
-        assert!(apply_to_knobs("gxMultisample", "8", &mut knobs));
+        apply(&mut app, "gxMultisample", "8");
         assert_eq!(
-            knobs.msaa.samples, 4,
+            res::<MsaaSetting>(&app).samples,
+            4,
             "a device that stops at 4x must never be handed an 8"
         );
         // A count the device DOES offer is untouched.
-        assert!(apply_to_knobs("gxmultisample", "2", &mut knobs));
-        assert_eq!(knobs.msaa.samples, 2);
-        assert!(apply_to_knobs("gxmultisample", "0", &mut knobs));
-        assert_eq!(knobs.msaa.samples, *MSAA_RANGE.start());
+        apply(&mut app, "gxmultisample", "2");
+        assert_eq!(res::<MsaaSetting>(&app).samples, 2);
+        apply(&mut app, "gxmultisample", "0");
+        assert_eq!(res::<MsaaSetting>(&app).samples, *MSAA_RANGE.start());
         // Render scale takes a fraction and clamps to its own range at both ends (1639).
-        assert!(apply_to_knobs("renderScale", "0.75", &mut knobs));
-        assert_eq!(knobs.render_scale.0, 0.75);
-        assert!(apply_to_knobs("renderscale", "9", &mut knobs));
-        assert_eq!(knobs.render_scale.0, *RENDER_SCALE_RANGE.end());
-        assert!(apply_to_knobs("renderscale", "0", &mut knobs));
-        assert_eq!(knobs.render_scale.0, *RENDER_SCALE_RANGE.start());
+        apply(&mut app, "renderScale", "0.75");
+        assert_eq!(res::<RenderScale>(&app).0, 0.75);
+        apply(&mut app, "renderscale", "9");
+        assert_eq!(res::<RenderScale>(&app).0, *RENDER_SCALE_RANGE.end());
+        apply(&mut app, "renderscale", "0");
+        assert_eq!(res::<RenderScale>(&app).0, *RENDER_SCALE_RANGE.start());
         // The FPS journal switch (2008): a flag, case-insensitive, off as shipped.
-        assert!(!knobs.fps_journal.0);
-        assert!(apply_to_knobs("fpsJournal", "1", &mut knobs));
-        assert!(knobs.fps_journal.0);
-        assert!(apply_to_knobs("fpsjournal", "0", &mut knobs));
-        assert!(!knobs.fps_journal.0);
+        assert!(!res::<crate::perf::FpsJournalSetting>(&app).0);
+        apply(&mut app, "fpsJournal", "1");
+        assert!(res::<crate::perf::FpsJournalSetting>(&app).0);
+        apply(&mut app, "fpsjournal", "0");
+        assert!(!res::<crate::perf::FpsJournalSetting>(&app).0);
         // Enable flags: any nonzero is on, zero is off (the client's int-parse + != 0).
-        assert!(apply_to_knobs("EnableMusic", "0", &mut knobs));
-        assert!(!knobs.sound.music_enabled);
-        assert!(apply_to_knobs("mastersoundeffects", "1", &mut knobs));
-        assert!(knobs.sound.enabled);
+        apply(&mut app, "EnableMusic", "0");
+        assert!(!res::<SoundConfig>(&app).music_enabled);
+        apply(&mut app, "mastersoundeffects", "1");
+        assert!(res::<SoundConfig>(&app).enabled);
         // The Controls trio lands on its knobs (case-insensitive like everything else).
-        assert!(apply_to_knobs("deselectonclick", "0", &mut knobs));
-        assert!(!knobs.click.deselect_on_click);
-        assert!(apply_to_knobs("MouseInvertPitch", "1", &mut knobs));
-        assert!(knobs.look.invert_pitch);
+        apply(&mut app, "deselectonclick", "0");
+        assert!(!res::<ClickConfig>(&app).deselect_on_click);
+        apply(&mut app, "MouseInvertPitch", "1");
+        assert!(res::<LookConfig>(&app).invert_pitch);
         // The sensitivity multiplier clamps to the 1.12 slider's range at the knob.
-        assert!(apply_to_knobs("mousespeed", "1.4", &mut knobs));
-        assert_eq!(knobs.look.sensitivity, 1.4);
-        assert!(apply_to_knobs("mousespeed", "9", &mut knobs));
-        assert_eq!(knobs.look.sensitivity, 1.5);
+        apply(&mut app, "mousespeed", "1.4");
+        assert_eq!(res::<LookConfig>(&app).sensitivity, 1.4);
+        apply(&mut app, "mousespeed", "9");
+        assert_eq!(res::<LookConfig>(&app).sensitivity, 1.5);
         // The following style lands as the ENGINE's enum (0 Never / 1 Smart / 2 Always), and the
         // "3" the reference's own dropdown writes for Never still means Never.
-        assert!(apply_to_knobs("cameraSmoothStyle", "0", &mut knobs));
-        assert_eq!(knobs.follow.style, FollowStyle::Never);
-        assert!(apply_to_knobs("camerasmoothstyle", "2", &mut knobs));
-        assert_eq!(knobs.follow.style, FollowStyle::Always);
-        assert!(apply_to_knobs("cameraSmoothStyle", "3", &mut knobs));
-        assert_eq!(knobs.follow.style, FollowStyle::Never);
-        assert!(apply_to_knobs("cameraSmoothStyle", "1", &mut knobs));
-        assert_eq!(knobs.follow.style, FollowStyle::Smart);
+        apply(&mut app, "cameraSmoothStyle", "0");
+        assert_eq!(res::<FollowConfig>(&app).style, FollowStyle::Never);
+        apply(&mut app, "camerasmoothstyle", "2");
+        assert_eq!(res::<FollowConfig>(&app).style, FollowStyle::Always);
+        apply(&mut app, "cameraSmoothStyle", "3");
+        assert_eq!(res::<FollowConfig>(&app).style, FollowStyle::Never);
+        apply(&mut app, "cameraSmoothStyle", "1");
+        assert_eq!(res::<FollowConfig>(&app).style, FollowStyle::Smart);
         // Its two siblings land on the same knob — the tracking selector, and the rate, which
         // clamps to 1.12's AUTO_FOLLOW_SPEED slider range.
-        assert!(apply_to_knobs("cameraSmoothTrackingStyle", "2", &mut knobs));
-        assert_eq!(knobs.follow.tracking_style, FollowStyle::Always);
-        assert_eq!(knobs.follow.style, FollowStyle::Smart, "and only that one");
-        assert!(apply_to_knobs("cameraYawSmoothSpeed", "270", &mut knobs));
-        assert_eq!(knobs.follow.yaw_speed, 270.0);
-        assert!(apply_to_knobs("cameraYawSmoothSpeed", "9000", &mut knobs));
-        assert_eq!(knobs.follow.yaw_speed, *FOLLOW_SPEED_RANGE.end());
+        apply(&mut app, "cameraSmoothTrackingStyle", "2");
+        assert_eq!(
+            res::<FollowConfig>(&app).tracking_style,
+            FollowStyle::Always
+        );
+        assert_eq!(
+            res::<FollowConfig>(&app).style,
+            FollowStyle::Smart,
+            "and only that one"
+        );
+        apply(&mut app, "cameraYawSmoothSpeed", "270");
+        assert_eq!(res::<FollowConfig>(&app).yaw_speed, 270.0);
+        apply(&mut app, "cameraYawSmoothSpeed", "9000");
+        assert_eq!(
+            res::<FollowConfig>(&app).yaw_speed,
+            *FOLLOW_SPEED_RANGE.end()
+        );
         // The max-orbit factor lands as YARDS on the knob (base 15 x factor), clamped to 1..2.
-        assert!(apply_to_knobs("cameraDistanceMaxFactor", "1", &mut knobs));
-        assert_eq!(knobs.zoom.max, 15.0);
-        assert!(apply_to_knobs("cameradistancemaxfactor", "5", &mut knobs));
-        assert_eq!(knobs.zoom.max, 30.0);
-        assert!(apply_to_knobs("autoLootDefault", "1", &mut knobs));
-        assert!(knobs.loot.auto_loot);
-        assert!(apply_to_knobs("showLootSpam", "0", &mut knobs));
-        assert!(!knobs.loot.show_loot_spam);
+        apply(&mut app, "cameraDistanceMaxFactor", "1");
+        assert_eq!(res::<ZoomLimit>(&app).max, 15.0);
+        apply(&mut app, "cameradistancemaxfactor", "5");
+        assert_eq!(res::<ZoomLimit>(&app).max, 30.0);
+        apply(&mut app, "autoLootDefault", "1");
+        assert!(res::<LootConfig>(&app).auto_loot);
+        apply(&mut app, "showLootSpam", "0");
+        assert!(!res::<LootConfig>(&app).show_loot_spam);
         // Guild Member Alert (1589) — the row that ships OFF, so its ON is the interesting write.
-        assert!(apply_to_knobs("guildMemberNotify", "1", &mut knobs));
-        assert!(knobs.guild_notify.0);
+        apply(&mut app, "guildMemberNotify", "1");
+        assert!(res::<crate::ui_guild::GuildMemberNotify>(&app).0);
         // Block Trades (1764) — the other row that ships OFF; its ON is what refuses a trade.
-        assert!(apply_to_knobs("BlockTrades", "1", &mut knobs));
-        assert!(knobs.block_trades.0);
+        apply(&mut app, "BlockTrades", "1");
+        assert!(res::<crate::ui_trade::BlockTrades>(&app).0);
         // The name trio lands on its gates (0992).
-        assert!(apply_to_knobs("UnitNameNPC", "0", &mut knobs));
-        assert!(!knobs.names.npc);
-        assert!(apply_to_knobs("unitnameown", "1", &mut knobs));
-        assert!(knobs.names.own);
+        apply(&mut app, "UnitNameNPC", "0");
+        assert!(!res::<NameConfig>(&app).npc);
+        apply(&mut app, "unitnameown", "1");
+        assert!(res::<NameConfig>(&app).own);
         // …and the plate pair on the two bits of the bitmask, either casing.
-        assert!(apply_to_knobs(
-            crate::vplates::CVAR_ENEMIES,
-            "0",
-            &mut knobs
-        ));
-        assert!(!knobs.plates.enemies);
-        assert!(apply_to_knobs("nameplateshowfriends", "1", &mut knobs));
-        assert!(knobs.plates.friends);
+        apply(&mut app, crate::vplates::CVAR_ENEMIES, "0");
+        assert!(!res::<VPlateMode>(&app).enemies);
+        apply(&mut app, "nameplateshowfriends", "1");
+        assert!(res::<VPlateMode>(&app).friends);
         // The bubble pair lands on the spawn gate's own knob (1139).
-        assert!(apply_to_knobs("ChatBubbles", "0", &mut knobs));
-        assert!(!knobs.bubbles.all);
-        assert!(apply_to_knobs("chatbubblesparty", "0", &mut knobs));
-        assert!(!knobs.bubbles.party);
+        apply(&mut app, "ChatBubbles", "0");
+        assert!(!res::<BubbleConfig>(&app).all);
+        apply(&mut app, "chatbubblesparty", "0");
+        assert!(!res::<BubbleConfig>(&app).party);
         // WorldDetail: panel 0/1/2 → density ×1/×2/×3, clamped to the 1.12 slider's range.
-        assert!(apply_to_knobs("WorldDetail", "0", &mut knobs));
-        assert_eq!(knobs.clutter.density, 1.0);
-        assert!(apply_to_knobs("worlddetail", "7", &mut knobs));
-        assert_eq!(knobs.clutter.density, 3.0);
+        apply(&mut app, "WorldDetail", "0");
+        assert_eq!(res::<ClutterConfig>(&app).density, 1.0);
+        apply(&mut app, "worlddetail", "7");
+        assert_eq!(res::<ClutterConfig>(&app).density, 3.0);
         // frillDensity: the SAME field in the reference's cells-per-chunk (2151), and the two
         // arms' clamps are deliberately different — the stop's `[0, 2]` above, the cells'
         // `[1, 256]` here (callback `0x688de0`). The stops round-trip through both spellings,
         // which is the property that makes them one knob rather than two that agree by habit.
-        assert!(apply_to_knobs("frillDensity", "48", &mut knobs));
-        assert_eq!(knobs.clutter.density, 3.0);
-        assert!(apply_to_knobs("frilldensity", "16", &mut knobs));
-        assert_eq!(knobs.clutter.density, 1.0);
+        apply(&mut app, "frillDensity", "48");
+        assert_eq!(res::<ClutterConfig>(&app).density, 3.0);
+        apply(&mut app, "frilldensity", "16");
+        assert_eq!(res::<ClutterConfig>(&app).density, 1.0);
         // Past the top stop is HONOURED, not clamped to it — pfUI's `hdgraphic` drives exactly
         // this, `ConsoleExec("frillDensity " .. (arg+1)*16)` for arg up to 15.
-        assert!(apply_to_knobs("frillDensity", "256", &mut knobs));
-        assert_eq!(knobs.clutter.density, 16.0);
+        apply(&mut app, "frillDensity", "256");
+        assert_eq!(res::<ClutterConfig>(&app).density, 16.0);
         // …and the reference's own bounds hold at both ends. `0` is NOT clutter-off: the callback
         // pins it to 1, and turning grass off stays the `$WOW_CLUTTER_DENSITY` instrument's.
-        assert!(apply_to_knobs("frillDensity", "9000", &mut knobs));
-        assert_eq!(knobs.clutter.density, 16.0);
-        assert!(apply_to_knobs("frillDensity", "0", &mut knobs));
-        assert_eq!(knobs.clutter.density, 1.0 / 16.0);
+        apply(&mut app, "frillDensity", "9000");
+        assert_eq!(res::<ClutterConfig>(&app).density, 16.0);
+        apply(&mut app, "frillDensity", "0");
+        assert_eq!(res::<ClutterConfig>(&app).density, 1.0 / 16.0);
         // The row `GetCVar` answers is the same field seen the other way round.
-        assert!(apply_to_knobs("WorldDetail", "1", &mut knobs));
-        assert_eq!(knobs.clutter.density, 2.0);
+        apply(&mut app, "WorldDetail", "1");
+        assert_eq!(res::<ClutterConfig>(&app).density, 2.0);
         // Weather Intensity (2181): the panel's four stops land whole, an off-grid value
         // truncates toward zero the way every int-valued row here does, and both ends clamp.
         for (wrote, want) in [
@@ -3301,9 +2956,10 @@ mod tests {
             ("9", 3),
             ("-4", 0),
         ] {
-            assert!(apply_to_knobs("weatherDensity", wrote, &mut knobs));
+            apply(&mut app, "weatherDensity", wrote);
             assert_eq!(
-                knobs.weather.weather_density, want,
+                res::<benilla_world::weather::WeatherState>(&app).weather_density,
+                want,
                 "weatherDensity {wrote}"
             );
         }
@@ -3312,33 +2968,40 @@ mod tests {
         // Both ends of the stock slider land whole, and the consumer's clamp holds the values the
         // reference accepts without one (`SetGamma(5)` writes -4 there).
         for (wrote, want) in [("1.000000", 1.0), ("0.500000", 0.5), ("1.500000", 1.5)] {
-            assert!(apply_to_knobs("gamma", wrote, &mut knobs));
-            assert_eq!(knobs.display_gamma.0, want, "gamma {wrote}");
+            apply(&mut app, "gamma", wrote);
+            assert_eq!(
+                res::<crate::ui_gamma::DisplayGamma>(&app).0,
+                want,
+                "gamma {wrote}"
+            );
         }
-        assert!(apply_to_knobs("gamma", "-4.000000", &mut knobs));
+        apply(&mut app, "gamma", "-4.000000");
         assert_eq!(
-            knobs.display_gamma.0,
+            res::<crate::ui_gamma::DisplayGamma>(&app).0,
             *crate::ui_gamma::GAMMA_RANGE.start(),
             "a negative exponent clamps at the consumer, where it cannot blank the screen"
         );
-        assert!(apply_to_knobs("gamma", "99", &mut knobs));
-        assert_eq!(knobs.display_gamma.0, *crate::ui_gamma::GAMMA_RANGE.end());
-        assert_eq!(knobs.clutter.frill_density(), 32.0);
-        // And the pair is NAMED as a pair, in the registered spelling and the lowercased one, so
-        // `$WOW_CLUTTER_DENSITY` cannot take one spelling of this knob for the session and leave
-        // the other free to persist the lever (2151).
-        for key in CLUTTER_DENSITY_CVARS {
-            assert!(
-                REGISTERED.iter().any(|r| r.name.eq_ignore_ascii_case(key)),
-                "{key}: named as a clutter-density spelling but not registered"
+        apply(&mut app, "gamma", "99");
+        assert_eq!(
+            res::<crate::ui_gamma::DisplayGamma>(&app).0,
+            *crate::ui_gamma::GAMMA_RANGE.end()
+        );
+        assert_eq!(res::<ClutterConfig>(&app).frill_density(), 32.0);
+        // Both spellings reach the same field, from a state neither of them holds — and
+        // `$WOW_CLUTTER_DENSITY` takes both for the session (`session_values`), so the lever
+        // cannot ride into `config.toml` through the other name (2151). Two different values,
+        // because a write of the sibling's mirrored value is the no-op it should be.
+        for (key, value) in [
+            (benilla_ui::script::CVAR_WORLD_DETAIL, "2"),
+            (benilla_ui::script::CVAR_FRILL_DENSITY, "16"),
+        ] {
+            app.world_mut().resource_mut::<ClutterConfig>().density = 0.5;
+            assert_eq!(apply(&mut app, key, value), SetOutcome::Changed);
+            assert_ne!(
+                res::<ClutterConfig>(&app).density,
+                0.5,
+                "{key}: reached no knob"
             );
-            assert_eq!(key.to_ascii_lowercase(), key, "the set is lowercased keys");
-        }
-        // Both of them reach the same field, from a state neither of them holds.
-        for key in CLUTTER_DENSITY_CVARS {
-            knobs.clutter.density = 0.5;
-            assert!(apply_to_knobs(key, "48", &mut knobs));
-            assert_ne!(knobs.clutter.density, 0.5, "{key}: reached no knob");
         }
         // **The engine verbs' half of the same weld** (2163). `SetWorldDetail`/`GetWorldDetail` live
         // in `benilla-ui`, which cannot see this table, so the two CVar names and the stop table it
@@ -3376,56 +3039,59 @@ mod tests {
             );
             // Either spelling of the stop lands on the same ground cover — which is what lets the
             // setter write `frillDensity` and the getter read `WorldDetail` without disagreeing.
-            assert!(apply_to_knobs("WorldDetail", &n.to_string(), &mut knobs));
-            let by_stop = knobs.clutter.density;
-            knobs.clutter.density = 0.5;
-            assert!(apply_to_knobs(
-                "frillDensity",
-                &frill.to_string(),
-                &mut knobs
-            ));
+            apply(&mut app, "WorldDetail", &n.to_string());
+            let by_stop = res::<ClutterConfig>(&app).density;
+            // Off the stop first — the mirror already wrote this spelling — then the stop's
+            // own cells through it.
+            apply(&mut app, "frillDensity", "1");
+            app.world_mut().resource_mut::<ClutterConfig>().density = 0.5;
+            apply(&mut app, "frillDensity", &frill.to_string());
             assert_eq!(
-                knobs.clutter.density, by_stop,
+                res::<ClutterConfig>(&app).density,
+                by_stop,
                 "stop {n}: the two spellings disagree"
             );
-            assert_eq!(knobs.clutter.frill_density(), *frill as f32);
+            assert_eq!(res::<ClutterConfig>(&app).frill_density(), *frill as f32);
         }
         // Back to the shipped stop, so the rows after this one read the default ground cover.
-        assert!(apply_to_knobs("WorldDetail", "1", &mut knobs));
-        assert_eq!(knobs.clutter.density, 2.0);
+        apply(&mut app, "WorldDetail", "1");
+        assert_eq!(res::<ClutterConfig>(&app).density, 2.0);
         // The zoom pair (1131): each index lands on its own field, clamped like `set_zoom`.
-        assert!(apply_to_knobs("minimapZoom", "5", &mut knobs));
-        assert_eq!(knobs.minimap.outdoor, 5);
-        assert_eq!(knobs.minimap.inside, 3, "the two indices are independent");
-        assert!(apply_to_knobs("minimapinsidezoom", "9", &mut knobs));
-        assert_eq!(knobs.minimap.inside, MINIMAP_ZOOM_LEVELS - 1);
-        assert!(apply_to_knobs("minimapZoom", "-2", &mut knobs));
-        assert_eq!(knobs.minimap.outdoor, 0);
-        // A bad value is consumed (known key) and the resource keeps its truth.
-        assert!(apply_to_knobs("uiScale", "banana", &mut knobs));
-        assert_eq!(knobs.scale.0, 0.9);
-        assert!(!apply_to_knobs("bogus", "1", &mut knobs));
+        apply(&mut app, "minimapZoom", "5");
+        assert_eq!(res::<MinimapZoom>(&app).outdoor, 5);
+        assert_eq!(
+            res::<MinimapZoom>(&app).inside,
+            3,
+            "the two indices are independent"
+        );
+        apply(&mut app, "minimapinsidezoom", "9");
+        assert_eq!(res::<MinimapZoom>(&app).inside, MINIMAP_ZOOM_LEVELS - 1);
+        apply(&mut app, "minimapZoom", "-2");
+        assert_eq!(res::<MinimapZoom>(&app).outdoor, 0);
+        // A bad value on a numeric row is REFUSED by the registry (2303) — the resource keeps
+        // its truth and the row keeps its value; an unknown name is reported as such.
+        assert_eq!(apply(&mut app, "uiScale", "banana"), SetOutcome::Refused);
+        assert_eq!(res::<UiScaleCvar>(&app).0, 0.9);
+        assert_eq!(apply(&mut app, "bogus", "1"), SetOutcome::Unknown);
     }
 
     #[test]
     fn compose_writes_the_diff_and_preserves_what_it_does_not_own() {
-        let previous: BTreeMap<String, String> = [
-            ("FutureKnob".to_string(), "3".to_string()), // a newer build's key: preserved
-            ("uiScale".to_string(), "0.8".to_string()),  // env-overridden this session
-            ("farclip".to_string(), "400".to_string()),  // will return to default
-        ]
-        .into();
-        let env: HashSet<String> = ["uiscale".to_string()].into();
-        let snapshot = vec![
-            // (name, value, default)
-            ("MusicVolume".into(), "0.7".into(), "0.4".into()), // moved: written
-            ("MasterVolume".into(), "1".into(), "1".into()),    // default: absent
-            ("uiScale".into(), "1.2".into(), "0.9".into()),     // env value: file keeps 0.8
-            ("farclip".into(), "350".into(), "350".into()),     // back to default: removed
-        ];
-        let out = compose_file(&previous, &env, &snapshot);
+        let mut cvars = Cvars::default();
+        cvars.own_for_session("uiScale", Some("1.2")); // env-overridden this session
+        cvars.load_file(
+            [
+                ("FutureKnob".to_string(), "3".to_string()), // a newer build's key: preserved
+                ("uiScale".to_string(), "0.8".to_string()),  // the file's own, kept as found
+                ("farclip".to_string(), "400".to_string()),  // will return to default
+            ]
+            .into(),
+        );
+        cvars.set("MusicVolume", "0.7"); // moved: written
+        cvars.set("farclip", "350"); // back to default: removed
+        let out = cvars.compose();
         assert_eq!(out.get("MusicVolume").map(String::as_str), Some("0.7"));
-        assert!(!out.contains_key("MasterVolume"));
+        assert!(!out.contains_key("MasterVolume"), "at default: absent");
         assert_eq!(out.get("uiScale").map(String::as_str), Some("0.8"));
         assert!(!out.contains_key("farclip"));
         assert_eq!(out.get("FutureKnob").map(String::as_str), Some("3"));
@@ -3486,8 +3152,8 @@ mod tests {
         std::fs::remove_dir_all(&tmp).ok();
     }
 
-    /// A client whose CVar host is real: every knob resource the [`KnobParams`] census wants,
-    /// [`CvarPlugin`] itself, and a VM for the table to live in. The three end-to-end tests below
+    /// A client whose CVar host is real: every knob resource an observer writes, every
+    /// observer, [`CvarPlugin`] itself, and a VM for the mirror to live in. The end-to-end tests below
     /// each stand a whole client up, and the census is one row per knob — copied per test, adding
     /// a knob meant editing every copy.
     fn cvar_app() -> App {
@@ -3543,19 +3209,117 @@ mod tests {
             .init_resource::<crate::text_filter::TextFilterSwitches>()
             .init_resource::<crate::game_tip::GameTipSetting>()
             .add_plugins(CvarPlugin);
+        for observer in ALL_OBSERVERS {
+            observer(&mut app);
+        }
         app.insert_non_send_resource(UiScript::new().unwrap());
         app
     }
 
+    /// Every CVar observer in the crate, as the plugins register them — the census this test
+    /// module stands a client up with. A new observer is one line here and one
+    /// `add_observer` in its plugin.
+    const ALL_OBSERVERS: &[fn(&mut App)] = &[
+        |app| {
+            app.add_observer(crate::sound::on_cvar);
+        },
+        |app| {
+            app.add_observer(crate::ui_script::on_cvar);
+        },
+        |app| {
+            app.add_observer(crate::video::on_cvar);
+        },
+        |app| {
+            app.add_observer(crate::player::camera::on_cvar);
+        },
+        |app| {
+            app.add_observer(crate::player::camera_dynamics::on_cvar);
+        },
+        |app| {
+            app.add_observer(crate::target::on_cvar);
+        },
+        |app| {
+            app.add_observer(crate::ui_action::on_cvar);
+        },
+        |app| {
+            app.add_observer(crate::combat_text::on_cvar);
+        },
+        |app| {
+            app.add_observer(crate::ui_chat::combat::on_cvar);
+        },
+        |app| {
+            app.add_observer(crate::ui_loot::on_cvar);
+        },
+        |app| {
+            app.add_observer(crate::nameplates::on_cvar);
+        },
+        |app| {
+            app.add_observer(crate::vplates::on_cvar);
+        },
+        |app| {
+            app.add_observer(crate::game_tip::on_cvar);
+        },
+        |app| {
+            app.add_observer(crate::text_filter::on_cvar);
+        },
+        |app| {
+            app.add_observer(crate::chat_bubble::on_cvar);
+        },
+        |app| {
+            app.add_observer(crate::ui_guild::on_cvar);
+        },
+        |app| {
+            app.add_observer(crate::ui_trade::on_cvar);
+        },
+        |app| {
+            app.add_observer(crate::minimap::on_cvar);
+        },
+        |app| {
+            app.add_observer(crate::portrait::on_cvar);
+        },
+        |app| {
+            app.add_observer(crate::perf::on_cvar);
+        },
+        |app| {
+            app.add_observer(crate::realmlist::on_cvar);
+        },
+        |app| {
+            app.add_observer(crate::ui_gamma::on_cvar);
+        },
+        |app| {
+            app.add_observer(crate::world_backdrop::on_cvar);
+        },
+    ];
+
+    /// A host write, its latch committed at once, and its observers run before this returns.
+    fn apply(app: &mut App, name: &str, value: &str) -> SetOutcome {
+        let world = app.world_mut();
+        let (outcome, events) = {
+            let mut cvars = world.resource_mut::<Cvars>();
+            let outcome = cvars.set(name, value);
+            cvars.commit_latched();
+            (outcome, cvars.take_events())
+        };
+        for event in events {
+            world.trigger(event);
+        }
+        outcome
+    }
+
+    fn res<T: Resource>(app: &App) -> &T {
+        app.world().resource::<T>()
+    }
+
     /// **The reported bug, end to end** (decision 1622): "char screen doesn't remember the last
     /// logged in char, the ref does". Two launches over one `benilla-config/`, with the real
     /// [`CvarPlugin`] and the real [`crate::char_select`] systems in between — entering the world
     /// as somebody has to survive the quit and bring the screen back to them.
     ///
-    /// The seam this covers and the per-module tests cannot: `set_cvar_engine`'s queued change is
-    /// only *persisted* if [`apply_to_knobs`] answers `true` for the name. A knobless CVar that
-    /// falls through to `_ => return false` reaches the VM's table, reads back correctly all
-    /// session, and is silently dropped at the save — which is this bug again, one layer down.
+    /// The seam this covers and the per-module tests cannot: the screen's host write has to
+    /// reach the file through the registry's own dirty/compose path. Before 2303 a knobless CVar
+    /// fell through the central arm match to `_ => return false`, reached the VM's table, read
+    /// back correctly all session, and was silently dropped at the save — this bug again, one
+    /// layer down.
     #[test]
     fn entering_the_world_survives_the_quit_and_comes_back_selected() {
         use crate::char_select::{ClientState, Roster};
@@ -3714,6 +3478,7 @@ mod tests {
         let parsed: LocalConfig = toml::from_str(hand).unwrap();
         assert_eq!(parsed.cvars.get("Farclip").map(String::as_str), Some("500"));
     }
+
     /// **The table's string-valued CVars, named — and each one's default asserted on its own
     /// terms.**
     ///
@@ -3729,14 +3494,14 @@ mod tests {
     /// cleanly, and inventing a realm name would be worse than admitting we have none yet.
     ///
     /// **`gxResolution` defaults to the pre-1627 window** (decision 1627), and **`realmList` to
-    /// `localhost`** (1667). These are the rows [`apply_to_knobs`] matches ahead of its numeric
-    /// parse, so each default is asserted through the same parser the live value goes through — a
-    /// spelling this table accepts but [`crate::video::parse_resolution`] or
-    /// [`crate::realmlist::normalize`] rejects would otherwise ship as a silent fall back.
+    /// `localhost`** (1667). These are the rows the registry takes any string for (a row's
+    /// default decides whether it is numeric — [`Cvars::set`]), so each default is asserted
+    /// through the parser its observer uses on the live value — a spelling this table accepts
+    /// but [`crate::video::parse_resolution`] or [`crate::realmlist::normalize`] rejects would
+    /// otherwise ship as a silent fall back.
     ///
-    /// The list itself is the load-bearing half: a new string-valued row that forgets its arm in
-    /// `apply_to_knobs` is a CVar the player can set and the client will never honour, and this is
-    /// what makes adding one impossible to do quietly.
+    /// The list itself is the load-bearing half: a new string-valued row has to come here and
+    /// name its parser, which is what makes adding one impossible to do quietly.
     #[test]
     fn the_string_valued_cvars_are_the_realm_and_the_windowed_size() {
         let mut strings: Vec<&str> = REGISTERED
@@ -3775,30 +3540,331 @@ mod tests {
         );
     }
 
-    /// **The claim the test above only asserted in prose, now enforced.** Its doc says a string
-    /// row that forgets its arm in [`apply_to_knobs`] "is a CVar the player can set and the client
-    /// will never honour, and this is what makes adding one impossible to do quietly" — and then
-    /// `realmName` was added and did exactly that. It reached the numeric parse, which can only
-    /// reject it, so every launch after the first connect logged
-    /// `cvar realmName: unparseable value 'VMaNGOS' ignored`.
-    ///
-    /// It was the mild half of the failure — the persisted value still reaches `GetCVar` through
-    /// `set_cvar_saved_base`, so nothing was actually lost, and the warn was libel rather than
-    /// news. A string row that DID own a knob would have been silently dropped. Both directions
-    /// are pinned: a new non-numeric row that skips [`is_string_valued`] fails here, and a key
-    /// named there that stops being a registered string row fails here too.
+    /// A registry with the file's entries and the session's env values, no disk: the pure
+    /// half of the load, for the tests below.
+    fn registry(file: &[(&str, &str)]) -> Cvars {
+        let mut cvars = Cvars::default();
+        cvars.load_file(
+            file.iter()
+                .map(|(k, v)| (k.to_string(), v.to_string()))
+                .collect(),
+        );
+        cvars
+    }
+
+    /// **The latch** (decision 2303): a write to a row the reference registers with flag bit1
+    /// is staged, the applied value stands, nothing fires and nothing dirties — the reference's
+    /// `Set 0x63df50` storing to `latchedValue` with `InternalSet` skipped — until the boundary
+    /// commits it (`CVar::Update 0x63e060`), at which point it fires, persists and reaches the
+    /// mirror. Staging the applied value back clears the stage; a stage never committed is not
+    /// what the file gets.
     #[test]
-    fn every_string_valued_row_is_claimed_before_the_numeric_parse() {
-        for r in REGISTERED {
-            let key = r.name.to_ascii_lowercase();
-            assert_eq!(
-                r.default.parse::<f32>().is_err(),
-                is_string_valued(&key),
-                "{}: a row's default parsing as a number and `is_string_valued` must agree — \
-                 a string row that misses the guard falls to the numeric parse, which only \
-                 rejects it",
-                r.name,
+    fn a_latched_row_stages_the_write_until_the_boundary_commits_it() {
+        let mut cvars = Cvars::default();
+        assert!(
+            cvars.row("gxVSync").unwrap().latched,
+            "the reference's flags=3 row"
+        );
+        assert_eq!(cvars.set("gxVSync", "0"), SetOutcome::Staged);
+        assert_eq!(cvars.get("gxVSync"), Some("1"), "applied value stands");
+        assert_eq!(cvars.row("gxVSync").unwrap().pending.as_deref(), Some("0"));
+        assert!(!cvars.has_events(), "nothing fires before the boundary");
+        assert!(!cvars.dirty, "nothing to save before the boundary");
+        assert_eq!(
+            cvars.set("gxVSync", "0"),
+            SetOutcome::Unchanged,
+            "same stage"
+        );
+        assert!(
+            !cvars.compose().contains_key("gxVSync"),
+            "a stage that is never committed never reaches the file"
+        );
+        // The boundary.
+        assert_eq!(cvars.commit_latched(), 1);
+        assert_eq!(cvars.get("gxVSync"), Some("0"));
+        assert_eq!(cvars.row("gxVSync").unwrap().pending, None);
+        assert_eq!(
+            cvars.take_events(),
+            vec![CvarChanged {
+                name: "gxVSync".into(),
+                old: "1".into(),
+                new: "0".into()
+            }]
+        );
+        assert!(cvars.dirty);
+        assert_eq!(
+            cvars.compose().get("gxVSync").map(String::as_str),
+            Some("0")
+        );
+        assert_eq!(
+            cvars.take_outbox(),
+            vec![("gxVSync".to_string(), "0".to_string())]
+        );
+        // Staging the applied value back over a stage clears the stage, and the next boundary
+        // has nothing to do.
+        cvars.set("gxVSync", "1");
+        assert_eq!(cvars.set("gxVSync", "0"), SetOutcome::Unchanged);
+        assert_eq!(cvars.row("gxVSync").unwrap().pending, None);
+        assert_eq!(cvars.commit_latched(), 0);
+        // An unlatched row applies at once, fires, and dirties.
+        assert_eq!(cvars.set("MusicVolume", "0.7"), SetOutcome::Changed);
+        assert_eq!(cvars.get("MusicVolume"), Some("0.7"));
+        assert_eq!(cvars.take_events().len(), 1);
+    }
+
+    /// **A numeric row refuses what does not parse** — the applied value stands, the mirror
+    /// that already stored the garbage is corrected through the outbox, and nothing fires. The
+    /// old central parse consumed the value and let it into the file; the registry does not.
+    /// A string row takes any string, and its observer is the one that judges it.
+    #[test]
+    fn a_numeric_row_refuses_what_does_not_parse_and_corrects_the_mirror() {
+        let mut cvars = Cvars::default();
+        assert_eq!(cvars.set_from_vm("uiScale", "banana"), SetOutcome::Refused);
+        assert_eq!(cvars.get("uiScale"), Some("0.9"));
+        assert!(!cvars.has_events());
+        assert!(!cvars.dirty);
+        assert_eq!(
+            cvars.take_outbox(),
+            vec![("uiScale".to_string(), "0.9".to_string())],
+            "the VM stored 'banana' synchronously; the host writes the truth back"
+        );
+        assert_eq!(cvars.set("uiScale", "banana"), SetOutcome::Refused);
+        assert!(
+            cvars.take_outbox().is_empty(),
+            "a host write has no mirror to correct"
+        );
+        assert_eq!(
+            cvars.set("realmList", "not an address"),
+            SetOutcome::Changed
+        );
+        assert_eq!(cvars.set("nosuchrow", "1"), SetOutcome::Unknown);
+    }
+
+    /// **An addon-declared row persists like the client's own** (decisions 1195, 1291, 2303):
+    /// the VM reports the registration, the registry gives it a row starting at the file's
+    /// value when the file carries one, a write to it dirties the config, and the save writes it
+    /// as a diff against the addon's default. Before the registry the write reached the VM's
+    /// table and nothing dirtied, so an addon-only change was saved only if something else
+    /// happened to move.
+    #[test]
+    fn an_addon_row_persists_like_the_clients_own() {
+        let mut cvars = registry(&[("myAddonKnob", "3")]);
+        assert_eq!(
+            cvars.orphans(),
+            vec![("myAddonKnob".to_string(), "3".to_string())],
+            "unclaimed until the addon declares it — the VM's saved base"
+        );
+        cvars.learn_addon_row("myAddonKnob", "1");
+        assert_eq!(
+            cvars.get("myAddonKnob"),
+            Some("3"),
+            "starts at the saved value"
+        );
+        assert_eq!(cvars.default_of("myAddonKnob"), Some("1"));
+        assert!(cvars.orphans().is_empty());
+        cvars.learn_addon_row("myAddonKnob", "9");
+        assert_eq!(
+            cvars.default_of("myAddonKnob"),
+            Some("1"),
+            "a re-declaration is a no-op"
+        );
+        assert!(!cvars.dirty);
+        assert_eq!(cvars.set_from_vm("myAddonKnob", "5"), SetOutcome::Changed);
+        assert!(cvars.dirty, "an addon-only change is a change");
+        assert_eq!(
+            cvars.compose().get("myAddonKnob").map(String::as_str),
+            Some("5")
+        );
+        cvars.set_from_vm("myAddonKnob", "1");
+        assert!(
+            !cvars.compose().contains_key("myAddonKnob"),
+            "back at the addon's default, it leaves the diff"
+        );
+        // A newer build's key stays an orphan and rides through the save verbatim.
+        let cvars = registry(&[("FutureKnob", "3")]);
+        assert_eq!(
+            cvars.compose().get("FutureKnob").map(String::as_str),
+            Some("3")
+        );
+    }
+
+    /// **A session-owned row answers the env and never reaches the file**: the value the knob
+    /// is running at is what `GetCVar` answers, the file's own entry for the key is neither
+    /// applied nor rewritten, and a player's write to it during the session still works — it
+    /// just stays out of the diff.
+    #[test]
+    fn a_session_owned_row_answers_the_env_and_never_reaches_the_file() {
+        let mut cvars = Cvars::default();
+        cvars.own_for_session("uiScale", Some("1.2"));
+        cvars.load_file(BTreeMap::from([("uiScale".to_string(), "0.8".to_string())]));
+        assert_eq!(
+            cvars.get("uiScale"),
+            Some("1.2"),
+            "the env's, not the file's"
+        );
+        assert!(
+            !cvars.has_events(),
+            "the knob already read the env — nothing to apply"
+        );
+        assert_eq!(cvars.set("uiScale", "1.4"), SetOutcome::Changed);
+        assert_eq!(
+            cvars.compose().get("uiScale").map(String::as_str),
+            Some("0.8"),
+            "the file keeps what it said"
+        );
+        // A lever whose resource is absent still marks the row, so the file cannot apply over
+        // the env — the registered default stands as the truth.
+        cvars.own_for_session("farclip", None);
+        cvars.load_file(BTreeMap::from([("farclip".to_string(), "500".to_string())]));
+        assert_eq!(cvars.get("farclip"), Some("350"));
+        assert!(cvars.is_session_owned("FARCLIP"));
+    }
+
+    /// **The loaded file reaches a knob synchronously, before anything ordered after
+    /// [`CvarLoad`]** — the observers fire inside the exclusive load, which is what lets the
+    /// camera read `gxMultisample` at spawn (1629) and every other `Startup` reader of a knob
+    /// see the player's value rather than the default.
+    #[test]
+    fn the_loaded_file_reaches_a_knob_before_anything_ordered_after_cvar_load() {
+        use crate::local_state::test_env::{EnvGuard, ENV_LOCK};
+        let _l = ENV_LOCK
+            .lock()
+            .unwrap_or_else(std::sync::PoisonError::into_inner);
+        let tmp = std::env::temp_dir().join(format!("benilla-cvar-load-{}", std::process::id()));
+        std::fs::remove_dir_all(&tmp).ok();
+        let _c = EnvGuard::unset("WOW_CAPTURE");
+        let _u = EnvGuard::unset("WOW_UI_SCALE");
+        let _f = EnvGuard::unset("WOW_FARCLIP");
+        let _d = EnvGuard::unset("WOW_CLUTTER_DENSITY");
+        let _m = EnvGuard::unset("WOW_MSAA");
+        let _h = EnvGuard::set("BENILLA_HOME", tmp.to_str().unwrap());
+        crate::local_state::write_atomic(
+            &tmp.join("config.toml"),
+            "[cvars]\nMusicVolume = \"0.1\"\ngxMultisample = \"4\"\n",
+        )
+        .unwrap();
+        #[derive(Resource, Default)]
+        struct SeenAtStartup(Option<(f32, u32)>);
+        fn after_load(
+            sound: Res<SoundConfig>,
+            msaa: Res<MsaaSetting>,
+            mut seen: ResMut<SeenAtStartup>,
+        ) {
+            seen.0 = Some((sound.music, msaa.samples));
+        }
+        let mut app = cvar_app();
+        app.init_resource::<SeenAtStartup>()
+            .add_systems(Startup, after_load.after(CvarLoad));
+        app.update();
+        assert_eq!(
+            app.world().resource::<SeenAtStartup>().0,
+            Some((0.1, 4)),
+            "both the plain row and the latched one are applied by the time CvarLoad is over"
+        );
+        assert_eq!(
+            app.world().resource::<Cvars>().get("gxMultisample"),
+            Some("4"),
+            "a file value is applied, not staged: the reference's LoadFile runs before Register"
+        );
+        std::fs::remove_dir_all(&tmp).ok();
+    }
+
+    /// **Every registered row has a reader** — the honest-tree rule (module doc, 1140), made
+    /// structural now that the registry has no central arm to answer `false` from. A row's
+    /// reader is a string literal naming it somewhere in the crate's code or `benilla-ui`'s (an
+    /// observer's arm in the lowercased spelling, a `cvars.get("…")`, a `const` the row is
+    /// registered through), or the row is named in [`LUA_ONLY`] with the stock file that reads
+    /// it. Test files are not readers.
+    #[test]
+    fn every_registered_row_has_a_reader_in_the_source() {
+        /// Rows whose only reader is the stock interface, by decision.
+        const LUA_ONLY: &[(&str, &str)] = &[
+            (
+                "statusBarText",
+                "TextStatusBar.lua reads it on CVAR_UPDATE (1140)",
+            ),
+            (
+                "UberTooltips",
+                "GameTooltip's binding-line gate, stock and pfUI (1316)",
+            ),
+            ("gxApi", "pfUI's system tooltip names the backend (2151)"),
+            (
+                "useUiScale",
+                "UIOptionsFrame.lua and OptionsFrame.lua branch on it to gate the uiScale slider",
+            ),
+        ];
+        let app_src = crate::test_support::src_dir();
+        let ui_src = app_src
+            .parent()
+            .and_then(std::path::Path::parent)
+            .expect("crates/")
+            .join("benilla-ui")
+            .join("src");
+        let mut code = String::new();
+        for file in crate::test_support::rust_files(&app_src)
+            .into_iter()
+            .chain(crate::test_support::rust_files(&ui_src))
+        {
+            let rel = file.to_string_lossy().replace('\\', "/");
+            if rel.ends_with("/cvars.rs") && rel.contains("benilla-app") || rel.contains("tests") {
+                continue;
+            }
+            let text = std::fs::read_to_string(&file).expect("source is readable");
+            for line in text.lines() {
+                if !line.trim_start().starts_with("//") {
+                    code.push_str(line);
+                    code.push('\n');
+                }
+            }
+        }
+        let mut orphans = Vec::new();
+        for row in REGISTERED {
+            if LUA_ONLY.iter().any(|(n, _)| *n == row.name) {
+                continue;
+            }
+            let exact = format!("\"{}\"", row.name);
+            let lower = format!("\"{}\"", row.name.to_ascii_lowercase());
+            if !(code.contains(&exact) || code.contains(&lower)) {
+                orphans.push(row.name);
+            }
+        }
+        assert!(
+            orphans.is_empty(),
+            "registered rows nothing in the source reads (an observer arm, a `cvars.get`, or a \
+             `LUA_ONLY` entry with its stock reader): {orphans:?}"
+        );
+        for (name, _) in LUA_ONLY {
+            assert!(
+                REGISTERED.iter().any(|r| r.name == *name),
+                "{name}: named Lua-only but not registered"
             );
         }
     }
+
+    /// The eight rows the reference latches that benilla registers, and no other — read off
+    /// `re/cvar/cvar-register-sites.tsv` (`flags` 2 or 3): the sound-init row, and the `gx*`
+    /// block `RestartGx` commits. `trilinear`/`anisotropic`/`farclip` register with `flags = 1`
+    /// there and apply live, so they are deliberately not here.
+    #[test]
+    fn the_latched_rows_are_the_references_own() {
+        let mut latched: Vec<&str> = REGISTERED
+            .iter()
+            .filter(|r| r.latched)
+            .map(|r| r.name)
+            .collect();
+        latched.sort_unstable();
+        assert_eq!(
+            latched,
+            vec![
+                "SoundBufferSize",
+                "gxApi",
+                "gxColorBits",
+                "gxDepthBits",
+                "gxMultisample",
+                "gxResolution",
+                "gxVSync",
+                "gxWindow",
+            ]
+        );
+    }
 }
diff --git a/crates/benilla-app/src/death.rs b/crates/benilla-app/src/death.rs
index a60c4ad3..91d16481 100644
--- a/crates/benilla-app/src/death.rs
+++ b/crates/benilla-app/src/death.rs
@@ -16,7 +16,7 @@ use benilla_ui::script::{DeathAction, DeathUiState, ScriptValue, UiScript};
 
 use crate::net::{ClientCommand, GuidIndex, NetCommands, ObjectStore, SelfGuid, SelfPlayer};
 use crate::ui_action::Spells;
-use crate::ui_script::UiInput;
+use crate::ui_script::{UiFeed, UiInput};
 
 /// Where our corpse is — the `MSG_CORPSE_QUERY` answer (decision 0308 §5). Raw WoW coords.
 #[derive(Debug, Clone, Copy, PartialEq)]
@@ -177,7 +177,6 @@ const SPIRIT_HEALER_RANGE_SQ: f32 = 5.5556 * 5.5556;
 /// Per-frame: derive the death state from the self descriptor, push the countdown/offer snapshot,
 /// and fire the reference's death events on the edges (before `UiInput`, so a frame's `OnEvent`
 /// sees current values — the [`crate::ui_unit`] feed convention).
-#[allow(clippy::too_many_arguments)]
 fn feed_death(
     script: Option<NonSendMut<UiScript>>,
     self_q: Query<(&ObjectStore, &Transform), With<SelfPlayer>>,
@@ -188,14 +187,14 @@ fn feed_death(
     // comparison must be the same clock.
     time: Res<Time<Real>>,
     mut feed: ResMut<DeathFeedState>,
-    mut names: ResMut<crate::names::NameCache>,
+    names: Res<crate::names::NameCache>,
     net: Res<NetCommands>,
     index: Res<GuidIndex>,
     transforms: Query<&Transform>,
     map: Option<Res<benilla_world::world_map::CurrentMap>>,
     status: Res<crate::net::NetStatus>,
     spells: Option<Res<Spells>>,
-    mut items: ResMut<crate::items::Items>,
+    items: Res<crate::items::Items>,
 ) {
     // **Only a LIVE session's descriptor is a snapshot** (decision 1732). A reconnect-able
     // disconnect keeps the self avatar as the local puppet (0065) — descriptor and all — so
@@ -260,7 +259,7 @@ fn feed_death(
         // `HasSoulstone()` — see [`resolve_self_res`] for the three gates and their order. Not a
         // per-frame inventory walk in general: the dead gate is first, so while alive this is one
         // health read, and while dead-unreleased the walk only runs on a zero field.
-        self_res_label: resolve_self_res(&store.0, &mut items, spells.as_deref(), &net)
+        self_res_label: resolve_self_res(&store.0, &items, spells.as_deref(), &net)
             .map(|r| r.label().to_owned()),
     });
 
@@ -471,7 +470,7 @@ impl SelfRes {
 /// the lookup fires answers within a frame or two and the next resolve sees it.
 fn resolve_self_res(
     store: &benilla_protocol::ObjectFields,
-    items: &mut crate::items::Items,
+    items: &crate::items::Items,
     spells: Option<&Spells>,
     commands: &NetCommands,
 ) -> Option<SelfRes> {
@@ -629,7 +628,7 @@ fn drain_death(
                 match store.as_ref().and_then(|store| {
                     resolve_self_res(
                         store,
-                        &mut ladder.items,
+                        &ladder.items,
                         ladder.spells.as_deref(),
                         &ladder.commands,
                     )
@@ -719,7 +718,7 @@ impl Plugin for DeathPlugin {
             .add_systems(
                 Update,
                 (
-                    feed_death.before(UiInput),
+                    feed_death.in_set(UiFeed),
                     drain_death.after(UiInput),
                     drive_death_look,
                     // Before the feed, so the frame a session ends is already a frame the feed
@@ -838,7 +837,7 @@ mod self_res_tests {
     #[test]
     fn the_dead_gate_precedes_the_field() {
         let (net, _rx) = commands();
-        let mut items = Items::default();
+        let items = Items::default();
         let spells = catalog([(REINCARNATION, named("Reincarnation", [94, 0, 0]))]);
 
         let alive = ObjectFields::from_pairs(&[
@@ -847,7 +846,7 @@ mod self_res_tests {
             (F_SELF_RES, REINCARNATION),
         ]);
         assert_eq!(
-            resolve_self_res(&alive, &mut items, Some(&spells), &net),
+            resolve_self_res(&alive, &items, Some(&spells), &net),
             None,
             "alive with a self-res owed: nil"
         );
@@ -860,7 +859,7 @@ mod self_res_tests {
             (F_SELF_RES, REINCARNATION),
         ]);
         assert_eq!(
-            resolve_self_res(&ghost, &mut items, Some(&spells), &net),
+            resolve_self_res(&ghost, &items, Some(&spells), &net),
             None,
             "a released ghost still holds the field, and still answers nil"
         );
@@ -871,7 +870,7 @@ mod self_res_tests {
             (F_SELF_RES, REINCARNATION),
         ]);
         assert_eq!(
-            resolve_self_res(&dead, &mut items, Some(&spells), &net),
+            resolve_self_res(&dead, &items, Some(&spells), &net),
             Some(SelfRes::Spell {
                 spell: REINCARNATION,
                 label: "Reincarnation".into(),
@@ -884,12 +883,12 @@ mod self_res_tests {
     #[test]
     fn an_unresolvable_spell_id_reads_unknown_not_nil() {
         let (net, _rx) = commands();
-        let mut items = Items::default();
+        let items = Items::default();
         let dead =
             ObjectFields::from_pairs(&[(F_MAXHEALTH, 4000), (F_HEALTH, 0), (F_SELF_RES, 999_999)]);
         for spells in [None, Some(catalog([]))] {
             assert_eq!(
-                resolve_self_res(&dead, &mut items, spells.as_ref(), &net),
+                resolve_self_res(&dead, &items, spells.as_ref(), &net),
                 Some(SelfRes::Spell {
                     spell: 999_999,
                     label: "UNKNOWN".into(),
@@ -949,7 +948,7 @@ mod self_res_tests {
         }
         let dead = ObjectFields::from_pairs(&pairs);
 
-        match resolve_self_res(&dead, &mut items, Some(&spells), &net) {
+        match resolve_self_res(&dead, &items, Some(&spells), &net) {
             Some(SelfRes::Item { entry, label, .. }) => {
                 assert_eq!(
                     entry, 12,
@@ -962,9 +961,6 @@ mod self_res_tests {
 
         // Take it away and the answer is nil again — not "UNKNOWN", which is the spell leg's.
         let bare = ObjectFields::from_pairs(&[(F_MAXHEALTH, 4000), (F_HEALTH, 0)]);
-        assert_eq!(
-            resolve_self_res(&bare, &mut items, Some(&spells), &net),
-            None
-        );
+        assert_eq!(resolve_self_res(&bare, &items, Some(&spells), &net), None);
     }
 }
diff --git a/crates/benilla-app/src/debug_panel/inspect.rs b/crates/benilla-app/src/debug_panel/inspect.rs
index 34db476b..41a3b096 100644
--- a/crates/benilla-app/src/debug_panel/inspect.rs
+++ b/crates/benilla-app/src/debug_panel/inspect.rs
@@ -157,6 +157,10 @@ pub(super) struct InspectStores<'w, 's> {
     /// The ask-once GO template cache — the readable head a TEXT object's line reports
     /// (decision 1105), and the highlight column + name the tooltip ladder reports (2246).
     go_templates: Res<'w, crate::go_templates::GameObjectTemplates>,
+    /// `[0xb72038]` — the meeting-stone queue, the other half of MEETINGSTONE(23)'s own
+    /// highlightable term (decision 2283), so the card's `interact` verdict reads the same
+    /// predicate the cursor and the click do.
+    stone: Option<Res<'w, crate::ui_dialog_verbs::MeetingStone>>,
     /// **The published GameObject mouseover** — the one the tooltip actually reads
     /// ([`crate::target::HoveredObject`]). The card's own pick is a dev pick and does not go
     /// through the publish, so without this the card can show an object the game is not hovering
@@ -192,7 +196,6 @@ pub(super) struct InspectStores<'w, 's> {
 /// The inspector overlay, drawn only while armed: a weak top-centre "armed" pill (so it's obvious the
 /// mode is on and how to leave it) and, whenever the cursor is over an identified object, a compact
 /// identity card pinned to the cursor. No chrome, no panel — its own lightweight surface.
-#[allow(clippy::too_many_arguments)]
 pub(super) fn inspect_ui(
     mut contexts: EguiContexts,
     inspect: Res<InspectMode>,
@@ -206,7 +209,7 @@ pub(super) fn inspect_ui(
     drivers: Query<&crate::creature_anim::AnimDriver>,
     anim_data: Option<Res<crate::creature_anim::AnimData>>,
     spells: Option<Res<crate::ui_action::Spells>>,
-    mut names: ResMut<crate::names::NameCache>,
+    names: Res<crate::names::NameCache>,
     net_commands: Res<crate::net::NetCommands>,
     // Bundled into one param (Bevy's system-function arity ceiling): the copy-click button, and
     // the flag it must yield to — a left press this frame the UI already consumed as a
@@ -262,6 +265,7 @@ pub(super) fn inspect_ui(
     let (reputations, plates, plate_mode) =
         (&*stores.reputations, &stores.plates.0, &*stores.plate_mode);
     let go_templates = &*stores.go_templates;
+    let queued_area = stores.stone.as_deref().map_or(0, |s| s.area);
     let hovered_go = &*stores.hovered_go;
     // The picked submesh's shading payload — off the hit entity itself (see the field's doc).
     let tag_line = mouseover
@@ -417,7 +421,8 @@ pub(super) fn inspect_ui(
                     self_store, go_guid,
                 ),
                 meeting_stone_queued: crate::target::cursor_mode::meeting_stone_queued(
-                    go_guid.and_then(|g| go_templates.get(g)?.meeting_stone_area),
+                    go_guid.and_then(|g| Some(go_templates.get(g)?.meeting_stone?.area)),
+                    queued_area,
                 ),
             };
             let interact = if crate::target::cursor_mode::go_highlightable(s, reaction, overrides) {
diff --git a/crates/benilla-app/src/debug_panel/journal.rs b/crates/benilla-app/src/debug_panel/journal.rs
index 1fe87952..fcae929c 100644
--- a/crates/benilla-app/src/debug_panel/journal.rs
+++ b/crates/benilla-app/src/debug_panel/journal.rs
@@ -156,13 +156,12 @@ fn age(now: f64, at: f64) -> String {
 /// The journal overlay: while inspect is armed, the recent casts as a top-left column, newest
 /// first — click a row to copy its one-line identity block. Shares the inspector card's style
 /// (decision 0025's one overlay look).
-#[allow(clippy::too_many_arguments)]
 pub(super) fn journal_ui(
     mut contexts: EguiContexts,
     inspect: Res<InspectMode>,
     journal: Res<CastJournal>,
     self_guid: Res<SelfGuid>,
-    mut names: ResMut<crate::names::NameCache>,
+    names: Res<crate::names::NameCache>,
     net_commands: Res<NetCommands>,
     time: Res<Time>,
     // The copied row's edge stamp (`CastRecord::at` is unique per row) + when the copy happened,
diff --git a/crates/benilla-app/src/debug_panel/lighting_controls.rs b/crates/benilla-app/src/debug_panel/lighting_controls.rs
index cc6dc269..9776689d 100644
--- a/crates/benilla-app/src/debug_panel/lighting_controls.rs
+++ b/crates/benilla-app/src/debug_panel/lighting_controls.rs
@@ -28,7 +28,8 @@ struct Knob {
 }
 
 // MONKEY (lighting debug panel): keep names, typed reads and presentation together. The numeric
-// bounds mirror `cvars::apply_to_knobs` (including its wider ambient/fill/attenuation ranges);
+// bounds mirror `video::on_cvar`'s MONKEY (lighting) arms — the registry's change-callback
+// observer since 2303 — including their wider ambient/fill/attenuation ranges;
 // shared shadow constants follow the setter directly. Casting the booleans through u32 keeps
 // the descriptor read-only without inventing a parallel configuration type.
 macro_rules! knob {
diff --git a/crates/benilla-app/src/debug_panel/mod.rs b/crates/benilla-app/src/debug_panel/mod.rs
index 8f9e63ba..3b991233 100644
--- a/crates/benilla-app/src/debug_panel/mod.rs
+++ b/crates/benilla-app/src/debug_panel/mod.rs
@@ -37,6 +37,7 @@ use bevy_egui::{
     PrimaryEguiContext,
 };
 
+use benilla_assets::LockRecover;
 use benilla_world::lighting::{ClockSource, GameClock, WowLighting};
 use benilla_world::model_render::{ModelKind, ModelPart};
 use benilla_world::modkeys::{dev_chord, DEV_CHORD};
@@ -381,7 +382,6 @@ fn toggle_panel(keys: Res<ButtonInput<KeyCode>>, mut debug: ResMut<DebugState>)
 /// Draw the panel as a translucent **overlay** on the right — the world renders full-screen
 /// underneath (no viewport inset). `ui_script::PointerOverUi` keeps the cursor's panel
 /// interactions from leaking into gameplay mouse-look.
-#[allow(clippy::too_many_arguments)]
 fn debug_panel_ui(
     mut contexts: EguiContexts,
     stamp: Res<benilla_world::build_id::BuildId>,
@@ -682,7 +682,7 @@ fn debug_panel_ui(
                             // The LAST sample, not the ring average the meter shows: the panel
                             // is the instrument, and "what did the most recent pong measure" is
                             // the question a stuck or spiking meter needs answered.
-                            let last_rtt = ping.0.lock().expect("ping clock").last_rtt_ms;
+                            let last_rtt = ping.0.lock_recover().last_rtt_ms;
                             ui.label(if net_status.connected {
                                 match last_rtt {
                                     Some(ms) => format!("connected · {ms} ms ping"),
diff --git a/crates/benilla-app/src/debug_panel/world.rs b/crates/benilla-app/src/debug_panel/world.rs
index 3d86425d..b7d26a01 100644
--- a/crates/benilla-app/src/debug_panel/world.rs
+++ b/crates/benilla-app/src/debug_panel/world.rs
@@ -45,7 +45,7 @@ pub(super) struct WorldReadout<'w, 's> {
     skybox_weight: Res<'w, benilla_world::skybox::SkyboxWeight>,
     streamer: Res<'w, benilla_world::terrain_stream::TerrainStreamer>,
     self_guid: Res<'w, crate::net::SelfGuid>,
-    names: ResMut<'w, crate::names::NameCache>,
+    names: Res<'w, crate::names::NameCache>,
     net_commands: Res<'w, crate::net::NetCommands>,
     camera: Query<'w, 's, &'static Transform, With<benilla_world::view::WorldCamera>>,
     land: MessageWriter<'w, LandHere>,
diff --git a/crates/benilla-app/src/dev.rs b/crates/benilla-app/src/dev.rs
index f06dc6e9..b1532881 100644
--- a/crates/benilla-app/src/dev.rs
+++ b/crates/benilla-app/src/dev.rs
@@ -34,6 +34,15 @@ pub(crate) fn print_scenario_names() {
     crate::capture::print_scenario_names();
 }
 
+/// `WOW_PROBE=list` — the probe fleet's environment registry (`capture::probe_env`): every
+/// `WOW_PROBE*` variable, whether it arms the un-occludable window, and `WOW_PROBE`'s own named
+/// values — printed before any window or asset setup. Answers nothing in a player build, which
+/// has no probes.
+pub(crate) fn print_probe_vars() {
+    #[cfg(feature = "dev")]
+    crate::capture::probe_env::print();
+}
+
 /// `WOW_HOVER_LOG_REPORT=<csv>` — re-read a recorded run and print its report, no window, no game.
 /// New analysis lands on runs already captured (see `hover_log`).
 pub(crate) fn report_recorded_hover_log(_path: &str) {
@@ -105,34 +114,26 @@ impl Plugin for DevProbesPlugin {
             // Any scripted probe keeps its window un-occludable: a fully covered macOS window drops to
             // ~1 fps drawables, and every probe schedule is wall-clock — a throttled run doesn't measure
             // slowly, it runs the wrong script (see `capture::ProbeFocusPlugin`, decision 0906).
+            // Which probe variables count is the registry's `wall_clock` column
+            // (`capture::probe_env::PROBE_VARS`), not a list kept here: this list was hand-kept
+            // and had drifted to ten of the twenty-five wall-clock variables when 2265 §A5 read
+            // it against the code, so a mail or auction probe ran covered. The four below are the
+            // non-probe instruments that schedule on the wall clock too.
             // (`WOW_LIVE_FPS` is in the list because an occluded SETTLE phase streams the world at ~1 fps
             // and under-warms the scene before sampling even starts — the assertion has to be live from
             // the first tick, not at the uncap.)
-            if [
-                "WOW_PROBE",
-                "WOW_PROBE_CHAT",
-                "WOW_PROBE_HOVER",
-                "WOW_PROBE_KEY",
-                "WOW_PROBE_LUA",
-                // The swim-pitch aim is a wall-clock timeline like every other probe schedule, and
-                // it is the one script that can be a run's *only* actuator (a drifting swimmer
-                // needs no keys) — so it arms the occlusion defence on its own.
-                "WOW_PROBE_PITCH",
-                "WOW_PROBE_CHEST",
-                "WOW_PROBE_CLAM",
-                "WOW_PROBE_VENDOR_SWAP",
-                "WOW_PROBE_MODEL_CAMERA",
-                "WOW_RIG",
-                "WOW_LIVE_FPS",
-                // A screenshot burst and a pick burst are wall-clock schedules too, and on an
-                // occluded window they capture the same stale drawable over and over: a whole
-                // day of lamppost A/Bs on the Air read identical to the decimal because every
-                // frame in every burst was one frame (the halo record).
-                "WOW_LIVE_SHOT",
-                "WOW_PICK",
-            ]
-            .iter()
-            .any(|k| std::env::var(k).is_ok())
+            if crate::capture::probe_env::wall_clock_vars()
+                .chain([
+                    "WOW_RIG",
+                    "WOW_LIVE_FPS",
+                    // A screenshot burst and a pick burst are wall-clock schedules too, and on an
+                    // occluded window they capture the same stale drawable over and over: a whole
+                    // day of lamppost A/Bs on the Air read identical to the decimal because every
+                    // frame in every burst was one frame (the halo record).
+                    "WOW_LIVE_SHOT",
+                    "WOW_PICK",
+                ])
+                .any(|k| std::env::var(k).is_ok())
             {
                 app.add_plugins(crate::capture::ProbeFocusPlugin);
             }
@@ -318,6 +319,14 @@ impl Plugin for DevProbesPlugin {
             if std::env::var("WOW_PROBE_BGQUEUE").is_ok() {
                 app.add_plugins(crate::capture::ProbeBgQueuePlugin);
             }
+            // The inside-a-battleground live probe: `WOW_PROBE_BG=wsg|ab|av` walks the whole
+            // player road — level, greet, queue, take the port through the stock
+            // `AcceptBattlefieldPort` — and then censuses the battleground from inside. The
+            // interface arc (1963/1972/1974/1980) built everything up to the port button and
+            // nothing past it; this is the first instrument that looks (see `capture::ProbeBgPlugin`).
+            if std::env::var("WOW_PROBE_BG").is_ok() {
+                app.add_plugins(crate::capture::ProbeBgPlugin);
+            }
             // The mail-arc live probe: `WOW_PROBE_MAIL=1` GM-mails the probe's own character, opens the
             // Goldshire mailbox on the real wire, and drives the inbox/take/send/delete surface through
             // the live Lua VM — decisions 0544/0548's end-to-end instrument (see `capture::ProbeMailPlugin`).
@@ -386,6 +395,13 @@ impl Plugin for DevProbesPlugin {
             if std::env::var("WOW_PROBE_BOOK").is_ok() {
                 app.add_plugins(crate::capture::ProbeBookPlugin);
             }
+            // The meeting-stone live probe: `WOW_PROBE_STONE=1` parks at a real stone, clicks it
+            // on the click's own route below and inside its level band, and reads the queue back
+            // out of the live VM — decision 2283's instrument, the end-to-end answer to "can a
+            // player get into the LFG queue" (see `capture::ProbeStonePlugin`).
+            if std::env::var("WOW_PROBE_STONE").is_ok() {
+                app.add_plugins(crate::capture::ProbeStonePlugin);
+            }
             // The chest live probe: `WOW_PROBE_CHEST=1` parks at a real chest spawn, opens it on the
             // click's own route and reports the self unit's base anim id before/during/after — B84's
             // instrument, the numeric answer to "does the player kneel at a chest" (decision 1471;
diff --git a/crates/benilla-app/src/entities.rs b/crates/benilla-app/src/entities.rs
index 805c4566..bb264ee9 100644
--- a/crates/benilla-app/src/entities.rs
+++ b/crates/benilla-app/src/entities.rs
@@ -104,7 +104,7 @@ pub(crate) use collision_height::CollisionHeight;
 /// spawned under the same attach-point joints as held items, lifetime per the kit stage.
 mod missile;
 use missile::{attach_missile_models, move_missiles, spawn_missiles};
-pub(crate) use missile::{MissileMiss, MissileSound};
+pub(crate) use missile::{MissileMiss, MissileSound, PendingMissiles};
 
 /// WMO-display GameObject doodad props (the ship's sails / the zeppelin's rotor): the WMO's MODD
 /// M2s spawned as children of the streamed gameobject, so they ride a moving transport.
@@ -602,7 +602,6 @@ pub(crate) struct DisplayBuildSet;
 /// doc for why a clear is always safe mid-session). These caches are get-or-insert at every use
 /// site, so a cleared entry rebuilds on the next spawn that wants it; without this, every display
 /// id, material key, and composited skin ever seen stayed resident for the life of the process.
-#[allow(clippy::too_many_arguments)]
 fn evict_display_caches(
     mut changes: MessageReader<benilla_world::world_map::MapChange>,
     mut composites: ResMut<SkinComposites>,
@@ -1236,7 +1235,6 @@ fn setup_entities(
 /// For every display id active among the net entities: ensure its [`DisplayModel`] exists (resolve the
 /// catalog + request the model handle), and once the handle has loaded, build its spawn parts (the
 /// per-submesh material, with creature skin slots filled from the display's variations).
-#[allow(clippy::too_many_arguments)]
 fn update_display_models(
     // `ObjectStore` rides along for the corpses: which cache holds a corpse's model is a
     // descriptor question (`CORPSE_FLAG_BONES`), not a display-id one — decision 1706.
@@ -1250,6 +1248,10 @@ fn update_display_models(
     mut forms: ResMut<benilla_world::model_forms::ModelForms>,
     asset_server: Res<AssetServer>,
     mut mats: benilla_world::model_render::M2BatchMaterials,
+    // The UV lane a batch's texture transform is delivered on (decision 2295): an entity batch is
+    // seeded AND registered in one call, so a display built here can never be marked-but-frozen.
+    mut uv_reg: ResMut<benilla_world::doodad_anim::UvAnimMaterials>,
+    mut anim_table: ResMut<benilla_world::mat_anim_table::MatAnimTable>,
     // The bone-pile display cache + the ChrRaces fileStrings its paths are built from (1706).
     mut bones: ResMut<corpse::BonesModels>,
     // The glue-preview want (decisions 0423 + 0465): the glue screens' look's body displayId, so
@@ -1265,6 +1267,15 @@ fn update_display_models(
         return; // no lighting yet → no materials to build
     }
     let (m2s, wmos) = (&model_assets.0, &model_assets.1);
+    // `instance: None` — every display cache here is keyed by display id and shared by every unit
+    // wearing it, so these materials belong to the batch. The one population that needs its own
+    // (a GameObject whose file-sequence slots bake different loops) takes its clone at spawn,
+    // where the host entity exists (`attach::dress`).
+    let mut uv = benilla_world::model_render::EntityUvLane {
+        reg: &mut uv_reg,
+        table: &mut anim_table,
+        instance: None,
+    };
 
     // The (kind, display) pairs live in the world this frame — cheap to collect.
     let mut actives: Vec<(EntityKind, u32)> = entities
@@ -1357,6 +1368,7 @@ fn update_display_models(
                             &mut forms,
                             &asset_server,
                             &mut mats,
+                            &mut uv,
                             false, // gameobject: creatures — no hull collider, no bake variant
                         );
                     }
@@ -1387,6 +1399,7 @@ fn update_display_models(
                             &mut forms,
                             &asset_server,
                             &mut mats,
+                            &mut uv,
                             true, // gameobject: hull collider + the interior BAKE material variant
                         );
                     }
@@ -1412,6 +1425,7 @@ fn update_display_models(
                         &mut forms,
                         &asset_server,
                         &mut mats,
+                        &mut uv,
                         false, // gameobject: a prop body — unit lighting, no hull collider
                     );
                 }
@@ -1438,6 +1452,7 @@ fn update_display_models(
                         &mut forms,
                         &asset_server,
                         &mut mats,
+                        &mut uv,
                         false, // gameobject: held items — unit lighting, no collider
                     );
                 }
@@ -1458,6 +1473,7 @@ fn update_display_models(
                         &mut forms,
                         &asset_server,
                         &mut mats,
+                        &mut uv,
                         false, // gameobject: effects — unit lighting, no collider
                     );
                 }
@@ -1478,6 +1494,7 @@ fn update_display_models(
                         &mut forms,
                         &asset_server,
                         &mut mats,
+                        &mut uv,
                         false, // gameobject: effects — unit lighting, no collider
                     );
                 }
@@ -1678,6 +1695,11 @@ mod display_mirror_tests {
             }),
             alpha_anim: None,
             rgb_anim: None,
+            rgb_seq: None,
+            uv_anim: None,
+            uv_seq: None,
+            uv_rot_seq: None,
+            uv_scale_seq: None,
             ground_quad: None,
         }
     }
diff --git a/crates/benilla-app/src/entities/attach/char_skin.rs b/crates/benilla-app/src/entities/attach/char_skin.rs
index 3c9d5803..7f88c80d 100644
--- a/crates/benilla-app/src/entities/attach/char_skin.rs
+++ b/crates/benilla-app/src/entities/attach/char_skin.rs
@@ -281,7 +281,7 @@ fn shared_skin_probe() -> bool {
 /// available (those parts then keep their built, untextured material). A composited atlas is uploaded once per look ([`super::super::SkinComposites`] cache); a baked or hair
 /// BLP loads through the async `mpq://` pipeline (which dedups by path). `parts` supplies the hair
 /// batches' blend (hair is alpha-cut, so it can't be forced opaque like the body).
-#[allow(clippy::too_many_arguments, clippy::type_complexity)]
+#[allow(clippy::type_complexity)]
 pub(super) fn build_char_skin_materials(
     look: &CharLook,
     // The worn armor display ids (bodyslot 2–9) + the cloak's, and the ItemDisplayInfo catalog to
diff --git a/crates/benilla-app/src/entities/attach/dress.rs b/crates/benilla-app/src/entities/attach/dress.rs
index c735734c..93a7399f 100644
--- a/crates/benilla-app/src/entities/attach/dress.rs
+++ b/crates/benilla-app/src/entities/attach/dress.rs
@@ -103,6 +103,161 @@ pub(super) fn part_materials<'a>(
     }
 }
 
+/// The material store and the two animated-material registries, for the one entity population
+/// that needs a material of its **own** rather than the batch's (decision 2295).
+///
+/// Taken as one bundle, and taken by the dressing path itself rather than by a system that fixes
+/// parts up afterwards, because the cloned handles have to be in hand *before* the part's
+/// [`InteriorLit`](benilla_world::interior) and [`FadeMaterials`] are built from them — a later
+/// pass would have to reach into both and rewrite what the classifier already wrote.
+pub(super) struct OwnMats<'a> {
+    pub(super) store: &'a mut Assets<WowModelMaterial>,
+    pub(super) uv: &'a mut benilla_world::doodad_anim::UvAnimMaterials,
+    pub(super) tint: &'a mut benilla_world::doodad_anim::TintAnimMaterials,
+    pub(super) table: &'a mut benilla_world::mat_anim_table::MatAnimTable,
+}
+
+/// One part's **own** variant set — [`PartMaterials`]' owning twin, held by the spawn for as long
+/// as it takes to dress the part.
+struct OwnedMaterials {
+    steady: Handle<WowModelMaterial>,
+    interior: Option<Handle<WowModelMaterial>>,
+    fade_blend: Option<Handle<WowModelMaterial>>,
+    bake: Option<Handle<WowModelMaterial>>,
+    bake_blend: Option<Handle<WowModelMaterial>>,
+    zfill: Option<Handle<WowModelMaterial>>,
+}
+
+impl OwnedMaterials {
+    fn borrow(&self) -> PartMaterials<'_> {
+        PartMaterials {
+            steady: &self.steady,
+            interior: self.interior.as_ref(),
+            fade_blend: self.fade_blend.as_ref(),
+            bake: self.bake.as_ref(),
+            bake_blend: self.bake_blend.as_ref(),
+            zfill: self.zfill.as_ref(),
+        }
+    }
+}
+
+/// Give this part a material set of its **own**, registered against its own instance's anim host —
+/// or `None`, which is every part but a measured thirteen batches (decision 2295).
+///
+/// **Who needs one.** A batch whose file-sequence slots bake *different* UV or tint loops cannot be
+/// served by a material every instance of the model shares: the registries are keyed by material,
+/// so one row would have to answer for placements that are playing different slots. That is
+/// 1408's finding, and the entity side of it is six GameObject models — `BloodOfHeroes`'s five
+/// bubble sheets (slot 0 holds them still, slot 1 sweeps them, at freq 16384/16383, so the pools
+/// bubble independently), `Valentines_Blanket`, `G_GnomeTerminal`'s screen, and on the tint
+/// channel `G_FreezingTrap`'s glow card, `OrgrimmarPentagram` and `ScholomanceCrystalBall01`.
+/// **Four of the five tint batches bake nothing in slot 0**, so their shared material can only
+/// ever seed white however faithfully it is ticked — the hunter's trap glows flat instead of
+/// pulsing blue-white as it arms.
+///
+/// **Why it is gated on `GameObject`.** Not as a safety valve: the census is the reason. No unit,
+/// no player body, no corpse and no held item in the shipped corpus authors a per-sequence set on
+/// either channel (`benilla-extract entityuvscan`), so widening this past GameObjects would add a
+/// clone-and-register branch to the hottest spawn path in the client for an empty population. If
+/// a future model joins it, the gate is the line to move and this paragraph is why.
+fn own_per_sequence_materials(
+    part: &EntityPart,
+    dress: &PartDress<'_>,
+    own: &mut OwnMats<'_>,
+) -> Option<OwnedMaterials> {
+    let loops = part.uv_loops();
+    let (uv_seq, tint_seq) = (loops.seqs.is_some(), part.rgb_seq.is_some());
+    if dress.kind != ModelKind::GameObject || !(uv_seq || tint_seq) {
+        return None;
+    }
+    let src = part_materials(part, dress.char_mats);
+    // The shared variants may still be PARKED (`model_render::lazy` reserves a handle and holds
+    // the value until something view-visible binds it), so each is realized before it is read —
+    // the same order `spell_fx`'s clone takes, and the reason 2038's registrations all returned
+    // `None` when they skipped it.
+    let mut clone = |h: &Handle<WowModelMaterial>| -> Option<Handle<WowModelMaterial>> {
+        benilla_world::model_render::lazy::realize(own.store, h.id());
+        let mut mat = own.store.get(h.id()).cloned()?;
+        // A clone leaves the shared table (decision 1381): its rows are its own, and a carried
+        // slot would add the shared delta on top of them.
+        mat.extension.anim_slots = Vec4::ZERO;
+        Some(own.store.add(mat))
+    };
+    let owned = OwnedMaterials {
+        steady: clone(src.steady)?,
+        interior: src.interior.and_then(&mut clone),
+        fade_blend: src.fade_blend.and_then(&mut clone),
+        bake: src.bake.and_then(&mut clone),
+        bake_blend: src.bake_blend.and_then(&mut clone),
+        // The depth-prime twin is NOT cloned and NOT registered, exactly as on the placed-doodad
+        // lane: it draws only while the part feathers, and its alpha test reading unscrolled UVs
+        // for those frames is the behaviour the streamer has always had.
+        zfill: src.zfill.cloned(),
+    };
+    // Every variant the part can swap to over its life — indoors, feathering, both — takes a row,
+    // or a GameObject that walks under a roof would stop mid-scroll.
+    for id in [
+        Some(&owned.steady),
+        owned.interior.as_ref(),
+        owned.fade_blend.as_ref(),
+        owned.bake.as_ref(),
+        owned.bake_blend.as_ref(),
+    ]
+    .into_iter()
+    .flatten()
+    .map(Handle::id)
+    {
+        if uv_seq {
+            benilla_world::doodad_anim::register_entity_uv(
+                own.uv,
+                own.table,
+                own.store,
+                id,
+                &loops,
+                Some(dress.unit),
+            );
+        }
+        if let Some(seqs) = &part.rgb_seq {
+            benilla_world::doodad_anim::register_tint(
+                own.tint,
+                own.table,
+                own.store,
+                id,
+                benilla_world::doodad_anim::TintLoop::PerSeq {
+                    seqs: seqs.clone(),
+                    host: dress.unit,
+                },
+            );
+        }
+    }
+    Some(owned)
+}
+
+/// Put this part in `tick_anim_materials`' draw scan — **iff something registered a row for it**.
+///
+/// The marker and the registration have to ask ONE question, because 2038's whole bug class is the
+/// two disagreeing: a marked part with no registry entry trips the lane's own tripwire, and a
+/// registered material that no marked part accounts for freezes silently, which is how every
+/// waterfall in the game stood still for three days. So this is not a predicate over the part's
+/// channels — it is a statement about what actually happened a few lines up.
+///
+/// Two registrations can have happened. The **shared** UV lane's, made inside
+/// `entity_variants` when the batch's transform moves at all (`UvLoops::animates`, which is not
+/// `uv_anim.is_some()`: a rotate-only batch answers `None` there). And this instance's **own**
+/// clone, when it has one — which is the only way the TINT channel is ever registered on an
+/// entity, and why `owned` has to be consulted rather than the part's `rgb_seq` re-tested: the
+/// clone can decline (a full table, a dead handle), and a marker for a registration that did not
+/// happen is the first half of the bug above.
+fn mark_mat_anim(
+    child: &mut bevy::ecs::system::EntityCommands<'_>,
+    part: &EntityPart,
+    owned: &Option<OwnedMaterials>,
+) {
+    if part.uv_loops().animates() || owned.is_some() {
+        child.insert(benilla_world::doodad_anim::AnimMatPart);
+    }
+}
+
 /// Stamp a pickable part (or card) with the pick population its kind belongs to: the mouseover
 /// pickers filter by these markers instead of kind-comparing every `WorldObject` row per frame.
 /// One site for both the mesh-part and the billboard-card spawn, so the two can't drift.
@@ -183,10 +338,11 @@ pub(super) fn spawn_group(
     part: &EntityPart,
     group: &super::merge::BodyGroup,
     dress: &PartDress,
+    own: &mut OwnMats<'_>,
 ) -> bool {
     let members =
         (group.members.len() > 1).then(|| super::merge::DressedGroup(group.members.clone().into()));
-    spawn_part(commands, part, group.first() as usize, members, dress)
+    spawn_part(commands, part, group.first() as usize, members, dress, own)
 }
 
 /// Spawn one mesh part (or billboard card) of a body under `dress.unit`; `group` is the merged
@@ -197,11 +353,18 @@ pub(super) fn spawn_part(
     index: usize,
     group: Option<super::merge::DressedGroup>,
     dress: &PartDress,
+    own: &mut OwnMats<'_>,
 ) -> bool {
     if let Some(info) = &part.billboard {
-        return spawn_billboard_part(commands, part, index, info, dress);
+        return spawn_billboard_part(commands, part, index, info, dress, own);
     }
-    let mats = part_materials(part, dress.char_mats);
+    // A material of this instance's OWN, for the measured thirteen batches whose slots disagree
+    // (2295) — resolved first, because everything below dresses from whatever this returns.
+    let owned = own_per_sequence_materials(part, dress, own);
+    let mats = match &owned {
+        Some(o) => o.borrow(),
+        None => part_materials(part, dress.char_mats),
+    };
     let set = mats.fade_set();
     // A freshly-streamed CGObject appear-fades in (decision 0032): spawn already on the blend twin
     // with a ≈0 `MeshTag`, so it doesn't flash opaque for a frame before `apply_render_fade` ramps
@@ -314,6 +477,7 @@ pub(super) fn spawn_part(
             dress.unit,
         ));
     }
+    mark_mat_anim(&mut child, part, &owned);
     effective.dress(&mut child, &set)
 }
 
@@ -328,6 +492,7 @@ fn spawn_billboard_part(
     index: usize,
     info: &benilla_assets::BillboardInfo,
     dress: &PartDress,
+    own: &mut OwnMats<'_>,
 ) -> bool {
     let anchor = commands
         .spawn((
@@ -363,12 +528,15 @@ fn spawn_billboard_part(
     // (decision 0836). Splitting the batch into a world-root entity is benilla's parenting detail;
     // it is not a reason for the glow on a weapon's gems to blaze at full strength over a body that
     // has not appeared yet.
-    let set = FadeSet {
-        steady: &part.material,
-        blend: part.fade_blend.as_ref(),
-        bake_blend: part.material_interior_bake_blend.as_ref(),
-        zfill: part.zfill.as_ref(),
+    // A card may need a material of its own for exactly the same reason a mesh part does — and
+    // on this population it is the card that needs it: `World\Goober\G_FreezingTrap`'s animated
+    // batch IS the additive glow card, whose blue-white pulse is keyed in file slot 2 alone.
+    let owned = own_per_sequence_materials(part, dress, own);
+    let mats = match &owned {
+        Some(o) => o.borrow(),
+        None => part_materials(part, dress.char_mats),
     };
+    let set = mats.fade_set();
     let effective = PartFade::resolve(dress.fade, &set);
     let (init_mat, tag_alpha) = effective.seed(&set, dress.now);
     let mut card = commands.spawn((
@@ -401,9 +569,9 @@ fn spawn_billboard_part(
         card.insert(aabb);
     }
     if let Some(lit) = part_interior_lit(
-        &part.material,
-        part.material_interior.as_ref(),
-        part.material_interior_bake.as_ref(),
+        mats.steady,
+        mats.interior,
+        mats.bake,
         dress.bake_center,
         dress.unit,
     ) {
@@ -417,6 +585,11 @@ fn spawn_billboard_part(
             dress.unit,
         ));
     }
+    // …and its batch's material animation, on the same rule as a mesh part (2295). A card is a
+    // batch of the unit's own model; the split into a world-root entity is benilla's parenting
+    // detail, never a reason for one batch of a model to animate and its sibling not to — and on
+    // this population it is the card that carries it.
+    mark_mat_anim(&mut card, part, &owned);
     let armed = effective.dress(&mut card, &set);
     let card = card.id();
     // The card follows the JOINT when the unit is rigged, so it does not cascade with the anchor's
@@ -431,6 +604,28 @@ fn spawn_billboard_part(
 #[cfg(test)]
 mod tests {
     use super::*;
+
+    /// A standalone [`OwnMats`] for the spawn tests — none of them dresses a GameObject, so the
+    /// lane is never taken; it exists so the spawn's signature can stay non-optional, which is
+    /// what stops a production caller passing `None` and silently losing the clone.
+    #[derive(Default)]
+    struct TestOwn {
+        store: Assets<WowModelMaterial>,
+        uv: benilla_world::doodad_anim::UvAnimMaterials,
+        tint: benilla_world::doodad_anim::TintAnimMaterials,
+        table: benilla_world::mat_anim_table::MatAnimTable,
+    }
+
+    impl TestOwn {
+        fn lane(&mut self) -> OwnMats<'_> {
+            OwnMats {
+                store: &mut self.store,
+                uv: &mut self.uv,
+                tint: &mut self.tint,
+                table: &mut self.table,
+            }
+        }
+    }
     use benilla_world::model_fade::{FadeMaterials, PendingAppearFade};
 
     /// One synthetic batch at `char_slot`/`two_sided`, carrying its own (distinguishable) built
@@ -456,6 +651,11 @@ mod tests {
             billboard: None,
             alpha_anim: None,
             rgb_anim: None,
+            rgb_seq: None,
+            uv_anim: None,
+            uv_seq: None,
+            uv_rot_seq: None,
+            uv_scale_seq: None,
             ground_quad: None,
         }
     }
@@ -546,11 +746,12 @@ mod tests {
             now: 0.0,
             fade: JoinedFade::Steady,
         };
+        let mut own = TestOwn::default();
         let mut queue = bevy::ecs::world::CommandQueue::default();
         let armed = {
             let world = app.world();
             let mut commands = Commands::new(&mut queue, world);
-            spawn_part(&mut commands, &fadeable, 0, None, &dress)
+            spawn_part(&mut commands, &fadeable, 0, None, &dress, &mut own.lane())
         };
         queue.apply(app.world_mut());
         assert!(!armed, "steady: no ramp armed");
@@ -610,11 +811,12 @@ mod tests {
             now: 0.0,
             fade: JoinedFade::Pending { since: SINCE },
         };
+        let mut own = TestOwn::default();
         let mut queue = bevy::ecs::world::CommandQueue::default();
         let armed = {
             let world = app.world();
             let mut commands = Commands::new(&mut queue, world);
-            spawn_part(&mut commands, &card, 0, None, &dress)
+            spawn_part(&mut commands, &card, 0, None, &dress, &mut own.lane())
         };
         queue.apply(app.world_mut());
         assert!(
@@ -686,12 +888,20 @@ mod tests {
                 now: 0.0,
                 fade: JoinedFade::Steady,
             };
+            let mut own = TestOwn::default();
             let mut queue = bevy::ecs::world::CommandQueue::default();
             {
                 let world = app.world();
                 let mut commands = Commands::new(&mut queue, world);
-                spawn_part(&mut commands, &part(None, false), 0, None, &dress);
-                spawn_part(&mut commands, &billboard, 1, None, &dress);
+                spawn_part(
+                    &mut commands,
+                    &part(None, false),
+                    0,
+                    None,
+                    &dress,
+                    &mut own.lane(),
+                );
+                spawn_part(&mut commands, &billboard, 1, None, &dress, &mut own.lane());
             }
             queue.apply(app.world_mut());
             let world = app.world_mut();
diff --git a/crates/benilla-app/src/entities/attach/merge.rs b/crates/benilla-app/src/entities/attach/merge.rs
index ca326ceb..9f9a3649 100644
--- a/crates/benilla-app/src/entities/attach/merge.rs
+++ b/crates/benilla-app/src/entities/attach/merge.rs
@@ -364,6 +364,11 @@ mod tests {
             welded_billboard: false,
             alpha_anim: None,
             rgb_anim: None,
+            rgb_seq: None,
+            uv_anim: None,
+            uv_seq: None,
+            uv_rot_seq: None,
+            uv_scale_seq: None,
             ground_quad: None,
         }
     }
diff --git a/crates/benilla-app/src/entities/attach/mod.rs b/crates/benilla-app/src/entities/attach/mod.rs
index 4087b0c1..29898d73 100644
--- a/crates/benilla-app/src/entities/attach/mod.rs
+++ b/crates/benilla-app/src/entities/attach/mod.rs
@@ -294,7 +294,7 @@ struct RigBuild {
 /// / player body) as submesh children, or a colored cube fallback. The entity's pose is owned by the
 /// net bridge — or, for our own avatar, the player controller — we only add the geometry (and bake
 /// per-display scale onto the root). Our own avatar is the same streamed entity and renders here too.
-#[allow(clippy::type_complexity, clippy::too_many_arguments)]
+#[allow(clippy::type_complexity)]
 pub(super) fn attach_entity_visuals(
     mut commands: Commands,
     pending: Query<
@@ -348,6 +348,14 @@ pub(super) fn attach_entity_visuals(
         // The merged-group forms (`merge`): built on a body's first silhouette, shared after.
         ResMut<Assets<Mesh>>,
         ResMut<merge::MergedFormsCache>,
+        // …and the animated-material lane a spawned part may need a material of its OWN on
+        // (decision 2295) — a GameObject whose file-sequence slots bake different UV or tint
+        // loops. Taken by the dressing path itself, because the clone has to exist before the
+        // part's interior and fade records are built from it; nested here for this tuple's own
+        // stated reason, the 16-param limit.
+        ResMut<benilla_world::doodad_anim::UvAnimMaterials>,
+        ResMut<benilla_world::doodad_anim::TintAnimMaterials>,
+        ResMut<benilla_world::mat_anim_table::MatAnimTable>,
     ),
     // The owned skin-palette table (decision 0720): every skinned instance claims a rig slot.
     mut palettes: ResMut<benilla_world::rig_palette::RigPalettes>,
@@ -365,6 +373,9 @@ pub(super) fn attach_entity_visuals(
         mut mats,
         mut meshes,
         mut merged,
+        mut uv_reg,
+        mut tint_reg,
+        mut anim_table,
     ) = skin_build;
     // Arm each entity's appear-fade at the moment its visual attaches (≈ its first-visible moment).
     let now = time.elapsed_secs();
@@ -870,7 +881,18 @@ pub(super) fn attach_entity_visuals(
             for group in &groups {
                 let forms = merged.forms(parts, group, &mut meshes);
                 let part = merge::group_part(parts, group, forms);
-                unit_will_fade |= spawn_group(&mut commands, &part, group, &dress);
+                unit_will_fade |= spawn_group(
+                    &mut commands,
+                    &part,
+                    group,
+                    &dress,
+                    &mut dress::OwnMats {
+                        store: mats.materials(),
+                        uv: &mut uv_reg,
+                        tint: &mut tint_reg,
+                        table: &mut anim_table,
+                    },
+                );
             }
             // Mirror the appear-fade clock onto the unit root (see `unit_will_fade` above): a held item
             // / helm / shoulder attaching later reads this to join the same ramp
diff --git a/crates/benilla-app/src/entities/attach/preview.rs b/crates/benilla-app/src/entities/attach/preview.rs
index b8b60702..f7f1e4fe 100644
--- a/crates/benilla-app/src/entities/attach/preview.rs
+++ b/crates/benilla-app/src/entities/attach/preview.rs
@@ -159,7 +159,6 @@ pub(in crate::entities) struct PreviewCtx<'a, 'w> {
 /// entity-visuals chain (after `update_display_models` has built the body model from the
 /// want-list), so a fresh look's models are ready within a frame or two; until then it leaves the
 /// bake untouched and retries. A bare yaw change never reaches here (the booth handles it).
-#[allow(clippy::too_many_arguments)]
 pub(in crate::entities) fn build_glue_preview(
     preview: Res<GluePreview>,
     mut bake: ResMut<GluePreviewBake>,
@@ -351,7 +350,6 @@ pub(in crate::entities) fn build_glue_preview(
 /// plus the tried-on substitutions. The body display is the player's own, so it is already built
 /// (they are standing in the world); an ITEM model still has to load, which is what the retry latch
 /// is for.
-#[allow(clippy::too_many_arguments)]
 pub(in crate::entities) fn build_dressup_preview(
     preview: Res<DressUpPreview>,
     mut bake: ResMut<DressUpBake>,
diff --git a/crates/benilla-app/src/entities/attach/redress.rs b/crates/benilla-app/src/entities/attach/redress.rs
index fdd66bd9..664127df 100644
--- a/crates/benilla-app/src/entities/attach/redress.rs
+++ b/crates/benilla-app/src/entities/attach/redress.rs
@@ -68,7 +68,7 @@ type PartWrites<'a> = (
 /// creature's look never changes this way, and a character-model NPC wears its display's columns —
 /// a *display* change is a different model and stays a teardown
 /// ([`super::super::live_display::refresh_live_display`]).
-#[allow(clippy::type_complexity, clippy::too_many_arguments)]
+#[allow(clippy::type_complexity)]
 pub(in crate::entities) fn redress_player_looks(
     mut commands: Commands,
     mut players: Query<
@@ -115,6 +115,15 @@ pub(in crate::entities) fn redress_player_looks(
         ResMut<Assets<Mesh>>,
         ResMut<MergedFormsCache>,
     ),
+    // The animated-material lane a re-dressed part may need a material of its own on (2295).
+    // Plumbing here rather than a live case: a re-dress is a PLAYER's gear change, and no
+    // character batch in the corpus carries a per-sequence loop — but the dressing law is one law,
+    // and a path that could not express it would be a place for the two to drift.
+    mut own_lane: (
+        ResMut<benilla_world::doodad_anim::UvAnimMaterials>,
+        ResMut<benilla_world::doodad_anim::TintAnimMaterials>,
+        ResMut<benilla_world::mat_anim_table::MatAnimTable>,
+    ),
     time: Res<Time>,
 ) {
     let (
@@ -288,7 +297,18 @@ pub(in crate::entities) fn redress_player_looks(
             }
             let forms = merged.forms(parts, group, &mut meshes);
             let part = merge::group_part(parts, group, forms);
-            spawn_group(&mut commands, &part, group, &dress);
+            spawn_group(
+                &mut commands,
+                &part,
+                group,
+                &dress,
+                &mut super::dress::OwnMats {
+                    store: mats.materials(),
+                    uv: &mut own_lane.0,
+                    tint: &mut own_lane.1,
+                    table: &mut own_lane.2,
+                },
+            );
             shown += 1;
         }
         // One line per re-dress — a handful per session, and the only readout of a mechanism whose
@@ -398,6 +418,11 @@ mod tests {
             billboard: None,
             alpha_anim: None,
             rgb_anim: None,
+            rgb_seq: None,
+            uv_anim: None,
+            uv_seq: None,
+            uv_rot_seq: None,
+            uv_scale_seq: None,
             ground_quad: None,
         }
     }
@@ -425,7 +450,12 @@ mod tests {
             .init_resource::<MergedFormsCache>()
             // The engine's material cache — normally `model_render::plugin`'s, which this bare
             // harness does not install.
-            .init_resource::<benilla_world::model_render::ModelMaterials>();
+            .init_resource::<benilla_world::model_render::ModelMaterials>()
+            // The animated-material lane the dressing path now takes (2295) — never exercised by
+            // a re-dress, which is a player's gear change, but the system asks for it.
+            .init_resource::<benilla_world::doodad_anim::UvAnimMaterials>()
+            .init_resource::<benilla_world::doodad_anim::TintAnimMaterials>()
+            .init_resource::<benilla_world::mat_anim_table::MatAnimTable>();
 
         let mut dm = empty_display();
         dm.parts = Some(geosets.iter().map(|g| part(*g)).collect());
diff --git a/crates/benilla-app/src/entities/chain_beam.rs b/crates/benilla-app/src/entities/chain_beam.rs
index 288855ad..08bc9462 100644
--- a/crates/benilla-app/src/entities/chain_beam.rs
+++ b/crates/benilla-app/src/entities/chain_beam.rs
@@ -240,7 +240,6 @@ fn select_targets(
 /// reapable: the reference only ever publishes a flagged node to the owner slots that the channel
 /// teardown sweeps (`0x6ecdaa` gates the AddRef on the flag), so a one-shot beam always runs its own
 /// clock to the end.
-#[allow(clippy::too_many_arguments)]
 pub(super) fn spawn_chain_beams(
     mut commands: Commands,
     time: Res<Time>,
@@ -463,7 +462,6 @@ fn push_strand(
 /// Per frame: age the beam, re-resolve every hop's live endpoints, re-jitter and advect its
 /// polyline, and write the ribbons into the shared effect-quad stream — the reference's
 /// `LightningObject::Update` (`0x6ec460`) and `CLightning::Render` (`0x7afcb0`) in one pass.
-#[allow(clippy::too_many_arguments)]
 pub(crate) fn simulate_chain_beams(
     time: Res<Time>,
     mut commands: Commands,
diff --git a/crates/benilla-app/src/entities/conform.rs b/crates/benilla-app/src/entities/conform.rs
index 134d06fe..abaf1f44 100644
--- a/crates/benilla-app/src/entities/conform.rs
+++ b/crates/benilla-app/src/entities/conform.rs
@@ -94,7 +94,7 @@ fn conform_rotation(mode: u8, n_local: Vec3) -> Quat {
 /// spawn seats instantly like the reference; and a parked rig (off-frustum, the 0448 anim-LOD
 /// gate) skips its ray and drops its vector, re-seeding warm on wake — the 0448 absolute-snap
 /// philosophy applied to the stance, bounding the cost at one ray per flagged unit ON SCREEN.
-#[allow(clippy::too_many_arguments, clippy::type_complexity)] // one Bevy system's full input set
+#[allow(clippy::type_complexity)] // one Bevy system's full input set
 pub(super) fn conform_units(
     time: Res<Time>,
     spatial: SpatialQuery,
diff --git a/crates/benilla-app/src/entities/dest_fx.rs b/crates/benilla-app/src/entities/dest_fx.rs
index 06bd9400..4051a0a2 100644
--- a/crates/benilla-app/src/entities/dest_fx.rs
+++ b/crates/benilla-app/src/entities/dest_fx.rs
@@ -42,7 +42,7 @@ use crate::creature_anim::{SpellKitSound, SpellVisuals};
 use crate::net::{NetEntity, ObjectStore};
 use benilla_protocol::EntityKind;
 
-use super::spell_fx::{attach_effect_visuals, ensure_model, SpellFx};
+use super::spell_fx::{attach_effect_visuals, ensure_model, FxMaterials, SpellFx};
 
 /// The client's hardcoded shard-model table (`0x870e24`, 7 entries — wow-re
 /// `dynobject-visual-machine.md` Q-A1). `CharParamZero`'s decoded small int indexes it.
@@ -267,7 +267,6 @@ pub(super) fn tick_shard_emitters(
 /// Attach model parts to pending instances whose M2 finished building (the missile pattern —
 /// free world models, ground-anchored so authored flat quads decal to the terrain), start the
 /// one-shot clocks, and run both reapers (one-shot expiry; the loop-repeat override).
-#[allow(clippy::too_many_arguments)] // one Bevy system's full input set
 pub(super) fn attach_ground_fx_models(
     mut commands: Commands,
     time: Res<Time>,
@@ -276,6 +275,8 @@ pub(super) fn attach_ground_fx_models(
     asset_server: Res<AssetServer>,
     mut wow_materials: ResMut<Assets<benilla_assets::materials::WowModelMaterial>>,
     mut tint_reg: ResMut<super::spell_fx::FxTintAnims>,
+    mut uv_reg: ResMut<benilla_world::doodad_anim::UvAnimMaterials>,
+    mut anim_table: ResMut<benilla_world::mat_anim_table::MatAnimTable>,
     ibps: Res<Assets<bevy::mesh::skinning::SkinnedMeshInverseBindposes>>,
     mut palettes: ResMut<benilla_world::rig_palette::RigPalettes>,
 ) {
@@ -299,8 +300,12 @@ pub(super) fn attach_ground_fx_models(
                 // The dest one-shot is not a `CEffect` on a unit: it plants at the packet's point and
                 // runs its own span clock, so it keeps the plain single-clip arm.
                 None,
-                &mut wow_materials,
-                &mut tint_reg,
+                &mut FxMaterials {
+                    store: &mut wow_materials,
+                    tint: &mut tint_reg,
+                    uv: &mut uv_reg,
+                    table: &mut anim_table,
+                },
                 &ibps,
                 &mut palettes,
                 None,
diff --git a/crates/benilla-app/src/entities/display.rs b/crates/benilla-app/src/entities/display.rs
index fc567cba..dd39efca 100644
--- a/crates/benilla-app/src/entities/display.rs
+++ b/crates/benilla-app/src/entities/display.rs
@@ -127,6 +127,30 @@ pub(super) struct EntityPart {
     /// the **first key** seeded as the material tint (pixel-identical to the old static bake);
     /// the effect lane clones + ticks the tint per instance. `None` for constant tints.
     pub(super) rgb_anim: Option<std::sync::Arc<benilla_formats::RgbAnim>>,
+    /// The per-file-sequence-slot form of [`Self::rgb_anim`], carried only where the slots
+    /// disagree (decision 1408) — [`Self::uv_seq`]'s twin, and the reason a GameObject may need a
+    /// material of its own. Five batches on three GameObject models author one, and **four of
+    /// them bake nothing in slot 0**, so `rgb_anim` is `None` for them and a shared material can
+    /// only ever seed white: the hunter's Freezing Trap glow card is the class (decision 2295).
+    pub(super) rgb_seq: Option<std::sync::Arc<benilla_formats::SeqLoops<[f32; 3]>>>,
+    /// The part's **texture-transform (UV) loop** — the translation track that scrolls this
+    /// batch's stage UVs (decision 0130 phase 3, wow-re `m2-texanim-uv`). The **effect lane**
+    /// ([`super::spell_fx`]) samples it per instance on its own clip clock, through a material
+    /// clone (decision 2282); the unit/GameObject lane runs it on the shared, deduped material
+    /// (decision 2295). `None` for the ~98.6% of batches with no texture transform, and for all
+    /// WMO parts.
+    pub(super) uv_anim: Option<std::sync::Arc<benilla_formats::UvAnim>>,
+    /// The per-file-sequence-slot form of [`Self::uv_anim`], carried only where the slots
+    /// disagree (decision 1408) — an effect that advances `Stand` → `Hold` → `Decay` reads the
+    /// slot it is actually playing. `None` for every batch whose slots agree.
+    pub(super) uv_seq: Option<std::sync::Arc<benilla_formats::SeqLoops<[f32; 2]>>>,
+    /// The texture transform's **rotation** loop per file sequence slot (decision 2019) and its
+    /// scaling twin. Three effect models in the whole 1.12 corpus author them — Shield Wall's
+    /// halo turns *and* scales, Grounding Totem's glow is a scale-only transform — which is
+    /// precisely why the effect lane has to read them from the asset rather than from memory
+    /// (`benilla-extract fxuvscan`). `None` everywhere else.
+    pub(super) uv_rot_seq: Option<std::sync::Arc<benilla_formats::SeqLoops<[f32; 4]>>>,
+    pub(super) uv_scale_seq: Option<std::sync::Arc<benilla_formats::SeqLoops<[f32; 2]>>>,
     /// The part's flat **ground-plane quad** shape (detected at M2 load — see
     /// [`benilla_formats::GroundQuad`]). On a base-anchored spell effect the fx attach renders it
     /// as a projected surface decal ([`crate::ground_fx`]) instead of free geometry, so it drapes
@@ -134,6 +158,23 @@ pub(super) struct EntityPart {
     pub(super) ground_quad: Option<benilla_formats::GroundQuad>,
 }
 
+impl EntityPart {
+    /// This part's four baked texture-transform channels, in the shape the engine's lanes take
+    /// them — **the one place a spawner reads them**, so "does this batch animate its transform"
+    /// has a single answer wherever it is asked (the effect attach's clone test, the entity
+    /// spawn's [`benilla_world::doodad_anim::AnimMatPart`] marker). `UvLoops::animates` is that
+    /// question: a scale-only transform and a dead-slot-0 translation each answer `None` to the
+    /// channel you would check first.
+    pub(super) fn uv_loops(&self) -> benilla_world::doodad_anim::UvLoops {
+        benilla_world::doodad_anim::UvLoops {
+            seqs: self.uv_seq.clone(),
+            single: self.uv_anim.clone(),
+            rot: self.uv_rot_seq.clone(),
+            scale: self.uv_scale_seq.clone(),
+        }
+    }
+}
+
 /// Everything needed to render one display id, cached so a model is loaded + built once and shared by
 /// every entity of that display. `parts` is `None` while the asset loads, then `Some` — empty if the
 /// model failed / has no geometry (→ cube/none fallback), else the spawn parts.
@@ -375,7 +416,6 @@ pub(super) fn empty_display() -> DisplayModel {
 /// Build a display model's spawn parts once its asset has loaded — each submesh's `WowModelMaterial`,
 /// with a creature skin slot filled from the display's variation (`<dir>\<name>.blp`). Returns early
 /// (leaving `parts` `None`) while the asset is still loading.
-#[allow(clippy::too_many_arguments)]
 pub(super) fn build_parts(
     dm: &mut DisplayModel,
     m2s: &Assets<M2Model>,
@@ -386,6 +426,10 @@ pub(super) fn build_parts(
     forms: &mut benilla_world::model_forms::ModelForms,
     asset_server: &AssetServer,
     mats: &mut benilla_world::model_render::M2BatchMaterials,
+    // Where this display's animated texture transforms are delivered (decision 2295) — taken
+    // rather than reached for, because building an entity batch's material and putting it on the
+    // lane are one act.
+    uv: &mut benilla_world::model_render::EntityUvLane<'_>,
     // Whether this display is a GAMEOBJECT: gates the hull-collider build (chests/veins/doors;
     // creatures use unit collision).
     gameobject: bool,
@@ -511,7 +555,7 @@ pub(super) fn build_parts(
                     // the law that decides which of them collapse onto each other (decisions 0842
                     // / 0865 / 0831 / 0355). `None` cannot happen here: the caller gated on the
                     // light buffer before the first build.
-                    let v = mats.entity_variants(sub, texture, order);
+                    let v = mats.entity_variants(sub, texture, order, uv);
                     let v = v.expect("light buffer checked at entry");
                     EntityPart {
                         // Index-parallel with the submeshes by the forms contract; a miss is a
@@ -538,6 +582,11 @@ pub(super) fn build_parts(
                         welded_billboard: sub.geometry.welded_billboard,
                         alpha_anim: sub.alpha_anim.clone(),
                         rgb_anim: sub.rgb_anim.clone(),
+                        rgb_seq: sub.rgb_seq.clone(),
+                        uv_anim: sub.uv_anim.clone(),
+                        uv_seq: sub.uv_seq.clone(),
+                        uv_rot_seq: sub.uv_rot_seq.clone(),
+                        uv_scale_seq: sub.uv_scale_seq.clone(),
                         ground_quad: sub.ground_quad,
                     }
                 })
@@ -588,6 +637,11 @@ pub(super) fn build_parts(
                     welded_billboard: false, // …so nothing can be welded to one
                     alpha_anim: None,        // …nor colour/weight loops
                     rgb_anim: None,
+                    rgb_seq: None,
+                    uv_anim: None, // …nor texture transforms (WMO has none)
+                    uv_seq: None,
+                    uv_rot_seq: None,
+                    uv_scale_seq: None,
                     ground_quad: None, // the fx decal lane is M2-only
                 })
                 .collect()
diff --git a/crates/benilla-app/src/entities/equipment/resolve.rs b/crates/benilla-app/src/entities/equipment/resolve.rs
index af23e1f5..236d00ae 100644
--- a/crates/benilla-app/src/entities/equipment/resolve.rs
+++ b/crates/benilla-app/src/entities/equipment/resolve.rs
@@ -172,7 +172,7 @@ pub(crate) struct DressKey {
 /// descriptor changed, its key changed, or a global input moved — the [`Items`] epochs (an
 /// object ingest covers the quiver bag walk, a landed template answers every pending ask) and
 /// the two client-data load edges. The idle crowd costs one tick check and one small compare.
-#[allow(clippy::type_complexity, clippy::too_many_arguments)]
+#[allow(clippy::type_complexity)]
 pub(in crate::entities) fn resolve_equipment(
     mut commands: Commands,
     units: Query<(
@@ -192,7 +192,7 @@ pub(in crate::entities) fn resolve_equipment(
         Has<crate::net::SelfPlayer>,
     )>,
     held: Option<ResMut<ItemDisplays>>,
-    mut templates: ResMut<Items>,
+    templates: Res<Items>,
     net: Res<NetCommands>,
     asset_server: Res<AssetServer>,
     // The creature display cache — a character-model NPC's helm/shoulder ids + race/sex live on its
@@ -638,7 +638,7 @@ pub(in crate::entities) fn resolve_equipment(
             EntityKind::Player if char_component => {
                 let race = s.unit_race().unwrap_or(1);
                 let sex = s.unit_gender().unwrap_or(0).min(1);
-                let mut resolve = |slot: u8| {
+                let resolve = |slot: u8| {
                     s.player_visible_item_entry(slot)
                         .filter(|e| *e != 0)
                         .and_then(|entry| templates.held(entry, &net))
diff --git a/crates/benilla-app/src/entities/equipment/spawn.rs b/crates/benilla-app/src/entities/equipment/spawn.rs
index ec92e2c9..acf79447 100644
--- a/crates/benilla-app/src/entities/equipment/spawn.rs
+++ b/crates/benilla-app/src/entities/equipment/spawn.rs
@@ -352,8 +352,9 @@ fn spawn_slot(
         if let Some([top, bottom]) = dm.string_anchors {
             commands.entity(root).insert(crate::bowstring::Bowstring {
                 owner: entity,
-                top: top.1,
-                bottom: bottom.1,
+                // Bone AND offset: the prop flexes, so the tips move (decision 2281).
+                top,
+                bottom,
             });
         }
     }
@@ -382,6 +383,23 @@ fn spawn_slot(
                 .insert(crate::fishing_line::FishingPoleTip { owner: entity, tip });
         }
     }
+    // **The RANGED PROP's own animation** (decision 2281) — benilla's `[CGUnit+0xd24]`. The
+    // reference keeps the equipped ranged weapon's M2 *instance* and re-arms its animation from the
+    // body's `$BWP`/`$BWR` keyframes: BowPull(160) on the pull, and on the release either Stand(0)
+    // (a bow's limbs relax) or **BowRelease(161)** — which on a firearm is the muzzle blast, seven
+    // particle emitters keyed to zero in Stand and to a 0.2 s burst in 161. See
+    // [`crate::ranged_flex`] for the byte law and the corpus measurement.
+    //
+    // So this one held model is NOT the lane's "rests at bind pose" case, and it earns the three
+    // things a resting attach model is denied: a pose buffer, a player, and bone ANCHORS for its
+    // emitters (bone 2 of every firearm is keyed +90° in 161 — that rotation is what aims the blast
+    // down the barrel). The gate is the asset: 46 of the 571 shipped weapon models author 160 or
+    // 161, all of them bows, crossbows and firearms, and nothing else in the corpus does.
+    let flexes = slot_idx == 2
+        && !dm.skeleton.joints.is_empty()
+        && dm.animations.as_ref().is_some_and(|a| {
+            a.owns(crate::ranged_flex::BOW_PULL) || a.owns(crate::ranged_flex::BOW_RELEASE)
+        });
     // **The item rig** (decisions 0841, withdrawn by 0847, RESTORED by 0854) — the one case an
     // attach model runs a joint palette. 0847 pulled it believing a spherical billboard swept the
     // spikes through the plate; that was wrong (0853: the spikes run ALONG their bone, worst vertex
@@ -454,7 +472,14 @@ fn spawn_slot(
             benilla_world::rig_palette::RigSkin::allocate_bones(
                 palettes,
                 dm.skeleton.joints.len() as u32,
-                Handle::default(),
+                // A resting rider needs no inverse bindposes — at bind pose every row collapses to
+                // the placement and 1609's write never consults them. A FLEXING prop's rows are
+                // `F × model[b] × ibp[b]`, so its slot carries the real handle.
+                if flexes {
+                    dm.inverse_bindposes.clone().unwrap_or_default()
+                } else {
+                    Handle::default()
+                },
             )
         })
         .flatten()
@@ -472,6 +497,34 @@ fn spawn_slot(
             slot
         }),
     };
+    // The flexing prop's own pose buffer and clock (see `flexes` above). The collapsed lane
+    // ([`benilla_world::rig_anim::RigPose`] — no joint entities; bone anchors are minted on demand
+    // by the emitter loop below), armed on the model-load bootstrap the reference gives every M2
+    // instance: animation id 0 through the model's own `playableAnimationLookup`. From there
+    // [`crate::ranged_flex`] re-arms it per keyframe.
+    //
+    // Its palette rows stay the RIDER lane's — `RigRider` is still on this root, and 2281 taught
+    // that lane to compose a pose rather than repeat one frame. That is deliberate: composing this
+    // prop from its own absolute `GlobalTransform` instead would hand the bow back the 0.98 mm
+    // one-ULP staircase 1609 exists to have removed (the attach point is a ~1 yd quantity summed
+    // onto a ~9500 yd one, recomputed every frame).
+    let mut prop_pose = (flexes && rider.is_some()).then(|| {
+        let anims = dm.animations.as_ref().expect("flexes ⇒ animations");
+        let mut player = AnimationPlayer::default();
+        if let Some(idle) = anims.idle_clip() {
+            let active = player.play(idle.node);
+            if idle.looping {
+                active.repeat();
+            }
+        }
+        commands.entity(root).insert((
+            player,
+            AnimationGraphHandle(anims.graph.clone()),
+            anims.clone(),
+            crate::ranged_flex::RangedProp { owner: entity },
+        ));
+        benilla_world::rig_anim::RigPose::new(root, &dm.skeleton)
+    });
     // The instance slot every part below carries in its `MeshTag`. The WEARER's only when the item
     // has no palette slot of its own — that is what puts a tinted body's colour on a boneless
     // helm (decision 0812). An item WITH a slot must carry its own, because the vertex stage
@@ -583,7 +636,22 @@ fn spawn_slot(
             // strength — the Hungering Cold's five glow cards blaze at 1.0 where the file says
             // 0.30 (decision 0836).
             if let Some(anim) = &part.alpha_anim {
-                child.insert(benilla_world::doodad_anim::MatAnim::resting(anim.clone()));
+                // `resting` is the attach model's pinned read — right for every held item but the
+                // one that plays sequences (decision 2281): a flexing prop's per-sequence alpha
+                // loops follow its own player, like a creature's do.
+                child.insert(if flexes {
+                    benilla_world::doodad_anim::MatAnim::following(anim.clone(), root)
+                } else {
+                    benilla_world::doodad_anim::MatAnim::resting(anim.clone())
+                });
+            }
+            // …and the batch's texture transform (decision 2295), on the same one predicate every
+            // other entity spawn asks. One held-item batch in the whole 1.12 corpus animates one —
+            // `Item\ObjectComponents\Shield\shield_epic_a_01`, the Drillborer Disk, whose
+            // Ragnaros-skinned lava is a 6.7 s global-sequence scroll — which is exactly why the
+            // marker is a property of the batch here and not of a list somebody maintains.
+            if part.uv_loops().animates() {
+                child.insert(benilla_world::doodad_anim::AnimMatPart);
             }
             effective.dress(&mut child, &set);
         }
@@ -656,6 +724,9 @@ fn spawn_slot(
         if let Some(anim) = &part.alpha_anim {
             card.insert(benilla_world::doodad_anim::MatAnim::resting(anim.clone()));
         }
+        if part.uv_loops().animates() {
+            card.insert(benilla_world::doodad_anim::AnimMatPart);
+        }
         effective.dress(&mut card, &set);
     }
     // The item's own particle emitters — the held torch's flame (0130 phase 4: the same
@@ -698,6 +769,19 @@ fn spawn_slot(
         // frame is realized as a mesh-less billboard card the emitter OWNS-follows
         // (`BillboardCard::frame_following`). Nothing else in the chain is live: of the
         // 95 item models whose emitters ride a billboard bone, none animates its chain.
+        //
+        // …and ONE exception to *that*: a **flexing ranged prop** (decision 2281) does have a rig,
+        // so its emitter rides its BONE's anchor. The firearm muzzle bank hangs off bone 2, which
+        // BowRelease(161) keys a constant +90° about Y against Stand's 0° — on the root frame the
+        // blast sprays out of the receiver, on the bone it goes down the barrel. `bone_pivot`
+        // rebases the authored model-space origin into that bone's frame, exactly as the doodad and
+        // widget lanes do. A billboard chain still wins the fork above: it is camera-replaced, and
+        // no flexing model in the corpus has one.
+        let posed = prop_pose
+            .as_mut()
+            .filter(|_| em.billboard.is_none())
+            .and_then(|p| p.anchor_for(commands, root, em.def.bone))
+            .map(|anchor| (anchor, em.bone_pivot));
         let owner = match em.billboard {
             Some(benilla_assets::EmitterBillboard { kind, pivot, .. }) => {
                 let frame = commands
@@ -725,7 +809,7 @@ fn spawn_slot(
             em,
             spawn_tf,
             benilla_world::particles::EmitterFrames {
-                owner: Some(owner),
+                owner: Some(posed.unwrap_or(owner)),
                 // A held item is an attached model — the flame fans with the swing.
                 // The cloud anchors at the MODEL; the bone composes births only.
                 anchor: Some(root),
@@ -745,9 +829,16 @@ fn spawn_slot(
                 // batches already classify under (`BodyBakeCenter`).
                 light_node: Some(entity),
             },
-            // A held item spawns no rig; its emitters run the item model's own slot-0
-            // loop on the spawn clock (the torch burns always — the doodad law).
-            benilla_world::particles::EmitClock::Pinned,
+            // A held item spawns no rig; its emitters run the item model's own **loader-idle**
+            // slot on the spawn clock (the torch burns always — the doodad law). A flexing ranged
+            // prop does have a player, and its rate/gate tracks read the sequence it is actually
+            // on: the gun's blast is keyed to zero in Stand and to a 0.2 s burst in BowRelease,
+            // so a pinned clock would emit nothing on it for ever (decision 2281).
+            if flexes {
+                benilla_world::particles::EmitClock::Host(root)
+            } else {
+                benilla_world::particles::EmitClock::Pinned
+            },
         );
     }
     // The item's own M2 point light — **the held torch's glow** (decision 0016's law on the
@@ -782,6 +873,16 @@ fn spawn_slot(
             None,
         );
     }
+    // Last, so every `anchor_for` above is already registered in it.
+    if let Some(pose) = prop_pose {
+        debug!(
+            "ranged flex: unit {entity} display {} → prop clock ({} bones, {} anchors)",
+            hs.display,
+            pose.locals.len(),
+            pose.anchors.len()
+        );
+        commands.entity(root).insert(pose);
+    }
     debug!(
         "held attach: unit {entity} display {} → attach {} (bone {bone}, {} parts)",
         hs.display,
@@ -823,6 +924,11 @@ mod tests {
             billboard: None,
             alpha_anim: None,
             rgb_anim: None,
+            rgb_seq: None,
+            uv_anim: None,
+            uv_seq: None,
+            uv_rot_seq: None,
+            uv_scale_seq: None,
             ground_quad: None,
         }
     }
@@ -1138,6 +1244,173 @@ mod tests {
         assert_eq!(a.joints, 0, "a rigid item builds no joint rig");
     }
 
+    /// **The ranged prop gets a clock, and only the ranged prop** (decision 2281).
+    ///
+    /// Four things have to be true together or the gun's muzzle blast never fires, and each one
+    /// alone is a silent no-op: the prop root carries a [`crate::ranged_flex::RangedProp`] naming
+    /// its wearer (that is how a `$BWR` key finds it), a [`benilla_world::rig_anim::RigPose`] and a
+    /// player (so 161 can be armed and posed at all), its emitter is **hosted on that root** rather
+    /// than pinned to the loader idle (the blast's gate track is keyed only in 161 — a pinned
+    /// emitter reads Stand's flat zero for ever), and the emitter rides its BONE's anchor rather
+    /// than the model root (bone 2 is what aims it down the barrel).
+    ///
+    /// The control is the same display in the MAINHAND slot: nothing is ever passed to the
+    /// reference's `[+0xd24]` arms but the ranged weapon, so a melee item keeps the resting lane —
+    /// no player, no pose, a pinned clock.
+    #[test]
+    fn a_flexing_ranged_prop_gets_a_pose_a_clock_and_hosted_emitters() {
+        fn attach(slot_idx: usize, attach: u16) -> (App, Option<Entity>) {
+            let mut app = App::new();
+            app.add_plugins(MinimalPlugins);
+            app.init_resource::<benilla_world::rig_palette::RigPalettes>();
+            app.init_resource::<Assets<bevy::image::Image>>();
+            let mut displays = ItemDisplays::icons_for_tests(
+                benilla_formats::ItemDisplayCatalog::from_displays(HashMap::new()),
+            );
+            let mut dm = empty_display();
+            let mut p = part(false);
+            p.skinned_mesh = Some(skinned_handle());
+            dm.parts = Some(vec![p]);
+            dm.skeleton = benilla_assets::ModelSkeleton {
+                joints: vec![
+                    benilla_assets::ModelJoint {
+                        parent: -1,
+                        local_translation: Vec3::ZERO,
+                        billboard: None,
+                        parent_arm: None,
+                    },
+                    // The muzzle bone the emitters hang off.
+                    benilla_assets::ModelJoint {
+                        parent: 0,
+                        local_translation: Vec3::X,
+                        billboard: None,
+                        parent_arm: None,
+                    },
+                ],
+                spine_bone: None,
+                head_bone: None,
+            };
+            dm.inverse_bindposes = Some(Handle::default());
+            // A firearm's animation shape: Stand + BowRelease, and no BowPull.
+            dm.animations = Some(benilla_assets::ModelAnimations {
+                graph: Handle::default(),
+                clips: Vec::new(),
+                hand_close: [None, None],
+                playable_animation_lookup: Vec::new(),
+                // `owns(161)` — the gate, the reference's own `0x711960` question.
+                animation_lookup: {
+                    let mut v = vec![0xffffu16; 162];
+                    v[0] = 0;
+                    v[crate::ranged_flex::BOW_RELEASE as usize] = 1;
+                    v
+                },
+                global_bones: Vec::new(),
+                first_seq: None,
+                pose: Default::default(),
+            });
+            let mut em = benilla_assets::ModelEmitter {
+                def: benilla_world::testing::plain_particle_def(),
+                texture: Some(Handle::default()),
+                bone_pivot: [0.0; 3],
+                billboard: None,
+                recursion: None,
+                geometry: None,
+                owner_reach: 0.0,
+                water_bound: (Vec3::ZERO, 0.0),
+                idle_seq: 0,
+            };
+            em.def.bone = 1;
+            dm.emitters = vec![em];
+            displays.models.insert((7, ItemModelKind::Weapon), dm);
+            app.insert_resource(displays);
+
+            let bones = BoneAttach {
+                points: HashMap::from([(attach, (3u16, Vec3::ZERO))]),
+                markers: HashMap::new(),
+            };
+            let mut items = HeldItems::default();
+            items.slots[slot_idx] = Some(HeldSlot {
+                display: 7,
+                kind: ItemModelKind::Weapon,
+                attach,
+                visual: NO_GLOW,
+            });
+            let wearer = app
+                .world_mut()
+                .spawn((items, bones, Transform::default()))
+                .id();
+            let pose = benilla_world::testing::test_rig_pose(wearer, &[Vec3::ZERO; 4]);
+            app.world_mut().entity_mut(wearer).insert(pose);
+            app.add_systems(Update, attach_held_items);
+            app.update();
+            (app, Some(wearer))
+        }
+
+        // The ranged slot (2), drawn in the right hand.
+        let (mut app, wearer) = attach(2, attach_id::HAND_RIGHT);
+        let wearer = wearer.unwrap();
+        let (prop, owner) = app
+            .world_mut()
+            .query::<(Entity, &crate::ranged_flex::RangedProp)>()
+            .iter(app.world())
+            .map(|(e, p)| (e, p.owner))
+            .next()
+            .expect("the ranged prop is marked");
+        assert_eq!(owner, wearer, "…and names its wearer, like `[+0xd24]` does");
+        assert!(
+            app.world().entity(prop).contains::<AnimationPlayer>()
+                && app
+                    .world()
+                    .entity(prop)
+                    .contains::<benilla_world::rig_anim::RigPose>(),
+            "a flexing prop carries a player and a pose of its own"
+        );
+        let hosts: Vec<Option<Entity>> = app
+            .world_mut()
+            .query::<&benilla_world::particles::ParticleEmitter>()
+            .iter(app.world())
+            .map(|e| e.emit_host())
+            .collect();
+        assert_eq!(
+            hosts,
+            vec![Some(prop)],
+            "its emitter reads the sequence the PROP is playing"
+        );
+        // The emitter's owner frame is the muzzle bone's anchor, not the model root.
+        let anchors: Vec<(Entity, u16)> = app
+            .world_mut()
+            .query::<&benilla_world::rig_anim::RigAnchor>()
+            .iter(app.world())
+            .map(|a| (a.rig, a.bone))
+            .collect();
+        assert!(
+            anchors.contains(&(prop, 1)),
+            "the emitter minted the muzzle bone's anchor: {anchors:?}"
+        );
+
+        // The control: the SAME display in the mainhand keeps the resting lane.
+        let (mut app, _) = attach(0, attach_id::HAND_RIGHT);
+        assert_eq!(
+            app.world_mut()
+                .query::<&crate::ranged_flex::RangedProp>()
+                .iter(app.world())
+                .count(),
+            0,
+            "a melee item is never armed — the reference only ever re-anims the ranged prop"
+        );
+        let hosts: Vec<Option<Entity>> = app
+            .world_mut()
+            .query::<&benilla_world::particles::ParticleEmitter>()
+            .iter(app.world())
+            .map(|e| e.emit_host())
+            .collect();
+        assert_eq!(
+            hosts,
+            vec![None],
+            "…and its emitter stays on the pinned clock"
+        );
+    }
+
     /// **What a booth can see of an equipped item** (decision 0822, `#bugs` B118's paper-doll half).
     /// An item model's camera-facing batch spawns as a world-ROOT card and its emitters as free
     /// owner-followed entities — neither is a unit descendant, so the portrait / paper-doll booths,
diff --git a/crates/benilla-app/src/entities/item_glow.rs b/crates/benilla-app/src/entities/item_glow.rs
index 834e28de..246e6a32 100644
--- a/crates/benilla-app/src/entities/item_glow.rs
+++ b/crates/benilla-app/src/entities/item_glow.rs
@@ -55,7 +55,7 @@ use benilla_assets::m2_url;
 use benilla_assets::materials::WowModelMaterial;
 
 use super::equipment::{ItemDisplays, ItemModelKind};
-use super::spell_fx::{attach_effect_visuals, EffectHost, FxTintAnims};
+use super::spell_fx::{attach_effect_visuals, EffectHost, FxMaterials, FxTintAnims};
 use super::{DisplayModel, ModelHandle};
 
 /// The glow chain's data + the effect-model cache: the joined `ItemVisuals`/`ItemVisualEffects`
@@ -177,7 +177,6 @@ pub(crate) struct ItemGlowAttached;
 /// waits, so a two-model visual can't spawn half of itself and then re-enter here. A model that
 /// never loads simply never glows (the item is still perfectly drawn); the retry is a handful of
 /// roots per frame.
-#[allow(clippy::too_many_arguments)]
 pub(super) fn attach_item_glows(
     mut commands: Commands,
     pending: Query<(Entity, &ItemGlow), Without<ItemGlowAttached>>,
@@ -186,6 +185,8 @@ pub(super) fn attach_item_glows(
     time: Res<Time>,
     mut wow_materials: ResMut<Assets<WowModelMaterial>>,
     mut tint_reg: ResMut<FxTintAnims>,
+    mut uv_reg: ResMut<benilla_world::doodad_anim::UvAnimMaterials>,
+    mut anim_table: ResMut<benilla_world::mat_anim_table::MatAnimTable>,
     ibps: Res<Assets<bevy::mesh::skinning::SkinnedMeshInverseBindposes>>,
     mut palettes: ResMut<benilla_world::rig_palette::RigPalettes>,
     // One breadcrumb per session the first time a glow actually spawns — the machine-readable
@@ -307,8 +308,12 @@ pub(super) fn attach_item_glows(
                 // An `ItemVisuals` glow is armed by a different leg than `PlaySpellVisualKit`
                 // (0805) and carries no kit stage — the plain single-clip arm, as before.
                 None,
-                &mut wow_materials,
-                &mut tint_reg,
+                &mut FxMaterials {
+                    store: &mut wow_materials,
+                    tint: &mut tint_reg,
+                    uv: &mut uv_reg,
+                    table: &mut anim_table,
+                },
                 &ibps,
                 &mut palettes,
                 None, // the glow models author one looping sequence — the default pick
diff --git a/crates/benilla-app/src/entities/missile.rs b/crates/benilla-app/src/entities/missile.rs
index cce9bb5b..e8bc8851 100644
--- a/crates/benilla-app/src/entities/missile.rs
+++ b/crates/benilla-app/src/entities/missile.rs
@@ -92,7 +92,7 @@ use crate::creature_anim::{
 use benilla_assets::m2_url;
 
 use super::equipment::ItemDisplays;
-use super::spell_fx::{attach_effect_visuals, ensure_model, EffectHost, SpellFx};
+use super::spell_fx::{attach_effect_visuals, ensure_model, EffectHost, FxMaterials, SpellFx};
 use super::{BoneAttach, DisplayModel, ModelHandle};
 
 /// The anim-event idents that release queued missiles — the dispatcher's drain arms (`0x5ffbd0`:
@@ -293,8 +293,58 @@ struct QueuedGo {
 
 /// Every caster's pending queue (the client's per-unit `+0xac` list heads). A caster that
 /// streams out drops its queue with it.
+///
+/// **It is also a GATE, not only a queue** (decision 2288, wow-re
+/// `missile-queue-gates-the-release-event.md`). `[CGUnit+0xac]` holds `CMissile` nodes — the
+/// binary names them itself (`Missile_C.cpp`) — inserted by the missile spawner `0x60a3d0` and
+/// drained by the release event, and the `$BWR` handler reads it *before* draining it
+/// (`0x600182 mov eax,[esi+0xac]; test eax,eax; je 0x600299`). Everything between those two points
+/// — the ranged prop's own re-anim and the cast-sound reposition — happens **only when a
+/// projectile is actually waiting to be released**. So a shot's flex and its launch are two
+/// effects of one act, and a consumer that arms the prop without asking this has half a mechanism.
 #[derive(Resource, Default)]
-pub(super) struct PendingMissiles(EntityHashMap<Vec<QueuedGo>>);
+pub(crate) struct PendingMissiles(EntityHashMap<Vec<QueuedGo>>);
+
+impl PendingMissiles {
+    /// Is a projectile queued on `caster`, waiting for its release keyframe? The reference's
+    /// `test eax,eax` on the list head — asked by [`crate::ranged_flex`] before the drain, which is
+    /// the order `0x600182` and `0x600294` sit in.
+    pub(crate) fn releasing(&self, caster: Entity) -> bool {
+        self.0.get(&caster).is_some_and(|q| !q.is_empty())
+    }
+
+    /// Queue one projectile on `caster` — **test-only**, for the consumers of the gate above
+    /// ([`crate::ranged_flex`]), which need the queue non-empty without standing up the whole GO
+    /// path to put something in it. The node's contents are irrelevant to every reader of
+    /// [`Self::releasing`]; only its presence is.
+    #[cfg(test)]
+    pub(crate) fn queue_a_shot(app: &mut bevy::app::App, caster: Entity) {
+        let spawn = MissileSpawn {
+            caster,
+            spell_id: 75,
+            path: None,
+            ammo_display_id: None,
+            dest_tag: None,
+            speed: 40.0,
+            targets: Vec::new(),
+            ground_aim: None,
+            weapon_visual: None,
+            missile_sound: None,
+            awaits_release: true,
+        };
+        app.world_mut()
+            .resource_mut::<Self>()
+            .0
+            .entry(caster)
+            .or_default()
+            .push(QueuedGo {
+                spawn,
+                key: None,
+                queued: 0.0,
+                saw_oneshot: false,
+            });
+    }
+}
 
 /// The ammo display's flight model as a [`SpellFx`] cache entry: the **shape rule** (module
 /// docs — right slot = `Ammo\`, left slot = `Weapon\`, thrown), with the row's own object skin.
@@ -462,7 +512,6 @@ fn arrival_handoff(
 /// arrival deadline was fixed at GO). A release already past its deadline arrives on the spot:
 /// the arrival hand-off plays now, no flight entity, no flight loop — the melee-range cast
 /// shows only the hit, the reference's close-range look.
-#[allow(clippy::too_many_arguments)]
 fn launch_go(
     go: &QueuedGo,
     launch: Vec3,
@@ -535,7 +584,6 @@ fn launch_go(
 /// is created at queue time (shared with the attach-point effects — the same `.mdx` is one load
 /// however many things use it); a chain-less spawn resolves the wire ammo display instead
 /// ([`ensure_ammo_model`]).
-#[allow(clippy::too_many_arguments)]
 pub(super) fn spawn_missiles(
     mut commands: Commands,
     time: Res<Time>,
@@ -673,7 +721,6 @@ pub(super) fn spawn_missiles(
 /// Spawn a missile's model parts + particle emitters once its M2 finishes building (the shared
 /// cache's `parts` fill in `super::update_display_models`) — children of the missile entity, so
 /// they ride the mover below. An unloadable model just flies invisible and still impacts on time.
-#[allow(clippy::too_many_arguments)]
 pub(super) fn attach_missile_models(
     mut commands: Commands,
     mut missiles: Query<(Entity, &mut Missile)>,
@@ -682,6 +729,8 @@ pub(super) fn attach_missile_models(
     time: Res<Time>,
     mut wow_materials: ResMut<Assets<benilla_assets::materials::WowModelMaterial>>,
     mut tint_reg: ResMut<super::spell_fx::FxTintAnims>,
+    mut uv_reg: ResMut<benilla_world::doodad_anim::UvAnimMaterials>,
+    mut anim_table: ResMut<benilla_world::mat_anim_table::MatAnimTable>,
     ibps: Res<Assets<bevy::mesh::skinning::SkinnedMeshInverseBindposes>>,
     mut palettes: ResMut<benilla_world::rig_palette::RigPalettes>,
 ) {
@@ -722,8 +771,12 @@ pub(super) fn attach_missile_models(
             // A projectile is the separate `CMissile` TU, not a `CEffect`: it has no kit stage and
             // no Birth/Hold/Decay lifecycle — it flies its one sequence and dies on arrival.
             None,
-            &mut wow_materials,
-            &mut tint_reg,
+            &mut FxMaterials {
+                store: &mut wow_materials,
+                tint: &mut tint_reg,
+                uv: &mut uv_reg,
+                table: &mut anim_table,
+            },
             &ibps,
             &mut palettes,
             Some(INFLIGHT_ANIM),
@@ -751,7 +804,6 @@ pub(super) fn attach_missile_models(
 /// the path. On schedule-end it snaps to the point, runs the [`arrival_handoff`] (a landed
 /// target's impact, a missed one's dodge/block), and despawns (children with it; emitters
 /// self-release via the owner contract).
-#[allow(clippy::too_many_arguments)]
 pub(super) fn move_missiles(
     mut commands: Commands,
     time: Res<Time>,
@@ -902,6 +954,7 @@ mod tests {
             entity: caster,
             ident: *b"$CSL",
             data: 0,
+            anim_id: 0,
             pos: None,
         });
         step(&mut app, 0.05);
@@ -935,6 +988,7 @@ mod tests {
             entity: caster,
             ident: *b"$CSL",
             data: 0,
+            anim_id: 0,
             pos: None,
         });
         step(&mut app, 0.016);
@@ -1021,6 +1075,7 @@ mod tests {
             entity: caster,
             ident: *b"$CSL",
             data: 0,
+            anim_id: 0,
             pos: None,
         });
         step(&mut app, 0.016);
@@ -1101,6 +1156,7 @@ mod tests {
                 entity: caster,
                 ident: *b"$CSL",
                 data: 0,
+                anim_id: 0,
                 pos: None,
             });
             step(&mut app, 0.016);
diff --git a/crates/benilla-app/src/entities/mount.rs b/crates/benilla-app/src/entities/mount.rs
index 0dc01da1..237c4205 100644
--- a/crates/benilla-app/src/entities/mount.rs
+++ b/crates/benilla-app/src/entities/mount.rs
@@ -156,7 +156,6 @@ pub(super) type MountChildren<'w, 's> = Query<
 /// Drive one unit's mount side to the point where the rider can be seated. Spawns the child when
 /// it is missing, drops and retries a child built for a display the field has since moved off, and
 /// resolves the seat frame once the child's rig is up.
-#[allow(clippy::too_many_arguments)] // the seat law's full input set, like its callers
 pub(super) fn seat_or_spawn_mount(
     commands: &mut Commands,
     children: &MountChildren,
diff --git a/crates/benilla-app/src/entities/spell_fx/mod.rs b/crates/benilla-app/src/entities/spell_fx/mod.rs
index 9d6afe62..8a082bec 100644
--- a/crates/benilla-app/src/entities/spell_fx/mod.rs
+++ b/crates/benilla-app/src/entities/spell_fx/mod.rs
@@ -37,10 +37,14 @@
 //! shield's pulse comes from), and run their **material
 //! animation**: each part's colour-alpha × transparency-weight loops sample per instance on the
 //! attach clock (a [`MatAnim`](benilla_world::doodad_anim::MatAnim) that owns the part's render-alpha
-//! tag — Battle Shout's staggered crescent pulses), and an animated M2Color RGB ticks a
+//! tag — Battle Shout's staggered crescent pulses), an animated M2Color RGB ticks a
 //! **per-instance material clone**'s tint uniform ([`FxTintAnims`] — the white-hot flash cooling
 //! to red; per instance because one cast = one phase, unlike the doodad lane's shared-clock
-//! loops in [`benilla_world::doodad_anim::TintAnimMaterials`]).
+//! loops in [`benilla_world::doodad_anim::TintAnimMaterials`]), and a **texture transform** scrolls
+//! that same clone's UVs off the instance's own clip — translation, rotation and scale, through
+//! [`register_fx_uv`](benilla_world::doodad_anim::register_fx_uv)'s effect lane (decision 2282;
+//! the druid's claw trail is nothing but that scroll, so until it landed the trail did not draw
+//! at all).
 //!
 //! Effect instances **fire their model's event track** ([`fire_fx_anim_events`], decision 0304):
 //! the playing clip's `$SND`-family keyframes emit the same [`AnimSoundEvent`] stream creatures
@@ -49,10 +53,12 @@
 //! WATCHER — the `UNIT_FIELD_LEVEL` edge that spawns the pillar — lives with its lootable-edge
 //! sibling in `creature_anim::spell_visual::arm_level_up_fx`, the SpellKitFx writers' home.)
 //!
-//! Approximations, named: the UV-scroll channel still doesn't run here (0130's scope was placed
-//! doodads); the span-based self-termination stands in for the client's model-event completion
-//! callback; and the kit sound keeps playing unconditionally where the client gates it on
-//! no-visual-attached.
+//! Approximations, named: a ground-anchored effect's flat quad parts carry no UV offset — their
+//! draw identity rides a `GroundFxDecal` record rather than a `WowModelMaterial` (0733), and no
+//! transform-animating effect model authors one, so the population is empty (`benilla-extract
+//! fxuvscan` is where that stays measured rather than remembered); the span-based
+//! self-termination stands in for the client's model-event completion callback; and the kit sound
+//! keeps playing unconditionally where the client gates it on no-visual-attached.
 
 mod lifecycle;
 
@@ -168,32 +174,73 @@ pub(crate) fn tick_fx_tint(
     });
 }
 
-/// Resolve one part's material for a NEW effect instance: the shared handle, unless the part's
-/// M2Color RGB animates — then a per-instance clone seeded at the loop's first key and registered
-/// for the per-frame tint tick ([`FxTintAnims`]).
+/// The material side of an effect attach, in one parameter: the store a part's clone is made
+/// from, and the three places that clone can be registered for per-instance animation — the tint
+/// loop ([`FxTintAnims`], decision 0271), the UV scroll ([`UvAnimMaterials`]' effect lane,
+/// decision 2282) and the delta table both scrolls write their rows into. They always travel
+/// together, and a caller that threaded some of them silently dropped a channel.
+pub(crate) struct FxMaterials<'a> {
+    pub(crate) store: &'a mut Assets<WowModelMaterial>,
+    pub(crate) tint: &'a mut FxTintAnims,
+    pub(crate) uv: &'a mut benilla_world::doodad_anim::UvAnimMaterials,
+    pub(crate) table: &'a mut benilla_world::mat_anim_table::MatAnimTable,
+}
+
+/// Resolve one part's material for a NEW effect instance. The shared handle, unless a channel has
+/// to run **per instance** — an animated M2Color RGB (decision 0271) or a texture transform
+/// (decision 2282) — and then a clone of it, seeded at each live loop's first key and registered
+/// for the per-frame ticks. `host` is the instance root, whose `AnimationPlayer` the UV lane reads
+/// its clip off (the sequence source `MatAnim::following_host` takes beside it).
 fn fx_part_material(
     part: &EntityPart,
     now: f32,
-    wow_materials: &mut Assets<WowModelMaterial>,
-    tint_reg: &mut FxTintAnims,
+    host: Entity,
+    mats: &mut FxMaterials,
 ) -> Handle<WowModelMaterial> {
-    let Some(anim) = &part.rgb_anim else {
+    let loops = part.uv_loops();
+    if part.rgb_anim.is_none() && !loops.any() {
         return part.material.clone();
-    };
+    }
     // The shared steady may still be parked (`model_render::lazy`): this copy is made before
     // anything binds it.
-    benilla_world::model_render::lazy::realize(wow_materials, part.material.id());
-    let Some(mut mat) = wow_materials.get(part.material.id()).cloned() else {
+    benilla_world::model_render::lazy::realize(mats.store, part.material.id());
+    let Some(mut mat) = mats.store.get(part.material.id()).cloned() else {
         return part.material.clone(); // shared material not built yet — parts were checked ready
     };
-    let t0 = anim.sample(0.0);
-    mat.extension.tint = Vec4::new(t0[0], t0[1], t0[2], 1.0);
-    // The clone must leave the shared mat-anim table (decision 1381): its tint is ticked per
-    // INSTANCE right here (the whole point of the clone), and a carried world slot would add the
-    // shared delta on top — a double animation the old asset-mutating lane could never produce.
+    if let Some(anim) = &part.rgb_anim {
+        let t0 = anim.sample(0.0);
+        mat.extension.tint = Vec4::new(t0[0], t0[1], t0[2], 1.0);
+    }
+    // The clone must leave the shared mat-anim table (decision 1381): its channels are ticked per
+    // INSTANCE, and a carried world slot would add the shared delta on top — a double animation
+    // the old asset-mutating lane could never produce. `register_fx_uv` below hands it rows of
+    // its own.
     mat.extension.anim_slots = Vec4::ZERO;
-    let handle = wow_materials.add(mat);
-    tint_reg.0.insert(handle.id(), (anim.clone(), now));
+    if loops.any() {
+        // **Seed the clone at the loop's own t = 0**, not at the entity lane's flat zero
+        // (`entity_variants` builds every effect batch with `play_uv = false`, so the shared
+        // steady this was cloned from carries no offset at all). The delta table is measured from
+        // whatever `sun_scale.zw` holds at registration (1381), so seeding here is what makes the
+        // registration's own opening row land on the scroll's first frame.
+        let t0 = loops.open_offset();
+        mat.extension.sun_scale.z = t0[0];
+        mat.extension.sun_scale.w = t0[1];
+    }
+    let handle = mats.store.add(mat);
+    if let Some(anim) = &part.rgb_anim {
+        mats.tint.0.insert(handle.id(), (anim.clone(), now));
+    }
+    if loops.any() {
+        benilla_world::doodad_anim::register_fx_uv(
+            mats.uv,
+            mats.table,
+            mats.store,
+            handle.id(),
+            loops,
+            host,
+            now,
+        );
+    }
     handle
 }
 
@@ -236,7 +283,6 @@ pub(crate) struct EffectHost {
 /// rather than off a slot pinned at spawn. `None` for the lanes that are not `CEffect`s and never
 /// advance — a missile (the separate `CMissile` TU), an item glow, the `fxview` preview — which
 /// keep the pinned single-clip arm they have always had.
-#[allow(clippy::too_many_arguments)]
 pub(crate) fn attach_effect_visuals(
     commands: &mut Commands,
     root: Entity,
@@ -245,8 +291,7 @@ pub(crate) fn attach_effect_visuals(
     ground_anchor: bool,
     host: EffectHost,
     stage: Option<FxStage>,
-    wow_materials: &mut Assets<WowModelMaterial>,
-    tint_reg: &mut FxTintAnims,
+    mats: &mut FxMaterials,
     ibps: &Assets<bevy::mesh::skinning::SkinnedMeshInverseBindposes>,
     palettes: &mut benilla_world::rig_palette::RigPalettes,
     preferred_anim: Option<u16>,
@@ -281,7 +326,7 @@ pub(crate) fn attach_effect_visuals(
             if is_ground_decal(p) {
                 p.material.clone()
             } else {
-                fx_part_material(p, now, wow_materials, tint_reg)
+                fx_part_material(p, now, root, mats)
             }
         })
         .collect();
@@ -427,8 +472,8 @@ pub(crate) fn attach_effect_visuals(
         };
         // The material's packed fog byte, handed over raw — the lane owns what it maps to.
         // `7` (Scene) is the no-material fallback the packer's own default agrees with.
-        benilla_world::model_render::lazy::realize(wow_materials, part.material.id());
-        let (texture, fog_bits) = match wow_materials.get(part.material.id()) {
+        benilla_world::model_render::lazy::realize(mats.store, part.material.id());
+        let (texture, fog_bits) = match mats.store.get(part.material.id()) {
             Some(mat) => (
                 mat.base.base_color_texture.clone(),
                 (mat.extension.clutter_fade.z as u32 >> 4) & 7,
@@ -924,7 +969,7 @@ fn reap_matching(
 /// so the whole effect — meshes and particle emitters alike — rides the animating bone. The one
 /// exception is the kit's **world-plant slot** ([`benilla_formats::WORLD_EFFECT_TAG`], kit field
 /// 12): its root is a free world entity at the owner's position/facing/scale, [`WorldPlantFx`].
-#[allow(clippy::too_many_arguments, clippy::type_complexity)] // one Bevy system's full input set
+#[allow(clippy::type_complexity)] // one Bevy system's full input set
 pub(super) fn attach_spell_fx(
     mut commands: Commands,
     mut units: Query<(
@@ -942,6 +987,8 @@ pub(super) fn attach_spell_fx(
     time: Res<Time>,
     mut wow_materials: ResMut<Assets<WowModelMaterial>>,
     mut tint_reg: ResMut<FxTintAnims>,
+    mut uv_reg: ResMut<benilla_world::doodad_anim::UvAnimMaterials>,
+    mut anim_table: ResMut<benilla_world::mat_anim_table::MatAnimTable>,
     ibps: Res<Assets<bevy::mesh::skinning::SkinnedMeshInverseBindposes>>,
     mut palettes: ResMut<benilla_world::rig_palette::RigPalettes>,
     mut emitters: Query<&mut benilla_world::particles::ParticleEmitter>,
@@ -1091,8 +1138,12 @@ pub(super) fn attach_spell_fx(
                 EffectHost { parent: Some(unit) },
                 // A kit effect IS a `CEffect`: it runs the stage's animation lifecycle.
                 Some(inst.stage),
-                &mut wow_materials,
-                &mut tint_reg,
+                &mut FxMaterials {
+                    store: &mut wow_materials,
+                    tint: &mut tint_reg,
+                    uv: &mut uv_reg,
+                    table: &mut anim_table,
+                },
                 &ibps,
                 &mut palettes,
                 None, // an attach-point kit effect opens on its model's own `Stand`
@@ -1138,7 +1189,6 @@ pub(super) fn attach_spell_fx(
 /// the world position; an instance root's own is joint-local). Unlike a streamed creature, an
 /// instance is born under our eyes at t = 0, so first sight fires the head window `[0, cur]` —
 /// the level-up pillar's `$SND(888)` sits at 0.033 s and depends on it.
-#[allow(clippy::too_many_arguments)] // the scan's own params plus the frame's two reads
 pub(super) fn fire_fx_anim_events(
     units: Query<(Entity, &FxAttached)>,
     players: Query<&AnimationPlayer>,
@@ -1232,6 +1282,8 @@ mod tests {
             .init_asset::<SkinnedMeshInverseBindposes>()
             .init_resource::<SpellFx>()
             .init_resource::<FxTintAnims>()
+            .init_resource::<benilla_world::doodad_anim::UvAnimMaterials>()
+            .init_resource::<benilla_world::mat_anim_table::MatAnimTable>()
             .init_resource::<benilla_world::rig_palette::RigPalettes>()
             .add_systems(Update, attach_spell_fx);
         let roots: Vec<Entity> = persistent
@@ -1457,6 +1509,8 @@ mod tests {
         .init_resource::<Time>()
         .init_resource::<SpellFx>()
         .init_resource::<FxTintAnims>()
+        .init_resource::<benilla_world::doodad_anim::UvAnimMaterials>()
+        .init_resource::<benilla_world::mat_anim_table::MatAnimTable>()
         .init_resource::<benilla_world::rig_palette::RigPalettes>()
         .add_systems(Update, attach_spell_fx);
 
diff --git a/crates/benilla-app/src/entities/wmo_props.rs b/crates/benilla-app/src/entities/wmo_props.rs
index 93532f12..59cc2261 100644
--- a/crates/benilla-app/src/entities/wmo_props.rs
+++ b/crates/benilla-app/src/entities/wmo_props.rs
@@ -186,7 +186,6 @@ pub(super) fn resolve_wmo_gameobject_props(
 /// Spawn each pending prop as its M2 lands, parented under the gameobject entity. The whole ship's
 /// set spawns within a few frames of the models landing — no per-frame budget (transports are a
 /// handful of instances per map, not a city's worth of placements).
-#[allow(clippy::too_many_arguments)] // one Bevy system's full input set
 pub(super) fn spawn_wmo_gameobject_props(
     mut commands: Commands,
     m2s: Res<Assets<M2Model>>,
diff --git a/crates/benilla-app/src/footprints.rs b/crates/benilla-app/src/footprints.rs
index 557fb973..c57ca982 100644
--- a/crates/benilla-app/src/footprints.rs
+++ b/crates/benilla-app/src/footprints.rs
@@ -159,7 +159,6 @@ type RootState = (
 /// Spawn a print for each per-foot plant on a footprint surface: the state gates (hover /
 /// stealth / ghost / distance), the terrain-flags gate, the unit's ink + params, the event
 /// marker's live bone position, yaw to the facing, project once, cache the triangles.
-#[allow(clippy::too_many_arguments)]
 fn spawn_footprints(
     mut events: MessageReader<AnimSoundEvent>,
     time: Res<Time>,
diff --git a/crates/benilla-app/src/game_plugins.rs b/crates/benilla-app/src/game_plugins.rs
new file mode 100644
index 00000000..623a2a0c
--- /dev/null
+++ b/crates/benilla-app/src/game_plugins.rs
@@ -0,0 +1,1682 @@
+//! **[`GamePlugins`] — the game, as one name** (decision 2279, 2265 §C2).
+//!
+//! `benilla_world::world_plugins::WorldPlugins` is the engine as one name (1164); this is the
+//! client on top of it: every plugin the game adds, in the order `run()` always added them.
+//! Until 2279 that chain lived inline in `run()` — 616 lines, the crate's only public function,
+//! ~150 `add_plugins` — so nothing could build the game's schedule except the binary, and no
+//! test could ask the one question Bevy can answer about a schedule: which conflicting pairs
+//! have no declared order (the instrument that would have caught 2220 and B354 at the line).
+//! `schedule_tests` below builds it headless and asks.
+//!
+//! **The order is load-bearing and is preserved from `run()` as-is.** Two kinds of edge live in
+//! it: documented dependencies (a plugin that reads a resource an earlier one inserts at build
+//! time — `VideoPlugin` and `RealmlistPlugin` before `CvarPlugin`, `WorldBackdropPlugin` after
+//! `PlayerUiPlugin`, the `UiActionPlugin` family), and registration order, which is the
+//! executor's tie-break between systems with no declared order. The second kind is exactly
+//! what the ambiguity count measures; until it is zero, reordering members is a behaviour
+//! change.
+//!
+//! **What is NOT here:** the engine (`WorldPlugins`), the three process plugins (`ThreadQos`,
+//! `BgWin`, `MacQuit`), the instruments that sit above the stack (`dev::DevToolsPlugin`,
+//! `perf::FpsJournalPlugin`, `dev::DevProbesPlugin`) — all still `run()`'s, in their places
+//! around this group. `pipe_warm` is inside, at its old position: a client instrument, but one
+//! that warms the *game's* pipeline set and has always been added among them.
+
+use bevy::app::PluginGroupBuilder;
+use bevy::prelude::*;
+
+use crate::blob_shadow::BlobShadowPlugin;
+use crate::bowstring::BowstringPlugin;
+use crate::camera_shake::CameraShakePlugin;
+use crate::chr_classes::ChrClassesPlugin;
+use crate::cinematic::CinematicPlugin;
+use crate::creature_anim::CreatureAnimPlugin;
+use crate::cursor::CursorPlugin;
+use crate::entities::EntitiesPlugin;
+use crate::fishing_line::FishingLinePlugin;
+use crate::footprints::FootprintsPlugin;
+use crate::loading_screen::LoadingScreenPlugin;
+use crate::name_persist::NamePersistPlugin;
+use crate::net::NetPlugin;
+use crate::player::PlayerPlugin;
+use crate::portrait::PortraitPlugin;
+use crate::quest_markers::QuestMarkersPlugin;
+use crate::sound::SoundPlugin;
+use crate::target::TargetPlugin;
+use crate::textinput::TextInputPlugin;
+use crate::transport::TransportPlugin;
+use crate::tutorial::TutorialPlugin;
+use crate::ui_action::UiActionPlugin;
+use crate::ui_auction::UiAuctionPlugin;
+use crate::ui_aura::UiAuraPlugin;
+use crate::ui_bank::UiBankPlugin;
+use crate::ui_battlefield::BattlefieldPlugin;
+use crate::ui_battlefield_positions::BattlefieldPositionsPlugin;
+use crate::ui_battlefield_score::BattlefieldScorePlugin;
+use crate::ui_binder::UiBinderPlugin;
+use crate::ui_cast::UiCastPlugin;
+use crate::ui_char::UiCharPlugin;
+use crate::ui_chat::UiChatPlugin;
+use crate::ui_craft::UiCraftPlugin;
+use crate::ui_dialog_verbs::UiDialogVerbsPlugin;
+use crate::ui_duel::UiDuelPlugin;
+use crate::ui_follow::UiFollowPlugin;
+use crate::ui_gm_ticket::UiGmTicketPlugin;
+use crate::ui_gossip::UiGossipPlugin;
+use crate::ui_guild::UiGuildPlugin;
+use crate::ui_instance::UiInstancePlugin;
+use crate::ui_item_text::UiItemTextPlugin;
+use crate::ui_items::UiItemsPlugin;
+use crate::ui_layout::UiLayoutPlugin;
+use crate::ui_logout::UiLogoutPlugin;
+use crate::ui_loot::UiLootPlugin;
+use crate::ui_loot_roll::UiLootRollPlugin;
+use crate::ui_mail::UiMailPlugin;
+use crate::ui_merchant::UiMerchantPlugin;
+use crate::ui_mirror::UiMirrorPlugin;
+use crate::ui_net::UiNetPlugin;
+use crate::ui_party::UiPartyPlugin;
+use crate::ui_pass::PlayerUiPlugin;
+use crate::ui_pet::UiPetPlugin;
+use crate::ui_pet_book::UiPetBookPlugin;
+use crate::ui_pet_doll::UiPetDollPlugin;
+use crate::ui_pet_stats::UiPetStatsPlugin;
+use crate::ui_petition::UiPetitionPlugin;
+use crate::ui_quest::UiQuestPlugin;
+use crate::ui_quest_log::UiQuestLogPlugin;
+use crate::ui_quest_share::QuestSharePlugin;
+use crate::ui_saved::UiSavedPlugin;
+use crate::ui_script::UiScriptPlugin;
+use crate::ui_shapeshift::UiShapeshiftPlugin;
+use crate::ui_social::UiSocialPlugin;
+use crate::ui_spellbook::UiSpellbookPlugin;
+use crate::ui_stable::UiStablePlugin;
+use crate::ui_summon::UiSummonPlugin;
+use crate::ui_tabard::TabardUiPlugin;
+use crate::ui_talent::UiTalentPlugin;
+use crate::ui_talent_wipe::UiTalentWipePlugin;
+use crate::ui_taxi::UiTaxiPlugin;
+use crate::ui_text::UiTextPlugin;
+use crate::ui_tooltip::UiTooltipPlugin;
+use crate::ui_trade::UiTradePlugin;
+use crate::ui_tradeskill::UiTradeSkillPlugin;
+use crate::ui_trainer::UiTrainerPlugin;
+use crate::ui_unit::UiUnitPlugin;
+use crate::world_backdrop::WorldBackdropPlugin;
+
+/// The game, as one plugin group. The two fields are the two plugins `run()` parameterises.
+pub(crate) struct GamePlugins {
+    /// [`NetPlugin::connect`]: `false` in capture mode — the channel resources exist, no IO
+    /// thread runs, so captures are deterministic regardless of whether a server is up.
+    pub(crate) connect: bool,
+    /// [`crate::char_select::CharSelectPlugin::start`]: the screen this session opens on.
+    pub(crate) start: crate::char_select::ClientState,
+}
+
+impl PluginGroup for GamePlugins {
+    fn build(self) -> PluginGroupBuilder {
+        PluginGroupBuilder::start::<Self>()
+            // The game's own WGSL, compiled into the binary (decision 1175) — before anything that could
+            // ask for one. The engine's seven register themselves inside `WorldPlugins`, which
+            // `run()` adds ahead of this group.
+            .add(crate::shaders::plugin)
+            .add(BowstringPlugin)
+            .add(crate::weapon_trail::WeaponTrailPlugin)
+            .add(FishingLinePlugin)
+            .add(QuestMarkersPlugin)
+            // Pipeline-compile counters + the live-compile tripwire (decision 0837: macOS builds every
+            // pipeline synchronously on the render thread, so a live compile is a felt stall).
+            .add(crate::pipe_warm::plugin)
+            // Streamed world entities: cube assets + display catalogs at startup, sync each frame.
+            .add(EntitiesPlugin)
+            // Creature animation: pick Stand/Walk/Run from each creature's movement state each frame (Milestone C).
+            .add(CreatureAnimPlugin)
+            // The unit blob shadow: the dark ground oval under every unit, sized from the playing
+            // animation's box (the byte-verified law — wow-re unit-blob-shadow RE), on the same
+            // surface-decal projector as the selection ring. `worldShadows 0` — the shipped default,
+            // the faithful 1.12 frame — draws it exactly as the reference does; while `worldShadows 1`
+            // the realtime shadow-map path owns unit shadows and this lane hides (the gate inside
+            // `update_shadows`), so a unit never wears the oval underneath its cast shadow.
+            .add(BlobShadowPlugin)
+            // Footprint decals (B212, decision 1006): the prints a walking unit leaves on snow/sand,
+            // spawn-once projections on the same decal projector, fading off the effect stream.
+            .add(CameraShakePlugin)
+            .add(FootprintsPlugin)
+            // GameObject animation (decision 0242): net-streamed GObjects (doors/chests) play an M2 sequence
+            // on GAMEOBJECT_STATE change — the state-machine sibling of the doodad idle loop above.
+            .add(crate::go_anim::plugin)
+            .add(crate::doodad_events::plugin)
+            // Avatar + camera + input.
+            .add(PlayerPlugin)
+            // Cinematic fly-bys (`SMSG_TRIGGER_CINEMATIC`): the race intro a first login plays, and the
+            // GameObject cameras. Takes the world camera for the duration — hence after PlayerPlugin,
+            // whose `control` it overrides within the same stage (decision 0196's deferred arc).
+            .add(crate::screen_fade::ScreenFadePlugin)
+            .add(CinematicPlugin)
+            // The real client's hardware mouse cursor (native NSCursor on macOS).
+            .add(CursorPlugin)
+            // Net↔ECS bridge: spawns the world thread, exposes the snapshot + writer resources. In capture
+            // mode the IO thread is skipped (`connect: false`) so the scene is deterministic.
+            .add(NetPlugin {
+                connect: self.connect,
+            })
+            // The death arc (decision 0308): the wire-fed death stores + the root/water-walk ack messages.
+            .add(crate::death::DeathPlugin)
+            // The shared glue vocabulary both pre-world screens stand on (decision 0465): the ADD-mode UI
+            // material, the client-data art set, the GlueStrings table.
+            .add(crate::glue::GluePlugin)
+            // The glue layer (decision 0193): the ClientState machine + the character-select screen
+            // that answers the parked IO thread's pick. A world capture boots straight InWorld (no net,
+            // no picker); a glue capture boots onto the screen it photographs.
+            .add(crate::char_select::CharSelectPlugin { start: self.start })
+            // The login screen (decision 0539): the faithful AccountLogin glue + the credential policy
+            // that answers the IO thread's pre-logon park.
+            .add(crate::login::LoginPlugin)
+            // The realm list: the faithful RealmList glue + the policy that answers the IO thread's
+            // realm park. The client used to take `realms.first()` and offer no way to say otherwise.
+            .add(crate::realm_select::RealmSelectPlugin)
+            // The character-creation screen + its live preview booth (decision 0423).
+            .add(crate::char_create::CharCreatePlugin)
+            // Audio: the delegated mixer + WoW's owned selection layer (decision 0070).
+            .add(SoundPlugin)
+            // Targeting: left-click a unit to select it (→ CMSG_SET_SELECTION) + draw its ground ring.
+            .add(TargetPlugin)
+            .add(TransportPlugin)
+            // Faithful world-load splash + progress bar on startup + cross-map teleport (the load latency
+            // streaming can't hide); per-map art via the Map.dbc→LoadingScreens.dbc→BLP chain.
+            .add(LoadingScreenPlugin)
+            // The player-UI quad pass (decision 0068 §2): its own composited-above-the-world,
+            // below-the-egui-dev-overlays camera + sorted-quad renderer. `$WOW_UI_DEMO=1` seeds a proof scene.
+            .add(PlayerUiPlugin)
+            // The world's frame, rendered off-screen and drawn first in the UI camera's main pass —
+            // the seam that puts the UI-over-world blend back into gamma bytes (0161/0254's last piece,
+            // a pass rather than a quad since 2234). Registered AFTER the UI pass: it points that
+            // plugin's camera at the world camera.
+            .add(WorldBackdropPlugin)
+            // The HUD minimap (decision 0203 phase 1): fills the `<Minimap>` widget's extracted hole with
+            // the streamed tile window + mask + player arrow, and feeds the zone text.
+            .add(crate::minimap::MinimapPlugin)
+            // The pet-bar / spellbook autocast shine, drawn on the append lane from the conversion's
+            // parked sites — zero per-frame script-layout traffic (decision 1383, B282).
+            // The `<Model>` widgets' M2s, rendered as tiles of one atlas and composited at the
+            // callback rank (decision 2008).
+            .add(crate::ui_models::UiModelsPlugin)
+            // The shared AreaTable catalog + the ZONE_CHANGED event family / zone-text host globals
+            // behind GetZoneText & co. (the zone-entry splash arc, decision 0287).
+            .add(crate::area::AreaPlugin)
+            .add(crate::area_poi::AreaPoiPlugin)
+            .add(crate::world_state_ui::WorldStateUiPlugin)
+            // The `AreaTrigger.dbc` volumes + the per-frame containment check that reports walking into
+            // one (`CMSG_AREATRIGGER`) — the client's whole part in portals, instance entrances and
+            // explore objectives; the server owns what each trigger means.
+            .add(crate::area_trigger::AreaTriggerPlugin)
+            .add(crate::ui_world_map::WorldMapUiPlugin)
+            // The guard's directions marker (`SMSG_GOSSIP_POI`) — one landmark record, drawn by the
+            // minimap's landmark pass and the world map's POI child, cleared by arriving at it.
+            .add(crate::poi_marker::PoiMarkerPlugin)
+            // The glyph atlas (client TTFs -> baked bitmap) `ui_script`'s extraction draws `FontString`
+            // regions through. Loads at Startup, after the asset chain opens (decision 0068 §2).
+            .add(UiTextPlugin)
+            // The one "which NPC am I interacting with" answer, shared by the portrait booth's `"npc"`
+            // token and the interaction face-me (decision 1467) — hence its own plugin, ahead of both.
+            .add(crate::ui_session::UiSessionPlugin)
+            // Unit-frame portraits: the token -> off-screen-baked-face bridge the UI extract samples for a
+            // `SetPortraitTexture`-bound region (the modern high-res 2D model bake).
+            .add(PortraitPlugin)
+            .add(TextInputPlugin)
+            .add(UiScriptPlugin)
+            // The video knobs the CVar host writes into (today: `gxVSync`). Before CvarPlugin so the
+            // resource exists when `load_config` applies the saved value at Startup.
+            .add(crate::video::VideoPlugin)
+            // MONKEY (shadows): the shared rig (loads first) + the independent lane plugins. Here,
+            // between `VideoPlugin` and `RealmlistPlugin`, because every one of them registers cvars
+            // that `CvarPlugin` (two lines down) must already see when `load_config` applies the
+            // saved values at Startup — the same edge that pins the two knob plugins around them.
+            .add(crate::shadow_core::ShadowCorePlugin)
+            .add(crate::character_shadow::CharacterShadowPlugin)
+            .add(crate::world_shadow::WorldShadowPlugin)
+            .add(crate::torch_shadow::TorchShadowPlugin)
+            // MONKEY (dynamic interiors): the fixture-lit interior lane's cvar bridge — independent
+            // of the shadow lanes, a plain drop-in.
+            .add(crate::dynamic_interior::DynamicInteriorPlugin)
+            // The realmlist (decision 1667) — the logon address the login screen edits. Same reason as
+            // VideoPlugin above: it is a CVar knob, so its resource has to exist before `load_config`.
+            .add(crate::realmlist::RealmlistPlugin)
+            // The CVar host (decision 0954): registration, knob sync, config.toml persistence. After
+            // UiScriptPlugin only for reading order — its systems gate on the VM existing anyway.
+            .add(crate::cvars::CvarPlugin)
+            // The console command registry (decision 2303): the reference's `ConsoleCommand` table,
+            // its four CVar commands and `help`; subsystems register their own from their plugins.
+            .add(crate::console::ConsolePlugin)
+            // The key-binding engine (decision 0997): the chord→command dispatch every rebindable input
+            // runs through, its persistence, and the Key Bindings window's capture seam.
+            .add(crate::bindings::BindingsPlugin)
+            // The unit snapshot + event feed (decision 0068 §3): pushes ECS game state into the VM as the
+            // plain data the `Unit*` bindings read, and fires the matching WoW events.
+            .add(UiUnitPlugin)
+            .add(UiPartyPlugin)
+            // Duels (decision 0633): the wire session, the client-side countdown tick, the four Era
+            // events, and the accept/cancel/challenge intents.
+            .add(UiDuelPlugin)
+            // Setting your hearthstone (decision 1331): the innkeeper's SMSG_BINDER_CONFIRM question, the
+            // CONFIRM_BINDER dialog it raises, and the CMSG_BINDER_ACTIVATE its Accept sends — the only
+            // packet in the flow that actually binds anything.
+            .add(UiBinderPlugin)
+            // The dialog engine's own verbs (decision 1963): the pet trainer's question, the instance
+            // boot clock, the area spirit healer, the battleground queue, the meeting stone.
+            .add(UiDialogVerbsPlugin)
+            .add(BattlefieldScorePlugin)
+            .add(BattlefieldPlugin)
+            .add(BattlefieldPositionsPlugin)
+            .add(crate::game_tip::GameTipPlugin)
+            .add(crate::text_filter::TextFilterPlugin)
+            // The re-shape a `bevy_ui` text root loses when its last span is despawned
+            // (decision 2212, B383): an upstream change-detection hole whose only symptom is a
+            // panic inside `bevy_text` on the next window resize.
+            .add(crate::text_reshape::TextReshapePlugin)
+            .add(TutorialPlugin)
+            // The melee swing refusals (`SMSG_ATTACKSWING_NOTINRANGE`/`_BADFACING`/`_DEADTARGET`/
+            // `_CANT_ATTACK`): the latch the packets set, and the 4 s repeat that shows it while an
+            // attack target stands and no swing lands.
+            .add(crate::swing_refusal::SwingRefusalPlugin)
+            // The talent spell-modifier tables (`SMSG_SET_FLAT_/PCT_SPELL_MODIFIER`): the wire
+            // fills them, world-enter clears them, and `usable::power_cost` reads op 14 out of
+            // them. Beside the swing refusal because both are the same shape — a small wire-fed
+            // store with a world-entry reset — and neither has a feed of its own.
+            .add(crate::spell_mods::SpellModsPlugin)
+            // Being summoned (decision 1747): SMSG_SUMMON_REQUEST's latch, the CONFIRM_SUMMON dialog it
+            // raises, and the CMSG_SUMMON_RESPONSE its Accept sends. The binder's twin one line up — a
+            // server-asked question whose only wire answer is yes — and here for that reason.
+            .add(UiSummonPlugin)
+            // The GM trouble-ticket flow (decision 1673): the Help window's five sends, the UPDATE_TICKET
+            // answer ticket behind its 10-minute poll, and the GMTicketCategory.dbc list its "page a GM"
+            // rows are built from. Beside the binder because it is the same feed/drain shape, and after it
+            // because both want UiInput ordering and this reads better grouped.
+            .add(UiGmTicketPlugin)
+            // Auto-follow's UI seam: the popup's Follow row + `FollowUnit`/`FollowByName` inbound, and
+            // the AUTOFOLLOW_BEGIN/END pair that drives the centre-screen status line outbound.
+            .add(UiFollowPlugin)
+            // Instance/raid lockouts (decision 1748): the four CHAT_MSG_SYSTEM lines the client composes
+            // itself out of GlobalStrings, the last-dungeon/ownership bookkeeping behind
+            // `CanShowResetInstances()`, and the SELF menu's one send. Beside the binder family for the
+            // same feed/drain shape; it needs the map catalog, which is up long before Update runs.
+            .add(UiInstancePlugin)
+            // Leaving (decision 0674): the game menu's Logout/Exit Game — the request, the server's
+            // 20-second answer narrated as the CAMP/QUIT countdown, and the process exit.
+            .add(UiLogoutPlugin)
+            .add(UiSocialPlugin)
+            // Guilds (decision 1257): the identity/roster mirror behind the four guild windows, the
+            // membership verbs, and the `ERR_GUILD_*` lines. Right after the social session, whose
+            // FriendsFrame it shares a window with and whose ignore list its sign-on lines consult.
+            .add(UiGuildPlugin)
+            // Founding a guild (decision 1672): the guild registrar and the charter window — the slice
+            // 1257 §2 left out. Right after the guild session, whose error channel its refusals ride and
+            // whose roster its success produces.
+            .add(UiPetitionPlugin)
+            .add(UiTooltipPlugin)
+            // The character-window feed (decision 0208): the combat-stats/inventory snapshots + events
+            // the paper doll reads, and the paper-doll booth's yaw mirror.
+            .add(UiCharPlugin)
+            // The reputation-pane feed: the player's wire faction slots resolved against Faction.dbc into
+            // the pane's snapshot, plus the pane's three outbound verbs. Beside the character feed because
+            // it is the same window's other tab.
+            .add(crate::ui_reputation::UiReputationPlugin)
+            // The inspect feed (decision 0631): another player's equipment off their PUBLIC visible-item
+            // entries, plus the "inspect" booth's unit + yaw. Right after the character feed it mirrors.
+            .add(crate::ui_inspect::InspectUiPlugin)
+            // The honor feed (decision 1512): the PRIVATE honor descriptor block as the snapshot both
+            // Honor tabs read, plus the inspect-honor round trip. After the inspect feed because it
+            // resolves that feed's target to address its request at.
+            .add(crate::ui_honor::UiHonorPlugin)
+            // The dressing-room feed (decision 1060): the window's try-on intents → the player's own look
+            // with the tried-on items substituted in, plus the "dressup" booth's yaw. Beside the inspect
+            // feed, whose shape it shares (intents in, a booth look out).
+            .add(crate::ui_dressup::DressUpUiPlugin)
+            .add(UiActionPlugin)
+            // The aura feed (decisions 0255/0257): the player's insertion-ordered buff/debuff cache + the
+            // self-only durations, pushed as the data the `UnitAura` bindings read; fires UNIT_AURA and
+            // drains the right-click cancels. After UiActionPlugin (shares its `Spells` catalog).
+            .add(UiAuraPlugin)
+            // The spellbook window feed (decision 0216 §8, slice 5): builds the book from
+            // PlayerActions.spells through the Spell.dbc/SkillLine.dbc join and drives
+            // SpellBookFrame.xml's snapshot + cast-drain seam — the spell SOURCE for the cursor payload
+            // arc (bags/doll/bars/book). After UiActionPlugin (shares its `Spells` resource + the cast
+            // tail `send_spell_cast`).
+            .add(UiSpellbookPlugin)
+            // The macro system (decision 0983): the icon chooser's catalog, the `benilla-config/macros/`
+            // files, `UPDATE_MACROS`, and the macro→bound-spell table the action bar's MACRO slots
+            // resolve their cooldown/usability through. After UiSpellbookPlugin — the bound spell is
+            // resolved against the book that feed pushes, by the same law `CastSpellByName` uses.
+            .add(crate::ui_macro::UiMacroPlugin)
+            // The talent window feed (decision 0304): builds the class pages from Talent.dbc × the
+            // known-spell set + PLAYER_CHARACTER_POINTS, drives TalentFrame.xml through the engine's
+            // talent seam, and drains learn clicks into CMSG_LEARN_TALENT. After UiActionPlugin
+            // (shares its `Spells` catalog), beside the spellbook it mirrors.
+            .add(UiTalentPlugin)
+            // Unlearning them again (decision 1580): the class trainer's respec question, its
+            // CONFIRM_TALENT_WIPE dialog, and the answer that is the only packet in the flow which
+            // unlearns anything. Beside UiTalentPlugin for the subject, but it is UiBinderPlugin's twin
+            // in shape — a guid-carrying question over an already-closed gossip menu.
+            .add(UiTalentWipePlugin)
+            // The stance/shapeshift bar feed (wow-re shapeshift-bar-api.md): builds the form list from
+            // PlayerActions.spells per the byte-verified admission/order, drives the stock shapeshift bar through
+            // the engine's shapeshift seam, and drains its clicks (cancel-if-active else cast). After
+            // UiActionPlugin (shares `Spells`, the `usable` walk, and the cast tail).
+            .add(UiShapeshiftPlugin)
+            // The pet action bar (decision 0982) — the stance bar's mirror image: server-authoritative,
+            // so this renders the ten packed words the last `SMSG_PET_SPELLS` delivered and sends
+            // intents back. After UiActionPlugin (shares `Spells` and the cooldown triple's clock).
+            .add(UiPetPlugin)
+            .add(ChrClassesPlugin)
+            .add(UiPetBookPlugin)
+            // The pet's paper-doll stat block (happiness/loyalty/XP/training points). Its own plugin
+            // because it runs off descriptor fields and two DBC tables rather than off `SMSG_PET_SPELLS`.
+            .add(UiPetStatsPlugin)
+            // The pet paper doll's SHARED surface (decision 1057) — the combat-stats snapshot under the
+            // `"pet"` token and the page's model booth. Apart from the block above because these values
+            // pass through the character sheet's own bindings and events, with no hunter gate.
+            .add(UiPetDollPlugin)
+            // The connection-telemetry feed: the averaged ping RTT behind `GetNetStats()`, which the main
+            // bar's performance meter polls (decision 0658).
+            .add(UiNetPlugin)
+            .add(UiCastPlugin)
+            // The breath / fatigue bars (decision 0874): server-authoritative mirror timers off the
+            // wire into the transcribed MirrorTimer1/2/3 frames. Beside the cast bar it shares its
+            // feed→drain shape (and its art: the same UI-CastingBar-Border chrome).
+            .add(UiMirrorPlugin)
+            // Floating combat text (decision 0137 phase 2): the WORLDTEXTSTRING law — world-anchored
+            // damage numbers/outcome words projected into the UI quad pass each frame.
+            .add(crate::combat_text::CombatTextPlugin)
+            // Overhead unit names (nameplates): world-billboard name text over players + NPCs.
+            .add(crate::nameplates::NameplatesPlugin)
+            // Raid-target marker billboards (0434 §6): the mark icon over marked units, one line-pitch
+            // above the overhead name; plated units show the plate's raid child instead.
+            .add(crate::raid_marks::RaidMarksPlugin)
+            // V-key nameplates (0167): the toggled health-bar plates, a 2-D overlay replacing the
+            // overhead name on plated units.
+            .add(crate::vplates::VPlatesPlugin)
+            // Chat speech bubbles (0598): the over-the-head bubble a say/yell/party line spawns, the
+            // plates' 2-D overlay sibling — mutually exclusive with both the plate and the name.
+            .add(crate::chat_bubble::ChatBubblePlugin)
+            // TOGGLEUI (`CTRL-Z`/`Cmd-Z`): the whole quad layer goes dark — frames, minimap, plates,
+            // bubbles, combat text — leaving the world and the cursor.
+            .add(crate::ui_hide::UiHidePlugin)
+            .add(UiItemsPlugin)
+            // The gossip window (decision 0081): fills from the net drain's GossipState and drives
+            // GossipFrame.xml over the Era gossip API.
+            .add(UiGossipPlugin)
+            // The merchant window (decision 0081 phase 4): fills from the net drain's MerchantOpen and
+            // drives MerchantFrame.xml over the Era vendor API + the money display.
+            .add(UiMerchantPlugin)
+            // The bank window (decision 0604): the SHOW_BANK session (BankOpen) + the purchase row;
+            // the vault's slots ride the container feed as bags −1/5..=10.
+            // The auction house (decision 1511) — an NPC-session window like the bank beside it, but the
+            // only `doublewide` panel in the UI, so it displaces both the left and center seats.
+            .add(UiAuctionPlugin)
+            .add(UiBankPlugin)
+            // The mail window (decision 0544 P1/P2): the client-side mailbox session (MailOpen), the
+            // NPC-session range guard, and MailFrame.xml over the Era mail API (inbox, open-letter,
+            // send tab).
+            .add(UiMailPlugin)
+            // Player-to-player trade (TradeFrame.xml): the two-sided trade window, driven server-side over
+            // the P0 wire; the partner's portrait rides the shared "npc" booth (decision 0592 P1).
+            .add(UiTradePlugin)
+            // The item-text reader (ItemTextFrame.xml): right-clicked bag letters (mail-made permanent
+            // copies) read in the reference reader window over the shared ask-once item-text cache.
+            .add(UiItemTextPlugin)
+            .add(UiSavedPlugin)
+            .add(NamePersistPlugin)
+            .add(UiStablePlugin)
+            .add(TabardUiPlugin)
+            .add(UiTrainerPlugin)
+            // The taxi map (decision 0484 phases 1-2): the SMSG_SHOWTAXINODES-fed TaxiState resource, the
+            // NPC-session range guard, and the TaxiFrame.xml window feed/drain (catalogs, node
+            // projection/route computation, the activate send, the UnitOnTaxi ride flag).
+            .add(UiTaxiPlugin)
+            .add(UiTradeSkillPlugin)
+            .add(UiCraftPlugin)
+            // The loot window (decision 0084): fills from the net drain's LootState and drives
+            // LootFrame.xml over the Era loot API (coin + rows, paging).
+            .add(UiLootPlugin)
+            .add(UiLootRollPlugin)
+            // The questgiver window (decision 0088): fills from the net drain's QuestGiver and drives
+            // the stock questgiver window's four sub-panels over the Era quest API (1944).
+            .add(UiQuestPlugin)
+            // The quest-log window (decision 0088's deferred second slice): fills from the self player's
+            // PLAYER_QUEST_LOG descriptor slots + the SMSG_QUEST_QUERY_RESPONSE template cache, and drives
+            // the stock quest log over the Era quest-log API (1944).
+            .add(UiQuestLogPlugin)
+            // The party quest-share (decision 1733): the verdict lines on a quest we pushed, and the
+            // escort-quest confirm. Neither is bound to a window, so it is its own plugin rather than a
+            // lodger in either quest plugin above.
+            .add(QuestSharePlugin)
+            .add(UiChatPlugin)
+            // The layout cache: the geometry of every window the player has dragged or resized, restored
+            // at world entry and written back a quiet second after the last drag
+            // (`benilla-config/layout/<realm>-<character>.txt`). The consumer of the engine's userPlaced
+            // bit, which nothing read before it.
+            .add(UiLayoutPlugin)
+            // Print screen (decision 1487): the SCREENSHOT binding's engine half — one PNG per
+            // `Screenshot()` call into `benilla-config/Screenshots/` (never the install — decision 1486),
+            // answered to the UI as SCREENSHOT_SUCCEEDED/FAILED so the status text can never be in the
+            // frame it announces.
+            .add(crate::screenshot::ScreenshotPlugin)
+    }
+}
+
+#[cfg(test)]
+pub(crate) mod schedule_tests {
+    use std::any::TypeId;
+    use std::collections::{BTreeMap, HashMap, HashSet};
+
+    use super::*;
+    use bevy::ecs::component::ComponentId;
+    use bevy::ecs::schedule::graph::Direction;
+    use bevy::ecs::schedule::{LogLevel, NodeId, ScheduleBuildSettings, ScheduleLabel, SystemKey};
+
+    /// **The whole client, built headless.** The tuned `DefaultPlugins` with no window, no
+    /// winit, no logger and no GPU (`backends: None` — bevy then creates no render app), then
+    /// the engine, then the game. Every plugin's `build` and `finish` runs; no schedule does.
+    /// What this yields is the schedule GRAPH — which is fixed once the plugins have built
+    /// (the census probe's own argument, `capture::probes::sched_census`) — so a question
+    /// about ordering can be asked here, in a test, instead of on a login.
+    pub(crate) fn headless_client() -> App {
+        let mut app = App::new();
+        app.add_plugins(
+            benilla_world::boot::tuned_default_plugins(Window::default())
+                .disable::<bevy::winit::WinitPlugin>()
+                .disable::<bevy::log::LogPlugin>()
+                .set(bevy::window::WindowPlugin {
+                    primary_window: None,
+                    exit_condition: bevy::window::ExitCondition::DontExit,
+                    ..default()
+                })
+                .set(bevy::render::RenderPlugin {
+                    render_creation: bevy::render::settings::WgpuSettings {
+                        backends: None,
+                        ..default()
+                    }
+                    .into(),
+                    ..default()
+                }),
+        );
+        app.add_plugins(benilla_world::world_plugins::WorldPlugins);
+        app.add_plugins(GamePlugins {
+            connect: false,
+            start: crate::char_select::ClientState::Login,
+        });
+        app.finish();
+        app.cleanup();
+        app
+    }
+
+    /// One system as the schedule graph knows it: its name, every set it is under
+    /// (transitively), and every run condition on it or on one of those sets, by name.
+    #[derive(Debug, Clone)]
+    pub(crate) struct SystemInfo {
+        pub name: String,
+        pub sets: Vec<String>,
+        pub conditions: Vec<String>,
+    }
+
+    /// One schedule, read two ways: the graph before it builds (names, sets, conditions — all
+    /// of which move into the executable when it does), and the conflict list after (which
+    /// only exists once it has).
+    pub(crate) struct Census {
+        pub systems: HashMap<SystemKey, SystemInfo>,
+        /// Pairs of systems with conflicting access and no path between them, each with what
+        /// they fight over.
+        pub conflicts: Vec<(SystemKey, SystemKey, Vec<ComponentId>)>,
+        /// Everything any pair fights over, by name (a placeholder in a build without type
+        /// names — [`type_names_available`]).
+        pub components: HashMap<ComponentId, String>,
+        /// The explained classes, resolved against this world (decision 2287).
+        pub classes: Classes,
+        /// Every declared `a` runs before `b`, at the system level.
+        pub dependencies: Vec<(SystemKey, SystemKey)>,
+        /// The systems that must run on the main thread (the VM's, the audio layer's).
+        pub non_send: Vec<SystemKey>,
+        /// The systems whose declared access includes the Lua VM — read off each system's
+        /// own access set, not off the conflicts it happens to have (a holder whose every VM
+        /// pair is declared would not show there).
+        pub holds_vm: HashSet<SystemKey>,
+    }
+
+    impl Census {
+        pub fn name(&self, key: SystemKey) -> &str {
+            self.systems
+                .get(&key)
+                .map(|s| s.name.as_str())
+                .unwrap_or("?")
+        }
+
+        pub fn component(&self, id: ComponentId) -> &str {
+            self.components.get(&id).map(String::as_str).unwrap_or("?")
+        }
+    }
+
+    /// Take the census of one schedule. Initializing it runs every system's param setup, and
+    /// at least one of those inserts `Schedules` itself, so this goes through bevy's own
+    /// take-out-initialize-put-back rather than a `resource_scope` on that resource.
+    pub(crate) fn census(app: &mut App, label: impl ScheduleLabel) -> Census {
+        let label = label.intern();
+        app.world_mut().schedule_scope(label, |world, schedule| {
+            schedule.set_build_settings(ScheduleBuildSettings {
+                ambiguity_detection: LogLevel::Warn,
+                ..default()
+            });
+            // The systems' access is filled by `initialize`, which the build below would run
+            // anyway (bevy drains one list of uninitialized systems, once). Done first, so pass
+            // 1 can read it while the graph still holds the systems.
+            schedule.graph_mut().systems.initialize(world);
+            let vm = world
+                .components()
+                .get_resource_id(TypeId::of::<benilla_ui::script::UiScript>());
+            // Pass 1, before the build: the graph still holds the systems.
+            let graph = schedule.graph();
+            let set_conditions: HashMap<_, Vec<String>> = graph
+                .system_sets
+                .iter()
+                .map(|(key, _, conds)| {
+                    (
+                        key,
+                        conds
+                            .iter()
+                            .map(|c| c.condition.name().to_string())
+                            .collect(),
+                    )
+                })
+                .collect();
+            let mut systems = HashMap::new();
+            let mut holds_vm = HashSet::new();
+            for (key, system, conds) in graph.systems.iter() {
+                if let (Some(vm), Some(with_access)) = (vm, graph.systems.get(key)) {
+                    let access = with_access.access.combined_access();
+                    if access.has_resource_read(vm) || access.has_resource_write(vm) {
+                        holds_vm.insert(key);
+                    }
+                }
+                let mut sets = Vec::new();
+                let mut conditions: Vec<String> = conds
+                    .iter()
+                    .map(|c| c.condition.name().to_string())
+                    .collect();
+                let mut stack = vec![NodeId::System(key)];
+                while let Some(node) = stack.pop() {
+                    for parent in graph
+                        .hierarchy()
+                        .graph()
+                        .neighbors_directed(node, Direction::Incoming)
+                    {
+                        if let NodeId::Set(set) = parent {
+                            if let Some(s) = graph.system_sets.get(set) {
+                                sets.push(format!("{s:?}"));
+                            }
+                            if let Some(c) = set_conditions.get(&set) {
+                                conditions.extend(c.iter().cloned());
+                            }
+                            stack.push(parent);
+                        }
+                    }
+                }
+                systems.insert(
+                    key,
+                    SystemInfo {
+                        name: system.name().to_string(),
+                        sets,
+                        conditions,
+                    },
+                );
+            }
+            // Every declared order, at the system level: a `.before`/`.after`/`chain` edge
+            // between sets is an edge between every member of one and every member of the
+            // other.
+            let members = |node: NodeId| -> Vec<SystemKey> {
+                let mut out = Vec::new();
+                let mut stack = vec![node];
+                while let Some(n) = stack.pop() {
+                    match n {
+                        NodeId::System(k) => out.push(k),
+                        NodeId::Set(_) => stack.extend(
+                            graph
+                                .hierarchy()
+                                .graph()
+                                .neighbors_directed(n, Direction::Outgoing),
+                        ),
+                    }
+                }
+                out
+            };
+            let mut dependencies = Vec::new();
+            for (a, b) in graph.dependency().graph().all_edges() {
+                for x in members(a) {
+                    for y in members(b) {
+                        if x != y {
+                            dependencies.push((x, y));
+                        }
+                    }
+                }
+            }
+            // Pass 2: build, and read what the build found. `is_send` is only known once a
+            // system's params have registered their access, i.e. after this.
+            schedule.initialize(world).expect("the schedule builds");
+            let mut non_send = Vec::new();
+            for (key, system) in schedule.systems().expect("initialized") {
+                if !system.is_send() {
+                    non_send.push(key);
+                }
+                // The build inserts what nobody added: the `ApplyDeferred` sync points between a
+                // system with commands and its dependents. Name them so a census can count them.
+                systems.entry(key).or_insert_with(|| SystemInfo {
+                    name: system.name().to_string(),
+                    sets: Vec::new(),
+                    conditions: Vec::new(),
+                });
+            }
+            let mut components = HashMap::new();
+            let conflicts = schedule
+                .graph()
+                .conflicting_systems()
+                .0
+                .iter()
+                .map(|(a, b, ids)| {
+                    for id in ids.iter() {
+                        components.entry(*id).or_insert_with(|| {
+                            world
+                                .components()
+                                .get_name(*id)
+                                .map(|n| n.to_string())
+                                .unwrap_or_else(|| format!("{id:?}"))
+                        });
+                    }
+                    (*a, *b, ids.to_vec())
+                })
+                .collect();
+            let classes = Classes::read(world);
+            Census {
+                systems,
+                conflicts,
+                components,
+                classes,
+                dependencies,
+                non_send,
+                holds_vm,
+            }
+        })
+    }
+
+    /// **Does this build carry type names?** bevy only does under its `debug` feature, which
+    /// rides with ours (`benilla-world`'s `dev`, decision 1451); a player build names every
+    /// system and resource `<Enable the debug feature …>`. Probed off the census itself rather
+    /// than off a feature flag — a `cfg(feature = "dev")` outside `run_mode` is a seam leak (1179),
+    /// and what these tests need is the capability, not the plane. The name-dependent tests
+    /// announce the skip and return; the name-free ratchets run either way.
+    fn type_names_available(c: &Census) -> bool {
+        c.systems.values().any(|s| s.name.contains("benilla_app::"))
+    }
+
+    /// **The explained classes** (decision 2287) — what an undeclared order may be about
+    /// without anyone declaring it, argued once here instead of by every session that adds a
+    /// system. On 2287's eve three sessions raised the two constants this table replaced,
+    /// each with a paragraph, each through a rebase conflict on the same lines, none declaring
+    /// an order (2281, 2282, 2283) — because for most of what those counts held there was
+    /// nothing to declare:
+    ///
+    /// - **A non-`Send` owner** — the Lua VM, the audio layer's handles. Their systems run on
+    ///   the main thread one at a time under any executor, so no order among them is a race.
+    ///   *Which feed fires its Lua events first* is a real question, answered by the `UiFeed`
+    ///   phase (decision 2304): every push after the drain and before the tick, and among the
+    ///   pushes an order declared where it matters (the chat cascade, the cooldown events),
+    ///   registration order otherwise. Derived, not listed: every registration that is not
+    ///   `Send + Sync`.
+    /// - **A pure cache** — a read is a write because a miss records itself: the ask-once
+    ///   caches mark the key pending and send one query (`NameCache`, the GameObject
+    ///   templates, the page texts), the load-once caches build the entry (`WorldAssets`,
+    ///   `Creatures`' display models). Two misses for one key commute — one query, or one
+    ///   build, whichever runs first — and the answer lands in the net drain, in packet order,
+    ///   inside `WorldStage::Net`. *Pure* is the condition: a resource that is a cache **and**
+    ///   a window's state (`Items`, `MailOpen`, `GuildState`, `QuestLog`, `PetitionState`) is
+    ///   not here, because its other writers do not commute; 2265 §A4 is what lets those
+    ///   split (decision 2288).
+    /// - **An append-only sink** — `ChatLog`, `MessageSounds`, `UiErrorKeys`, `UiErrorTexts`:
+    ///   writers commute, and a drain's order against a writer is one frame of latency, never
+    ///   a loss. (2283's ten pairs were all this shape: a new verb drain against its siblings
+    ///   over the chat and error sinks.)
+    /// - **An exclusive edge** — a pair bevy reports with NO component list: one side is a
+    ///   build-inserted `ApplyDeferred` sync point or an exclusive system, which conflicts on
+    ///   `World` itself. Its order against a system it shares nothing with is immaterial by
+    ///   construction (the build already placed the barrier after the commands it flushes and
+    ///   before their dependents), and there is nothing to declare it against. Until 2304 an
+    ///   empty list read as "VM only" vacuously, so that class rose and fell with the barrier
+    ///   count; now it is named.
+    /// - **A random stream** — `SoundKits`, which every sound system holds to play a kit: a
+    ///   decode cache, a per-kit last-variation memory and one xorshift stream. Any
+    ///   interleaving of draws is a valid draw, and that is the reference's own contract for
+    ///   its single stream, consumed in whatever order its callers happen to run.
+    ///
+    /// A pair is **explained** when everything it fights over is in one of the four, and
+    /// **actionable** otherwise; only the actionable count is ratcheted. Adding a type here is
+    /// the act raising the ceiling used to be — a claim, with its reason, made in review — and
+    /// it is a claim about *every* writer of that resource, which is why the pure caches are
+    /// pure. Resolved by `TypeId`, so the ratchet runs in the player build, which carries no
+    /// names (1451).
+    /// One row of the class table: the type's name for the message, and its `TypeId`.
+    type ClassRow = (&'static str, fn() -> TypeId);
+
+    pub(crate) struct Classes {
+        /// The VM's own id, for the executor census.
+        pub vm: Option<ComponentId>,
+        pub non_send: HashSet<ComponentId>,
+        pub caches: HashSet<ComponentId>,
+        pub sinks: HashSet<ComponentId>,
+        pub streams: HashSet<ComponentId>,
+    }
+
+    impl Classes {
+        const CACHES: &[ClassRow] = &[
+            ("NameCache", TypeId::of::<crate::names::NameCache>),
+            (
+                "GameObjectTemplates",
+                TypeId::of::<crate::go_templates::GameObjectTemplates>,
+            ),
+            ("PageTexts", TypeId::of::<crate::ui_item_text::PageTexts>),
+            ("WorldAssets", TypeId::of::<benilla_assets::WorldAssets>),
+            ("Creatures", TypeId::of::<crate::entities::Creatures>),
+        ];
+        const SINKS: &[ClassRow] = &[
+            ("ChatLog", TypeId::of::<crate::ui_chat::ChatLog>),
+            ("MessageSounds", TypeId::of::<crate::sound::MessageSounds>),
+            ("UiErrorKeys", TypeId::of::<crate::ui_action::UiErrorKeys>),
+            ("UiErrorTexts", TypeId::of::<crate::ui_action::UiErrorTexts>),
+        ];
+        const STREAMS: &[ClassRow] = &[
+            ("SoundKits", TypeId::of::<crate::sound::SoundKits>),
+            // The client's ONE `rand()` stream (decision 2301). Four lanes draw from it — the
+            // placed-doodad host, the creature driver, the GameObject arm and the portrait booth —
+            // and in the reference they draw from one TLS cell in whatever order the frame runs
+            // them. The interleaving IS the mechanism: a shared sequence is what de-syncs a stand
+            // of identical props, and no consumer can observe which draw it got, only that it got
+            // a fresh one. So an undeclared order here is not a missing `.after`; declaring one
+            // would be inventing a determinism the reference does not have.
+            //
+            // It reduces the count by **nothing** today, and that is not an oversight: the three
+            // Update-side lanes already conflict on `Query<&mut AnimationPlayer>`, which no class
+            // explains, so every pair this row would cover is counted for that instead. It is the
+            // standing claim about the resource — what keeps these pairs from surfacing the day
+            // that other conflict is declared — not a saving.
+            ("AnimRng", TypeId::of::<benilla_assets::AnimRng>),
+        ];
+
+        /// Resolve the table against a world whose schedules have initialized (every param
+        /// has registered its resource by then). A row that resolves to nothing is a stale
+        /// row, and the test says which.
+        fn read(world: &World) -> Self {
+            let comps = world.components();
+            let resolve = |rows: &[ClassRow]| -> HashSet<ComponentId> {
+                rows.iter()
+                    .map(|(name, type_id)| {
+                        comps.get_resource_id(type_id()).unwrap_or_else(|| {
+                            panic!("`{name}` is in the class table but is not a resource of this world")
+                        })
+                    })
+                    .collect()
+            };
+            Self {
+                vm: comps.get_resource_id(TypeId::of::<benilla_ui::script::UiScript>()),
+                non_send: comps
+                    .iter_registered()
+                    .filter(|info| !info.is_send_and_sync())
+                    .map(|info| info.id())
+                    .collect(),
+                caches: resolve(Self::CACHES),
+                sinks: resolve(Self::SINKS),
+                streams: resolve(Self::STREAMS),
+            }
+        }
+
+        fn explains(&self, id: ComponentId) -> bool {
+            self.non_send.contains(&id)
+                || self.caches.contains(&id)
+                || self.sinks.contains(&id)
+                || self.streams.contains(&id)
+        }
+
+        /// Which class explains this pair — `None` if it is actionable.
+        pub fn class_of(&self, what: &[ComponentId]) -> Option<&'static str> {
+            if what.is_empty() {
+                return Some("exclusive");
+            }
+            if !what.iter().all(|id| self.explains(*id)) {
+                return None;
+            }
+            Some(if self.vm_only(what) {
+                "VM only"
+            } else if self.non_send_only(what) {
+                "non-Send owners"
+            } else if what.iter().all(|id| self.caches.contains(id)) {
+                "pure caches"
+            } else if what.iter().all(|id| self.sinks.contains(id)) {
+                "append-only sinks"
+            } else if what.iter().all(|id| self.streams.contains(id)) {
+                "random streams"
+            } else {
+                "mixed"
+            })
+        }
+
+        pub fn vm_only(&self, what: &[ComponentId]) -> bool {
+            what.iter().all(|id| Some(*id) == self.vm)
+        }
+
+        pub fn non_send_only(&self, what: &[ComponentId]) -> bool {
+            what.iter().all(|id| self.non_send.contains(id))
+        }
+    }
+
+    #[test]
+    fn the_client_builds_headless() {
+        let app = headless_client();
+        assert!(app.world().contains_resource::<Schedules>());
+    }
+
+    /// `PostUpdate`, 181 systems: `GlobalTransform` and the particle `EffectQuads` are most of it.
+    ///
+    /// **375 (MONKEY, the dynamic light and shadow system)** — upstream's own number is 351; this
+    /// branch adds **+24**, and the pairs were READ off the dump rather than reasoned about (the
+    /// lesson the `UPDATE_ACTIONABLE_CEILING` paragraphs paid for). `WOW_AMBIGUITY_DUMP_POST=1`
+    /// on this test prints them; three systems carry every one:
+    ///
+    /// - `entities::carried_light::track_carried_light_motion` (12 pairs) — the system that walks
+    ///   a torch's light to its carrier's hand. It meets `billboard::face_billboards`,
+    ///   `billboard_joint_palette`, `particles::{sim, model}`, `ribbons::simulate_ribbons`,
+    ///   `rig_anim::compose::finalize_rig_worlds`, the four sky/sun/moon/star followers,
+    ///   `nameplates::place_nameplates` and `raid_marks::place_raid_marks`.
+    /// - `lighting::global_light::classify_light_lanes` (12 pairs) — the interior/exterior lane
+    ///   classifier, against the same family for the same reason.
+    /// - `bevy_pbr::material::check_entities_needing_specialization` for the two shadow-proxy
+    ///   materials (`shadow_core::ShadowCasterMaterial`, `world_shadow::CutoutShadowCasterMaterial`)
+    ///   against `straddle::sync_straddle_twins` (2 pairs).
+    ///
+    /// **Every one of the 24 is over `GlobalTransform` (22) or `Mesh3d` (2), and both of ours are
+    /// READS.** Neither lighting system writes a transform: they ask where a light already is and
+    /// then write their own state (a `WorldPointLight`'s position, a `LightLane`). So the
+    /// undeclared order decides only whether a light is placed from this frame's pose or the last
+    /// one — the `AreaSpiritHealer` poll's class exactly (the 3,288 paragraph): both are
+    /// **level**-triggered, re-deriving from scratch every frame, so a frame-late read is a light
+    /// trailing a walking carrier by one stride, re-corrected on the next frame and invisible at
+    /// any frame rate the client runs at. The `Mesh3d` pair is Bevy's own specialization check
+    /// against a straddle twin, which is a read of the mesh handle on both sides.
+    ///
+    /// Declaring the orders instead would mean pinning two lighting systems after eleven unrelated
+    /// animation, particle and celestial-follow systems to buy a one-frame-fresher transform that
+    /// nothing can see — a real serialisation cost for no observable difference. Raised, with the
+    /// reason, as the failure message offers.
+    const POST_UPDATE_CEILING: usize = 375;
+    const POST_UPDATE_SLACK: usize = 20;
+    /// The **actionable** pairs in `Update` — two systems with conflicting access and no
+    /// declared order, where [`Classes`] explains none of what they share, so the executor
+    /// runs them in whatever order the graph around them happens to produce (B354, 2220). Same
+    /// shape as `world_api_wall.rs`: the count may not rise past the ceiling, and the ceiling
+    /// follows the count down. `WOW_AMBIGUITY_DUMP=1` prints every actionable pair with what
+    /// it fights over.
+    ///
+    /// **Measured 2026-09-17 (decision 2287), 662 systems:** 16,548 pairs in all, 12,849 of
+    /// them explained — 10,703 on the VM alone, 431 on the other non-`Send` owners, 556 on
+    /// the pure caches, 87 on the sinks, 41 on the stream, 1,031 on a mix of those — and
+    /// 3,699 actionable. The largest part of those is `Transform` on disjoint lanes (716 pairs
+    /// alone): populations that never intersect, which the filter algebra cannot see. A lane
+    /// is not a class — the checker cannot tell a disjoint lane from two writers of the same
+    /// entity — so they stay here, and each new one is a claim made at the registration with
+    /// its reason:
+    ///
+    /// - **2281:** the ranged prop's two `AnimationPlayer` writers against the booth's and the
+    ///   quest markers' (four lanes; the held weapon, a booth model, a marker).
+    /// - **2282:** the three fx attaches against the mat-anim tick and its probe, over
+    ///   `MatAnimTable`/`UvAnimMaterials` — immaterial by construction, because attach writes
+    ///   the rows a tick would, off the same clock.
+    /// - **2295:** the same two readers against `entities::update_display_models` and
+    ///   `entities::attach::attach_entity_visuals`, over the same two resources, now that the
+    ///   entity lane registers its own texture transform. **+4**, measured pair by pair on the
+    ///   rebased tree rather than assumed additive — both writers already held
+    ///   `Assets<WowModelMaterial>`, so most of the systems they newly meet were already
+    ///   ambiguous against them for another reason, and `redress_player_looks` takes the
+    ///   identical three resources and adds no pair at all. Immaterial for 2282's reason plus
+    ///   one: a display is built ONCE, the frame its asset lands, and a row left unwritten for
+    ///   a frame reads as the material's own built seed — the batch's authored `t = 0`, not a
+    ///   wrong value — because the same call seeds `sun_scale.zw` at the loop's opening.
+    ///
+    /// **3,280 (decision 2288)** — the one query cache: a read that asks marks its miss through
+    /// `&self`, so a feed that only resolves a name or a template holds the owner shared, and
+    /// its pairs over `Items` (725 → 104, the largest non-class resource in the count) are gone;
+    /// the pairs over the pure caches moved into the VM-only class, where the same systems still
+    /// meet over the VM alone.
+    ///
+    /// **3,288 (decision 2291, corrected)** — the area-spirit-healer poll. Its **four** remaining
+    /// pairs, named one by one because the first version of this paragraph named the wrong ones:
+    /// `portrait::booth::face_booth_billboards`, `quest_markers::bake_seat_scale` and
+    /// `entities::live_display::tick_scale_ease` over `Transform`, and
+    /// `entities::live_display::refresh_live_display` over **`NetEntity`** — a row read, not a
+    /// `Transform` pair at all. All four are the poll seeing a unit one mover early or late, which
+    /// moves a 20 yd acquire decision by at most one frame of walking; the poll is
+    /// **level**-triggered, re-deriving the whole cache every frame, so a boundary case decided
+    /// early is decided again next frame. The target scanner carries the same class for the same
+    /// reason.
+    ///
+    /// **The correction is the part worth keeping.** This paragraph first claimed "+6, all
+    /// `&Transform`", and that the poll's "one write-write pair … is *declared*". Both were wrong,
+    /// and the second one hid a real defect. There were **two** undeclared write-write pairs, and
+    /// the system on the other side of both was `drain_latch_verbs` — the one that turns
+    /// `AcceptAreaSpiritHeal()` into `CMSG_AREA_SPIRIT_HEALER_QUEUE`. It met the poll *and*
+    /// `target::click::act_on_right_click` over `AreaSpiritHealer`, because `.after(UiInput)`
+    /// orders it against neither (`UiInput` precedes `WorldStage::Input`; `TargetUpdate` follows
+    /// it). The drain takes its presses unconditionally and only then reads the healer, so that
+    /// undeclared order decided whether a ghost's Accept became a packet or vanished with no
+    /// message. Declaring `drain_latch_verbs.before(TargetUpdate)` — the reference's own order, the
+    /// dialog's Lua handler running in the UI dispatch ahead of `CGWorldFrame`'s poll and pick —
+    /// removed exactly those two.
+    ///
+    /// **Re-measured at 3,289 on the rebased tree**, not carried across as arithmetic. This branch
+    /// measured 3,290 → 3,288 on its own base; a neighbour landed 3,291 first, and the resolution
+    /// is the number the dump prints on the merged tree — which happens to agree with 3,291 − 2
+    /// this time, and is right for the reason that it was read rather than that it adds up.
+    ///
+    /// A ceiling raised with the wrong reason is a ratchet that has stopped meaning anything. The
+    /// lesson this one cost: **read the dump, do not reason about what the new pairs must be.**
+    ///
+    /// **3,291 (decision 2300)** — the glue create/main-menu scene's material lane: exactly **one**
+    /// new pair, `ui_models::forget_dead_vm_tiles` against `portrait::glue_booth::sync_glue_scene`
+    /// over `MatAnimTable`, measured pair by pair on the tree that lands rather than assumed
+    /// additive (the scene builder's other three new resources add none — it already held
+    /// `RigPalettes` and `Assets<WowModelMaterial>`, so the systems they newly meet were already
+    /// ambiguous against it). Immaterial by construction, and narrowly: `MatAnimTable` is a slot
+    /// **allocator**, one owner per slot. A tile reaping its dead rows and the scene claiming
+    /// fresh ones touch disjoint slots and neither reads the other's; the only thing the order
+    /// decides is *which* free slot the scene is handed, and a slot number is not observable —
+    /// the row behind it is, and it is written by whoever owns it. A scene is also built **once**,
+    /// the frame its model asset lands, against a reaper that fires only when a tile dies.
+    ///
+    /// Raising this ceiling is a claim that a new undeclared order is acceptable; make it with
+    /// the reason, or declare the order instead (`.after`, a set, a `chain`). If the pair is
+    /// about a resource that commutes by construction, the claim belongs in [`Classes`].
+    const UPDATE_ACTIONABLE_CEILING: usize = 2_975;
+    const UPDATE_ACTIONABLE_SLACK: usize = 40;
+
+    fn ratchet(what: &str, n: usize, ceiling: usize, slack: usize) {
+        eprintln!("{what}: {n} ambiguous pairs (ceiling {ceiling}, slack {slack})");
+        assert!(
+            n <= ceiling,
+            "{n} ambiguous pairs in {what}; the ceiling is {ceiling}. A new system runs in an \
+             undeclared order against something it shares state with — declare the order \
+             (`.after`, a set, a `chain`), or raise the ceiling here with the reason. \
+             `WOW_AMBIGUITY_DUMP=1` on this test lists the pairs; a resource that commutes by \
+             construction belongs in `Classes` instead (decisions 2279, 2287)."
+        );
+        assert!(
+            n + slack >= ceiling,
+            "only {n} ambiguous pairs in {what} and the ceiling still says {ceiling}. Lower the \
+             ceiling to {n} so it keeps ratcheting."
+        );
+    }
+
+    /// The ratchet. Ids, not names, so it runs in the player build too; prints the class
+    /// census beside the number it holds.
+    #[test]
+    fn the_schedules_have_no_more_undeclared_orders_than_the_ceilings_say() {
+        let mut app = headless_client();
+        let update = census(&mut app, Update);
+        let post = census(&mut app, PostUpdate);
+        let mut explained: BTreeMap<&str, usize> = BTreeMap::new();
+        let mut actionable = Vec::new();
+        for (a, b, what) in &update.conflicts {
+            match update.classes.class_of(what) {
+                Some(class) => *explained.entry(class).or_default() += 1,
+                None => actionable.push((*a, *b, what)),
+            }
+        }
+        eprintln!(
+            "Update: {} systems, {} ambiguous pairs; {} explained ({}); {} actionable",
+            update
+                .systems
+                .values()
+                .filter(|s| !is_sync_point(&s.name))
+                .count(),
+            update.conflicts.len(),
+            update.conflicts.len() - actionable.len(),
+            explained
+                .iter()
+                .map(|(class, n)| format!("{n} {class}"))
+                .collect::<Vec<_>>()
+                .join(", "),
+            actionable.len(),
+        );
+        if std::env::var_os("WOW_AMBIGUITY_DUMP").is_some() {
+            let mut rows: Vec<String> = actionable
+                .iter()
+                .map(|(a, b, what)| {
+                    format!(
+                        "  {}  <->  {}\n      on {}",
+                        update.name(*a),
+                        update.name(*b),
+                        what.iter()
+                            .map(|id| update.component(*id))
+                            .collect::<Vec<_>>()
+                            .join(", ")
+                    )
+                })
+                .collect();
+            rows.sort();
+            for r in rows {
+                eprintln!("{r}");
+            }
+        }
+        // MONKEY (lighting): the `PostUpdate` half of the dump, which upstream's `Update`-only
+        // lever had no equivalent of — and without which `POST_UPDATE_CEILING` could only ever be
+        // raised by reasoning about what the new pairs must be, the exact mistake the ceiling's
+        // own comments record. Its own env var, not `WOW_AMBIGUITY_DUMP`, because `PostUpdate`
+        // prints every pair (there is no `Classes` pass over it) and 375 rows would bury the
+        // actionable `Update` list this test is usually run for.
+        if std::env::var_os("WOW_AMBIGUITY_DUMP_POST").is_some() {
+            let mut rows: Vec<String> = post
+                .conflicts
+                .iter()
+                .map(|(a, b, what)| {
+                    format!(
+                        "POST  {}  <->  {}\n      on {}",
+                        post.name(*a),
+                        post.name(*b),
+                        what.iter()
+                            .map(|id| post.component(*id))
+                            .collect::<Vec<_>>()
+                            .join(", ")
+                    )
+                })
+                .collect();
+            rows.sort();
+            for r in rows {
+                eprintln!("{r}");
+            }
+        }
+        ratchet(
+            "Update (actionable)",
+            actionable.len(),
+            UPDATE_ACTIONABLE_CEILING,
+            UPDATE_ACTIONABLE_SLACK,
+        );
+        ratchet(
+            "PostUpdate",
+            post.conflicts.len(),
+            POST_UPDATE_CEILING,
+            POST_UPDATE_SLACK,
+        );
+    }
+
+    /// The `ApplyDeferred` the build inserts between a system with commands and its dependents.
+    fn is_sync_point(name: &str) -> bool {
+        name == "bevy_ecs::apply_deferred"
+    }
+
+    /// **How parallel could `Update` be?** A greedy list schedule with unlimited threads: each
+    /// wave takes every system whose predecessors have run and that shares no undeclared
+    /// conflict with a system already in the wave; non-`Send` systems are pairwise exclusive
+    /// besides (the multi-threaded executor runs them one at a time on the main thread). The
+    /// wave count is the frame's serial depth under that executor; the longest declared chain
+    /// is its floor. Returned as `(waves, critical_path)`.
+    fn waves(
+        c: &Census,
+        keep_conflict: impl Fn(&[ComponentId]) -> bool,
+        non_send: &[SystemKey],
+    ) -> (usize, usize) {
+        use std::collections::{HashMap, HashSet};
+        // The build-inserted sync points are left out: they are exclusive barriers the build
+        // places from the flattened graph, which this model does not see; their count is
+        // reported beside the waves instead.
+        let mut order: Vec<SystemKey> = c
+            .systems
+            .iter()
+            .filter(|(_, s)| !is_sync_point(&s.name))
+            .map(|(k, _)| *k)
+            .collect();
+        order.sort_by(|a, b| c.name(*a).cmp(c.name(*b)));
+        let mut preds: HashMap<SystemKey, Vec<SystemKey>> = HashMap::new();
+        for (a, b) in &c.dependencies {
+            preds.entry(*b).or_default().push(*a);
+        }
+        let mut exclusive: HashMap<SystemKey, HashSet<SystemKey>> = HashMap::new();
+        for (a, b, what) in &c.conflicts {
+            if keep_conflict(what) {
+                exclusive.entry(*a).or_default().insert(*b);
+                exclusive.entry(*b).or_default().insert(*a);
+            }
+        }
+        for (i, a) in non_send.iter().enumerate() {
+            for b in &non_send[i + 1..] {
+                exclusive.entry(*a).or_default().insert(*b);
+                exclusive.entry(*b).or_default().insert(*a);
+            }
+        }
+        let mut done: HashSet<SystemKey> = HashSet::new();
+        let mut waves = 0;
+        while done.len() < order.len() {
+            let mut wave: Vec<SystemKey> = Vec::new();
+            for k in &order {
+                if done.contains(k) {
+                    continue;
+                }
+                let ready = preds
+                    .get(k)
+                    .is_none_or(|p| p.iter().all(|x| done.contains(x)));
+                if !ready {
+                    continue;
+                }
+                let clash = exclusive
+                    .get(k)
+                    .is_some_and(|ex| wave.iter().any(|w| ex.contains(w)));
+                if !clash {
+                    wave.push(*k);
+                }
+            }
+            assert!(
+                !wave.is_empty(),
+                "no system is ready — the dependency graph has a cycle"
+            );
+            done.extend(wave.iter().copied());
+            waves += 1;
+        }
+        // The longest declared chain, by depth over the dependency DAG.
+        let mut depth: HashMap<SystemKey, usize> = HashMap::new();
+        fn depth_of(
+            k: SystemKey,
+            preds: &HashMap<SystemKey, Vec<SystemKey>>,
+            depth: &mut HashMap<SystemKey, usize>,
+        ) -> usize {
+            if let Some(d) = depth.get(&k) {
+                return *d;
+            }
+            let d = 1 + preds
+                .get(&k)
+                .map(|p| {
+                    p.iter()
+                        .map(|x| depth_of(*x, preds, depth))
+                        .max()
+                        .unwrap_or(0)
+                })
+                .unwrap_or(0);
+            depth.insert(k, d);
+            d
+        }
+        let critical = order
+            .iter()
+            .map(|k| depth_of(*k, &preds, &mut depth))
+            .max()
+            .unwrap_or(0);
+        (waves, critical)
+    }
+
+    /// The structural half of 2265 §A3's executor question — is the prize of collapsing the VM
+    /// (and the audio layer) to one `Send` owner correctness only, or correctness plus
+    /// parallelism? Prints the serial depth of `Update` today and under each collapse.
+    #[test]
+    fn concurrency_census() {
+        let mut app = headless_client();
+        let c = census(&mut app, Update);
+        let holds = |k: SystemKey, pick: &dyn Fn(ComponentId) -> bool| {
+            c.conflicts
+                .iter()
+                .any(|(a, b, w)| (*a == k || *b == k) && w.iter().any(|id| pick(*id)))
+        };
+        let vm: Vec<SystemKey> = c
+            .non_send
+            .iter()
+            .copied()
+            .filter(|k| c.holds_vm.contains(k))
+            .collect();
+        let audio: Vec<SystemKey> = c
+            .non_send
+            .iter()
+            .copied()
+            .filter(|k| {
+                holds(*k, &|id| {
+                    c.classes.non_send.contains(&id) && Some(id) != c.classes.vm
+                })
+            })
+            .collect();
+        let other_non_send: Vec<SystemKey> = c
+            .non_send
+            .iter()
+            .copied()
+            .filter(|k| !vm.contains(k) && !audio.contains(k))
+            .collect();
+        let real = c
+            .systems
+            .values()
+            .filter(|s| !is_sync_point(&s.name))
+            .count();
+        eprintln!(
+            "Update: {real} systems; {} non-Send ({} touch the VM, {} the audio layer, {} neither); {} declared edges; {} ambiguous pairs",
+            c.non_send.len() - c.non_send.iter().filter(|k| is_sync_point(c.name(**k))).count(), vm.len(), audio.len(), other_non_send.len() - c.non_send.iter().filter(|k| is_sync_point(c.name(**k))).count(), c.dependencies.len(), c.conflicts.len()
+        );
+        let sync_points = c
+            .systems
+            .values()
+            .filter(|s| is_sync_point(&s.name))
+            .count();
+        let mut neither: Vec<&str> = other_non_send
+            .iter()
+            .map(|k| c.name(*k))
+            .filter(|n| !is_sync_point(n))
+            .collect();
+        neither.sort_unstable();
+        eprintln!(
+            "  {sync_points} auto-inserted ApplyDeferred sync points (exclusive barriers); other non-Send: {}",
+            neither.join(", ")
+        );
+        let (w0, cp) = waves(&c, |_| true, &c.non_send);
+        eprintln!("  as-is:                 {w0} waves (critical path {cp})");
+        let not_vm: Vec<SystemKey> = c
+            .non_send
+            .iter()
+            .copied()
+            .filter(|k| !vm.contains(k) || audio.contains(k))
+            .collect();
+        let (w1, _) = waves(&c, |w| !c.classes.vm_only(w), &not_vm);
+        eprintln!("  VM Send-owned:         {w1} waves");
+        let (w2, _) = waves(&c, |w| !c.classes.non_send_only(w), &other_non_send);
+        eprintln!("  VM + audio Send-owned: {w2} waves");
+        let (w3, _) = waves(&c, |_| false, &[]);
+        eprintln!("  declared edges only:   {w3} waves (every conflict ordered, everything Send)");
+    }
+
+    /// Why a system that holds the VM in `Update` and is ordered before the tick may stay OUT
+    /// of [`crate::ui_script::UiFeed`] — keyed by a suffix of the system's full name, with the
+    /// reason. Read beside [`every_vm_holder_in_update_declares_its_side_of_the_tick`].
+    /// Empty at 2304: every holder ordered before the tick joined the phase (`ui_session::
+    /// feed_interact_npc`, seated inside `WorldStage::Net` for decision 2022's reason, looked
+    /// like the one exception and is not — it writes a resource the unit feed reads, and
+    /// never holds the VM).
+    const OUTSIDE_THE_FEED_PHASE: &[(&str, &str)] = &[];
+
+    /// **Every system that holds the VM in `Update` declares its side of the tick** (decision
+    /// 2304). The VM ticks once a frame (`extract::tick_script`, in `UiInput`): a push the tick
+    /// must see rides `UiFeed`, which the plugin chains after the net drain and before the
+    /// tick; a drain of what the tick produced is `.after(UiInput)`. Read off the built graph,
+    /// so a membership through a parent set and an order through a chain both count. Three
+    /// things fail here: a holder with no declared path to or from the tick; one ordered
+    /// before the tick without riding the feed phase — so it may run before this frame's
+    /// packets land, the class 2265 §A3 counted as "ordered only against `UiInput`" — unless
+    /// it is argued in [`OUTSIDE_THE_FEED_PHASE`]; and a feed-phase member the graph does not
+    /// actually place after the drain and before the tick, the set's contract checked rather
+    /// than trusted. A row arguing a system the graph places elsewhere fails too.
+    #[test]
+    fn every_vm_holder_in_update_declares_its_side_of_the_tick() {
+        let mut app = headless_client();
+        let c = census(&mut app, Update);
+        if !type_names_available(&c) {
+            eprintln!(
+                "skipped: this build carries no type names (bevy/debug rides with dev, 1451)"
+            );
+            return;
+        }
+        let one = |suffix: &str| -> SystemKey {
+            let mut hits = c.systems.iter().filter(|(_, s)| s.name.ends_with(suffix));
+            match (hits.next(), hits.next()) {
+                (Some((k, _)), None) => *k,
+                _ => panic!("exactly one system named `…{suffix}` in Update"),
+            }
+        };
+        let tick = one("::extract::tick_script");
+        let drain = one("::net::apply::apply_net_updates");
+        let mut succ: HashMap<SystemKey, Vec<SystemKey>> = HashMap::new();
+        let mut pred: HashMap<SystemKey, Vec<SystemKey>> = HashMap::new();
+        for (a, b) in &c.dependencies {
+            succ.entry(*a).or_default().push(*b);
+            pred.entry(*b).or_default().push(*a);
+        }
+        let reach = |start: SystemKey, edges: &HashMap<SystemKey, Vec<SystemKey>>| {
+            let mut seen = HashSet::new();
+            let mut stack = vec![start];
+            while let Some(n) = stack.pop() {
+                for m in edges.get(&n).into_iter().flatten() {
+                    if seen.insert(*m) {
+                        stack.push(*m);
+                    }
+                }
+            }
+            seen
+        };
+        let before_tick = reach(tick, &pred);
+        let after_tick = reach(tick, &succ);
+        let after_drain = reach(drain, &succ);
+        let mut holders: Vec<SystemKey> = c.holds_vm.iter().copied().collect();
+        holders.sort_by(|a, b| c.name(*a).cmp(c.name(*b)));
+        let (mut feed, mut post, mut argued) = (0, 0, 0);
+        let mut offenders = Vec::new();
+        let mut stale = Vec::new();
+        for k in &holders {
+            if *k == tick {
+                continue;
+            }
+            let s = &c.systems[k];
+            let in_feed = s.sets.iter().any(|set| set == "UiFeed");
+            let row = OUTSIDE_THE_FEED_PHASE
+                .iter()
+                .find(|(suffix, _)| s.name.ends_with(suffix));
+            if in_feed {
+                feed += 1;
+                if !(after_drain.contains(k) && before_tick.contains(k)) {
+                    offenders.push(format!(
+                        "{}: in `UiFeed`, but the graph does not place it after the net drain and before the tick",
+                        s.name
+                    ));
+                }
+            } else if after_tick.contains(k) {
+                post += 1;
+            } else if before_tick.contains(k) {
+                if row.is_some() {
+                    argued += 1;
+                    continue;
+                }
+                offenders.push(format!(
+                    "{}: ordered before the tick but not in `UiFeed` — it may run before this frame's packets land; `.in_set(UiFeed)`",
+                    s.name
+                ));
+            } else {
+                offenders.push(format!(
+                    "{}: no declared side of the tick — `.in_set(UiFeed)` for a push the tick must see this frame, `.after(UiInput)` for a drain of what the tick produced",
+                    s.name
+                ));
+            }
+            if row.is_some() {
+                stale.push(format!(
+                    "{}: argued in OUTSIDE_THE_FEED_PHASE but the graph places it {} — drop the row",
+                    s.name,
+                    if in_feed {
+                        "in the feed phase"
+                    } else {
+                        "after the tick"
+                    }
+                ));
+            }
+        }
+        for (suffix, _) in OUTSIDE_THE_FEED_PHASE {
+            if !holders.iter().any(|k| c.name(*k).ends_with(suffix)) {
+                stale.push(format!(
+                    "`…{suffix}` is not a VM holder in Update — drop its row"
+                ));
+            }
+        }
+        eprintln!(
+            "VM holders in Update: {} — the tick, {feed} in the feed phase, {post} after the tick, {argued} argued outside the phase",
+            holders.len()
+        );
+        assert!(
+            offenders.is_empty(),
+            "these systems hold the VM in `Update` without declaring their side of the tick \
+             (decision 2304):\n  {}",
+            offenders.join("\n  ")
+        );
+        assert!(stale.is_empty(), "stale rows:\n  {}", stale.join("\n  "));
+    }
+
+    /// The consumer markers 2220's census used: a system that holds the VM and does one of
+    /// these to host state has spent something this frame that nothing can re-spend.
+    const CONSUMES: &[&str] = &["fire_event(", "mem::take(", ".drain("];
+
+    /// Why a one-shot consumer that holds the VM and is NOT gated on `ingame_ui_up` cannot lose
+    /// anything in 2214's one-frame window — 2232's discriminator, as a type. (In that window
+    /// the wire is in-world and the boot VM is still live and frameless, so a one-shot spent
+    /// then is published to a VM with nothing to show it.)
+    #[derive(Debug, Clone, Copy, PartialEq, Eq)]
+    enum Because {
+        /// The consumed queue is filled only by Lua asking; a frameless VM asks for nothing.
+        FilledByVm,
+        /// Filled only by a server reply to something the player had to click in the interface
+        /// — or, noted in the reason, by another player's act on us, which can share a drain
+        /// with the login burst only by coincidence (the residual 2279 names).
+        PlayerRoundTrip,
+        /// Consumed in the window or not, the state is re-asked or re-derived once the UI is up.
+        SelfHealing,
+        /// The publication is driven by a `VmMemo` diff, so a new VM re-derives and re-fires it
+        /// (decision 2226).
+        MemoLatched,
+        /// Documented at the line as intentional.
+        Deliberate,
+    }
+
+    /// Every one-shot consumer that holds the VM, is not gated on `ingame_ui_up` (by its own
+    /// run condition or a set's — read off the real schedule, not off the registration text),
+    /// and is not a memo-diffed `fire_event` — each with the reason it is safe. Keyed
+    /// `(path under src/, fn)`. Audited 2026-09-16 (decision 2279) against the fill sites;
+    /// the reason names them. Adding a consumer the ordinary way (gated) passes; adding one
+    /// ungated fails here, at the line, until it is either gated or argued.
+    const EXEMPT: &[(&str, &str, Because, &str)] = &[
+        ("bindings.rs", "sync_dispatch", Because::MemoLatched,
+         "`seen_generation` is a `VmMemo`: a new VM reads `None`, rebuilds and re-fires UPDATE_BINDINGS"),
+        ("capture/probe_bg.rs", "bg_probe", Because::SelfHealing,
+         "the battleground probe: dev-only (`WOW_PROBE_BG`, `cfg(feature = \"dev\")`) so it is not in a player build at all, and its `mem::take` is of its OWN pending-events string, not a queue anything else fills. Its one real VM dependency is the Lua event tap, which self-heals: `EVENT_DRAIN` returns a `<tap-gone>` sentinel when the tap's globals are missing — the case this window causes, since a tap installed in the boot VM is discarded when `mint_entry_vm` builds the interface — and the probe re-installs on the next frame"),
+        ("death.rs", "feed_death", Because::MemoLatched,
+         "`feed.vm: VmMemo<DeathAnnounced>`: a fresh memo makes the first snapshot an edge and re-announces a held offer, confirm and corpse range"),
+        ("screenshot.rs", "ask_for_captures", Because::FilledByVm,
+         "`pending` holds only the VM's own `Screenshot()` asks, and the take spawns a capture, publishing nothing"),
+        ("screenshot.rs", "report_captures", Because::FilledByVm,
+         "the outcome chain starts with the VM's own `Screenshot()` call"),
+        ("tutorial.rs", "drain_tutorials", Because::FilledByVm,
+         "`sends` exist only after Lua acknowledged, cleared or reset a flag, and go to the wire"),
+        ("ui_action/drain.rs", "drain_go_openers", Because::FilledByVm,
+         "filled only by a world right-click on a GameObject; the drain sends casts to the wire (2232's own bucket)"),
+        ("ui_auction/mod.rs", "drain_auction", Because::FilledByVm,
+         "VM verbs; the refresh flags act only under an open window and become wire re-asks"),
+        ("ui_bank.rs", "feed_bank", Because::PlayerRoundTrip,
+         "`BankErrors` answers a `BuyBankSlot` click; the OPENED edge rides `VmMemo`s"),
+        ("ui_battlefield.rs", "feed_battlefield", Because::SelfHealing,
+         "`reset_on_world_enter` runs before it, clears the session and re-sends `BattlefieldStatusRequest`"),
+        ("ui_binder.rs", "feed_binder", Because::PlayerRoundTrip,
+         "`SMSG_BINDER_CONFIRM` only answers the innkeeper's gossip line"),
+        ("ui_char.rs", "feed_char", Because::MemoLatched,
+         "`feed.vm: VmMemo<CharFeedMemo>`; `vm_reset` fires every transition on a fresh memo"),
+        ("ui_chat/recruitment.rs", "guild_recruitment_cascade", Because::SelfHealing,
+         "`pending` is held until the zone mask and zone id are settled, which happens on the entry VM"),
+        ("ui_dialog_verbs.rs", "feed_meeting_stone", Because::SelfHealing,
+         "the query is sent once per VM (`asked: VmMemo<bool>`), so the entry VM re-asks and the reply lands after the UI is up"),
+        ("ui_duel.rs", "feed_duel", Because::PlayerRoundTrip,
+         "a duel exists only after someone's Duel cast, and the server ends any duel at logout; FINISHED/bounds ride `VmMemo<FedDuel>` (another player's act: coincidence-only residual)"),
+        ("ui_follow.rs", "feed_follow", Because::MemoLatched,
+         "`feed.vm: VmMemo<FollowFeedMemo>`; a fresh VM re-fires BEGIN for a follow in progress"),
+        ("ui_gm_ticket.rs", "feed_gm_ticket", Because::MemoLatched,
+         "`feed.vm: VmMemo<FedTicket>` counters restart per VM while `state.answers` keeps counting, so the latest answer is re-fired"),
+        ("ui_honor.rs", "feed_honor", Because::MemoLatched,
+         "`state.vm: VmMemo<HonorFeedMemo>`; `events_for(None, ..)` re-fires both events on a fresh VM"),
+        ("ui_inspect.rs", "feed_inspect", Because::MemoLatched,
+         "the token is latched only by Lua's `NotifyInspect`, and the diffs ride a `VmMemo`"),
+        ("ui_item_text.rs", "drain_item_text", Because::FilledByVm,
+         "page turns and close are Lua intents"),
+        ("ui_item_text.rs", "feed_item_text", Because::MemoLatched,
+         "`told` is a `VmMemo` inside the session (a fresh VM re-begins), and the open is a player click"),
+        ("ui_items/drain.rs", "drain_container_destroys", Because::FilledByVm,
+         "`take_container_destroys` is a VM-owned queue filled by Lua's `DeleteCursorItem`"),
+        ("ui_items/drain.rs", "drain_container_uses", Because::FilledByVm,
+         "`take_container_uses` and `take_container_repairs` are Lua intents held by the VM"),
+        ("ui_logout.rs", "feed_logout", Because::PlayerRoundTrip,
+         "both packets answer the `CMSG_LOGOUT_REQUEST`/cancel the game menu sent"),
+        ("ui_loot.rs", "drain_loot", Because::Deliberate,
+         "the pre-VM take of `LootMoveStart` is documented at the line and publishes nothing to the VM; the event-firing takes are Lua's queues"),
+        ("ui_loot_roll.rs", "drain_loot_rolls", Because::FilledByVm,
+         "only a Need/Greed/Pass click queues a confirm or vote, held in the VM"),
+        ("ui_loot_roll.rs", "feed_loot_rolls", Because::PlayerRoundTrip,
+         "a roll exists only after a group member loots under group loot (2232's bucket); leftovers are cleared at socket teardown (another player's act: coincidence-only residual)"),
+        ("ui_macro/mod.rs", "load_macros", Because::MemoLatched,
+         "`MacroFiles.identity` is a `VmMemo`, so a new session re-reads the files and re-fires UPDATE_MACROS; also `InWorldGated`"),
+        ("ui_macro/mod.rs", "save_dirty_macros", Because::FilledByVm,
+         "`take_macros_dirty` is raised only by the macro window's Lua"),
+        ("ui_mail/mod.rs", "feed_mail", Because::SelfHealing,
+         "the window queues are mailbox-click replies; the one server push (`SMSG_RECEIVED_MAIL`) is re-asked by `send_query_next_mail_time_on_enter`, whose reply sets `notify` unconditionally"),
+        ("ui_merchant.rs", "feed_merchant", Because::PlayerRoundTrip,
+         "a buy/sell refusal answers a click on an open merchant; show/update ride `VmMemo`s"),
+        ("ui_petition/feed.rs", "feed_petition", Because::PlayerRoundTrip,
+         "every line answers a charter action of ours; the window edges ride the `fed` memo"),
+        ("ui_quest_share.rs", "feed_quest_share", Because::PlayerRoundTrip,
+         "a verdict answers our own push and a confirm follows a party member's escort accept, both held until the name resolves (the confirm is another player's act: coincidence-only residual)"),
+        ("ui_script/extract/mod.rs", "paint_script", Because::Deliberate,
+         "per-frame paint and cost state, not a queue (2232)"),
+        ("ui_social/feed.rs", "feed_social", Because::MemoLatched,
+         "the login-burst lists are re-announced to a new VM by `fed.seeded` (`VmMemo<FedSocial>`); the show flag is Lua's; a status line waits on the name resolve"),
+        ("ui_stable.rs", "feed_stable", Because::PlayerRoundTrip,
+         "both packets follow a stable master's gossip and a click in its window"),
+        ("ui_summon.rs", "feed_summon", Because::PlayerRoundTrip,
+         "only another player's Ritual of Summoning latches the ask (2232's duel shape; coincidence-only residual)"),
+        ("ui_tabard.rs", "drain_tabard", Because::FilledByVm,
+         "the intents are Lua's; the event answers a Save intent"),
+        ("ui_tabard.rs", "feed_tabard", Because::PlayerRoundTrip,
+         "every latch follows a tabard-vendor click, and `reset_on_world_enter` zeroes the resource on entry"),
+        ("ui_talent_wipe.rs", "feed_talent_wipe", Because::PlayerRoundTrip,
+         "`MSG_TALENT_WIPE_CONFIRM` answers the trainer's gossip option"),
+        ("ui_taxi/mod.rs", "feed_taxi", Because::PlayerRoundTrip,
+         "both packets follow talking to a flight master (2232's own example)"),
+        ("ui_tradeskill.rs", "drain_trade_skill", Because::FilledByVm,
+         "every consumed queue is Lua's; the cast-event continuation is inert until a Lua `DoTradeSkill` latched a count"),
+        ("ui_trainer/mod.rs", "feed_trainer", Because::PlayerRoundTrip,
+         "a refusal answers a Train click and a list answers a trainer gossip click; the edges ride `VmMemo`s"),
+    ];
+
+    /// `ui_chat/feed.rs` → `ui_chat::feed`; `target/mod.rs` → `target`; `lib.rs` → ``.
+    fn module_of(rel: &str) -> String {
+        let no_ext = rel.trim_end_matches(".rs");
+        let no_mod = no_ext.trim_end_matches("/mod");
+        if no_mod == "lib" {
+            String::new()
+        } else {
+            no_mod.replace('/', "::")
+        }
+    }
+
+    /// **Every one-shot consumer that holds the VM is gated, memo-latched, or argued** (2220's
+    /// proposed test, built on the real schedule rather than on the registration text — which
+    /// is why 2220 refused a mechanical pass: `.run_if(ingame_ui_up)` on a set, on a tuple, or
+    /// on the member all read differently in source and identically here). A consumer is one
+    /// of 2220's census: a system taking `NonSend[Mut]<UiScript>` whose body has a
+    /// [`CONSUMES`] marker. It passes if the schedule shows `ingame_ui_up` on it or on a set
+    /// above it, or if it is a `fire_event` driven by a `VmMemo` parameter, or if it is in
+    /// [`EXEMPT`] with its reason. An `EXEMPT` row for a system that is gated after all, or
+    /// that no longer consumes, fails too — the table describes the tree, not its history.
+    #[test]
+    fn every_one_shot_consumer_that_holds_the_vm_is_gated_or_argued() {
+        use crate::test_support::{fn_items, rel_path, rust_files, src_dir};
+        let mut consumers = Vec::new();
+        for file in rust_files(&src_dir()) {
+            let text = std::fs::read_to_string(&file).expect("readable source");
+            if !text.contains("UiScript") {
+                continue;
+            }
+            let rel = rel_path(&file);
+            for f in fn_items(&text) {
+                let holds_vm = f.params.contains("NonSendMut<UiScript>")
+                    || f.params.contains("NonSend<UiScript>");
+                if !holds_vm || !CONSUMES.iter().any(|m| f.body.contains(m)) {
+                    continue;
+                }
+                let takes = f.body.contains("mem::take(") || f.body.contains(".drain(");
+                let memo = f.params.contains("VmMemo<");
+                consumers.push((rel.clone(), f.name.to_string(), takes, memo));
+            }
+        }
+        let mut app = headless_client();
+        let update = census(&mut app, Update);
+        if !type_names_available(&update) {
+            eprintln!(
+                "skipped: this build carries no type names (bevy/debug rides with dev, 1451)"
+            );
+            return;
+        }
+        let post = census(&mut app, PostUpdate);
+        let by_name: HashMap<&str, &SystemInfo> = update
+            .systems
+            .values()
+            .chain(post.systems.values())
+            .map(|s| (s.name.as_str(), s))
+            .collect();
+        let mut gated = 0;
+        let mut latched = 0;
+        let mut argued = 0;
+        let mut offenders = Vec::new();
+        let mut stale: Vec<String> = Vec::new();
+        consumers.sort();
+        for (rel, name, takes, memo) in &consumers {
+            let module = module_of(rel);
+            let full = if module.is_empty() {
+                format!("benilla_app::{name}")
+            } else {
+                format!("benilla_app::{module}::{name}")
+            };
+            let info = by_name.get(full.as_str()).copied().or_else(|| {
+                let suffix = format!("::{name}");
+                let mut hits = by_name.iter().filter(|(k, _)| k.ends_with(&suffix));
+                match (hits.next(), hits.next()) {
+                    (Some((_, v)), None) => Some(*v),
+                    _ => None,
+                }
+            });
+            let exempt = EXEMPT.iter().find(|(p, f, _, _)| p == rel && f == name);
+            let is_gated =
+                info.is_some_and(|i| i.conditions.iter().any(|c| c.ends_with("::ingame_ui_up")));
+            if is_gated {
+                gated += 1;
+                if exempt.is_some() {
+                    stale.push(format!(
+                        "{rel}: `{name}` is gated on `ingame_ui_up` now — drop its EXEMPT row"
+                    ));
+                }
+            } else if !*takes && *memo {
+                latched += 1;
+                if exempt.is_some() {
+                    stale.push(format!(
+                        "{rel}: `{name}` is a memo-diffed fire_event — drop its EXEMPT row"
+                    ));
+                }
+            } else if exempt.is_some() {
+                argued += 1;
+            } else {
+                // Name the sets it is under: the fix is usually a gate on one of them.
+                let where_ = match info {
+                    None => " (not found in Update/PostUpdate)".to_string(),
+                    Some(i) => {
+                        let named: Vec<&str> = i
+                            .sets
+                            .iter()
+                            .filter(|s| !s.starts_with("SystemTypeSet"))
+                            .map(String::as_str)
+                            .collect();
+                        format!(" (sets: {})", named.join(", "))
+                    }
+                };
+                offenders.push(format!("{rel}: `{name}`{where_}"));
+            }
+        }
+        for (p, f, _, _) in EXEMPT {
+            if !consumers
+                .iter()
+                .any(|(rel, name, _, _)| rel == p && name == f)
+            {
+                stale.push(format!(
+                    "{p}: `{f}` is not a one-shot consumer holding the VM — drop its EXEMPT row"
+                ));
+            }
+        }
+        eprintln!(
+            "one-shot consumers holding the VM: {} — {gated} gated on ingame_ui_up, {latched} memo-latched, {argued} argued in EXEMPT",
+            consumers.len()
+        );
+        assert!(
+            offenders.is_empty(),
+            "these systems hold the VM and consume a one-shot with nothing gating them on the \
+             interface being up — in 2214's one-frame window they publish to a VM with no frames \
+             and the edge is lost (2220, 2232). Gate them (`.run_if(ingame_ui_up)`, on the system \
+             or its set), or add them to `EXEMPT` with the reason they cannot be filled before \
+             the interface exists (decision 2279):\n  {}",
+            offenders.join("\n  ")
+        );
+        assert!(
+            stale.is_empty(),
+            "stale EXEMPT rows:\n  {}",
+            stale.join("\n  ")
+        );
+    }
+}
diff --git a/crates/benilla-app/src/game_tip.rs b/crates/benilla-app/src/game_tip.rs
index 810935f7..358ce6da 100644
--- a/crates/benilla-app/src/game_tip.rs
+++ b/crates/benilla-app/src/game_tip.rs
@@ -268,12 +268,24 @@ pub(crate) fn tip_bundle() -> impl Bundle {
 
 pub(crate) struct GameTipPlugin;
 
+/// The tip rows' change callback (decision 2303): the switch, and the cursor — which is not a
+/// preference: a hand-edited or downgraded value lands here verbatim and [`raise`] clamps it,
+/// which is the reference's own tolerance (`0x46b682`).
+pub(crate) fn on_cvar(ev: On<crate::cvars::CvarChanged>, mut setting: ResMut<GameTipSetting>) {
+    match ev.key().as_str() {
+        "showgametips" => setting.show = ev.flag(),
+        "gametip" => setting.next = ev.num() as i64,
+        _ => {}
+    }
+}
+
 impl Plugin for GameTipPlugin {
     fn build(&self, app: &mut App) {
+        app.add_observer(on_cvar);
         app.init_resource::<GameTips>()
-            // The CVar mirror, init'd HERE and not by the CVar host: `KnobParams` takes it as a
-            // plain `ResMut`, so a build that registers the row without the resource panics the
-            // first `load_config` — which is what a live run caught and no unit test could, the
+            // The CVar knob, init'd HERE and not by the CVar host: [`on_cvar`] takes it as a
+            // plain `ResMut`, so a build that registers the row without the resource panics on
+            // the first write — which is what a live run caught and no unit test could, the
             // test harness having its own `init_resource` chain.
             .init_resource::<GameTipSetting>()
             .add_systems(
@@ -312,7 +324,6 @@ fn empty_tip(e: &mut EntityCommands, vis: &mut Visibility) {
 ///
 /// Two jobs in one system because they are one mechanism seen at two moments: the reference picks
 /// the row inside `EnterWorld` and lays it out once per raise, then draws that layout every frame.
-#[allow(clippy::too_many_arguments)]
 fn drive_game_tip(
     mut screen: ResMut<crate::loading_screen::LoadingScreen>,
     mut tips: ResMut<GameTips>,
@@ -331,9 +342,9 @@ fn drive_game_tip(
     windows: Query<&Window>,
     assets: Res<AssetServer>,
     mut commands: Commands,
-    // The cursor persists through the VM's table, not the knob — see `cvars::write_host_cvar`.
-    script: Option<NonSendMut<benilla_ui::script::UiScript>>,
-    mut persist: ResMut<crate::cvars::CvarPersist>,
+    // The cursor persists through the registry, not the knob alone: a host write there is what
+    // the file is composed from and what the VM's mirror learns (decision 2303).
+    mut cvars: ResMut<crate::cvars::Cvars>,
 ) {
     let Some(edge) = screen.take_tip_edge() else {
         return;
@@ -357,9 +368,7 @@ fn drive_game_tip(
         // is `EnterWorld`'s own bookkeeping and belongs to the PICK, not to the draw: it stands
         // even on a frame the paint below cannot complete.
         setting.next = i64::from(next);
-        if let Some(mut script) = script {
-            crate::cvars::write_host_cvar(&mut script, &mut persist, "gameTip", &next.to_string());
-        }
+        cvars.set("gameTip", &next.to_string());
     }
 
     // The text is laid out once per raise, not per frame, exactly as the reference does.
@@ -574,7 +583,7 @@ mod tests {
         app.add_plugins((MinimalPlugins, bevy::asset::AssetPlugin::default()));
         crate::text_reshape::harness::add_text_plugins(&mut app);
         app.add_systems(PostUpdate, bevy::text::detect_text_needs_rerender::<Text>);
-        app.init_resource::<crate::cvars::CvarPersist>();
+        app.init_resource::<crate::cvars::Cvars>();
         app.init_resource::<GameTipSetting>();
         app.insert_resource(GameTips {
             catalog: GameTipsCatalog::from_tips(vec![
diff --git a/crates/benilla-app/src/glue/dialog.rs b/crates/benilla-app/src/glue/dialog.rs
index efb51f99..05cf4202 100644
--- a/crates/benilla-app/src/glue/dialog.rs
+++ b/crates/benilla-app/src/glue/dialog.rs
@@ -394,7 +394,6 @@ pub(crate) fn spawn_dialog(
 ///
 /// Runs inside each glue screen's own system chain (again: the header says why it cannot be
 /// hoisted out with an ordering pair).
-#[allow(clippy::too_many_arguments)]
 pub(crate) fn drive_glue_dialog(
     mut commands: Commands,
     mut dialog: ResMut<GlueDialog>,
diff --git a/crates/benilla-app/src/glue/widgets.rs b/crates/benilla-app/src/glue/widgets.rs
index 87c35956..0a05c9b0 100644
--- a/crates/benilla-app/src/glue/widgets.rs
+++ b/crates/benilla-app/src/glue/widgets.rs
@@ -162,7 +162,6 @@ pub(crate) fn outlined_text<W: Bundle, T: Bundle>(
 /// Every *other* wrapped glue string in the shipped XML sets `justifyH="LEFT"` explicitly
 /// (`CharacterCreate.xml`'s race/class/faction bodies, `AddonList.xml`'s title/notes/deps), which
 /// is why [`outlined_text`] stays left and this is the exception rather than the default.
-#[allow(clippy::too_many_arguments)]
 pub(crate) fn outlined_text_centered<W: Bundle, T: Bundle>(
     parent: &mut ChildSpawnerCommands,
     node: Node,
@@ -257,7 +256,6 @@ pub(crate) fn markup_spans(text: &str, base: Color, wrap: bool) -> Vec<(String,
 ///
 /// **Private**: [`outlined_text`] is the one door in, so no caller can hand-build spans and skip
 /// the markup decode (B273's shape — see [`markup_spans`]).
-#[allow(clippy::too_many_arguments)]
 fn outlined_spans<W: Bundle, T: Bundle>(
     parent: &mut ChildSpawnerCommands,
     node: Node,
@@ -355,7 +353,6 @@ fn outlined_spans<W: Bundle, T: Bundle>(
 /// visual), and the name label along the bottom (the ref's `HighlightText`, `GlueFontNormalSmall`,
 /// anchored BOTTOM +1 — over the icon's bottom edge). `dyn_icon`/`label_dyn` are the screen's
 /// refresh markers, spawned onto the face / real label text.
-#[allow(clippy::too_many_arguments)]
 pub(crate) fn icon_button<A: Component, I: Bundle, L: Bundle>(
     parent: &mut ChildSpawnerCommands,
     font: &Handle<Font>,
@@ -712,7 +709,6 @@ pub(crate) fn paint_glue_field<'a>(
 /// onto all five row items ([`GlueFieldPart`]) so the screen's refresh can query them as a set and
 /// hand them to [`paint_glue_field`]. Plain-fill fallback without art. Focus and typing are the
 /// owning screen's systems — this is chrome only, so the screens' boxes can never fork.
-#[allow(clippy::too_many_arguments)]
 pub(crate) fn glue_edit_box<E: Bundle, T: Bundle + Clone>(
     parent: &mut ChildSpawnerCommands,
     art: &GlueArt,
@@ -821,7 +817,6 @@ pub(crate) fn glue_edit_box<E: Bundle, T: Bundle + Clone>(
 /// Returns the button's entity, so a screen can reach back into what it just built — the login
 /// screen marks its realmlist button [`GlueDisabled`] when `$WOW_HOST` owns the session (1667).
 /// Ignoring the return is the norm; nothing is `#[must_use]`.
-#[allow(clippy::too_many_arguments)]
 pub(crate) fn glue_button<A: Component>(
     parent: &mut ChildSpawnerCommands,
     art: &GlueArt,
diff --git a/crates/benilla-app/src/go_anim.rs b/crates/benilla-app/src/go_anim.rs
index 8b4fbcc1..d1e92739 100644
--- a/crates/benilla-app/src/go_anim.rs
+++ b/crates/benilla-app/src/go_anim.rs
@@ -1,8 +1,8 @@
-//! GameObject open/close animation (decision 0242; chest lid folded in by 0250) — a **client-side**
+//! GameObject open/close animation (decision 0242; chest lid folded in by 2271) — a **client-side**
 //! `GAMEOBJECT_STATE` drives a skeletal M2 sequence, so a **door** swings, a **button** depresses, and a
 //! **chest lid** opens/closes on its §243 state machine.
 //!
-//! **The model (0250, §5-VERIFIED):** the real client keeps *one* stored state per GameObject (the
+//! **The model (2271, §5-VERIFIED):** the real client keeps *one* stored state per GameObject (the
 //! binary's `go+0x27c`) and *one* `SetGoState` that all callers funnel through; a change of that state
 //! plays the §243 transition. benilla mirrors that exactly — [`GoAnim::state`] is the single source of
 //! truth, written by the **three callers** the RE census pinned:
@@ -72,7 +72,7 @@ use bevy::animation::RepeatAnimation;
 use bevy::prelude::*;
 use std::time::Duration;
 
-use crate::creature_anim::{advance_track, scan_events, select, AnimSoundEvent};
+use crate::creature_anim::{advance_track, scan_events, AnimSoundEvent};
 use crate::net::{GuidIndex, ObjectStore};
 use benilla_world::model_fade::DespawnFade;
 use benilla_world::schedule::WorldStage;
@@ -88,7 +88,7 @@ const GO_STATE_READY: u32 = 1;
 /// object plays this once and *then* goes away; see [`DespawnAnimAnnounced`].
 const ANIM_DESPAWN: u16 = 157;
 
-/// Marker + client-side state for an animated GameObject (decisions 0242/0250). Instanced by
+/// Marker + client-side state for an animated GameObject (decisions 0242/2271). Instanced by
 /// [`crate::entities::attach`] on an animatable GO type whose model authors sequences; driven by
 /// [`drive_go_anim`]. Distinct from creatures' `AnimDriver` so the two drivers never touch one entity.
 #[derive(Component, Default)]
@@ -102,10 +102,6 @@ pub(crate) struct GoAnim {
     /// leaving (first sight settles the resting pose **silently** — a door that streams in already open
     /// must not replay its swing).
     shown: Option<u32>,
-    /// The last `GAMEOBJECT_STATE` seen on the wire, so [`sync_wire_go_state`] writes `state` only on a
-    /// *genuine* wire change — a chest's wire state is constant (its lid is driven by loot events, not the
-    /// wire), so an unrelated values-update (a dyn-flag, a position) must not re-close an open lid.
-    last_wire: Option<u32>,
     /// A pending **one-shot** play, as an `AnimationData.dbc` id — the second, disjoint arm
     /// channel of wow-re `gameobject-anim-arm.md` §2c, never the §243 lid family. The reference
     /// has ONE such slot fed by ONE entry point (`0x5f8c50(GO, code)` → slot 15), whose 7-entry
@@ -304,7 +300,7 @@ fn collider_is_solid(wire_state: Option<u32>) -> bool {
 }
 
 /// A cast launched at a GameObject (`SMSG_SPELL_GO` carrying a `TARGET_FLAG_GAMEOBJECT`), bridged from the
-/// net apply layer to this module (decision 0250). [`open_go_lid`] opens the target's lid/door iff the
+/// net apply layer to this module (decision 2271). [`open_go_lid`] opens the target's lid/door iff the
 /// spell carries an open-lock effect and the GO is an animated type — the client's `Spell_C` open path.
 #[derive(Message, Clone, Copy)]
 pub(crate) struct GoLidOpen {
@@ -437,27 +433,36 @@ fn resolve(prev: Option<u32>, cur: u32) -> Option<Play> {
 
 /// Caller 1 (the wire, §243): track each animated GO's `GAMEOBJECT_STATE` from the wire, acting only on a
 /// *genuine* wire change. This is the door/button driver (the server flips their state over the wire) and
-/// the first-sight rest-pose seed for every animated GO (a chest streams in closed). Runs on the seed
-/// (`Added<GoAnim>`, when attach tags the entity) and on any later descriptor delta; the `last_wire`
-/// guard makes an unrelated field change (position, dyn-flags) a no-op, so a chest whose wire state is
-/// constant is never re-closed by one — its lid is owned by the loot callers below.
+/// the first-sight rest-pose seed for every animated GO (a chest streams in closed). Two inputs, both
+/// exact (decision 2297): the seed (`Added<GoAnim>`, when attach tags the entity — read off the store),
+/// and the field EDGE on `GAMEOBJECT_STATE` for any later delta. An unrelated field change (position,
+/// dyn-flags) is not an edge on this dword, so a chest whose wire state is constant is never re-closed by
+/// one — its lid is owned by the loot callers below. That used to need a `last_wire` shadow on the
+/// component; the edge carries the old value itself.
 #[allow(clippy::type_complexity)]
 fn sync_wire_go_state(
-    mut gos: Query<(&ObjectStore, &mut GoAnim), Or<(Changed<ObjectStore>, Added<GoAnim>)>>,
+    mut edges: MessageReader<crate::net::FieldChanged>,
+    // The seed leg and the edge leg both write `GoAnim`; one `ParamSet`, two disjoint views.
+    mut gos: ParamSet<(
+        Query<(&ObjectStore, &mut GoAnim), Added<GoAnim>>,
+        Query<&mut GoAnim>,
+    )>,
 ) {
-    for (store, mut anim) in &mut gos {
+    for (store, mut anim) in &mut gos.p0() {
         // Absent ⇒ the wire default `0` = ACTIVE (decision 0757) — vmangos omits zero fields, so a
         // door that spawns OPEN sends none. Reading that as "unknown" left `state` at `None`, and
-        // the object rested at its loader pose instead of Opened. The `last_wire` guard is
-        // unaffected: a constant wire state (a chest's `Some(1)`) still compares equal frame to
-        // frame, so the client-predicted lid is still never re-closed by an unrelated delta.
-        let wire = Some(store.0.gameobject_state().unwrap_or(GO_STATE_ACTIVE));
-        if wire == anim.last_wire {
-            continue; // an unrelated field changed (position, flags, dyn-flags) — not our transition
+        // the object rested at its loader pose instead of Opened.
+        anim.state = Some(store.0.gameobject_state().unwrap_or(GO_STATE_ACTIVE));
+    }
+    let mut live = gos.p1();
+    for e in edges.read() {
+        if e.kind != benilla_protocol::messages::ObjectType::GameObject
+            || e.index != benilla_protocol::field::FIELD_GAMEOBJECT_STATE
+        {
+            continue;
         }
-        anim.last_wire = wire;
-        if let Some(s) = wire {
-            anim.state = Some(s);
+        if let Ok(mut anim) = live.get_mut(e.entity) {
+            anim.state = Some(e.new);
         }
     }
 }
@@ -716,6 +721,43 @@ fn retire_transient_anim(
     }
 }
 
+/// **The GameObject arm's instrument** (`WOW_MOVE_TRACE_TAGS=goa`) — one line per arm, carrying
+/// everything the roll decided: the requested `AnimationData.dbc` id, what the §2c remap turned it
+/// into, the `_rand` draw itself, and the **file sequence slot** the weighted walk landed on.
+///
+/// That last column is the one this exists for. A GameObject's variation chain is not cosmetic:
+/// the per-sequence material lanes (2295) key their UV and tint loops by `seq_index`, so *which
+/// take is armed* is what decides whether a Blood of Heroes pool bubbles at all (slot 0 authors no
+/// texture transform, slot 1 does) and whether an Onyxia lava trap spurts. From outside, an arm
+/// that re-rolls every window and one that armed once and stalled look identical — both are "a
+/// still pool" for as long as you happen to watch — and the three legs that produce the difference
+/// (`0x5f39fa`'s already-armed skip, the collapse-to-0 leg that jumps past it, the completion that
+/// re-enters through slot 14) are invisible in a screenshot. One line per arm makes the cycle,
+/// its period and its distribution readable directly.
+fn trace_arm(
+    entity: Entity,
+    lane: &str,
+    requested: u16,
+    want: u16,
+    frozen: bool,
+    roll: u16,
+    clip: &benilla_assets::AnimClip,
+) {
+    if !benilla_assets::trace::enabled_for("goa") {
+        return;
+    }
+    benilla_assets::trace::line(
+        "goa",
+        &format!(
+            "{lane} e={entity} id={requested}->{want}{} roll={roll} seq={} freq={} dur={:.3}",
+            if frozen { " frozen" } else { "" },
+            clip.seq_index,
+            clip.frequency,
+            clip.duration,
+        ),
+    );
+}
+
 /// Play the §243 sequence for a change of the client-side [`GoAnim::state`] (written by any of the three
 /// callers). Mirrors the state-transition detection of [`crate::sound::gameobject`] (first sight silent),
 /// but points it at the model instead of the mixer — one system owns the visual, the other the audio.
@@ -733,7 +775,7 @@ fn drive_go_anim(
     mut dispatch: MessageWriter<GoStateDispatch>,
     // The client's single `_rand` stream (wow-re `rf36-rand-stub.md`), as `creature_anim` keeps
     // one: op4's variation roll draws from it on every GameObject arm below.
-    mut rng: Local<u32>,
+    mut rng: ResMut<benilla_assets::AnimRng>,
 ) {
     for (entity, mut go, mut player, mut tr, anims) in &mut gos {
         // ── The §243 state arm ─────────────────────────────────────────────────────────────────
@@ -784,7 +826,9 @@ fn drive_go_anim(
                     if skip {
                         continue;
                     }
-                    if let Some(clip) = anims.pick_variation(want, select::msvc_rand(&mut rng)) {
+                    let roll = rng.draw();
+                    if let Some(clip) = anims.pick_variation(want, roll) {
+                        trace_arm(entity, "state", play.anim_id(), want, frozen, roll, clip);
                         go.armed_id = Some(want);
                         // Snap a rest pose (blend 0 — a stream-in must not swing); ease a motion
                         // over its authored blend.
@@ -858,7 +902,9 @@ fn drive_go_anim(
                 // Slot 15 funnels through the same slot-34 → `0x5f3930` arm as the state channel
                 // (§2c), so it rolls a variation for the same reason — a Custom0 with two authored
                 // takes alternates them.
-                if let Some(clip) = anims.pick_variation(id, select::msvc_rand(&mut rng)) {
+                let roll = rng.draw();
+                if let Some(clip) = anims.pick_variation(id, roll) {
+                    trace_arm(entity, "custom", id, id, false, roll, clip);
                     go.armed_id = Some(id);
                     go.rest_window = None;
                     let node = clip.node;
@@ -884,11 +930,11 @@ fn drive_go_anim(
 /// scoped to the door/button types ([`collision_follows_state`]); a chest keeps its collider whatever its
 /// state.
 ///
-/// **Reconciles on an `ObjectStore` change OR on the collider's arrival** (idempotent either way).
+/// **Reconciles on a `GAMEOBJECT_STATE` edge OR on the collider's arrival** (idempotent either way).
 /// The `Added<Collider>` half is load-bearing, not belt-and-braces (decision 0763): a streamed
 /// GameObject's descriptor lands with the create block, but its `Collider` is baked from the M2
 /// hull and inserted by `entities::attach` only when the **asset finishes loading**, frames later.
-/// Watching `Changed<ObjectStore>` alone meant the two conditions were never true in the same frame
+/// Watching the descriptor alone meant the two conditions were never true in the same frame
 /// for a freshly streamed object — the descriptor changed while there was no collider, the collider
 /// arrived while the descriptor was quiet — so the reconcile never ran at all, and every door kept
 /// the enabled collider it was born with. A *closed* door is solid by default and looked correct;
@@ -896,17 +942,24 @@ fn drive_go_anim(
 /// reporter's workaround exactly: toggling the object from the GM panel changes the descriptor
 /// *after* the collider exists, so the reconcile finally fires.
 ///
-/// Same shape as [`sync_wire_go_state`]'s `Or<(Changed<ObjectStore>, Added<GoAnim>)>` — the
-/// seed-plus-delta pair this file already uses for every other state consumer.
-#[allow(clippy::type_complexity)]
+/// The descriptor half is the field edge on the one dword this reads (decision 2297) — the same
+/// seed-plus-edge pair [`sync_wire_go_state`] uses.
 fn drive_go_collision(
     mut commands: Commands,
-    gos: Query<
-        (Entity, &ObjectStore, Has<ColliderDisabled>),
-        (With<Collider>, Or<(Changed<ObjectStore>, Added<Collider>)>),
-    >,
+    gos: Query<(&ObjectStore, Has<ColliderDisabled>), With<Collider>>,
+    arrived: Query<Entity, Added<Collider>>,
+    mut edges: MessageReader<crate::net::FieldChanged>,
 ) {
-    for (entity, store, disabled) in &gos {
+    let state_edges = edges.read().filter(|e| {
+        e.kind == benilla_protocol::messages::ObjectType::GameObject
+            && e.index == benilla_protocol::field::FIELD_GAMEOBJECT_STATE
+    });
+    let mut due: bevy::ecs::entity::EntityHashSet = arrived.iter().collect();
+    due.extend(state_edges.map(|e| e.entity));
+    for entity in due {
+        let Ok((store, disabled)) = gos.get(entity) else {
+            continue;
+        };
         if !collision_follows_state(store.0.gameobject_type_id()) {
             continue;
         }
@@ -1205,6 +1258,8 @@ mod tests {
         ));
         app.init_resource::<Time>();
         app.init_resource::<NextStep>();
+        // The client's ONE `rand()` stream (2301) — the arm rolls a variation off it.
+        app.init_resource::<benilla_assets::AnimRng>();
         // The state dispatch's audio consumer lives in `sound::gameobject`; here it is recorded
         // instead, so a test can assert *which* edges re-enter `0x5f3cb0`.
         app.add_message::<GoStateDispatch>();
@@ -1784,7 +1839,7 @@ mod tests {
 
     #[test]
     fn chest_animates_but_keeps_its_collider() {
-        // A chest (3) is on the animation machine (0250) but off the collision gate (0249): you see the
+        // A chest (3) is on the animation machine (2271) but off the collision gate (0249): you see the
         // lid move, but you never walk through an open chest.
         assert!(go_animates(3));
         assert!(!collision_follows_state(3));
diff --git a/crates/benilla-app/src/go_templates.rs b/crates/benilla-app/src/go_templates.rs
index 16656e9d..2491a658 100644
--- a/crates/benilla-app/src/go_templates.rs
+++ b/crates/benilla-app/src/go_templates.rs
@@ -7,13 +7,12 @@
 //! from [`crate::net::apply`]'s `ObjectCreate`, the same discipline as the name cache), the answer
 //! resolved in [`GameObjectTemplates::insert`], and read by the interact routing ([`crate::target`]).
 
-use std::collections::{HashMap, HashSet};
-
 use benilla_formats::{LockCatalog, LockTypeCatalog};
 use benilla_protocol::guid;
 use bevy::prelude::*;
 
 use crate::net::{ClientCommand, NetCommands};
+use crate::query_cache::QueryCache;
 
 /// `Lock.dbc` as a resource (decision 0239) — `lockId → requirement slots`, read by the interact
 /// routing to decide use-vs-cast and, for a lockable object, which `LockType` the opener spell must
@@ -39,15 +38,32 @@ pub(crate) struct GoTemplate {
     /// The display name — the hover tooltip's gold first line (decision 0276's GO law).
     pub(crate) name: String,
     /// The vanilla **highlight** column, for the two types whose mouseover-eligibility slot reads
-    /// it instead of running a predicate (decision 1106): GENERIC(5)'s `data[1]` (`0x5f4830`,
+    /// it instead of running a predicate (decision 1110): GENERIC(5)'s `data[1]` (`0x5f4830`,
     /// decision 0762 — nonzero on 1387 of the 1870 shipped type-5 templates, which is why a road
     /// signpost hovers and the scenery beside it never does) and CAPTURE_POINT(29)'s `data[19]`
     /// (`0x5f6d80` — byte-for-byte the same shape, a different slot). `false` for every other type,
     /// which never consults it.
     pub(crate) highlight_column: bool,
-    /// MEETINGSTONE (type 23) only: the template's `data[2]` = **areaID**, the sole input of that
-    /// type's own `highlightable` slot (`0x5f6990` — decision 1106). `None` for every other type.
-    pub(crate) meeting_stone_area: Option<u32>,
+    /// GENERIC(5) only: the template's **`data[0]`**, the sole input of that type's `[vtbl+0x5c]`
+    /// (`0x5f8630`) — the fork in the mouseover publisher that decides whether this object's
+    /// tooltip FOLLOWS THE CURSOR (`0x492a01` → `0x52ffe0(owner, 6, 0, 0)`, the SetOwner core at
+    /// anchor state 6) or takes the default corner seat like a creature's (`0x492a42`, which
+    /// writes no owner and fires `OnTooltipSetDefaultAnchor` instead).
+    ///
+    /// The slot is named by `0x621b00(type, semantic 0x13)`, a key that resolves for exactly one
+    /// of the 31 GO types — so no other type can take the cursor arm, and 0766's INTERIM "GENERIC
+    /// vs not" proxy is replaced by the real key (decision 2259). **Distinct from
+    /// [`Self::highlight_column`]**, which is `data[1]` via semantic `0x12` and gates *eligibility*
+    /// rather than *placement*: an object can be hoverable and still be corner-seated.
+    ///
+    /// `false` for every other type. (The *name* is inferred from vmangos's field order; the index
+    /// and the fork are byte-verified, and the data is cross-checked against the reference client's
+    /// own `gameobjectcache.wdb` — 1890 entries, zero disagreements with the server's.)
+    pub(crate) floating_tooltip: bool,
+    /// MEETINGSTONE (type 23) only: the three template slots the stone's own strategy reads —
+    /// `data[0]`/`data[1]` = minLevel/maxLevel and `data[2]` = areaID (decisions 1110, 2283).
+    /// `None` for every other type.
+    pub(crate) meeting_stone: Option<MeetingStoneTemplate>,
     /// MO_TRANSPORT (type 15) path parameters — `Some` only for boats/zeppelins (decision 0438):
     /// the template's `data0..2` = (taxiPathId, moveSpeed, accelRate), the inputs the transport
     /// timetable is built from.
@@ -63,6 +79,23 @@ pub(crate) struct GoTemplate {
     pub(crate) quest_material: Option<u32>,
 }
 
+/// A MEETINGSTONE (type 23) template's three slots, all of them read by the stone's own strategy
+/// through the per-type attribute table `0x621b00`: keys `0x33`/`0x34`/`0x35` → indices 0/1/2
+/// (vmangos `GameObjectInfo::meetingstone` = `minLevel, maxLevel, areaID`; decision 2283).
+///
+/// The **areaID** is the input of the type's own `highlightable` slot `0x5f6990`
+/// ([`crate::target::cursor_mode::meeting_stone_queued`]); the **level pair** is the input of the
+/// use-slot validator's level refusal (`ERR_MEETING_STONE_INVALID_LEVEL`).
+#[derive(Clone, Copy)]
+pub(crate) struct MeetingStoneTemplate {
+    /// `data[0]` — the lowest level the stone accepts.
+    pub(crate) min_level: u32,
+    /// `data[1]` — the highest level the stone accepts.
+    pub(crate) max_level: u32,
+    /// `data[2]` — the `AreaTable` id the stone queues for.
+    pub(crate) area: u32,
+}
+
 /// A MO_TRANSPORT template's path tuple (`gameobject_template.data0..2`, decision 0438).
 #[derive(Clone, Copy)]
 pub(crate) struct MoTransport {
@@ -86,36 +119,39 @@ pub(crate) struct TextPage {
 /// `entry → template`, ask-once per connection (mirrors [`crate::names::NameCache`]'s discipline).
 #[derive(Resource, Default)]
 pub(crate) struct GameObjectTemplates {
-    templates: HashMap<u32, GoTemplate>,
-    pending: HashSet<u32>,
+    templates: QueryCache<u32, GoTemplate>,
+}
+
+impl crate::query_cache::AskOnce for GameObjectTemplates {
+    fn clear_pending(&mut self) {
+        self.templates.clear_pending();
+    }
 }
 
 impl GameObjectTemplates {
     /// Ask the server for a GameObject's template if not already known or in flight (once per entry).
     /// `guid` names the asking object; the server answers by entry, so all spawns of a template share
     /// the one query.
-    pub(crate) fn request(&mut self, guid: u64, commands: &NetCommands) {
+    pub(crate) fn request(&self, guid: u64, commands: &NetCommands) {
         let Some(entry) = guid::entry(guid) else {
             return;
         };
-        if self.templates.contains_key(&entry) || !self.pending.insert(entry) {
-            return;
-        }
-        debug!("go: asking template (entry {entry}, guid {guid:#x})");
-        let _ = commands
-            .0
-            .send(ClientCommand::GameObjectQuery { entry, guid });
+        self.templates.get_or_ask(entry, || {
+            debug!("go: asking template (entry {entry}, guid {guid:#x})");
+            let _ = commands
+                .0
+                .send(ClientCommand::GameObjectQuery { entry, guid });
+        });
     }
 
     /// Record a `SMSG_GAMEOBJECT_QUERY_RESPONSE`, resolving the lockId from the type-specific
     /// `data[]` slot. A miss (server didn't know the entry) arrives zeroed → `lock_id = 0` (no lock).
     pub(crate) fn insert(&mut self, entry: u32, type_id: u32, name: String, data: &[i32; 24]) {
-        self.pending.remove(&entry);
         let lock_id = go_lock_slot(type_id)
             .and_then(|slot| data.get(slot))
             .map(|&v| v.max(0) as u32)
             .unwrap_or(0);
-        // The highlight column, at the slot its type reads it from (decision 1106): GENERIC(5)
+        // The highlight column, at the slot its type reads it from (decision 1110): GENERIC(5)
         // `data[1]`, CAPTURE_POINT(29) `data[19]`. Both slots are resolved by the same
         // `0x621b00(type, semantic 0x12)` lookup in the reference; the two shipped answers are
         // inlined here for the same reason [`go_lock_slot`] inlines the lock's.
@@ -124,9 +160,18 @@ impl GameObjectTemplates {
             29 => data[19] != 0,
             _ => false,
         };
-        // MEETINGSTONE (23): data[2] = areaID (vmangos `gameobject_template`), the one input of
-        // that type's own highlightable slot.
-        let meeting_stone_area = (type_id == 23).then(|| data[2].max(0) as u32);
+        // GENERIC(5): data[0] = the tooltip-placement fork's input (decision 2259). Same shape as
+        // the highlight column above and deliberately beside it — they are adjacent slots that
+        // answer different questions, and reading them as one is the mistake 0766 made.
+        let floating_tooltip = type_id == 5 && data[0] != 0;
+        // MEETINGSTONE (23): data[0..2] = minLevel, maxLevel, areaID (vmangos
+        // `gameobject_template`) — the area feeds that type's own highlightable slot, the level
+        // pair the use-slot validator's level refusal (decision 2283).
+        let meeting_stone = (type_id == 23).then(|| MeetingStoneTemplate {
+            min_level: data[0].max(0) as u32,
+            max_level: data[1].max(0) as u32,
+            area: data[2].max(0) as u32,
+        });
         // MO_TRANSPORT (15): data0..2 = taxiPathId / moveSpeed / accelRate (vmangos
         // `GameObjectInfo::moTransport`; decision 0438).
         let mo_transport = (type_id == 15).then(|| MoTransport {
@@ -146,21 +191,22 @@ impl GameObjectTemplates {
         };
         self.templates.insert(
             entry,
-            GoTemplate {
+            Some(GoTemplate {
                 lock_id,
                 name,
                 highlight_column,
-                meeting_stone_area,
+                floating_tooltip,
+                meeting_stone,
                 mo_transport,
                 text_page,
                 quest_material,
-            },
+            }),
         );
     }
 
     /// The cached template for a GameObject guid, or `None` if its query hasn't answered yet.
     pub(crate) fn get(&self, guid: u64) -> Option<&GoTemplate> {
-        guid::entry(guid).and_then(|e| self.templates.get(&e))
+        guid::entry(guid).and_then(|e| self.templates.get(e))
     }
 }
 
@@ -207,14 +253,14 @@ mod tests {
         t.insert(101, 9, "Book".into(), &data);
         t.insert(102, 10, "Chest".into(), &data);
         t.insert(103, 15, "Boat".into(), &data);
-        assert_eq!(t.templates[&100].quest_material, Some(2));
-        assert_eq!(t.templates[&101].quest_material, Some(2));
+        assert_eq!(t.templates.get(100).unwrap().quest_material, Some(2));
+        assert_eq!(t.templates.get(101).unwrap().quest_material, Some(2));
         assert_eq!(
-            t.templates[&102].quest_material,
+            t.templates.get(102).unwrap().quest_material,
             Some(3),
             "a chest reads data[9]"
         );
-        assert_eq!(t.templates[&103].quest_material, None);
+        assert_eq!(t.templates.get(103).unwrap().quest_material, None);
     }
 
     #[test]
@@ -227,13 +273,18 @@ mod tests {
         data[1] = 30;
         data[2] = 1;
         t.insert(176231, 15, "Proudmore's Treasure".into(), &data);
-        let mo = t.templates[&176231].mo_transport.expect("type 15 captures");
+        let mo = t
+            .templates
+            .get(176231)
+            .unwrap()
+            .mo_transport
+            .expect("type 15 captures");
         assert_eq!(mo.taxi_path_id, 292);
         assert_eq!(mo.move_speed, 30.0);
         assert_eq!(mo.accel_rate, 1.0);
         // A chest doesn't.
         t.insert(2, 3, "Chest".into(), &data);
-        assert!(t.templates[&2].mo_transport.is_none());
+        assert!(t.templates.get(2).unwrap().mo_transport.is_none());
     }
 
     /// TEXT (9) captures the readable head — `data[0]` page id, `data[2]` material (decision
@@ -246,12 +297,17 @@ mod tests {
         data[1] = 0; // language
         data[2] = 2; // pageMaterial (Stone)
         t.insert(2036, 9, "Book".into(), &data);
-        let page = t.templates[&2036].text_page.expect("type 9 captures");
+        let page = t
+            .templates
+            .get(2036)
+            .unwrap()
+            .text_page
+            .expect("type 9 captures");
         assert_eq!(page.page_id, 1416);
         assert_eq!(page.material, 2);
         // A goober with the same bytes does not — its data[0] is a lockId.
         t.insert(2037, 10, "Lever".into(), &data);
-        assert!(t.templates[&2037].text_page.is_none());
+        assert!(t.templates.get(2037).unwrap().text_page.is_none());
     }
 
     #[test]
@@ -269,4 +325,61 @@ mod tests {
         );
         assert_eq!(t.get(guid).map(|g| g.lock_id), Some(38));
     }
+
+    /// **`data[0]` and `data[1]` are different questions, and a GENERIC object can answer them
+    /// differently** — the pin that replaces 0766's INTERIM proxy (decision 2259).
+    ///
+    /// `data[1]` (semantic `0x12`, `0x5f4830`) is mouseover ELIGIBILITY: is this hoverable at all.
+    /// `data[0]` (semantic `0x13`, `0x5f8630`) is PLACEMENT: does its plate follow the cursor or
+    /// take the corner seat. Reading one as the other is exactly the mistake 0766 named as a proxy.
+    ///
+    /// The two rows are real, taken from the reference client's own `gameobjectcache.wdb`
+    /// (build 5875): `Brill` (entry 1630) is hoverable *and* cursor-seated, while
+    /// `Doodad_WoodSignPointerNice10` (175656) — the same family of wooden pointer sign — is
+    /// hoverable and CORNER-seated. Same model family, opposite answers, which is why the type
+    /// alone could never have been the key.
+    #[test]
+    fn a_generic_can_be_hoverable_and_still_corner_seated() {
+        let mut t = GameObjectTemplates::default();
+        let mut brill = [0i32; 24];
+        (brill[0], brill[1]) = (1, 1);
+        let mut pointer = [0i32; 24];
+        (pointer[0], pointer[1]) = (0, 1);
+        t.insert(1630, 5, "Brill".into(), &brill);
+        t.insert(175656, 5, "Doodad_WoodSignPointerNice10".into(), &pointer);
+
+        let brill = t.templates.get(1630).expect("Brill cached");
+        assert!(brill.highlight_column, "Brill is hoverable");
+        assert!(brill.floating_tooltip, "Brill's plate follows the cursor");
+
+        let pointer = t.templates.get(175656).expect("the pointer sign cached");
+        assert!(
+            pointer.highlight_column,
+            "the pointer sign is hoverable too"
+        );
+        assert!(
+            !pointer.floating_tooltip,
+            "but its plate takes the corner seat — eligibility did not decide placement"
+        );
+    }
+
+    /// The fork's key exists for GENERIC(5) and for no other type: `0x621b00` answers semantic
+    /// `0x13` for exactly one of the 31 types, so `data[0]` is never read as a placement flag
+    /// anywhere else — a CHEST's `data[0]` is its lockId, and must not move its tooltip.
+    #[test]
+    fn no_other_type_reads_data0_as_the_placement_fork() {
+        let mut t = GameObjectTemplates::default();
+        let mut data = [0i32; 24];
+        data[0] = 1;
+        for type_id in [0u32, 1, 2, 3, 6, 7, 8, 9, 10, 16, 22, 23, 25, 29] {
+            t.insert(9000 + type_id, type_id, format!("type {type_id}"), &data);
+            assert!(
+                !t.templates
+                    .get(9000 + type_id)
+                    .expect("cached")
+                    .floating_tooltip,
+                "type {type_id} must not take the cursor arm — it carries no semantic 0x13"
+            );
+        }
+    }
 }
diff --git a/crates/benilla-app/src/items.rs b/crates/benilla-app/src/items.rs
index ca262197..985f4601 100644
--- a/crates/benilla-app/src/items.rs
+++ b/crates/benilla-app/src/items.rs
@@ -17,13 +17,14 @@
 //!   reports "not yet". Negative answers are cached — a bad entry never becomes a query loop.
 //!   Templates survive disconnect: item definitions are stable across sessions.
 
-use std::collections::{HashMap, HashSet};
+use std::collections::HashMap;
 
 use bevy::prelude::*;
 
 use benilla_protocol::{ItemInfo, ObjectFields};
 
 use crate::net::{ClientCommand, NetCommands, ObjectStore};
+use crate::query_cache::QueryCache;
 
 /// The slice of an item template that equipment rendering + combat animation consume (decisions
 /// 0072/0073): the ItemDisplayInfo key, the two placement inputs, and the weapon class pair the
@@ -291,28 +292,19 @@ impl RollCatalogs<'_> {
 #[derive(Resource, Default)]
 pub(crate) struct Items {
     objects: HashMap<u64, ObjectFields>,
-    /// `None` = the server flagged the entry unknown (the top-bit miss branch) — cached negative.
-    templates: HashMap<u32, Option<ItemInfo>>,
-    pending: HashSet<u32>,
+    /// The template cache — ask-once through [`QueryCache`] (decision 2288); a `None` answer is
+    /// the server's "unknown entry" (the top-bit miss branch), cached so it is never re-asked.
+    templates: QueryCache<u32, ItemInfo>,
     /// Entries whose template landed since the last [`Self::take_fresh`] drain — the push half of
     /// the tooltip store (every landed template goes to the UI unprompted, so the first hover of
     /// an item whose name is already on screen never misses).
     fresh: Vec<u32>,
-    /// Bumped by every landed answer ([`Self::insert_template`]), positive or negative. The
-    /// **broadcast** twin of [`Self::fresh`]: `fresh` is a DRAIN (exactly one consumer can take
-    /// it — the tooltip feed does), so a second consumer that caches a template-derived view
-    /// needs its own signal. A consumer keeps the epoch it last resolved at and re-resolves when
-    /// it advances — the modern stand-in for the ref's `DBCACHECALLBACK` redisplay (`0x6e29b0`),
-    /// which is how the real client repaints a view that was drawn while the item cache was still
-    /// answering. Any cache that gates a template read behind a change-flag needs this: the read
-    /// itself is what ISSUES the ask-once query, so the first resolve of a cold entry ALWAYS
-    /// misses (decision 0660).
-    template_epoch: u64,
     /// [`Self::template_epoch`]'s twin for the INSTANCE side (decision 1439): bumped by every
     /// object create/merge/destroy and every enchant-deadline write — everything wire-driven
-    /// that can change what a bag/equipment view reads. The pair exists because `is_changed` on
-    /// this resource says nothing: the feeds' own lazy `template()` resolves take `&mut self`
-    /// every frame, so the resource reads as changed even when nothing landed.
+    /// that can change what a bag/equipment view reads. The pair was born because `is_changed`
+    /// on this resource said nothing while the feeds' lazy `template()` resolves took `&mut
+    /// self` every frame; 2288 made those reads `&self`, and the counters stay as the finer
+    /// signal (a view keyed on one side does not rebuild for the other).
     object_epoch: u64,
     /// The **temporary-enchant deadlines**, keyed `(item guid, enchant slot)` — the reference's
     /// per-item `[obj + slot*4 + 0x324]` array (wow-re `tooltip-content-law.md` §E3), whose only
@@ -514,19 +506,15 @@ impl Items {
     /// template-only) and returns `None` — call again after the answer lands. A cached negative
     /// (server doesn't know the entry) is also `None`, without a re-ask.
     pub(crate) fn template(
-        &mut self,
+        &self,
         entry: u32,
         guid: u64,
         commands: &NetCommands,
     ) -> Option<&ItemInfo> {
-        if !self.templates.contains_key(&entry) {
-            if self.pending.insert(entry) {
-                debug!("items: asking template (entry {entry})");
-                let _ = commands.0.send(ClientCommand::ItemQuery { entry, guid });
-            }
-            return None;
-        }
-        self.templates.get(&entry).and_then(|t| t.as_ref())
+        self.templates.get_or_ask(entry, || {
+            debug!("items: asking template (entry {entry})");
+            let _ = commands.0.send(ClientCommand::ItemQuery { entry, guid });
+        })
     }
 
     /// Whether the server has ANSWERED the `entry` query with "unknown item" — the cached
@@ -535,13 +523,13 @@ impl Items {
     /// answer (the ref's `DBCACHECALLBACK` redisplay), negative → give up and show the ref's
     /// `"UNKNOWN"` fallback instead of waiting forever.
     pub(crate) fn template_answered_unknown(&self, entry: u32) -> bool {
-        self.templates.get(&entry).is_some_and(|t| t.is_none())
+        self.templates.answered_unknown(entry)
     }
 
     /// The held/worn display head for `entry` — the [`HeldTemplate`] view of [`Self::template`]
     /// (same ask-once discipline, template-only ask). Equipment rendering + the swing selector
     /// consume this Copy slice instead of borrowing the full info.
-    pub(crate) fn held(&mut self, entry: u32, commands: &NetCommands) -> Option<HeldTemplate> {
+    pub(crate) fn held(&self, entry: u32, commands: &NetCommands) -> Option<HeldTemplate> {
         self.template(entry, 0, commands).map(|i| HeldTemplate {
             display_info_id: i.display_info_id,
             inventory_type: i.inventory_type,
@@ -557,27 +545,29 @@ impl Items {
     /// rung runs inside a `&Items` borrow, and by the time a button is pressed the greying feed
     /// that shares its search has had the template for many frames.
     pub(crate) fn template_cached(&self, entry: u32) -> Option<&ItemInfo> {
-        self.templates.get(&entry)?.as_ref()
+        self.templates.get(entry)
     }
 
     /// Record a template answer (`SMSG_ITEM_QUERY_SINGLE_RESPONSE`); `None` = unknown entry.
     pub(crate) fn insert_template(&mut self, entry: u32, info: Option<ItemInfo>) {
-        self.pending.remove(&entry);
         if info.is_some() {
             self.fresh.push(entry);
         }
+        // A NEGATIVE answer moves the generation too: it flips the entry from "still asking" to
+        // "answered unknown", which is a real display transition for anything that waits on the
+        // ask (the cast-fail redisplay's `"UNKNOWN"` literal, [`Self::template_answered_unknown`]).
         self.templates.insert(entry, info);
-        // A NEGATIVE answer bumps too: it flips the entry from "still asking" to "answered
-        // unknown", which is a real display transition for anything that waits on the ask (the
-        // cast-fail redisplay's `"UNKNOWN"` literal, [`Self::template_answered_unknown`]).
-        self.template_epoch = self.template_epoch.wrapping_add(1);
     }
 
-    /// The landed-template broadcast counter — see the [`Self::template_epoch`] field. Advances on
-    /// every answer; a consumer that caches a template-derived view compares it against the value
-    /// it last resolved at and re-resolves when they differ.
+    /// The landed-template broadcast counter — the cache's own generation, bumped by every
+    /// landed answer, positive or negative. The **broadcast** twin of [`Self::fresh`]: `fresh`
+    /// is a DRAIN (exactly one consumer can take it — the tooltip feed does), so a second
+    /// consumer that caches a template-derived view needs its own signal; it keeps the epoch it
+    /// last resolved at and re-resolves when it advances — the modern stand-in for the ref's
+    /// `DBCACHECALLBACK` redisplay (`0x6e29b0`), which is how the real client repaints a view
+    /// drawn while the item cache was still answering (decision 0660).
     pub(crate) fn template_epoch(&self) -> u64 {
-        self.template_epoch
+        self.templates.generation()
     }
 
     /// Drain the entries whose template landed since the last drain (see the `fresh` field).
@@ -609,17 +599,23 @@ impl Items {
     /// cost of a wrong latch (a feature dead all session, in silence) is nothing like the cost of
     /// a redundant re-ask.
     pub(crate) fn clear_pending(&mut self) {
-        self.pending.clear();
+        self.templates.clear_pending();
     }
 
     pub(crate) fn clear_session(&mut self) {
         self.objects.clear();
         self.enchant_deadlines.clear();
-        self.pending.clear();
+        self.templates.clear_pending();
         self.object_epoch = self.object_epoch.wrapping_add(1);
     }
 }
 
+impl crate::query_cache::AskOnce for Items {
+    fn clear_pending(&mut self) {
+        Items::clear_pending(self);
+    }
+}
+
 /// The ask-once trio every UI resolver needs to be tested: the template cache, the command
 /// channel, and — crucially — the channel's live **receiver**, without which every `ItemQuery`
 /// send fails and the "asked the server" half of the law goes unobservable. `items` starts empty,
@@ -668,7 +664,7 @@ pub(crate) const EQUIPMENT_SLOT_OFFHAND: u8 = 16;
 /// slot or a template still in flight.
 fn equipped_class(
     store: &ObjectStore,
-    items: &mut Items,
+    items: &Items,
     commands: &NetCommands,
     slot: u8,
 ) -> Option<u8> {
@@ -689,7 +685,7 @@ fn equipped_class(
 /// was once missing from all three of its call sites.
 pub(crate) fn disarmed_equipment_slot(
     store: &ObjectStore,
-    items: &mut Items,
+    items: &Items,
     commands: &NetCommands,
 ) -> Option<u8> {
     if store.0.unit_flags() & crate::creature_anim::UNIT_FLAG_DISARMED == 0 {
diff --git a/crates/benilla-app/src/lib.rs b/crates/benilla-app/src/lib.rs
index 90828ce5..093dd2ce 100644
--- a/crates/benilla-app/src/lib.rs
+++ b/crates/benilla-app/src/lib.rs
@@ -58,7 +58,9 @@ mod chat_bubble;
 mod chr_classes;
 mod cinematic;
 mod combat_text;
+mod console;
 mod cooldowns;
+mod crash;
 mod creature_anim;
 mod cursor;
 mod cvars;
@@ -74,6 +76,7 @@ mod dynamic_interior;
 mod entities;
 mod fishing_line;
 mod footprints;
+mod game_plugins;
 mod glue;
 mod glue_strings;
 mod go_anim;
@@ -101,8 +104,10 @@ mod portrait;
 mod preflight;
 #[cfg(feature = "dev")]
 mod probe_shield;
+mod query_cache;
 mod quest_markers;
 mod raid_marks;
+mod ranged_flex;
 mod realm_select;
 mod realmlist;
 mod run_mode;
@@ -119,9 +124,14 @@ mod opaque2d;
 mod shutdown;
 mod smart_rect;
 mod sound;
+/// The two talent spell-modifier tables (`SMSG_SET_FLAT_/PCT_SPELL_MODIFIER`) and the read that
+/// puts them on a number.
+mod spell_mods;
 /// The melee swing refusal's latch + 4 s repeat (`SMSG_ATTACKSWING_*`).
 mod swing_refusal;
 mod target;
+#[cfg(test)]
+pub(crate) mod test_support;
 mod text_filter;
 mod text_reshape;
 mod textinput;
@@ -204,84 +214,6 @@ mod world_state;
 mod world_state_ui;
 
 use bevy::prelude::*;
-use blob_shadow::BlobShadowPlugin;
-use bowstring::BowstringPlugin;
-use camera_shake::CameraShakePlugin;
-use chr_classes::ChrClassesPlugin;
-use cinematic::CinematicPlugin;
-use creature_anim::CreatureAnimPlugin;
-use cursor::CursorPlugin;
-use entities::EntitiesPlugin;
-use fishing_line::FishingLinePlugin;
-use footprints::FootprintsPlugin;
-use loading_screen::LoadingScreenPlugin;
-use name_persist::NamePersistPlugin;
-use net::NetPlugin;
-use player::PlayerPlugin;
-use portrait::PortraitPlugin;
-use quest_markers::QuestMarkersPlugin;
-use sound::SoundPlugin;
-use target::TargetPlugin;
-use textinput::TextInputPlugin;
-use transport::TransportPlugin;
-use tutorial::TutorialPlugin;
-use ui_action::UiActionPlugin;
-use ui_auction::UiAuctionPlugin;
-use ui_aura::UiAuraPlugin;
-use ui_bank::UiBankPlugin;
-use ui_battlefield::BattlefieldPlugin;
-use ui_battlefield_positions::BattlefieldPositionsPlugin;
-use ui_battlefield_score::BattlefieldScorePlugin;
-use ui_binder::UiBinderPlugin;
-use ui_cast::UiCastPlugin;
-use ui_char::UiCharPlugin;
-use ui_chat::UiChatPlugin;
-use ui_craft::UiCraftPlugin;
-use ui_dialog_verbs::UiDialogVerbsPlugin;
-use ui_duel::UiDuelPlugin;
-use ui_follow::UiFollowPlugin;
-use ui_gm_ticket::UiGmTicketPlugin;
-use ui_gossip::UiGossipPlugin;
-use ui_guild::UiGuildPlugin;
-use ui_instance::UiInstancePlugin;
-use ui_item_text::UiItemTextPlugin;
-use ui_items::UiItemsPlugin;
-use ui_layout::UiLayoutPlugin;
-use ui_logout::UiLogoutPlugin;
-use ui_loot::UiLootPlugin;
-use ui_loot_roll::UiLootRollPlugin;
-use ui_mail::UiMailPlugin;
-use ui_merchant::UiMerchantPlugin;
-use ui_mirror::UiMirrorPlugin;
-use ui_net::UiNetPlugin;
-use ui_party::UiPartyPlugin;
-use ui_pass::PlayerUiPlugin;
-use ui_pet::UiPetPlugin;
-use ui_pet_book::UiPetBookPlugin;
-use ui_pet_doll::UiPetDollPlugin;
-use ui_pet_stats::UiPetStatsPlugin;
-use ui_petition::UiPetitionPlugin;
-use ui_quest::UiQuestPlugin;
-use ui_quest_log::UiQuestLogPlugin;
-use ui_quest_share::QuestSharePlugin;
-use ui_saved::UiSavedPlugin;
-use ui_script::UiScriptPlugin;
-use ui_shapeshift::UiShapeshiftPlugin;
-use ui_social::UiSocialPlugin;
-use ui_spellbook::UiSpellbookPlugin;
-use ui_stable::UiStablePlugin;
-use ui_summon::UiSummonPlugin;
-use ui_tabard::TabardUiPlugin;
-use ui_talent::UiTalentPlugin;
-use ui_talent_wipe::UiTalentWipePlugin;
-use ui_taxi::UiTaxiPlugin;
-use ui_text::UiTextPlugin;
-use ui_tooltip::UiTooltipPlugin;
-use ui_trade::UiTradePlugin;
-use ui_tradeskill::UiTradeSkillPlugin;
-use ui_trainer::UiTrainerPlugin;
-use ui_unit::UiUnitPlugin;
-use world_backdrop::WorldBackdropPlugin;
 
 // The `benilla` launcher shim (the bin package) is this library's only caller: it stamps the
 // build id at compile time and hands it into [`run`]. Re-exported so the shim needs no bevy
@@ -308,6 +240,16 @@ pub fn run(build: BuildId) -> AppExit {
         dev::print_scenario_names();
         return AppExit::Success;
     }
+    // `WOW_PROBE=list` prints the probe fleet's environment registry (`capture::probe_env`) the
+    // same way — before any window, so a session can ask the binary what the fleet takes.
+    if std::env::var("WOW_PROBE").as_deref() == Ok("list") {
+        dev::print_probe_vars();
+        return AppExit::Success;
+    }
+
+    // From here on a panic leaves `benilla-config/Diagnostics/crash-<unix>.txt` behind (decision
+    // 2266 §B2) — armed before the `App` exists, so a panic while plugins build is a report too.
+    crash::install(build);
 
     let mut app = App::new();
     // The stamp is plain data from here on — the panel footer and preflight banner read it back.
@@ -516,9 +458,6 @@ pub fn run(build: BuildId) -> AppExit {
         },
         ..default()
     }))
-    // The game's own WGSL, compiled into the binary (decision 1175) — before anything that could
-    // ask for one. The engine's seven register themselves inside `WorldPlugins` below.
-    .add_plugins(shaders::plugin)
     .add_plugins(benilla_world::thread_qos::ThreadQosPlugin)
     // The app-side half of background instrumented runs: undo winit's forced macOS app
     // activation so a probe/capture launch never yanks focus off the director's screen. The
@@ -547,339 +486,13 @@ pub fn run(build: BuildId) -> AppExit {
     // build appends a per-second row of position, frame cost and the GPU's per-pass split to
     // `benilla-config/Diagnostics/fps-journal.csv`; `WOW_FPS_JOURNAL=<csv>` is the harness lever.
     .add_plugins(perf::FpsJournalPlugin)
-    .add_plugins(BowstringPlugin)
-    .add_plugins(weapon_trail::WeaponTrailPlugin)
-    .add_plugins(FishingLinePlugin)
-    .add_plugins(QuestMarkersPlugin)
-    // Pipeline-compile counters + the live-compile tripwire (decision 0837: macOS builds every
-    // pipeline synchronously on the render thread, so a live compile is a felt stall).
-    .add_plugins(pipe_warm::plugin)
-    // Streamed world entities: cube assets + display catalogs at startup, sync each frame.
-    .add_plugins(EntitiesPlugin)
-    // Creature animation: pick Stand/Walk/Run from each creature's movement state each frame (Milestone C).
-    .add_plugins(CreatureAnimPlugin)
-    // The unit blob shadow: the dark ground oval under every unit, sized from the playing
-    // animation's box (the byte-verified law — wow-re unit-blob-shadow RE), on the same
-    // surface-decal projector as the selection ring. `worldShadows 0` — the shipped default,
-    // the faithful 1.12 frame — draws it exactly as the reference does; while `worldShadows 1`
-    // the realtime shadow-map path owns unit shadows and this lane hides (the gate inside
-    // `update_shadows`), so a unit never wears the oval underneath its cast shadow.
-    .add_plugins(BlobShadowPlugin)
-    // Footprint decals (B212, decision 1006): the prints a walking unit leaves on snow/sand,
-    // spawn-once projections on the same decal projector, fading off the effect stream.
-    .add_plugins(CameraShakePlugin)
-    .add_plugins(FootprintsPlugin)
-    // GameObject animation (decision 0242): net-streamed GObjects (doors/chests) play an M2 sequence
-    // on GAMEOBJECT_STATE change — the state-machine sibling of the doodad idle loop above.
-    .add_plugins(go_anim::plugin)
-    .add_plugins(doodad_events::plugin)
-    // Avatar + camera + input.
-    .add_plugins(PlayerPlugin)
-    // Cinematic fly-bys (`SMSG_TRIGGER_CINEMATIC`): the race intro a first login plays, and the
-    // GameObject cameras. Takes the world camera for the duration — hence after PlayerPlugin,
-    // whose `control` it overrides within the same stage (decision 0196's deferred arc).
-    .add_plugins(crate::screen_fade::ScreenFadePlugin)
-    .add_plugins(CinematicPlugin)
-    // The real client's hardware mouse cursor (native NSCursor on macOS).
-    .add_plugins(CursorPlugin)
-    // Net↔ECS bridge: spawns the world thread, exposes the snapshot + writer resources. In capture
-    // mode the IO thread is skipped (`connect: false`) so the scene is deterministic.
-    .add_plugins(NetPlugin {
+    // **The game, as one name** (decision 2279): everything the client adds on top of the
+    // engine, in the order it always had. See `game_plugins.rs` for the members, the ordering
+    // edges inside it that are load-bearing, and the test that builds it headless.
+    .add_plugins(game_plugins::GamePlugins {
         connect: !capturing,
-    })
-    // The death arc (decision 0308): the wire-fed death stores + the root/water-walk ack messages.
-    .add_plugins(death::DeathPlugin)
-    // The shared glue vocabulary both pre-world screens stand on (decision 0465): the ADD-mode UI
-    // material, the client-data art set, the GlueStrings table.
-    .add_plugins(glue::GluePlugin)
-    // The glue layer (decision 0193): the ClientState machine + the character-select screen
-    // that answers the parked IO thread's pick. A world capture boots straight InWorld (no net,
-    // no picker); a glue capture boots onto the screen it photographs.
-    .add_plugins(char_select::CharSelectPlugin {
         start: run_mode::start_state(),
-    })
-    // The login screen (decision 0539): the faithful AccountLogin glue + the credential policy
-    // that answers the IO thread's pre-logon park.
-    .add_plugins(login::LoginPlugin)
-    // The realm list: the faithful RealmList glue + the policy that answers the IO thread's
-    // realm park. The client used to take `realms.first()` and offer no way to say otherwise.
-    .add_plugins(realm_select::RealmSelectPlugin)
-    // The character-creation screen + its live preview booth (decision 0423).
-    .add_plugins(char_create::CharCreatePlugin)
-    // Audio: the delegated mixer + WoW's owned selection layer (decision 0070).
-    .add_plugins(SoundPlugin)
-    // Targeting: left-click a unit to select it (→ CMSG_SET_SELECTION) + draw its ground ring.
-    .add_plugins(TargetPlugin)
-    .add_plugins(TransportPlugin)
-    // Faithful world-load splash + progress bar on startup + cross-map teleport (the load latency
-    // streaming can't hide); per-map art via the Map.dbc→LoadingScreens.dbc→BLP chain.
-    .add_plugins(LoadingScreenPlugin)
-    // The player-UI quad pass (decision 0068 §2): its own composited-above-the-world,
-    // below-the-egui-dev-overlays camera + sorted-quad renderer. `$WOW_UI_DEMO=1` seeds a proof scene.
-    .add_plugins(PlayerUiPlugin)
-    // The world's frame, rendered off-screen and drawn first in the UI camera's main pass —
-    // the seam that puts the UI-over-world blend back into gamma bytes (0161/0254's last piece,
-    // a pass rather than a quad since 2234). Registered AFTER the UI pass: it points that
-    // plugin's camera at the world camera.
-    .add_plugins(WorldBackdropPlugin)
-    // The HUD minimap (decision 0203 phase 1): fills the `<Minimap>` widget's extracted hole with
-    // the streamed tile window + mask + player arrow, and feeds the zone text.
-    .add_plugins(minimap::MinimapPlugin)
-    // The pet-bar / spellbook autocast shine, drawn on the append lane from the conversion's
-    // parked sites — zero per-frame script-layout traffic (decision 1383, B282).
-    // The `<Model>` widgets' M2s, rendered as tiles of one atlas and composited at the
-    // callback rank (decision 2008).
-    .add_plugins(ui_models::UiModelsPlugin)
-    // The shared AreaTable catalog + the ZONE_CHANGED event family / zone-text host globals
-    // behind GetZoneText & co. (the zone-entry splash arc, decision 0287).
-    .add_plugins(area::AreaPlugin)
-    .add_plugins(area_poi::AreaPoiPlugin)
-    .add_plugins(world_state_ui::WorldStateUiPlugin)
-    // The `AreaTrigger.dbc` volumes + the per-frame containment check that reports walking into
-    // one (`CMSG_AREATRIGGER`) — the client's whole part in portals, instance entrances and
-    // explore objectives; the server owns what each trigger means.
-    .add_plugins(area_trigger::AreaTriggerPlugin)
-    .add_plugins(ui_world_map::WorldMapUiPlugin)
-    // The guard's directions marker (`SMSG_GOSSIP_POI`) — one landmark record, drawn by the
-    // minimap's landmark pass and the world map's POI child, cleared by arriving at it.
-    .add_plugins(poi_marker::PoiMarkerPlugin)
-    // The glyph atlas (client TTFs -> baked bitmap) `ui_script`'s extraction draws `FontString`
-    // regions through. Loads at Startup, after the asset chain opens (decision 0068 §2).
-    .add_plugins(UiTextPlugin)
-    // The one "which NPC am I interacting with" answer, shared by the portrait booth's `"npc"`
-    // token and the interaction face-me (decision 1467) — hence its own plugin, ahead of both.
-    .add_plugins(ui_session::UiSessionPlugin)
-    // Unit-frame portraits: the token -> off-screen-baked-face bridge the UI extract samples for a
-    // `SetPortraitTexture`-bound region (the modern high-res 2D model bake).
-    .add_plugins(PortraitPlugin)
-    .add_plugins((TextInputPlugin, UiScriptPlugin))
-    // The video knobs the CVar host writes into (today: `gxVSync`). Before CvarPlugin so the
-    // resource exists when `load_config` applies the saved value at Startup.
-    .add_plugins(video::VideoPlugin)
-    // MONKEY (shadows): the shared rig (loads first) + the two independent lane plugins.
-    .add_plugins((
-        shadow_core::ShadowCorePlugin,
-        character_shadow::CharacterShadowPlugin,
-        world_shadow::WorldShadowPlugin,
-        torch_shadow::TorchShadowPlugin,
-        // MONKEY (dynamic interiors): the fixture-lit interior lane's cvar bridge — independent
-        // of the shadow lanes, a plain drop-in.
-        dynamic_interior::DynamicInteriorPlugin,
-    ))
-    // The realmlist (decision 1667) — the logon address the login screen edits. Same reason as
-    // VideoPlugin above: it is a CVar knob, so its resource has to exist before `load_config`.
-    .add_plugins(realmlist::RealmlistPlugin)
-    // The CVar host (decision 0954): registration, knob sync, config.toml persistence. After
-    // UiScriptPlugin only for reading order — its systems gate on the VM existing anyway.
-    .add_plugins(cvars::CvarPlugin)
-    // The key-binding engine (decision 0997): the chord→command dispatch every rebindable input
-    // runs through, its persistence, and the Key Bindings window's capture seam.
-    .add_plugins(bindings::BindingsPlugin)
-    // The unit snapshot + event feed (decision 0068 §3): pushes ECS game state into the VM as the
-    // plain data the `Unit*` bindings read, and fires the matching WoW events.
-    .add_plugins(UiUnitPlugin)
-    .add_plugins(UiPartyPlugin)
-    // Duels (decision 0633): the wire session, the client-side countdown tick, the four Era
-    // events, and the accept/cancel/challenge intents.
-    .add_plugins(UiDuelPlugin)
-    // Setting your hearthstone (decision 1331): the innkeeper's SMSG_BINDER_CONFIRM question, the
-    // CONFIRM_BINDER dialog it raises, and the CMSG_BINDER_ACTIVATE its Accept sends — the only
-    // packet in the flow that actually binds anything.
-    .add_plugins(UiBinderPlugin)
-    // The dialog engine's own verbs (decision 1963): the pet trainer's question, the instance
-    // boot clock, the area spirit healer, the battleground queue, the meeting stone.
-    .add_plugins(UiDialogVerbsPlugin)
-    .add_plugins(BattlefieldScorePlugin)
-    .add_plugins(BattlefieldPlugin)
-    .add_plugins(BattlefieldPositionsPlugin)
-    .add_plugins(crate::game_tip::GameTipPlugin)
-    .add_plugins(crate::text_filter::TextFilterPlugin)
-    // The re-shape a `bevy_ui` text root loses when its last span is despawned
-    // (decision 2212, B383): an upstream change-detection hole whose only symptom is a
-    // panic inside `bevy_text` on the next window resize.
-    .add_plugins(crate::text_reshape::TextReshapePlugin)
-    .add_plugins(TutorialPlugin)
-    // The melee swing refusals (`SMSG_ATTACKSWING_NOTINRANGE`/`_BADFACING`/`_DEADTARGET`/
-    // `_CANT_ATTACK`): the latch the packets set, and the 4 s repeat that shows it while an
-    // attack target stands and no swing lands.
-    .add_plugins(swing_refusal::SwingRefusalPlugin)
-    // Being summoned (decision 1747): SMSG_SUMMON_REQUEST's latch, the CONFIRM_SUMMON dialog it
-    // raises, and the CMSG_SUMMON_RESPONSE its Accept sends. The binder's twin one line up — a
-    // server-asked question whose only wire answer is yes — and here for that reason.
-    .add_plugins(UiSummonPlugin)
-    // The GM trouble-ticket flow (decision 1673): the Help window's five sends, the UPDATE_TICKET
-    // answer ticket behind its 10-minute poll, and the GMTicketCategory.dbc list its "page a GM"
-    // rows are built from. Beside the binder because it is the same feed/drain shape, and after it
-    // because both want UiInput ordering and this reads better grouped.
-    .add_plugins(UiGmTicketPlugin)
-    // Auto-follow's UI seam: the popup's Follow row + `FollowUnit`/`FollowByName` inbound, and
-    // the AUTOFOLLOW_BEGIN/END pair that drives the centre-screen status line outbound.
-    .add_plugins(UiFollowPlugin)
-    // Instance/raid lockouts (decision 1748): the four CHAT_MSG_SYSTEM lines the client composes
-    // itself out of GlobalStrings, the last-dungeon/ownership bookkeeping behind
-    // `CanShowResetInstances()`, and the SELF menu's one send. Beside the binder family for the
-    // same feed/drain shape; it needs the map catalog, which is up long before Update runs.
-    .add_plugins(UiInstancePlugin)
-    // Leaving (decision 0674): the game menu's Logout/Exit Game — the request, the server's
-    // 20-second answer narrated as the CAMP/QUIT countdown, and the process exit.
-    .add_plugins(UiLogoutPlugin)
-    .add_plugins(UiSocialPlugin)
-    // Guilds (decision 1257): the identity/roster mirror behind the four guild windows, the
-    // membership verbs, and the `ERR_GUILD_*` lines. Right after the social session, whose
-    // FriendsFrame it shares a window with and whose ignore list its sign-on lines consult.
-    .add_plugins(UiGuildPlugin)
-    // Founding a guild (decision 1672): the guild registrar and the charter window — the slice
-    // 1257 §2 left out. Right after the guild session, whose error channel its refusals ride and
-    // whose roster its success produces.
-    .add_plugins(UiPetitionPlugin)
-    .add_plugins(UiTooltipPlugin)
-    // The character-window feed (decision 0208): the combat-stats/inventory snapshots + events
-    // the paper doll reads, and the paper-doll booth's yaw mirror.
-    .add_plugins(UiCharPlugin)
-    // The reputation-pane feed: the player's wire faction slots resolved against Faction.dbc into
-    // the pane's snapshot, plus the pane's three outbound verbs. Beside the character feed because
-    // it is the same window's other tab.
-    .add_plugins(ui_reputation::UiReputationPlugin)
-    // The inspect feed (decision 0631): another player's equipment off their PUBLIC visible-item
-    // entries, plus the "inspect" booth's unit + yaw. Right after the character feed it mirrors.
-    .add_plugins(ui_inspect::InspectUiPlugin)
-    // The honor feed (decision 1512): the PRIVATE honor descriptor block as the snapshot both
-    // Honor tabs read, plus the inspect-honor round trip. After the inspect feed because it
-    // resolves that feed's target to address its request at.
-    .add_plugins(ui_honor::UiHonorPlugin)
-    // The dressing-room feed (decision 1060): the window's try-on intents → the player's own look
-    // with the tried-on items substituted in, plus the "dressup" booth's yaw. Beside the inspect
-    // feed, whose shape it shares (intents in, a booth look out).
-    .add_plugins(ui_dressup::DressUpUiPlugin)
-    .add_plugins(UiActionPlugin)
-    // The aura feed (decisions 0255/0257): the player's insertion-ordered buff/debuff cache + the
-    // self-only durations, pushed as the data the `UnitAura` bindings read; fires UNIT_AURA and
-    // drains the right-click cancels. After UiActionPlugin (shares its `Spells` catalog).
-    .add_plugins(UiAuraPlugin)
-    // The spellbook window feed (decision 0216 §8, slice 5): builds the book from
-    // PlayerActions.spells through the Spell.dbc/SkillLine.dbc join and drives
-    // SpellBookFrame.xml's snapshot + cast-drain seam — the spell SOURCE for the cursor payload
-    // arc (bags/doll/bars/book). After UiActionPlugin (shares its `Spells` resource + the cast
-    // tail `send_spell_cast`).
-    .add_plugins(UiSpellbookPlugin)
-    // The macro system (decision 0983): the icon chooser's catalog, the `benilla-config/macros/`
-    // files, `UPDATE_MACROS`, and the macro→bound-spell table the action bar's MACRO slots
-    // resolve their cooldown/usability through. After UiSpellbookPlugin — the bound spell is
-    // resolved against the book that feed pushes, by the same law `CastSpellByName` uses.
-    .add_plugins(ui_macro::UiMacroPlugin)
-    // The talent window feed (decision 0304): builds the class pages from Talent.dbc × the
-    // known-spell set + PLAYER_CHARACTER_POINTS, drives TalentFrame.xml through the engine's
-    // talent seam, and drains learn clicks into CMSG_LEARN_TALENT. After UiActionPlugin
-    // (shares its `Spells` catalog), beside the spellbook it mirrors.
-    .add_plugins(UiTalentPlugin)
-    // Unlearning them again (decision 1580): the class trainer's respec question, its
-    // CONFIRM_TALENT_WIPE dialog, and the answer that is the only packet in the flow which
-    // unlearns anything. Beside UiTalentPlugin for the subject, but it is UiBinderPlugin's twin
-    // in shape — a guid-carrying question over an already-closed gossip menu.
-    .add_plugins(UiTalentWipePlugin)
-    // The stance/shapeshift bar feed (wow-re shapeshift-bar-api.md): builds the form list from
-    // PlayerActions.spells per the byte-verified admission/order, drives the stock shapeshift bar through
-    // the engine's shapeshift seam, and drains its clicks (cancel-if-active else cast). After
-    // UiActionPlugin (shares `Spells`, the `usable` walk, and the cast tail).
-    .add_plugins(UiShapeshiftPlugin)
-    // The pet action bar (decision 0982) — the stance bar's mirror image: server-authoritative,
-    // so this renders the ten packed words the last `SMSG_PET_SPELLS` delivered and sends
-    // intents back. After UiActionPlugin (shares `Spells` and the cooldown triple's clock).
-    .add_plugins(UiPetPlugin)
-    .add_plugins(ChrClassesPlugin)
-    .add_plugins(UiPetBookPlugin)
-    // The pet's paper-doll stat block (happiness/loyalty/XP/training points). Its own plugin
-    // because it runs off descriptor fields and two DBC tables rather than off `SMSG_PET_SPELLS`.
-    .add_plugins(UiPetStatsPlugin)
-    // The pet paper doll's SHARED surface (decision 1057) — the combat-stats snapshot under the
-    // `"pet"` token and the page's model booth. Apart from the block above because these values
-    // pass through the character sheet's own bindings and events, with no hunter gate.
-    .add_plugins(UiPetDollPlugin)
-    // The connection-telemetry feed: the averaged ping RTT behind `GetNetStats()`, which the main
-    // bar's performance meter polls (decision 0658).
-    .add_plugins(UiNetPlugin)
-    .add_plugins(UiCastPlugin)
-    // The breath / fatigue bars (decision 0874): server-authoritative mirror timers off the
-    // wire into the transcribed MirrorTimer1/2/3 frames. Beside the cast bar it shares its
-    // feed→drain shape (and its art: the same UI-CastingBar-Border chrome).
-    .add_plugins(UiMirrorPlugin)
-    // Floating combat text (decision 0137 phase 2): the WORLDTEXTSTRING law — world-anchored
-    // damage numbers/outcome words projected into the UI quad pass each frame.
-    .add_plugins(combat_text::CombatTextPlugin)
-    // Overhead unit names (nameplates): world-billboard name text over players + NPCs.
-    .add_plugins(nameplates::NameplatesPlugin)
-    // Raid-target marker billboards (0434 §6): the mark icon over marked units, one line-pitch
-    // above the overhead name; plated units show the plate's raid child instead.
-    .add_plugins(raid_marks::RaidMarksPlugin)
-    // V-key nameplates (0167): the toggled health-bar plates, a 2-D overlay replacing the
-    // overhead name on plated units.
-    .add_plugins(vplates::VPlatesPlugin)
-    // Chat speech bubbles (0598): the over-the-head bubble a say/yell/party line spawns, the
-    // plates' 2-D overlay sibling — mutually exclusive with both the plate and the name.
-    .add_plugins(chat_bubble::ChatBubblePlugin)
-    // TOGGLEUI (`CTRL-Z`/`Cmd-Z`): the whole quad layer goes dark — frames, minimap, plates,
-    // bubbles, combat text — leaving the world and the cursor.
-    .add_plugins(ui_hide::UiHidePlugin)
-    .add_plugins(UiItemsPlugin)
-    // The gossip window (decision 0081): fills from the net drain's GossipState and drives
-    // GossipFrame.xml over the Era gossip API.
-    .add_plugins(UiGossipPlugin)
-    // The merchant window (decision 0081 phase 4): fills from the net drain's MerchantOpen and
-    // drives MerchantFrame.xml over the Era vendor API + the money display.
-    .add_plugins(UiMerchantPlugin)
-    // The bank window (decision 0604): the SHOW_BANK session (BankOpen) + the purchase row;
-    // the vault's slots ride the container feed as bags −1/5..=10.
-    // The auction house (decision 1511) — an NPC-session window like the bank beside it, but the
-    // only `doublewide` panel in the UI, so it displaces both the left and center seats.
-    .add_plugins(UiAuctionPlugin)
-    .add_plugins(UiBankPlugin)
-    // The mail window (decision 0544 P1/P2): the client-side mailbox session (MailOpen), the
-    // NPC-session range guard, and MailFrame.xml over the Era mail API (inbox, open-letter,
-    // send tab).
-    .add_plugins(UiMailPlugin)
-    // Player-to-player trade (TradeFrame.xml): the two-sided trade window, driven server-side over
-    // the P0 wire; the partner's portrait rides the shared "npc" booth (decision 0592 P1).
-    .add_plugins(UiTradePlugin)
-    // The item-text reader (ItemTextFrame.xml): right-clicked bag letters (mail-made permanent
-    // copies) read in the reference reader window over the shared ask-once item-text cache.
-    .add_plugins(UiItemTextPlugin)
-    .add_plugins(UiSavedPlugin)
-    .add_plugins(NamePersistPlugin)
-    .add_plugins(UiStablePlugin)
-    .add_plugins(TabardUiPlugin)
-    .add_plugins(UiTrainerPlugin)
-    // The taxi map (decision 0484 phases 1-2): the SMSG_SHOWTAXINODES-fed TaxiState resource, the
-    // NPC-session range guard, and the TaxiFrame.xml window feed/drain (catalogs, node
-    // projection/route computation, the activate send, the UnitOnTaxi ride flag).
-    .add_plugins(UiTaxiPlugin)
-    .add_plugins(UiTradeSkillPlugin)
-    .add_plugins(UiCraftPlugin)
-    // The loot window (decision 0084): fills from the net drain's LootState and drives
-    // LootFrame.xml over the Era loot API (coin + rows, paging).
-    .add_plugins(UiLootPlugin)
-    .add_plugins(UiLootRollPlugin)
-    // The questgiver window (decision 0088): fills from the net drain's QuestGiver and drives
-    // the stock questgiver window's four sub-panels over the Era quest API (1944).
-    .add_plugins(UiQuestPlugin)
-    // The quest-log window (decision 0088's deferred second slice): fills from the self player's
-    // PLAYER_QUEST_LOG descriptor slots + the SMSG_QUEST_QUERY_RESPONSE template cache, and drives
-    // the stock quest log over the Era quest-log API (1944).
-    .add_plugins(UiQuestLogPlugin)
-    // The party quest-share (decision 1733): the verdict lines on a quest we pushed, and the
-    // escort-quest confirm. Neither is bound to a window, so it is its own plugin rather than a
-    // lodger in either quest plugin above.
-    .add_plugins(QuestSharePlugin)
-    .add_plugins(UiChatPlugin)
-    // The layout cache: the geometry of every window the player has dragged or resized, restored
-    // at world entry and written back a quiet second after the last drag
-    // (`benilla-config/layout/<realm>-<character>.txt`). The consumer of the engine's userPlaced
-    // bit, which nothing read before it.
-    .add_plugins(UiLayoutPlugin)
-    // Print screen (decision 1487): the SCREENSHOT binding's engine half — one PNG per
-    // `Screenshot()` call into `benilla-config/Screenshots/` (never the install — decision 1486),
-    // answered to the UI as SCREENSHOT_SUCCEEDED/FAILED so the status text can never be in the
-    // frame it announces.
-    .add_plugins(screenshot::ScreenshotPlugin);
+    });
 
     // Register benilla-assets' loaders AFTER `AssetPlugin` (they go into the live `AssetServer`).
     benilla_assets::register_asset_loaders(&mut app);
diff --git a/crates/benilla-app/src/loading_screen.rs b/crates/benilla-app/src/loading_screen.rs
index fb418f26..b08d3d48 100644
--- a/crates/benilla-app/src/loading_screen.rs
+++ b/crates/benilla-app/src/loading_screen.rs
@@ -549,7 +549,7 @@ fn setup_loading_screen(
 
 /// Per-frame: observe the lifecycle edges, run the trigger/clear state machine, resolve backdrop
 /// art, and push the progress fraction into the bar.
-#[allow(clippy::too_many_arguments, clippy::type_complexity)]
+#[allow(clippy::type_complexity)]
 fn drive_loading_screen(
     mut screen: ResMut<LoadingScreen>,
     // The streamer's two published facts, bundled into one param (Bevy's 16-element system-param
diff --git a/crates/benilla-app/src/login/mod.rs b/crates/benilla-app/src/login/mod.rs
index d5c97292..234f5019 100644
--- a/crates/benilla-app/src/login/mod.rs
+++ b/crates/benilla-app/src/login/mod.rs
@@ -95,6 +95,11 @@ impl Plugin for LoginPlugin {
                     )
                         .chain()
                         .before(crate::glue::GlueVisuals)
+                        // After the UI tick: one member holds the VM (`answer_dialog` writes
+                        // into it), and every VM holder in `Update` declares its side of the
+                        // tick (decision 2304). A glue screen has no push the tick must see,
+                        // so the whole chain takes the drain side.
+                        .after(crate::ui_script::UiInput)
                         .run_if(in_state(ClientState::Login)),
                     (smoke::debug_login_smoke, screen::debug_login_shot),
                 )
@@ -156,7 +161,8 @@ impl LoginIntent {
 /// the channel to the parked IO thread, the abandon generation a Cancel bumps, and — since
 /// decision 1667 — the realmlist it dials.
 ///
-/// A bundle rather than four parameters, for `cvars::KnobParams`' reason: adding the realmlist put
+/// A bundle rather than four parameters, for the reason the CVar host's old knob bundle had
+/// (retired by 2303): adding the realmlist put
 /// [`login_input`] at **seventeen** parameters, one past Bevy's ceiling, and the three systems
 /// that submit were already re-typing the same four names. Now a submit is one call on one param,
 /// and the next thing an attempt needs is one field here instead of a fourth signature to widen.
@@ -447,7 +453,6 @@ fn logon_refusal_text(strings: &GlueStrings, code: Option<u8>) -> &str {
 /// The policy tick + the net-message reactions. Runs in every state (the reconnect path fires
 /// while `InWorld`); the screen's own submit comes through [`login_input`], which calls
 /// [`send_login`] with `announced = true`.
-#[allow(clippy::too_many_arguments)]
 fn drive_policy(
     mut attempt: Attempt,
     realm_list_up: Res<crate::realm_select::Realms>,
@@ -792,7 +797,7 @@ fn enter_login(mut form: ResMut<LoginForm>, mut preview: ResMut<GluePreview>) {
 /// The screen's input: typing into the focused box (the ref's 16-letter cap), Tab cycling, Enter
 /// submits, Esc quits (dialog-first — an open dialog's Esc is its Cancel/Okay), clicks focus the
 /// boxes / press the buttons / toggle the checkbox.
-#[allow(clippy::too_many_arguments, clippy::type_complexity)]
+#[allow(clippy::type_complexity)]
 fn login_input(
     realms: Res<crate::realm_select::Realms>,
     presses: Query<(Entity, &LoginAction, Ref<Interaction>)>,
diff --git a/crates/benilla-app/src/login/screen.rs b/crates/benilla-app/src/login/screen.rs
index bfe241c6..bfd1a970 100644
--- a/crates/benilla-app/src/login/screen.rs
+++ b/crates/benilla-app/src/login/screen.rs
@@ -81,7 +81,6 @@ pub(super) struct RealmlistReadout;
 /// Spawn the screen tree once its prerequisites exist (the select screen's boot-order pattern:
 /// the INITIAL state's `OnEnter` fires before the MPQ chain / booth slots do) — and upgrade an
 /// artless early spawn the moment the client art lands.
-#[allow(clippy::too_many_arguments)]
 pub(super) fn materialize_screen(
     mut commands: Commands,
     existing: Query<(Entity, &LoginUi)>,
@@ -137,7 +136,6 @@ pub(super) fn materialize_screen(
     }
 }
 
-#[allow(clippy::too_many_arguments)]
 fn spawn_screen(
     commands: &mut Commands,
     assets: &AssetServer,
diff --git a/crates/benilla-app/src/login/smoke.rs b/crates/benilla-app/src/login/smoke.rs
index 1eb35ca9..083c2fcf 100644
--- a/crates/benilla-app/src/login/smoke.rs
+++ b/crates/benilla-app/src/login/smoke.rs
@@ -38,7 +38,6 @@ pub(crate) fn smoke_character(spec: &str) -> Option<String> {
 /// `WOW_UNATTENDED=1` still needs a way to name a character without taking it. The pick itself
 /// stays `char_select`'s (`apply_roster_policy` reads the third field the same way it reads
 /// `WOW_CHAR`); this only declines to exit. Pair with `WOW_PROBE_EXIT_AT` to bound the run.
-#[allow(clippy::too_many_arguments)]
 pub(super) fn debug_login_smoke(
     state: Res<State<ClientState>>,
     mut attempt: Attempt,
diff --git a/crates/benilla-app/src/minimap/blips/dots.rs b/crates/benilla-app/src/minimap/blips/dots.rs
index 0cd4cf20..b139a7ef 100644
--- a/crates/benilla-app/src/minimap/blips/dots.rs
+++ b/crates/benilla-app/src/minimap/blips/dots.rs
@@ -91,7 +91,6 @@ fn unit_dot_eligible(store: Option<&ObjectStore>, me: Option<u64>) -> bool {
 /// Walks the candidate set rather than the status map — the classifier's own shape (it is a
 /// per-object callback, not a per-status one), and the only way to reach each object's descriptor,
 /// which [`unit_dot_eligible`] needs.
-#[allow(clippy::too_many_arguments)]
 pub(in crate::minimap) fn emit_quest_dots(
     ctx: &BlipCtx,
     statuses: &HashMap<u64, u32>,
@@ -233,7 +232,6 @@ fn creature_type_of(
 /// byte-verified `0x4eac31`). Same hard 3-D radius cull, cross-interior grey, and hover law
 /// as the quest dots; drawn just before them (the draw walks the cell lists in order, so
 /// cells 0/1 sit under a same-spot quest or party dot).
-#[allow(clippy::too_many_arguments)]
 pub(in crate::minimap) fn emit_tracking_dots(
     ctx: &BlipCtx,
     tracking: SelfTracking,
diff --git a/crates/benilla-app/src/minimap/blips/mod.rs b/crates/benilla-app/src/minimap/blips/mod.rs
index 377adf11..50f5ad61 100644
--- a/crates/benilla-app/src/minimap/blips/mod.rs
+++ b/crates/benilla-app/src/minimap/blips/mod.rs
@@ -398,7 +398,6 @@ fn poi_icon_cell(icon: u32) -> Option<[f32; 4]> {
 /// Draw the landmark layer: in-range POI icons at position, then the nearest-3 rim arrows,
 /// each rotated to point at its POI. Records a hover hit (later-drawn wins, matching draw
 /// order).
-#[allow(clippy::too_many_arguments)]
 pub(super) fn emit_landmarks(
     ctx: &BlipCtx,
     cat: Option<&AreaPoiCatalog>,
@@ -566,7 +565,7 @@ pub(super) fn emit_party_arrows(
 pub(super) fn drive_blip_tooltip(
     script: Option<NonSendMut<UiScript>>,
     hover: Res<MinimapBlipHover>,
-    mut names: ResMut<NameCache>,
+    names: Res<NameCache>,
     commands: Res<NetCommands>,
     mut last: Local<crate::ui_script::VmMemo<Option<(String, Vec2)>>>,
 ) {
diff --git a/crates/benilla-app/src/minimap/composite.rs b/crates/benilla-app/src/minimap/composite.rs
index 24b9581c..616d8b8b 100644
--- a/crates/benilla-app/src/minimap/composite.rs
+++ b/crates/benilla-app/src/minimap/composite.rs
@@ -118,8 +118,9 @@ pub(super) fn setup_composite(
     let image = images.add(image);
 
     // A 1×1 quad centred on the origin: every tile is this mesh under its own Transform, so a
-    // panning composite never rewrites a vertex buffer (1463).
-    let quad = meshes.add(Rectangle::new(1.0, 1.0));
+    // panning composite never rewrites a vertex buffer (1463). Its layout is a pipeline key axis
+    // and pipe_warm warms the same mesh, so the builder has one author (2262).
+    let quad = meshes.add(crate::ui_pass::tile_quad_mesh());
 
     let camera = commands
         .spawn((
diff --git a/crates/benilla-app/src/minimap/mod.rs b/crates/benilla-app/src/minimap/mod.rs
index fcb06177..989e04a0 100644
--- a/crates/benilla-app/src/minimap/mod.rs
+++ b/crates/benilla-app/src/minimap/mod.rs
@@ -129,7 +129,7 @@ fn texel_stretch(extent_yd: f32) -> f32 {
 /// above `224/255` (wow-re `system/minimap/scratch/wmo-interior-minimap-composite.md`, VERIFIED).
 /// Written as the exact f32 the client computes rather than the ratio, because that ULP is the
 /// value fragments are compared against.
-const INTERIOR_TILE_ALPHA_REF: f32 = f32::from_bits(0x3F60_E0E2);
+pub(crate) const INTERIOR_TILE_ALPHA_REF: f32 = f32::from_bits(0x3F60_E0E2);
 
 /// The corpse blip's edge as a fraction of the widget side (the POIIcons cell is authored 16px on
 /// a 140px minimap ≈ 0.11; INTERIM eyeball beside [`ARROW_FRACTION`]'s).
@@ -238,6 +238,23 @@ pub(crate) struct MinimapZoom {
     pub(crate) inside: u8,
 }
 
+/// The two zoom indices' change callback (1131, 2303): each index lands on its own field,
+/// clamped exactly like the client's `set_zoom` (`0x6daa10`: clamp at 5) — the widget clamps
+/// again on the way in, so a hand-edited level lands in range whichever path it takes.
+pub(crate) fn on_cvar(ev: On<crate::cvars::CvarChanged>, mut zoom: ResMut<MinimapZoom>) {
+    match ev.key().as_str() {
+        "minimapzoom" => zoom.outdoor = zoom_index(ev.num()),
+        "minimapinsidezoom" => zoom.inside = zoom_index(ev.num()),
+        _ => {}
+    }
+}
+
+/// A stored minimap zoom level → a valid index: truncate to int and clamp into
+/// `[0, MINIMAP_ZOOM_LEVELS)`, the client's own `set_zoom` clamp.
+fn zoom_index(v: f32) -> u8 {
+    v.clamp(0.0, f32::from(benilla_ui::widget::MINIMAP_ZOOM_LEVELS - 1)) as u8
+}
+
 impl Default for MinimapZoom {
     fn default() -> Self {
         Self {
@@ -400,7 +417,6 @@ fn minimap_interior<'a>(
 /// Fills the extracted widget hole: the visible tile quads (clipped to the widget, masked to the
 /// circle) and the player arrow, appended at the widget's own z (stable sort keeps append order
 /// within a key, so the arrow rides above the tiles and below the widget's children).
-#[allow(clippy::too_many_arguments)]
 fn emit_minimap(
     widget: Res<MinimapWidget>,
     assets: Option<Res<MinimapAssets>>,
@@ -935,7 +951,6 @@ fn emit_minimap(
 /// — the client's own signal for "the effective zoom changed" (FrameXML `Minimap_OnEvent`). Without it
 /// the buttons keep the level you left (e.g. `ZoomIn` greyed from an outdoor max-zoom, still greyed
 /// indoors at level 3), which is the director's report (2026-07-09).
-#[allow(clippy::too_many_arguments)] // one Bevy system's full input set
 fn feed_minimap_inside(
     script: Option<bevy::ecs::system::NonSendMut<benilla_ui::script::UiScript>>,
     world: benilla_world::world_point::WorldPoint,
@@ -1060,6 +1075,7 @@ pub(crate) struct MinimapPlugin;
 
 impl Plugin for MinimapPlugin {
     fn build(&self, app: &mut App) {
+        app.add_observer(on_cvar);
         app.init_resource::<MinimapWidget>()
             .init_resource::<MinimapZoom>()
             .init_resource::<MinimapTileCache>()
@@ -1088,27 +1104,36 @@ impl Plugin for MinimapPlugin {
                     composite::drive_composite.after(UiQuadAppend),
                     // Before the script tick, so a zoom button pressed this frame routes to the
                     // indoor/outdoor index that matches where the player actually is.
-                    feed_minimap_inside.before(crate::ui_script::UiInput),
+                    feed_minimap_inside.in_set(crate::ui_script::UiFeed),
                     // Before the script tick, so an addon's OnUpdate steers off this frame's
                     // heading rather than last frame's.
-                    feed_minimap_player_facing.before(crate::ui_script::UiInput),
-                    // Before the emit that reads `MinimapAssets::mask`, so a mask set this frame
-                    // is the one this frame draws with.
-                    feed_minimap_mask.before(UiQuadAppend),
+                    feed_minimap_player_facing.in_set(crate::ui_script::UiFeed),
+                    // After the tick that can call `Minimap:SetMaskTexture`, before the emit that
+                    // reads `MinimapAssets::mask`: a mask set this frame is the one this frame
+                    // draws with.
+                    feed_minimap_mask
+                        .after(crate::ui_script::UiInput)
+                        .before(UiQuadAppend),
                     // Before the script tick, and after the containment verdict it reads: the
                     // `MINIMAP_PING` event and `Minimap:GetPingPosition()`'s value land in the
                     // same tick, on a ping the renderer already drew at the end of last frame.
+                    // Gated on the interface being up (decision 2279): a group member's
+                    // `MSG_MINIMAP_PING` can land in the same drain as the login burst, and the
+                    // `fresh` latch it sets is spent by this system's take — on the boot VM, with
+                    // no `MiniMapPing` frame to show it, if this ran in 2214's one-frame window.
+                    // Gated, the latch simply waits for the first frame with an interface.
                     ping::drive_minimap_ping
                         .after(feed_minimap_inside)
-                        .before(crate::ui_script::UiInput),
+                        .in_set(crate::ui_script::UiFeed)
+                        .run_if(crate::ui_script::ingame_ui_up),
                     // Before the script tick, so GameTimeFrame's OnUpdate reads this frame's
                     // minute, not last frame's.
-                    feed_game_time.before(crate::ui_script::UiInput),
+                    feed_game_time.in_set(crate::ui_script::UiFeed),
                     // After the world-mouseover drive (UnitFeed): a same-frame world-hover→blip
                     // transition must end with the blip tooltip shown, not the fade.
                     blips::drive_blip_tooltip
                         .after(crate::ui_unit::UnitFeed)
-                        .before(crate::ui_script::UiInput),
+                        .in_set(crate::ui_script::UiFeed),
                 ),
             );
     }
diff --git a/crates/benilla-app/src/minimap/ping.rs b/crates/benilla-app/src/minimap/ping.rs
index acc5afbf..50a71981 100644
--- a/crates/benilla-app/src/minimap/ping.rs
+++ b/crates/benilla-app/src/minimap/ping.rs
@@ -134,7 +134,6 @@ pub(super) fn seat_click(ctx: &BlipCtx, ping: &mut MinimapPing, click: Option<(f
 /// Runs before the script tick so the `MINIMAP_PING` event and the position behind
 /// `Minimap:GetPingPosition()` land in the same tick, and so an addon's handler sees a ping that
 /// is already seated (the renderer seated it at the end of the previous frame).
-#[allow(clippy::too_many_arguments)] // one Bevy system's full input set
 pub(super) fn drive_minimap_ping(
     script: Option<bevy::ecs::system::NonSendMut<UiScript>>,
     mut ping: ResMut<MinimapPing>,
diff --git a/crates/benilla-app/src/name_persist.rs b/crates/benilla-app/src/name_persist.rs
index 3dedd158..8f395f90 100644
--- a/crates/benilla-app/src/name_persist.rs
+++ b/crates/benilla-app/src/name_persist.rs
@@ -104,12 +104,16 @@ fn load_name_cache(
     match NameCache::from_tsv(&text, &realm) {
         Some(loaded) => {
             let n = loaded.len();
-            // Replace rather than merge: this is the *start* of a realm's session, so there is
-            // nothing of this realm's in memory to preserve, and a merge would silently keep the
-            // previous realm's records alive under their own keys. (What it replaces is creature
-            // templates — the file carries nothing else since 2223 — and world entry clears the
-            // guid-keyed stores a moment later regardless.)
-            *names = loaded;
+            // **The file's own records go in; nothing else is touched** (decision 2260). This used
+            // to be `*names = loaded`, on the premise stated here that "world entry clears the
+            // guid-keyed stores a moment later regardless" — and the ordering is the other way
+            // round. This loader fires the first frame `identity` answers, which is the frame the
+            // *pick* is in flight; `connected` does its world-session clear and then seeds our own
+            // name in the same neighbourhood. Whichever ran second won, and when it was this one
+            // the player's own name went with it — `UnitName("player")` nil for a wire round-trip,
+            // once per process, on the first login of a fresh start. See
+            // [`NameCache::install_persisted`].
+            names.install_persisted(loaded);
             file.saved_generation = names.generation();
             debug!(
                 "names: loaded {n} cached records for {realm} from {}",
@@ -165,3 +169,134 @@ fn write_now(file: &mut NameCacheFile, names: &NameCache) {
         Err(e) => warn!("names: cannot write {}: {e}", path.display()),
     }
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::local_state::test_env::{EnvGuard, ENV_LOCK};
+
+    /// A roster with a pick in flight and no realm — [`crate::ui_macro::identity`] then answers
+    /// `("Realm", <name>)`, which is the identity the loader keys the file by.
+    fn roster_with_pick(name: &str, guid: u64) -> Roster {
+        Roster::with_pending_pick(
+            vec![benilla_protocol::Character {
+                guid,
+                name: name.into(),
+                race: 1,
+                class: 1,
+                gender: 0,
+                skin: 0,
+                face: 0,
+                hair_style: 0,
+                hair_color: 0,
+                facial_hair: 0,
+                level: 1,
+                zone: 0,
+                map: 0,
+                position: benilla_protocol::wire::Vector3d {
+                    x: 0.0,
+                    y: 0.0,
+                    z: 0.0,
+                },
+                flags: 0,
+                equipment: [benilla_protocol::CharEnumItem::default(); 19],
+                pet_display_id: 0,
+                pet_level: 0,
+                pet_family: 0,
+            }],
+            guid,
+        )
+    }
+
+    /// **The director's report, at the seam that produced it** (decision 2260).
+    ///
+    /// The realm cache is read off disk the first frame the pick's identity is known, and the
+    /// login's seed of our OWN name lands in the same neighbourhood — so the two race, and the
+    /// loader used to win by overwriting the whole cache (`*names = loaded`). What that cost was
+    /// `UnitName("player")` answering **nil** for one wire round-trip on the first login of a
+    /// fresh start, because the feed's player snapshot carries the cache's answer and a `None`
+    /// there replaces the roster seat the UI loaded under. KLHThreatMeter reads it on its first
+    /// `OnUpdate` and indexes a table with it: `KTM_Tables.lua:198: table index is nil`.
+    ///
+    /// The load runs here *after* the seed on purpose: that is the losing order, and it must now
+    /// be survivable rather than merely unlikely.
+    #[test]
+    fn the_disk_load_installs_templates_without_touching_the_live_session() {
+        use benilla_protocol::guid;
+        /// `counter | (entry << 24) | (high << 48)` — the server's own composition.
+        fn compose(high: u16, entry: u32, counter: u32) -> u64 {
+            u64::from(counter) | (u64::from(entry) << 24) | (u64::from(high) << 48)
+        }
+        const CREATURE_ENTRY: u32 = 1234;
+        const PET_NUMBER: u32 = 7;
+        let me = compose(guid::HIGH_PLAYER, 0, 0x2A);
+        let pet = compose(guid::HIGH_PET, PET_NUMBER, 9);
+        let guard = compose(guid::HIGH_UNIT, CREATURE_ENTRY, 1);
+
+        let _l = ENV_LOCK
+            .lock()
+            .unwrap_or_else(std::sync::PoisonError::into_inner);
+        let tmp = std::env::temp_dir().join(format!("benilla-namecache-{}", std::process::id()));
+        let _ = std::fs::remove_dir_all(&tmp);
+        let _capture = EnvGuard::unset("WOW_CAPTURE");
+        let _home = EnvGuard::set("BENILLA_HOME", tmp.to_str().expect("utf-8 temp path"));
+
+        // A realm file with one creature template in it — written the way the saver writes it, so
+        // the header the loader gates on is this build's by construction.
+        let mut on_disk = NameCache::default();
+        on_disk.insert_creature(
+            CREATURE_ENTRY,
+            Some(crate::names::CreatureRecord {
+                name: "Stormwind Guard".into(),
+                subname: None,
+                creature_type: 7,
+                pet_family: 0,
+                rank: 0,
+                type_flags: 0,
+                civilian: false,
+                racial_leader: false,
+                display_id: 0,
+            }),
+        );
+        let path = crate::local_state::name_cache_path("Realm").expect("a state folder");
+        std::fs::create_dir_all(path.parent().expect("cache dir")).expect("cache dir");
+        std::fs::write(&path, on_disk.to_tsv("Realm")).expect("write the realm cache");
+
+        // The live session: the login has already seeded our own name (and a pet's), exactly as
+        // `net::apply::session::connected` does a moment after the pick goes out.
+        let mut names = NameCache::default();
+        names.insert_player(me, "Nelprifour".into(), None);
+        names.insert_pet(PET_NUMBER, "Fluffy".into());
+        let before = names.generation();
+
+        let mut app = App::new();
+        app.insert_resource(roster_with_pick("Nelprifour", me))
+            .insert_resource(names)
+            .init_resource::<NameCacheFile>()
+            .add_systems(Update, load_name_cache);
+        app.update();
+
+        let names = app.world().resource::<NameCache>();
+        assert_eq!(
+            names.peek(me),
+            Some("Nelprifour"),
+            "the login's seed of our own name must survive the disk load — losing it is the bug"
+        );
+        assert_eq!(
+            names.peek(pet),
+            Some("Fluffy"),
+            "…and so must a pet name: the file carries neither, so neither is its to replace"
+        );
+        assert_eq!(
+            names.peek(guard),
+            Some("Stormwind Guard"),
+            "the file's own records are what the load is for"
+        );
+        assert!(
+            names.generation() > before,
+            "a landed record moves the counter the gated feeds watch (1439)"
+        );
+
+        let _ = std::fs::remove_dir_all(&tmp);
+    }
+}
diff --git a/crates/benilla-app/src/nameplates.rs b/crates/benilla-app/src/nameplates.rs
index da5cd612..30227b49 100644
--- a/crates/benilla-app/src/nameplates.rs
+++ b/crates/benilla-app/src/nameplates.rs
@@ -384,7 +384,7 @@ fn build_name_mesh(atlas: &mut UiFontAtlas, lines: &[String]) -> Mesh {
 /// Update (the schedule the mesh pipelines support). The per-frame *placement* is
 /// [`place_nameplates`] (PostUpdate, off this frame's propagated pose) — a fresh plate spawned
 /// here gets its first seat there, same frame (Update commands flush before PostUpdate).
-#[allow(clippy::too_many_arguments, clippy::type_complexity)] // one Bevy system's full input set
+#[allow(clippy::type_complexity)] // one Bevy system's full input set
 pub(crate) fn drive_nameplates(
     mut commands: Commands,
     units: Query<(
@@ -414,7 +414,7 @@ pub(crate) fn drive_nameplates(
         // The UnitName* cvar mask (0992) — the kind gates below read it.
         Res<NameConfig>,
     ),
-    mut names: ResMut<NameCache>,
+    names: Res<NameCache>,
     // The guild-identity cache (1257) — the a5 line's text, and the lazy `CMSG_GUILD_QUERY` a
     // miss sends. `ResMut` because the read IS the ask ([`crate::ui_guild::unit_guild_name`]).
     mut guilds: ResMut<crate::ui_guild::GuildState>,
@@ -801,8 +801,20 @@ pub(crate) struct NameplatesPlugin;
 #[derive(Resource)]
 struct NameAnchorTrace(bool);
 
+/// The overhead-name rows' change callback (decision 2303): the name trio and the guild line.
+pub(crate) fn on_cvar(ev: On<crate::cvars::CvarChanged>, mut names: ResMut<NameConfig>) {
+    match ev.key().as_str() {
+        "unitnameplayer" => names.player = ev.flag(),
+        "unitnamenpc" => names.npc = ev.flag(),
+        "unitnameown" => names.own = ev.flag(),
+        "unitnameplayerguild" => names.player_guild = ev.flag(),
+        _ => {}
+    }
+}
+
 impl Plugin for NameplatesPlugin {
     fn build(&self, app: &mut App) {
+        app.add_observer(on_cvar);
         app.insert_resource(NameAnchorTrace(
             std::env::var_os("WOW_PROBE_NAME_TRACE").is_some(),
         ))
diff --git a/crates/benilla-app/src/names.rs b/crates/benilla-app/src/names.rs
index b0a8c7ef..84e9ed3d 100644
--- a/crates/benilla-app/src/names.rs
+++ b/crates/benilla-app/src/names.rs
@@ -21,13 +21,14 @@
 //! benilla's own addition, and it is what answered a wiped server's brand-new character with a
 //! deleted one's name (report B386, decision 2223).
 
-use std::collections::{HashMap, HashSet};
+use std::collections::HashMap;
 
 use bevy::prelude::*;
 
 use benilla_protocol::guid;
 
 use crate::net::{ClientCommand, NetCommands, ObjectStore};
+use crate::query_cache::QueryCache;
 
 /// The creature template's **`type_flags`** word, bit by bit — the dword the server ships in
 /// `SMSG_CREATURE_QUERY_RESPONSE` and the reference caches at `[CGUnit+0xb30] + 0x14` (its async
@@ -76,7 +77,7 @@ pub(crate) mod type_flags {
 pub(crate) struct NameCache {
     /// Player names by guid. `Some(None)`-shaped answers are stored as `None`: the server was asked
     /// and didn't know (an empty wire name) — cached so we never re-ask a dead guid.
-    players: HashMap<u64, Option<String>>,
+    players: QueryCache<u64, String>,
     /// `(race, class, gender)` from the same `SMSG_NAME_QUERY_RESPONSE` that carried the name — the
     /// wire has always sent these three and we used to drop them. Two consumers now: the
     /// `$`-macro expander's non-player-subject path: the reference resolves a macro subject from
@@ -92,19 +93,17 @@ pub(crate) struct NameCache {
     /// unknown. The subname is the overhead/tooltip title line ("Stable Master", …); the type is
     /// the `CreatureType.dbc` id the TAB-target critter filter reads; rank/civilian feed the
     /// unit tooltip's level-line word + CIVILIAN line (decision 0276).
-    creatures: HashMap<u32, Option<CreatureRecord>>,
+    creatures: QueryCache<u32, CreatureRecord>,
     /// Pet names by **pet number** — the third naming path (see [`Self::resolve`]'s pet branch).
     /// No negative entry exists: the server answers for a live pet or says nothing at all, so an
     /// unanswered ask stays unanswered, exactly as it does for the real client.
-    pets: HashMap<u32, String>,
-    pending_players: HashSet<u64>,
-    pending_creatures: HashSet<u32>,
-    pending_pets: HashSet<u32>,
+    pets: QueryCache<u32, String>,
     /// Bumped by every **landed** answer (and the pet-rename eviction) — never by an ask. The
     /// gated feeds' watch counter (decision 1439): a feed that resolved a miss re-runs when the
-    /// answer lands, and only then. `is_changed` cannot say this — the resolves themselves take
-    /// `&mut self` every frame (the ask-once marker), so the resource reads as changed whenever
-    /// anything is still pending.
+    /// answer lands, and only then. Born because `is_changed` could not say this while the
+    /// resolves took `&mut self` every frame; 2288 made them `&self` (the in-flight marks live
+    /// behind [`QueryCache`]'s lock), and the counter stays as the one number the three caches
+    /// share.
     generation: u64,
 }
 
@@ -177,16 +176,14 @@ impl NameCache {
     /// connection) and returns `None` — call again after the answer lands. A guid family that has no
     /// name on the 1.12 wire (GameObjects resolve via their own query, not modeled yet) is `None`
     /// without a query.
-    pub(crate) fn resolve(&mut self, guid_val: u64, commands: &NetCommands) -> Option<&str> {
+    pub(crate) fn resolve(&self, guid_val: u64, commands: &NetCommands) -> Option<&str> {
         if guid::is_player(guid_val) {
-            if !self.players.contains_key(&guid_val) {
-                if self.pending_players.insert(guid_val) {
+            self.players
+                .get_or_ask(guid_val, || {
                     debug!("names: asking player name (guid {guid_val})");
                     let _ = commands.0.send(ClientCommand::NameQuery { guid: guid_val });
-                }
-                return None;
-            }
-            self.players.get(&guid_val).and_then(|n| n.as_deref())
+                })
+                .map(String::as_str)
         } else if let Some(pet_number) = guid::pet_number(guid_val) {
             // A pet is a `TYPEID_UNIT` like any creature, but it carries a pet number where a
             // creature carries its template entry, so it has its own query. Asking the creature
@@ -205,17 +202,15 @@ impl NameCache {
     /// answer**: vmangos returns early without a packet when the guid is not a live pet bearing that
     /// number (`PetHandler.cpp:190-192`), so an unanswered ask simply stays unresolved rather than
     /// caching a "server doesn't know" — and is re-asked after a reconnect like the others.
-    fn resolve_pet(&mut self, pet_number: u32, guid: u64, commands: &NetCommands) -> Option<&str> {
-        if !self.pets.contains_key(&pet_number) {
-            if self.pending_pets.insert(pet_number) {
+    fn resolve_pet(&self, pet_number: u32, guid: u64, commands: &NetCommands) -> Option<&str> {
+        self.pets
+            .get_or_ask(pet_number, || {
                 debug!("names: asking pet name (pet {pet_number})");
                 let _ = commands
                     .0
                     .send(ClientCommand::PetNameQuery { pet_number, guid });
-            }
-            return None;
-        }
-        self.pets.get(&pet_number).map(String::as_str)
+            })
+            .map(String::as_str)
     }
 
     /// The name for a creature template `entry`, if known — the entry-keyed twin of
@@ -226,36 +221,32 @@ impl NameCache {
     /// regardless of which spawn asked (the same template-only convention as
     /// [`crate::items::Items::template`]'s `guid: 0`).
     pub(crate) fn resolve_creature(
-        &mut self,
+        &self,
         entry: u32,
         guid: u64,
         commands: &NetCommands,
     ) -> Option<&str> {
-        if !self.creatures.contains_key(&entry) {
-            if self.pending_creatures.insert(entry) {
+        self.creatures
+            .get_or_ask(entry, || {
                 debug!("names: asking creature name (entry {entry})");
                 let _ = commands
                     .0
                     .send(ClientCommand::CreatureQuery { entry, guid });
-            }
-            return None;
-        }
-        self.creatures
-            .get(&entry)
-            .and_then(|n| n.as_ref().map(|r| r.name.as_str()))
+            })
+            .map(|r| r.name.as_str())
     }
 
     /// The cached name for `guid`, read-only — no query on a miss (the trace/diagnostic twin of
     /// [`Self::resolve`], for callers that must not mutate the ask-once state).
     pub(crate) fn peek(&self, guid_val: u64) -> Option<&str> {
         if guid::is_player(guid_val) {
-            self.players.get(&guid_val).and_then(|n| n.as_deref())
+            self.players.get(guid_val).map(String::as_str)
         } else if let Some(pet_number) = guid::pet_number(guid_val) {
-            self.pets.get(&pet_number).map(String::as_str)
+            self.pets.get(pet_number).map(String::as_str)
         } else if guid::is_creature_or_pet(guid_val) {
             self.creatures
-                .get(&guid::entry(guid_val)?)
-                .and_then(|n| n.as_ref().map(|r| r.name.as_str()))
+                .get(guid::entry(guid_val)?)
+                .map(|r| r.name.as_str())
         } else {
             None
         }
@@ -274,7 +265,6 @@ impl NameCache {
     /// replacing that name. Keeping the old one would leave a record whose name says one character
     /// and whose race says another — a contradiction manufactured by the cache itself.
     pub(crate) fn insert_player(&mut self, guid: u64, name: String, traits: Option<(u8, u8, u8)>) {
-        self.pending_players.remove(&guid);
         match traits.filter(|_| !name.is_empty()) {
             Some(t) => self.player_traits.insert(guid, t),
             None => self.player_traits.remove(&guid),
@@ -307,8 +297,36 @@ impl NameCache {
         self.players.clear();
         self.player_traits.clear();
         self.pets.clear();
-        self.pending_players.clear();
-        self.pending_pets.clear();
+        self.generation = self.generation.wrapping_add(1);
+    }
+
+    /// **Install a realm cache read off disk — its CREATURE templates, and nothing else**
+    /// (decision 2260).
+    ///
+    /// The persisted file has carried creature templates alone since 2223, so this is the whole of
+    /// what a load can legitimately say. It used to be spelled `*names = loaded` in
+    /// [`crate::name_persist::load_name_cache`], which is the same thing only when the loader is
+    /// the first writer of the session — and it is not. The loader fires the first frame the realm
+    /// identity is known, which is the frame the *pick* is in flight; the login's
+    /// `SMSG_..._VERIFY_WORLD` seed of our OWN name ([`Self::insert_player`], from
+    /// `net::apply::session::connected`) lands in the same neighbourhood, and whichever arrives
+    /// second wins. When the load won, it discarded the player's own name — so `UnitName("player")`
+    /// answered nil for one wire round-trip while the feed re-asked for a guid it had just been
+    /// told about, and every addon reading it in that window saw nil (the KLHThreatMeter
+    /// `table index is nil` report; reproduced live 3 runs in 4).
+    ///
+    /// Once per process, because `NameCacheFile::realm` only goes `None` → `Some` once — which is
+    /// exactly the "first login of a fresh game start, and never again" shape the report named.
+    ///
+    /// So the rule is not an ordering to get right, it is a *scope*: this touches what the file
+    /// carries. Dropping the guid-keyed stores across a realm change is
+    /// [`Self::clear_world_session`]'s, and it runs at every world entry regardless.
+    ///
+    /// Replace rather than merge — the realm-change case, 2223's own reasoning: the previous
+    /// realm's templates are not this realm's. The generation ticks because a landed record is
+    /// exactly what the gated feeds watch for (1439).
+    pub(crate) fn install_persisted(&mut self, loaded: NameCache) {
+        self.creatures = loaded.creatures;
         self.generation = self.generation.wrapping_add(1);
     }
 
@@ -325,8 +343,7 @@ impl NameCache {
 
     /// Record a pet-name answer (`SMSG_PET_NAME_QUERY_RESPONSE`), keyed by pet number.
     pub(crate) fn insert_pet(&mut self, pet_number: u32, name: String) {
-        self.pending_pets.remove(&pet_number);
-        self.pets.insert(pet_number, name);
+        self.pets.insert(pet_number, Some(name));
         self.generation = self.generation.wrapping_add(1);
     }
 
@@ -340,14 +357,12 @@ impl NameCache {
     /// rename racing an in-flight query would otherwise have its re-ask deduped away and leave the
     /// stale name in place forever.
     pub(crate) fn forget_pet(&mut self, pet_number: u32) {
-        self.pending_pets.remove(&pet_number);
-        self.pets.remove(&pet_number);
+        self.pets.evict(pet_number);
         self.generation = self.generation.wrapping_add(1);
     }
 
     /// Record a creature-name answer (`SMSG_CREATURE_QUERY_RESPONSE`); `None` = unknown entry.
     pub(crate) fn insert_creature(&mut self, entry: u32, record: Option<CreatureRecord>) {
-        self.pending_creatures.remove(&entry);
         self.creatures.insert(entry, record);
         self.generation = self.generation.wrapping_add(1);
     }
@@ -355,10 +370,7 @@ impl NameCache {
     /// The cached subname (the overhead/tooltip title line) for a creature entry — read-only: the
     /// nameplate asks only after [`Self::resolve`] already returned the name (same answer packet).
     pub(crate) fn creature_subname(&self, entry: u32) -> Option<&str> {
-        self.creatures
-            .get(&entry)?
-            .as_ref()
-            .and_then(|r| r.subname.as_deref())
+        self.creatures.get(entry)?.subname.as_deref()
     }
 
     /// The whole cached record for a creature entry — the unit tooltip's read (subtitle, type,
@@ -376,17 +388,14 @@ impl NameCache {
     /// fails CLOSED like `0x623b70`'s null leg, the wound gate (`DO_NOT_PLAY_WOUND_ANIM`, 2068)
     /// fails OPEN like `0x6125f0`'s.
     pub(crate) fn creature_record(&self, entry: u32) -> Option<&CreatureRecord> {
-        self.creatures.get(&entry)?.as_ref()
+        self.creatures.get(entry)
     }
 
     /// The cached `CreatureType.dbc` id for a creature entry — read-only, same ask-once discipline
     /// as the subname (the TAB-target scan reads it; an unresolved entry is `None`, which the scan
     /// treats as targetable — the client's own out-of-range skip).
     pub(crate) fn creature_type(&self, entry: u32) -> Option<u32> {
-        self.creatures
-            .get(&entry)?
-            .as_ref()
-            .map(|r| r.creature_type)
+        Some(self.creatures.get(entry)?.creature_type)
     }
 
     /// Forget the in-flight asks (a disconnect may have dropped them on the writer floor). Resolved
@@ -394,13 +403,18 @@ impl NameCache {
     /// names do not: a pet number names one live spawn rather than a template, and nothing that
     /// answered before the disconnect is still on the map after it.
     pub(crate) fn clear_pending(&mut self) {
-        self.pending_players.clear();
-        self.pending_creatures.clear();
-        self.pending_pets.clear();
+        self.players.clear_pending();
+        self.creatures.clear_pending();
         self.pets.clear();
     }
 }
 
+impl crate::query_cache::AskOnce for NameCache {
+    fn clear_pending(&mut self) {
+        NameCache::clear_pending(self);
+    }
+}
+
 // ─────────────────────────────────────────────────────────────────────────────────────────────
 // Persistence — the `.wdb` law, in benilla's own folder (decision 1689)
 // ─────────────────────────────────────────────────────────────────────────────────────────────
@@ -442,7 +456,7 @@ impl NameCache {
     pub(crate) fn to_tsv(&self, realm: &str) -> String {
         let mut out =
             format!("{CACHE_MAGIC}\t{CACHE_FORMAT}\t{CACHE_BUILD}\t{CACHE_LOCALE}\t{realm}\n");
-        for (entry, rec) in &self.creatures {
+        for (entry, rec) in self.creatures.iter() {
             match rec {
                 Some(r) => out.push_str(&format!(
                     "C\t{entry}\t{}\t{}\t{}\t{}\t{}\t{}\t{}\t{}\t{}\n",
@@ -531,9 +545,8 @@ impl NameCache {
     /// that vmangos never sends it — so against our own server this is the mechanism being present
     /// and correct rather than a path we exercise.
     pub(crate) fn invalidate_player(&mut self, guid: u64) {
-        self.players.remove(&guid);
+        self.players.evict(guid);
         self.player_traits.remove(&guid);
-        self.pending_players.remove(&guid);
         self.generation = self.generation.wrapping_add(1);
     }
 
@@ -634,7 +647,7 @@ mod tests {
     #[test]
     fn a_stable_list_names_the_pet_before_it_is_ever_summoned() {
         let (cmds, rx) = commands();
-        let mut cache = NameCache::default();
+        let cache = NameCache::default();
         // The guid the pet will have once summoned: its pet number rides the ENTRY slot.
         let rex = compose(guid::HIGH_PET, 7, 42);
 
@@ -686,7 +699,7 @@ mod tests {
         let back = NameCache::from_tsv(&text, "Hydraxian Waterlords").expect("header matches");
 
         // A cached negative must survive as a negative — present-and-None, not absent.
-        assert!(back.creatures.contains_key(&1234));
+        assert!(back.creatures.answered(1234));
         let rec = back.creature_record(69).expect("creature survived");
         assert_eq!(rec.name, "Stable Master Kitrik");
         assert_eq!(rec.subname.as_deref(), Some("Stable Master"));
@@ -778,7 +791,7 @@ mod tests {
         assert_eq!(cache.peek(0x11), None);
         assert_eq!(cache.player_traits(0x11), None);
         assert!(
-            cache.creatures.contains_key(&69),
+            cache.creatures.answered(69),
             "templates outlive the world session"
         );
         // And the ask-once markers went with them, so the next sighting asks rather than sitting
diff --git a/crates/benilla-app/src/net.rs b/crates/benilla-app/src/net.rs
index 141b9193..b4b8b961 100644
--- a/crates/benilla-app/src/net.rs
+++ b/crates/benilla-app/src/net.rs
@@ -14,7 +14,7 @@
 //! The bridge runs in [`WorldStage::Net`], before `Input`, so a server teleport snaps → streams →
 //! covers in one frame. Coordinates cross from raw WoW into Bevy space here (`wow_to_bevy`).
 
-use std::collections::HashMap;
+use std::collections::{HashMap, HashSet};
 use std::time::{Duration, Instant};
 
 use benilla_protocol::{
@@ -27,11 +27,13 @@ use crossbeam_channel::{Receiver, Sender};
 use benilla_world::schedule::WorldStage;
 
 mod apply;
+pub(crate) mod handlers;
 pub(crate) mod io;
 mod motion;
 
 pub(crate) use apply::apply_net_updates;
 use apply::tag_self_player;
+pub(crate) use handlers::NetHandlerApp;
 
 // The per-frame motion model lives in [`motion`]: `RemoteMotion`/`Spline` are re-exported for the
 // crate (the animation selector reads them); the integration systems + pose helpers stay `pub(super)`
@@ -74,30 +76,14 @@ pub(crate) struct NetPlugin {
 #[derive(Resource)]
 pub(crate) struct NetOffline;
 
-/// Release the ask-once latches at world enter — the counterpart to the disconnect teardown in
-/// `apply::session`, which clears them when a socket DIES but never when one is born.
-///
-/// The asymmetry was load-bearing and wrong. `Items::template` (and `NameCache`'s resolvers) mark
-/// an id pending *before* sending the query, and a command sent while the io thread holds no
-/// writer evaporates with a warn — so an ask made before the first connect latched the id for the
-/// life of the process. On 2026-09-06 that emptied the mail send tab's stationery list for an
-/// entire session, in silence. The ask site that did it is fixed; this makes the class harmless,
-/// because a redundant re-ask costs one packet and a wrong latch costs a dead feature nobody can
-/// see is dead.
-fn release_ask_once_latches_on_enter(
-    mut entered: MessageReader<EnteredWorldMessage>,
-    mut items: ResMut<crate::items::Items>,
-    mut names: ResMut<crate::names::NameCache>,
-) {
-    if entered.read().count() == 0 {
-        return;
-    }
-    items.clear_pending();
-    names.clear_pending();
-}
-
 impl Plugin for NetPlugin {
     fn build(&self, app: &mut App) {
+        // The one release-on-enter for the ask-once caches this plugin owns (decision 2288;
+        // the story of the latch that emptied the mail send tab's stationery for a session is
+        // on `query_cache::register`).
+        crate::query_cache::register::<crate::names::NameCache>(app);
+        crate::query_cache::register::<crate::go_templates::GameObjectTemplates>(app);
+        crate::query_cache::register::<crate::items::Items>(app);
         let handles = io::spawn_net(io::NetConfig::from_env(), self.connect);
         if !self.connect {
             app.insert_resource(NetOffline);
@@ -133,6 +119,7 @@ impl Plugin for NetPlugin {
             .init_resource::<crate::items::Items>()
             .init_resource::<crate::world_state::WorldStates>()
             .add_message::<TeleportMessage>()
+            .add_message::<FieldChanged>()
             .add_message::<SelfMoveMessage>()
             .add_message::<SpeedChangeMessage>()
             .add_message::<ClientControlMessage>()
@@ -160,7 +147,6 @@ impl Plugin for NetPlugin {
                 Update,
                 (
                     apply_net_updates,
-                    release_ask_once_latches_on_enter,
                     tag_self_player,
                     sample_splines,
                     // Derive each creature's swim state from the water over its feet (the wire never
@@ -306,6 +292,124 @@ pub(crate) fn current_speed(s: &MoveSpeeds, flags: u32) -> f32 {
 #[derive(Component, Clone, Default)]
 pub(crate) struct ObjectStore(pub(crate) ObjectFields);
 
+/// **One descriptor dword moved on a streamed object** — the reference's `CMirrorHandler` edge
+/// (decision 2297). The real client keeps a shadow copy of every object's field array, and the
+/// values-apply notifier (`0x465330`) memcmps live against shadow over each registered span and
+/// calls the watcher with the OLD value (`0x465570` hands the mirror pointer as `param3` —
+/// wow-re `object-layer.md`); a first CREATE passes a notify-suppress flag and fires nothing, an
+/// in-place re-create of a live guid goes down the values path and fires like any delta.
+///
+/// benilla emits the same edge once, from the drain's merge, which is the one place that holds
+/// both sides: every consumer that used to poll `Changed<ObjectStore>` and re-derive "did THIS
+/// field move" against its own `Local<EntityHashMap>` shadow reads these instead, with no
+/// first-sight rule and no per-frame `retain` of its own (the create is never merged, so the
+/// suppression is structural). Unwatched fields cost one `Vec` push each; the consumers filter
+/// by `(kind, index)` through [`benilla_protocol::field`]'s named constants — the same constants
+/// the store's accessors read through, so a watch and its accessor cannot disagree.
+///
+/// `kind` is the store's own class off its create block: a raw index means different things per
+/// class (`36` is a unit's `BYTES_0` and a corpse's `DYNAMIC_FLAGS`), and a unit-field watcher
+/// must accept both `Unit` and `Player` ([`Self::unit_field`]).
+#[derive(Message, Clone, Copy, Debug, PartialEq, Eq)]
+pub(crate) struct FieldChanged {
+    pub entity: Entity,
+    pub guid: u64,
+    pub kind: benilla_protocol::messages::ObjectType,
+    pub index: u16,
+    pub old: u32,
+    pub new: u32,
+}
+
+impl FieldChanged {
+    /// A unit-block edge — units and players share the UNIT block, so a watch registered for
+    /// the reference's TYPEID 3 sees both here.
+    pub fn is_unit(&self) -> bool {
+        use benilla_protocol::messages::ObjectType;
+        matches!(self.kind, ObjectType::Unit | ObjectType::Player)
+    }
+    /// The edge on one named unit field.
+    pub fn unit_field(&self, index: u16) -> bool {
+        self.is_unit() && self.index == index
+    }
+    /// The edge's slot inside a unit-block array starting at `base` with `len` dwords — the aura
+    /// arrays' shape (`UNIT_FIELD_AURA[48]`, `AURAAPPLICATIONS[12]`).
+    pub fn unit_array_slot(&self, base: u16, len: u16) -> Option<u16> {
+        (self.is_unit() && (base..base + len).contains(&self.index)).then(|| self.index - base)
+    }
+}
+
+/// The field edges one feed saw this run, keyed the way the unit feeds ask — "did THIS guid's
+/// field move" per token — so a per-token event rides the reference's own trigger (its notifier
+/// fans a moved field out to every token naming the unit, `0x515e50`) instead of a snapshot diff
+/// guarded by `prev.is_some()` (decision 2297). Collected once per run, off the reader.
+#[derive(Default)]
+pub(crate) struct FieldEdges(HashSet<(u64, u16)>);
+
+impl FieldEdges {
+    pub fn collect(reader: &mut MessageReader<FieldChanged>) -> Self {
+        Self(reader.read().map(|e| (e.guid, e.index)).collect())
+    }
+    /// Did `guid`'s dword at `index` move this run?
+    pub fn moved(&self, guid: u64, index: u16) -> bool {
+        self.0.contains(&(guid, index))
+    }
+    #[cfg(test)]
+    pub fn of(edges: &[(u64, u16)]) -> Self {
+        Self(edges.iter().copied().collect())
+    }
+}
+
+/// Fold a descriptor update onto a live store and report its field edges — the drain's merge
+/// body, shared with the test harness so a fixture drives a watcher through exactly the path
+/// the wire does. A store that is not there yet is seeded silently (the first create).
+pub(crate) fn merge_store_fields(
+    store: &mut ObjectFields,
+    delta: ObjectFields,
+    entity: Entity,
+    guid: u64,
+    mut emit: impl FnMut(FieldChanged),
+) {
+    let Some(kind) = store.created_as() else {
+        // No create seen for this store (a defensively seeded bare delta): nothing the reference
+        // would have an object to notify on. The fields still land.
+        store.merge(delta);
+        return;
+    };
+    store.merge_diff(delta, |index, old, new| {
+        emit(FieldChanged {
+            entity,
+            guid,
+            kind,
+            index,
+            old,
+            new,
+        });
+    });
+}
+
+/// Apply a descriptor update to `entity` the way the drain does — seed on first sight (no
+/// edges), merge and emit [`FieldChanged`] after — so a watcher test speaks the wire's language
+/// instead of poking the component. The fixture must be [`ObjectFields::into_created`] on its
+/// first application, like every real create block.
+#[cfg(test)]
+pub(crate) fn apply_fields_for_test(world: &mut World, entity: Entity, delta: ObjectFields) {
+    let guid = world.get::<Guid>(entity).map_or(0, |g| g.0);
+    let mut edges = Vec::new();
+    match world.get_mut::<ObjectStore>(entity) {
+        Some(mut store) => merge_store_fields(&mut store.0, delta, entity, guid, |e| edges.push(e)),
+        None => {
+            assert!(
+                delta.created_as().is_some(),
+                "a fixture's first descriptor is a create block: chain `.into_created(..)`"
+            );
+            world.entity_mut(entity).insert(ObjectStore(delta));
+        }
+    }
+    world
+        .resource_mut::<Messages<FieldChanged>>()
+        .write_batch(edges);
+}
+
 /// Marks our own player's streamed entity (guid == [`SelfGuid`]). This is **identity** — "my
 /// character", the thing whose bags, auras, quest log and paper doll are mine. It is deliberately
 /// *not* "the thing I steer": that is [`Embodied`], which normally sits on the same entity and
@@ -1340,6 +1444,13 @@ pub(crate) enum ClientCommand {
     AreaSpiritHealerQueue {
         healer: u64,
     },
+    /// The client ADOPTED a new area spirit healer — `CMSG_AREA_SPIRIT_HEALER_QUERY`, asking for
+    /// its wave clock. No Lua verb sends this: its only writer is the reference's own
+    /// "set current area spirit healer" routine `0x4921c0`, reached from the per-frame proximity
+    /// poll and from the spirit-guide click arm ([`crate::ui_dialog_verbs::AreaSpiritHealer`]).
+    AreaSpiritHealerQuery {
+        healer: u64,
+    },
     /// `AcceptBattlefieldPort(index, accept)` — `CMSG_BATTLEFIELD_PORT`: the slot's map id and
     /// the answer as one byte.
     BattlefieldPort {
@@ -1352,6 +1463,11 @@ pub(crate) enum ClientCommand {
     LeaveBattlefield {
         map_id: u32,
     },
+    /// A right-click on a `GAMEOBJECT_TYPE_MEETINGSTONE` that passed the type's four client-side
+    /// refusals — `CMSG 0x292`, `u64 goGuid` (decision 2283).
+    MeetingStoneJoin {
+        go_guid: u64,
+    },
     /// `CancelMeetingStoneRequest()` — `CMSG 0x293`, empty.
     MeetingStoneLeave,
     /// The enter-world meeting-stone status query — `CMSG 0x296`, empty (decision 1974).
@@ -2757,6 +2873,71 @@ pub(crate) struct PetDismissSoundMessage {
 mod tests {
     use super::*;
 
+    /// The field-edge contract at the one write that emits it (decision 2297), through the same
+    /// body the drain's merge calls: a first create seeds silently (the reference's create-time
+    /// notify-suppress), a values delta reports each moved dword with its old value and the
+    /// store's class, a value re-sent unchanged reports nothing, and an in-place re-create of a
+    /// live object notifies like any delta — including a field the fresh snapshot dropped.
+    #[test]
+    fn the_merge_emits_one_edge_per_moved_dword_and_none_for_a_first_create() {
+        use benilla_protocol::field::{FIELD_UNIT_HEALTH, FIELD_UNIT_LEVEL};
+        use benilla_protocol::messages::ObjectType;
+
+        let mut world = World::new();
+        world.init_resource::<Messages<FieldChanged>>();
+        let unit = world.spawn(Guid(0xF130_0000_0000_0042)).id();
+        let drain = |world: &mut World| -> Vec<FieldChanged> {
+            world
+                .resource_mut::<Messages<FieldChanged>>()
+                .drain()
+                .collect()
+        };
+
+        // The create block: seeds, says nothing.
+        apply_fields_for_test(
+            &mut world,
+            unit,
+            ObjectFields::from_pairs(&[(FIELD_UNIT_HEALTH, 100), (FIELD_UNIT_LEVEL, 9)])
+                .into_created(ObjectType::Unit),
+        );
+        assert!(drain(&mut world).is_empty(), "a create is not an edge");
+
+        // A values delta: the ding's dword and the health's, the level re-sent unchanged.
+        apply_fields_for_test(
+            &mut world,
+            unit,
+            ObjectFields::from_pairs(&[(FIELD_UNIT_LEVEL, 9), (FIELD_UNIT_HEALTH, 0)]),
+        );
+        assert_eq!(
+            drain(&mut world),
+            vec![FieldChanged {
+                entity: unit,
+                guid: 0xF130_0000_0000_0042,
+                kind: ObjectType::Unit,
+                index: FIELD_UNIT_HEALTH,
+                old: 100,
+                new: 0,
+            }],
+            "one edge for the dword that moved, carrying the old value; the resend is silent"
+        );
+
+        // A re-create of the live guid: the reference's in-place refresh notifies, and the
+        // replace makes the dropped health an explicit `0 → 0`... no: it was 0 already, so the
+        // level's rise is the only edge.
+        apply_fields_for_test(
+            &mut world,
+            unit,
+            ObjectFields::from_pairs(&[(FIELD_UNIT_LEVEL, 10)]).into_created(ObjectType::Unit),
+        );
+        let edges = drain(&mut world);
+        assert_eq!(edges.len(), 1);
+        assert!(edges[0].unit_field(FIELD_UNIT_LEVEL) && edges[0].old == 9 && edges[0].new == 10);
+        assert_eq!(
+            world.get::<ObjectStore>(unit).unwrap().0.unit_level(),
+            Some(10)
+        );
+    }
+
     /// **The kick sends the player back to the login screen** — decision 1262's whole promise,
     /// pinned at the one place that decides it, in the environment the director actually plays in.
     ///
diff --git a/crates/benilla-app/src/net/apply.rs b/crates/benilla-app/src/net/apply.rs
index 1ec77cb3..252cecb9 100644
--- a/crates/benilla-app/src/net/apply.rs
+++ b/crates/benilla-app/src/net/apply.rs
@@ -9,16 +9,11 @@ use benilla_protocol::{ObjectFields, SessionEvent};
 use bevy::prelude::*;
 
 use super::{
-    AiReactionMessage, CharActionResultMessage, CharListMessage, EmoteMessage, EnteredWorldMessage,
-    Guid, GuidIndex, LoggedOutMessage, NetCommands, NetEvents, NetStatus, ObjectStore,
-    PendingTransfer, PetDismissSoundMessage, PetTalkMessage, RemoteMotion, Reputations, SelfGuid,
-    SelfPlayer, ServerSoundMessage, ServerTime, ServerWallClock, TeleportMessage, UnitMoveModes,
-    WorldportMessage,
+    Guid, GuidIndex, NetCommands, NetEvents, NetStatus, ObjectStore, Reputations, SelfGuid,
+    SelfPlayer,
 };
-use benilla_world::weather::WeatherMessage;
 
 mod anim;
-mod auction;
 mod chat;
 mod combat;
 mod combat_chat;
@@ -31,6 +26,7 @@ mod mount;
 mod names;
 mod npc;
 mod objects;
+mod params;
 mod pet;
 mod quests;
 mod session;
@@ -38,6 +34,8 @@ mod spells;
 mod trade;
 mod world;
 
+use params::{ActionStores, AnimWriters, Catalogs, Clocks, ObjectQueries, Session, WindowStores};
+
 // The arm families, split out of the dispatch match below (each `pub(super)` fn is one arm's
 // body; the match stays the dispatcher, one call per arm — see the child modules).
 use loot::{
@@ -54,8 +52,8 @@ use quests::{
 use spells::{
     action_buttons, aura_duration, cancel_auto_repeat, cast_result, channel_start, channel_update,
     clear_cooldown, cooldown_cheat, cooldown_event, item_cooldown, learned_spell, removed_spell,
-    spell_book, spell_chain_targets, spell_cooldowns, spell_delayed, spell_failed_other, spell_go,
-    spell_start, superceded_spell,
+    set_spell_modifier, spell_book, spell_chain_targets, spell_cooldowns, spell_delayed,
+    spell_failed_other, spell_go, spell_start, superceded_spell,
 };
 
 /// Which unit's cooldown store a wire cooldown packet addresses (decision 0982).
@@ -87,477 +85,190 @@ fn addressed_store<'a>(
 
 // ── The per-frame bridge systems ─────────────────────────────────────────────────────────────────
 
-/// Drain the inbound event channel and mutate real ECS entities: spawn on create, move existing,
-/// despawn on remove, attach/clear movement splines, and surface teleport/worldport/clock changes.
-// The tuple params below batch resources to stay under Bevy's 16-SystemParam ceiling; clippy reads
-// the 5-element ResMut tuples as "very complex types", but a named alias per tuple would be less
-// legible than the inline, commented groups.
-#[allow(clippy::too_many_arguments, clippy::type_complexity)]
-pub(crate) fn apply_net_updates(
+/// The drain: take this frame's events off the channel and run them, **in packet order**, through
+/// the two halves of the dispatch (decision 2305) — first the kinds the `match` below still owns,
+/// through [`apply_unpeeled`], then the kinds a subsystem has claimed in the handler table
+/// ([`super::handlers`]), each handler a one-shot system over this exclusive world. One frame,
+/// packet order, before anything else in [`benilla_world::schedule::WorldStage::Net`] runs: the
+/// property 0006 built and 2265 said every split must keep.
+pub(crate) fn apply_net_updates(world: &mut World) {
+    let events: Vec<SessionEvent> = world.resource::<NetEvents>().0.try_iter().collect();
+    super::handlers::dispatch(world, events, |world, unclaimed| {
+        if let Err(e) = world.run_system_cached_with(apply_unpeeled, unclaimed) {
+            panic!("the drain's dispatch match did not run: {e}");
+        }
+    });
+}
+
+/// The dispatch `match` — every kind no subsystem has claimed yet (2305's migration runs one
+/// window family at a time out of here into its own module's handlers). Mutates real ECS
+/// entities: spawn on create, move existing, despawn on remove, attach/clear movement splines,
+/// and surface teleport/worldport/clock changes; parks the rest into window state.
+fn apply_unpeeled(
+    In(events): In<Vec<SessionEvent>>,
     mut commands: Commands,
-    events: Res<NetEvents>,
+    net_commands: Res<NetCommands>,
     mut index: ResMut<GuidIndex>,
     mut self_guid: ResMut<SelfGuid>,
     mut status: ResMut<NetStatus>,
-    // The two server clocks, paired in one param (the 16-SystemParam ceiling this signature
-    // already lives against): the in-game day/night clock the lighting reads, and the wall clock
-    // the absolute descriptor stamps are dated in (decision 1150). Different quantities, same
-    // handler file.
-    mut clocks: (ResMut<ServerTime>, ResMut<ServerWallClock>),
     mut reputations: ResMut<Reputations>,
-    mut transforms: Query<&mut Transform>,
-    mut stores: Query<&mut ObjectStore>,
-    // One tuple param (the 16-SystemParam ceiling this signature already lives against): the three
-    // per-unit motion states the drain writes. [`RemoteMotion`] is a relayed player's dead-reckon;
-    // [`UnitMoveModes`] is any unit's server-granted movement modes (decision 1780);
-    // [`crate::transport::TransportRider`] is the deck a unit is standing on and its pose there
-    // (decision 1936). Different components, one concern — what the wire says about how a body we
-    // don't control is moving.
-    mut motion: (
-        Query<&mut RemoteMotion>,
-        Query<&mut UnitMoveModes>,
-        Query<&mut crate::transport::TransportRider>,
-    ),
-    // One tuple param (the 16-SystemParam ceiling): the session-lifecycle one-shot writers — the
-    // player's teleport/worldport snaps + the glue-screen edges (decision 0193).
-    session_msgs: (
-        MessageWriter<TeleportMessage>,
-        MessageWriter<WorldportMessage>,
-        // **The two park publications, paired** — the tuple is at Bevy's 16-param ceiling, and
-        // these are the pair that belongs together: the realm list and the character roster are
-        // the same thing one park apart, each published so the app's policy can answer it.
-        (
-            MessageWriter<CharListMessage>,
-            MessageWriter<crate::net::RealmListMessage>,
-        ),
-        // **The pick park's two verdicts, paired** (the tuple is at Bevy's 16-element ceiling, and
-        // these belong together): what a create/delete came back with, and the refusal of the pick
-        // itself.
-        (
-            MessageWriter<CharActionResultMessage>,
-            MessageWriter<super::CharacterLoginFailedMessage>,
-        ),
-        // **The world-entry pair** — the tuple is at Bevy's 16-element ceiling, and these two are
-        // one edge: the entry message, and the `SMSG_ADDON_INFO` verdict that the entry's own UI
-        // load reads before the first addon's file-scope code asks `GetNumAddOns()` (2175).
-        (
-            MessageWriter<EnteredWorldMessage>,
-            ResMut<crate::net::AddonInfoReply>,
-        ),
-        MessageWriter<LoggedOutMessage>,
-        MessageWriter<super::SpeedChangeMessage>,
-        // The two server-authored mover edges the controller both *applies* and *answers*, paired to
-        // stay inside Bevy's 16-element tuple limit — and they do belong together: a granted mode
-        // (decisions 0308, 0866) and a knockback launch (decision 1702) are the same handshake, an
-        // edge the server may not act on until our own live pose comes back.
-        (
-            MessageWriter<super::MoveModeMessage>,
-            MessageWriter<super::KnockBackMessage>,
-        ),
-        // The login screen's dialog + reconnect-policy feed (decision 0539).
-        MessageWriter<super::LoginStageMessage>,
-        // The login queue's position feed (decision 1681).
-        MessageWriter<super::LoginQueuedMessage>,
-        MessageWriter<super::LoginFailedMessage>,
-        MessageWriter<super::DisconnectedMessage>,
-        // The server's own answer to a GM dot-command, readable rather than only logged — the
-        // probe shield's confirmation channel (decision 0677).
-        MessageWriter<super::ServerSaidMessage>,
-        // A `MSG_MOVE_*` the server addressed to OUR mover (decision 0725): a pose it wrote, with
-        // no handshake — the controller applies it in `player::wire_in`.
-        MessageWriter<super::SelfMoveMessage>,
-        // The possession handoff (`SMSG_CLIENT_CONTROL_UPDATE`): control of a unit granted or
-        // revoked. Forwarded verbatim — only the controller knows the pose it would have to park.
-        MessageWriter<super::ClientControlMessage>,
-        // A cinematic to play (`SMSG_TRIGGER_CINEMATIC`) — `crate::cinematic` owns both the
-        // playback and the ack that has to answer it (decision 0196).
-        MessageWriter<super::CinematicTriggeredMessage>,
-    ),
-    // One tuple param (the 16-SystemParam ceiling): the ask-once query caches + the gossip/merchant
-    // state the net drain fills for the NPC-interaction windows (decision 0081).
-    caches: (
-        ResMut<crate::names::NameCache>,
-        ResMut<crate::items::Items>,
-        ResMut<crate::ui_gossip::GossipState>,
-        ResMut<crate::ui_merchant::MerchantOpen>,
-        // Nested pair: the two gossip-reached NPC service sessions the net drain fills whose
-        // state is a whole open window (the tuple is at the 16-param ceiling).
-        (
-            ResMut<crate::ui_trainer::TrainerOpen>,
-            ResMut<crate::ui_stable::StableOpen>,
-        ),
-        // Nested triple (the tuple is at the 16-param ceiling): the loot window state, the
-        // client-local loot-target latch (the kneel's self trigger, decision 0515), and the open
-        // group-loot rolls (decision 0591).
-        (
-            ResMut<crate::ui_loot::LootState>,
-            ResMut<crate::ui_loot::LootLatch>,
-            ResMut<crate::ui_loot_roll::LootRolls>,
-        ),
-        ResMut<crate::ui_chat::ChatLog>,
-        ResMut<crate::ui_quest::QuestGiver>,
-        // Nested pair (the tuple is at the 16-param ceiling): the quest-log template cache, and
-        // the party quest-share state (decision 1733) — the verdicts on a quest we pushed and the
-        // escort confirm. Same family, one slot; unlike most nestings here these two genuinely
-        // belong together, since a share is a quest-log verb.
-        (
-            ResMut<crate::ui_quest_log::QuestLog>,
-            ResMut<crate::ui_quest_share::QuestShare>,
-        ),
-        ResMut<crate::go_templates::GameObjectTemplates>,
-        ResMut<crate::net::HomeBind>,
-        ResMut<crate::net::Proficiencies>,
-        ResMut<crate::net::DroppedOpcodes>,
-        // The death arc's wire-fed store (decision 0308): reclaim expiry, corpse location,
-        // resurrect offer, the spirit-healer confirm.
-        ResMut<crate::death::DeathNet>,
-        // The party/raid roster mirror + its composed system lines (decision 0434).
-        ResMut<crate::ui_party::GroupState>,
-        // The taxi-map session (decision 0484 phase 1) + the mailbox session + its login-scoped
-        // arrival countdown (decision 0544) + the player-trade session (decision 0592) + the bank
-        // session and its purchase-refusal queue (decision 0604) + the world-state table the
-        // NPC-text `$<n>w` tokens read + the duel session (decision 0633), grouped to stay under
-        // Bevy's 16-SystemParam ceiling (this tuple's 16th and last slot).
-        (
-            ResMut<crate::ui_taxi::TaxiState>,
-            ResMut<crate::ui_mail::MailOpen>,
-            ResMut<crate::ui_mail::MailPending>,
-            ResMut<crate::ui_trade::TradeSession>,
-            ResMut<crate::ui_bank::BankOpen>,
-            ResMut<crate::ui_bank::BankErrors>,
-            ResMut<crate::world_state::WorldStates>,
-            ResMut<crate::ui_duel::DuelState>,
-            ResMut<crate::ui_social::SocialState>,
-            // The pending logout/quit (decision 0674): the server's response and cancel-ack land
-            // here, and `crate::ui_logout` turns them into the countdown dialog.
-            ResMut<crate::ui_logout::LogoutState>,
-            // The shared AreaTable catalog — the exploration arm's area-id → name resolve
-            // (decision 0828) — and the race-keyed discovery-jingle catalog (decision 0829).
-            // Either absent if its DBC failed to load.
-            Option<Res<crate::area::AreaTableRes>>,
-            Option<Res<crate::sound::ExplorationSounds>>,
-            // The mirror-timer queue (decision 0874): the breath/fatigue START/PAUSE/STOP edges,
-            // drained into the FrameXML bars by `crate::ui_mirror`.
-            ResMut<crate::ui_mirror::MirrorTimerFeed>,
-            // The pet action bar's server-authoritative state + its own cooldown store
-            // (decision 0982), replaced wholesale on every `SMSG_PET_SPELLS`; and the by-key red
-            // error queue its refused-order feedback rides (the `DisplayError` route, resolved
-            // through the VM's own GlobalStrings by `ui_action::feed_actions`).
-            ResMut<crate::ui_pet::PetBar>,
-            ResMut<crate::ui_action::UiErrorKeys>,
-            // The ask-once book-page cache (decision 1105) — every readable's text, keyed by
-            // `PageText` id; the reader session repaints off it.
-            // Paired into one slot: the group is itself at Bevy's 16-param ceiling, so a 17th
-
-            // entry stops the whole system implementing `SystemParam` — nesting is the same
-
-            // escape this tuple already is. Third member: the guild session (decision 1257) —
-            // the identity/roster mirror the seven `SessionEvent::Guild*` arms below drive.
-            (
-                ResMut<crate::ui_item_text::PageTexts>,
-                ResMut<crate::net::PlayedTimeAnswer>,
-                ResMut<crate::ui_guild::GuildState>,
-                // The innkeeper's pending bind question (decision 1331) — `SMSG_BINDER_CONFIRM`
-                // parks the innkeeper's guid here and `crate::ui_binder` turns it into the
-                // CONFIRM_BINDER dialog, whose Accept is the only thing that binds anything.
-                ResMut<crate::ui_binder::BinderState>,
-                // The class trainer's pending respec question (decision 1580) — the inbound
-                // `MSG_TALENT_WIPE_CONFIRM` parks the trainer's guid + cost here and
-                // `crate::ui_talent_wipe` turns it into the CONFIRM_TALENT_WIPE dialog, whose
-                // Accept is the only thing that unlearns anything. The binder's twin above.
-                (
-                    ResMut<crate::ui_talent_wipe::TalentWipeState>,
-                    // The dialog engine's verbs (decision 1963): the pet trainer's latch, the
-                    // instance-boot clock, the area spirit healer, the battleground queue and
-                    // the meeting-stone queue — each a feed for a stock dialog. Nested beside
-                    // the talent wipe because this tuple sits at Bevy's sixteen-entry limit.
-                    (
-                        ResMut<crate::ui_dialog_verbs::PetUnlearnState>,
-                        ResMut<crate::ui_dialog_verbs::InstanceBoot>,
-                        ResMut<crate::ui_dialog_verbs::AreaSpiritHealer>,
-                        ResMut<crate::ui_dialog_verbs::BattlefieldQueue>,
-                        ResMut<crate::ui_dialog_verbs::MeetingStone>,
-                        ResMut<crate::ui_battlefield_score::BattlefieldScoreboard>,
-                        ResMut<crate::ui_battlefield::Battlefield>,
-                        ResMut<crate::tutorial::Tutorials>,
-                        ResMut<crate::ui_battlefield_positions::BattlefieldPositions>,
-                        ResMut<crate::ui_tabard::TabardOpen>,
-                    ),
-                ),
-                // The guard's directions marker (`SMSG_GOSSIP_POI`) and the map id it has to be
-                // stamped with — the wire carries no map field, so "where you were standing when
-                // the guard told you" is the client's to remember (`crate::poi_marker`).
-                ResMut<crate::poi_marker::PoiMarker>,
-                Option<Res<benilla_world::world_map::CurrentMap>>,
-                // The inspect-honor reply (decision 1512) — `MSG_INSPECT_HONOR_STATS` is the only
-                // source of another player's honor numbers, so the reply parks here and
-                // `crate::ui_honor` pushes it into the pane and fires `INSPECT_HONOR_UPDATE`.
-                ResMut<crate::ui_honor::InspectHonor>,
-                // The auctioneer session (decision 1511) — the hello reply opens it, the three
-                // list results fill it, and `crate::ui_auction` feeds it to the window.
-                ResMut<crate::ui_auction::AuctionOpen>,
-                // Guild Member Alert (decision 1589) — the CVar knob the sign-on/sign-off pair's
-                // display condition reads; see `ui_guild::apply::event` for the four conjuncts.
-                Res<crate::ui_guild::GuildMemberNotify>,
-                // The minimap ping (decision 1596) — a group member's `MSG_MINIMAP_PING` seats the
-                // world point here and the minimap renderer derives everything else from it.
-                ResMut<crate::minimap::MinimapPing>,
-                // The GM ticket (decision 1673) — `SMSG_GMTICKET_GETTICKET` replaces the held
-                // ticket here and BUMPS AN ANSWER COUNTER, which is what `crate::ui_gm_ticket`
-                // diffs on: the Help window re-polls every 10 minutes and an unchanged answer
-                // still has to re-fire `UPDATE_TICKET`.
-                ResMut<crate::ui_gm_ticket::GmTicketState>,
-                // The guild-charter session (decision 1672) — two resources because only the
-                // registrar half is NPC-bound: `SMSG_PETITION_SHOWLIST` opens the registrar, and
-                // `SMSG_PETITION_SHOW_SIGNATURES` opens the item-bound charter window, which must
-                // survive walking away from the registrar.
-                ResMut<crate::ui_petition::GuildRegistrarState>,
-                ResMut<crate::ui_petition::PetitionState>,
-                // The pending summon question (decision 1747) — `SMSG_SUMMON_REQUEST` parks the
-                // summoner's guid, zone and expiry here and `crate::ui_summon` turns it into the
-                // CONFIRM_SUMMON dialog, whose Accept is the only packet in the flow.
-                ResMut<crate::ui_summon::SummonState>,
-                // The instance-lockout bookkeeping (decision 1748) — four of its six packets
-                // queue a GlobalStrings-templated chat line here for `crate::ui_instance` to
-                // resolve against the VM, and two write the latch behind
-                // `CanShowResetInstances()`.
-                ResMut<crate::ui_instance::InstanceState>,
-            ),
-        ),
-    ),
-    // One tuple param (the 16-SystemParam ceiling again): the action-bar- + merchant-facing errors
-    // and the cast-bar feed (decision 0137), plus the item-lock bookkeeping the inventory-failure
-    // arm also drains (decision 0216 §4 / 0218 §3 — this apply site has no `UiScript` to fire
-    // `ITEM_LOCK_CHANGED` through, so the transitioned slots queue in `LockTransitions` for
-    // the container feed to pick up).
-    mut ui_actions: (
-        ResMut<crate::ui_action::PlayerActions>,
-        // Nested group (the tuple is at the 16-param ceiling): the cast + mount error queues,
-        // both drained into the red error line by `ui_action::feed_actions`, plus the
-        // FactionTemplate catalog the combat log's friend/foe split reads (B297). The catalog has
-        // nothing to do with the other two — it rides here purely because this is where the
-        // ceiling left room. Absent if the DBC failed to load, which degrades an unresolved unit
-        // to the friendly side of the classifier rather than dropping its lines.
-        (
-            ResMut<crate::ui_action::CastErrors>,
-            ResMut<crate::ui_action::MountErrors>,
-            Option<Res<crate::target::ring::Factions>>,
-            // The `modalNextSpell` chain's outbox (1597) — `cast_result` fills it, the ui_action
-            // drain sends it through the one cast path. Rides here for the same reason the
-            // catalog does: this is where the ceiling left room.
-            ResMut<crate::ui_action::ChainCasts>,
-            // The taming-refusal queue (decision 2039) — `SMSG_PET_TAME_FAILURE`'s reason byte.
-            // Its own queue rather than `UiErrorKeys` because its message needs TWO GlobalStrings
-            // lookups, and the inner one is only reachable at the drain (see the resource's doc).
-            ResMut<crate::ui_action::PetTameFailures>,
-            // The combat-feedback CVars — the eight display ranges, `CombatLogPeriodicSpells`,
-            // and the three floating-text gates. Rides here for exactly the reason the
-            // FactionTemplate catalog two fields up does: the signature is at the 16-param ceiling
-            // and this is where the room is. One bundle rather than three `Res`, so the use sites
-            // read `cvars.ranges` instead of `ui_actions.1 .7`.
-            crate::ui_chat::combat::CombatFeedbackCvars<'_>,
-            // Spells learned mid-session, awaiting `LEARNED_SPELL_IN_TAB` (2252). A queue for the
-            // same reason the reference sorts before it fires: the tab index is only correct
-            // against the rebuilt tab list, which is the spellbook feed's, not this apply's.
-            ResMut<crate::ui_spellbook::LearnedInTab>,
-        ),
-        ResMut<crate::ui_items::EquipErrors>,
-        ResMut<crate::ui_merchant::MerchantErrors>,
-        ResMut<crate::ui_cast::CastBarFeed>,
-        ResMut<crate::pending_item_ops::PendingItemOps>,
-        ResMut<crate::pending_item_ops::LockTransitions>,
-        // Nested pair (the tuple is at the ceiling): the two NPC-service windows' error queues,
-        // each drained onto its window's red line by its own feed.
-        (
-            ResMut<crate::ui_trainer::TrainerErrors>,
-            ResMut<crate::ui_stable::StableErrors>,
-        ),
-        ResMut<crate::ui_cast::PendingCast>,
-        // The cooldown store + the Spell.dbc catalog its wire laws read, and the live
-        // auto-repeat state the bar's flash rides (decision 0137 phase 4).
-        ResMut<crate::cooldowns::Cooldowns>,
-        Option<Res<crate::ui_action::Spells>>,
-        ResMut<crate::ui_action::AutoRepeatActive>,
-        // Our own running channel (the IsCurrentAction channel leg, decision 0137 phase 4).
-        ResMut<crate::ui_cast::ActiveChannel>,
-        // Pre-formatted UIErrorsFrame lines — text the wire already resolved, so there is no
-        // GlobalStrings key to look up: the death durability notice, `SMSG_NOTIFICATION`, and
-        // `SMSG_AREA_TRIGGER_MESSAGE`. Drained by `ui_action::feed_actions` beside UiErrorKeys.
-        ResMut<crate::ui_action::UiErrorTexts>,
-        // The queued on-next-swing strike (the melee-slot half of the cast tracking) — the
-        // wire resolves it here: GO fires it, a failing result/interrupt kills it.
-        ResMut<crate::ui_cast::QueuedMeleeSpell>,
-    ),
-    net_commands: Res<NetCommands>,
-    // One tuple param (Bevy's 16-SystemParam ceiling): the audio + combat/cast bridge writers, the
-    // cast-state read the spell-id-keyed `Casting` reap needs (decision 0107), and the floating
-    // combat-text feed (decision 0137 phase 2).
-    mut audio: (
-        MessageWriter<ServerSoundMessage>,
-        MessageWriter<WeatherMessage>,
-        MessageWriter<EmoteMessage>,
-        MessageWriter<crate::creature_anim::SwingMessage>,
-        Query<&crate::creature_anim::Casting>,
-        MessageWriter<crate::creature_anim::CastEvent>,
-        MessageWriter<crate::creature_anim::SpellGoTargets>,
-        MessageWriter<crate::combat_text::CombatTextSpawn>,
-        MessageWriter<crate::creature_anim::SwingImpact>,
-        MessageWriter<crate::creature_anim::SwingFlush>,
-        MessageWriter<crate::go_anim::GoLidOpen>,
-        // The aggro/alert vocal flare + the pushed-kit play (decision 0280).
-        MessageWriter<AiReactionMessage>,
-        MessageWriter<crate::creature_anim::KitPush>,
-        // The remote landing predictor's report (decision 0415): a relayed FALL_LAND fires the
-        // grunt + dust puff for an observed mover, the way the self controller does for us.
-        MessageWriter<crate::creature_anim::HardLanding>,
-        // An observed rider's flourish (`SMSG_MOUNTSPECIAL_ANIM`, decision 0441 P2) — the
-        // unit → mount-child hop happens in `creature_anim::flourish_to_anim`.
-        MessageWriter<crate::creature_anim::MountFlourish>,
-        // The UNIT_COMBAT event feed (the portrait hit indicator, decision 0576) + the
-        // COMBAT_TEXT_UPDATE feed (the center combat text, decision 0578) — the spell arms'
-        // self-facing twins of the floating-text spawn — and the sheath setter's queue, which the
-        // ATTACKERSTATEUPDATE arm's melee auto-draw writes into. Nested: the tuple is at the
-        // 16-param ceiling.
-        (
-            MessageWriter<crate::ui_unit::UnitCombatFeedback>,
-            MessageWriter<crate::ui_unit::CombatTextEvent>,
-            MessageWriter<crate::creature_anim::SheathRequest>,
-            // The GO one-shot Custom play (`SMSG_GAMEOBJECT_CUSTOM_ANIM` — the bobber's bite
-            // splash, decision 1086), the step-8 sibling of the `GoLidOpen` writer above.
-            MessageWriter<crate::go_anim::GoCustomAnim>,
-            // Are *we* already swinging? The ref's `[player+0xc48]`, mirrored by the
-            // server-echoed [`crate::creature_anim::Engaged`] — read by the GO handler's deferred
-            // auto-attack start (`0x6e83e7`, decision 1593). Filter-only, so it conflicts with
-            // nothing else in this drain.
-            Query<(), (With<crate::creature_anim::Engaged>, With<SelfPlayer>)>,
-            // The pet's bark (`SMSG_PET_ACTION_SOUND`, decision 2039) — `AiReactionMessage`'s
-            // sibling: both are pure audio that resolves a guid and hands the sound layer a
-            // state for the SAME `0x623a40` dispatcher. Nested for the same reason as its
-            // neighbours: the outer tuple is at the 16-param ceiling.
-            MessageWriter<PetTalkMessage>,
-            MessageWriter<PetDismissSoundMessage>,
-            // The swing-refusal seam's two edges (`crate::swing_refusal`, decision 2037): the four
-            // `SMSG_ATTACKSWING_*` refusals, and our own landed swing, which clears their latch.
-            // ONE writer for both so the drain hands them on in packet order.
-            MessageWriter<crate::swing_refusal::SwingRefusalEdge>,
-        ),
-    ),
-    // The aura feed's duration side-table + the clock to stamp arrivals (decisions 0255/0257): the
-    // self-only `SMSG_UPDATE_AURA_DURATION` lands here keyed by raw slot, timestamped for the
-    // `ui_aura` slot-join — plus the ping clock, which this drain now only CLEARS on a
-    // disconnect: the measuring moved to the read thread with B346's fix.
-    // Grouped as a tuple to stay under Bevy's 16-SystemParam ceiling.
-    //
-    // The stamp clock is `Time<Real>`, NOT the default virtual one, and both its readers
-    // (`aura_duration`, `corpse_reclaim_delay`) are the reason: a span the SERVER sends us counts
-    // down in real seconds, so it must be stamped and read on a real clock. `Time<Virtual>` clamps
-    // at 250 ms per frame (`max_delta`), which is right for simulation — a 2 s hitch must not
-    // teleport animations — and wrong here: every long frame would quietly ADD that much to every
-    // buff timer, so an aura would vanish with seconds still showing on its clock. Measured on a
-    // hitchy run: the virtual clock lost 20 s against real in 33 s (decision 0846).
-    mut aura: (
-        ResMut<crate::ui_aura::AuraDurations>,
-        Res<Time<Real>>,
-        Res<super::PingShared>,
-        // READ-only: every write to a mover's speed set goes through this drain's
-        // `objects::SpeedStage` and lands in one flush at the end (decision 1478).
-        Query<&super::UnitSpeeds>,
-        // The PlayAnimation call-order counter (`creature_anim::PlaySeq`): every
-        // animation-bearing message this drain emits stamps `next()`, in packet order.
-        ResMut<crate::creature_anim::PlaySeq>,
-        // The EnvironmentalDamage.dbc 6-slot table (damage type → SpellVisualKit) the
-        // `SMSG_ENVIRONMENTALDAMAGELOG` arm reads — the fall-landing dust puff.
-        Option<Res<crate::creature_anim::EnvDamageTable>>,
-        // The far-teleport latch + the armed-transport lens for the worldport's spare
-        // predicate (decision 0455: a boat whose path touches the destination map survives
-        // the purge; the TRANSFER_PENDING transport block routes NEW_WORLD's coordinates).
-        ResMut<PendingTransfer>,
-        Query<&crate::transport::Transport>,
-        // The REAL-time clock the relayed-move replay runs on (decisions 0601/0615): a remote's
-        // fire-time is stamped against this, and `drain_pending_moves`/`extrapolate_remote_units`
-        // read the same clock. Virtual time's `max_delta` clamp falls behind real time under
-        // occlusion throttling and would displace the whole replay schedule.
-        Res<Time<bevy::time::Real>>,
-    ),
+    // The families, by name (`params`): the drain destructures each one below so every arm
+    // reads a plain local.
+    clocks: Clocks,
+    objects: ObjectQueries,
+    session: Session,
+    windows: WindowStores,
+    actions: ActionStores,
+    anim: AnimWriters,
+    catalogs: Catalogs,
 ) {
+    let Clocks {
+        mut server_time,
+        mut wall_clock,
+        real: real_clock,
+    } = clocks;
+    let ObjectQueries {
+        mut transforms,
+        mut stores,
+        remote: mut remote_motion,
+        modes: mut unit_modes,
+        mut riders,
+        speeds: unit_speeds,
+        transports,
+        casting: casting_units,
+        engaged_self,
+        mut field_changes,
+    } = objects;
+    let ActionStores {
+        mut player_actions,
+        mut cast_errors,
+        mut mount_errors,
+        mut chain_casts,
+        mut pet_tame_failures,
+        mut learned_in_tab,
+        mut equip_errors,
+        mut merchant_errors,
+        mut cast_bar,
+        mut pending_item_ops,
+        mut lock_transitions,
+        mut trainer_errors,
+        mut stable_errors,
+        mut pending_cast,
+        cooldowns: mut cooldown_store,
+        mut auto_repeat,
+        mut active_channel,
+        mut ui_error_texts,
+        mut queued_melee,
+        mut aura_durations,
+        mut spell_mods,
+    } = actions;
+    let AnimWriters {
+        mut server_sounds,
+        weather: mut weather_msgs,
+        mut emotes,
+        mut swings,
+        mut cast_events,
+        mut spell_go_targets,
+        combat_text: mut combat_text_spawns,
+        mut swing_impacts,
+        mut swing_flushes,
+        go_lid_open: mut go_lid_opens,
+        mut ai_reactions,
+        mut kit_pushes,
+        mut hard_landings,
+        mut mount_flourishes,
+        unit_combat: mut unit_combat_feedback,
+        mut combat_text_events,
+        mut sheath_requests,
+        go_custom_anim: mut go_custom_anims,
+        pet_talk: mut pet_talks,
+        pet_dismiss: mut pet_dismiss_sounds,
+        swing_refusals: mut swing_refusal_edges,
+        mut play_seq,
+    } = anim;
+    let Catalogs {
+        factions: faction_catalog,
+        spells: spell_catalog,
+        combat_cvars,
+        env_damage: env_damage_table,
+        area_table,
+        exploration_sounds,
+        current_map,
+        guild_notify,
+    } = catalogs;
     // A `&mut` to the counter itself (deref-coerced through the `ResMut`), so the arms that stamp
     // it *conditionally* can take it by reference and only advance it when they emit.
-    let play_seq: &mut crate::creature_anim::PlaySeq = &mut aura.4;
-    let (
+    let play_seq: &mut crate::creature_anim::PlaySeq = &mut play_seq;
+    let WindowStores {
         mut names,
         mut items,
         mut gossip,
         mut merchant,
-        (mut trainer_open, mut stable_open),
-        (mut loot, mut loot_latch, mut loot_rolls),
+        mut trainer_open,
+        mut stable_open,
+        mut loot,
+        mut loot_latch,
+        mut loot_rolls,
         mut chat_log,
         mut quest,
-        (mut quest_log, mut quest_share),
+        mut quest_log,
+        mut quest_share,
         mut go_templates,
         mut home_bind,
         mut proficiencies,
         mut dropped,
         mut death_net,
         mut group,
-        (
-            mut taxi,
-            mut mail_open,
-            mut mail_pending,
-            mut trade_session,
-            mut bank_open,
-            mut bank_errors,
-            mut world_states,
-            mut duel,
-            mut social,
-            mut logout,
-            area_table,
-            exploration_sounds,
-            mut mirror_timers,
-            mut pet_bar,
-            mut ui_error_keys,
-            (
-                mut page_texts,
-                mut played_time_answer,
-                mut guild,
-                mut binder,
-                (
-                    mut talent_wipe,
-                    (
-                        mut pet_unlearn,
-                        mut instance_boot,
-                        mut area_spirit,
-                        mut battlefield_queue,
-                        mut meeting_stone,
-                        mut battlefield_scoreboard,
-                        mut battlefield,
-                        mut tutorials,
-                        mut battlefield_positions,
-                        mut tabard,
-                    ),
-                ),
-                mut poi_marker,
-                current_map,
-                mut inspect_honor,
-                mut auction_open,
-                guild_notify,
-                mut ping,
-                mut gm_ticket,
-                mut registrar,
-                mut petition,
-                mut summon,
-                mut instances,
-            ),
-        ),
-    ) = caches;
-    let (
+        mut taxi,
+        mut mail_open,
+        mut mail_pending,
+        mut trade_session,
+        mut bank_open,
+        mut bank_errors,
+        mut world_states,
+        mut duel,
+        mut social,
+        mut logout,
+        mut mirror_timers,
+        mut pet_bar,
+        mut ui_error_keys,
+        mut page_texts,
+        mut played_time_answer,
+        mut guild,
+        mut binder,
+        mut talent_wipe,
+        mut pet_unlearn,
+        mut instance_boot,
+        mut area_spirit,
+        mut battlefield_queue,
+        mut meeting_stone,
+        mut battlefield_scoreboard,
+        mut battlefield,
+        mut tutorials,
+        mut battlefield_positions,
+        mut tabard,
+        mut poi_marker,
+        mut inspect_honor,
+        mut ping,
+        mut gm_ticket,
+        mut registrar,
+        mut petition,
+        mut summon,
+        mut instances,
+    } = windows;
+    let Session {
         mut teleports,
         mut worldports,
-        (mut char_lists, mut realm_lists),
-        (mut char_actions, mut char_login_failures),
-        (mut entered_world, mut addon_reply),
+        mut char_lists,
+        mut realm_lists,
+        mut char_actions,
+        mut char_login_failures,
+        mut entered_world,
+        mut addon_reply,
         mut logged_out,
         mut speed_changes,
-        (mut move_modes, mut knockbacks),
+        mut move_modes,
+        mut knockbacks,
         mut login_stages,
         mut login_queued,
         mut login_failures,
@@ -566,7 +277,8 @@ pub(crate) fn apply_net_updates(
         mut self_moves,
         mut client_control,
         mut cinematics,
-    ) = session_msgs;
+        transfer: mut pending_transfer,
+    } = session;
     // Descriptor seeds/deltas for objects created *earlier in this same drain* can't land on their
     // entities yet (the spawn `Command` hasn't run), so they accumulate here and flush once at the end.
     // This also removes a latent clobber: a plain per-delta `insert` on a not-yet-spawned entity would
@@ -590,15 +302,15 @@ pub(crate) fn apply_net_updates(
                 self_guid: &self_guid,
                 group: Some(&group),
                 index: &index,
-                factions: ui_actions.1 .2.as_deref(),
+                factions: faction_catalog.as_deref(),
                 reputations: &reputations,
-                spells: ui_actions.10.as_deref(),
-                ranges: &ui_actions.1 .5.ranges,
-                periodic: ui_actions.1 .5.periodic.0,
+                spells: spell_catalog.as_deref(),
+                ranges: &combat_cvars.ranges,
+                periodic: combat_cvars.periodic.0,
             }
         };
     }
-    for ev in events.0.try_iter() {
+    for ev in events {
         match ev {
             SessionEvent::LoginStage { stage } => session::login_stage(stage, &mut login_stages),
             SessionEvent::LoginQueued { position, realm } => {
@@ -678,14 +390,13 @@ pub(crate) fn apply_net_updates(
                     &mut mail_open,
                     &mut mail_pending,
                     &mut trade_session,
-                    &mut auction_open,
                     &mut bank_open,
                     &mut duel,
                     &mut social,
                     &mut guild,
                     &mut gm_ticket,
-                    &mut ui_actions.9,
-                    &mut aura.6,
+                    &mut cooldown_store,
+                    &mut pending_transfer,
                     &mut disconnects,
                 );
             }
@@ -722,9 +433,10 @@ pub(crate) fn apply_net_updates(
                     &mut transforms,
                     &mut stores,
                     &mut pending,
+                    &mut field_changes,
                     &mut speed_stage,
-                    &mut names,
-                    &mut go_templates,
+                    &names,
+                    &go_templates,
                     &net_commands,
                 )
             }
@@ -751,7 +463,11 @@ pub(crate) fn apply_net_updates(
             // `[CMovement+0xac] += lag`). A guid we do not hold is dropped, faithfully: the
             // reference resolves under `TYPEMASK_UNIT` and returns on a miss.
             SessionEvent::MoveTimeSkipped { guid, lag_ms } => {
-                if let Some(mut m) = index.0.get(&guid).and_then(|&e| motion.0.get_mut(e).ok()) {
+                if let Some(mut m) = index
+                    .0
+                    .get(&guid)
+                    .and_then(|&e| remote_motion.get_mut(e).ok())
+                {
                     m.relay.skip_time(lag_ms);
                 }
             }
@@ -770,7 +486,7 @@ pub(crate) fn apply_net_updates(
                 // The scheduled-replay law (decisions 0601/0615): `unit_move` runs the mover's own
                 // replay chain over this packet's wire stamp to get its client fire-time, then
                 // applies it now if due, else queues it on the unit for `drain_pending_moves`.
-                let now_ms = aura.8.elapsed_secs_f64() * 1000.0;
+                let now_ms = real_clock.elapsed_secs_f64() * 1000.0;
                 objects::unit_move(
                     guid,
                     crate::net::motion::RelayMove {
@@ -788,9 +504,9 @@ pub(crate) fn apply_net_updates(
                     &mut commands,
                     &index,
                     &self_guid,
-                    &mut motion.0,
+                    &mut remote_motion,
                     &mut transforms,
-                    &mut audio.13,
+                    &mut hard_landings,
                     &mut self_moves,
                 );
             }
@@ -799,7 +515,15 @@ pub(crate) fn apply_net_updates(
                 // reclaim latch is re-asked on that edge, as the reference's `FLAGS` mirror
                 // handler `0x5d6d60` does (1729).
                 death::recheck_corpse(guid, &fields, &self_guid, &mut death_net);
-                objects::object_values(guid, fields, &index, &mut stores, &mut pending, &mut items)
+                objects::object_values(
+                    guid,
+                    fields,
+                    &index,
+                    &mut stores,
+                    &mut pending,
+                    &mut field_changes,
+                    &mut items,
+                )
             }
             SessionEvent::ObjectDestroyed(guid) => {
                 death::forget_corpse(guid, &mut death_net);
@@ -841,11 +565,11 @@ pub(crate) fn apply_net_updates(
                 duration_ms,
                 flying,
                 run_mode,
-                objects::modes_of(guid, &index, &motion.1, &staged_modes).rooted(),
+                objects::modes_of(guid, &index, &unit_modes, &staged_modes).rooted(),
                 &mut commands,
                 &index,
                 &mut transforms,
-                &mut motion.2,
+                &mut riders,
             ),
             SessionEvent::Teleport {
                 guid,
@@ -876,26 +600,26 @@ pub(crate) fn apply_net_updates(
                     needs_ack,
                     &mut commands,
                     &mut index,
-                    &mut aura.6,
-                    &aura.7,
+                    &mut pending_transfer,
+                    &transports,
                     &mut worldports,
                 )
             }
             SessionEvent::TransferPending {
                 map_id,
                 transport_entry,
-            } => session::transfer_pending(map_id, transport_entry, &mut aura.6),
+            } => session::transfer_pending(map_id, transport_entry, &mut pending_transfer),
             SessionEvent::TransferAborted { reason } => {
-                session::transfer_aborted(reason, &mut aura.6)
+                session::transfer_aborted(reason, &mut pending_transfer)
             }
             SessionEvent::TimeSpeed {
                 hours,
                 minutes,
                 day_serial,
                 timescale,
-            } => session::time_speed(hours, minutes, day_serial, timescale, &mut clocks.0),
+            } => session::time_speed(hours, minutes, day_serial, timescale, &mut server_time),
             SessionEvent::ServerUnixTime { unix_time } => {
-                session::server_unix_time(unix_time, &mut clocks.1)
+                session::server_unix_time(unix_time, &mut wall_clock)
             }
             SessionEvent::Reputations { standings } => {
                 session::reputations(standings, &mut reputations)
@@ -906,7 +630,7 @@ pub(crate) fn apply_net_updates(
                 combat_chat::faction_standing(
                     &standings,
                     &reputations,
-                    ui_actions.1 .2.as_deref(),
+                    faction_catalog.as_deref(),
                     &mut chat_log,
                 );
                 session::reputation_delta(standings, &mut reputations, &mut quest)
@@ -932,7 +656,7 @@ pub(crate) fn apply_net_updates(
                     credit.victim_guid,
                     u8::try_from(credit.victim_rank).unwrap_or(0),
                 );
-                audio.15 .1.write(crate::ui_unit::CombatTextEvent {
+                combat_text_events.write(crate::ui_unit::CombatTextEvent {
                     message_type: "HONOR_GAINED",
                     data: Some(credit.honor.to_string()),
                     extra: None,
@@ -961,7 +685,7 @@ pub(crate) fn apply_net_updates(
                     zone,
                     delay_ms,
                     dead_or_ghost,
-                    aura.1.elapsed_secs_f64(),
+                    real_clock.elapsed_secs_f64(),
                     &mut summon,
                 );
             }
@@ -1052,7 +776,7 @@ pub(crate) fn apply_net_updates(
                     &mut binder,
                     &mut ui_error_keys,
                     area_table.as_deref(),
-                    &mut audio.0,
+                    &mut server_sounds,
                 )
             }
             SessionEvent::Proficiency {
@@ -1105,24 +829,24 @@ pub(crate) fn apply_net_updates(
                 objects::gameobject_info(entry, type_id, display_id, name, &data, &mut go_templates)
             }
             SessionEvent::GameObjectCustomAnim { guid, anim_id } => {
-                objects::gameobject_custom_anim(guid, anim_id, &mut audio.15 .3)
+                objects::gameobject_custom_anim(guid, anim_id, &mut go_custom_anims)
             }
             SessionEvent::GameObjectDespawnAnim { guid } => {
                 objects::gameobject_despawn_anim(guid, &mut commands, &index)
             }
             SessionEvent::FishNotHooked => loot::fish_verdict(false, &mut ui_error_keys),
             SessionEvent::FishEscaped => loot::fish_verdict(true, &mut ui_error_keys),
-            SessionEvent::PlaySound { sound_id } => world::play_sound(sound_id, &mut audio.0),
-            SessionEvent::PlayMusic { music_id } => world::play_music(music_id, &mut audio.0),
+            SessionEvent::PlaySound { sound_id } => world::play_sound(sound_id, &mut server_sounds),
+            SessionEvent::PlayMusic { music_id } => world::play_music(music_id, &mut server_sounds),
             SessionEvent::PlayObjectSound { sound_id, guid } => {
-                world::play_object_sound(sound_id, guid, &index, &mut audio.0)
+                world::play_object_sound(sound_id, guid, &index, &mut server_sounds)
             }
             SessionEvent::Weather {
                 weather_type,
                 grade,
                 sound_id,
                 instant,
-            } => world::weather(weather_type, grade, sound_id, instant, &mut audio.1),
+            } => world::weather(weather_type, grade, sound_id, instant, &mut weather_msgs),
             SessionEvent::TextEmote {
                 guid,
                 text_emote,
@@ -1132,30 +856,35 @@ pub(crate) fn apply_net_updates(
                 text_emote,
                 target_name,
                 &index,
-                &mut audio.2,
+                &mut emotes,
                 &mut chat_log,
             ),
             SessionEvent::Emote { guid, emote_id } => {
-                anim::emote(guid, emote_id, &index, &mut audio.2)
+                anim::emote(guid, emote_id, &index, &mut emotes)
             }
             // The spell-book/action-bar pair → the action store the UI feed reads
             // (`crate::ui_action`), sent once at login (and the bar again on server-side edits).
             SessionEvent::SpellBook {
                 spell_ids,
                 cooldowns,
-            } => spell_book(spell_ids, cooldowns, &mut ui_actions.0, &mut ui_actions.9),
-            SessionEvent::ActionButtons { buttons } => action_buttons(buttons, &mut ui_actions.0),
+            } => spell_book(
+                spell_ids,
+                cooldowns,
+                &mut player_actions,
+                &mut cooldown_store,
+            ),
+            SessionEvent::ActionButtons { buttons } => action_buttons(buttons, &mut player_actions),
             SessionEvent::SpellLearned { spell_id } => learned_spell(
                 spell_id,
-                &mut ui_actions.0,
-                ui_actions.10.as_deref(),
+                &mut player_actions,
+                spell_catalog.as_deref(),
                 &mut ui_error_keys,
-                &mut ui_actions.1 .6,
+                &mut learned_in_tab,
             ),
             SessionEvent::SpellRemoved { spell_id } => removed_spell(
                 spell_id,
-                &mut ui_actions.0,
-                ui_actions.10.as_deref(),
+                &mut player_actions,
+                spell_catalog.as_deref(),
                 &mut ui_error_keys,
             ),
             SessionEvent::SpellSuperceded {
@@ -1164,10 +893,10 @@ pub(crate) fn apply_net_updates(
             } => superceded_spell(
                 old_spell_id,
                 new_spell_id,
-                &mut ui_actions.0,
-                ui_actions.10.as_deref(),
+                &mut player_actions,
+                spell_catalog.as_deref(),
                 &mut ui_error_keys,
-                &mut ui_actions.1 .6,
+                &mut learned_in_tab,
             ),
             SessionEvent::CastResult {
                 spell_id,
@@ -1182,17 +911,17 @@ pub(crate) fn apply_net_updates(
                 &mut commands,
                 &self_guid,
                 &index,
-                &mut ui_actions.1 .0,
-                &audio.4,
-                &mut audio.5,
-                &mut ui_actions.4,
-                &mut ui_actions.8,
-                &mut ui_actions.14,
-                &mut ui_actions.9,
-                &mut ui_actions.11,
-                ui_actions.10.as_deref(),
+                &mut cast_errors,
+                &casting_units,
+                &mut cast_events,
+                &mut cast_bar,
+                &mut pending_cast,
+                &mut queued_melee,
+                &mut cooldown_store,
+                &mut auto_repeat,
+                spell_catalog.as_deref(),
                 &net_commands,
-                &mut ui_actions.1 .3,
+                &mut chain_casts,
                 play_seq.next(),
             ),
             SessionEvent::InventoryFailure {
@@ -1205,9 +934,9 @@ pub(crate) fn apply_net_updates(
                 required_level,
                 item_guid,
                 bag_slot,
-                &mut ui_actions.2,
-                &mut ui_actions.5,
-                &mut ui_actions.6,
+                &mut equip_errors,
+                &mut pending_item_ops,
+                &mut lock_transitions,
                 &mut loot_latch,
             ),
             SessionEvent::Chat(m) => {
@@ -1242,9 +971,9 @@ pub(crate) fn apply_net_updates(
             SessionEvent::ChatRestricted => {
                 chat::broadcast(crate::ui_chat::Broadcast::ChatRestricted, &mut chat_log)
             }
-            SessionEvent::Notification { text } => chat::notification(text, &mut ui_actions.13),
+            SessionEvent::Notification { text } => chat::notification(text, &mut ui_error_texts),
             SessionEvent::AreaTriggerMessage { text } => {
-                chat::area_trigger_message(text, &mut ui_actions.13)
+                chat::area_trigger_message(text, &mut ui_error_texts)
             }
             SessionEvent::PlayedTime { total, level } => {
                 // BOTH halves, and they are not redundant. The chat breakdown is our stand-in for
@@ -1273,7 +1002,7 @@ pub(crate) fn apply_net_updates(
                 &mut ui_error_keys,
                 &name,
                 &self_guid,
-                &mut names,
+                &names,
                 &net_commands,
             ),
             SessionEvent::GroupDestroyed => group::destroyed(&mut group, &mut ui_error_keys),
@@ -1292,7 +1021,7 @@ pub(crate) fn apply_net_updates(
                 members,
                 leader,
                 loot,
-                &mut names,
+                &names,
                 &index,
                 &net_commands,
             ),
@@ -1462,7 +1191,7 @@ pub(crate) fn apply_net_updates(
             }
             SessionEvent::PetitionSignResults(results) => crate::ui_petition::apply::sign_results(
                 &mut petition,
-                &mut names,
+                &names,
                 self_guid.0.unwrap_or(0),
                 results,
                 &net_commands,
@@ -1517,7 +1246,7 @@ pub(crate) fn apply_net_updates(
                 corpse_map,
             } => death::corpse_query(found, display_map, position, corpse_map, &mut death_net),
             SessionEvent::CorpseReclaimDelay { delay_ms } => {
-                death::corpse_reclaim_delay(delay_ms, aura.1.elapsed_secs_f64(), &mut death_net)
+                death::corpse_reclaim_delay(delay_ms, real_clock.elapsed_secs_f64(), &mut death_net)
             }
             SessionEvent::ResurrectRequest {
                 caster,
@@ -1551,8 +1280,8 @@ pub(crate) fn apply_net_updates(
                 apply,
                 &mut commands,
                 &index,
-                &mut motion.1,
-                &mut motion.0,
+                &mut unit_modes,
+                &mut remote_motion,
                 &mut staged_modes,
             ),
             SessionEvent::KnockBack {
@@ -1567,10 +1296,10 @@ pub(crate) fn apply_net_updates(
                 combat::attack_start(attacker, victim, &mut commands, &index)
             }
             SessionEvent::AttackStop { attacker, victim } => {
-                combat::attack_stop(attacker, victim, &mut commands, &index, &mut audio.9)
+                combat::attack_stop(attacker, victim, &mut commands, &index, &mut swing_flushes)
             }
             SessionEvent::AiReaction { unit, reaction } => {
-                combat::ai_reaction(unit, reaction, &index, &mut audio.11)
+                combat::ai_reaction(unit, reaction, &index, &mut ai_reactions)
             }
             SessionEvent::AttackerState(s) => {
                 combat_chat::attacker_state(s, &chat_ctx!(), &stores, &transforms, &mut chat_log);
@@ -1578,17 +1307,19 @@ pub(crate) fn apply_net_updates(
                     s,
                     &index,
                     &self_guid,
-                    &mut audio.3,
-                    &mut audio.8,
-                    &mut audio.15 .1,
-                    &mut audio.15 .2,
-                    &mut audio.15 .7,
+                    &mut swings,
+                    &mut swing_impacts,
+                    &mut combat_text_events,
+                    &mut sheath_requests,
+                    &mut swing_refusal_edges,
                     &stores,
                     play_seq.next(),
                 )
             }
-            SessionEvent::AttackSwingError(e) => combat::attack_swing_error(e, &mut audio.15 .7),
-            SessionEvent::CancelCombat => combat::cancel_combat(&mut audio.15 .7),
+            SessionEvent::AttackSwingError(e) => {
+                combat::attack_swing_error(e, &mut swing_refusal_edges)
+            }
+            SessionEvent::CancelCombat => combat::cancel_combat(&mut swing_refusal_edges),
             SessionEvent::FeignDeathResisted => combat::feign_death_resisted(&mut ui_error_keys),
             SessionEvent::SpellDamageLog(s) => {
                 combat_chat::spell_damage_log(s, &chat_ctx!(), &stores, &transforms, &mut chat_log);
@@ -1597,11 +1328,11 @@ pub(crate) fn apply_net_updates(
                     &index,
                     &self_guid,
                     &stores,
-                    ui_actions.10.as_deref(),
-                    *ui_actions.1 .5.damage_text,
-                    &mut audio.7,
-                    &mut audio.15 .0,
-                    &mut audio.15 .1,
+                    spell_catalog.as_deref(),
+                    *combat_cvars.damage_text,
+                    &mut combat_text_spawns,
+                    &mut unit_combat_feedback,
+                    &mut combat_text_events,
                 )
             }
             SessionEvent::PeriodicAuraLog(s) => {
@@ -1610,7 +1341,7 @@ pub(crate) fn apply_net_updates(
                 // the handler `0x626dd0` does, and a zero jumps to the bare epilogue `0x6271b4`:
                 // no chat line, no floating tick number, no periodic miss word. Gating inside
                 // either half below would model it as two filters; it is one gate over both.
-                if !ui_actions.1 .5.periodic.0 {
+                if !combat_cvars.periodic.0 {
                     continue;
                 }
                 combat_chat::periodic_aura_log(
@@ -1625,12 +1356,12 @@ pub(crate) fn apply_net_updates(
                     &index,
                     &self_guid,
                     &stores,
-                    ui_actions.10.as_deref(),
-                    *ui_actions.1 .5.damage_text,
-                    &mut audio.7,
-                    &mut audio.15 .0,
-                    &mut audio.15 .1,
-                    &mut names,
+                    spell_catalog.as_deref(),
+                    *combat_cvars.damage_text,
+                    &mut combat_text_spawns,
+                    &mut unit_combat_feedback,
+                    &mut combat_text_events,
+                    &names,
                     &net_commands,
                 )
             }
@@ -1640,9 +1371,9 @@ pub(crate) fn apply_net_updates(
                     s,
                     &index,
                     &self_guid,
-                    &mut audio.15 .0,
-                    &mut audio.15 .1,
-                    &mut names,
+                    &mut unit_combat_feedback,
+                    &mut combat_text_events,
+                    &names,
                     &net_commands,
                 )
             }
@@ -1654,7 +1385,7 @@ pub(crate) fn apply_net_updates(
                     &transforms,
                     &mut chat_log,
                 );
-                combat_log::spell_energize_log(s, &self_guid, &mut audio.15 .1)
+                combat_log::spell_energize_log(s, &self_guid, &mut combat_text_events)
             }
             SessionEvent::DamageShield(s) => {
                 combat_chat::damage_shield(s, &chat_ctx!(), &stores, &transforms, &mut chat_log);
@@ -1663,9 +1394,9 @@ pub(crate) fn apply_net_updates(
                     &index,
                     &self_guid,
                     &stores,
-                    *ui_actions.1 .5.damage_text,
-                    &mut audio.7,
-                    &mut audio.15 .0,
+                    *combat_cvars.damage_text,
+                    &mut combat_text_spawns,
+                    &mut unit_combat_feedback,
                 )
             }
             SessionEvent::SpellLogMiss(s) => {
@@ -1675,11 +1406,11 @@ pub(crate) fn apply_net_updates(
                     &index,
                     &self_guid,
                     &stores,
-                    ui_actions.10.as_deref(),
-                    *ui_actions.1 .5.damage_text,
-                    &mut audio.7,
-                    &mut audio.15 .0,
-                    &mut audio.15 .1,
+                    spell_catalog.as_deref(),
+                    *combat_cvars.damage_text,
+                    &mut combat_text_spawns,
+                    &mut unit_combat_feedback,
+                    &mut combat_text_events,
                 )
             }
             // ── the combat log's completeness block (1703) ────────────────────────────────
@@ -1727,9 +1458,13 @@ pub(crate) fn apply_net_updates(
                 &transforms,
                 &mut chat_log,
             ),
-            SessionEvent::XpGain(x) => {
-                combat_log::xp_gain(x, &index, &self_guid, &mut audio.7, &mut chat_log)
-            }
+            SessionEvent::XpGain(x) => combat_log::xp_gain(
+                x,
+                &index,
+                &self_guid,
+                &mut combat_text_spawns,
+                &mut chat_log,
+            ),
             SessionEvent::ExplorationXp(x) => combat_log::exploration_xp(
                 x,
                 area_table.as_deref(),
@@ -1737,7 +1472,7 @@ pub(crate) fn apply_net_updates(
                 &index,
                 &self_guid,
                 &stores,
-                &mut audio.0,
+                &mut server_sounds,
                 &mut chat_log,
             ),
             SessionEvent::LevelUp(l) => combat_log::level_up(l, &mut chat_log),
@@ -1757,11 +1492,11 @@ pub(crate) fn apply_net_updates(
                 ammo_display_id,
                 &mut commands,
                 &index,
-                &mut audio.5,
+                &mut cast_events,
                 &self_guid,
-                &mut ui_actions.4,
-                &mut ui_actions.8,
-                ui_actions.10.as_deref(),
+                &mut cast_bar,
+                &mut pending_cast,
+                spell_catalog.as_deref(),
                 play_seq.next(),
             ),
             SessionEvent::SpellGo {
@@ -1788,29 +1523,29 @@ pub(crate) fn apply_net_updates(
                 item_caster,
                 &mut commands,
                 &index,
-                &audio.4,
-                &mut audio.5,
-                &mut audio.6,
+                &casting_units,
+                &mut cast_events,
+                &mut spell_go_targets,
                 &self_guid,
                 &stores,
-                &mut ui_actions.4,
-                &mut ui_actions.8,
-                &mut ui_actions.14,
-                &mut audio.7,
-                *ui_actions.1 .5.damage_text,
-                &mut audio.10,
+                &mut cast_bar,
+                &mut pending_cast,
+                &mut queued_melee,
+                &mut combat_text_spawns,
+                *combat_cvars.damage_text,
+                &mut go_lid_opens,
                 &mut loot_latch,
                 (
-                    &mut ui_actions.9,
-                    ui_actions.10.as_deref(),
+                    &mut cooldown_store,
+                    spell_catalog.as_deref(),
                     &mut items,
                     &net_commands,
                     &mut pet_bar,
                 ),
                 (
-                    &mut ui_actions.11,
-                    &mut audio.15 .2,
-                    !audio.15 .4.is_empty(),
+                    &mut auto_repeat,
+                    &mut sheath_requests,
+                    !engaged_self.is_empty(),
                 ),
                 play_seq.next(),
             ),
@@ -1824,23 +1559,23 @@ pub(crate) fn apply_net_updates(
                 spell_id,
                 &mut commands,
                 &index,
-                &audio.4,
-                &mut audio.5,
+                &casting_units,
+                &mut cast_events,
                 &self_guid,
-                &mut ui_actions.4,
-                &mut ui_actions.8,
-                &mut ui_actions.14,
+                &mut cast_bar,
+                &mut pending_cast,
+                &mut queued_melee,
                 play_seq.next(),
             ),
             SessionEvent::SpellDelayed { caster, delay_ms } => spell_delayed(
                 caster,
                 delay_ms,
                 &self_guid,
-                &mut ui_actions.4,
-                &mut ui_actions.8,
+                &mut cast_bar,
+                &mut pending_cast,
             ),
             SessionEvent::CancelAutoRepeat => cancel_auto_repeat(
-                &mut ui_actions.11,
+                &mut auto_repeat,
                 &self_guid,
                 &index,
                 &mut commands,
@@ -1848,15 +1583,15 @@ pub(crate) fn apply_net_updates(
             ),
             SessionEvent::SpellCooldowns { caster, cooldowns } => {
                 if let Some(store) =
-                    addressed_store(caster, &self_guid, &mut ui_actions.9, &mut pet_bar)
+                    addressed_store(caster, &self_guid, &mut cooldown_store, &mut pet_bar)
                 {
-                    spell_cooldowns(caster, cooldowns, ui_actions.10.as_deref(), store);
+                    spell_cooldowns(caster, cooldowns, spell_catalog.as_deref(), store);
                 }
             }
             SessionEvent::ItemCooldown {
                 item_guid,
                 spell_id,
-            } => item_cooldown(item_guid, spell_id, &items, &mut ui_actions.9),
+            } => item_cooldown(item_guid, spell_id, &items, &mut cooldown_store),
             // The item-lifetime countdown's ONLY feed (decision 1933): park the deadline on the
             // item store, exactly as the enchant timer below does — vmangos's own writer says the
             // `ITEM_FIELD_DURATION` field the client also holds is not what it displays from.
@@ -1872,21 +1607,21 @@ pub(crate) fn apply_net_updates(
             } => items.set_enchant_deadline(item_guid, slot, seconds),
             SessionEvent::CooldownEvent { spell_id, caster } => {
                 if let Some(store) =
-                    addressed_store(caster, &self_guid, &mut ui_actions.9, &mut pet_bar)
+                    addressed_store(caster, &self_guid, &mut cooldown_store, &mut pet_bar)
                 {
                     cooldown_event(spell_id, caster, store);
                 }
             }
             SessionEvent::ClearCooldown { spell_id, caster } => {
                 if let Some(store) =
-                    addressed_store(caster, &self_guid, &mut ui_actions.9, &mut pet_bar)
+                    addressed_store(caster, &self_guid, &mut cooldown_store, &mut pet_bar)
                 {
                     clear_cooldown(spell_id, caster, store);
                 }
             }
             SessionEvent::CooldownCheat { caster } => {
                 if let Some(store) =
-                    addressed_store(caster, &self_guid, &mut ui_actions.9, &mut pet_bar)
+                    addressed_store(caster, &self_guid, &mut cooldown_store, &mut pet_bar)
                 {
                     cooldown_cheat(caster, store);
                 }
@@ -1894,40 +1629,49 @@ pub(crate) fn apply_net_updates(
             // The pet action bar (decision 0982) — server-authoritative, so PET_SPELLS is a
             // wholesale replace and its zero-guid form is the teardown.
             SessionEvent::PetSpells(spells) => {
-                pet::pet_spells(*spells, ui_actions.10.as_deref(), &mut pet_bar)
+                pet::pet_spells(*spells, spell_catalog.as_deref(), &mut pet_bar)
             }
             SessionEvent::PetMode(mode) => pet::pet_mode(mode, &mut pet_bar),
             SessionEvent::PetActionFeedback { reason } => {
                 pet::pet_action_feedback(reason, &mut ui_error_keys)
             }
             SessionEvent::PetCastFailed { spell_id, reason } => {
-                pet::pet_cast_failed(spell_id, reason, &mut ui_actions.1 .0)
+                pet::pet_cast_failed(spell_id, reason, &mut cast_errors)
             }
             // The three pet-feedback arms and the pet's voice (decision 2039). Each was
             // name-table-only until then; each is something the reference visibly does.
             SessionEvent::PetTameFailure { reason } => {
-                pet::pet_tame_failure(reason, &mut ui_actions.1 .4)
+                pet::pet_tame_failure(reason, &mut pet_tame_failures)
             }
             SessionEvent::PetNameInvalid => pet::pet_name_invalid(&mut ui_error_keys),
             SessionEvent::PetBroken => pet::pet_broken(&mut ui_error_keys),
             SessionEvent::PetActionSound { pet_guid, talk } => {
-                pet::pet_action_sound(pet_guid, talk, &index, &mut audio.15 .5)
+                pet::pet_action_sound(pet_guid, talk, &index, &mut pet_talks)
             }
             SessionEvent::PetDismissSound { model_id, position } => {
-                pet::pet_dismiss_sound(model_id, position, &mut audio.15 .6)
+                pet::pet_dismiss_sound(model_id, position, &mut pet_dismiss_sounds)
             }
             SessionEvent::ChannelStart {
                 spell_id,
                 duration_ms,
-            } => channel_start(spell_id, duration_ms, &mut ui_actions.12, &mut ui_actions.4),
+            } => channel_start(spell_id, duration_ms, &mut active_channel, &mut cast_bar),
             SessionEvent::ChannelUpdate { remaining_ms } => {
-                channel_update(remaining_ms, &mut ui_actions.12, &mut ui_actions.4)
-            }
-            SessionEvent::AuraDuration { slot, remaining_ms } => {
-                aura_duration(slot, remaining_ms, &mut aura.0, aura.1.elapsed_secs_f64())
+                channel_update(remaining_ms, &mut active_channel, &mut cast_bar)
             }
+            SessionEvent::AuraDuration { slot, remaining_ms } => aura_duration(
+                slot,
+                remaining_ms,
+                &mut aura_durations,
+                real_clock.elapsed_secs_f64(),
+            ),
+            SessionEvent::SpellModifier {
+                flat,
+                mask_bit,
+                op,
+                value,
+            } => set_spell_modifier(flat, mask_bit, op, value, &mut spell_mods),
             SessionEvent::PlaySpellVisual { unit, kit_id } => {
-                anim::play_spell_visual(unit, kit_id, &index, play_seq, &mut audio.12)
+                anim::play_spell_visual(unit, kit_id, &index, play_seq, &mut kit_pushes)
             }
             SessionEvent::EnvironmentalDamageLog(e) => {
                 combat_chat::environmental_damage_log(
@@ -1940,9 +1684,9 @@ pub(crate) fn apply_net_updates(
                 anim::environmental_damage_log(
                     e,
                     &index,
-                    aura.5.as_deref(),
+                    env_damage_table.as_deref(),
                     play_seq,
-                    &mut audio.12,
+                    &mut kit_pushes,
                 )
             }
             // The gossip/vendor/trainer NPC-interaction family — arm bodies in `npc`.
@@ -1969,7 +1713,7 @@ pub(crate) fn apply_net_updates(
                 &poi,
                 &mut poi_marker,
                 current_map.as_ref().map_or(0, |m| m.0),
-                aura.1.elapsed_secs_f64(),
+                real_clock.elapsed_secs_f64(),
             ),
             // Questgiver panels (decision 0088): fill the `QuestGiver` the quest feed
             // (`crate::ui_quest`) reads. Each panel packet replaces the open view; the greeting/gossip
@@ -2035,7 +1779,7 @@ pub(crate) fn apply_net_updates(
                 npc::trainer_buy_succeeded(trainer, spell_id, &mut trainer_open, &net_commands)
             }
             SessionEvent::TrainerBuyFailed { error, .. } => {
-                npc::trainer_buy_failed(error, &mut ui_actions.7 .0)
+                npc::trainer_buy_failed(error, &mut trainer_errors)
             }
             SessionEvent::InvalidatePlayer { guid } => names::invalidate_player(guid, &mut names),
             SessionEvent::ListStabledPets {
@@ -2043,12 +1787,9 @@ pub(crate) fn apply_net_updates(
                 num_stable_slots,
                 pets,
             } => npc::list_stabled_pets(npc, num_stable_slots, pets, &mut stable_open, &mut names),
-            SessionEvent::StableResult { result } => npc::stable_result(
-                result,
-                &mut stable_open,
-                &mut ui_actions.7 .1,
-                &net_commands,
-            ),
+            SessionEvent::StableResult { result } => {
+                npc::stable_result(result, &mut stable_open, &mut stable_errors, &net_commands)
+            }
             SessionEvent::TaxiNodesShown {
                 flightmaster,
                 nearest_node,
@@ -2069,11 +1810,15 @@ pub(crate) fn apply_net_updates(
                 vendor,
                 item_entry,
                 reason,
-            } => {
-                npc::vendor_buy_failed(vendor, item_entry, reason, &mut merchant, &mut ui_actions.3)
-            }
+            } => npc::vendor_buy_failed(
+                vendor,
+                item_entry,
+                reason,
+                &mut merchant,
+                &mut merchant_errors,
+            ),
             SessionEvent::VendorSellFailed { reason, .. } => {
-                npc::vendor_sell_failed(reason, &mut ui_actions.3)
+                npc::vendor_sell_failed(reason, &mut merchant_errors)
             }
             SessionEvent::ForceSpeedChange {
                 guid,
@@ -2086,20 +1831,20 @@ pub(crate) fn apply_net_updates(
                 counter,
                 speed,
                 &index,
-                &aura.3,
+                &unit_speeds,
                 &mut speed_stage,
                 &self_guid,
                 &mut speed_changes,
             ),
             SessionEvent::SpeedChanged { guid, kind, speed } => {
-                objects::speed_changed(guid, kind, speed, &index, &aura.3, &mut speed_stage)
+                objects::speed_changed(guid, kind, speed, &index, &unit_speeds, &mut speed_stage)
             }
             // ── The mount arc (decision 0441) — arm bodies in `mount` ─────────────────────────
             SessionEvent::MountResult { mount, code } => {
-                mount::mount_result(mount, code, &mut ui_actions.1 .1)
+                mount::mount_result(mount, code, &mut mount_errors)
             }
             SessionEvent::MountSpecial { guid } => {
-                mount::mount_special(guid, &self_guid, &index, &mut audio.14)
+                mount::mount_special(guid, &self_guid, &index, &mut mount_flourishes)
             }
             // Possession's control half (B211). Forwarded whole and unjudged: the guid may name us
             // (a revoke) or somebody else (a grant), and only the controller can act on either —
@@ -2140,7 +1885,7 @@ pub(crate) fn apply_net_updates(
                 item,
                 &mut mail_open,
                 &net_commands,
-                &mut ui_actions.2,
+                &mut equip_errors,
             ),
             SessionEvent::MailItemText { text_id, text } => {
                 mail::mail_item_text(text_id, text, &mut mail_open)
@@ -2158,41 +1903,6 @@ pub(crate) fn apply_net_updates(
             SessionEvent::NextMailTime { seconds } => {
                 mail::next_mail_time(seconds, &mut mail_pending)
             }
-            // The auction house arc (decision 1511 P1): the hello reply OPENS the window — our
-            // send does not — and the three list results fill the three tabs.
-            SessionEvent::AuctionHello {
-                auctioneer,
-                house_id,
-            } => auction::auction_hello(auctioneer, house_id, &mut auction_open),
-            SessionEvent::AuctionCommandResult {
-                auction_id,
-                action,
-                error,
-                tail,
-            } => {
-                auction::auction_command_result(auction_id, action, error, &tail, &mut auction_open)
-            }
-            SessionEvent::AuctionListResult {
-                auctions,
-                total_count,
-            } => auction::auction_list_result(auctions, total_count, &mut auction_open),
-            SessionEvent::AuctionOwnerListResult {
-                auctions,
-                total_count,
-            } => auction::auction_owner_list_result(auctions, total_count, &mut auction_open),
-            SessionEvent::AuctionBidderListResult {
-                auctions,
-                total_count,
-            } => auction::auction_bidder_list_result(auctions, total_count, &mut auction_open),
-            SessionEvent::AuctionBidderNotification(n) => {
-                auction::auction_bidder_notification(&n, &mut auction_open)
-            }
-            SessionEvent::AuctionOwnerNotification(n) => {
-                auction::auction_owner_notification(&n, &mut auction_open)
-            }
-            SessionEvent::AuctionRemovedNotification { item_entry, .. } => {
-                auction::auction_removed_notification(item_entry, &mut auction_open)
-            }
             // The player-trade arc (decision 0592 P1): the status packet drives the open/accept/close
             // state machine, the extended snapshot replaces one side's item/gold — both into the
             // `TradeSession` the trade feed (`crate::ui_trade`) reads.
@@ -2208,6 +1918,15 @@ pub(crate) fn apply_net_updates(
             SessionEvent::WorldStates { scope, states } => {
                 world::world_states(scope, states, &mut world_states)
             }
+            // A kind with no arm here is one a subsystem has claimed in the handler table
+            // (decision 2305) — routed there by the drain, so it never reaches this match — or a
+            // new kind nobody handles, which `every_session_event_kind_has_one_owner` names at
+            // test time and this names at run time: the reference discards an unregistered
+            // opcode in silence; this client says so.
+            other => error!(
+                "net: {:?} reached the dispatch match with no arm — neither peeled nor handled",
+                benilla_protocol::SessionEventKind::from(&other)
+            ),
         }
     }
     // Flush the staged descriptor seeds/deltas onto the entities born this drain (now spawned by the
diff --git a/crates/benilla-app/src/net/apply/combat.rs b/crates/benilla-app/src/net/apply/combat.rs
index efcd52e5..14648ace 100644
--- a/crates/benilla-app/src/net/apply/combat.rs
+++ b/crates/benilla-app/src/net/apply/combat.rs
@@ -109,7 +109,6 @@ pub(super) fn ai_reaction(
 /// the center combat text, which the client fires **synchronously at packet parse**
 /// (`0x6255b0 → 0x629d30 → 0x703f50`, one call stack — §5-verified, wow-re
 /// `combat-text-update-emission-law.md`; decision 0580's fold-back).
-#[allow(clippy::too_many_arguments)] // one dispatch arm's full writer set
 pub(super) fn attacker_state(
     mut s: AttackerState,
     index: &GuidIndex,
diff --git a/crates/benilla-app/src/net/apply/combat_chat.rs b/crates/benilla-app/src/net/apply/combat_chat.rs
index 06b3b72e..793e8c89 100644
--- a/crates/benilla-app/src/net/apply/combat_chat.rs
+++ b/crates/benilla-app/src/net/apply/combat_chat.rs
@@ -1185,7 +1185,6 @@ fn periodic_leech_amount(power: u32, amount: u32) -> u32 {
 /// 6. **the periodic flag picks the chat-type stub** — `0x627d60` periodic, `0x627d30` direct —
 ///    and only here, *after* the fork.
 /// 7. **`drained == 0` drops the line** (`627ae3 test esi,esi` / `627ae5 je`), after the divide.
-#[allow(clippy::too_many_arguments)] // one reference function's full argument set
 fn power_drain_line(
     log: &mut ChatLog,
     ctx: &ChatCtx,
@@ -1409,8 +1408,7 @@ pub(super) fn faction_standing(
 
 /// The one tail every arm ends in: build the queued line (dropping a class-9 endpoint) and park it
 /// for its names.
-#[allow(clippy::too_many_arguments)] // the tail's args ARE the line: sink, context, and the five
-                                     // facts a queued line is made of. Bundling any of them would only move the list somewhere else.
+// facts a queued line is made of. Bundling any of them would only move the list somewhere else.
 fn queue(
     log: &mut ChatLog,
     ctx: &ChatCtx,
@@ -1436,7 +1434,6 @@ fn queue(
 
 /// [`queue`] for a family whose `Named` slot still has to be looked up — an item entry or a unit
 /// guid rides along and the drain resolves it, holding the line until it lands (§5.7).
-#[allow(clippy::too_many_arguments)] // as [`queue`], plus the one key that defers the line
 fn queue_named(
     log: &mut ChatLog,
     ctx: &ChatCtx,
@@ -1458,7 +1455,6 @@ fn queue_named(
 /// there is a **fall-through** to the generic leech/drain path, not a dropped line. Both failure
 /// shapes below are among the ones the reference reports: its own range gate, and an empty
 /// template.
-#[allow(clippy::too_many_arguments)] // as [`queue_named`], whose body this is
 fn queue_reported(
     log: &mut ChatLog,
     ctx: &ChatCtx,
diff --git a/crates/benilla-app/src/net/apply/combat_log.rs b/crates/benilla-app/src/net/apply/combat_log.rs
index dd1acdf7..c480f5ef 100644
--- a/crates/benilla-app/src/net/apply/combat_log.rs
+++ b/crates/benilla-app/src/net/apply/combat_log.rs
@@ -175,7 +175,6 @@ fn power_message_type(power: u32) -> Option<&'static str> {
 /// the zero-damage ABSORB/RESIST word, over the target (`0x5e85e0`). Source-classified: only my
 /// (gold) or my pet's (gold, PetSpellDamage-gated) spells draw. The handler pushes the same
 /// record/source to number and word twin alike, so the override colors both.
-#[allow(clippy::too_many_arguments)] // one dispatch arm's full writer set
 pub(super) fn spell_damage_log(
     s: SpellDamageLog,
     index: &GuidIndex,
@@ -246,7 +245,6 @@ pub(super) fn spell_damage_log(
 
 /// `SMSG_PERIODICAURALOG` → DoT ticks float like direct damage (`0x626dd0`, never crit-category);
 /// heal/energize/leech ticks float **nothing** (heals never float in 5875).
-#[allow(clippy::too_many_arguments)] // one dispatch arm's full writer set
 pub(super) fn periodic_aura_log(
     s: PeriodicAuraLog,
     index: &GuidIndex,
@@ -257,7 +255,7 @@ pub(super) fn periodic_aura_log(
     text: &mut MessageWriter<CombatTextSpawn>,
     feedback: &mut MessageWriter<UnitCombatFeedback>,
     center: &mut MessageWriter<CombatTextEvent>,
-    names: &mut NameCache,
+    names: &NameCache,
     net: &NetCommands,
 ) {
     if benilla_assets::trace::enabled() {
@@ -435,7 +433,7 @@ pub(super) fn spell_heal_log(
     self_guid: &SelfGuid,
     feedback: &mut MessageWriter<UnitCombatFeedback>,
     center: &mut MessageWriter<CombatTextEvent>,
-    names: &mut NameCache,
+    names: &NameCache,
     net: &NetCommands,
 ) {
     if let Some(&unit) = index.0.get(&s.target) {
@@ -526,7 +524,6 @@ fn miss_action(code: u8) -> Option<&'static str> {
 /// Source-classified like every emitter (the classifier lives inside the word twin too), and
 /// **coloured by the same B/K law as a number** — `0x5e7f63 mov ecx,[ebp-0x8]; 0x5e7f66 push ecx`
 /// pushes the resolved SpellRec, not NULL, so this site's words are spell-GOLD (decision 2229).
-#[allow(clippy::too_many_arguments)] // one dispatch arm's full writer set
 pub(super) fn spell_log_miss(
     s: SpellLogMiss,
     index: &GuidIndex,
@@ -619,7 +616,6 @@ pub(super) fn xp_gain(
 ///   path as `SMSG_PLAY_SOUND`.
 ///
 /// No floating text (the XP itself still arrives via the non-kill `SMSG_LOG_XPGAIN`).
-#[allow(clippy::too_many_arguments)] // one arm of the dispatch — its param list IS its input set
 pub(super) fn exploration_xp(
     x: ExplorationXp,
     area_table: Option<&crate::area::AreaTableRes>,
diff --git a/crates/benilla-app/src/net/apply/group.rs b/crates/benilla-app/src/net/apply/group.rs
index ca39da12..80ce811c 100644
--- a/crates/benilla-app/src/net/apply/group.rs
+++ b/crates/benilla-app/src/net/apply/group.rs
@@ -68,7 +68,7 @@ pub(super) fn leader_changed(
     errors: &mut UiErrorKeys,
     name: &str,
     self_guid: &SelfGuid,
-    names: &mut NameCache,
+    names: &NameCache,
     net_commands: &NetCommands,
 ) {
     let own = self_guid
@@ -88,7 +88,6 @@ pub(super) fn leader_changed(
 /// read them and both were empty for an out-of-area member before this — the raid grid's class
 /// column (`ui_party::feed::raid_roster`, whose own-row twin of this hole 1549 §7 found live), and
 /// the party frame's 2D portrait stand-in (`portrait::temporary_portrait`, report B315).
-#[allow(clippy::too_many_arguments)]
 pub(super) fn list(
     group: &mut GroupState,
     errors: &mut UiErrorKeys,
@@ -98,7 +97,7 @@ pub(super) fn list(
     members: Vec<GroupMemberEntry>,
     leader: u64,
     loot: Option<GroupLootInfo>,
-    names: &mut NameCache,
+    names: &NameCache,
     index: &GuidIndex,
     net_commands: &NetCommands,
 ) {
@@ -276,7 +275,7 @@ mod tests {
             vec![member(leader, "Frostshake"), member(far, "Thalyn")],
             leader,
             None,
-            &mut names,
+            &names,
             &GuidIndex::default(),
             &net,
         );
@@ -305,7 +304,7 @@ mod tests {
             vec![member(leader, "Frostshake"), member(far, "Thalyn")],
             leader,
             None,
-            &mut names,
+            &names,
             &GuidIndex::default(),
             &net,
         );
@@ -427,7 +426,7 @@ mod tests {
             UiErrorKeys::default(),
             QuestGiver::default(),
         );
-        let mut names = NameCache::default();
+        let names = NameCache::default();
         let (near, far) = (0x11u64, 0x22u64);
 
         // `near` is streamed, `far` is not.
@@ -446,7 +445,7 @@ mod tests {
                 members,
                 near,
                 None,
-                &mut names,
+                &names,
                 &index,
                 &net,
             );
diff --git a/crates/benilla-app/src/net/apply/loot.rs b/crates/benilla-app/src/net/apply/loot.rs
index b3e0790b..2d952fe0 100644
--- a/crates/benilla-app/src/net/apply/loot.rs
+++ b/crates/benilla-app/src/net/apply/loot.rs
@@ -364,7 +364,6 @@ pub(super) fn item_template(entry: u32, info: Option<ItemInfo>, items: &mut Item
 /// [`PendingItemOps::clear_by_failure`]. This site has no `UiScript` to fire `ITEM_LOCK_CHANGED`
 /// through, so the transitioned slots queue in [`LockTransitions`] for the container feed
 /// (`ui_items::feed::feed_containers`) to drain and fire next time it runs.
-#[allow(clippy::too_many_arguments)] // one dispatch arm's full input set
 pub(super) fn inventory_failure(
     reason: u8,
     required_level: Option<u32>,
diff --git a/crates/benilla-app/src/net/apply/mail.rs b/crates/benilla-app/src/net/apply/mail.rs
index 370eb751..9919c191 100644
--- a/crates/benilla-app/src/net/apply/mail.rs
+++ b/crates/benilla-app/src/net/apply/mail.rs
@@ -76,7 +76,6 @@ fn take_empties(entry: &MailListEntry, action: u32) -> bool {
 /// take/return/delete then re-syncs the inbox with a fresh `CMSG_GET_MAIL_LIST` (the reference
 /// client's inbox-refresh moment); an EQUIP_ERROR routes to the existing inventory-error surface;
 /// any other failure surfaces the red error line.
-#[allow(clippy::too_many_arguments)]
 pub(super) fn send_mail_result(
     mail_id: u32,
     action: u32,
@@ -147,8 +146,7 @@ pub(super) fn send_mail_result(
 /// `SessionEvent::MailItemText` (`SMSG_ITEM_TEXT_QUERY_RESPONSE`) — land the letter body in the
 /// ask-once cache + clear its pending flag; the feed repaints (MAIL_INBOX_UPDATE) on the change.
 pub(super) fn mail_item_text(text_id: u32, text: String, mail: &mut MailOpen) {
-    mail.bodies.insert(text_id, text);
-    mail.pending_bodies.remove(&text_id);
+    mail.bodies.insert(text_id, Some(text));
 }
 
 /// `SessionEvent::ReceivedMail` (`SMSG_RECEIVED_MAIL`) — mail just arrived. `seconds` is the wire's
diff --git a/crates/benilla-app/src/net/apply/names.rs b/crates/benilla-app/src/net/apply/names.rs
index 19e13c18..a3f76b56 100644
--- a/crates/benilla-app/src/net/apply/names.rs
+++ b/crates/benilla-app/src/net/apply/names.rs
@@ -40,7 +40,6 @@ pub(super) fn invalidate_player(guid: u64, names: &mut NameCache) {
 /// `SMSG_CREATURE_QUERY_RESPONSE` — the template's name plus the hover line's fields. A `None` name
 /// is the server's "no such entry", cached as such so the ask never repeats; the remaining fields
 /// then carry their miss defaults.
-#[allow(clippy::too_many_arguments)]
 pub(super) fn creature_name(
     entry: u32,
     name: Option<String>,
diff --git a/crates/benilla-app/src/net/apply/npc.rs b/crates/benilla-app/src/net/apply/npc.rs
index 355bd322..8dc12da2 100644
--- a/crates/benilla-app/src/net/apply/npc.rs
+++ b/crates/benilla-app/src/net/apply/npc.rs
@@ -42,7 +42,6 @@ fn npc_gender(guid: u64, index: &GuidIndex, stores: &Query<&mut ObjectStore>) ->
 ///
 /// The greeting is **drawn here**, not at the packet — this is the reference's own moment for it
 /// (`0x4e2010`), and the draw needs both this NPC's gender ([`npc_gender`]) and a fresh roll.
-#[allow(clippy::too_many_arguments)]
 pub(super) fn gossip_menu(
     npc: u64,
     text_id: u32,
diff --git a/crates/benilla-app/src/net/apply/objects.rs b/crates/benilla-app/src/net/apply/objects.rs
index 23b25b3d..084a32d4 100644
--- a/crates/benilla-app/src/net/apply/objects.rs
+++ b/crates/benilla-app/src/net/apply/objects.rs
@@ -23,8 +23,8 @@ use super::super::motion::{
     trace_create_spline, trace_move_snap, wire_yaw, write_pose, SplineStopped, ROOT_APPLY_WIPE,
 };
 use super::super::{
-    Guid, GuidIndex, NetCommands, NetEntity, ObjectStore, RemoteMotion, SelfGuid,
-    SpeedChangeMessage, Spline, UnitMoveModes, UnitSpeeds,
+    merge_store_fields, FieldChanged, Guid, GuidIndex, NetCommands, NetEntity, ObjectStore,
+    RemoteMotion, SelfGuid, SpeedChangeMessage, Spline, UnitMoveModes, UnitSpeeds,
 };
 
 /// A GameObject plays its one-shot **Custom** animation (`SMSG_GAMEOBJECT_CUSTOM_ANIM`, decision
@@ -63,7 +63,6 @@ pub(super) fn gameobject_despawn_anim(guid: u64, commands: &mut Commands, index:
 
 /// An object entered range / was created (`SMSG_UPDATE_OBJECT` create block): spawn or refresh the
 /// entity, warm the ask-once caches, and seed its descriptor store via the per-drain `pending` map.
-#[allow(clippy::too_many_arguments)]
 pub(super) fn object_create(
     guid: u64,
     kind: EntityKind,
@@ -82,9 +81,10 @@ pub(super) fn object_create(
     transforms: &mut Query<&mut Transform>,
     stores: &mut Query<&mut ObjectStore>,
     pending: &mut HashMap<u64, ObjectFields>,
+    edges: &mut MessageWriter<FieldChanged>,
     speed_stage: &mut SpeedStage,
-    names: &mut NameCache,
-    go_templates: &mut GameObjectTemplates,
+    names: &NameCache,
+    go_templates: &GameObjectTemplates,
     net_commands: &NetCommands,
 ) {
     let net = NetEntity {
@@ -243,8 +243,9 @@ pub(super) fn object_create(
             }
         }
         write_pose(commands, transforms, e, position, placement);
-        // Overlay the fresh snapshot's descriptor fields onto the existing store.
-        merge_fields(stores, pending, e, guid, fields);
+        // Overlay the fresh snapshot's descriptor fields onto the existing store — the reference's
+        // in-place refresh of a live guid, which notifies its field watchers like any delta.
+        merge_fields(stores, pending, edges, e, guid, fields);
     } else {
         // A transport spawns hidden: its create pose is the *stationary* spawn point (or worse,
         // the origin), not where the boat is in its cycle — the transport tick unhides it at the
@@ -317,7 +318,6 @@ pub(super) fn object_move(
 /// applies now, a future one queues on the unit and fires in `drain_pending_moves` — the dead-reckon
 /// covering the mover's own timeline in between, which is what kills the arrival-jitter snap.
 /// `WOW_REMOTE_SNAP=1` restores raw apply-at-arrival for an A/B.
-#[allow(clippy::too_many_arguments)] // the wire fields + the apply context, one per concern
 pub(super) fn unit_move(
     guid: u64,
     mv: crate::net::motion::RelayMove,
@@ -442,10 +442,11 @@ pub(super) fn object_values(
     index: &GuidIndex,
     stores: &mut Query<&mut ObjectStore>,
     pending: &mut HashMap<u64, ObjectFields>,
+    edges: &mut MessageWriter<FieldChanged>,
     items: &mut Items,
 ) {
     if let Some(&e) = index.0.get(&guid) {
-        merge_fields(stores, pending, e, guid, fields);
+        merge_fields(stores, pending, edges, e, guid, fields);
     } else if guid::is_item(guid) {
         items.merge_object(guid, fields);
     }
@@ -528,7 +529,6 @@ pub(super) fn objects_removed(guids: Vec<u64>, commands: &mut Commands, index: &
 /// rider's local pose for `transport::compose_riders` to carry out to the world. When it is `None`
 /// on a unit we had riding, the unit has *left* the deck — vmangos drops it from the transport on
 /// exactly this edge (`MoveSplineInit::Launch`, `spline/MoveSplineInit.cpp:156-159`).
-#[allow(clippy::too_many_arguments)]
 pub(super) fn monster_move(
     guid: u64,
     transport: Option<u64>,
@@ -754,7 +754,6 @@ pub(super) fn modes_of(
 /// the reference applies to whatever it finds — so we do too. It is inert on the avatar either way:
 /// the animation selector's `unify` gives the controller's own `MovementState` precedence, and our
 /// mover's modes are the handshake family's ([`crate::player::state::MoveModes`]).
-#[allow(clippy::too_many_arguments)] // the wire fields + the apply context, one per concern
 pub(super) fn spline_move_mode(
     guid: u64,
     mode: SplineMode,
@@ -818,17 +817,27 @@ pub(super) fn gameobject_info(
 /// created earlier this same drain (its spawn `Command` hasn't run, so it isn't queryable yet), else in
 /// place on the live component. The final `else` — in the index but neither live nor pending — should not
 /// happen (a create always seeds `pending` first), but seeds defensively rather than drop the delta.
+///
+/// Every merge reports its field edges ([`FieldChanged`], decision 2297) — into the pending seed
+/// too: a create and a values delta for the same guid in one drain are two wire blocks, and the
+/// reference notifies on the second. The seed itself is never merged, which is the reference's
+/// create-time notify-suppress.
 fn merge_fields(
     stores: &mut Query<&mut ObjectStore>,
     pending: &mut HashMap<u64, ObjectFields>,
+    edges: &mut MessageWriter<FieldChanged>,
     entity: Entity,
     guid: u64,
     delta: ObjectFields,
 ) {
     if let Some(f) = pending.get_mut(&guid) {
-        f.merge(delta);
+        merge_store_fields(f, delta, entity, guid, |e| {
+            edges.write(e);
+        });
     } else if let Ok(mut s) = stores.get_mut(entity) {
-        s.0.merge(delta);
+        merge_store_fields(&mut s.0, delta, entity, guid, |e| {
+            edges.write(e);
+        });
     } else {
         pending.insert(guid, delta);
     }
@@ -920,7 +929,6 @@ fn live_speeds(index: &GuidIndex, speeds: &Query<&UnitSpeeds>, guid: u64) -> Opt
 /// answers the mandatory ack with its live pose (the TeleportMessage pattern). An unknown guid
 /// still acks if it's ours-by-guid; a foreign mover (we never control others) is only applied,
 /// never acked — acking a unit we don't control is the server's error path.
-#[allow(clippy::too_many_arguments)]
 pub(super) fn force_speed_change(
     guid: u64,
     kind: SpeedKind,
diff --git a/crates/benilla-app/src/net/apply/params.rs b/crates/benilla-app/src/net/apply/params.rs
new file mode 100644
index 00000000..0396037d
--- /dev/null
+++ b/crates/benilla-app/src/net/apply/params.rs
@@ -0,0 +1,375 @@
+//! **The drain's parameters, by name** (decision 2279, 2265 §A1a).
+//!
+//! [`super::apply_net_updates`] takes every resource the 273 arms write, and Bevy caps a system
+//! at sixteen parameters (`bevy_ecs` `system_param.rs`, `all_tuples!(…, 0, 16)`). From day one
+//! (0006) the escape was tuples nested up to six deep, addressed by coordinate — `audio.15 .6`,
+//! `ui_actions.1 .5` — with fifty comments across the tree explaining that a thing rides where it
+//! rides "because this is where the ceiling left room". The `SystemParam` derive emits a named
+//! struct with no field cap, so each family below is a struct: the body destructures it by field
+//! name, every use site reads as what it is, and a new resource joins the family it belongs to
+//! rather than the tuple with a slot free.
+//!
+//! **Grouping is by what the arms do with a thing**, not by what it is: a session-lifecycle edge,
+//! a window's parked state, the action bar's queues, an animation-bearing message, a read-only
+//! catalog. Two families the tuples had mis-homed for want of room moved to where they belong
+//! (the catalogs, and the queries); one parameter the tuples carried nobody read
+//! (`PingShared` — the drain stopped clearing it with B346) is gone. Nothing else changed: the
+//! same set of resources, the same access, one system.
+//!
+//! Splitting the drain itself — each family owning a reader system of its own — is 2265 §A1(b),
+//! and starts from these names.
+
+use bevy::ecs::system::SystemParam;
+use bevy::prelude::*;
+
+use super::super::{
+    AiReactionMessage, CharActionResultMessage, CharListMessage, EmoteMessage, EnteredWorldMessage,
+    LoggedOutMessage, ObjectStore, PendingTransfer, PetDismissSoundMessage, PetTalkMessage,
+    RemoteMotion, SelfPlayer, ServerSoundMessage, ServerTime, ServerWallClock, TeleportMessage,
+    UnitMoveModes, WorldportMessage,
+};
+use benilla_world::weather::WeatherMessage;
+
+/// The clocks: the server's two, and our real one.
+#[derive(SystemParam)]
+pub(crate) struct Clocks<'w> {
+    /// The in-game day/night clock the lighting reads (`SMSG_LOGIN_SETTIMESPEED`).
+    pub server_time: ResMut<'w, ServerTime>,
+    /// The wall clock the absolute descriptor stamps are dated in (decision 1150). A different
+    /// quantity from the one above, from the same handler file.
+    pub wall_clock: ResMut<'w, ServerWallClock>,
+    /// `Time<Real>`, NOT the default virtual one, and every reader here is the reason: a span
+    /// the SERVER sends us (an aura's remaining duration, the corpse-reclaim delay, a relayed
+    /// mover's fire-time) counts down in real seconds, so it must be stamped and read on a real
+    /// clock. `Time<Virtual>` clamps at 250 ms per frame (`max_delta`), which is right for
+    /// simulation — a 2 s hitch must not teleport animations — and wrong here: every long frame
+    /// would quietly ADD that much to every buff timer, so an aura would vanish with seconds
+    /// still showing on its clock. Measured on a hitchy run: the virtual clock lost 20 s against
+    /// real in 33 s (decision 0846). The relayed-move replay (0601/0615) reads the same clock in
+    /// `drain_pending_moves`/`extrapolate_remote_units`.
+    pub real: Res<'w, Time<Real>>,
+}
+
+/// Every entity query the drain holds — what it reads or writes on streamed objects.
+#[derive(SystemParam)]
+pub(crate) struct ObjectQueries<'w, 's> {
+    pub transforms: Query<'w, 's, &'static mut Transform>,
+    pub stores: Query<'w, 's, &'static mut ObjectStore>,
+    /// A relayed player's dead-reckon.
+    pub remote: Query<'w, 's, &'static mut RemoteMotion>,
+    /// Any unit's server-granted movement modes (decision 1780).
+    pub modes: Query<'w, 's, &'static mut UnitMoveModes>,
+    /// The deck a unit is standing on and its pose there (decision 1936).
+    pub riders: Query<'w, 's, &'static mut crate::transport::TransportRider>,
+    /// READ-only: every write to a mover's speed set goes through the drain's
+    /// `objects::SpeedStage` and lands in one flush at the end (decision 1478).
+    pub speeds: Query<'w, 's, &'static super::super::UnitSpeeds>,
+    /// The armed-transport lens for the worldport's spare predicate (decision 0455: a boat whose
+    /// path touches the destination map survives the purge).
+    pub transports: Query<'w, 's, &'static crate::transport::Transport>,
+    /// The cast-state read the spell-id-keyed `Casting` reap needs (decision 0107).
+    pub casting: Query<'w, 's, &'static crate::creature_anim::Casting>,
+    /// Are *we* already swinging? The ref's `[player+0xc48]`, mirrored by the server-echoed
+    /// [`crate::creature_anim::Engaged`] — read by the GO handler's deferred auto-attack start
+    /// (`0x6e83e7`, decision 1593). Filter-only, so it conflicts with nothing else in the drain.
+    pub engaged_self: Query<'w, 's, (), (With<crate::creature_anim::Engaged>, With<SelfPlayer>)>,
+    /// The per-field descriptor edges the merge reports (decision 2297) — the reference's
+    /// `CMirrorHandler` notify pass, emitted from the one write that holds both sides.
+    pub field_changes: MessageWriter<'w, super::super::FieldChanged>,
+}
+
+/// The session lifecycle: the glue-screen edges, the player's own teleports and mover
+/// handshakes, and the entry/transfer state those edges write (decision 0193).
+#[derive(SystemParam)]
+pub(crate) struct Session<'w> {
+    pub teleports: MessageWriter<'w, TeleportMessage>,
+    pub worldports: MessageWriter<'w, WorldportMessage>,
+    /// The two park publications: the realm list and the character roster are the same thing
+    /// one park apart, each published so the app's policy can answer it.
+    pub char_lists: MessageWriter<'w, CharListMessage>,
+    pub realm_lists: MessageWriter<'w, crate::net::RealmListMessage>,
+    /// The pick park's two verdicts: what a create/delete came back with, and the refusal of the
+    /// pick itself.
+    pub char_actions: MessageWriter<'w, CharActionResultMessage>,
+    pub char_login_failures: MessageWriter<'w, super::super::CharacterLoginFailedMessage>,
+    /// The world-entry pair, one edge: the entry message, and the `SMSG_ADDON_INFO` verdict that
+    /// the entry's own UI load reads before the first addon's file-scope code asks
+    /// `GetNumAddOns()` (2175).
+    pub entered_world: MessageWriter<'w, EnteredWorldMessage>,
+    pub addon_reply: ResMut<'w, crate::net::AddonInfoReply>,
+    pub logged_out: MessageWriter<'w, LoggedOutMessage>,
+    pub speed_changes: MessageWriter<'w, super::super::SpeedChangeMessage>,
+    /// The two server-authored mover edges the controller both *applies* and *answers*: a
+    /// granted mode (decisions 0308, 0866) and a knockback launch (decision 1702) are the same
+    /// handshake, an edge the server may not act on until our own live pose comes back.
+    pub move_modes: MessageWriter<'w, super::super::MoveModeMessage>,
+    pub knockbacks: MessageWriter<'w, super::super::KnockBackMessage>,
+    /// The login screen's dialog + reconnect-policy feed (decision 0539).
+    pub login_stages: MessageWriter<'w, super::super::LoginStageMessage>,
+    /// The login queue's position feed (decision 1681).
+    pub login_queued: MessageWriter<'w, super::super::LoginQueuedMessage>,
+    pub login_failures: MessageWriter<'w, super::super::LoginFailedMessage>,
+    pub disconnects: MessageWriter<'w, super::super::DisconnectedMessage>,
+    /// The server's own answer to a GM dot-command, readable rather than only logged — the probe
+    /// shield's confirmation channel (decision 0677).
+    pub server_said: MessageWriter<'w, super::super::ServerSaidMessage>,
+    /// A `MSG_MOVE_*` the server addressed to OUR mover (decision 0725): a pose it wrote, with no
+    /// handshake — the controller applies it in `player::wire_in`.
+    pub self_moves: MessageWriter<'w, super::super::SelfMoveMessage>,
+    /// The possession handoff (`SMSG_CLIENT_CONTROL_UPDATE`): control of a unit granted or
+    /// revoked. Forwarded verbatim — only the controller knows the pose it would have to park.
+    pub client_control: MessageWriter<'w, super::super::ClientControlMessage>,
+    /// A cinematic to play (`SMSG_TRIGGER_CINEMATIC`) — `crate::cinematic` owns both the playback
+    /// and the ack that has to answer it (decision 0196).
+    pub cinematics: MessageWriter<'w, super::super::CinematicTriggeredMessage>,
+    /// The far-teleport latch (decision 0455): `SMSG_TRANSFER_PENDING`'s transport block routes
+    /// `NEW_WORLD`'s coordinates; cleared on disconnect.
+    pub transfer: ResMut<'w, PendingTransfer>,
+}
+
+/// The windows' parked state: the ask-once caches and every `*Open`/`*State`/`*Session` a
+/// `feed_*` pushes into the VM later (decision 0081). Where 195 of the 273 arms land.
+#[derive(SystemParam)]
+pub(crate) struct WindowStores<'w> {
+    pub names: ResMut<'w, crate::names::NameCache>,
+    pub items: ResMut<'w, crate::items::Items>,
+    pub gossip: ResMut<'w, crate::ui_gossip::GossipState>,
+    pub merchant: ResMut<'w, crate::ui_merchant::MerchantOpen>,
+    /// The two gossip-reached NPC service sessions whose state is a whole open window.
+    pub trainer_open: ResMut<'w, crate::ui_trainer::TrainerOpen>,
+    pub stable_open: ResMut<'w, crate::ui_stable::StableOpen>,
+    /// The loot window state, the client-local loot-target latch (the kneel's self trigger,
+    /// decision 0515), and the open group-loot rolls (decision 0591).
+    pub loot: ResMut<'w, crate::ui_loot::LootState>,
+    pub loot_latch: ResMut<'w, crate::ui_loot::LootLatch>,
+    pub loot_rolls: ResMut<'w, crate::ui_loot_roll::LootRolls>,
+    pub chat_log: ResMut<'w, crate::ui_chat::ChatLog>,
+    pub quest: ResMut<'w, crate::ui_quest::QuestGiver>,
+    /// The quest-log template cache, and the party quest-share state (decision 1733) — the
+    /// verdicts on a quest we pushed and the escort confirm: a share is a quest-log verb.
+    pub quest_log: ResMut<'w, crate::ui_quest_log::QuestLog>,
+    pub quest_share: ResMut<'w, crate::ui_quest_share::QuestShare>,
+    pub go_templates: ResMut<'w, crate::go_templates::GameObjectTemplates>,
+    pub home_bind: ResMut<'w, crate::net::HomeBind>,
+    pub proficiencies: ResMut<'w, crate::net::Proficiencies>,
+    pub dropped: ResMut<'w, crate::net::DroppedOpcodes>,
+    /// The death arc's wire-fed store (decision 0308): reclaim expiry, corpse location, resurrect
+    /// offer, the spirit-healer confirm.
+    pub death_net: ResMut<'w, crate::death::DeathNet>,
+    /// The party/raid roster mirror + its composed system lines (decision 0434).
+    pub group: ResMut<'w, crate::ui_party::GroupState>,
+    /// The taxi-map session (decision 0484 phase 1).
+    pub taxi: ResMut<'w, crate::ui_taxi::TaxiState>,
+    /// The mailbox session + its login-scoped arrival countdown (decision 0544).
+    pub mail_open: ResMut<'w, crate::ui_mail::MailOpen>,
+    pub mail_pending: ResMut<'w, crate::ui_mail::MailPending>,
+    /// The player-trade session (decision 0592).
+    pub trade_session: ResMut<'w, crate::ui_trade::TradeSession>,
+    /// The bank session and its purchase-refusal queue (decision 0604).
+    pub bank_open: ResMut<'w, crate::ui_bank::BankOpen>,
+    pub bank_errors: ResMut<'w, crate::ui_bank::BankErrors>,
+    /// The world-state table the NPC-text `$<n>w` tokens read.
+    pub world_states: ResMut<'w, crate::world_state::WorldStates>,
+    /// The duel session (decision 0633).
+    pub duel: ResMut<'w, crate::ui_duel::DuelState>,
+    pub social: ResMut<'w, crate::ui_social::SocialState>,
+    /// The pending logout/quit (decision 0674): the server's response and cancel-ack land here,
+    /// and `crate::ui_logout` turns them into the countdown dialog.
+    pub logout: ResMut<'w, crate::ui_logout::LogoutState>,
+    /// The mirror-timer queue (decision 0874): the breath/fatigue START/PAUSE/STOP edges, drained
+    /// into the FrameXML bars by `crate::ui_mirror`.
+    pub mirror_timers: ResMut<'w, crate::ui_mirror::MirrorTimerFeed>,
+    /// The pet action bar's server-authoritative state + its own cooldown store (decision 0982),
+    /// replaced wholesale on every `SMSG_PET_SPELLS`.
+    pub pet_bar: ResMut<'w, crate::ui_pet::PetBar>,
+    /// The by-key red error queue the pet bar's refused-order feedback rides (the `DisplayError`
+    /// route, resolved through the VM's own GlobalStrings by `ui_action::feed_actions`).
+    pub ui_error_keys: ResMut<'w, crate::ui_action::UiErrorKeys>,
+    /// The ask-once book-page cache (decision 1105) — every readable's text, keyed by `PageText`
+    /// id; the reader session repaints off it.
+    pub page_texts: ResMut<'w, crate::ui_item_text::PageTexts>,
+    pub played_time_answer: ResMut<'w, crate::net::PlayedTimeAnswer>,
+    /// The guild session (decision 1257) — the identity/roster mirror the seven
+    /// `SessionEvent::Guild*` arms drive.
+    pub guild: ResMut<'w, crate::ui_guild::GuildState>,
+    /// The innkeeper's pending bind question (decision 1331) — `SMSG_BINDER_CONFIRM` parks the
+    /// innkeeper's guid here and `crate::ui_binder` turns it into the CONFIRM_BINDER dialog,
+    /// whose Accept is the only thing that binds anything.
+    pub binder: ResMut<'w, crate::ui_binder::BinderState>,
+    /// The class trainer's pending respec question (decision 1580) — the inbound
+    /// `MSG_TALENT_WIPE_CONFIRM` parks the trainer's guid + cost here and
+    /// `crate::ui_talent_wipe` turns it into the CONFIRM_TALENT_WIPE dialog, whose Accept is the
+    /// only thing that unlearns anything. The binder's twin.
+    pub talent_wipe: ResMut<'w, crate::ui_talent_wipe::TalentWipeState>,
+    /// The dialog engine's verbs (decision 1963): the pet trainer's latch, the instance-boot
+    /// clock, the area spirit healer, the battleground queue and the meeting-stone queue — each
+    /// a feed for a stock dialog.
+    pub pet_unlearn: ResMut<'w, crate::ui_dialog_verbs::PetUnlearnState>,
+    pub instance_boot: ResMut<'w, crate::ui_dialog_verbs::InstanceBoot>,
+    pub area_spirit: ResMut<'w, crate::ui_dialog_verbs::AreaSpiritHealer>,
+    pub battlefield_queue: ResMut<'w, crate::ui_dialog_verbs::BattlefieldQueue>,
+    pub meeting_stone: ResMut<'w, crate::ui_dialog_verbs::MeetingStone>,
+    pub battlefield_scoreboard: ResMut<'w, crate::ui_battlefield_score::BattlefieldScoreboard>,
+    pub battlefield: ResMut<'w, crate::ui_battlefield::Battlefield>,
+    pub tutorials: ResMut<'w, crate::tutorial::Tutorials>,
+    pub battlefield_positions: ResMut<'w, crate::ui_battlefield_positions::BattlefieldPositions>,
+    pub tabard: ResMut<'w, crate::ui_tabard::TabardOpen>,
+    /// The guard's directions marker (`SMSG_GOSSIP_POI`) — the wire carries no map field, so
+    /// "where you were standing when the guard told you" is the client's to remember
+    /// (`crate::poi_marker`).
+    pub poi_marker: ResMut<'w, crate::poi_marker::PoiMarker>,
+    /// The inspect-honor reply (decision 1512) — `MSG_INSPECT_HONOR_STATS` is the only source of
+    /// another player's honor numbers, so the reply parks here and `crate::ui_honor` pushes it
+    /// into the pane and fires `INSPECT_HONOR_UPDATE`.
+    pub inspect_honor: ResMut<'w, crate::ui_honor::InspectHonor>,
+    /// The minimap ping (decision 1596) — a group member's `MSG_MINIMAP_PING` seats the world
+    /// point here and the minimap renderer derives everything else from it.
+    pub ping: ResMut<'w, crate::minimap::MinimapPing>,
+    /// The GM ticket (decision 1673) — `SMSG_GMTICKET_GETTICKET` replaces the held ticket here
+    /// and BUMPS AN ANSWER COUNTER, which is what `crate::ui_gm_ticket` diffs on: the Help window
+    /// re-polls every 10 minutes and an unchanged answer still has to re-fire `UPDATE_TICKET`.
+    pub gm_ticket: ResMut<'w, crate::ui_gm_ticket::GmTicketState>,
+    /// The guild-charter session (decision 1672) — two resources because only the registrar
+    /// half is NPC-bound: `SMSG_PETITION_SHOWLIST` opens the registrar, and
+    /// `SMSG_PETITION_SHOW_SIGNATURES` opens the item-bound charter window, which must survive
+    /// walking away from the registrar.
+    pub registrar: ResMut<'w, crate::ui_petition::GuildRegistrarState>,
+    pub petition: ResMut<'w, crate::ui_petition::PetitionState>,
+    /// The pending summon question (decision 1747) — `SMSG_SUMMON_REQUEST` parks the summoner's
+    /// guid, zone and expiry here and `crate::ui_summon` turns it into the CONFIRM_SUMMON dialog,
+    /// whose Accept is the only packet in the flow.
+    pub summon: ResMut<'w, crate::ui_summon::SummonState>,
+    /// The instance-lockout bookkeeping (decision 1748) — four of its six packets queue a
+    /// GlobalStrings-templated chat line here for `crate::ui_instance` to resolve against the
+    /// VM, and two write the latch behind `CanShowResetInstances()`.
+    pub instances: ResMut<'w, crate::ui_instance::InstanceState>,
+}
+
+/// The action bar's family: the cast/cooldown state and every error queue the red line drains
+/// (decision 0137), plus the item-lock bookkeeping the inventory-failure arm also drives
+/// (decision 0216 §4 / 0218 §3 — the drain has no `UiScript` to fire `ITEM_LOCK_CHANGED`
+/// through, so the transitioned slots queue in `LockTransitions` for the container feed).
+#[derive(SystemParam)]
+pub(crate) struct ActionStores<'w> {
+    pub player_actions: ResMut<'w, crate::ui_action::PlayerActions>,
+    /// The cast + mount error queues, both drained into the red error line by
+    /// `ui_action::feed_actions`.
+    pub cast_errors: ResMut<'w, crate::ui_action::CastErrors>,
+    pub mount_errors: ResMut<'w, crate::ui_action::MountErrors>,
+    /// The `modalNextSpell` chain's outbox (1597) — `cast_result` fills it, the ui_action drain
+    /// sends it through the one cast path.
+    pub chain_casts: ResMut<'w, crate::ui_action::ChainCasts>,
+    /// The taming-refusal queue (decision 2039) — `SMSG_PET_TAME_FAILURE`'s reason byte. Its own
+    /// queue rather than `UiErrorKeys` because its message needs TWO GlobalStrings lookups, and
+    /// the inner one is only reachable at the drain (see the resource's doc).
+    pub pet_tame_failures: ResMut<'w, crate::ui_action::PetTameFailures>,
+    /// Spells learned mid-session, awaiting `LEARNED_SPELL_IN_TAB` (2252). A queue for the same
+    /// reason the reference sorts before it fires: the tab index is only correct against the
+    /// rebuilt tab list, which is the spellbook feed's, not this apply's.
+    pub learned_in_tab: ResMut<'w, crate::ui_spellbook::LearnedInTab>,
+    pub equip_errors: ResMut<'w, crate::ui_items::EquipErrors>,
+    pub merchant_errors: ResMut<'w, crate::ui_merchant::MerchantErrors>,
+    pub cast_bar: ResMut<'w, crate::ui_cast::CastBarFeed>,
+    pub pending_item_ops: ResMut<'w, crate::pending_item_ops::PendingItemOps>,
+    pub lock_transitions: ResMut<'w, crate::pending_item_ops::LockTransitions>,
+    /// The two NPC-service windows' error queues, each drained onto its window's red line by its
+    /// own feed.
+    pub trainer_errors: ResMut<'w, crate::ui_trainer::TrainerErrors>,
+    pub stable_errors: ResMut<'w, crate::ui_stable::StableErrors>,
+    pub pending_cast: ResMut<'w, crate::ui_cast::PendingCast>,
+    /// The player's cooldown store (decision 0137 phase 4); the pet's is in its bar, and
+    /// `addressed_store` picks between them.
+    pub cooldowns: ResMut<'w, crate::cooldowns::Cooldowns>,
+    /// The live auto-repeat state the bar's flash rides (decision 0137 phase 4).
+    pub auto_repeat: ResMut<'w, crate::ui_action::AutoRepeatActive>,
+    /// Our own running channel (the IsCurrentAction channel leg, decision 0137 phase 4).
+    pub active_channel: ResMut<'w, crate::ui_cast::ActiveChannel>,
+    /// Pre-formatted UIErrorsFrame lines — text the wire already resolved, so there is no
+    /// GlobalStrings key to look up: the death durability notice, `SMSG_NOTIFICATION`, and
+    /// `SMSG_AREA_TRIGGER_MESSAGE`. Drained by `ui_action::feed_actions` beside `UiErrorKeys`.
+    pub ui_error_texts: ResMut<'w, crate::ui_action::UiErrorTexts>,
+    /// The queued on-next-swing strike (the melee-slot half of the cast tracking) — the wire
+    /// resolves it here: GO fires it, a failing result/interrupt kills it.
+    pub queued_melee: ResMut<'w, crate::ui_cast::QueuedMeleeSpell>,
+    /// The aura feed's duration side-table (decisions 0255/0257): the self-only
+    /// `SMSG_UPDATE_AURA_DURATION` lands here keyed by raw slot, timestamped on
+    /// [`Clocks::real`] for the `ui_aura` slot-join.
+    pub aura_durations: ResMut<'w, crate::ui_aura::AuraDurations>,
+    /// The two talent spell-modifier tables (`crate::spell_mods`) — one wire packet is one
+    /// absolute cell, and this is its only writer.
+    pub spell_mods: ResMut<'w, crate::spell_mods::SpellModifiers>,
+}
+
+/// Every animation-bearing or audible message the drain emits, in packet order, plus the
+/// PlayAnimation call-order counter they stamp (decisions 0107, 0137 phase 2, 0280).
+#[derive(SystemParam)]
+pub(crate) struct AnimWriters<'w> {
+    pub server_sounds: MessageWriter<'w, ServerSoundMessage>,
+    pub weather: MessageWriter<'w, WeatherMessage>,
+    pub emotes: MessageWriter<'w, EmoteMessage>,
+    pub swings: MessageWriter<'w, crate::creature_anim::SwingMessage>,
+    pub cast_events: MessageWriter<'w, crate::creature_anim::CastEvent>,
+    pub spell_go_targets: MessageWriter<'w, crate::creature_anim::SpellGoTargets>,
+    /// The floating combat-text feed (decision 0137 phase 2).
+    pub combat_text: MessageWriter<'w, crate::combat_text::CombatTextSpawn>,
+    pub swing_impacts: MessageWriter<'w, crate::creature_anim::SwingImpact>,
+    pub swing_flushes: MessageWriter<'w, crate::creature_anim::SwingFlush>,
+    pub go_lid_open: MessageWriter<'w, crate::go_anim::GoLidOpen>,
+    /// The aggro/alert vocal flare + the pushed-kit play (decision 0280).
+    pub ai_reactions: MessageWriter<'w, AiReactionMessage>,
+    pub kit_pushes: MessageWriter<'w, crate::creature_anim::KitPush>,
+    /// The remote landing predictor's report (decision 0415): a relayed FALL_LAND fires the grunt
+    /// + dust puff for an observed mover, the way the self controller does for us.
+    pub hard_landings: MessageWriter<'w, crate::creature_anim::HardLanding>,
+    /// An observed rider's flourish (`SMSG_MOUNTSPECIAL_ANIM`, decision 0441 P2) — the unit →
+    /// mount-child hop happens in `creature_anim::flourish_to_anim`.
+    pub mount_flourishes: MessageWriter<'w, crate::creature_anim::MountFlourish>,
+    /// The UNIT_COMBAT event feed (the portrait hit indicator, decision 0576) + the
+    /// COMBAT_TEXT_UPDATE feed (the center combat text, decision 0578) — the spell arms'
+    /// self-facing twins of the floating-text spawn.
+    pub unit_combat: MessageWriter<'w, crate::ui_unit::UnitCombatFeedback>,
+    pub combat_text_events: MessageWriter<'w, crate::ui_unit::CombatTextEvent>,
+    /// The sheath setter's queue, which the ATTACKERSTATEUPDATE arm's melee auto-draw writes.
+    pub sheath_requests: MessageWriter<'w, crate::creature_anim::SheathRequest>,
+    /// The GO one-shot Custom play (`SMSG_GAMEOBJECT_CUSTOM_ANIM` — the bobber's bite splash,
+    /// decision 1086), the step-8 sibling of `go_lid_open`.
+    pub go_custom_anim: MessageWriter<'w, crate::go_anim::GoCustomAnim>,
+    /// The pet's bark (`SMSG_PET_ACTION_SOUND`, decision 2039) — `ai_reactions`' sibling: both
+    /// are pure audio that resolves a guid and hands the sound layer a state for the SAME
+    /// `0x623a40` dispatcher.
+    pub pet_talk: MessageWriter<'w, PetTalkMessage>,
+    pub pet_dismiss: MessageWriter<'w, PetDismissSoundMessage>,
+    /// The swing-refusal seam's two edges (`crate::swing_refusal`, decision 2037): the four
+    /// `SMSG_ATTACKSWING_*` refusals, and our own landed swing, which clears their latch. ONE
+    /// writer for both so the drain hands them on in packet order.
+    pub swing_refusals: MessageWriter<'w, crate::swing_refusal::SwingRefusalEdge>,
+    /// The PlayAnimation call-order counter (`creature_anim::PlaySeq`): every animation-bearing
+    /// message this drain emits stamps `next()`, in packet order.
+    pub play_seq: ResMut<'w, crate::creature_anim::PlaySeq>,
+}
+
+/// The read-only reference tables the arms resolve against. Each DBC-backed one is `Option`:
+/// absent if its table failed to load, and every reader degrades rather than drops.
+#[derive(SystemParam)]
+pub(crate) struct Catalogs<'w> {
+    /// The FactionTemplate catalog the combat log's friend/foe split reads (B297). Absent, an
+    /// unresolved unit lands on the friendly side of the classifier rather than losing its lines.
+    pub factions: Option<Res<'w, crate::target::ring::Factions>>,
+    /// The Spell.dbc catalog the cooldown/cast wire laws read.
+    pub spells: Option<Res<'w, crate::ui_action::Spells>>,
+    /// The combat-feedback CVars — the eight display ranges, `CombatLogPeriodicSpells`, and the
+    /// three floating-text gates.
+    pub combat_cvars: crate::ui_chat::combat::CombatFeedbackCvars<'w>,
+    /// The EnvironmentalDamage.dbc 6-slot table (damage type → SpellVisualKit) the
+    /// `SMSG_ENVIRONMENTALDAMAGELOG` arm reads — the fall-landing dust puff.
+    pub env_damage: Option<Res<'w, crate::creature_anim::EnvDamageTable>>,
+    /// The shared AreaTable catalog — the exploration arm's area-id → name resolve (decision
+    /// 0828) — and the race-keyed discovery-jingle catalog (decision 0829).
+    pub area_table: Option<Res<'w, crate::area::AreaTableRes>>,
+    pub exploration_sounds: Option<Res<'w, crate::sound::ExplorationSounds>>,
+    /// The map the guard's directions marker is stamped with.
+    pub current_map: Option<Res<'w, benilla_world::world_map::CurrentMap>>,
+    /// Guild Member Alert (decision 1589) — the CVar knob the sign-on/sign-off pair's display
+    /// condition reads; see `ui_guild::apply::event` for the four conjuncts.
+    pub guild_notify: Res<'w, crate::ui_guild::GuildMemberNotify>,
+}
diff --git a/crates/benilla-app/src/net/apply/session.rs b/crates/benilla-app/src/net/apply/session.rs
index 32f3a523..1544b7f6 100644
--- a/crates/benilla-app/src/net/apply/session.rs
+++ b/crates/benilla-app/src/net/apply/session.rs
@@ -112,7 +112,6 @@ pub(super) fn cinematic_triggered(
 
 /// We are in the world (the IO thread's first in-world event): record our guid, flip the status,
 /// and seed the name cache with our own name.
-#[allow(clippy::too_many_arguments)] // the login's whole hand-off
 pub(super) fn connected(
     guid: u64,
     name: String,
@@ -170,7 +169,6 @@ pub(super) fn logged_out(
 
 /// The session ended (socket closed / handshake failure): tear down the streamed world and clear
 /// every session-scoped cache.
-#[allow(clippy::too_many_arguments)]
 pub(super) fn disconnected(
     reason: String,
     end: benilla_protocol::SessionEnd,
@@ -196,7 +194,6 @@ pub(super) fn disconnected(
     mail: &mut MailOpen,
     mail_pending: &mut crate::ui_mail::MailPending,
     trade: &mut crate::ui_trade::TradeSession,
-    auction: &mut crate::ui_auction::AuctionOpen,
     bank: &mut crate::ui_bank::BankOpen,
     duel: &mut crate::ui_duel::DuelState,
     social: &mut crate::ui_social::SocialState,
@@ -265,10 +262,6 @@ pub(super) fn disconnected(
     // The arrival countdown is login-scoped (decision 0544 P3): a fresh login re-queries
     // `MSG_QUERY_NEXT_MAIL_TIME` at world-enter, so nothing carries over across a reconnect.
     *mail_pending = crate::ui_mail::MailPending::default();
-    // An open auction house dies with the socket (decision 1511): every auction command
-    // re-validates the auctioneer server-side, so a session that survived a reconnect would be a
-    // window whose every button silently failed.
-    auction.clear_session();
     // An open trade dies with the socket too (decision 0592) — the reconnect starts with no trade.
     trade.clear_session();
     // The bank window dies with the socket (decision 0604) — a reconnect re-opens via the banker.
@@ -385,7 +378,6 @@ pub(super) fn transfer_aborted(reason: u8, pending: &mut PendingTransfer) {
 /// the seam (the `CurrentMap` flip itself flips which legs render), keeping the ride attachment
 /// and the deck collider valid the whole way; the server's post-ack re-create then refreshes its
 /// anchor in place. Boats whose paths never reach the new map despawn like everything else.
-#[allow(clippy::too_many_arguments)] // one dispatch arm's full context, like `disconnected`
 pub(super) fn worldport(
     map_id: u32,
     position: [f32; 3],
@@ -486,7 +478,9 @@ pub(super) fn reputation_delta(
 ) {
     use benilla_formats::faction_flags as flag;
     for (list_id, standing) in standings {
-        let i = list_id as usize;
+        let Some(i) = reputation_slot(list_id, "SMSG_SET_FACTION_STANDING") else {
+            continue;
+        };
         if reputations.0.len() <= i {
             reputations.0.resize(i + 1, (0, 0));
         }
@@ -508,13 +502,32 @@ pub(super) fn reputation_delta(
 /// silent failure it exists to prevent: the pane keys row membership off this bit, so a faction met
 /// mid-session would keep accruing reputation the player could never see.
 pub(super) fn reputation_visible(list_id: u32, reputations: &mut Reputations) {
-    let i = list_id as usize;
+    let Some(i) = reputation_slot(list_id, "SMSG_SET_FACTION_VISIBLE") else {
+        return;
+    };
     if reputations.0.len() <= i {
         reputations.0.resize(i + 1, (0, 0));
     }
     reputations.0[i].0 |= benilla_formats::faction_flags::VISIBLE;
 }
 
+/// A wire `repListId` as a store index, or `None` (logged) when it is not one. The list is
+/// positional in a `FACTION_LIST_LEN`-entry array (vmangos `MAX_FACTION_COUNT` 64), so a slot
+/// past it is not a faction — and resizing the store to it was the one wire value that could
+/// abort the process instead of dropping a packet (`0xFFFF_FFFF` → a 34 GB resize; decision
+/// 2265 §B1).
+fn reputation_slot(list_id: u32, opcode: &str) -> Option<usize> {
+    let i = usize::try_from(list_id).ok()?;
+    if i >= benilla_protocol::messages::FACTION_LIST_LEN {
+        warn!(
+            "net: {opcode} names reputation slot {list_id}, past the {}-entry faction list — dropped",
+            benilla_protocol::messages::FACTION_LIST_LEN
+        );
+        return None;
+    }
+    Some(i)
+}
+
 /// The dropped-packet tally (the wire-coverage instrument): count it, and announce each opcode's
 /// FIRST drop at info — visible in any log without the panel open, and one line per opcode per
 /// run, so it can never flood.
diff --git a/crates/benilla-app/src/net/apply/spells.rs b/crates/benilla-app/src/net/apply/spells.rs
index edec3857..a2a6a15c 100644
--- a/crates/benilla-app/src/net/apply/spells.rs
+++ b/crates/benilla-app/src/net/apply/spells.rs
@@ -181,7 +181,6 @@ pub(super) fn superceded_spell(
 }
 
 /// The server's verdict on our cast (`SMSG_CAST_RESULT`).
-#[allow(clippy::too_many_arguments)]
 pub(super) fn cast_result(
     spell_id: u32,
     success: bool,
@@ -276,6 +275,7 @@ pub(super) fn cast_result(
                     arg,
                     // `SMSG_CAST_FAILED` is addressed to the caster, and this handler is ours.
                     caster: crate::ui_action::Caster::Player,
+                    redisplay: false,
                 });
             }
         }
@@ -335,7 +335,6 @@ pub(super) fn cast_result(
 
 /// A unit began a non-triggered cast (`SMSG_SPELL_START`), instants included (`cast_time_ms == 0`)
 /// — the precast trigger the phase-2 casting animation loop builds on (decision 0099 phase 1).
-#[allow(clippy::too_many_arguments)]
 pub(super) fn spell_start(
     caster: u64,
     spell_id: u32,
@@ -446,7 +445,6 @@ const GO_TYPE_CHEST: i32 = 3;
 /// nothing about missile travel rides this packet; the client (and we) rebuild the flight
 /// visually from the same Speed column (decision 0099 phase 4: the target lists go out as
 /// [`SpellGoTargets`] for the router's instant-impact/missile branch).
-#[allow(clippy::too_many_arguments)] // one dispatch arm's full input set
 pub(super) fn spell_go(
     caster: u64,
     spell_id: u32,
@@ -522,7 +520,7 @@ pub(super) fn spell_go(
     }
     // A cast that names a GameObject (an open-lock cast on a chest / locked door) hands off to the GO
     // animation driver, which gates on the open-lock effect and opens the lid on the cast going off
-    // (decision 0250). Independent of the caster being streamed to us — an observed open still animates.
+    // (decision 2271). Independent of the caster being streamed to us — an observed open still animates.
     if let Some(go_guid) = go_target {
         go_lid.write(crate::go_anim::GoLidOpen { go_guid, spell_id });
     }
@@ -801,7 +799,6 @@ pub(super) fn spell_go(
 
 /// An observed cast was interrupted/cancelled (`SMSG_SPELL_FAILED_OTHER`) — ends the caster's
 /// `Casting` state seam the same as [`spell_go`].
-#[allow(clippy::too_many_arguments)] // one dispatch arm's full input set
 pub(super) fn spell_failed_other(
     caster: u64,
     spell_id: u32,
@@ -1049,6 +1046,23 @@ pub(super) fn aura_duration(
     durations.set(slot, remaining_ms, now_secs);
 }
 
+/// One cell of one talent spell-modifier table (`SMSG_SET_FLAT_SPELL_MODIFIER` /
+/// `SMSG_SET_PCT_SPELL_MODIFIER`) — `HandleSetSpellModifier 0x6e9950`'s whole body, which is a
+/// single store: the server sends the absolute value of that `(family bit, op)` pair, never a
+/// delta, so there is nothing to accumulate and nothing to invalidate.
+///
+/// The out-of-range refusal lives on the store ([`crate::spell_mods::SpellModifiers::set`], which
+/// documents why it is ours and not the reference's).
+pub(super) fn set_spell_modifier(
+    flat: bool,
+    mask_bit: u8,
+    op: u8,
+    value: i32,
+    mods: &mut crate::spell_mods::SpellModifiers,
+) {
+    mods.set(flat, mask_bit, op, value);
+}
+
 /// The caster's chain-target hop array, filled from a wire target list — the reference's
 /// `0x605780` (decision 0955): it **clears before it fills** and **skips any entry equal to the
 /// unit's own guid** (`0x6057bf`/`0x6057c9`). Targets not streamed to us drop out here: an endpoint
@@ -1368,6 +1382,7 @@ mod tests {
             .init_resource::<PendingCast>()
             .init_resource::<QueuedMeleeSpell>()
             .init_resource::<Cooldowns>()
+            .init_resource::<crate::spell_mods::SpellModifiers>()
             .init_resource::<crate::ui_pet::PetBar>()
             .init_resource::<crate::items::Items>();
 
@@ -1475,6 +1490,126 @@ mod tests {
         assert!(matches!(feed[0], CastBarEdge::Stop), "…with a STOP");
     }
 
+    /// **A broken channel flashes green and fades — it never goes red "Interrupted"**, and the
+    /// whole of `Spell::cancel()`'s wire is driven here because the correctness rests on a gate
+    /// that does not mention channels.
+    ///
+    /// vmangos cancels a running channel (moved, turned, target died, `CMSG_CANCEL_CHANNELLING`)
+    /// with **two** packets, in this order (`Spell.cpp` `Spell::cancel`, `SPELL_STATE_CASTING`):
+    ///
+    /// ```text
+    /// SendChannelUpdate(0, true)   -> MSG_CHANNEL_UPDATE(0)      -> SPELLCAST_CHANNEL_STOP
+    /// SendInterrupted(0)           -> SMSG_SPELL_FAILED_OTHER    -> ??? (SendObjectMessageToSet
+    ///                                                                 (…, /*self*/ true))
+    /// ```
+    ///
+    /// The second one **reaches the caster too**, so the obvious reading is that the bar turns red
+    /// a frame after it flashed green. It must not, and three independent things say so:
+    ///
+    /// - vmangos deliberately withholds the *other* interrupt signal —
+    ///   `sendInterrupt = !(m_channeled && m_spellState != SPELL_STATE_PREPARING)` gates
+    ///   `SendCastResult(SPELL_FAILED_INTERRUPTED)` off, with the comment "channeled spells don't
+    ///   display interrupted message even if they are interrupted";
+    /// - the reference's own `SMSG_SPELL_FAILED_OTHER` handler (`0x6e8e40`, opcode `0x2a6`) fires
+    ///   **no FrameScript event at all** — its whole body is `0x60d040` + `0x614150`, the *unit's*
+    ///   cast state, and wow-re's boundary line for it lists no `-> ui` edge;
+    /// - and stock `CastingBarFrame.lua` guards its red arm with `not this.channeling`.
+    ///
+    /// Ours lands on the same behaviour by a **fourth** route, which is the one worth pinning:
+    /// [`spell_failed_other`]'s red edge is keyed to a live `Casting` component, and a channel
+    /// never has one — `Casting` is inserted only for `cast_time_ms > 0`, and `SMSG_SPELL_GO`
+    /// (which always precedes `MSG_CHANNEL_START` in `handle_immediate`) removes it regardless.
+    /// That is correct and it is also invisible: nothing in `spell_failed_other` says "channel",
+    /// so a future change to when `Casting` is armed would turn every broken channel red with no
+    /// test to catch it. This is that test.
+    #[test]
+    fn a_cancelled_channel_never_turns_the_bar_red() {
+        use crate::creature_anim::Casting;
+        use crate::net::{Guid, SelfPlayer};
+        use bevy::ecs::system::RunSystemOnce;
+
+        const BLIZZARD: u32 = 10;
+        let t0 = Instant::now();
+
+        let mut app = App::new();
+        app.add_message::<CastEvent>()
+            .init_resource::<GuidIndex>()
+            .init_resource::<SelfGuid>()
+            .init_resource::<CastBarFeed>()
+            .init_resource::<PendingCast>()
+            .init_resource::<QueuedMeleeSpell>()
+            .init_resource::<ActiveChannel>();
+        let self_e = app.world_mut().spawn((Guid(10), SelfPlayer)).id();
+        app.world_mut()
+            .resource_mut::<GuidIndex>()
+            .0
+            .insert(10, self_e);
+        app.world_mut().resource_mut::<SelfGuid>().0 = Some(10);
+
+        // 1-2. MSG_CHANNEL_START, then the server's own end: MSG_CHANNEL_UPDATE(0).
+        {
+            let world = app.world_mut();
+            let mut feed = world.remove_resource::<CastBarFeed>().unwrap();
+            let mut channel = world.remove_resource::<ActiveChannel>().unwrap();
+            channel_start(BLIZZARD, 8_000, &mut channel, &mut feed);
+            assert_eq!(
+                channel.current(t0 + Duration::from_secs(1)),
+                Some(BLIZZARD),
+                "the mirror is armed while the channel runs"
+            );
+            channel_update(0, &mut channel, &mut feed);
+            assert_eq!(
+                channel.current(t0 + Duration::from_secs(1)),
+                None,
+                "update 0 closes the mirror, so the action button unlights"
+            );
+            world.insert_resource(feed);
+            world.insert_resource(channel);
+        }
+
+        // 3. SendInterrupted(0) — SMSG_SPELL_FAILED_OTHER, addressed to us, for the channel's id.
+        app.world_mut()
+            .run_system_once(
+                move |mut commands: Commands,
+                      index: Res<GuidIndex>,
+                      casting: Query<&Casting>,
+                      mut cast_events: MessageWriter<CastEvent>,
+                      self_guid: Res<SelfGuid>,
+                      mut cast_bar: ResMut<CastBarFeed>,
+                      mut pending: ResMut<PendingCast>,
+                      mut queued_melee: ResMut<QueuedMeleeSpell>| {
+                    spell_failed_other(
+                        10,
+                        BLIZZARD,
+                        &mut commands,
+                        &index,
+                        &casting,
+                        &mut cast_events,
+                        &self_guid,
+                        &mut cast_bar,
+                        &mut pending,
+                        &mut queued_melee,
+                        1,
+                    );
+                },
+            )
+            .unwrap();
+
+        let feed = &app.world().resource::<CastBarFeed>().0;
+        assert!(
+            !feed
+                .iter()
+                .any(|e| matches!(e, CastBarEdge::Interrupted | CastBarEdge::Failed)),
+            "a cancelled channel pushes NO red edge — the bar flashes green and fades"
+        );
+        assert_eq!(feed.len(), 2, "exactly the two channel edges");
+        assert!(matches!(feed[0], CastBarEdge::ChannelStart { .. }));
+        assert!(matches!(
+            feed[1],
+            CastBarEdge::ChannelUpdate { remaining_ms: 0 }
+        ));
+    }
+
     /// **The GO's inline miss word: gold, gated, and only for an INSTANT spell** (decision 2229).
     ///
     /// Phase 2 shipped this emit unconditional and hardcoded white. The §5 closed both halves:
@@ -1540,6 +1675,7 @@ mod tests {
                 .init_resource::<PendingCast>()
                 .init_resource::<QueuedMeleeSpell>()
                 .init_resource::<Cooldowns>()
+                .init_resource::<crate::spell_mods::SpellModifiers>()
                 .init_resource::<crate::ui_pet::PetBar>()
                 .init_resource::<crate::items::Items>();
             let self_e = app
@@ -1708,6 +1844,7 @@ mod tests {
                 .init_resource::<PendingCast>()
                 .init_resource::<QueuedMeleeSpell>()
                 .init_resource::<Cooldowns>()
+                .init_resource::<crate::spell_mods::SpellModifiers>()
                 .init_resource::<crate::ui_pet::PetBar>()
                 .init_resource::<crate::items::Items>();
             let self_e = app
@@ -1842,6 +1979,7 @@ mod tests {
             .init_resource::<PendingCast>()
             .init_resource::<QueuedMeleeSpell>()
             .init_resource::<Cooldowns>()
+            .init_resource::<crate::spell_mods::SpellModifiers>()
             .init_resource::<crate::ui_pet::PetBar>()
             .init_resource::<crate::items::Items>();
 
@@ -1972,6 +2110,7 @@ mod tests {
             .init_resource::<PendingCast>()
             .init_resource::<QueuedMeleeSpell>()
             .init_resource::<Cooldowns>()
+            .init_resource::<crate::spell_mods::SpellModifiers>()
             .init_resource::<AutoRepeatActive>();
 
         let self_e = app
@@ -2253,6 +2392,7 @@ mod tests {
                 .init_resource::<PendingCast>()
                 .init_resource::<QueuedMeleeSpell>()
                 .init_resource::<Cooldowns>()
+                .init_resource::<crate::spell_mods::SpellModifiers>()
                 .init_resource::<crate::ui_pet::PetBar>()
                 .init_resource::<crate::items::Items>();
             let self_e = app
@@ -2442,6 +2582,7 @@ mod tests {
                 .init_resource::<PendingCast>()
                 .init_resource::<QueuedMeleeSpell>()
                 .init_resource::<Cooldowns>()
+                .init_resource::<crate::spell_mods::SpellModifiers>()
                 .init_resource::<AutoRepeatActive>()
                 .init_resource::<crate::ui_action::ChainCasts>();
             let self_e = app.world_mut().spawn((Guid(10), SelfPlayer)).id();
diff --git a/crates/benilla-app/src/net/handlers.rs b/crates/benilla-app/src/net/handlers.rs
new file mode 100644
index 00000000..96b54742
--- /dev/null
+++ b/crates/benilla-app/src/net/handlers.rs
@@ -0,0 +1,329 @@
+//! The inbound **handler table** (decision 2305) — the reference's own shape for the wire's
+//! arrival side, and the cut 2265 §A1 asked for between the net bridge and the game windows.
+//!
+//! The real client keeps an opcode → handler table inside `NetClient` (`+0x74`, 828 slots; 387
+//! registrations by 37 subsystem clusters — wow-re `net.md`) and its dispatcher `0x537aa0` knows
+//! none of them: it looks the opcode up and calls what it finds, **in packet order**, discarding an
+//! unregistered opcode in silence. Here the table is [`NetHandlers`]: a [`SessionEventKind`] →
+//! handlers map that every subsystem fills for itself through [`NetHandlerApp::net_handler`], and
+//! the drain ([`super::apply_net_updates`]) is exclusive over the world so the handlers — ordinary
+//! systems taking `In<SessionEvent>`, registered as one-shots — run one after another in the
+//! order the packets arrived, each seeing what the one before it did.
+//!
+//! **Why not one typed `Message<T>` per family with a reader system each** (2265's sketch): a
+//! reader per family runs *after* the whole drain, so two families' packets interleaved in one
+//! frame are handled family by family, not in packet order — a chat line and a combat-log line
+//! that arrived in one drain would swap. The table keeps the one property 2265 said must survive
+//! any split: one frame, packet order, before anything else runs.
+//!
+//! **The migration.** The dispatch `match` in `apply.rs` still owns every kind no subsystem has
+//! claimed. One drain runs in two halves: the unclaimed events through the match first, in packet
+//! order, then the claimed ones through the table, in packet order — so a window handler always
+//! sees this frame's object updates, whatever the interleaving. A kind is owned by exactly one of
+//! the two, checked on the built app by `every_session_event_kind_has_one_owner`; the one
+//! exception is [`BROADCAST`], a session-end the match still handles and peeled windows also listen
+//! to, which reaches both. When the last family leaves the match, the match, the halves and the
+//! broadcast list go with it.
+
+use std::collections::HashMap;
+
+use benilla_protocol::{SessionEvent, SessionEventKind};
+use bevy::ecs::system::SystemId;
+use bevy::prelude::*;
+
+/// One registered handler: the one-shot system and the name it registers under (for the census).
+type Handler = (SystemId<In<SessionEvent>>, &'static str);
+
+/// The table. Filled at plugin build by every subsystem that answers a packet; read by the drain.
+#[derive(Resource, Default)]
+pub(crate) struct NetHandlers {
+    by_kind: HashMap<SessionEventKind, Vec<Handler>>,
+}
+
+/// The kinds the dispatch match still owns **and** peeled subsystems listen to — a session end,
+/// which every window that dies with the socket answers for itself. Cloned to the table after the
+/// match has run. Empty once the session family itself is peeled.
+pub(crate) const BROADCAST: &[SessionEventKind] = &[SessionEventKind::Disconnected];
+
+impl NetHandlers {
+    /// Is there at least one handler for this kind?
+    pub(crate) fn handles(&self, kind: SessionEventKind) -> bool {
+        self.by_kind.contains_key(&kind)
+    }
+
+    /// Every kind with a handler, with the handlers' names in registration order — the owner
+    /// test's view of the table.
+    #[cfg(test)]
+    pub(crate) fn census(&self) -> std::collections::BTreeMap<SessionEventKind, Vec<&'static str>> {
+        self.by_kind
+            .iter()
+            .map(|(k, v)| (*k, v.iter().map(|(_, n)| *n).collect()))
+            .collect()
+    }
+
+    fn push(&mut self, kind: SessionEventKind, handler: Handler) {
+        self.by_kind.entry(kind).or_default().push(handler);
+    }
+
+    /// Run every handler registered for the event's kind, in registration order, each with the
+    /// event (cloned for all but the last).
+    fn run(&self, world: &mut World, ev: SessionEvent) {
+        let Some(list) = self.by_kind.get(&SessionEventKind::from(&ev)) else {
+            return;
+        };
+        let Some(((last_id, last_name), rest)) = list.split_last() else {
+            return;
+        };
+        for (id, name) in rest {
+            call(world, *id, name, ev.clone());
+        }
+        call(world, *last_id, last_name, ev);
+    }
+}
+
+fn call(world: &mut World, id: SystemId<In<SessionEvent>>, name: &str, ev: SessionEvent) {
+    if let Err(e) = world.run_system_with(id, ev) {
+        // A registered handler that cannot run is a bug in the registering plugin (a missing
+        // resource, most likely), never the wire's fault — loud, so the smoke gate sees it.
+        error!("net: handler `{name}` did not run: {e}");
+    }
+}
+
+/// Registering a packet handler from a plugin: `app.net_handler(SessionEventKind::X, on_x)`,
+/// where `on_x` is an ordinary system taking `In<SessionEvent>` and whatever it needs. Several
+/// handlers may answer one kind; they run in registration order.
+pub(crate) trait NetHandlerApp {
+    fn net_handler<M>(
+        &mut self,
+        kind: SessionEventKind,
+        handler: impl IntoSystem<In<SessionEvent>, (), M> + 'static,
+    ) -> &mut Self;
+}
+
+impl NetHandlerApp for App {
+    fn net_handler<M>(
+        &mut self,
+        kind: SessionEventKind,
+        handler: impl IntoSystem<In<SessionEvent>, (), M> + 'static,
+    ) -> &mut Self {
+        let name = std::any::type_name_of_val(&handler);
+        let id = self.world_mut().register_system(handler);
+        self.world_mut()
+            .get_resource_or_init::<NetHandlers>()
+            .push(kind, (id, name));
+        self
+    }
+}
+
+/// One drain's dispatch: the events the table does not own go through `unclaimed` first — the
+/// dispatch match, in packet order — then the owned ones run through the table, in packet order.
+/// A [`BROADCAST`] kind reaches both.
+pub(crate) fn dispatch(
+    world: &mut World,
+    events: Vec<SessionEvent>,
+    unclaimed: impl FnOnce(&mut World, Vec<SessionEvent>),
+) {
+    let handlers = world.remove_resource::<NetHandlers>().unwrap_or_default();
+    let mut to_match = Vec::with_capacity(events.len());
+    let mut to_table = Vec::new();
+    for ev in events {
+        let kind = SessionEventKind::from(&ev);
+        if !handlers.handles(kind) {
+            to_match.push(ev);
+        } else if BROADCAST.contains(&kind) {
+            to_table.push(ev.clone());
+            to_match.push(ev);
+        } else {
+            to_table.push(ev);
+        }
+    }
+    unclaimed(world, to_match);
+    for ev in to_table {
+        handlers.run(world, ev);
+    }
+    world.insert_resource(handlers);
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    /// What ran, in order — a handler's name and the event it saw.
+    #[derive(Resource, Default)]
+    struct Log(Vec<String>);
+
+    fn on_queued(In(ev): In<SessionEvent>, mut log: ResMut<Log>) {
+        let SessionEvent::LoginQueued { position, .. } = ev else {
+            panic!("the table routes by kind");
+        };
+        log.0.push(format!("queued:{}", position.unwrap_or(0)));
+    }
+
+    fn on_logged_out(In(ev): In<SessionEvent>, mut log: ResMut<Log>) {
+        assert!(matches!(ev, SessionEvent::LoggedOut));
+        log.0.push("logged_out".into());
+    }
+
+    fn on_logged_out_too(In(_): In<SessionEvent>, mut log: ResMut<Log>) {
+        log.0.push("logged_out_too".into());
+    }
+
+    fn on_disconnected(In(ev): In<SessionEvent>, mut log: ResMut<Log>) {
+        let SessionEvent::Disconnected { reason, .. } = ev else {
+            panic!("the table routes by kind");
+        };
+        log.0.push(format!("disconnected:{reason}"));
+    }
+
+    fn app() -> App {
+        let mut app = App::new();
+        app.add_plugins(MinimalPlugins).init_resource::<Log>();
+        app
+    }
+
+    fn queued(position: u32) -> SessionEvent {
+        SessionEvent::LoginQueued {
+            position: Some(position),
+            realm: None,
+        }
+    }
+
+    fn run(app: &mut App, events: Vec<SessionEvent>) -> Vec<String> {
+        dispatch(app.world_mut(), events, |world, unclaimed| {
+            let mut log = world.resource_mut::<Log>();
+            for ev in unclaimed {
+                log.0
+                    .push(format!("match:{:?}", SessionEventKind::from(&ev)));
+            }
+        });
+        std::mem::take(&mut app.world_mut().resource_mut::<Log>().0)
+    }
+
+    #[test]
+    fn owned_kinds_run_in_packet_order_after_the_match_has_run_the_rest() {
+        let mut app = app();
+        app.net_handler(SessionEventKind::LoginQueued, on_queued)
+            .net_handler(SessionEventKind::LoggedOut, on_logged_out);
+        let log = run(
+            &mut app,
+            vec![
+                queued(1),
+                SessionEvent::LoginStage {
+                    stage: benilla_protocol::LoginStage::Connecting,
+                },
+                SessionEvent::LoggedOut,
+                queued(2),
+            ],
+        );
+        assert_eq!(
+            log,
+            vec!["match:LoginStage", "queued:1", "logged_out", "queued:2"]
+        );
+    }
+
+    #[test]
+    fn several_handlers_on_one_kind_run_in_registration_order_each_with_the_event() {
+        let mut app = app();
+        app.net_handler(SessionEventKind::LoggedOut, on_logged_out)
+            .net_handler(SessionEventKind::LoggedOut, on_logged_out_too);
+        let log = run(&mut app, vec![SessionEvent::LoggedOut]);
+        assert_eq!(log, vec!["logged_out", "logged_out_too"]);
+        assert_eq!(
+            app.world().resource::<NetHandlers>().census()[&SessionEventKind::LoggedOut].len(),
+            2
+        );
+    }
+
+    #[test]
+    fn a_broadcast_kind_reaches_the_match_and_the_table() {
+        let mut app = app();
+        app.net_handler(SessionEventKind::Disconnected, on_disconnected);
+        let log = run(
+            &mut app,
+            vec![SessionEvent::Disconnected {
+                reason: "socket".into(),
+                end: benilla_protocol::SessionEnd::Lost,
+            }],
+        );
+        assert_eq!(log, vec!["match:Disconnected", "disconnected:socket"]);
+    }
+
+    #[test]
+    fn with_no_table_at_all_everything_goes_to_the_match() {
+        let mut app = app();
+        let log = run(&mut app, vec![SessionEvent::LoggedOut, queued(0)]);
+        assert_eq!(log, vec!["match:LoggedOut", "match:LoginQueued"]);
+        assert!(app.world().resource::<NetHandlers>().census().is_empty());
+    }
+
+    /// **Every kind has exactly one owner** — the dispatch match in `net/apply.rs` or the table,
+    /// read off the built client — and the [`BROADCAST`] rows are the only kinds in both. A kind
+    /// neither owns is a packet the client decodes and then drops on the floor.
+    #[test]
+    fn every_session_event_kind_has_one_owner() {
+        use std::collections::BTreeSet;
+        let source = std::fs::read_to_string(
+            std::path::Path::new(env!("CARGO_MANIFEST_DIR")).join("src/net/apply.rs"),
+        )
+        .expect("the drain's source");
+        let stripped = regex_lite_strip_comments(&source);
+        let by_name: HashMap<String, SessionEventKind> = SessionEventKind::all()
+            .map(|k| (format!("{k:?}"), k))
+            .collect();
+        let mut in_match: BTreeSet<SessionEventKind> = BTreeSet::new();
+        for token in stripped.split("SessionEvent::").skip(1) {
+            let name: String = token
+                .chars()
+                .take_while(|c| c.is_ascii_alphanumeric() || *c == '_')
+                .collect();
+            if let Some(k) = by_name.get(&name) {
+                in_match.insert(*k);
+            }
+        }
+        let mut app = crate::game_plugins::schedule_tests::headless_client();
+        let table = app.world_mut().resource::<NetHandlers>().census();
+        let in_table: BTreeSet<SessionEventKind> = table.keys().copied().collect();
+        let mut problems = Vec::new();
+        for kind in SessionEventKind::all() {
+            let m = in_match.contains(&kind);
+            let t = in_table.contains(&kind);
+            let b = BROADCAST.contains(&kind);
+            match (m, t, b) {
+                (true, true, true) | (true, false, false) | (false, true, false) => {}
+                (true, true, false) => problems.push(format!(
+                    "{kind:?}: owned by the match AND handled by {:?} — a peeled kind leaves the match (or is a BROADCAST row)",
+                    table[&kind]
+                )),
+                (true, false, true) => problems.push(format!(
+                    "{kind:?}: a BROADCAST row nobody listens to — drop the row"
+                )),
+                (false, true, true) => problems.push(format!(
+                    "{kind:?}: a BROADCAST row the match no longer owns — drop the row"
+                )),
+                (false, false, _) => problems.push(format!(
+                    "{kind:?}: decoded and dropped — no arm in the match, no handler in the table"
+                )),
+            }
+        }
+        eprintln!(
+            "session event kinds: {} — {} in the dispatch match, {} in the handler table ({} handlers), {} broadcast",
+            SessionEventKind::all().count(),
+            in_match.len(),
+            in_table.len(),
+            table.values().map(Vec::len).sum::<usize>(),
+            BROADCAST.len()
+        );
+        assert!(problems.is_empty(), "{}", problems.join("\n"));
+    }
+
+    /// `//` comments out, so a variant named in prose does not count as an arm.
+    fn regex_lite_strip_comments(s: &str) -> String {
+        s.lines()
+            .map(|l| match l.find("//") {
+                Some(i) => &l[..i],
+                None => l,
+            })
+            .collect::<Vec<_>>()
+            .join("\n")
+    }
+}
diff --git a/crates/benilla-app/src/net/io.rs b/crates/benilla-app/src/net/io.rs
index f65f2f0e..41baf964 100644
--- a/crates/benilla-app/src/net/io.rs
+++ b/crates/benilla-app/src/net/io.rs
@@ -34,6 +34,7 @@ use std::thread;
 use std::time::{Duration, Instant};
 
 use anyhow::{anyhow, bail, Result};
+use benilla_assets::LockRecover;
 use benilla_protocol::{
     host_port, messages, AuthReject, CharAction, LoginStage, Poll, SessionEnd, SessionEvent,
     WardenRequired, WorldSession, WorldWriter, WORLD_PORT,
@@ -341,6 +342,11 @@ pub(super) fn spawn_net(cfg: NetConfig, connect: bool) -> NetHandles {
                     realm_rx,
                     pick_rx,
                 };
+                // Opcodes whose decoder has already been caught leaving bytes behind — one
+                // announcement per opcode for the life of the process, like the dropped-packet
+                // tally's first-occurrence line. Lives here, above the cycle loop, so a reconnect
+                // does not re-announce what the log already says.
+                let mut tails_announced = std::collections::HashSet::new();
                 loop {
                     // **A cycle starts with no measurements.** Every way the last one ended — a
                     // stream failure, a logout, a re-park — lands here, so one clear covers them
@@ -348,8 +354,16 @@ pub(super) fn spawn_net(cfg: NetConfig, connect: bool) -> NetHandles {
                     // in from the app's drain a frame later. (`writer_loop` clears again when the
                     // fresh writer arrives, and still has to: between the old socket dying and
                     // that handover the keepalive tick can still fire on the stale writer.)
-                    read_clock.lock().expect("ping clock").clear();
-                    match run(&cfg, &events_tx, &writer_tx, &parks, &abandon, &read_clock) {
+                    read_clock.lock_recover().clear();
+                    match run(
+                        &cfg,
+                        &events_tx,
+                        &writer_tx,
+                        &parks,
+                        &abandon,
+                        &read_clock,
+                        &mut tails_announced,
+                    ) {
                         Ok(Cycle::Exit) => return,
                         Ok(Cycle::Repark) => {}
                         Ok(end @ (Cycle::LoggedOut | Cycle::LoginRefused)) => {
@@ -422,6 +436,7 @@ fn run(
     parks: &Parks,
     abandon: &AtomicU64,
     ping_clock: &Mutex<PingClock>,
+    tails_announced: &mut std::collections::HashSet<u16>,
 ) -> Result<Cycle> {
     let Parks {
         login_rx,
@@ -849,8 +864,25 @@ fn run(
             let polled = reader.poll()?;
             note_inbound(); // one packet off the wire, parsed or not — the census counts liveness
             match polled {
-                Poll::Events { opcode, events } => {
+                Poll::Events {
+                    opcode,
+                    events,
+                    tail,
+                } => {
                     skip_run = 0;
+                    // **The decode-length instrument** (decision 2265 §B1). A body is
+                    // length-framed, so a decoder shorter than the server's layout succeeds
+                    // silently and the field it never read is invisible from outside. This is
+                    // the one line that shows it — once per opcode, at info, and NEVER a skip:
+                    // the packet decoded and its events are real; a trailing field we have no
+                    // use for is drift to look at, not a packet to drop.
+                    if tail > 0 && tails_announced.insert(opcode) {
+                        bevy::log::info!(
+                            "net: opcode {} ({opcode:#06x}) left {tail} trailing byte(s) after \
+                             decode (first occurrence; announced once per opcode)",
+                            benilla_protocol::messages::opcode_name(opcode).unwrap_or("?"),
+                        );
+                    }
                     // The full inbound opcode stream (tag `in`, decision 0624) — the last place a
                     // packet could hide. `skip` covers what failed to parse and `rly` covers what
                     // reached the mover replay; between them sits the packet that parsed into *no*
@@ -876,9 +908,7 @@ fn run(
                         // a whole client frame to every reading, which is a frame's worth of the
                         // client's own slowness reported as the server's distance.
                         if let SessionEvent::Pong { sequence } = ev {
-                            if let Some(rtt) =
-                                ping_clock.lock().expect("ping clock").record_pong(sequence)
-                            {
+                            if let Some(rtt) = ping_clock.lock_recover().record_pong(sequence) {
                                 bevy::log::debug!("net: pong seq={sequence} rtt={rtt}ms");
                             }
                             continue;
@@ -1018,7 +1048,7 @@ fn writer_loop(
                     // A fresh connection restarts the keepalive from scratch, like the real
                     // client: sequence 1 is the new socket's first ping, and a stale in-flight
                     // pong from the old socket can no longer match.
-                    ping_clock.lock().expect("ping clock").clear();
+                    ping_clock.lock_recover().clear();
                     // The connect stamp: the first keepalive of a connection is a full interval
                     // out, not on the next drain (`0x537bcf` — verified; the alternative reading,
                     // that a zeroed stamp fires one immediately, is what the bytes ruled out).
@@ -1042,7 +1072,7 @@ fn writer_loop(
                     // spacing is our attempts on the socket, not the server's answers.
                     ping_tick = crossbeam_channel::after(PING_INTERVAL);
                     let (sequence, last_rtt) = {
-                        let mut c = ping_clock.lock().expect("ping clock");
+                        let mut c = ping_clock.lock_recover();
                         c.sequence += 1;
                         c.sent_at = Some(Instant::now());
                         // `lastRtt`: the most recent single sample, never the mean (VERIFIED —
@@ -1356,6 +1386,9 @@ fn writer_loop(
                     ClientCommand::AreaSpiritHealerQueue { healer } => {
                         w.area_spirit_healer_queue(healer)
                     }
+                    ClientCommand::AreaSpiritHealerQuery { healer } => {
+                        w.area_spirit_healer_query(healer)
+                    }
                     ClientCommand::BattlefieldPort { map_id, accept } => {
                         w.battlefield_port(map_id, accept)
                     }
@@ -1363,6 +1396,7 @@ fn writer_loop(
                         w.request_battlefield_score_data()
                     }
                     ClientCommand::LeaveBattlefield { map_id } => w.leave_battlefield(map_id),
+                    ClientCommand::MeetingStoneJoin { go_guid } => w.meeting_stone_join(go_guid),
                     ClientCommand::MeetingStoneLeave => w.meeting_stone_leave(),
                     ClientCommand::MeetingStoneStatusQuery => w.meeting_stone_status_query(),
                     ClientCommand::TutorialFlag { id } => w.tutorial_flag(id),
diff --git a/crates/benilla-app/src/net/motion/facing.rs b/crates/benilla-app/src/net/motion/facing.rs
index 043f4f9d..44ffa0ed 100644
--- a/crates/benilla-app/src/net/motion/facing.rs
+++ b/crates/benilla-app/src/net/motion/facing.rs
@@ -227,7 +227,7 @@ fn filter_step(cur: f32, goal: f32, hist: &mut [f32; 4]) -> f32 {
 /// `pub(crate)` rather than `pub(in crate::net)` for one reason: the shuffle latch's *consumer*
 /// lives in `creature_anim`, and the only test that can catch the latch being produced but never
 /// read has to run both systems in one app (`creature_anim::driver::tests`).
-#[allow(clippy::type_complexity, clippy::too_many_arguments)] // one Bevy system's full input set
+#[allow(clippy::type_complexity)] // one Bevy system's full input set
 pub(crate) fn drive_display_facing(
     mut commands: Commands,
     index: Res<GuidIndex>,
diff --git a/crates/benilla-app/src/net/motion/remote.rs b/crates/benilla-app/src/net/motion/remote.rs
index 64f9bdaa..13f1afa9 100644
--- a/crates/benilla-app/src/net/motion/remote.rs
+++ b/crates/benilla-app/src/net/motion/remote.rs
@@ -492,7 +492,6 @@ pub(in crate::net) fn drain_pending_moves(
 /// ([`drain_pending_moves`]); a dead-reckon that advanced on a different (virtual, clamped) clock
 /// than the fire-times it converges toward would never land on them.
 #[allow(clippy::type_complexity)]
-#[allow(clippy::too_many_arguments)] // a Bevy system signature: one param per resource/query
 pub(in crate::net) fn extrapolate_remote_units(
     time: Res<Time<Real>>,
     mut commands: Commands,
diff --git a/crates/benilla-app/src/net/motion/spline.rs b/crates/benilla-app/src/net/motion/spline.rs
index 2671438b..26574270 100644
--- a/crates/benilla-app/src/net/motion/spline.rs
+++ b/crates/benilla-app/src/net/motion/spline.rs
@@ -245,7 +245,6 @@ fn catmull_rom(pts: &[[f32; 3]], i: usize, u: f32) -> ([f32; 3], [f32; 3]) {
 /// takes the Catmull-Rom family instead (the taxi/flight look — see [`Spline::sample`]'s INTERIM note).
 /// Returns `None` — "stationary, clear any path" — for a `Stop`, a zero duration, or a path with fewer
 /// than two points (nothing to travel along).
-#[allow(clippy::too_many_arguments)] // one argument per decoded wire field
 pub(in crate::net) fn monster_move_spline(
     path: Vec<[f32; 3]>,
     spline_id: u32,
diff --git a/crates/benilla-app/src/npc_text.rs b/crates/benilla-app/src/npc_text.rs
index 92a141cd..e81bb3f0 100644
--- a/crates/benilla-app/src/npc_text.rs
+++ b/crates/benilla-app/src/npc_text.rs
@@ -209,7 +209,7 @@ fn trim_spaces(arm: &[char]) -> &[char] {
 /// re-substitutes when that happens.
 pub(crate) fn player_identity(
     self_q: &Query<(&ObjectStore, &Guid), With<SelfPlayer>>,
-    names: &mut NameCache,
+    names: &NameCache,
     commands: &NetCommands,
 ) -> Option<Subject> {
     let (store, guid) = self_q.iter().next()?;
@@ -233,7 +233,7 @@ pub(crate) fn subject_for_guid(
     guid: u64,
     index: &GuidIndex,
     stores: &Query<&ObjectStore>,
-    names: &mut NameCache,
+    names: &NameCache,
     commands: &NetCommands,
 ) -> Option<Subject> {
     if guid == 0 {
diff --git a/crates/benilla-app/src/perf/gpu.rs b/crates/benilla-app/src/perf/gpu.rs
index 25c8a13f..1dc3f5a2 100644
--- a/crates/benilla-app/src/perf/gpu.rs
+++ b/crates/benilla-app/src/perf/gpu.rs
@@ -102,7 +102,7 @@ fn census(instance: Res<bevy::render::renderer::RenderInstance>, shared: Res<Wgp
 /// multi-draw indirect, so a multidrawable batch set still draws bin by bin) plus one per
 /// unbatchable entity and per non-mesh item; a sorted phase issues one per item whose batch
 /// range survived batching (a merged item's range is emptied into its predecessor's).
-#[allow(clippy::type_complexity, clippy::too_many_arguments)]
+#[allow(clippy::type_complexity)]
 fn count_draws(
     shared: Res<WgpuCensusShared>,
     opaque: Option<Res<ViewBinnedRenderPhases<Opaque3d>>>,
diff --git a/crates/benilla-app/src/perf/journal.rs b/crates/benilla-app/src/perf/journal.rs
index 206ce403..8763453e 100644
--- a/crates/benilla-app/src/perf/journal.rs
+++ b/crates/benilla-app/src/perf/journal.rs
@@ -64,6 +64,15 @@ const JOURNAL_HEADER: &str = "t,x,y,z,mean_ms,p95_ms,streamed,entities,cpu_ms,ma
                               gpu_ms,gpu_opaque,gpu_static,gpu_transp,gpu_glow,gpu_post,gpu_ui,\
                               gpu_other\n";
 
+/// The FPS journal switch's change callback (2008, 2303): a flag, the client's int-parse +
+/// `!= 0`. The journal system reads the knob every frame, so the file opens on the next second
+/// and closes the second it is turned off.
+pub(crate) fn on_cvar(ev: On<crate::cvars::CvarChanged>, mut journal: ResMut<FpsJournalSetting>) {
+    if ev.is("fpsJournal") {
+        journal.0 = ev.flag();
+    }
+}
+
 impl Plugin for FpsJournalPlugin {
     fn build(&self, app: &mut App) {
         // bevy's per-pass render diagnostics — the source of the GPU columns, and (under the
@@ -72,6 +81,7 @@ impl Plugin for FpsJournalPlugin {
         // journal is exactly the build that has to carry it (2008).
         app.add_plugins(RenderDiagnosticsPlugin)
             .init_resource::<FpsJournalSetting>()
+            .add_observer(on_cvar)
             .insert_resource(FpsJournal {
                 env_path: std::env::var("WOW_FPS_JOURNAL")
                     .ok()
@@ -314,7 +324,6 @@ struct JournalGpu<'w> {
 /// `NonSendMarker` pins this to the main thread, which the `main_ms` column requires:
 /// [`main_thread_cpu_secs`] reports *the calling thread*, so on a worker it would silently log
 /// whichever pool thread ran the flush.
-#[allow(clippy::too_many_arguments)]
 fn journal_fps(
     _pin_to_main_thread: bevy::ecs::system::NonSendMarker,
     mut journal: ResMut<FpsJournal>,
diff --git a/crates/benilla-app/src/perf/mod.rs b/crates/benilla-app/src/perf/mod.rs
index 5d63ce8c..7b198905 100644
--- a/crates/benilla-app/src/perf/mod.rs
+++ b/crates/benilla-app/src/perf/mod.rs
@@ -82,7 +82,9 @@ pub(crate) use clock::{process_cpu_secs, process_faults, system_cpu_ticks, threa
 pub(crate) use gpu::{GpuMsShared, WgpuCensusShared};
 #[cfg(feature = "dev")]
 pub(crate) use hud::PerfHud;
-pub(crate) use journal::{FpsJournalPlugin, FpsJournalSetting};
+pub(crate) use journal::FpsJournalPlugin;
+#[cfg(test)]
+pub(crate) use journal::{on_cvar, FpsJournalSetting};
 #[cfg(feature = "dev")]
 pub(crate) use main_split::MainThreadSplit;
 
diff --git a/crates/benilla-app/src/perf/stall.rs b/crates/benilla-app/src/perf/stall.rs
index e27e118f..aeb6cac5 100644
--- a/crates/benilla-app/src/perf/stall.rs
+++ b/crates/benilla-app/src/perf/stall.rs
@@ -135,6 +135,10 @@ fn arm_injectors(app: &mut App) {
             app.insert_resource(TeardownWedge(ms));
         }
     }
+    // The third injector lives with the instrument it exercises — `crash::arm_injector`, a
+    // deliberate main-thread panic — and is armed from here so all three standing injectors
+    // are named in one place.
+    crate::crash::arm_injector(app);
 }
 
 fn watchdog(dir: Option<std::path::PathBuf>) {
diff --git a/crates/benilla-app/src/perf/trace.rs b/crates/benilla-app/src/perf/trace.rs
index 01f1d573..7d16a7fd 100644
--- a/crates/benilla-app/src/perf/trace.rs
+++ b/crates/benilla-app/src/perf/trace.rs
@@ -39,7 +39,6 @@ const STREAM_TRACE_HEADER: &str = "frame,t,delta_ms,cpu_ms,ents,stream_ms,furnis
                                    attached,adt_freed,meshes_freed,images_freed,adt_added,\
                                    meshes_added,images_added,pipes_new,pipes_pending\n";
 
-#[allow(clippy::too_many_arguments)]
 pub(super) fn trace_stream(
     mut trace: ResMut<StreamTrace>,
     mut activity: ResMut<benilla_world::terrain_stream::StreamActivity>,
diff --git a/crates/benilla-app/src/pipe_warm/menagerie.rs b/crates/benilla-app/src/pipe_warm/menagerie.rs
index e3353dbe..079ee8ed 100644
--- a/crates/benilla-app/src/pipe_warm/menagerie.rs
+++ b/crates/benilla-app/src/pipe_warm/menagerie.rs
@@ -60,6 +60,9 @@ pub(super) struct WarmLanes<'w> {
     /// The image store (0958): the twin booth's render target and the effect-lane warm's
     /// stand-in texture are created here for the life of the pass.
     pub(super) images: ResMut<'w, Assets<Image>>,
+    /// The UI quad store (2262): the minimap interior composite's tile material is built here
+    /// through its own production builder, for the tile-quad warm rig below.
+    ui_quads: ResMut<'w, Assets<crate::ui_pass::UiQuadMaterial>>,
 }
 
 /// One portrait/paperdoll booth camera + its layer ([`crate::portrait`], 0938): the booths run
@@ -89,12 +92,12 @@ pub(super) type BoothCamQuery<'w, 's> = Query<
 /// variant encoding can never drift from the real spawn paths; meshes from the production
 /// submesh builders (or their attribute-exact stand-ins) so the vertex layouts can't either.
 /// Returns the entity count.
-#[allow(clippy::too_many_arguments)] // one arg per store/anchor, the file's builder convention
 pub(super) fn spawn_menagerie(
     commands: &mut Commands,
     cam: Entity,
     booth: Option<(Entity, &bevy::camera::visibility::RenderLayers)>,
     warm_booth: &(Entity, bevy::camera::visibility::RenderLayers),
+    warm_ortho: &(Entity, bevy::camera::visibility::RenderLayers),
     meshes: &mut Assets<Mesh>,
     materials: &mut Assets<WowModelMaterial>,
     lanes: &mut WarmLanes,
@@ -390,6 +393,14 @@ pub(super) fn spawn_menagerie(
     // (the class real bakes install) — that otherwise compiles live on the first in-world
     // portrait. A unit's gear (any family, any layout, far-swapped included when submerged)
     // can reach a booth pane. Shard rows can't (particle instances never ride booth layers).
+    //
+    // …and onto the ORTHOGRAPHIC twin (2262), the third projection class: the UI model tile
+    // atlas's camera. Its rigs are built by `ui_models` through `portrait::material_variant`,
+    // which clones the world material and swaps only the light buffer — the same pipeline key,
+    // under a class nothing warmed. **Minus the far twins**, which the booths do take: a far
+    // twin is `model_render::classify_water_side` swapping a material for an eye-and-model
+    // straddle of a water plane, and a tile is a `<Model>` widget's own file on its own stage —
+    // there is no water plane in a tile and no classify pass runs over one.
     for (mesh, aabb, skinned) in &layouts {
         for mat in mats.iter().chain(far_mats.iter()) {
             spawn_model_rig(commands, cam, None, mesh, aabb, *skinned, mat);
@@ -417,6 +428,18 @@ pub(super) fn spawn_menagerie(
             );
             count += 1;
         }
+        for mat in &mats {
+            spawn_model_rig(
+                commands,
+                warm_ortho.0,
+                Some(warm_ortho.1.clone()),
+                mesh,
+                aabb,
+                *skinned,
+                mat,
+            );
+            count += 1;
+        }
         if !*skinned {
             for mat in shard_mats.iter().chain(far_shard_mats.iter()) {
                 spawn_model_rig(commands, cam, None, mesh, aabb, false, mat);
@@ -471,7 +494,8 @@ pub(super) fn spawn_menagerie(
     let (plain_mesh, plain_aabb, _) = layouts[0].clone();
     let (colours_mesh, colours_aabb, _) = layouts[2].clone();
     let posuv = meshes.add(warm_pos_uv_mesh());
-    let liquid_mesh = meshes.add(warm_liquid_mesh());
+    let liquid_mesh = meshes.add(warm_liquid_mesh(false));
+    let liquid_color_mesh = meshes.add(warm_liquid_mesh(true));
     // Celestial discs + glares (`sun::setup` quads: position+normal+UV).
     for mat in lane_handles(&mut lanes.celestial) {
         spawn_lane_rig(
@@ -521,14 +545,40 @@ pub(super) fn spawn_menagerie(
             &mut count,
         );
     }
-    // Liquid: every kind × fog-block material `setup_liquid` built, on the liquid grid layout.
+    // Liquid: every kind × fog-block material `setup_liquid` built, on BOTH of the liquid grid's
+    // layouts. An **interior** WMO pool bakes its `MOMT.diffColor` into a fifth attribute —
+    // `ATTRIBUTE_COLOR`, `liquid::surface::liquid_bevy_mesh` — which `liquid.wgsl:275` reads behind
+    // `#ifdef VERTEX_COLORS`: a different shader-def set AND a different vertex buffer, so a
+    // different pipeline, exactly the way the minimap composite's quad was (2262). The ADT and
+    // WMO-exterior lanes pass `None` and take the shader's `#else` white. Warming only the
+    // four-attribute form left the first indoor water pool — a cave, a dungeon, an inn's basin —
+    // compiling live on the frame it came into view.
     for mat in lane_handles(&mut lanes.liquid) {
-        spawn_lane_rig(commands, cam, None, &liquid_mesh, None, mat, &mut count);
+        spawn_lane_rig(
+            commands,
+            cam,
+            None,
+            &liquid_mesh,
+            None,
+            mat.clone(),
+            &mut count,
+        );
+        spawn_lane_rig(
+            commands,
+            cam,
+            None,
+            &liquid_color_mesh,
+            None,
+            mat,
+            &mut count,
+        );
     }
     // The plain-`StandardMaterial` lanes (0938 — the director's evening log). The fallback cube
     // (`entities::CubeAssets`, drawn while any entity's model streams) uses the production mesh
     // + materials, on the world camera AND a booth layer (a cube-bodied target can reach a
-    // portrait pane). The nameplate and raid-mark materials are built on first need, so the lane
+    // portrait pane) — but NOT the orthographic twin (2262): `ui_models` has no cube fallback at
+    // all, a tile's root simply stays bare until its M2 is resident, so no cube ever draws
+    // through the tile camera. The nameplate and raid-mark materials are built on first need, so the lane
     // warms REPRESENTATIVES with the builders' exact key fields (`nameplates::spawn_nameplates`,
     // `raid_marks::place_marks` — texture presence is not a key axis); the plate/mark quads
     // share the static-plain attribute set.
@@ -597,6 +647,43 @@ pub(super) fn spawn_menagerie(
         mark,
         &mut count,
     );
+
+    // The **minimap interior composite's tile quad** (1466, warmed by 2262). A `Material2d`
+    // pipeline is keyed on `(view key, MESH LAYOUT)`, and `UiQuadMaterial` therefore has TWO
+    // pipelines, not the one `warm_ui_quad_lane`'s doc claimed: the HUD's batch mesh is
+    // POSITION+UV_0+COLOR, the composite's tile is `Rectangle` — POSITION+NORMAL+UV_0. The
+    // composite's own camera cannot be warmed through (it is `is_active: false` until the player
+    // is inside a baked WMO interior, and an inactive camera is not extracted at all, so there is
+    // no view to specialise against) — but it does not need to be: the two cameras' VIEW keys are
+    // byte-identical (both `Msaa::Off`, neither HDR, same tonemap defs — confirmed by diffing the
+    // two variants in a `WOW_PIPE_TRACE` inventory, which differ in nothing but the vertex defs
+    // and buffer layout). So drawing the composite's mesh + its production material through the
+    // player-UI camera mints exactly the composite's pipeline, under the cover.
+    //
+    // The texture is a real 1×1 stand-in rather than a default handle, so the material's
+    // `AsBindGroup` cannot land on the retry path: a `#[texture]` binding whose `Some(handle)`
+    // does not resolve returns `RetryNextUpdate`, and a warm rig that never prepares is a warm
+    // rig that draws nothing and warms nothing, silently. `warm_effect_lane` binds a stand-in
+    // for the same reason.
+    let tile_tex = lanes.images.add(Image::default());
+    commands.spawn((
+        Mesh2d(meshes.add(crate::ui_pass::tile_quad_mesh())),
+        MeshMaterial2d(
+            lanes
+                .ui_quads
+                .add(crate::ui_pass::UiQuadMaterial::interior_tile(
+                    tile_tex,
+                    crate::minimap::INTERIOR_TILE_ALPHA_REF,
+                )),
+        ),
+        // Visible — unlike the model rigs, which the pacing reveals a slice at a time. It is one
+        // pipeline, drawn once at a scale that covers no pixel worth speaking of.
+        Transform::from_xyz(0.0, 0.0, 0.0).with_scale(Vec3::splat(0.001)),
+        crate::ui_pass::ui_render_layers(),
+        WarmRig,
+    ));
+    count += 1;
+
     count
 }
 
@@ -712,9 +799,16 @@ fn warm_pos_uv_mesh() -> Mesh {
     m
 }
 
-/// A tiny quad in the liquid grid's layout — POSITION + NORMAL + UV_0 + UV_1
-/// (`liquid::surface` inserts exactly these four attributes).
-fn warm_liquid_mesh() -> Mesh {
+/// A tiny quad in the liquid grid's layout — POSITION + NORMAL + UV_0 + UV_1, plus
+/// `ATTRIBUTE_COLOR` when `body_color` is set.
+///
+/// **Both forms are real** (2262's lesson, found by the sweep after it): `liquid_bevy_mesh` takes
+/// an `Option<[f32; 3]>` body colour and inserts the fifth attribute only for an INTERIOR WMO
+/// pool that is not fullbright — the ADT and WMO-exterior lanes pass `None`. `liquid.wgsl:275`
+/// reads it behind `#ifdef VERTEX_COLORS`, so the two are separate pipelines. This doc used to
+/// claim `liquid::surface` "inserts exactly these four attributes", which is what kept the second
+/// one out of the menagerie.
+fn warm_liquid_mesh(body_color: bool) -> Mesh {
     let mut m = Mesh::new(
         PrimitiveTopology::TriangleList,
         RenderAssetUsages::default(),
@@ -732,6 +826,10 @@ fn warm_liquid_mesh() -> Mesh {
     m.insert_attribute(Mesh::ATTRIBUTE_NORMAL, vec![[0.0, 1.0, 0.0]; 4]);
     m.insert_attribute(Mesh::ATTRIBUTE_UV_0, uvs.clone());
     m.insert_attribute(Mesh::ATTRIBUTE_UV_1, uvs);
+    if body_color {
+        // The production insert's shape exactly (`liquid_bevy_mesh`): one RGBA per vertex, alpha 1.
+        m.insert_attribute(Mesh::ATTRIBUTE_COLOR, vec![[1.0, 1.0, 1.0, 1.0]; 4]);
+    }
     m.insert_indices(Indices::U32(vec![0, 1, 2, 0, 2, 3]));
     m
 }
@@ -813,13 +911,20 @@ mod tests {
         //   (Its world-lane twin, benilla-world's `FfxCombinePipeline`, is outside this scan
         //   and compiles under the same cover: the player-UI camera's backdrop pair is keyed on
         //   that camera's own main texture and specialised on its first frame, pre-world, and a
-        //   bake's pair on the bake image's fixed format.)
+        //   bake's pair on the bake image's fixed format. That list was one short — a world view
+        //   also has its OWN pair, for the frames nothing claims it, and 2262 found it compiling
+        //   live at app exit. `prepare_textures` now specialises that pair on every frame rather
+        //   than only on the frame it first needs it.)
         let exempt = ["UiGammaPipeline"];
-        let src_root = std::path::Path::new(env!("CARGO_MANIFEST_DIR")).join("src");
-        let warm_src = std::fs::read_to_string(src_root.join("pipe_warm/mod.rs")).unwrap()
-            + &std::fs::read_to_string(src_root.join("pipe_warm/menagerie.rs")).unwrap();
+        let own_src = std::path::Path::new(env!("CARGO_MANIFEST_DIR")).join("src");
+        let warm_src = std::fs::read_to_string(own_src.join("pipe_warm/mod.rs")).unwrap()
+            + &std::fs::read_to_string(own_src.join("pipe_warm/menagerie.rs")).unwrap();
         let mut missing = Vec::new();
-        for (path, text) in walk_rs(&src_root) {
+        let files: Vec<_> = workspace_src_roots()
+            .iter()
+            .flat_map(|r| walk_rs(r))
+            .collect();
+        for (path, text) in files {
             for needle in [
                 "impl SpecializedRenderPipeline for ",
                 "impl SpecializedMeshPipeline for ",
@@ -845,6 +950,41 @@ mod tests {
         );
     }
 
+    /// **The scan root: every crate in the workspace, not just this one.**
+    ///
+    /// Both lane-coverage scans below used to walk `CARGO_MANIFEST_DIR/src` — which is
+    /// `crates/benilla-app/src`, and every lane either scan exists to catch lives in
+    /// **`benilla-world`**: all eight 3-D `MaterialPlugin` registrations, and both real hand-rolled
+    /// pipelines (`FfxCombinePipeline`, `EffectPipeline`). The only `Specialized*Pipeline` impl in
+    /// benilla-app is `UiGammaPipeline`, which the test then exempts — so the custom-lane assertion
+    /// could not fail, ever, and the material assertion could only ever see the two 2-D/UI
+    /// families. Both tests were green because they were looking at an empty room; the exempt list
+    /// even named `TerrainMaterial`/`WdlMaterial`, types the walk could never reach. Found by the
+    /// sweep after 2262, which is the third time in this file's history that a lane shipped
+    /// unwarmed because the instrument could not see it.
+    fn workspace_src_roots() -> Vec<std::path::PathBuf> {
+        // `crates/benilla-app` → `crates`, then every crate's `src` under it.
+        let crates = std::path::Path::new(env!("CARGO_MANIFEST_DIR"))
+            .parent()
+            .expect("CARGO_MANIFEST_DIR always has a parent")
+            .to_path_buf();
+        let mut roots: Vec<std::path::PathBuf> = std::fs::read_dir(&crates)
+            .expect("the crates/ directory is always readable from a test")
+            .filter_map(|e| {
+                let p = e.ok()?.path().join("src");
+                p.is_dir().then_some(p)
+            })
+            .collect();
+        roots.sort();
+        assert!(
+            roots.len() > 1,
+            "the lane scans must walk the whole workspace — a single root is the bug this \
+             function exists to prevent (only {roots:?} found under {})",
+            crates.display(),
+        );
+        roots
+    }
+
     /// Every `.rs` file under `src`, read — shared by both lane-coverage scans.
     fn walk_rs(src_root: &std::path::Path) -> Vec<(std::path::PathBuf, String)> {
         let mut out = Vec::new();
@@ -889,12 +1029,16 @@ mod tests {
             ("Material2dPlugin::<", &[]),
             ("UiMaterialPlugin::<", &["AddUiMaterial"]),
         ];
-        let src_root = std::path::Path::new(env!("CARGO_MANIFEST_DIR")).join("src");
+        let own_src = std::path::Path::new(env!("CARGO_MANIFEST_DIR")).join("src");
         // "Named in this file" = anywhere in the pipe_warm module folder.
-        let warm_src = std::fs::read_to_string(src_root.join("pipe_warm/mod.rs")).unwrap()
-            + &std::fs::read_to_string(src_root.join("pipe_warm/menagerie.rs")).unwrap();
+        let warm_src = std::fs::read_to_string(own_src.join("pipe_warm/mod.rs")).unwrap()
+            + &std::fs::read_to_string(own_src.join("pipe_warm/menagerie.rs")).unwrap();
         let mut missing = Vec::new();
-        for (path, text) in walk_rs(&src_root) {
+        let files: Vec<_> = workspace_src_roots()
+            .iter()
+            .flat_map(|r| walk_rs(r))
+            .collect();
+        for (path, text) in files {
             for (needle, exempt) in families {
                 for (i, _) in text.match_indices(needle) {
                     // A preceding ident char means this match is really a longer family's name
diff --git a/crates/benilla-app/src/pipe_warm/mod.rs b/crates/benilla-app/src/pipe_warm/mod.rs
index 4b1fa4f1..57385b0b 100644
--- a/crates/benilla-app/src/pipe_warm/mod.rs
+++ b/crates/benilla-app/src/pipe_warm/mod.rs
@@ -110,7 +110,15 @@ pub(crate) fn plugin(app: &mut App) {
     });
     app.insert_resource(PipeWatch(shared.clone()));
     app.init_resource::<WarmPass>();
-    app.add_systems(Last, (publish_cover, publish_compile_burst));
+    app.add_systems(
+        Last,
+        (
+            publish_cover,
+            publish_compile_burst,
+            record_warmed_views,
+            census_view_classes,
+        ),
+    );
     // Before the Present stage so the loading screen reads this frame's gate, not last frame's.
     app.add_systems(
         Update,
@@ -321,6 +329,15 @@ pub(crate) struct WarmPass {
     /// LIVE" warn is exactly the instrument for it — which is why this can be a latch and not a
     /// guess. A timeout does NOT latch it: something was still pending.
     warmed_once: bool,
+    /// **The cameras the menagerie parents rigs to** — the world camera, one real portrait booth,
+    /// the twin booth and the orthographic twin. Recorded as entities at spawn so
+    /// [`record_warmed_views`] can read their LIVE view key each frame instead of restating what
+    /// the spawn code meant (2264).
+    anchors: Vec<Entity>,
+    /// **The view keys those anchors actually carried while the pass ran** — the census's only
+    /// notion of "warm". Never a rule, never an inference: if a rig did not render through it,
+    /// it is not in here.
+    warmed_views: Vec<ViewClass>,
     /// Pacing state (1116): rigs warmed so far, when the last slice went out, how many frames
     /// the reveal spanned, and the slice currently on screen (hidden again next frame).
     revealed: usize,
@@ -395,7 +412,6 @@ type WarmRigVis<'w, 's> = Query<
 /// 0737's rule: never hold a cover unbounded. A timeout fires the tripwire-adjacent warn and
 /// releases; the remaining compiles land live (the pre-0837 world, once, with a named cause).
 const WARM_TIMEOUT_SECS: f32 = 10.0;
-#[allow(clippy::too_many_arguments)] // a Bevy system: each param is one resource, the app's convention
 fn run_warm_pass(
     mut commands: Commands,
     mut warm: ResMut<WarmPass>,
@@ -466,13 +482,23 @@ fn run_warm_pass(
         commands
             .entity(warm_booth.0)
             .insert((WarmRig, WarmBoothCam));
+        // The orthographic twin (2262): the THIRD projection class, the one the UI model tile
+        // atlas draws through. Same deal — a WarmRig, so the despawn paths take it too.
+        let warm_ortho = crate::ui_models::spawn_warm_tile_cam(&mut commands, &mut lanes.images);
+        commands.entity(warm_ortho.0).insert(WarmRig);
         // The effect lane's stand-in texture — held for the life of the pass.
         warm.effect_tex = Some(lanes.images.add(Image::default()));
+        // The anchors the census measures "warm" from (2264): every camera the menagerie actually
+        // hangs rigs on. Recorded as entities, not as remembered shapes.
+        warm.anchors = vec![cam, warm_booth.0, warm_ortho.0];
+        warm.anchors.extend(booth.iter().next().map(|(e, _)| e));
+        warm.warmed_views.clear();
         let count = spawn_menagerie(
             &mut commands,
             cam,
             booth.iter().next(),
             &warm_booth,
+            &warm_ortho,
             &mut meshes,
             &mut materials,
             &mut lanes,
@@ -555,6 +581,149 @@ fn run_warm_pass(
     }
 }
 
+/// **The view-class census** (2262, rebuilt by 2264) — 0958's claim, turned from a sentence into
+/// an instrument that can actually fire.
+///
+/// 0958 verified that "the whole 3-D view space is `(samples, projection class)`, and both classes
+/// of both sample counts are now warm". True the day it was written; false a month later, when
+/// 2013 gave the UI model tile atlas an orthographic camera — a third class, warmed by nothing,
+/// whose first tile compiled its whole batch set live. Neither lane-coverage gate test can see a
+/// *camera*, so nothing caught it.
+///
+/// **2262's first attempt at this census could not fire.** It decided what was warm from a rule it
+/// held in its own head — "samples=1 is warm in all three classes, and the world camera's own pair
+/// is warm" — and then skipped every camera matching it. But `gxMultisample` registers `"1"`
+/// (`cvars.rs`), `MsaaSetting::default()` is 1, and **only the world camera ever reads it**
+/// (`player/setup.rs:99`, `:118`); every other 3-D camera hard-codes `Msaa::Off` through
+/// `booth_view_shape()`. So `samples == 1` covered the entire population and the loop body was
+/// unreachable — including for the very camera 2013 added. An instrument that restates what the
+/// author believed is not an instrument.
+///
+/// So it no longer believes anything. [`WarmPass::warmed_views`] records the view key of each
+/// camera the menagerie **actually parented rigs to**, read off those cameras live while the pass
+/// runs; the census compares every `Camera3d` against that recorded set and nothing else. It also
+/// runs for the whole session rather than once at drain, warning once per distinct unwarmed key,
+/// because the class a booth is warm in is one it installs *at runtime* on its first bake — which
+/// a single read at drain is too early to see.
+fn census_view_classes(
+    warm: Res<WarmPass>,
+    mut reported: Local<Vec<ViewClass>>,
+    cams: ViewCamQuery,
+) {
+    if !warm.warmed_once {
+        return;
+    }
+    for (name, projection, msaa, hdr) in &cams {
+        let class = view_class(projection, msaa, hdr);
+        if warm.warmed_views.contains(&class) || reported.contains(&class) {
+            continue;
+        }
+        reported.push(class);
+        warn!(
+            "pipeline warm: camera {} draws through {} — a view key the menagerie never rendered \
+             a rig through, so its whole model-pipeline space compiles LIVE on first sight. Give \
+             it a warm arm (decisions 0958/2262/2264). Warm keys this session: {}.",
+            name.map_or("<unnamed>", Name::as_str),
+            class.describe(),
+            warm.warmed_views
+                .iter()
+                .map(ViewClass::describe)
+                .collect::<Vec<_>>()
+                .join(", "),
+        );
+    }
+}
+
+/// Every 3-D camera in the world, for [`census_view_classes`]: the name it reports itself by, and
+/// the three components that decide its mesh-pipeline view key.
+type ViewCamQuery<'w, 's> = Query<
+    'w,
+    's,
+    (
+        Option<&'static Name>,
+        Option<&'static Projection>,
+        Option<&'static Msaa>,
+        Has<bevy::render::view::Hdr>,
+    ),
+    With<Camera3d>,
+>;
+
+/// The key a 3-D view contributes to `MeshPipelineKey`, as [`census_view_classes`] compares them.
+///
+/// `hdr` is here because it is a key bit in its own right AND the gate on two more: bevy admits
+/// `TONEMAP_IN_SHADER` and `DEBAND_DITHER` into the key only when the view is **not** HDR
+/// (`bevy_pbr-0.18.1` `render/mesh.rs:418`), and `Camera3d`'s required components hand a camera
+/// both by default. 0958's "every 3-D camera is HDR so tonemap/dither are dead axes" is true of
+/// every camera we spawn today and is exactly the kind of sentence this census exists to stop
+/// trusting: a new 3-D camera that forgets `Hdr` flips three key bits at once, and 2262's version
+/// did not look at it.
+#[derive(PartialEq, Eq, Clone, Copy, Debug)]
+pub(crate) struct ViewClass {
+    projection: &'static str,
+    samples: u32,
+    hdr: bool,
+}
+
+impl ViewClass {
+    fn describe(&self) -> String {
+        format!(
+            "{}/samples={}/{}",
+            self.projection,
+            self.samples,
+            if self.hdr { "hdr" } else { "no-hdr" }
+        )
+    }
+}
+
+fn view_class(projection: Option<&Projection>, msaa: Option<&Msaa>, hdr: bool) -> ViewClass {
+    ViewClass {
+        // bevy_pbr folds exactly these three into `MeshPipelineKey` (`bevy_pbr-0.18.1`
+        // `render/mesh.rs:397`); the match is exhaustive so a fourth variant upstream stops the
+        // build here rather than opening a silent hole. A view with no `Projection` at all sets
+        // no bits, which is the NONSTANDARD pattern — the same class as Custom.
+        projection: match projection {
+            Some(Projection::Perspective(_)) => "Perspective",
+            Some(Projection::Orthographic(_)) => "Orthographic",
+            Some(Projection::Custom(_)) | None => "Custom",
+        },
+        samples: msaa.copied().unwrap_or_default().samples(),
+        hdr,
+    }
+}
+
+/// The menagerie's anchor cameras, read for their LIVE view key by [`record_warmed_views`] —
+/// entity first, so the recorder can match against [`WarmPass::anchors`].
+type AnchorViewQuery<'w, 's> = Query<
+    'w,
+    's,
+    (
+        Entity,
+        Option<&'static Projection>,
+        Option<&'static Msaa>,
+        Has<bevy::render::view::Hdr>,
+    ),
+    With<Camera3d>,
+>;
+
+/// Record the view key of every camera the menagerie actually parents rigs to, while the pass is
+/// running. Read off the live cameras rather than restated from what the spawn code intended —
+/// that restatement is what made 2262's census unable to fire.
+fn record_warmed_views(mut warm: ResMut<WarmPass>, cams: AnchorViewQuery) {
+    if warm.spawned_at.is_none() || warm.done {
+        return;
+    }
+    let anchors = warm.anchors.clone();
+    for (e, projection, msaa, hdr) in &cams {
+        if !anchors.contains(&e) {
+            continue;
+        }
+        let class = view_class(projection, msaa, hdr);
+        if !warm.warmed_views.contains(&class) {
+            warm.warmed_views.push(class);
+        }
+    }
+}
+
 /// Tear the pass down by despawning only its ROOT entities. `despawn` is recursive, and the twin
 /// booth's rigs are *children* of the twin booth camera — itself a `WarmRig` — so despawning
 /// every query row queues the children twice (once explicitly, once via the parent's recursion):
@@ -582,11 +751,16 @@ fn despawn_rigs(commands: &mut Commands, rigs: &Query<(Entity, Option<&ChildOf>)
 /// half exercised too. Per-frame like the gizmo line: the stream clears every frame.
 ///
 /// [`EffectPipelineKey`]: benilla_world::particles::render::EffectPipelineKey
-/// The HUD-substrate warm (0958's sweep, residual): `UiQuadMaterial` is exactly ONE pipeline,
-/// and on a normal entry it compiles covered because the HUD's first quad batch lands under the
-/// cover — but nothing structural holds that timing (a slow Interface load would land it after
-/// the lift). One invisible overlay quad per warm frame pins the compile inside the cover
-/// window; the append lane clears itself every frame, so nothing lingers.
+/// The HUD-substrate warm (0958's sweep, residual): on a normal entry the HUD's first quad batch
+/// lands under the cover — but nothing structural holds that timing (a slow Interface load would
+/// land it after the lift). One invisible overlay quad per warm frame pins the compile inside the
+/// cover window; the append lane clears itself every frame, so nothing lingers.
+///
+/// This warms the HUD's **batch mesh** layout (POSITION + UV_0 + COLOR) only. 0958 read
+/// `UiQuadMaterial` as "exactly ONE pipeline"; it is two, because a `Material2d` pipeline is
+/// keyed on the mesh layout as well as the view, and the minimap interior composite draws the
+/// same material on a `Rectangle` (POSITION + NORMAL + UV_0). That second one is warmed as a rig
+/// in [`menagerie`], not here — this lane's stream only ever builds the batch layout (2262).
 fn warm_ui_quad_lane(warm: Res<WarmPass>, mut quads: ResMut<crate::ui_pass::UiQuads>) {
     if warm.spawned_at.is_none() || warm.done {
         return;
@@ -706,3 +880,77 @@ fn warm_effect_lane(
         );
     }
 }
+
+#[cfg(test)]
+mod census_tests {
+    use super::{view_class, ViewClass};
+    use bevy::camera::{OrthographicProjection, PerspectiveProjection, Projection};
+    use bevy::render::view::Msaa;
+
+    fn perspective() -> Projection {
+        Projection::Perspective(PerspectiveProjection::default())
+    }
+
+    fn orthographic() -> Projection {
+        Projection::Orthographic(OrthographicProjection::default_3d())
+    }
+
+    /// The warm set as it stood the day 2013 landed: the world camera's Perspective and the two
+    /// `Msaa::Off` booth classes. No orthographic arm — because there was no orthographic camera
+    /// when 0958 wrote the census down.
+    fn warm_set_before_2262() -> Vec<ViewClass> {
+        vec![
+            view_class(Some(&perspective()), Some(&Msaa::Off), true),
+            view_class(Some(&perspective()), Some(&Msaa::Sample4), true),
+            view_class(None, Some(&Msaa::Off), true),
+        ]
+    }
+
+    /// **The census must fire for decision 2013's tile camera.** This is the case 2262's first
+    /// version could not report: that camera is `Msaa::Off` like every other booth, and 2262
+    /// skipped `samples == 1` outright, so the loop body was unreachable for it — and for every
+    /// other camera the client spawns, since `gxMultisample` defaults to 1 and only the world
+    /// camera ever reads it. The census now compares against the keys rigs actually rendered
+    /// through, so a class nothing warmed is a class it names.
+    #[test]
+    fn the_census_fires_for_an_unwarmed_orthographic_camera() {
+        let warm = warm_set_before_2262();
+        let tile_cam = view_class(Some(&orthographic()), Some(&Msaa::Off), true);
+        assert!(
+            !warm.contains(&tile_cam),
+            "the ui_models tile camera's view key must read as unwarmed against a warm set that \
+             has no orthographic arm — this is the report 2262 was written to produce"
+        );
+        // And the rule 2262 actually shipped would have swallowed it.
+        assert_eq!(
+            tile_cam.samples, 1,
+            "the tile camera is Msaa::Off, like every booth"
+        );
+    }
+
+    /// The other half: a class the menagerie DID render through is silent, so the census cannot
+    /// cry wolf on the cameras it is meant to bless.
+    #[test]
+    fn the_census_is_silent_for_every_warmed_class() {
+        let warm = warm_set_before_2262();
+        for class in &warm {
+            assert!(warm.contains(class));
+        }
+        let booth_after_first_bake = view_class(None, Some(&Msaa::Off), true);
+        assert!(
+            warm.contains(&booth_after_first_bake),
+            "a booth's runtime-installed custom projection is the NONSTANDARD class, warmed by \
+             the twin booth (0958)"
+        );
+    }
+
+    /// `Hdr` is a key bit and the gate on two more (tonemap, deband — `bevy_pbr` `mesh.rs:418`).
+    /// 2262's census did not read it, so a 3-D camera that forgot `Hdr` was invisible to it.
+    #[test]
+    fn dropping_hdr_is_a_different_view_key() {
+        let with = view_class(Some(&perspective()), Some(&Msaa::Off), true);
+        let without = view_class(Some(&perspective()), Some(&Msaa::Off), false);
+        assert_ne!(with, without);
+        assert!(!warm_set_before_2262().contains(&without));
+    }
+}
diff --git a/crates/benilla-app/src/player.rs b/crates/benilla-app/src/player.rs
index 3171fd31..77160706 100644
--- a/crates/benilla-app/src/player.rs
+++ b/crates/benilla-app/src/player.rs
@@ -326,6 +326,8 @@ impl Plugin for PlayerPlugin {
             Update,
             world_focus::release_post_snap_hold.after(benilla_world::schedule::WorldStage::Stream),
         );
+        app.add_observer(camera::on_cvar);
+        app.add_observer(camera_dynamics::on_cvar);
         app.init_resource::<camera::LookConfig>();
         app.init_resource::<camera::ZoomLimit>();
         app.init_resource::<camera::FollowConfig>();
@@ -347,7 +349,7 @@ impl Plugin for PlayerPlugin {
                 )
                     .in_set(WorldStage::Input)
                     .before(control)
-                    .run_if(in_state(crate::char_select::ClientState::InWorld)),
+                    .in_set(crate::char_select::InWorldGated),
             );
         app.add_systems(
             Startup,
@@ -372,7 +374,7 @@ impl Plugin for PlayerPlugin {
                 .in_set(PlayerControlSet)
                 .in_set(WorldStage::Input)
                 .run_if(not(resource_exists::<crate::run_mode::CaptureMode>))
-                .run_if(in_state(crate::char_select::ClientState::InWorld)),
+                .in_set(crate::char_select::InWorldGated),
         )
         // The posture setter's queue (the `/sit` family — decision 0881; `control` is the sole
         // executor, like the sheath queue).
@@ -386,7 +388,7 @@ impl Plugin for PlayerPlugin {
             land::land_here
                 .in_set(WorldStage::Input)
                 .before(control)
-                .run_if(in_state(crate::char_select::ClientState::InWorld)),
+                .in_set(crate::char_select::InWorldGated),
         )
         // (The two scripted probe drivers that used to sit here — `WOW_PROBE_LOOK`'s
         // mouse-turn and `WOW_PROBE_CAM`'s camera park — are the harness's now, and register
@@ -401,7 +403,7 @@ impl Plugin for PlayerPlugin {
                 .in_set(WorldStage::Input)
                 .before(control)
                 .run_if(not(resource_exists::<crate::run_mode::CaptureMode>))
-                .run_if(in_state(crate::char_select::ClientState::InWorld)),
+                .in_set(crate::char_select::InWorldGated),
         )
         // A session END releases the avatar — a confirmed `/logout`, or a lost session
         // (decision 1262): the streamed entity is despawned by the net drain either way, and
@@ -457,7 +459,7 @@ impl Plugin for PlayerPlugin {
                 .in_set(WorldStage::Input)
                 .before(control)
                 .before(follow::steer_follow)
-                .run_if(in_state(crate::char_select::ClientState::InWorld)),
+                .in_set(crate::char_select::InWorldGated),
         )
         // `/follow` (decision 0890): steer the facing and decide this tick's synthesized forward
         // input immediately BEFORE the controller, which folds the flag into its forward axis.
@@ -468,7 +470,7 @@ impl Plugin for PlayerPlugin {
             follow::steer_follow
                 .in_set(WorldStage::Input)
                 .before(control)
-                .run_if(in_state(crate::char_select::ClientState::InWorld)),
+                .in_set(crate::char_select::InWorldGated),
         )
         // The self-avatar zoom-in fade rides the same `MeshTag`/material channel as the interior
         // classifier + the appear/despawn fades, so it must run *after* both to win the frame while
diff --git a/crates/benilla-app/src/player/body_pose.rs b/crates/benilla-app/src/player/body_pose.rs
index ecefe3d1..e2e4fdfc 100644
--- a/crates/benilla-app/src/player/body_pose.rs
+++ b/crates/benilla-app/src/player/body_pose.rs
@@ -15,7 +15,6 @@ use super::{model_pivot_height, wrap_pi, BodyQuery, CameraPivot, Player};
 /// Write this frame onto the driven body and return the camera-pivot **target** height it carries.
 /// `anim_flags` is [`super::gait::drive_body_heading`]'s verdict; `move_flags_now` is the live
 /// wire word, whose forward/back bits gate the swim body pitch.
-#[allow(clippy::too_many_arguments)]
 pub(super) fn drive(
     player: &Player,
     body: &mut BodyQuery,
diff --git a/crates/benilla-app/src/player/camera.rs b/crates/benilla-app/src/player/camera.rs
index e347d94b..6995bce7 100644
--- a/crates/benilla-app/src/player/camera.rs
+++ b/crates/benilla-app/src/player/camera.rs
@@ -152,7 +152,9 @@ impl ZoomLimit {
         self.max = CAM_DIST_BASE_MAX * f;
     }
 
-    /// The live factor — what the CVar table and the config file carry.
+    /// The live factor — the inverse of [`Self::set_factor`], kept for the weld test (the
+    /// registry holds the string itself since 2303).
+    #[cfg(test)]
     pub(crate) fn factor(&self) -> f32 {
         self.max / CAM_DIST_BASE_MAX
     }
@@ -173,6 +175,54 @@ const LOOK_SENSITIVITY: f32 = 0.003;
 /// reproduces the shipped feel exactly.
 pub(crate) const MOUSE_SPEED_RANGE: std::ops::RangeInclusive<f32> = 0.5..=1.5;
 
+/// The camera rows' change callback (decision 2303) — the look, zoom and follow knobs.
+pub(crate) fn on_cvar(
+    ev: On<crate::cvars::CvarChanged>,
+    mut look: ResMut<LookConfig>,
+    mut zoom: ResMut<ZoomLimit>,
+    mut follow: ResMut<FollowConfig>,
+) {
+    let v = ev.num();
+    match ev.key().as_str() {
+        "mouseinvertpitch" => look.invert_pitch = v != 0.0,
+        // The 1.12 slider's own range; an off-grid hand-edit rides between stops, like the others.
+        "mousespeed" => {
+            look.sensitivity = v.clamp(*MOUSE_SPEED_RANGE.start(), *MOUSE_SPEED_RANGE.end());
+        }
+        // The reference's `0x50b330` validator REJECTS an out-of-range value rather than clamping
+        // it: it prints `Value out of range (%f - %f)` and `CVar::Set` never stores, so the old
+        // value stands. That is a different posture from every clamping row, and it is the
+        // faithful one — a script writing 1e9 gets a refusal, not a silently pinned camera.
+        "camerayawmovespeed" | "camerapitchmovespeed" => {
+            if !CAMERA_SPEED_RANGE.contains(&v) {
+                warn!(
+                    "cvar {}: value out of range ({} - {}) — ignored",
+                    ev.name,
+                    CAMERA_SPEED_RANGE.start(),
+                    CAMERA_SPEED_RANGE.end()
+                );
+                return;
+            }
+            if ev.is("cameraYawMoveSpeed") {
+                look.yaw_speed = v;
+            } else {
+                look.pitch_speed = v;
+            }
+        }
+        "cameradistancemaxfactor" => zoom.set_factor(v),
+        // The three stops are 1 Smart / 2 Always / 3 Never; anything else reads as the registrar
+        // default rather than as a dead camera (`FollowStyle::from_cvar`).
+        "camerasmoothstyle" => follow.style = FollowStyle::from_cvar(v),
+        // Its sibling selector — the one the reference swaps in for the externally-driven states.
+        "camerasmoothtrackingstyle" => follow.tracking_style = FollowStyle::from_cvar(v),
+        // The auto-follow rate, clamped to 1.12's own AUTO_FOLLOW_SPEED slider range.
+        "camerayawsmoothspeed" => {
+            follow.yaw_speed = v.clamp(*FOLLOW_SPEED_RANGE.start(), *FOLLOW_SPEED_RANGE.end());
+        }
+        _ => {}
+    }
+}
+
 /// **The mouse-look rate law, and the one place benilla's units are not the reference's.**
 ///
 /// The reference's own law is byte-VERIFIED (wow-re `world-click-drag-arbitration.md` §3.3):
@@ -330,7 +380,9 @@ impl FollowStyle {
         }
     }
 
-    /// The CVar string this style is — the value the table and `config.toml` carry.
+    /// The CVar string this style is — the inverse of [`Self::from_cvar`], kept for the
+    /// round-trip test (the registry holds the string itself since 2303).
+    #[cfg(test)]
     pub(crate) fn cvar(self) -> &'static str {
         match self {
             Self::Never => "0",
@@ -1033,7 +1085,6 @@ pub(crate) struct CameraPivot {
 /// [`PressGesture::is_click`] alone. There is no "promotion" and nothing cancels the click for
 /// having moved — the pending click used to be destroyed the moment the cursor crossed a 4 px
 /// threshold, which is why a drag could never select (ledger B226).
-#[allow(clippy::too_many_arguments)]
 pub(super) fn run_look_session(
     buttons: &ButtonInput<MouseButton>,
     mouse_motion: &AccumulatedMouseMotion,
@@ -1240,7 +1291,6 @@ pub(super) fn apply_zoom_scroll(scroll: f32, dt: f32, rig: &mut CameraControl, m
 /// `feet`/`head` are the caller's, because the head offset is the avatar capsule's and those
 /// constants are a movement concern; `body_pivot` is the target height read off the driven body
 /// this frame, used only when nothing else is being watched.
-#[allow(clippy::too_many_arguments)]
 pub(super) fn seat_on_subject(
     dt: f32,
     turn_delta: f32,
@@ -1397,7 +1447,6 @@ pub(super) fn seat_on_subject(
 /// `head`/`player_pos` are precomputed by [`super::control`] (which owns the avatar capsule
 /// constants); `cam_pivot_height` is the world pivot height it derived from [`CameraPivot`] this
 /// frame.
-#[allow(clippy::too_many_arguments)]
 pub(super) fn seat_camera(
     dt: f32,
     turn_delta: f32,
@@ -1640,7 +1689,7 @@ pub(super) fn seat_camera(
 /// compose (`wow_model.wgsl`: `out_rgb *= faded_alpha`) takes the card to black, which for an ADD blend
 /// is gone. That deliberately avoids `Visibility`, which the card's own hidden-owner mirror authors every
 /// frame in a different system.
-#[allow(clippy::type_complexity, clippy::too_many_arguments)] // one Bevy system's full input set
+#[allow(clippy::type_complexity)] // one Bevy system's full input set
 pub(crate) fn apply_self_model_fade(
     rig: Res<CameraControl>,
     self_player: Query<(Entity, Option<&crate::aura_visual::AuraNodes>), With<Embodied>>,
diff --git a/crates/benilla-app/src/player/camera_dynamics.rs b/crates/benilla-app/src/player/camera_dynamics.rs
index ed15702f..6ce7c063 100644
--- a/crates/benilla-app/src/player/camera_dynamics.rs
+++ b/crates/benilla-app/src/player/camera_dynamics.rs
@@ -104,6 +104,30 @@ pub(crate) struct CameraOptions {
     pub(crate) water_collision: bool,
 }
 
+/// The camera options' change callback (2149, 2303). The numeric rows take the value
+/// straight: the reference's own validator on them is `0x50b330`'s range REFUSAL, which is the
+/// camera-speed rows' business ([`super::camera::on_cvar`]), not these.
+pub(crate) fn on_cvar(ev: On<crate::cvars::CvarChanged>, mut opts: ResMut<CameraOptions>) {
+    let v = ev.num();
+    match ev.key().as_str() {
+        "camerapivot" => opts.pivot = v != 0.0,
+        "camerawatercollision" => opts.water_collision = v != 0.0,
+        "camerapivotdxmax" => opts.pivot_dx_max = v,
+        "camerapivotdymin" => opts.pivot_dy_min = v,
+        "cameratargetsmoothspeed" => opts.target_smooth_speed = v,
+        "cameraterraintilt" => opts.terrain_tilt = v != 0.0,
+        "cameragroundsmoothspeed" => opts.ground_smooth_speed = v,
+        "cameraterraintilttimemin" => opts.tilt_time_min = v,
+        "cameraterraintilttimemax" => opts.tilt_time_max = v,
+        "camerabobbing" => opts.bobbing = v != 0.0,
+        "camerabobbinglramplitude" => opts.bob_lr_amplitude = v,
+        "camerabobbingudamplitude" => opts.bob_ud_amplitude = v,
+        "camerabobbingfrequency" => opts.bob_frequency = v,
+        "camerabobbingsmoothspeed" => opts.bob_smooth_speed = v,
+        _ => {}
+    }
+}
+
 impl Default for CameraOptions {
     fn default() -> Self {
         Self {
diff --git a/crates/benilla-app/src/player/camera_saved.rs b/crates/benilla-app/src/player/camera_saved.rs
index fe94b5da..c535160d 100644
--- a/crates/benilla-app/src/player/camera_saved.rs
+++ b/crates/benilla-app/src/player/camera_saved.rs
@@ -42,7 +42,7 @@ use std::path::PathBuf;
 
 use bevy::prelude::*;
 
-use crate::char_select::ClientState;
+use crate::char_select::{ClientState, InWorldGated};
 
 use super::camera::{CameraControl, FlyCam, CAM_DIST_MAX, CAM_DIST_MIN, CAM_PITCH_LIMIT};
 use benilla_world::view::WorldCamera;
@@ -231,9 +231,7 @@ pub(super) fn plugin(app: &mut App) {
             // frame renders rather than something the player watches glide into place. Not gated on
             // capture mode: a capture resolves no state path at all (0954's hermetic rule), so this
             // is already inert there.
-            load_camera_pose
-                .before(super::control)
-                .run_if(in_state(ClientState::InWorld)),
+            load_camera_pose.before(super::control).in_set(InWorldGated),
         )
         .add_systems(OnExit(ClientState::InWorld), save_on_session_end);
     // The quit root goes on the exit edge, never `Update` (decision 1528): the close button's
diff --git a/crates/benilla-app/src/player/camera_view.rs b/crates/benilla-app/src/player/camera_view.rs
index 2d09ec7d..d1601fd7 100644
--- a/crates/benilla-app/src/player/camera_view.rs
+++ b/crates/benilla-app/src/player/camera_view.rs
@@ -146,17 +146,6 @@ pub(crate) const VIEW_DEFAULTS: [[&str; 3]; VIEW_COUNT] = [
 /// the client opens on `THIRD_PERSON_A`.
 pub(crate) const ACTIVE_VIEW_DEFAULT: &str = "1";
 
-/// True if `name` is one of this module's sixteen CVars (case-insensitively, like every CVar
-/// lookup). [`crate::cvars::apply_to_knobs`] asks so a `SaveView` marks the config dirty and the
-/// view is actually persisted; there is nothing to apply, because [`CameraViews`] is the writer.
-pub(crate) fn is_view_cvar(name: &str) -> bool {
-    name.eq_ignore_ascii_case(CVAR_ACTIVE_VIEW)
-        || VIEW_CVARS
-            .iter()
-            .flatten()
-            .any(|n| n.eq_ignore_ascii_case(name))
-}
-
 /// One view's pose, in **benilla's** units: yards, and radians with [`FlyCam::pitch`]'s
 /// positive-is-UP sign. `yaw` is an offset from the subject's facing (see the module header), so a
 /// view whose yaw is `0.0` is "directly behind" whichever way the character is pointing.
@@ -270,17 +259,17 @@ impl CameraViews {
 
 /// Startup: seed the five views (and the live index) from `config.toml`.
 ///
-/// Reads [`crate::cvars::CvarPersist::stored`] rather than the VM's table for the reason 1622's
-/// remembered-character row does: the VM's CVar table is a per-VM `Update` seed and does not exist
-/// yet, while the persisted values are a resource from `CvarLoad` onward and stay current across a
-/// VM replacement (1291). An absent key is the shipped default, which is every first run.
-fn load_saved_views(persist: Res<crate::cvars::CvarPersist>, mut views: ResMut<CameraViews>) {
+/// Reads the registry ([`crate::cvars::Cvars::get`]) rather than the VM's table for the reason
+/// 1622's remembered-character row does: the VM's mirror is a per-VM `Update` seed and does not
+/// exist yet, while the registry is a resource from `CvarLoad` onward and outlives every VM
+/// (2303). An absent key answers the shipped default, which is every first run.
+fn load_saved_views(cvars: Res<crate::cvars::Cvars>, mut views: ResMut<CameraViews>) {
     for (view, slot) in views.views.iter_mut().enumerate() {
         // Each field is independently optional, like the pose file's two keys: an absent or
         // hand-mangled value costs that one number, not the whole view.
         let field = |i: usize| {
-            persist
-                .stored(VIEW_CVARS[view][i])
+            cvars
+                .get(VIEW_CVARS[view][i])
                 .and_then(|s| s.trim().parse::<f32>().ok())
                 .filter(|v| v.is_finite())
         };
@@ -294,8 +283,8 @@ fn load_saved_views(persist: Res<crate::cvars::CvarPersist>, mut views: ResMut<C
         };
         *slot = ViewPose::from_reference(raw(0), raw(1), raw(2));
     }
-    if let Some(v) = persist
-        .stored(CVAR_ACTIVE_VIEW)
+    if let Some(v) = cvars
+        .get(CVAR_ACTIVE_VIEW)
         .and_then(|s| s.trim().parse::<usize>().ok())
         .filter(|v| *v < VIEW_COUNT)
     {
@@ -316,7 +305,11 @@ struct ViewTargets<'w, 's> {
 ///
 /// Ordered before [`super::control`] so a view taken this frame is the pose this frame's camera
 /// seat is computed from, exactly like the pose file's restore.
-fn drain_view_requests(script: Option<NonSendMut<UiScript>>, mut targets: ViewTargets) {
+fn drain_view_requests(
+    script: Option<NonSendMut<UiScript>>,
+    mut cvars: ResMut<crate::cvars::Cvars>,
+    mut targets: ViewTargets,
+) {
     let Some(mut script) = script else {
         return;
     };
@@ -399,10 +392,10 @@ fn drain_view_requests(script: Option<NonSendMut<UiScript>>, mut targets: ViewTa
         }
     }
 
-    // Mirror into the CVar table so the change dirties `config.toml` and the view survives a
-    // restart — `set_cvar_engine` is the minimap-zoom pattern (the engine's own value moved, so
-    // the table follows AND queues the change). The resource stays authoritative either way, so a
-    // run with no VM at all (a bare test app) still has working views.
+    // Mirror into the registry so the change dirties `config.toml` and the view survives a
+    // restart — a host write (2303: the engine's own value moved, so the table follows and the
+    // VM's mirror learns it). The resource stays authoritative either way, so a run with no VM
+    // at all (a bare test app) still has working views.
     for view in write_slots {
         // A reset writes the reference's default STRING verbatim, not a re-rendered `%f` of it:
         // `crate::cvars`'s file is a diff against the registered default, and only the exact text
@@ -415,11 +408,11 @@ fn drain_view_requests(script: Option<NonSendMut<UiScript>>, mut targets: ViewTa
             } else {
                 rendered[field].as_str()
             };
-            script.set_cvar_engine(VIEW_CVARS[view][field], value);
+            cvars.set(VIEW_CVARS[view][field], value);
         }
     }
     if write_active {
-        script.set_cvar_engine(CVAR_ACTIVE_VIEW, &targets.views.current.to_string());
+        cvars.set(CVAR_ACTIVE_VIEW, &targets.views.current.to_string());
     }
 }
 
@@ -451,6 +444,9 @@ pub(super) fn plugin(app: &mut App) {
         .add_systems(
             Update,
             drain_view_requests
+                // After the tick that queued them (`SetView`/`SaveView` are Lua's), before the
+                // control pass that seats the pose.
+                .after(crate::ui_script::UiInput)
                 .before(super::control)
                 // Capture parks the camera itself (`capture::probe_cam`), and `control` is gated
                 // off there for the same reason; a queued view must not steal a parked pose.
@@ -630,8 +626,8 @@ mod tests {
     }
 
     /// **The weld** ([`crate::cvars`]'s own convention): every one of the sixteen names is
-    /// registered, with the reference's default string, and nothing here has drifted from the
-    /// table `is_view_cvar` answers from.
+    /// registered, with the reference's default string. No observer watches them — this module
+    /// is their writer, and the registry persists a host write on its own (2303).
     #[test]
     fn the_view_cvars_are_registered_with_the_references_defaults() {
         let registered = |name: &str| {
@@ -648,25 +644,8 @@ mod tests {
                     Some(VIEW_DEFAULTS[view][field]),
                     "{name} is not registered with its shipped default"
                 );
-                assert!(
-                    is_view_cvar(name),
-                    "{name} is not recognised as a view cvar"
-                );
-                assert!(
-                    is_view_cvar(&name.to_ascii_uppercase()),
-                    "{name} is case-sensitive"
-                );
             }
         }
         assert_eq!(registered(CVAR_ACTIVE_VIEW), Some(ACTIVE_VIEW_DEFAULT));
-        assert!(is_view_cvar(CVAR_ACTIVE_VIEW));
-        assert!(
-            !is_view_cvar("cameraDistanceMaxFactor"),
-            "the zoom ceiling is not a view"
-        );
-        assert!(
-            !is_view_cvar("cameraDistanceE"),
-            "there are only five views"
-        );
     }
 }
diff --git a/crates/benilla-app/src/player/controller.rs b/crates/benilla-app/src/player/controller.rs
index c2aa29d0..361dd2f8 100644
--- a/crates/benilla-app/src/player/controller.rs
+++ b/crates/benilla-app/src/player/controller.rs
@@ -20,7 +20,7 @@ use super::*;
 /// third-person control (WASD walks the avatar; right-drag turns it, left-drag orbits the camera,
 /// wheel zooms) and streams our movement to the server as the confirmed mover. The dev chord + `F`
 /// toggles free-fly (decision 1043).
-#[allow(clippy::too_many_arguments, clippy::type_complexity)]
+#[allow(clippy::type_complexity)]
 pub(super) fn control(
     time: Res<Time>,
     keys: Res<ButtonInput<KeyCode>>,
diff --git a/crates/benilla-app/src/player/embody.rs b/crates/benilla-app/src/player/embody.rs
index 6364029b..6e61ae8d 100644
--- a/crates/benilla-app/src/player/embody.rs
+++ b/crates/benilla-app/src/player/embody.rs
@@ -51,7 +51,6 @@ use crate::net::{ActiveMover, Embodied, GuidIndex, RemoteMotion, SelfGuid, SelfP
 ///
 /// Runs before the controller, which reads both to decide what — if anything — it is driving.
 // A Bevy system's parameter list, not an argument list.
-#[allow(clippy::too_many_arguments)]
 pub(super) fn maintain_embodiment(
     mut commands: Commands,
     mut player: ResMut<Player>,
diff --git a/crates/benilla-app/src/player/flags.rs b/crates/benilla-app/src/player/flags.rs
index 77a43f64..689901d0 100644
--- a/crates/benilla-app/src/player/flags.rs
+++ b/crates/benilla-app/src/player/flags.rs
@@ -33,7 +33,6 @@ pub(super) struct FrameFlags {
 /// Build this frame's two flag words. `swim` is `Some((fwd, side))` exactly while swimming — the
 /// netted swim amounts that actually drove the mover, so a rooted or key-cancelled swimmer cannot
 /// stream a phantom direction.
-#[allow(clippy::too_many_arguments)]
 pub(super) fn this_frame(
     player: &mut Player,
     axes: &input::MoveAxes,
diff --git a/crates/benilla-app/src/player/gait.rs b/crates/benilla-app/src/player/gait.rs
index c4e67f72..dd47d62f 100644
--- a/crates/benilla-app/src/player/gait.rs
+++ b/crates/benilla-app/src/player/gait.rs
@@ -37,7 +37,6 @@ use super::{Player, STATIONARY_CHASE_RATE};
 // default bound is seven. These are one frame of mover state, each read from a different one of
 // the caller's queries — bundling them into a struct would name nothing the call site does not
 // already say, and the gate is `-D warnings`, so the honest move is to say why, here.
-#[allow(clippy::too_many_arguments)]
 pub(super) fn drive_body_heading(
     player: &mut Player,
     move_flags_now: u32,
diff --git a/crates/benilla-app/src/player/land.rs b/crates/benilla-app/src/player/land.rs
index ef7b7124..8127284b 100644
--- a/crates/benilla-app/src/player/land.rs
+++ b/crates/benilla-app/src/player/land.rs
@@ -43,7 +43,6 @@ const LAND_TIMEOUT: f32 = 5.0;
 /// The land-here ask, and the re-attach that closes it. Runs before [`super::control`], so the
 /// frame that applies the teleport is the frame that takes third-person control again.
 // One system phase's input set, like the controller's own params.
-#[allow(clippy::too_many_arguments)]
 pub(crate) fn land_here(
     keys: Res<ButtonInput<KeyCode>>,
     time: Res<Time>,
diff --git a/crates/benilla-app/src/player/movement_net.rs b/crates/benilla-app/src/player/movement_net.rs
index cbb112b1..93756e30 100644
--- a/crates/benilla-app/src/player/movement_net.rs
+++ b/crates/benilla-app/src/player/movement_net.rs
@@ -147,7 +147,6 @@ pub(super) struct ArcEdges {
 /// heartbeat so next frame can diff against them.
 // Eight, down from twelve: the arc edges are one struct now (`ArcEdges`). The rest are distinct
 // types the compiler can tell apart, so the remaining count is noise rather than a miscount risk.
-#[allow(clippy::too_many_arguments)]
 pub(super) fn stream_self_movement(
     sender: &Sender<ClientCommand>,
     player: &mut Player,
diff --git a/crates/benilla-app/src/player/mover.rs b/crates/benilla-app/src/player/mover.rs
index c3ebca45..b8ba8078 100644
--- a/crates/benilla-app/src/player/mover.rs
+++ b/crates/benilla-app/src/player/mover.rs
@@ -111,7 +111,6 @@ pub(super) struct Outcome {
 /// Advance the player mover one frame: settle hold, ground classify, the slide, and the
 /// step-down snap. Writes `player.pos`/`vel_y`/`horiz_vel` (the settle *release* is the terrain
 /// streamer's — decision 0737).
-#[allow(clippy::too_many_arguments)]
 pub(super) fn step(
     player: &mut Player,
     time: &Time,
diff --git a/crates/benilla-app/src/player/posture.rs b/crates/benilla-app/src/player/posture.rs
index 0eddfe7f..d874f478 100644
--- a/crates/benilla-app/src/player/posture.rs
+++ b/crates/benilla-app/src/player/posture.rs
@@ -17,7 +17,6 @@ use super::{move_trace, state, BodyQuery, ClientCommand, NetCommands, Player, St
 /// Run this frame's stand-state decision and the sheath toggle, and return the **committed**
 /// stand state — the local commit overlaid on the server's echoed byte, which is what the body
 /// pose and the sheath guard both read (decision 0080c).
-#[allow(clippy::too_many_arguments)]
 pub(super) fn update(
     player: &mut Player,
     body: &BodyQuery,
diff --git a/crates/benilla-app/src/player/state.rs b/crates/benilla-app/src/player/state.rs
index cc7fce83..685377ce 100644
--- a/crates/benilla-app/src/player/state.rs
+++ b/crates/benilla-app/src/player/state.rs
@@ -1252,7 +1252,7 @@ impl Player {
     /// vector and the swim amounts but deliberately leaves turning live). What this exists for is
     /// the question a *log line* has to answer after a session boundary — "can the character that
     /// just entered the world be driven?" — which B306 proved nothing was asking: `scripts/smoke.sh`
-    /// has crossed `/logout` → re-enter on every run since 1291 while counting UI rebuilds, errors
+    /// has crossed `/logout` → re-enter on every run since 2277 while counting UI rebuilds, errors
     /// and shutdown writes, none of which a frozen character disturbs.
     ///
     /// It does **not** make the smoke a B306 regression: that run logs in as a GM probe, so vmangos
diff --git a/crates/benilla-app/src/player/step_probe.rs b/crates/benilla-app/src/player/step_probe.rs
index b5b37d20..37998d1c 100644
--- a/crates/benilla-app/src/player/step_probe.rs
+++ b/crates/benilla-app/src/player/step_probe.rs
@@ -86,7 +86,6 @@ pub(crate) fn latest() -> (Vec<String>, f32) {
 /// `from`/`to` are the capsule centre either side of [`super::mover::grounded_step`] — the walk
 /// resolve alone, before the hover climb and the water-walk clamp, both of which move the body for
 /// reasons that have nothing to do with a kerb.
-#[allow(clippy::too_many_arguments)]
 pub(super) fn watch(
     world: &benilla_world::collision::WorldCollision<'_, '_>,
     capsule: &Collider,
diff --git a/crates/benilla-app/src/player/swim.rs b/crates/benilla-app/src/player/swim.rs
index 45afce86..5ce30573 100644
--- a/crates/benilla-app/src/player/swim.rs
+++ b/crates/benilla-app/src/player/swim.rs
@@ -495,7 +495,6 @@ pub(super) struct SwimFrame {
 /// `basis` is the **level** facing pair `(forward, right)`; `amounts` the netted `(fwd, side)`
 /// swim translation ([`translate_amounts`]); `wobble` this frame's drunk angle, already zeroed by
 /// the caller when it must not apply (sober, stunned, or not translating).
-#[allow(clippy::too_many_arguments)]
 pub(super) fn drive_step(
     player: &mut Player,
     time: &Time,
diff --git a/crates/benilla-app/src/player/wire_in.rs b/crates/benilla-app/src/player/wire_in.rs
index a4e5f2fe..efe10d09 100644
--- a/crates/benilla-app/src/player/wire_in.rs
+++ b/crates/benilla-app/src/player/wire_in.rs
@@ -106,7 +106,7 @@ fn control_verdict(mover: u64, allow_move: bool, self_guid: Option<u64>) -> Cont
 /// snap target).
 // One system phase's full input set (the spawner precedent); the transports query type is
 // `control`'s own param shape passed through.
-#[allow(clippy::too_many_arguments, clippy::type_complexity)]
+#[allow(clippy::type_complexity)]
 pub(super) fn apply_server_moves(
     time: &Time,
     commands: &mut Commands,
diff --git a/crates/benilla-app/src/portrait/booth.rs b/crates/benilla-app/src/portrait/booth.rs
index 2c8846ba..22c5f472 100644
--- a/crates/benilla-app/src/portrait/booth.rs
+++ b/crates/benilla-app/src/portrait/booth.rs
@@ -36,6 +36,30 @@ pub(super) struct BoothPart {
     /// the char composite's quint); the booth relights them beside the steady one and hands them
     /// here. `None` for a batch that cannot feather at all — the reference's own twin gate.
     pub(super) twins: BoothTwins,
+    /// Whether this batch's material was put on the **UV / tint lane** by the builder that made it
+    /// — i.e. whether [`benilla_world::doodad_anim::AnimMatPart`] belongs on the spawned child.
+    ///
+    /// **A statement about what was registered, never a re-test of the asset** (decision 2295's
+    /// lesson, 2038's bug class before it): the marker and the registration have to be one fact,
+    /// or the draw gate marks batches nothing samples — or samples batches it never marks, which
+    /// froze every waterfall in the game for three days.
+    ///
+    /// `false` for every booth but the **glue create / main-menu scene**. A portrait or
+    /// dressing-room bake is a still by design (0130's bake law — it photographs one instant);
+    /// the create screen is a live render, and the reference animates a texture transform inside
+    /// the per-model-per-frame animate kernel (`0x715f25`-`0x7163bc` over `md+0x74`, wow-re
+    /// `modelframe-texanim-and-sequence-law.md` §3.1), which is not a lane a host opts into.
+    pub(super) mat_anim: bool,
+}
+
+/// Put the draw gate's marker on a booth child when — and only when — its material went onto the
+/// UV / tint lane ([`BoothPart::mat_anim`]). `tick_anim_materials` writes a registered row only for
+/// a material some marked, visible part draws (decision 1375), so a registered booth batch that
+/// nobody marks stays frozen at its seed with a live table row behind it.
+fn mark_mat_anim(child: &mut bevy::ecs::system::EntityCommands<'_>, p: &BoothPart) {
+    if p.mat_anim {
+        child.insert(benilla_world::doodad_anim::AnimMatPart);
+    }
 }
 
 /// A batch's translucency twins as the bake sees them — see [`BoothPart::twins`]. Default (both
@@ -499,7 +523,6 @@ pub(super) enum BoothMotion {
 ///
 /// Returns the [`BoothRig`] handle — seat any remaining consumers on it (the effect hosts, the
 /// glue scene's emitters), then `finish()` it.
-#[allow(clippy::too_many_arguments)]
 pub(super) fn spawn_booth_model(
     commands: &mut Commands,
     palettes: &mut benilla_world::rig_palette::RigPalettes,
@@ -541,6 +564,7 @@ pub(super) fn spawn_booth_model(
                 layer.clone(),
                 ChildOf(root),
             ));
+            mark_mat_anim(&mut child, p);
             // The authored material alpha reaches the boneless bake too — it is a property of the
             // batch, not of the rig. The INSTANCE alpha multiplies into it, the reference's
             // `model+0x180 × the batch factor` (`0x707680`).
@@ -645,6 +669,7 @@ pub(super) fn spawn_booth_model(
             layer.clone(),
             ChildOf(root),
         ));
+        mark_mat_anim(&mut child, p);
         // The batch's authored material alpha, sampled onto the render-alpha tag field — the same
         // `MatAnim` the world lanes use, in its self-driving form (`drives_tag`: nothing else writes
         // a booth part's alpha). The rig field rides the same tag, so compose rather than overwrite;
@@ -867,7 +892,7 @@ fn arm_turn(
     player: &mut AnimationPlayer,
     anims: &benilla_assets::ModelAnimations,
     catalog: &benilla_formats::AnimDataCatalog,
-    rng: &mut u32,
+    rng: &mut benilla_assets::AnimRng,
     turn: &mut super::Turn,
     id: u16,
     now: f64,
@@ -882,8 +907,7 @@ fn arm_turn(
     if res.id != id {
         return false;
     }
-    let Some(clip) = anims.pick_variation(res.id, crate::creature_anim::select::msvc_rand(rng))
-    else {
+    let Some(clip) = anims.pick_variation(res.id, rng.draw()) else {
         return false;
     };
     let (node, looping, blend) = (clip.node, clip.looping, clip.blend_time.max(0.0));
@@ -984,7 +1008,7 @@ pub(super) fn drive_booth_turn(
     // The variation roll's state — the reference passes variation `-1` to `0x7121a0`, which is
     // "frequency-weighted random" off the CRT LCG (`0x71249a call 0x7400e5`). Same generator the
     // world lane's picks use, so a doll and a world unit roll their idles alike.
-    mut rng: Local<u32>,
+    mut rng: ResMut<benilla_assets::AnimRng>,
 ) {
     let Some(anim_data) = anim_data.as_deref() else {
         return;
@@ -1017,7 +1041,7 @@ fn step_turn(
     player: &mut AnimationPlayer,
     anims: &benilla_assets::ModelAnimations,
     catalog: &benilla_formats::AnimDataCatalog,
-    rng: &mut u32,
+    rng: &mut benilla_assets::AnimRng,
     turn: &mut super::Turn,
     now: f64,
 ) {
@@ -1427,6 +1451,7 @@ mod tests {
                 material: Handle::default(),
                 alpha_anim: None,
                 twins: BoothTwins::default(),
+                mat_anim: false,
             },
             BoothPart {
                 skinned: None,
@@ -1434,6 +1459,7 @@ mod tests {
                 material: Handle::default(),
                 alpha_anim: None,
                 twins: BoothTwins::default(),
+                mat_anim: false,
             },
         ];
 
@@ -1653,7 +1679,7 @@ mod tests {
             turning_model(),
             benilla_formats::AnimDataCatalog::from_rows([]),
         );
-        let (mut player, mut rng) = (baked(), 0u32);
+        let (mut player, mut rng) = (baked(), benilla_assets::AnimRng::default());
         let mut turn = super::super::Turn {
             // Arrow down. The shuffle is armed but contributes NOTHING yet.
             spun: Some(SHUFFLE_LEFT),
@@ -1730,7 +1756,7 @@ mod tests {
         );
 
         // Reverse at 0.1 s of a 0.25 s blend — 60% still to run, λ = 0.648. REFUSED.
-        let (mut player, mut rng) = (baked(), 0u32);
+        let (mut player, mut rng) = (baked(), benilla_assets::AnimRng::default());
         let mut turn = super::super::Turn {
             spun: Some(SHUFFLE_LEFT),
             ..Default::default()
@@ -1757,7 +1783,7 @@ mod tests {
         assert_eq!(turn.shuffle.map(|(id, _)| id), Some(SHUFFLE_RIGHT));
 
         // Reverse at 0.2 s instead — 20% still to run, λ = 0.104. The slot is taken.
-        let (mut player, mut rng) = (baked(), 0u32);
+        let (mut player, mut rng) = (baked(), benilla_assets::AnimRng::default());
         let mut turn = super::super::Turn {
             spun: Some(SHUFFLE_LEFT),
             ..Default::default()
@@ -1785,7 +1811,7 @@ mod tests {
             turning_model(),
             benilla_formats::AnimDataCatalog::from_rows([]),
         );
-        let (mut player, mut rng) = (baked(), 0u32);
+        let (mut player, mut rng) = (baked(), benilla_assets::AnimRng::default());
         let mut turn = super::super::Turn {
             spun: Some(SHUFFLE_LEFT),
             ..Default::default()
@@ -1834,7 +1860,7 @@ mod tests {
             usize::from(SHUFFLE_RIGHT) + 1
         ];
         let catalog = benilla_formats::AnimDataCatalog::from_rows([]);
-        let (mut player, mut rng) = (baked(), 0u32);
+        let (mut player, mut rng) = (baked(), benilla_assets::AnimRng::default());
         let mut turn = super::super::Turn::default();
         for t in [1.0, 1.1, 1.2, 2.0] {
             turn.spun = Some(SHUFFLE_LEFT);
diff --git a/crates/benilla-app/src/portrait/dressup.rs b/crates/benilla-app/src/portrait/dressup.rs
index f53eb03e..8969dc05 100644
--- a/crates/benilla-app/src/portrait/dressup.rs
+++ b/crates/benilla-app/src/portrait/dressup.rs
@@ -184,7 +184,6 @@ pub(super) fn spawn_dressup_booth(
 /// differs from the paper doll is only where the parts come from (a bake resource, not a live
 /// unit's children) and the hand grip — the assembly holds the weapons, so the hands close on them
 /// (wow-re `hand-grip-mechanism.md`).
-#[allow(clippy::too_many_arguments)]
 pub(super) fn sync_dressup_booth(
     mut commands: Commands,
     preview: Res<DressUpPreview>,
@@ -267,6 +266,7 @@ pub(super) fn sync_dressup_booth(
                 // `None` — the same known gap as the glue preview's (decision 0807).
                 alpha_anim: None,
                 twins: BoothTwins::default(),
+                mat_anim: false,
             })
             .collect();
         let booth_riders: Vec<BoothRider> = bake
diff --git a/crates/benilla-app/src/portrait/glue_booth.rs b/crates/benilla-app/src/portrait/glue_booth.rs
index 1ed92ba4..fe45ec9d 100644
--- a/crates/benilla-app/src/portrait/glue_booth.rs
+++ b/crates/benilla-app/src/portrait/glue_booth.rs
@@ -837,7 +837,7 @@ pub(super) fn sync_glue_ffx(
 /// seat the character on the stage spot, and hold the booth camera on the scene's authored camera 0
 /// — every frame, so the per-bake body framing from [`sync_glue_booth`] never wins while a scene
 /// shows. Leaving the screen (`look: None`) tears the scene down and restores the square target.
-#[allow(clippy::too_many_arguments, clippy::type_complexity)]
+#[allow(clippy::type_complexity)]
 pub(super) fn sync_glue_scene(
     mut commands: Commands,
     preview: Res<GluePreview>,
@@ -862,13 +862,30 @@ pub(super) fn sync_glue_scene(
         ResMut<benilla_world::model_forms::ModelForms>,
         ResMut<Assets<Mesh>>,
         ResMut<benilla_world::instance_tint::InstanceTintMirrors>,
+        // …and the scene's **material-animation lane**: the UV and tint registries and the shared
+        // delta table its samples land in (decisions 1381/2295). Here rather than beside, for the
+        // same ceiling — the param list is already full.
+        ResMut<benilla_world::doodad_anim::UvAnimMaterials>,
+        ResMut<benilla_world::doodad_anim::TintAnimMaterials>,
+        ResMut<benilla_world::mat_anim_table::MatAnimTable>,
+        ResMut<benilla_world::mat_anim_table::MatAnimMirrors>,
     ),
     // The swap gate's two inputs ([`PendingSwap`]) — the character assembly this stage must land
     // beside, and the real clock its bound is measured on. One tuple param: the 16-SystemParam
     // ceiling, same reason as `particle_assets` above.
     swap: (Res<GluePreviewBake>, Res<Time<bevy::time::Real>>),
 ) {
-    let (mut palettes, mut mirrors, mut forms, mut mesh_assets, mut tint_mirrors) = particle_assets;
+    let (
+        mut palettes,
+        mut mirrors,
+        mut forms,
+        mut mesh_assets,
+        mut tint_mirrors,
+        mut uv_reg,
+        mut tint_reg,
+        mut anim_table,
+        mut anim_mirrors,
+    ) = particle_assets;
     let (bake, real) = swap;
     let Some(booth) = booths.0.get(GLUE_SLOT) else {
         return;
@@ -1060,6 +1077,18 @@ pub(super) fn sync_glue_scene(
         // is the one off-world buffer that carries it — see
         // [`benilla_world::instance_tint::InstanceTintMirrors`] for why the portrait booths do not.
         tint_mirrors.0.insert("glue_scene", light.clone());
+        // …and the **mat-anim delta table** beside them (decisions 1381/2023): the scene's
+        // materials sample `matanim[slot]` out of THIS buffer, so registering a batch's loop is
+        // only half the act — without the mirror the rows are written every frame into a region
+        // only the world's materials ever read, and the scene samples its zero-initialised
+        // identity. That is verbatim 2023's cooldown-sweep failure, and it is what an A/B of this
+        // screen with the lane frozen against the lane running showed: byte-identical images,
+        // with 2 of UI_Human's 29 batches registered and marked.
+        //
+        // The portrait booths stay off this list on purpose ([`MatAnimMirrors`]'s own note): a
+        // bake photographs one instant, and its studio buffer's zeroed region IS that instant.
+        // The create screen is not a bake.
+        anim_mirrors.0.insert("glue_scene", light.clone());
         blob.write(&queue, &light);
         scene.fog = fog;
         scene.ghost = ghost;
@@ -1095,6 +1124,49 @@ pub(super) fn sync_glue_scene(
                 // and its street tied, and the tie re-broke every frame.
                 let order = u16::try_from(pi + 1).unwrap_or(u16::MAX);
                 let material = mats.off_world(s, s.texture.clone(), order, &light, true);
+                // **The scene's texture transforms and M2Color tint actually run** — the clouds
+                // drift, the water and lava creep, the fire sheets scroll. `off_world(rig: true)`
+                // has always *seeded* the UV at `sample(0.0)`, but seeding is not playing: nothing
+                // outside the world streamer, the entity dressing path and the effect lane had
+                // ever been registered, so every one of these froze on its first key while the
+                // comment above claimed they scrolled.
+                //
+                // Not a bake question, which is why it is decided here rather than deferred to
+                // 0130's bake law: a create/main-menu screen is a LIVE render, and the reference
+                // runs the texture transform inside the per-model-per-frame animate kernel
+                // (`0x715f25`-`0x7163bc` over the MD20 `+0x74` table, wow-re
+                // `modelframe-texanim-and-sequence-law.md` §3.1) — it is what an animated CM2Model
+                // does, not a lane a host opts into. The portrait and dressing-room bakes are the
+                // opposite case and stay still (`BoothPart::mat_anim`).
+                //
+                // **Shared lane only, and that is measured, not assumed** (`benilla-extract
+                // uvslotscan interface\glues`): 13 models, 261 batches, **15 live UV loops over 6
+                // models and 2 live RGB**, and PER-PLACEMENT is empty on both channels — every
+                // glue batch bakes one loop across its slots, so there is no sequence to key by
+                // and `host: None` is exact rather than a fallback.
+                let loops = benilla_world::doodad_anim::UvLoops::of(s);
+                let mut mat_anim = false;
+                if loops.animates() {
+                    benilla_world::doodad_anim::register_entity_uv(
+                        &mut uv_reg,
+                        &mut anim_table,
+                        mats.materials(),
+                        material.id(),
+                        &loops,
+                        None,
+                    );
+                    mat_anim = true;
+                }
+                if let Some(rgb) = s.rgb_anim.as_ref().filter(|a| a.period > 0.0) {
+                    benilla_world::doodad_anim::register_tint(
+                        &mut tint_reg,
+                        &mut anim_table,
+                        mats.materials(),
+                        material.id(),
+                        benilla_world::doodad_anim::TintLoop::Shared(rgb.clone()),
+                    );
+                    mat_anim = true;
+                }
                 BoothPart {
                     skinned: skin_forms.get(pi).cloned(),
                     static_mesh: stat_forms
@@ -1108,9 +1180,15 @@ pub(super) fn sync_glue_scene(
                     // corners — B121.
                     alpha_anim: s.alpha_anim.clone(),
                     twins: BoothTwins::default(),
+                    mat_anim,
                 }
             })
             .collect();
+        info!(
+            "create scene: UI_{token} material lane — {} of {} batches animate (UV/tint registered)",
+            scene_parts.iter().filter(|p| p.mat_anim).count(),
+            scene_parts.len(),
+        );
         let mut scene_rig = spawn_booth_model(
             &mut commands,
             &mut palettes,
@@ -1318,7 +1396,6 @@ fn resize_target(images: &mut Assets<Image>, target: &Handle<Image>, w: u32, h:
 /// the select screen's hardcoded weather-sun is the in-flight §5's to settle, decision 0465 §5),
 /// the studio buffer otherwise — pose a fresh Stand-**looping** instance with the riders on its
 /// joints, and frame it full-body.
-#[allow(clippy::too_many_arguments)]
 pub(super) fn sync_glue_booth(
     mut commands: Commands,
     preview: Res<GluePreview>,
@@ -1458,6 +1535,7 @@ pub(super) fn sync_glue_booth(
                 // previews at 1.0 here. Closing it means threading `alpha_anim` through the
                 // appearance-assembly layer — deliberately not folded into the B121 fix.
                 alpha_anim: None,
+                mat_anim: false,
             });
         }
         // The equipment riders (a Select look — helm/shoulders/sheathed weapons, decision 0465):
@@ -1643,7 +1721,6 @@ pub(super) fn sync_glue_booth(
 /// **Not yaw-driven.** Dragging the character spins the character: the reference's facing call
 /// (`0x4730e0`) writes the character component's model transform and nothing else, and both scene
 /// attachments are parentless unkeyed pivots, so the pet keeps the seat's own orientation.
-#[allow(clippy::too_many_arguments)]
 pub(super) fn sync_glue_pet(
     mut commands: Commands,
     pet: Res<GluePetBake>,
@@ -1704,6 +1781,7 @@ pub(super) fn sync_glue_pet(
             material: relight(&p.material, &mut scene.variants),
             alpha_anim: p.alpha_anim.clone(),
             twins: BoothTwins::default(),
+            mat_anim: false,
         })
         .collect();
     let booth_billboards: Vec<BoothBillboardSpec> = pet
diff --git a/crates/benilla-app/src/portrait/mod.rs b/crates/benilla-app/src/portrait/mod.rs
index 1edf2e3a..ca5e38ab 100644
--- a/crates/benilla-app/src/portrait/mod.rs
+++ b/crates/benilla-app/src/portrait/mod.rs
@@ -224,12 +224,19 @@ pub(super) const DRESSUP_LAYER: usize = GLUE_LAYER + 1;
 /// rule as [`GLUE_LAYER`]). This camera exists only while the warm pass runs
 /// ([`spawn_warm_booth`]); nothing but menagerie rigs ever rides its layer.
 pub(crate) const WARM_BOOTH_LAYER: usize = DRESSUP_LAYER + 1;
+/// pipe_warm's **orthographic twin camera**'s layer ([`crate::ui_models::spawn_warm_tile_cam`],
+/// decision 2262) — the next one past the twin booth's, same ladder rule. bevy_pbr keys a mesh
+/// pipeline on the view's projection CLASS, and the tile atlas's one camera is
+/// `Projection::Orthographic`: a THIRD class beside the world camera's Perspective and the twin
+/// booth's custom `WowPortraitProjection`. Like [`WARM_BOOTH_LAYER`] this camera exists only while
+/// the warm pass runs, and nothing but menagerie rigs ever rides its layer.
+pub(crate) const WARM_ORTHO_LAYER: usize = WARM_BOOTH_LAYER + 1;
 /// The **minimap interior composite**'s render layer (decision 1466) — the next one past the warm
 /// booth's. Not a portrait booth, but it is an offscreen camera with its own layer, and 0775's rule
 /// is that EVERY such layer is computed in this one ladder: the two booths that each worked out
 /// "the next layer past the paper doll's" in their own file landed on the same number, and the
 /// clash was silent in both rendering and the emitter→camera match.
-pub(crate) const MINIMAP_COMPOSITE_LAYER: usize = WARM_BOOTH_LAYER + 1;
+pub(crate) const MINIMAP_COMPOSITE_LAYER: usize = WARM_ORTHO_LAYER + 1;
 /// The UI model tiles' layer (`crate::ui_models`, decision 2008): every `<Model>` widget's M2
 /// renders into one atlas through one camera on this layer.
 pub(crate) const UI_MODELS_LAYER: usize = MINIMAP_COMPOSITE_LAYER + 1;
@@ -262,7 +269,8 @@ const _: () = assert!(
         && INSPECT_LAYER != GLUE_LAYER
         && DRESSUP_LAYER > GLUE_LAYER
         && WARM_BOOTH_LAYER > DRESSUP_LAYER
-        && MINIMAP_COMPOSITE_LAYER > WARM_BOOTH_LAYER
+        && WARM_ORTHO_LAYER > WARM_BOOTH_LAYER
+        && MINIMAP_COMPOSITE_LAYER > WARM_ORTHO_LAYER
         && UI_MODELS_LAYER > MINIMAP_COMPOSITE_LAYER
         && UI_MODEL_CAM_LAYER_BASE > UI_MODELS_LAYER,
     "booth render layers must be distinct — see GLUE_LAYER"
@@ -1196,11 +1204,19 @@ pub(crate) struct BoothFraming<'w> {
 /// Owns the portrait bake pipeline: the [`PortraitImages`] bridge + the per-slot off-screen booths.
 pub(crate) struct PortraitPlugin;
 
+/// The body panes' half-rate switch's change callback (1444, 2303): a flag.
+pub(crate) fn on_cvar(ev: On<crate::cvars::CvarChanged>, mut rate: ResMut<PaneRate>) {
+    if ev.is("boothHalfRate") {
+        rate.half = ev.flag();
+    }
+}
+
 impl Plugin for PortraitPlugin {
     fn build(&self, app: &mut App) {
         app.init_resource::<PortraitImages>()
             .init_resource::<PortraitBakes>()
             .init_resource::<PaneRate>()
+            .add_observer(on_cvar)
             .init_resource::<PaperDollBooth>()
             .init_resource::<InspectBooth>()
             .init_resource::<PetDollBooth>()
@@ -1388,7 +1404,6 @@ pub(crate) fn spawn_warm_booth(
 /// Startup: stand up one booth per slot — its image (registered in [`PortraitImages`]), a model-root
 /// entity, and a camera rendering only that slot's layer into the image (transparent, no bloom/MSAA,
 /// rendered before the world camera via a negative order).
-#[allow(clippy::too_many_arguments)]
 fn setup_booths(
     mut commands: Commands,
     mut images: ResMut<Assets<Image>>,
@@ -1684,7 +1699,6 @@ impl SnapKey {
     /// Build the key for `unit`'s pane this frame. `dress`/`rev` are the unit's own components
     /// (absent until its equipment first resolves, which is simply another value); `show` and
     /// `aspect` are the booth's.
-    #[allow(clippy::too_many_arguments)]
     fn build(
         unit: Entity,
         parts: &[&PortraitPart],
@@ -1895,7 +1909,6 @@ impl DressedLook<'_, '_> {
 /// [`PortraitPart`] children — into the booth whenever that look changes (new unit, gear swap,
 /// appearance refresh), re-framing the camera from the display's anchors. A live unit whose model
 /// hasn't attached yet shows the ref's 2D `TemporaryPortrait` stand-in instead (RE C5).
-#[allow(clippy::too_many_arguments)]
 fn sync_portraits(
     mut commands: Commands,
     mut booths: ResMut<Booths>,
@@ -2118,6 +2131,7 @@ fn sync_portraits(
                     // mirrored `PortraitPart` doesn't carry the batch's alpha loops.
                     alpha_anim: None,
                     twins: BoothTwins::default(),
+                    mat_anim: false,
                 })
                 .collect();
             let booth_riders: Vec<BoothRider> = riders
@@ -2237,7 +2251,6 @@ fn sync_portraits(
 /// pane showing, a change of dress, an explicit model event, a resize. Mirroring live put a bow
 /// drawn in combat straight onto the character sheet (`#bugs` B324); [`SnapKey`] carries the whole
 /// law and its byte provenance.
-#[allow(clippy::too_many_arguments)]
 fn sync_paperdoll(
     mut commands: Commands,
     mut booths: ResMut<Booths>,
@@ -2282,7 +2295,6 @@ fn sync_paperdoll(
 
 /// The inspect window's model pane (decision 0631 §4) — the paper doll's exact twin, pointed at
 /// whichever unit [`crate::ui_inspect`] resolved this frame instead of at the self player.
-#[allow(clippy::too_many_arguments)]
 fn sync_inspect_booth(
     mut commands: Commands,
     mut booths: ResMut<Booths>,
@@ -2326,7 +2338,6 @@ fn sync_inspect_booth(
 
 /// The pet paper doll's model pane (decision 1057) — the inspect pane's exact twin, pointed at the
 /// pet [`crate::ui_pet_doll`] resolved this frame.
-#[allow(clippy::too_many_arguments)]
 fn sync_petdoll_booth(
     mut commands: Commands,
     mut booths: ResMut<Booths>,
@@ -2455,7 +2466,6 @@ fn sync_stable_standin(
 /// subject entity. So this is [`sync_petdoll_booth`] with one `or` — which is the point of the
 /// stand-in: the summoned pet and the stabled pet reach the same bake through the same code, and so
 /// cannot drift apart in framing, lighting, animation or settle.
-#[allow(clippy::too_many_arguments)]
 fn sync_stable_booth(
     mut commands: Commands,
     mut booths: ResMut<Booths>,
@@ -2506,7 +2516,6 @@ fn sync_stable_booth(
 /// `unit` is a **subject**, not necessarily a world unit: a [`PortraitStandIn`] mirrors the same
 /// way and carries its own display id, which is how the stable pane draws a pet that has no object
 /// anywhere ([`StableBooth`]).
-#[allow(clippy::too_many_arguments)]
 fn sync_body_booth(
     palettes: &mut benilla_world::rig_palette::RigPalettes,
     slot: &str,
@@ -2636,6 +2645,7 @@ fn sync_body_booth(
                 // `None` — the same known gap as the glue preview's (decision 0807).
                 alpha_anim: None,
                 twins: BoothTwins::default(),
+                mat_anim: false,
             })
             .collect();
         let booth_riders: Vec<BoothRider> = riders
@@ -2829,7 +2839,6 @@ fn pipe_settle(compiling: bool, wake_drained: bool, held_for: f64) -> PipeSettle
 /// The pipeline warm pass is demand too (decision 0938): its menagerie duplicates rigs onto a
 /// booth layer so the booths' `Msaa::Off` pipeline twins compile behind the entry cover — which
 /// only works if the booth cameras render during the warm window.
-#[allow(clippy::too_many_arguments)] // a Bevy system: each param is one resource/query
 fn gate_booth_cameras(
     mut commands: Commands,
     mut booths: ResMut<Booths>,
diff --git a/crates/benilla-app/src/portrait/test_bake.rs b/crates/benilla-app/src/portrait/test_bake.rs
index a4c388ba..9a697e16 100644
--- a/crates/benilla-app/src/portrait/test_bake.rs
+++ b/crates/benilla-app/src/portrait/test_bake.rs
@@ -14,7 +14,6 @@ use benilla_assets::m2_url;
 
 /// The debug bake driver: when `WOW_PORTRAIT_TEST` is set, bake the named model into every slot once
 /// it loads, and own the booths (the live sync yields). See [`bake_test`].
-#[allow(clippy::too_many_arguments)]
 pub(super) fn sync_test_portraits(
     mut commands: Commands,
     booths: Res<Booths>,
@@ -58,7 +57,6 @@ pub(super) fn sync_test_portraits(
 /// → the muted fallback) into every slot and frame each camera. A pipeline eyeball only — no skins, no
 /// cache. Returns `true` once the model has loaded + a light buffer exists and it's baked (the caller
 /// then stops re-baking).
-#[allow(clippy::too_many_arguments)]
 fn bake_test(
     commands: &mut Commands,
     palettes: &mut benilla_world::rig_palette::RigPalettes,
@@ -131,6 +129,7 @@ fn bake_test(
                     // right here — an eyeball bake should show the batch dimming the artist wrote.
                     alpha_anim: s.alpha_anim.clone(),
                     twins: BoothTwins::default(),
+                    mat_anim: false,
                 })
                 .collect::<Vec<BoothPart>>()
         };
diff --git a/crates/benilla-app/src/preflight.rs b/crates/benilla-app/src/preflight.rs
index d955fead..b1d42ca4 100644
--- a/crates/benilla-app/src/preflight.rs
+++ b/crates/benilla-app/src/preflight.rs
@@ -249,7 +249,6 @@ struct Preflight {
 }
 
 /// Wait for the self descriptor after each world entry, then print the banner once.
-#[allow(clippy::too_many_arguments)]
 fn report_session(
     mut state: ResMut<Preflight>,
     mut entered: MessageReader<EnteredWorldMessage>,
diff --git a/crates/benilla-app/src/probe_shield.rs b/crates/benilla-app/src/probe_shield.rs
index d4579984..c98c5e6a 100644
--- a/crates/benilla-app/src/probe_shield.rs
+++ b/crates/benilla-app/src/probe_shield.rs
@@ -229,7 +229,6 @@ fn god_verdict(text: &str) -> Option<bool> {
 
 /// Arm the shield on every world entry, confirm it against the server's own answer, and put it
 /// back up whenever something drops it.
-#[allow(clippy::too_many_arguments)]
 fn drive_shield(
     mut shield: ResMut<ProbeShield>,
     mut entered: MessageReader<EnteredWorldMessage>,
diff --git a/crates/benilla-app/src/query_cache.rs b/crates/benilla-app/src/query_cache.rs
new file mode 100644
index 00000000..d984c4b8
--- /dev/null
+++ b/crates/benilla-app/src/query_cache.rs
@@ -0,0 +1,242 @@
+//! **`QueryCache<K, V>` — the one ask-once cache** (decision 2288; 2265 §A4).
+//!
+//! The reference has one `DBCache<T>` (wow-re `system/dbcache/dbcache.md`): a consumer's miss
+//! sends the query and queues a callback; a second lookup of a pending key appends a callback
+//! instead of re-sending; the response handler writes the record and fires the callbacks;
+//! eviction is explicit only. benilla had that machine hand-copied across eight modules under
+//! three names for the in-flight set (`pending`, `querying`, `queried`), the miss and the
+//! landing bodies pasted ("the exact twin of `NameCache`"), and the release that keeps an ask
+//! sent before the writer thread exists from latching its key for the process lifetime written
+//! for two of the eight.
+//!
+//! **The read that asks takes `&self`.** A miss marks itself in a lock-guarded set and sends
+//! its query; the answered map does not move. That is the reason for a type over the copies: a
+//! system that only *reads* a name or a template holds the owning resource shared, so two such
+//! systems no longer conflict over it — 2287's "pure cache" class measured 556 such undeclared
+//! orders — and Bevy's change detection on the owner means "an answer landed" again instead of
+//! "someone looked" (the two hand-rolled epochs in `items.rs` were written because it did not).
+//!
+//! A negative answer is cached as `None` (the server's high-bit miss), so a dead key is never
+//! re-asked; [`QueryCache::answered_unknown`] is for the consumer that waits (the cast-fail
+//! redisplay, decision 0552) to know when to stop.
+
+use std::collections::{HashMap, HashSet};
+use std::hash::Hash;
+use std::sync::Mutex;
+
+use benilla_assets::LockRecover;
+use bevy::prelude::*;
+
+use crate::net::EnteredWorldMessage;
+
+pub(crate) struct QueryCache<K, V> {
+    answered: HashMap<K, Option<V>>,
+    /// The keys in flight. Behind a lock so the read that asks is `&self`; uncontended by
+    /// construction (every holder runs on the main thread under the single-threaded executor,
+    /// and a miss is the rare path).
+    pending: Mutex<HashSet<K>>,
+    /// Bumped by every landing, positive or negative — the broadcast a consumer that caches a
+    /// view derived from an answer keys on (the reference's `DBCACHECALLBACK` redisplay, 0660).
+    generation: u64,
+}
+
+impl<K: Copy + Eq + Hash, V> Default for QueryCache<K, V> {
+    fn default() -> Self {
+        Self {
+            answered: HashMap::new(),
+            pending: Mutex::new(HashSet::new()),
+            generation: 0,
+        }
+    }
+}
+
+impl<K: Copy + Eq + Hash, V> QueryCache<K, V> {
+    /// The answer for `key` if the server has given one. `None` for a miss — which runs `ask`
+    /// once per key per connection — and for a cached negative alike.
+    pub(crate) fn get_or_ask(&self, key: K, ask: impl FnOnce()) -> Option<&V> {
+        match self.answered.get(&key) {
+            Some(answer) => answer.as_ref(),
+            None => {
+                if self.pending.lock_recover().insert(key) {
+                    ask();
+                }
+                None
+            }
+        }
+    }
+
+    /// The read-only twin: the answer if it is already here, and never an ask.
+    pub(crate) fn get(&self, key: K) -> Option<&V> {
+        self.answered.get(&key)?.as_ref()
+    }
+
+    /// The answer for `key`, mutably — for a record the wire patches in place after it landed
+    /// (a guild's rank rename, a petition's new title). Never an ask.
+    pub(crate) fn get_mut(&mut self, key: K) -> Option<&mut V> {
+        self.answered.get_mut(&key)?.as_mut()
+    }
+
+    /// Has the server answered `key` at all — with a record or with "unknown"?
+    pub(crate) fn answered(&self, key: K) -> bool {
+        self.answered.contains_key(&key)
+    }
+
+    /// Has the server answered `key` with "unknown"? Distinct from a still-pending ask, which
+    /// reads `None` from [`Self::get_or_ask`] too.
+    pub(crate) fn answered_unknown(&self, key: K) -> bool {
+        self.answered.get(&key).is_some_and(Option::is_none)
+    }
+
+    #[cfg(test)]
+    /// Is an ask for `key` in flight?
+    pub(crate) fn is_pending(&self, key: K) -> bool {
+        self.pending.lock_recover().contains(&key)
+    }
+
+    /// Land an answer; `None` is the server's negative.
+    pub(crate) fn insert(&mut self, key: K, answer: Option<V>) {
+        self.pending
+            .get_mut()
+            .unwrap_or_else(|p| p.into_inner())
+            .remove(&key);
+        self.answered.insert(key, answer);
+        self.generation = self.generation.wrapping_add(1);
+    }
+
+    /// The reference's explicit eviction (a high-bit key, `SMSG_INVALIDATE_PLAYER`): the next
+    /// read anywhere re-asks. Returns whether there was anything to evict.
+    pub(crate) fn evict(&mut self, key: K) -> bool {
+        self.pending
+            .get_mut()
+            .unwrap_or_else(|p| p.into_inner())
+            .remove(&key);
+        let was = self.answered.remove(&key).is_some();
+        if was {
+            self.generation = self.generation.wrapping_add(1);
+        }
+        was
+    }
+
+    /// Forget the in-flight asks — a disconnect may have dropped them on the writer floor, and
+    /// an ask sent before the writer existed never left at all. [`register`] runs this on every
+    /// world entry for every cache that registers.
+    pub(crate) fn clear_pending(&mut self) {
+        self.pending
+            .get_mut()
+            .unwrap_or_else(|p| p.into_inner())
+            .clear();
+    }
+
+    /// Drop everything, answers included (a session-scoped cache on disconnect).
+    pub(crate) fn clear(&mut self) {
+        self.answered.clear();
+        self.clear_pending();
+    }
+
+    /// The landing counter — see the field.
+    pub(crate) fn generation(&self) -> u64 {
+        self.generation
+    }
+
+    /// Every answered key with its answer (a persisted cache's save walks this).
+    pub(crate) fn iter(&self) -> impl Iterator<Item = (&K, &Option<V>)> {
+        self.answered.iter()
+    }
+
+    pub(crate) fn len(&self) -> usize {
+        self.answered.len()
+    }
+
+    #[cfg(test)]
+    pub(crate) fn is_empty(&self) -> bool {
+        self.answered.is_empty()
+    }
+}
+
+/// A resource that owns one or more [`QueryCache`]s: what to forget on world entry.
+pub(crate) trait AskOnce: Resource {
+    fn clear_pending(&mut self);
+}
+
+/// **The one release-on-enter.** Every cache owner registers here at build; the system runs on
+/// the world-enter message and clears the in-flight sets, so a key asked before the io writer
+/// existed — or across a disconnect — is asked again. Before 2288 this was written for two of
+/// the eight owners (`net::release_ask_once_latches_on_enter`, after the mail send tab's
+/// stationery list went missing for a whole session in silence), and the other six were the
+/// same dead-feature class, still armed.
+pub(crate) fn register<T: AskOnce>(app: &mut App) {
+    app.add_systems(
+        Update,
+        release_on_enter::<T>
+            .in_set(benilla_world::schedule::WorldStage::Net)
+            .after(crate::net::apply_net_updates),
+    );
+}
+
+fn release_on_enter<T: AskOnce>(
+    mut entered: MessageReader<EnteredWorldMessage>,
+    mut cache: ResMut<T>,
+) {
+    if entered.read().count() == 0 {
+        return;
+    }
+    cache.clear_pending();
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn a_miss_asks_once_and_a_landing_answers_it() {
+        let mut cache: QueryCache<u32, &str> = QueryCache::default();
+        let mut asks = 0;
+        assert!(cache.get_or_ask(7, || asks += 1).is_none());
+        assert!(cache.get_or_ask(7, || asks += 1).is_none());
+        assert_eq!(
+            asks, 1,
+            "the second lookup of a pending key does not re-send"
+        );
+        assert!(cache.is_pending(7));
+        cache.insert(7, Some("seven"));
+        assert_eq!(cache.get_or_ask(7, || asks += 1), Some(&"seven"));
+        assert_eq!(asks, 1);
+        assert!(!cache.is_pending(7));
+        assert_eq!(cache.generation(), 1);
+    }
+
+    #[test]
+    fn a_negative_is_cached_and_never_re_asked() {
+        let mut cache: QueryCache<u32, &str> = QueryCache::default();
+        let mut asks = 0;
+        cache.get_or_ask(1, || asks += 1);
+        cache.insert(1, None);
+        assert!(cache.get_or_ask(1, || asks += 1).is_none());
+        assert_eq!(asks, 1);
+        assert!(cache.answered_unknown(1));
+        assert!(!cache.answered_unknown(2));
+    }
+
+    #[test]
+    fn clearing_pending_lets_a_dropped_ask_go_again_and_keeps_the_answers() {
+        let mut cache: QueryCache<u32, &str> = QueryCache::default();
+        let mut asks = 0;
+        cache.get_or_ask(1, || asks += 1);
+        cache.insert(2, Some("two"));
+        cache.clear_pending();
+        cache.get_or_ask(1, || asks += 1);
+        assert_eq!(asks, 2);
+        assert_eq!(cache.get(2), Some(&"two"));
+    }
+
+    #[test]
+    fn eviction_re_asks() {
+        let mut cache: QueryCache<u32, &str> = QueryCache::default();
+        cache.insert(3, Some("three"));
+        assert!(cache.evict(3));
+        assert!(!cache.evict(3));
+        let mut asks = 0;
+        assert!(cache.get_or_ask(3, || asks += 1).is_none());
+        assert_eq!(asks, 1);
+    }
+}
diff --git a/crates/benilla-app/src/quest_markers/mod.rs b/crates/benilla-app/src/quest_markers/mod.rs
index 8f1a0ddc..0af139af 100644
--- a/crates/benilla-app/src/quest_markers/mod.rs
+++ b/crates/benilla-app/src/quest_markers/mod.rs
@@ -79,7 +79,7 @@
 //! few and player-adjacent, so the anim host runs ungated (no draw-gate `DoodadAnimHost`).
 //! [`pose_markers`] swaps every marker between the low and raised bob as the unit's overhead
 //! elements toggle (the floating name [`Nameplates::shows`] OR a live V-plate — our `unit+0xc7c`;
-//! the plate leg is a director-pinned deviation, rationale on [`pose_markers`], 0408/0409):
+//! the plate leg is a director-pinned deviation, rationale on [`pose_markers`], 2274/2275):
 //! cards re-arm the matching loop, hosts switch the playing clip.
 
 mod query;
@@ -200,7 +200,6 @@ fn despawn_marker(commands: &mut Commands, roots: &Query<&QuestMarkerRoot>, root
 /// client's two handlers race last-write-wins on the same attach slot; we compose
 /// deterministically instead — a quest marker, when the status yields one, outranks the green
 /// (a named deviation, invisible in practice: a flight master carrying an active quest marker).
-#[allow(clippy::too_many_arguments)] // a Bevy system's full input set
 fn sync_markers(
     mut commands: Commands,
     quest: Res<QuestGiver>,
@@ -327,7 +326,6 @@ fn seat_is_stale(marker: &QuestMarkerRoot, seat_alive: bool, want: Option<u16>)
 /// billboard cards under the identity root with their bob loop armed (the `?`). Retries silently
 /// while either half still loads; latches [`QuestMarkerRoot::no_anchor`] when the body model has
 /// no overhead point (the client's marker never parents — invisible).
-#[allow(clippy::too_many_arguments)]
 fn build_markers(
     mut commands: Commands,
     mut roots: Query<(Entity, &mut QuestMarkerRoot)>,
@@ -513,13 +511,13 @@ fn build_markers(
 /// (WoW z +0.427..+0.517 vs anim 0's −0.089..0), lifting the marker clear of the name text.
 /// Benilla raises for the floating name ([`Nameplates::shows`]) OR a live V-plate
 /// ([`VPlates`](crate::vplates::VPlates)) — the plate leg is a **director-pinned deviation**
-/// (0409): the reference arms anim 0 under a live plate (byte-verified, wow-re
+/// (2275): the reference arms anim 0 under a live plate (byte-verified, wow-re
 /// `questgiver-marker.md` Q4a — ShouldShowName's plate suppression destroys the rendered name
 /// and nulls the `desc+0x8` handle the selector `0x6c7950` tests), leaving its marker low
 /// behind the plate; the director rejected that overlap on sight. The re-arm law is settled
 /// faithful: the reference arms at attach AND re-arms on the frame the name shown-state flips
 /// (an edge inside `0x6c6e90`, never per-frame) — exactly our re-arm-on-flip.
-#[allow(clippy::type_complexity, clippy::too_many_arguments)] // a Bevy system: each param is one resource, the app's convention
+#[allow(clippy::type_complexity)] // a Bevy system: each param is one resource, the app's convention
 fn pose_markers(
     plates: Res<Nameplates>,
     vplates: Res<crate::vplates::VPlates>,
diff --git a/crates/benilla-app/src/quest_markers/query.rs b/crates/benilla-app/src/quest_markers/query.rs
index c34eaa54..20ac58f6 100644
--- a/crates/benilla-app/src/quest_markers/query.rs
+++ b/crates/benilla-app/src/quest_markers/query.rs
@@ -132,7 +132,7 @@ const GO_FLAG_INTERACT_COND: u32 = 0x4;
 /// equipping, unequipping and swapping a bag but not moving a stack inside one. Per unit, the
 /// reference's reaction refresh also keys on charm/persuade/duel-team/`PLAYER_BYTES_3`; we key on
 /// the faction template, and catch a standing change through the reputation sweep instead.
-#[allow(clippy::type_complexity, clippy::too_many_arguments)] // a Bevy system: one param per resource
+#[allow(clippy::type_complexity)] // a Bevy system: one param per resource
 pub(super) fn query_statuses(
     self_q: Query<Ref<ObjectStore>, With<SelfPlayer>>,
     objects: Query<
diff --git a/crates/benilla-app/src/raid_marks.rs b/crates/benilla-app/src/raid_marks.rs
index a35da50f..d27e3328 100644
--- a/crates/benilla-app/src/raid_marks.rs
+++ b/crates/benilla-app/src/raid_marks.rs
@@ -98,7 +98,6 @@ fn mark_mesh(icon: u32) -> Mesh {
 /// The marker's world transform for `unit` this frame — the §6 seat over the shared
 /// anchor/scale law. Generic over the joint-globals filter like [`overhead_anchor`] (the placer
 /// passes a disjoint query).
-#[allow(clippy::too_many_arguments)] // the anchor law's full input set, like its callers
 fn mark_place<F: bevy::ecs::query::QueryFilter>(
     unit: Entity,
     tf: &Transform,
@@ -131,7 +130,7 @@ fn mark_place<F: bevy::ecs::query::QueryFilter>(
 /// gate on the plate exclusion, and (re)build the billboard entities. Runs after the name
 /// driver (the seat reads this frame's line counts) — spawn-frame seat here, the per-frame
 /// re-seat is [`place_raid_marks`].
-#[allow(clippy::too_many_arguments, clippy::type_complexity)] // one Bevy system's full input set
+#[allow(clippy::type_complexity)] // one Bevy system's full input set
 fn drive_raid_marks(
     mut commands: Commands,
     group: Res<GroupState>,
diff --git a/crates/benilla-app/src/ranged_flex.rs b/crates/benilla-app/src/ranged_flex.rs
new file mode 100644
index 00000000..f32ad69e
--- /dev/null
+++ b/crates/benilla-app/src/ranged_flex.rs
@@ -0,0 +1,692 @@
+//! **The ranged weapon prop's own animation** (decision 2281) — the bow's limbs bend, the gun
+//! fires its muzzle blast.
+//!
+//! An equipped ranged weapon is not just a mesh in a hand. The reference keeps its M2 *instance*
+//! at `[CGUnit+0xd24]` (written by the ranged-attach helper `0x611e10` @`0x611eca`, populated on
+//! any sheath→2) and re-arms **that model's own animation** from two keyframes on the body clip:
+//!
+//! - **`$BWP`** (BowPull, keyed only in LoadBow 105 @0.434 s / LoadRifle 106 @0.433 s) →
+//!   `0x624cc0`: if the prop's model *owns* animation **160 BowPull** (`0x624cee push 0xa0; call
+//!   0x711960` — a presence test it bails on), play it on the prop at a rate that fits its
+//!   authored length into the body clip's REMAINING time (`0x624e31`'s computed float arg).
+//! - **`$BWR`** (BowRelease, keyed only in AttackBow 46 @0.033 s / AttackRifle 49 @0.000 s) →
+//!   `0x600159`, which **forks on the weapon family** and arms a different clip for each:
+//!   - the body is playing a **bow** clip (`0x5fcfb0`: 46 AttackBow / 105 LoadBow / 109 HoldBow) →
+//!     the prop plays **animation 0 (Stand)** (`0x600209`) — the drawn limbs relax;
+//!   - the body is playing a **rifle** clip (`0x5fcfd0`: 49 AttackRifle / 106 LoadRifle / 110
+//!     HoldRifle — guns AND crossbows) → the prop plays **animation 161 (BowRelease)**
+//!     (`0x600273`, `push 0xa1`).
+//!
+//! **That second arm is the gun's muzzle blast, and it is why this file exists.** A firearm M2
+//! authors exactly two sequences — Stand(0) and BowRelease(161) — and hangs its whole flash on the
+//! second: `Firearm_2H_Rifle_A_01.m2` carries **seven** particle emitters, each holding a flat rate
+//! in every sequence (100/s, 50/s, 40/s, 30/s, 20/s) and keying only its **enabled gate** — shut
+//! across Stand, open from the head of 161 for a window of its own (34 ms, 134 ms, 4 × 200 ms,
+//! 334 ms: a spark, a flare, the body of the flash, a smoke tail). Bone 2, the parent of all seven
+//! emitter bones, is keyed a constant **+90° about Y** in 161 against 0° in Stand — which is what
+//! aims the blast down the barrel instead of straight up out of the receiver. 21 of the 22 firearms
+//! in the 5875 chain author 161; 25 bows and crossbows author 160 *and* 161; nothing else in the
+//! 571-model weapon corpus authors either. Without this arm the emitters build, pool and tick for
+//! ever on a sequence whose gate is shut, and a gun shot is silent art.
+//!
+//! **It is the GATE that is keyed, never the rate** — the track at `def+0x1dc`, outside the ten
+//! scalar ones, `u8`-valued, step-interpolated (decision 2286). A consumer that asks "does this
+//! emitter emit anything?" of the *rate* sees a non-zero constant in every sequence, for a bank
+//! that has never once been switched on; that false negative is why this shipped broken and why a
+//! wow-re round briefly published the opposite reading.
+//!
+//! **wow-re recorded the opposite**, flagged INFERRED: `ranged-shot-anim.md` read the mechanism as
+//! "bow-only by asset … gun/crossbow/thrown/wand have **no** analogous prop re-anim call anywhere
+//! (exhaustive search)". The rifle arm is in the same function as the bow arm, eleven instructions
+//! apart. The §5 correction round landed as wow-re `ranged-prop-reanim-two-arm.md`: the fork is
+//! CONFIRMED in every detail, and its census finds **exactly four** sites that arm `[+0xd24]` —
+//! `0x624e31` (160), `0x600209` (0), `0x600273` (161) and `0x60f59d` (0, the reset below). The
+//! surviving, precise form of "no analog" is **thrown and wand**: a third family predicate
+//! `0x5fcf90` = {107, 111, 112} exists and the `$BWR` handler never calls it, so those two match
+//! neither arm and get no prop animation at all.
+//!
+//! **Both arms sit under a gate, and it is the projectile queue** (decision 2288). `[CGUnit+0xac]`
+//! is not a spell-visual list, as this file first guessed from its readers — it is the queue of
+//! `CMissile` nodes waiting for the caster's release event, and `$BWR` reads it (`0x600182`) before
+//! draining it (`0x600294` → `0x60c940`, the launcher). So the prop's re-anim and the projectile's
+//! launch are two effects of one act: no missile queued, no flex. benilla already held that queue —
+//! [`crate::entities::PendingMissiles`], whose own doc named `+0xac` correctly long before this
+//! round — and the chain runs this arm ahead of the drain, which is the order the two addresses
+//! sit in.
+//!
+//! What this file does NOT own: the prop's rig and palette rows (the rider lane —
+//! [`benilla_world::rig_rider`], given a posed arm by 2281), the emitters' clock (`EmitClock::Host`
+//! on the prop root, wired at the attach), or the bowstring chord ([`crate::bowstring`], which now
+//! spans the *posed* limb tips because of this).
+
+use bevy::prelude::*;
+
+use benilla_assets::ModelAnimations;
+
+use crate::creature_anim::AnimSoundEvent;
+
+/// `AnimationData.dbc` **160 BowPull** — the prop clip `$BWP` arms (`0x624e2a push 0xa0`).
+pub(crate) const BOW_PULL: u16 = 160;
+/// `AnimationData.dbc` **161 BowRelease** — the prop clip the RIFLE arm of `$BWR` plays
+/// (`0x60026c push 0xa1`). On a firearm this is the muzzle blast; on a bow it is authored and,
+/// per the byte fork above, never reached from here.
+pub(crate) const BOW_RELEASE: u16 = 161;
+/// The model-load bootstrap id — animation **0 Stand**, what the BOW arm of `$BWR` plays
+/// (`0x600205 push 0x0`) and what the un-nock's reset re-arms (`0x60f59d`): the drawn bow returns
+/// to rest.
+const STAND: u16 = 0;
+
+/// `0x5fcfb0` verbatim — the body clips that make the wearer a **bow** shooter.
+const BOW_FAMILY: [u16; 3] = [46, 105, 109]; // AttackBow · LoadBow · HoldBow
+/// `0x5fcfd0` verbatim — the body clips that make the wearer a **rifle** shooter (gun + crossbow).
+const RIFLE_FAMILY: [u16; 3] = [49, 106, 110]; // AttackRifle · LoadRifle · HoldRifle
+
+/// The unit's equipped **ranged weapon prop** — benilla's `[CGUnit+0xd24]`. On the prop root, put
+/// there by the equipment attach for the ranged slot when the display's model authors a flex clip
+/// (160 or 161); absent for every other held item, which is the reference's own population (nothing
+/// else is ever passed to `0x624cc0`/`0x600209`/`0x600273`).
+#[derive(Component)]
+pub(crate) struct RangedProp {
+    /// The unit wearing it — the `$BWP`/`$BWR` keys arrive on *its* timeline, not the prop's.
+    pub(crate) owner: Entity,
+}
+
+/// Arm the prop's clip from the wearer's `$BWP`/`$BWR` keys.
+///
+/// Registered in the creature-anim chain immediately after
+/// [`crate::creature_anim::drive_nock_latch`], so a key lands the frame it is crossed: the two are
+/// the same handler pair in the reference (`$BWP` is `0x624cc0`'s prop arm *then* `0x624b2f`'s ammo
+/// attach; `$BWR` is `0x600209`/`0x600273`'s prop arm *then* `0x600299`'s detach), and the prop's
+/// pose has to be this frame's before the rider lane composes its palette rows from it.
+pub(crate) fn flex_ranged_props(
+    mut events: MessageReader<AnimSoundEvent>,
+    props: Query<(Entity, &RangedProp)>,
+    // Disjoint from `props_mut` by the filter: a unit is never its own ranged prop.
+    wearers: Query<(&AnimationPlayer, &ModelAnimations), Without<RangedProp>>,
+    mut props_mut: Query<(&mut AnimationPlayer, &ModelAnimations), With<RangedProp>>,
+    // The `[+0xac]` gate — read here, drained by `entities::missile::spawn_missiles` on the same
+    // key. The creature-anim chain runs `.before(EntityVisualsSet)`, so this read lands ahead of
+    // that drain exactly as `0x600182` lands ahead of `0x600294`.
+    pending: Res<crate::entities::PendingMissiles>,
+) {
+    for ev in events.read() {
+        let want = match &ev.ident {
+            b"$BWP" => Some(BOW_PULL),
+            // **`0x60018a je 0x600299`** — no projectile waiting, no prop block at all. The gate
+            // is `$BWR`'s alone: `$BWP`'s handler (`0x624cc0`) reads nothing of the kind, and the
+            // nock-latch clear above it (`0x60016c`) and the ammo detach below it (`0x600299`) are
+            // both outside the skip, which is why `drive_nock_latch` stays ungated.
+            b"$BWR" if !pending.releasing(ev.entity) => None,
+            b"$BWR" => {
+                if BOW_FAMILY.contains(&ev.anim_id) {
+                    Some(STAND)
+                } else if RIFLE_FAMILY.contains(&ev.anim_id) {
+                    Some(BOW_RELEASE)
+                } else {
+                    // Neither family: the reference falls through to `0x60027a` and touches no
+                    // prop at all. Nothing in the shipped character models keys `$BWR` outside
+                    // 46/49, so this arm is the reference's own defensive one.
+                    None
+                }
+            }
+            _ => continue,
+        };
+        let Some(want) = want else { continue };
+        // The prop is found from the WEARER, exactly as `[+0xd24]` is: one ranged prop per unit.
+        let Some((prop, _)) = props.iter().find(|(_, p)| p.owner == ev.entity) else {
+            continue;
+        };
+        let Ok((mut player, anims)) = props_mut.get_mut(prop) else {
+            continue;
+        };
+        // **The two asks are not the same ask, and the asymmetry is real** (wow-re
+        // `ranged-prop-reanim-two-arm.md`, claim B). `$BWP` is guarded by `0x711960` — the
+        // *direct, unsubstituted* "does this model author id X" test — and bails when it fails:
+        // that is what confines BowPull to its 25 models, and what a firearm exits on, its whole
+        // cycle being the `$BWR` blast. `$BWR`'s arms carry no such guard, and `0x7121a0` does
+        // **not** silently no-op on a miss: `0x711bf0` substitutes through the model's own
+        // `PlayableAnimationLookup` first, and every weapon model that authors neither flex clip
+        // bakes both ids to Stand(0) (measured there: 571/571 resolve). So a rifle-family body
+        // holding a model without 161 re-arms Stand, it does not leave the prop alone.
+        let want = if want == BOW_PULL {
+            if !anims.owns(BOW_PULL) {
+                continue;
+            }
+            BOW_PULL
+        } else {
+            anims
+                .playable_animation_lookup
+                .get(want as usize)
+                .map_or(want, |row| row.resolved_id)
+        };
+        let Some(clip) = anims.clips.iter().find(|c| c.anim_id == want) else {
+            continue;
+        };
+        // `$BWP`'s rate: the reference fits BowPull's authored length into the body clip's
+        // REMAINING time (`0x624e31`'s computed float), so the draw completes exactly as the Load
+        // clip ends rather than finishing early and holding. Read off the wearer's own player at
+        // the clip the key fired from — `duration − seek` is the same quantity the reference
+        // builds from the block's window. Everything else plays at the literal 1.0 both `$BWR`
+        // arms push (`0x3f800000`).
+        let speed = if want == BOW_PULL {
+            // **`n <= 0` is NO FLEX THAT SHOT, not a flex at 1.0** (`0x624d91 jle`, claim C): the
+            // reference abandons the whole arm when the body clip has no time left to fill.
+            let Some(left) = wearers
+                .get(ev.entity)
+                .ok()
+                .and_then(|(p, a)| remaining(p, a, ev.anim_id))
+                .filter(|left| *left > 0.0)
+            else {
+                continue;
+            };
+            (clip.duration / left).clamp(0.05, 20.0)
+        } else {
+            1.0
+        };
+        // op4 ARMS a model, it does not layer — the prop plays exactly one clip. Without the
+        // stop, Bevy leaves the previous node active and `playing_seq` (which the emitters' rate
+        // track reads) picks by weight between two equal claims.
+        player.stop_all();
+        let active = player.play(clip.node);
+        active.replay();
+        active.set_speed(speed);
+        // **The instrument** (`WOW_MOVE_TRACE_TAGS=flex`), on the same clock as the `aev` key that
+        // asked for it. Whether a prop armed its clip is otherwise unobservable from outside the
+        // renderer — and "the blast did not fire" has three distinct causes (the key never
+        // arrived, the fork went the other way, the model owns no such clip) that look identical
+        // on screen.
+        if benilla_assets::trace::enabled_for("flex") {
+            benilla_assets::trace::line(
+                "flex",
+                &format!(
+                    "{} unit={} body={} prop={prop} arm={want} speed={speed:.3}",
+                    String::from_utf8_lossy(&ev.ident),
+                    ev.entity,
+                    ev.anim_id,
+                ),
+            );
+        }
+        // The authored flags decide the wrap, as everywhere else: a firearm's Stand loops and its
+        // BowRelease clamps, a bow's three clips all clamp. A clamped flex holds its last frame
+        // until the next key re-arms it, which is the reference's own steady state.
+        if clip.looping {
+            active.repeat();
+        } else {
+            active.set_repeat(bevy::animation::RepeatAnimation::Never);
+        }
+    }
+}
+
+/// **The un-nock's reset — `0x60f59d`, and its condition is INVERTED from what wow-re's prose
+/// said.** `ranged-shot-anim.md` read it as "re-arms the prop to Stand(0) **after** release"; the
+/// bytes say **UNLESS** it is releasing:
+///
+/// ```text
+/// 60f578  push -1 ; call 0x712090   ; the prop's CURRENT requested animation id
+/// 60f57f  cmp eax,0xa1              ; 161 BowRelease
+/// 60f584  je 0x60f5a2               ; …then SKIP the reset
+/// ```
+///
+/// **And the order is the law, not an implementation detail.** The reset lives inside the un-nock
+/// `0x60f530`, which `$BWR` itself reaches every shot (`0x600294` → `0x60c940` → `0x60c951`) —
+/// *after* the arm at `0x600273`. So the arm runs first and is exactly what that `cmp` reads back;
+/// build the two independently and a gun's muzzle blast is cancelled on the frame it starts. The
+/// guard exists for precisely this collision (wow-re `ranged-prop-reanim-two-arm.md`, claim D).
+///
+/// benilla reproduces the shape rather than the call graph: the un-nock's observable here is
+/// [`NockLatch`] leaving the wearer, which `$BWR` does every shot and every cancel path does too
+/// ([`crate::creature_anim::cancel_auto_repeat_local`], leaving the ranged sheath, a weapon
+/// change). Removals are visible a frame after the commands that make them apply, by which time a
+/// gun's prop is already on its 2 s BowRelease and the guard declines — which is the reference's
+/// outcome by the reference's own reasoning.
+///
+/// What it is actually *for* is the case no release covers: **a cancel while the bow is drawn.**
+/// BowPull(160) is a clamp, so a volley stopped mid-pull leaves the limbs bent at full draw for as
+/// long as the weapon stays in hand; this is what relaxes them.
+pub(crate) fn reset_ranged_props_on_unnock(
+    mut unnocked: RemovedComponents<crate::creature_anim::NockLatch>,
+    props: Query<(Entity, &RangedProp)>,
+    mut players: Query<(&mut AnimationPlayer, &ModelAnimations), With<RangedProp>>,
+) {
+    for owner in unnocked.read() {
+        let Some((prop, _)) = props.iter().find(|(_, p)| p.owner == owner) else {
+            continue;
+        };
+        let Ok((mut player, anims)) = players.get_mut(prop) else {
+            continue;
+        };
+        // `0x60f57f cmp eax,0xa1` — the prop's current requested id, not its clip time: a
+        // BowRelease that has already finished still reads 161 and is still skipped.
+        let releasing = player
+            .playing_animations()
+            .filter_map(|(node, _)| anims.clips.iter().find(|c| c.node == *node))
+            .any(|c| c.anim_id == BOW_RELEASE);
+        if releasing {
+            continue;
+        }
+        let Some(stand) = anims.clips.iter().find(|c| c.anim_id == STAND) else {
+            continue;
+        };
+        player.stop_all();
+        let active = player.play(stand.node);
+        active.replay();
+        active.set_speed(1.0);
+        if stand.looping {
+            active.repeat();
+        } else {
+            active.set_repeat(bevy::animation::RepeatAnimation::Never);
+        }
+    }
+}
+
+/// Seconds left in the wearer's playing clip for `anim_id` — the `$BWP` rate's denominator.
+fn remaining(player: &AnimationPlayer, anims: &ModelAnimations, anim_id: u16) -> Option<f32> {
+    let clip = anims
+        .clips
+        .iter()
+        .filter(|c| c.anim_id == anim_id)
+        .find_map(|c| Some((c, player.animation(c.node)?)))?;
+    Some(clip.0.duration - clip.1.seek_time())
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use benilla_assets::AnimClip;
+    use bevy::animation::graph::AnimationNodeIndex;
+
+    fn clip(anim_id: u16, node: u32, duration: f32, looping: bool) -> AnimClip {
+        AnimClip {
+            anim_id,
+            seq_index: 0,
+            node: AnimationNodeIndex::new(node as usize),
+            looping,
+            duration,
+            move_speed: 0.0,
+            blend_time: 0.0,
+            bounds_center: Vec3::ZERO,
+            bounds_radius: 0.0,
+            bounds_min: Vec3::ZERO,
+            bounds_max: Vec3::ZERO,
+            events: Vec::new().into(),
+            arm_nodes: None,
+            upper_node: None,
+            frequency: 0,
+            replay: (0, 0),
+            poses_bones: true,
+        }
+    }
+
+    /// A model's animation table, with the **two lookups a real M2 carries** built from the clips:
+    /// `animation_lookup` (the reference's direct `0x711960` test, which gates `$BWP`) and
+    /// `playable_animation_lookup` (the substitution `0x711bf0` runs before every arm — every id
+    /// the model does not author resolves to Stand, as the shipped weapon corpus bakes it).
+    /// Leaving either empty is what a synthetic fixture gets wrong: `owns()` then answers `false`
+    /// for a sequence the model plainly has.
+    fn anims(clips: Vec<AnimClip>) -> ModelAnimations {
+        let top = clips.iter().map(|c| c.anim_id).max().unwrap_or(0) as usize;
+        let mut animation_lookup = vec![0xffffu16; top + 1];
+        let mut playable = vec![
+            benilla_formats::PlayableAnim {
+                resolved_id: STAND,
+                dir_flags: 0,
+            };
+            top + 1
+        ];
+        for (i, c) in clips.iter().enumerate() {
+            animation_lookup[c.anim_id as usize] = i as u16;
+            playable[c.anim_id as usize].resolved_id = c.anim_id;
+        }
+        ModelAnimations {
+            graph: Handle::default(),
+            clips,
+            hand_close: [None, None],
+            playable_animation_lookup: playable,
+            animation_lookup,
+            global_bones: Vec::new(),
+            first_seq: None,
+            pose: Default::default(),
+        }
+    }
+
+    /// A firearm prop: Stand(0) looping + BowRelease(161) clamped, and **no** BowPull — the real
+    /// `Firearm_2H_Rifle_A_01.m2` shape (see the real-asset pin below).
+    fn gun() -> ModelAnimations {
+        anims(vec![
+            clip(STAND, 1, 0.333, true),
+            clip(BOW_RELEASE, 2, 2.0, false),
+        ])
+    }
+
+    /// A bow prop: Stand(0), BowPull(160), BowRelease(161) — `Bow_1H_Standard_A_01.m2`'s shape.
+    fn bow() -> ModelAnimations {
+        anims(vec![
+            clip(STAND, 1, 0.033, false),
+            clip(BOW_PULL, 2, 1.0, false),
+            clip(BOW_RELEASE, 3, 0.166, false),
+        ])
+    }
+
+    /// Spawn a wearer playing `body` and its prop, run the arm over one key, and report which
+    /// node the prop ended up playing (with its speed).
+    fn fire(
+        prop_anims: ModelAnimations,
+        body: u16,
+        body_clip: Option<(AnimClip, f32)>,
+        tag: &[u8; 4],
+    ) -> Option<(AnimationNodeIndex, f32)> {
+        let mut app = App::new();
+        app.add_message::<AnimSoundEvent>();
+        app.init_resource::<crate::entities::PendingMissiles>();
+        app.add_systems(Update, flex_ranged_props);
+        let mut wearer_player = AnimationPlayer::default();
+        let wearer_anims = match &body_clip {
+            Some((c, seek)) => {
+                let active = wearer_player.play(c.node);
+                active.seek_to(*seek);
+                anims(vec![c.clone()])
+            }
+            None => anims(Vec::new()),
+        };
+        let wearer = app.world_mut().spawn((wearer_player, wearer_anims)).id();
+        let prop = app
+            .world_mut()
+            .spawn((
+                AnimationPlayer::default(),
+                prop_anims,
+                RangedProp { owner: wearer },
+            ))
+            .id();
+        // A projectile queued on the wearer — the `[+0xac]` gate the `$BWR` arms sit under. Every
+        // leg but the gate's own test wants it open; `queue_a_shot` is what opens it.
+        crate::entities::PendingMissiles::queue_a_shot(&mut app, wearer);
+        app.world_mut().write_message(AnimSoundEvent {
+            entity: wearer,
+            ident: *tag,
+            data: 0,
+            anim_id: body,
+            pos: None,
+        });
+        app.update();
+        let player = app.world().entity(prop).get::<AnimationPlayer>().unwrap();
+        let armed = player
+            .playing_animations()
+            .map(|(n, a)| (*n, a.speed()))
+            .next();
+        armed
+    }
+
+    /// **The fork the whole file exists for** (`0x600159`): the SAME `$BWR` key arms a different
+    /// clip on the prop depending on which weapon family the body is playing. A gun asked for
+    /// BowRelease(161) — its muzzle blast — and a bow for Stand(0), its limbs relaxing.
+    ///
+    /// The gun leg is the director's report: before this, nothing anywhere played 161, so the
+    /// seven emitters that carry the blast sat for ever on Stand's authored rate of zero.
+    #[test]
+    fn bwr_forks_the_prop_clip_on_the_bodys_weapon_family() {
+        // AttackRifle(49) → 161 on the gun.
+        assert_eq!(
+            fire(gun(), 49, None, b"$BWR"),
+            Some((AnimationNodeIndex::new(2), 1.0)),
+            "a rifle-family body clip fires the prop's BowRelease at the literal 1.0"
+        );
+        // AttackBow(46) → Stand(0) on the bow.
+        assert_eq!(
+            fire(bow(), 46, None, b"$BWR").map(|(n, _)| n),
+            Some(AnimationNodeIndex::new(1)),
+            "a bow-family body clip relaxes the prop to Stand, NOT to its authored 161"
+        );
+        // The Load/Hold ids are in the same two sets (`0x5fcfb0`/`0x5fcfd0` each test three).
+        assert_eq!(
+            fire(gun(), 106, None, b"$BWR").map(|(n, _)| n),
+            Some(AnimationNodeIndex::new(2)),
+            "LoadRifle is in the rifle family"
+        );
+        // Neither family: the reference touches no prop at all.
+        assert_eq!(
+            fire(gun(), 0, None, b"$BWR"),
+            None,
+            "a body clip in neither family leaves the prop alone"
+        );
+    }
+
+    /// **The `[+0xac]` gate** (`0x600182`/`0x60018a`, decision 2288): a `$BWR` with no projectile
+    /// waiting to be released arms nothing on the prop. The reference skips the whole block —
+    /// prop re-anim and cast-point reposition together — because the flex and the launch are two
+    /// effects of one act, and there is no act without a missile to throw.
+    ///
+    /// Asserted as the difference the gate makes: the SAME key, the same rifle body clip, with and
+    /// without a queued shot.
+    #[test]
+    fn a_bwr_with_no_projectile_queued_arms_nothing() {
+        let mut app = App::new();
+        app.add_message::<AnimSoundEvent>();
+        app.init_resource::<crate::entities::PendingMissiles>();
+        app.add_systems(Update, flex_ranged_props);
+        let wearer = app.world_mut().spawn(anims(Vec::new())).id();
+        let prop = app
+            .world_mut()
+            .spawn((
+                AnimationPlayer::default(),
+                gun(),
+                RangedProp { owner: wearer },
+            ))
+            .id();
+        let fire = |app: &mut App| {
+            app.world_mut().write_message(AnimSoundEvent {
+                entity: wearer,
+                ident: *b"$BWR",
+                data: 0,
+                anim_id: 49,
+                pos: None,
+            });
+            app.update();
+            app.world()
+                .entity(prop)
+                .get::<AnimationPlayer>()
+                .unwrap()
+                .playing_animations()
+                .count()
+        };
+        assert_eq!(fire(&mut app), 0, "queue empty ⇒ the prop is not touched");
+        crate::entities::PendingMissiles::queue_a_shot(&mut app, wearer);
+        assert_eq!(
+            fire(&mut app),
+            1,
+            "…and the same key arms 161 once a shot is queued"
+        );
+    }
+
+    /// `$BWP` arms BowPull — and only on a model that HAS it. The reference makes that a literal
+    /// presence test it bails on (`0x624cee push 0xa0; call 0x711960`), and a firearm is exactly
+    /// the model it bails for: 21 of the 22 shipped firearms author 161 and none authors 160.
+    #[test]
+    fn bwp_pulls_only_a_prop_that_owns_bowpull() {
+        // BOTH legs supply a body clip with time left in it, so the firearm's `None` can only be
+        // the presence test — not the separate `n <= 0` bail the leg below covers.
+        let load = |id: u16| Some((clip(id, 9, 1.0, false), 0.433));
+        assert_eq!(
+            fire(bow(), 105, load(105), b"$BWP").map(|(n, _)| n),
+            Some(AnimationNodeIndex::new(2)),
+            "a bow draws on the pull key"
+        );
+        assert_eq!(
+            fire(gun(), 106, load(106), b"$BWP"),
+            None,
+            "a firearm owns no BowPull — the pull key arms nothing on it"
+        );
+        // `0x624d91 jle`: no time left in the body clip ⇒ no flex that shot, not a flex at 1.0.
+        assert_eq!(
+            fire(bow(), 105, Some((clip(105, 9, 1.0, false), 1.0)), b"$BWP"),
+            None,
+            "a pull key at the very end of its Load clip arms nothing"
+        );
+    }
+
+    /// The pull's RATE: the reference stretches BowPull's authored length over the body clip's
+    /// REMAINING time (`0x624e31`'s computed float), so the draw completes as the Load clip ends
+    /// instead of finishing early and holding. HumanMale LoadBow(105) is 1.0 s and keys `$BWP` at
+    /// 0.434 s, so a 1.0 s BowPull has to run at ~1.767×.
+    #[test]
+    fn the_pull_is_rate_matched_to_the_rest_of_the_load_clip() {
+        let load = clip(105, 9, 1.0, false);
+        let (node, speed) = fire(bow(), 105, Some((load, 0.434)), b"$BWP").expect("armed");
+        assert_eq!(node, AnimationNodeIndex::new(2));
+        assert!(
+            (speed - 1.0 / 0.566).abs() < 1e-3,
+            "BowPull fits the 0.566 s left of LoadBow, got {speed}"
+        );
+    }
+
+    /// **The reset's guard, which is what the round corrected** (`0x60f584 je`): the un-nock
+    /// re-arms Stand **unless** the prop is releasing. Taken the other way round — "reset after
+    /// release", which is how wow-re's prose read — a gun's muzzle blast is cancelled on the frame
+    /// it starts, because the reference reaches this reset from the very `$BWR` that armed 161.
+    #[test]
+    fn the_unnock_resets_a_drawn_prop_but_never_a_releasing_one() {
+        fn unnock(prop_anims: ModelAnimations, armed: u16) -> Option<AnimationNodeIndex> {
+            let mut app = App::new();
+            app.add_systems(Update, reset_ranged_props_on_unnock);
+            let wearer = app.world_mut().spawn(crate::creature_anim::NockLatch).id();
+            let mut player = AnimationPlayer::default();
+            let node = prop_anims
+                .clips
+                .iter()
+                .find(|c| c.anim_id == armed)
+                .unwrap()
+                .node;
+            player.play(node);
+            app.world_mut()
+                .spawn((player, prop_anims, RangedProp { owner: wearer }));
+            // The un-nock edge: the latch leaves the wearer.
+            app.world_mut()
+                .entity_mut(wearer)
+                .remove::<crate::creature_anim::NockLatch>();
+            app.update();
+            let prop = app
+                .world_mut()
+                .query_filtered::<Entity, With<RangedProp>>()
+                .iter(app.world())
+                .next()
+                .unwrap();
+            let player = app.world().entity(prop).get::<AnimationPlayer>().unwrap();
+            let armed = player.playing_animations().map(|(n, _)| *n).next();
+            armed
+        }
+        // A bow left at full draw by a cancel relaxes.
+        let bow_stand = bow().clips[0].node;
+        assert_eq!(
+            unnock(bow(), BOW_PULL),
+            Some(bow_stand),
+            "a cancel mid-draw returns the limbs to rest"
+        );
+        // A gun mid-blast is NOT touched — the whole point of the guard.
+        let gun_release = gun().clips[1].node;
+        assert_eq!(
+            unnock(gun(), BOW_RELEASE),
+            Some(gun_release),
+            "the reset skips a prop that is releasing — otherwise the blast dies at birth"
+        );
+    }
+
+    /// **The asset half, on the real chain** — the fact the whole feature rests on, and the one a
+    /// data-reading regression would break silently: a firearm's muzzle blast is authored ENTIRELY
+    /// on BowRelease(161), with every emitter's rate track keyed to zero on the loader idle.
+    ///
+    /// This is what makes "the prop never plays 161" invisible rather than obviously broken — the
+    /// emitters build, pool and tick, and pour nothing.
+    #[test]
+    fn a_firearms_muzzle_blast_is_authored_only_on_bowrelease() {
+        let data = benilla_formats::wow_data_or_skip!();
+        let mut chain = benilla_formats::open_chain(&data).expect("open chain");
+        let path = "Item\\ObjectComponents\\Weapon\\Firearm_2H_Rifle_A_01.m2";
+        let bytes = chain.read_file(path).expect("the rifle model");
+
+        let seqs = benilla_formats::parse_m2_animations(&bytes);
+        let ids: Vec<u16> = seqs.iter().map(|s| s.anim_id).collect();
+        assert_eq!(
+            ids,
+            vec![STAND, BOW_RELEASE],
+            "the rifle authors exactly Stand and BowRelease"
+        );
+        assert!(!seqs[1].looping, "BowRelease clamps — one blast per arm");
+
+        let emitters = benilla_formats::parse_m2_particle_emitters(&bytes).expect("emitters");
+        assert_eq!(emitters.len(), 7, "the muzzle bank");
+        // **The discriminator is the GATE, not the rate** (decision 2286). Every one of the seven
+        // holds a constant rate in every sequence (100/s, 50/s, 40/s, 30/s, 20/s) and keys only
+        // `enabled` — the eleventh track at `def+0x1dc`, `u8`, step: flat 0 across Stand, and
+        // `0.000 = 1 → <its own window> = 0` in BowRelease. That is precisely why this defect was
+        // silent — a "does this emitter emit anything?" check on the rate says yes, on every
+        // sequence, for a bank that has never once been switched on.
+        for (i, em) in emitters.iter().enumerate() {
+            assert!(
+                em.timing.rate(Some(0), 0.0, 0.0) > 0.0,
+                "emitter {i} holds a rate on Stand — it is the gate that is shut"
+            );
+            for step in 0..8 {
+                let t = step as f32 * 0.04;
+                assert!(
+                    !em.timing.emitting(Some(0), t, 0.0),
+                    "emitter {i} is gated shut on Stand (t={t})"
+                );
+            }
+            assert!(
+                em.timing.emitting(Some(1), 0.0, 0.0),
+                "emitter {i} opens at the head of BowRelease — this is the blast"
+            );
+            // 1.0 s clears every window in the bank — the widest is the 334 ms smoke tail, and
+            // the assertion is deliberately the property rather than a per-emitter figure (2286
+            // corrected 2281's "0.2 s", which was the modal window read as the only one).
+            assert!(
+                !em.timing.emitting(Some(1), 1.0, 0.0),
+                "emitter {i} is over well before BowRelease's 2 s band ends"
+            );
+        }
+    }
+
+    /// The other half of the corpus law, so the `flexes` gate at the attach is pinned to data and
+    /// not to a guess: bows and crossbows author BOTH flex clips, an ordinary melee weapon
+    /// authors NEITHER (and so never gets a pose, a player or a hosted emitter clock).
+    #[test]
+    fn only_ranged_weapon_models_author_the_flex_clips() {
+        let data = benilla_formats::wow_data_or_skip!();
+        let mut chain = benilla_formats::open_chain(&data).expect("open chain");
+        let ids = |path: &str, chain: &mut benilla_formats::Chain| -> Vec<u16> {
+            let bytes = chain
+                .read_file(path)
+                .unwrap_or_else(|e| panic!("{path}: {e}"));
+            let mut v: Vec<u16> = benilla_formats::parse_m2_animations(&bytes)
+                .iter()
+                .map(|s| s.anim_id)
+                .collect();
+            v.sort_unstable();
+            v.dedup();
+            v
+        };
+        assert_eq!(
+            ids(
+                "Item\\ObjectComponents\\Weapon\\Bow_1H_Standard_A_01.m2",
+                &mut chain
+            ),
+            vec![STAND, BOW_PULL, BOW_RELEASE],
+            "a bow draws AND releases"
+        );
+        assert_eq!(
+            ids(
+                "Item\\ObjectComponents\\Weapon\\Bow_2H_Crossbow_A_01.m2",
+                &mut chain
+            ),
+            vec![STAND, BOW_PULL, BOW_RELEASE],
+            "so does a crossbow — the rifle family plays its 161"
+        );
+        let sword = ids(
+            "ITEM\\ObjectComponents\\WEAPON\\Sword_2H_AhnQiraj_D_01.m2",
+            &mut chain,
+        );
+        assert!(
+            !sword.contains(&BOW_PULL) && !sword.contains(&BOW_RELEASE),
+            "a melee weapon authors no flex clip: {sword:?}"
+        );
+    }
+}
diff --git a/crates/benilla-app/src/realm_select/input.rs b/crates/benilla-app/src/realm_select/input.rs
index dd05b76c..b7fafcb9 100644
--- a/crates/benilla-app/src/realm_select/input.rs
+++ b/crates/benilla-app/src/realm_select/input.rs
@@ -20,7 +20,6 @@ const DOUBLE_CLICK_SECS: f32 = 0.4;
 
 /// Clicks: a row selects (a second one enters), the column headers sort, Okay enters, Cancel and
 /// the close X leave.
-#[allow(clippy::too_many_arguments)]
 pub(super) fn clicks(
     buttons: Query<(Entity, &RealmAction)>,
     hits: Res<crate::glue::GlueClicks>,
diff --git a/crates/benilla-app/src/realm_select/mod.rs b/crates/benilla-app/src/realm_select/mod.rs
index 722ac1f4..592b3894 100644
--- a/crates/benilla-app/src/realm_select/mod.rs
+++ b/crates/benilla-app/src/realm_select/mod.rs
@@ -374,7 +374,7 @@ fn apply_realm_policy(
     mut msgs: MessageReader<RealmListMessage>,
     mut realms: ResMut<Realms>,
     choice: Res<RealmChoice>,
-    persist: Res<crate::cvars::CvarPersist>,
+    cvars: Res<crate::cvars::Cvars>,
 ) {
     if !realms.env_read {
         realms.env_read = true;
@@ -396,7 +396,11 @@ fn apply_realm_policy(
         if realms.shown {
             continue;
         }
-        let remembered = persist.stored(CVAR_REALM_NAME).map(str::to_string);
+        // The registered default is the empty string — a client that has never connected.
+        let remembered = cvars
+            .get(CVAR_REALM_NAME)
+            .filter(|s| !s.is_empty())
+            .map(str::to_string);
         if realms.current.is_none() {
             realms.current = remembered.clone();
         }
diff --git a/crates/benilla-app/src/realm_select/screen.rs b/crates/benilla-app/src/realm_select/screen.rs
index fad76189..bc2b3e27 100644
--- a/crates/benilla-app/src/realm_select/screen.rs
+++ b/crates/benilla-app/src/realm_select/screen.rs
@@ -136,7 +136,6 @@ pub(super) struct OkButton;
 /// **Not a state transition.** The frame is shown over whatever glue screen is current and hidden
 /// again; nothing about that screen changes, which is the whole of `RealmList`'s lifecycle in the
 /// reference (see [`super`]).
-#[allow(clippy::too_many_arguments)]
 pub(super) fn drive_screen(
     mut commands: Commands,
     realms: Res<Realms>,
diff --git a/crates/benilla-app/src/realm_select/smoke.rs b/crates/benilla-app/src/realm_select/smoke.rs
index 48b75aec..60d5f5c9 100644
--- a/crates/benilla-app/src/realm_select/smoke.rs
+++ b/crates/benilla-app/src/realm_select/smoke.rs
@@ -56,7 +56,6 @@ pub(super) struct Walk {
 
 /// The walk. Every leg names itself on the way in, so a timeout says which boundary stalled
 /// instead of "the client did not exit".
-#[allow(clippy::too_many_arguments)]
 pub(super) fn debug_realm_smoke(
     mut msgs: MessageReader<crate::net::CharListMessage>,
     realms: ResMut<Realms>,
diff --git a/crates/benilla-app/src/realmlist.rs b/crates/benilla-app/src/realmlist.rs
index f0066348..d54e592f 100644
--- a/crates/benilla-app/src/realmlist.rs
+++ b/crates/benilla-app/src/realmlist.rs
@@ -29,8 +29,21 @@ use bevy::prelude::*;
 /// before `cvars::load_config` applies the saved value at `Startup` — `lib.rs` orders it there.
 pub(crate) struct RealmlistPlugin;
 
+/// `realmList`'s change callback (1667, 2303): a string row — a value that is not an address
+/// is consumed with a warn, and the resource keeps its truth.
+pub(crate) fn on_cvar(ev: On<crate::cvars::CvarChanged>, mut realmlist: ResMut<Realmlist>) {
+    if !ev.is(CVAR_REALMLIST) {
+        return;
+    }
+    match normalize(&ev.new) {
+        Some(address) => realmlist.set(&address),
+        None => warn!("cvar realmList: unusable realmlist '{}' ignored", ev.new),
+    }
+}
+
 impl Plugin for RealmlistPlugin {
     fn build(&self, app: &mut App) {
+        app.add_observer(on_cvar);
         app.init_resource::<Realmlist>();
     }
 }
diff --git a/crates/benilla-app/src/screenshot.rs b/crates/benilla-app/src/screenshot.rs
index d6d8431a..35eb57a6 100644
--- a/crates/benilla-app/src/screenshot.rs
+++ b/crates/benilla-app/src/screenshot.rs
@@ -65,7 +65,7 @@ use bevy::tasks::IoTaskPool;
 
 use benilla_ui::script::UiScript;
 
-use crate::ui_script::UiInput;
+use crate::ui_script::{UiFeed, UiInput};
 
 /// The reference's own file stem (`WoWScrnShot_`), kept: a player who knows what WoW screenshots
 /// are called finds the same names here, and so does every screenshot-organizing tool the
@@ -255,7 +255,7 @@ impl Plugin for ScreenshotPlugin {
         app.init_resource::<ScreenshotState>().add_systems(
             Update,
             (
-                report_captures.before(UiInput),
+                report_captures.in_set(UiFeed),
                 ask_for_captures
                     .after(UiInput)
                     .after(crate::bindings::BindingSet),
diff --git a/crates/benilla-app/src/sound/anim_events.rs b/crates/benilla-app/src/sound/anim_events.rs
index 13a38002..61c2b0e4 100644
--- a/crates/benilla-app/src/sound/anim_events.rs
+++ b/crates/benilla-app/src/sound/anim_events.rs
@@ -60,7 +60,6 @@ const TRD_HEIGHT: f32 = 1.0;
 /// The attachment the emote voice is born at — `0x623c3a push 0x11`.
 const CSD_ATTACH: u16 = 17;
 
-#[allow(clippy::too_many_arguments)] // the standard sound-route param set + the two resolvers
 pub(super) fn route_anim_events(
     mut events: MessageReader<AnimSoundEvent>,
     // GlobalTransform: `$SND` tags can fire from parented visuals (a mount child's model),
diff --git a/crates/benilla-app/src/sound/combat.rs b/crates/benilla-app/src/sound/combat.rs
index 582252dc..ca505c25 100644
--- a/crates/benilla-app/src/sound/combat.rs
+++ b/crates/benilla-app/src/sound/combat.rs
@@ -457,7 +457,6 @@ struct MeleeTables<'w> {
     voices: Option<Res<'w, CreatureVoices>>,
 }
 
-#[allow(clippy::too_many_arguments)]
 fn combat_sounds(
     mut swings: MessageReader<SwingMessage>,
     mut contacts: MessageReader<SwingImpact>,
diff --git a/crates/benilla-app/src/sound/creature.rs b/crates/benilla-app/src/sound/creature.rs
index 69aa16f0..7f94e13a 100644
--- a/crates/benilla-app/src/sound/creature.rs
+++ b/crates/benilla-app/src/sound/creature.rs
@@ -18,7 +18,7 @@ use benilla_protocol::EntityKind;
 
 use crate::creature_anim::AnimSoundEvent;
 use crate::entities::mount::{MountBody, MountChild};
-use crate::net::{NetEntity, ObjectStore, SelfPlayer};
+use crate::net::{FieldChanged, NetEntity, ObjectStore, SelfPlayer};
 use benilla_assets::{AssetSet, LockRecover, WorldAssets};
 use benilla_world::schedule::WorldStage;
 
@@ -108,7 +108,6 @@ const fn bark_kit(voice: &benilla_formats::CreatureVoice, state: u8) -> u32 {
 ///    client's behaviour, not an oversight of ours. (It is not reachable through the pet barks on
 ///    a vmangos server: `SendPetTalk` is gated on `SUMMON_PET`, and only those four voices carry
 ///    the columns — see [`pet_talk_vocals`].)
-#[allow(clippy::too_many_arguments)]
 fn play_bark(
     kits: &mut SoundKits,
     assets: &WorldAssets,
@@ -150,13 +149,16 @@ fn play_bark(
     }
 }
 
-/// Play the death vocal on a **live** death: a unit whose store transitions alive→dead. First
-/// sight already-dead records silently (a streamed corpse doesn't cry — the same distinction the
-/// animation driver makes for the settled-corpse pose).
-#[allow(clippy::too_many_arguments)]
+/// Play the death vocal on a **live** death — the reference's two triggers, each a field edge
+/// (decision 2297): the `UNIT_FIELD_HEALTH` watcher's alive→dead arm (`0x6046f0` at `0x6047a3`,
+/// `OLD > 0 && NEW ≤ 0` — the real death handler `0x605860`) and the `UNIT_DYNAMIC_FLAGS`
+/// watcher's `UNIT_DYNFLAG_DEAD` SET edge (`0x600543`), which fires the very same `0x623a40(4)`
+/// — so a feign drops the body with its death cry, exactly like a kill (decision 1022). A unit
+/// that streams in already dead cries nothing: the edge stream is create-suppressed, the same
+/// distinction the animation driver makes for the settled-corpse pose.
 fn death_vocals(
-    changed: Query<(Entity, &NetEntity, &ObjectStore, &Transform), Changed<ObjectStore>>,
-    mut known_dead: Local<EntityHashMap<bool>>,
+    mut edges: MessageReader<FieldChanged>,
+    units: Query<(&NetEntity, &Transform)>,
     voices: Option<Res<CreatureVoices>>,
     kits: Option<ResMut<SoundKits>>,
     assets: Option<Res<WorldAssets>>,
@@ -164,24 +166,22 @@ fn death_vocals(
     config: Res<SoundConfig>,
     listener: Res<AudioListener>,
 ) {
+    use benilla_protocol::field::{FIELD_UNIT_DYNAMIC_FLAGS, FIELD_UNIT_HEALTH, UNIT_DYNFLAG_DEAD};
     let (Some(voices), Some(mut kits), Some(assets)) = (voices, kits, assets) else {
         return;
     };
     let listener = listener.pos;
-    for (entity, net, store, transform) in &changed {
-        if !matches!(net.kind, EntityKind::Unit | EntityKind::Player) {
+    for e in edges.read() {
+        let died = (e.unit_field(FIELD_UNIT_HEALTH) && e.old > 0 && e.new == 0)
+            || (e.unit_field(FIELD_UNIT_DYNAMIC_FLAGS)
+                && e.old & UNIT_DYNFLAG_DEAD == 0
+                && e.new & UNIT_DYNFLAG_DEAD != 0);
+        if !died {
             continue;
         }
-        // Reads-dead, not really-dead (decision 1022): the reference's `UNIT_DYNAMIC_FLAGS` watcher
-        // fires `0x623a40(4)` — the death vocal state — on the `UNIT_DYNFLAG_DEAD` set edge
-        // (`0x600543`), the very same call its real death handler makes (`0x6251b0`). So a feign
-        // drops the body with its death cry, exactly like a kill.
-        let dead = store.0.unit_reads_dead();
-        let was = known_dead.insert(entity, dead);
-        let fresh_death = was == Some(false) && dead;
-        if !fresh_death {
+        let Ok((net, transform)) = units.get(e.entity) else {
             continue;
-        }
+        };
         let Some(voice) = net.display_id.and_then(|d| voices.0.for_display(d)) else {
             continue;
         };
@@ -191,7 +191,7 @@ fn death_vocals(
             &mut out,
             &config,
             listener,
-            entity,
+            e.entity,
             transform.translation,
             voice,
             BARK_DEATH,
@@ -240,7 +240,6 @@ fn death_vocals(
 /// for as long as it sounds, and [`kit::object_sound_playing`] is `0x4591f0`. ALERT (class 8) and
 /// HOSTILE (the priority route) consult it below; the combat vocals (classes 0–3) consult it in
 /// `super::combat`. Players are exempt — the CGPlayer twin `0x62f880` omits the gate entirely.
-#[allow(clippy::too_many_arguments)]
 fn ai_reaction_vocals(
     mut reactions: MessageReader<crate::net::AiReactionMessage>,
     units: Query<(&NetEntity, &Transform, Option<&MountChild>)>,
@@ -334,7 +333,6 @@ fn ai_reaction_vocals(
 /// the packet for `GetPetType() == SUMMON_PET`, i.e. those same demons, at a **10% roll** per
 /// order (`Unit.cpp:8939`, `PetHandler.cpp:522`, `PetAI.cpp:335`; the other 90% is
 /// `SendPetAIReaction`, the growl). A hunter's pet never reaches either half.
-#[allow(clippy::too_many_arguments)]
 fn pet_talk_vocals(
     mut talks: MessageReader<crate::net::PetTalkMessage>,
     units: Query<(&NetEntity, &Transform)>,
@@ -404,7 +402,6 @@ fn pet_talk_vocals(
 /// **vmangos never sends this packet**, so nothing here fires against our server today. It is
 /// built because the reference is the spec, and because it is what makes loading column 29 a
 /// mechanism rather than a guess.
-#[allow(clippy::too_many_arguments)]
 fn pet_dismiss_sounds(
     mut dismissals: MessageReader<crate::net::PetDismissSoundMessage>,
     voices: Option<Res<CreatureVoices>>,
@@ -457,7 +454,6 @@ fn pet_dismiss_sounds(
 /// is **forced** regardless of the kit's own 0x200 flag — every col-23 kit in 5875 is authored
 /// `*Loop*` yet half omit the flag, so respecting it would silence half the class (`0x461d80`'s
 /// flag handling is unpinned; the record covers the reading).
-#[allow(clippy::too_many_arguments)]
 fn creature_body_loops(
     units: Query<(
         Entity,
@@ -568,7 +564,6 @@ fn creature_body_loops(
 ///   `BasiliskStand2`, so it is audible — and it is the only model in 5875 that authors `$FDX`
 ///   *and* reaches a nonzero stand column (censused across all 20 models that reach one of the 19
 ///   rows carrying a stand kit).
-#[allow(clippy::too_many_arguments)]
 fn creature_anim_vocals(
     mut events: MessageReader<AnimSoundEvent>,
     // GlobalTransform: the mount child's local Transform is the seat-relative ~origin — world
@@ -654,7 +649,6 @@ fn creature_anim_vocals(
 /// sound at all — the grunt is predicted at the landing frame off the client's own fall height.
 /// The dust leg of the same predictor lives in `creature_anim::env_damage`; both gate on the
 /// shared [`crate::creature_anim::HARD_LANDING_DESCENT`].
-#[allow(clippy::too_many_arguments)]
 fn fall_landing_vocals(
     mut landings: MessageReader<crate::creature_anim::HardLanding>,
     units: Query<(&NetEntity, &Transform)>,
diff --git a/crates/benilla-app/src/sound/death_thud.rs b/crates/benilla-app/src/sound/death_thud.rs
index 9ffa6c87..44c2db7a 100644
--- a/crates/benilla-app/src/sound/death_thud.rs
+++ b/crates/benilla-app/src/sound/death_thud.rs
@@ -128,7 +128,6 @@ fn load_death_thuds(mut commands: Commands, assets: Option<Res<WorldAssets>>) {
     }
 }
 
-#[allow(clippy::too_many_arguments)] // the standard sound-route param set + the two catalogs
 fn death_thud_sounds(
     mut events: MessageReader<AnimSoundEvent>,
     // GlobalTransform for the same reason every other anim-event consumer takes one: the tag can
diff --git a/crates/benilla-app/src/sound/emitter_pool.rs b/crates/benilla-app/src/sound/emitter_pool.rs
index 0446b7ab..d30a128f 100644
--- a/crates/benilla-app/src/sound/emitter_pool.rs
+++ b/crates/benilla-app/src/sound/emitter_pool.rs
@@ -369,7 +369,6 @@ const fn cap_step(entitled: bool, sounding_so_far: usize) -> CapStep {
 
 /// The pump (`0x461990`): fade the orphans, mark unresolvable kits, then service the admitted
 /// entries — start a channel where there is none, and otherwise only *move* the one there is.
-#[allow(clippy::too_many_arguments)] // the standard sound-driver param set
 fn pump_emitters(
     mut pool: ResMut<AmbientEmitterPool>,
     mut emitters: Query<&mut Transform, With<PoolEmitter>>,
diff --git a/crates/benilla-app/src/sound/emote.rs b/crates/benilla-app/src/sound/emote.rs
index f84cfa63..4db6aa84 100644
--- a/crates/benilla-app/src/sound/emote.rs
+++ b/crates/benilla-app/src/sound/emote.rs
@@ -95,7 +95,6 @@ fn load_emote_sounds(mut commands: Commands, assets: Option<Res<WorldAssets>>) {
 /// Route the bridged emotes: a text emote plays the performer's race/sex voice; an anim emote
 /// plays its event kit. A performer without race/sex in its store yet (partial snapshot) stays
 /// silent rather than guessing a voice.
-#[allow(clippy::too_many_arguments)]
 fn emote_sounds(
     mut msgs: MessageReader<EmoteMessage>,
     units: Query<(&ObjectStore, &Transform)>,
diff --git a/crates/benilla-app/src/sound/footsteps.rs b/crates/benilla-app/src/sound/footsteps.rs
index 8aee65c8..a759013a 100644
--- a/crates/benilla-app/src/sound/footsteps.rs
+++ b/crates/benilla-app/src/sound/footsteps.rs
@@ -102,7 +102,6 @@ fn load_footsteps(mut commands: Commands, assets: Option<Res<WorldAssets>>) {
     }
 }
 
-#[allow(clippy::too_many_arguments)]
 fn footstep_sounds(
     mut events: MessageReader<AnimSoundEvent>,
     // GlobalTransform: a mounted unit's steps are the MOUNT model's own tags, fired by the
diff --git a/crates/benilla-app/src/sound/gameobject.rs b/crates/benilla-app/src/sound/gameobject.rs
index c5053b16..022be03b 100644
--- a/crates/benilla-app/src/sound/gameobject.rs
+++ b/crates/benilla-app/src/sound/gameobject.rs
@@ -93,7 +93,6 @@ fn go_event_slot(ident: &[u8; 4]) -> Option<usize> {
 /// `SMSG_PLAY_OBJECT_SOUND(3355)` ~200 ms earlier — and every lit prop in the world, whose
 /// `CampFireSmallLoop`/`TorchLoop`/`ElvenFountainSmallA` take the pool lane and hum until the
 /// object's state changes under them.
-#[allow(clippy::too_many_arguments)]
 pub(super) fn go_display_sounds(
     mut dispatched: MessageReader<GoStateDispatch>,
     mut events: MessageReader<crate::creature_anim::AnimSoundEvent>,
diff --git a/crates/benilla-app/src/sound/greeting.rs b/crates/benilla-app/src/sound/greeting.rs
index 2f9f4621..c075c399 100644
--- a/crates/benilla-app/src/sound/greeting.rs
+++ b/crates/benilla-app/src/sound/greeting.rs
@@ -182,7 +182,6 @@ fn resolve(
 
 /// Play one line for `npc` at kit `kit_id` (0 = no such line → nothing), variation `variant`
 /// (`None` = free-pick), latch-gated on the unit's channel (`0x60c28c`) and tagged with the unit.
-#[allow(clippy::too_many_arguments)]
 fn play_line(
     npc: Entity,
     kit_id: u32,
@@ -221,7 +220,6 @@ fn play_line(
 }
 
 /// System 1 — the select greeting: drain [`NpcGreetingRequest`]s and play the cycling welcome.
-#[allow(clippy::too_many_arguments)]
 fn play_select_greetings(
     mut reqs: MessageReader<NpcGreetingRequest>,
     mut seq: Local<GreetSeq>,
@@ -279,7 +277,6 @@ fn play_select_greetings(
 
 /// System 2 — the interaction-window hello/goodbye: diff the active interaction NPC (the union of
 /// the open window sessions) and play hello on open/swap, goodbye on close-to-nothing.
-#[allow(clippy::too_many_arguments)]
 fn play_window_greetings(
     merchant: Res<MerchantOpen>,
     gossip: Res<GossipState>,
diff --git a/crates/benilla-app/src/sound/kit.rs b/crates/benilla-app/src/sound/kit.rs
index 7ebe974d..618861c8 100644
--- a/crates/benilla-app/src/sound/kit.rs
+++ b/crates/benilla-app/src/sound/kit.rs
@@ -576,7 +576,6 @@ pub(crate) enum KitRef<'a> {
 /// Silently succeeds without playing when the kit is out of range or duplicate-suppressed
 /// (matching the client: gates are not errors) — `Ok(false)` is that outcome, see
 /// [`play_kit_ext`]'s return.
-#[allow(clippy::too_many_arguments)]
 pub(crate) fn play_kit(
     kits: &mut SoundKits,
     assets: &WorldAssets,
@@ -617,7 +616,6 @@ pub(crate) fn play_kit(
 /// per-bus cap, the duplicate walk), and callers that care read that zero. Almost none do, and
 /// `Ok(false)` reads exactly like `Ok(())` did for them; [`super::vocal`]'s escalation counter is
 /// the one place the distinction is the mechanism.
-#[allow(clippy::too_many_arguments)]
 pub(super) fn play_kit_ext(
     kits: &mut SoundKits,
     assets: &WorldAssets,
@@ -762,7 +760,18 @@ pub(super) fn play_kit_ext(
         return Ok(false);
     }
 
-    let mixer = out.mixer.as_mut().context("no audio device")?;
+    // **No device is a no-op, not an error.** Running silent (`WOW_NOSOUND=1`, CI, an unattended
+    // probe — or a player whose device is genuinely gone) is a startup fact `sound::plugin`
+    // already warns about ONCE. Returning `Err` here turned that one fact into a warn PER EVENT
+    // at every one of this module's ~25 call sites: a 75 s lava probe logged 3975 identical
+    // `no audio device` lines, 89% of the file, which is why `liquid_loop` grew a guard of its
+    // own — and a probe sweep still footstepped one warn every half-second. The fix belongs here,
+    // at the one place that knows, rather than as a guard repeated at each caller. `false` is the
+    // signal this function already uses for "the gates dropped it", which is exactly what
+    // happened.
+    let Some(mixer) = out.mixer.as_mut() else {
+        return Ok(false);
+    };
     let (track, handle) = match pos {
         Some(p) => {
             // `EAXDef 0` = no `SoundSamplePreferences` row = the reference's NULL-slot skip at
@@ -984,7 +993,10 @@ pub(crate) fn play_file(
     if !claim_voice(out, amp) {
         return Ok(());
     }
-    let mixer = out.mixer.as_mut().context("no audio device")?;
+    // No device is a no-op here too — see the note in [`play_kit_ext`].
+    let Some(mixer) = out.mixer.as_mut() else {
+        return Ok(());
+    };
     let handle = mixer.play_2d(data)?;
     if let Some(probe) = out.probe.as_ref() {
         probe.note_play(0, path, "sfx", "2d");
diff --git a/crates/benilla-app/src/sound/liquid_loop.rs b/crates/benilla-app/src/sound/liquid_loop.rs
index 0e85c573..47de19c5 100644
--- a/crates/benilla-app/src/sound/liquid_loop.rs
+++ b/crates/benilla-app/src/sound/liquid_loop.rs
@@ -89,7 +89,6 @@ fn load_water_sounds(mut commands: Commands, assets: Option<Res<WorldAssets>>) {
 }
 
 /// The per-frame driver (`0x462b50`): scan, arm/retire by priority, slew, fade.
-#[allow(clippy::too_many_arguments)]
 fn drive_liquid_loops(
     mut state: ResMut<LiquidLoopState>,
     water_sounds: Option<Res<WaterSounds>>,
@@ -284,7 +283,6 @@ fn near_clamped(pos: Vec3, player: Vec3) -> Vec3 {
 /// rides the emitter's `Transform`), force-looped (the type-22 kits are all authored loops but
 /// the lava pool omits the 0x200 flag — the same column-authority INTERIM as the creature
 /// body-loop), at an initial pump-lane gain.
-#[allow(clippy::too_many_arguments)]
 fn start_loop(
     kits: &mut SoundKits,
     assets: &WorldAssets,
diff --git a/crates/benilla-app/src/sound/message.rs b/crates/benilla-app/src/sound/message.rs
index 4cac62a0..148b2c23 100644
--- a/crates/benilla-app/src/sound/message.rs
+++ b/crates/benilla-app/src/sound/message.rs
@@ -87,7 +87,6 @@ impl MessageSounds {
 }
 
 /// Drain [`MessageSounds`]: cue by name, or speech by line (module doc).
-#[allow(clippy::too_many_arguments)]
 fn play_message_sounds(
     mut queue: ResMut<MessageSounds>,
     mut speech: ResMut<VocalSpeech>,
diff --git a/crates/benilla-app/src/sound/mod.rs b/crates/benilla-app/src/sound/mod.rs
index 91756f38..13012951 100644
--- a/crates/benilla-app/src/sound/mod.rs
+++ b/crates/benilla-app/src/sound/mod.rs
@@ -56,6 +56,9 @@ pub(crate) fn kit_decodes() -> u32 {
 }
 pub(crate) use glue::GlueSound;
 pub(crate) use greeting::NpcGreetingRequest;
+/// Named by the schedule tests' class table (`game_plugins::schedule_tests::Classes`, 2287).
+#[cfg(test)]
+pub(crate) use kit::SoundKits;
 pub(crate) use message::MessageSounds;
 pub(crate) use mixer::Mixer;
 pub(crate) use ui::{AutoEquipSound, LootPickupSound};
@@ -475,7 +478,7 @@ fn load_materials(mut commands: Commands, assets: Option<Res<benilla_assets::Wor
 /// object not streamed, and a template still in flight (asked once, answered next frame).
 pub(super) fn worn_chest_material(
     store: Option<&crate::net::ObjectStore>,
-    items: &mut crate::items::Items,
+    items: &crate::items::Items,
     net: &crate::net::NetCommands,
 ) -> Option<u32> {
     /// Index 4 of the inv-slot array — `0x62fa50`/`0x62fb86` read the fifth 8-byte guid.
@@ -521,8 +524,34 @@ fn world_audio_live(
 
 pub(crate) struct SoundPlugin;
 
+/// The sound rows' change callback (decision 2303): the volumes clamp to `[0, 1]`, the enables
+/// are the client's int-parse + `!= 0` — `SoundReverb`'s own parse is literally that
+/// (`0x4574d0`: `setne al`). Writes only the arm it matched, so a `SoundConfig` change is a
+/// sound setting moving and nothing else.
+pub(crate) fn on_cvar(ev: On<crate::cvars::CvarChanged>, mut sound: ResMut<SoundConfig>) {
+    let v = ev.num();
+    match ev.key().as_str() {
+        "mastervolume" => sound.master = v.clamp(0.0, 1.0),
+        "soundvolume" => sound.sfx = v.clamp(0.0, 1.0),
+        "musicvolume" => sound.music = v.clamp(0.0, 1.0),
+        "ambiencevolume" => sound.ambience = v.clamp(0.0, 1.0),
+        "mastersoundeffects" => sound.enabled = v != 0.0,
+        "enablemusic" => sound.music_enabled = v != 0.0,
+        "enableambience" => sound.ambience_enabled = v != 0.0,
+        "enableerrorspeech" => sound.error_speech = v != 0.0,
+        "sound_enablesoundwhengameisinbg" => sound.background_sound = v != 0.0,
+        "soundreverb" => sound.reverb = v != 0.0,
+        "soundoutputlimiter" => sound.limiter = v != 0.0,
+        "soundlisteneratcharacter" => sound.listener_at_character = v != 0.0,
+        "emotesounds" => sound.emote_sounds = v != 0.0,
+        "soundzonemusicnodelay" => sound.zone_music_no_delay = v != 0.0,
+        _ => {}
+    }
+}
+
 impl Plugin for SoundPlugin {
     fn build(&self, app: &mut App) {
+        app.add_observer(on_cvar);
         // Who gets sound: a run a human launched, and only that. The default posture is audible
         // (decision 1026 — `SoundConfig::muted` starts false), so the silence has to be opt-in by
         // the *automated* callers, both of which are unattended by construction:
diff --git a/crates/benilla-app/src/sound/mount.rs b/crates/benilla-app/src/sound/mount.rs
index c0783b23..8bb63fe9 100644
--- a/crates/benilla-app/src/sound/mount.rs
+++ b/crates/benilla-app/src/sound/mount.rs
@@ -8,12 +8,9 @@
 //! mounted→unmounted transition of any visible unit; first sight of an unmounted unit records
 //! silently, and a remount (id→id′) is not a dismount.
 
-use bevy::ecs::entity::EntityHashMap;
 use bevy::prelude::*;
 
-use benilla_protocol::EntityKind;
-
-use crate::net::{NetEntity, ObjectStore};
+use crate::net::FieldChanged;
 use benilla_assets::WorldAssets;
 use benilla_world::schedule::WorldStage;
 
@@ -28,10 +25,12 @@ use super::{AudioListener, SoundConfig, SoundOutput};
 /// as `SpiritWolf_DONOTRENAME` — a transcription-level difference, the row is unambiguous.
 const DISMOUNT_KIT: &str = "SpiritWolf (DONOTRENAME)";
 
-/// Play the fixed dismount kit on a live mounted→unmounted transition of any streamed unit.
+/// Play the fixed dismount kit on a live mounted→unmounted transition of any streamed unit —
+/// the `UNIT_FIELD_MOUNTDISPLAYID` edge with a zero NEW value (decision 2297: the field-edge
+/// stream is create-suppressed, so streaming in unmounted is not a dismount by construction).
 fn dismount_sounds(
-    changed: Query<(Entity, &NetEntity, &ObjectStore, &Transform), Changed<ObjectStore>>,
-    mut known_mount: Local<EntityHashMap<u32>>,
+    mut edges: MessageReader<FieldChanged>,
+    poses: Query<&Transform>,
     kits: Option<ResMut<SoundKits>>,
     assets: Option<Res<WorldAssets>>,
     mut out: NonSendMut<SoundOutput>,
@@ -42,21 +41,15 @@ fn dismount_sounds(
         return;
     };
     let listener = listener.pos;
-    for (entity, net, store, transform) in &changed {
-        if !matches!(net.kind, EntityKind::Unit | EntityKind::Player) {
+    for e in edges.read() {
+        if !e.unit_field(benilla_protocol::field::FIELD_UNIT_MOUNTDISPLAYID) || e.new != 0 {
             continue;
         }
-        let mount = store.0.unit_mount_display_id();
-        let was = known_mount.insert(entity, mount);
-        // Only the live mounted→unmounted edge sounds — streaming in unmounted is not a dismount.
-        if !(was.is_some_and(|w| w != 0) && mount == 0) {
+        let Ok(transform) = poses.get(e.entity) else {
             continue;
-        }
-        debug!(
-            "dismount kit on {entity:?} (was mount {})",
-            was.unwrap_or(0)
-        );
-        if let Err(e) = play_kit(
+        };
+        debug!("dismount kit on {:?} (was mount {})", e.entity, e.old);
+        if let Err(err) = play_kit(
             &mut kits,
             &assets,
             &mut out,
@@ -66,7 +59,7 @@ fn dismount_sounds(
             Some(transform.translation),
             SoundCategory::Sfx,
         ) {
-            warn!("dismount kit ({DISMOUNT_KIT}): {e:#}");
+            warn!("dismount kit ({DISMOUNT_KIT}): {err:#}");
         }
     }
 }
diff --git a/crates/benilla-app/src/sound/reverb.rs b/crates/benilla-app/src/sound/reverb.rs
index 6efe753d..af89c71d 100644
--- a/crates/benilla-app/src/sound/reverb.rs
+++ b/crates/benilla-app/src/sound/reverb.rs
@@ -60,7 +60,6 @@ struct AppliedPreset(Option<u32>);
 /// React to area/interior/underwater changes: resolve the preset id and hand the row to the
 /// mixer. The WMO interior's preset overrides the terrain area's (decision 0076 — this is where
 /// ~4 000 CAVE/AUDITORIUM rows live); zero falls through to the area chain.
-#[allow(clippy::too_many_arguments)]
 fn zone_reverb(
     mut applied: ResMut<AppliedPreset>,
     mut out: NonSendMut<SoundOutput>,
diff --git a/crates/benilla-app/src/sound/sheathe.rs b/crates/benilla-app/src/sound/sheathe.rs
index a2de56b1..b8aa06c6 100644
--- a/crates/benilla-app/src/sound/sheathe.rs
+++ b/crates/benilla-app/src/sound/sheathe.rs
@@ -49,7 +49,6 @@ fn load_sheathe_sounds(mut commands: Commands, assets: Option<Res<WorldAssets>>)
     }
 }
 
-#[allow(clippy::too_many_arguments)]
 fn sheathe_sounds(
     mut swaps: MessageReader<SheathSwapMessage>,
     units: Query<(&Transform, &Wielded), With<NetEntity>>,
diff --git a/crates/benilla-app/src/sound/spell.rs b/crates/benilla-app/src/sound/spell.rs
index bde10bd6..d22a1e14 100644
--- a/crates/benilla-app/src/sound/spell.rs
+++ b/crates/benilla-app/src/sound/spell.rs
@@ -21,7 +21,6 @@ use super::kit::{
 };
 use super::{AudioListener, SoundConfig, SoundOutput};
 
-#[allow(clippy::too_many_arguments)] // the standard sound-route param set + the hold ledger
 fn route_spell_kit_sounds(
     mut events: MessageReader<SpellKitSound>,
     transforms: Query<&Transform, Without<Camera3d>>,
diff --git a/crates/benilla-app/src/sound/ui.rs b/crates/benilla-app/src/sound/ui.rs
index 9fce2b15..36f4fab9 100644
--- a/crates/benilla-app/src/sound/ui.rs
+++ b/crates/benilla-app/src/sound/ui.rs
@@ -153,11 +153,10 @@ enum CursorGesture {
 /// missing link (template in flight, unknown display, group 0, kit 0, absent catalog) is the
 /// client's own silent return, never an error. The previous payload is tracked here (a `Local`),
 /// not in the VM — the engine-free model owns the state, the app owns the sound.
-#[allow(clippy::too_many_arguments)]
 fn play_item_gesture_sounds(
     script: Option<NonSend<UiScript>>,
     mut prev: Local<crate::ui_script::VmMemo<Option<CursorPayload>>>,
-    mut items: ResMut<Items>,
+    items: Res<Items>,
     displays: Option<Res<ItemDisplays>>,
     sounds: Option<Res<ItemSounds>>,
     kits: Option<ResMut<SoundKits>>,
@@ -267,7 +266,6 @@ fn play_item_gesture_sounds(
 /// through the byte-verified chain `ItemGroupSounds[ItemDisplayInfo[displayId].group_sounds]
 /// .kit[gesture]` and play it 2D on the SFX bucket. Every missing link (unknown display, group 0,
 /// kit 0) is the client's own silent return, never an error.
-#[allow(clippy::too_many_arguments)]
 fn play_item_gesture(
     display_id: u32,
     gesture: ItemGesture,
diff --git a/crates/benilla-app/src/sound/vocal.rs b/crates/benilla-app/src/sound/vocal.rs
index a8426f0c..517ba486 100644
--- a/crates/benilla-app/src/sound/vocal.rs
+++ b/crates/benilla-app/src/sound/vocal.rs
@@ -250,7 +250,6 @@ fn build_vocal_table(
 /// Say one error-speech line in the local player's own voice — the app-side entry point
 /// [`super::message`] calls, and the only caller there should ever be (the reference has exactly
 /// one too).
-#[allow(clippy::too_many_arguments)]
 pub(super) fn speak_line(
     line: u8,
     speech: &mut VocalSpeech,
diff --git a/crates/benilla-app/src/sound/water.rs b/crates/benilla-app/src/sound/water.rs
index d83fe0e2..b5702b2a 100644
--- a/crates/benilla-app/src/sound/water.rs
+++ b/crates/benilla-app/src/sound/water.rs
@@ -51,7 +51,6 @@ type SplashQuery = (Entity, &'static Transform, Option<&'static CollisionHeight>
 type SplashGate = Or<(Changed<Transform>, Changed<CollisionHeight>)>;
 
 /// Play the water splash on a unit's `0.4·h` depth-line crossing, either direction (module docs).
-#[allow(clippy::too_many_arguments)] // the sound-play plumbing, one param per concern
 fn water_splashes(
     units: Query<SplashQuery, (With<NetEntity>, SplashGate)>,
     world: benilla_world::world_point::WorldPoint,
diff --git a/crates/benilla-app/src/sound/zone.rs b/crates/benilla-app/src/sound/zone.rs
index a513a0a2..79d5e1e8 100644
--- a/crates/benilla-app/src/sound/zone.rs
+++ b/crates/benilla-app/src/sound/zone.rs
@@ -265,7 +265,6 @@ fn load_area_sounds(mut commands: Commands, assets: Option<Res<WorldAssets>>) {
 
 /// The per-frame scheduler: react to area/phase changes, arm the transition fade-stop, run the
 /// silence timer, start the next track, and keep the stream volumes on the sliders.
-#[allow(clippy::too_many_arguments)]
 fn zone_audio(
     mut zone: NonSendMut<ZoneAudio>,
     mut out: NonSendMut<SoundOutput>,
@@ -644,7 +643,6 @@ fn start_music_stream(
 /// out on the backend (drop the handle — the ramp finishes on kira's thread) while the new bed
 /// starts silent and fades in under the per-frame envelope. This mirrors the client's `0x460b00`
 /// (a 5.0 s crossfade — out `0x7a5a10(5.0f)`, in `0x7a5dc0(0)` → `0x7a57b0(5.0f)`).
-#[allow(clippy::too_many_arguments)]
 fn swap_ambience(
     zone: &mut ZoneAudio,
     out: &mut SoundOutput,
@@ -707,7 +705,6 @@ fn swap_ambience(
 /// `net::apply_net_updates`): 2D kits and object-positioned 3D kits go through the kit player;
 /// music takes the zone music slot (interrupting the current track — the zone scheduler resumes
 /// its own rotation after the pushed track ends, via the normal silence interval).
-#[allow(clippy::too_many_arguments)]
 fn server_sounds(
     mut msgs: MessageReader<ServerSoundMessage>,
     mut zone: NonSendMut<ZoneAudio>,
diff --git a/crates/benilla-app/src/spell_mods.rs b/crates/benilla-app/src/spell_mods.rs
new file mode 100644
index 00000000..cfb2cede
--- /dev/null
+++ b/crates/benilla-app/src/spell_mods.rs
@@ -0,0 +1,564 @@
+//! The **talent spell-modifier tables** — the client-side half of every talent that cheapens a
+//! spell, shortens its cast or cooldown, extends its range or radius, or lengthens its duration.
+//!
+//! Two `i32[64][29]` tables (`SPELLMOD_FLAT 0xcead60`, `SPELLMOD_PCT 0xcecb30`), one handler that
+//! fills them (`Spell_C::HandleSetSpellModifier 0x6e9950`, registered for both
+//! `SMSG_SET_FLAT_SPELL_MODIFIER` and `SMSG_SET_PCT_SPELL_MODIFIER` by `Spell_C::SystemInitialize
+//! 0x6e7150`), and one reader that answers them (`GetSpellModifiers 0x6e6b30`). Every law here is
+//! byte-VERIFIED in wow-re `system/spell/scratch/spellmod-table-law.md`; this module is that note
+//! turned into the one place benilla asks "does a talent change this number?".
+//!
+//! **The index is `mask_bit * 29 + op`, in both directions, and it is the thing to get right.**
+//! The writer multiplies its FIRST wire byte (`6e9993: imul eax,eax,0x1d`); the reader
+//! strength-reduces the same address to `4*op + 0x74*i` over a loop counter bounded by
+//! `cmp eax,0x40`, which forces the first factor to be the 0..63 `SpellFamilyFlags` **bit index**
+//! and the second the 0..28 SpellModOp. The transposed form addresses 47% of the array
+//! (`29*28 + 63 = 875` against 1856 cells) and makes writer and reader touch systematically
+//! disjoint cells — every modifier silently dropped, nothing to see in a log. wow-re's own
+//! `wave-handlers.md` carried the transposed form, `verified`, for months. [`index`] is the single
+//! expression both sides here go through, so they cannot drift apart.
+//!
+//! The server agrees, independently and in source: vmangos `Player::SendSpellMod`
+//! (`Objects/Player.cpp:17815`) loops `for (int eff = 0; eff < 64; ++eff)` over the modifier's own
+//! 64-bit mask and writes `uint8(eff)`, `uint8(mod->op)`, `int32(val)` for each set bit — first
+//! byte the family-flag bit, second the op — with `MAX_SPELLMOD = 29` as the enum's size.
+//!
+//! **The value is absolute.** The store is a plain `mov`, and vmangos `Player::SendSpellMod` sends
+//! one packet per set mask bit carrying that `(bit, op)` pair's total. Nothing accumulates, nothing
+//! expires, and there is no talent-change clear: a respec is a fresh set of absolute cells.
+//!
+//! **The read is three conjunct gates and then a sum over all 64 bits** ([`SpellModifiers::apply`]
+//! via [`SpellModifiers::modifiers`]): the spell's `SpellFamilyName` must be nonzero, must equal
+//! the local player's own class family ([`SpellModifiers::class_family`]), and the spell must not
+//! carry `AttributesEx3` bit 29. Then every set bit of the spell's 64-bit `SpellFamilyFlags`
+//! contributes one cell from each table — **no early break**, and the high dword is live (322
+//! shipped spells set more than one bit; the highest index in the file is 35).
+//!
+//! **The trap this module's shape exists to make unrepresentable.** `0x6e6b30` has four exits.
+//! Three write `(flat, pct) = (0, 100)`; the fourth — *the loop ran and nothing accumulated*, which
+//! is the COMMON case — leaves `pct = 0`, because it never reaches the `add ebx,0x64`. The
+//! reference gets away with it because all three appliers gate on the returned boolean. A
+//! re-implementation that hands a caller a bare `(flat, pct)` pair multiplies every unmodified
+//! spell by **zero**: every spell would cost 0 mana. So [`SpellModifiers::modifiers`] returns
+//! `Option<SpellMod>` — `None` IS that exit, and it is not a pair anyone can multiply by — and
+//! [`SpellMod`] is private with [`SpellMod::apply`] its only verb. `apply` is the reference's own
+//! integer applier `0x6e6af0`, boolean gate included.
+//!
+//! ## The 29 ops
+//!
+//! All 29 are stored: the stride is what the index arithmetic is made of, and nine of them have no
+//! reader anywhere in the reference image while the handler will happily write them. The numbers
+//! are VERIFIED (every one of the 35 call sites passes a literal); the names are vmangos
+//! corroboration, and **op 24's name is INFERRED and suspect** — the client routes aura 65
+//! (*casting speed*) to it while vmangos calls it `SPELL_BONUS_DAMAGE`, so key on the number.
+//!
+//! | op | name | benilla consumer |
+//! |---|---|---|
+//! | 0 | DAMAGE | — |
+//! | 1 | DURATION | — |
+//! | 2 | THREAT | — |
+//! | 3 | ATTACK_POWER | — |
+//! | 4 | CHARGES | — |
+//! | 5 | RANGE | — |
+//! | 6 | RADIUS | — |
+//! | 7 | CRITICAL_CHANCE | never read by the reference |
+//! | 8 | ALL_EFFECTS | — |
+//! | 9 | NOT_LOSE_CASTING_TIME | never read |
+//! | 10 | CASTING_TIME | — |
+//! | 11 | COOLDOWN | — |
+//! | 12 | SPEED | — |
+//! | 13 | *(no enumerator)* | never read |
+//! | **14** | **COST** | [`OP_COST`] — `ui_action::usable::power_cost` |
+//! | 15 | CRIT_DAMAGE_BONUS | never read |
+//! | 16 | RESIST_MISS_CHANCE | never read |
+//! | 17 | JUMP_TARGETS | — |
+//! | 18 | CHANCE_OF_SUCCESS | — |
+//! | 19 | ACTIVATION_TIME | — |
+//! | 20 | EFFECT_PAST_FIRST | never read |
+//! | 21 | GLOBAL_COOLDOWN | — |
+//! | 22 | DOT | — |
+//! | 23 | HASTE | — |
+//! | 24 | *(aura-65 op; name INFERRED)* | — |
+//! | 25 | *(no enumerator)* | never read |
+//! | 26 | *(no enumerator)* | never read |
+//! | 27 | MULTIPLE_VALUE | — |
+//! | 28 | RESIST_DISPEL_CHANCE | never read |
+//!
+//! ## Where this diverges from the reference, and why
+//!
+//! - **Both wire bytes are range-checked.** The reference checks neither: `field1 = 64, field2 = 19`
+//!   writes at byte 7500 from the FLAT table's base — 76 past its end, straight onto `[0xcecaac]`,
+//!   the class-family global the reader itself compares against — and `field1 = 65, field2 = 23`
+//!   lands on element 0 of the PCT table. That is a buffer overrun, not a behaviour, and reproducing it is not
+//!   fidelity. [`SpellModifiers::set`] drops the packet with a `warn!` naming both values.
+//! - **The lifecycle hangs off the session edge, not a process global.** The reference clears both
+//!   tables (and the class family) in `0x6e7150`, which runs once per **world-enter** — the Enter
+//!   World click, through `CGlueMgr::Update 0x46b930` — and nowhere else; its teardown
+//!   `Spell_C::Destroy 0x6e99e0` deliberately does not touch them. [`clear_on_world_enter`] is that
+//!   same edge, `OnEnter(ClientState::InWorld)`.
+
+use bevy::prelude::*;
+
+use benilla_formats::SpellDisplay;
+
+use crate::char_select::ClientState;
+use crate::chr_classes::ChrClassTable;
+use crate::net::{ObjectStore, SelfPlayer};
+
+/// The number of SpellModOps — the table's column count, and therefore the index **stride**
+/// (`imul eax,eax,0x1d`, and the reader's `add edx,0x74` = `29*4`).
+const OPS: usize = 29;
+/// The number of `SpellFamilyFlags` bits — the table's row count (`cmp eax,0x40`).
+const BITS: usize = 64;
+/// `0x740` dwords per table, exactly (`6e72ba: mov ecx,0x740` before each `rep stosd`), and
+/// `29*63 + 28 == 1855` fills it with nothing left over — which is itself one of the three
+/// discriminators that settle the index's factor roles.
+const CELLS: usize = BITS * OPS;
+
+/// `SPELLMOD_COST` — the one op benilla reads today ([`crate::ui_action::usable::power_cost`], the
+/// reference's `GetPowerCost 0x6e31b0` @ `6e32e3`). The module header's table names the other 28.
+pub(crate) const OP_COST: u8 = 14;
+
+/// `AttributesEx3` bit 29 (`SPELL_ATTR_EX3_IGNORE_CASTER_MODIFIERS`, vmangos
+/// `SpellDefines.h:940`) — the third gate, `0x6e6b52: test [SpellRec+0x24], 0x20000000`. A spell
+/// carrying it takes no modifier at all, whatever the tables say.
+const ATTR_EX3_IGNORE_CASTER_MODIFIERS: u32 = 0x2000_0000;
+
+/// A cell's offset in either table. **The one expression**, so the writer and the reader can never
+/// disagree about which of the two bytes is the row — the exact failure this system is famous for.
+///
+/// Callers have already range-checked both arguments ([`SpellModifiers::set`] refuses the packet,
+/// [`SpellModifiers::modifiers`] refuses the op and iterates the bit itself), so this cannot leave
+/// the array.
+fn index(mask_bit: u8, op: u8) -> usize {
+    usize::from(mask_bit) * OPS + usize::from(op)
+}
+
+/// What a talent does to one number: a flat term added first, then a percentage applied — the
+/// reference's `(value + flat) * pct / 100`.
+///
+/// Private, and [`Self::apply`] is the only way to spend it, because a `(flat, pct)` pair loose in
+/// the codebase is exactly the shape that multiplies an unmodified spell by zero (module header).
+/// [`Default`] is the identity, matching the three gate-failure exits that write `(0, 100)`.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+struct SpellMod {
+    flat: i32,
+    /// Already `max(0, 100 + Σ)` — the `+100` happens **once**, inside the reader (`6e6bb4`), and
+    /// never in an applier. So this is a raw percentage multiplier: 100 is "unchanged".
+    pct: i32,
+}
+
+impl Default for SpellMod {
+    fn default() -> Self {
+        SpellMod { flat: 0, pct: 100 }
+    }
+}
+
+impl SpellMod {
+    /// The reference's integer applier `0x6e6af0`: `*v = (*v + flat) * pct / 100`, with the flat
+    /// term added **before** the percentage and the division truncating **toward zero** (C signed
+    /// division — `6e6b14`'s magic-multiply/`sar 5`/`shr 31`/`add` sequence is exactly that).
+    ///
+    /// Computed in `i64` and saturated back, where the reference's 32-bit `imul` simply wraps: a
+    /// wrap here would be a debug panic on a packet nobody sent, and no real modifier comes within
+    /// several orders of magnitude of the boundary (a cost is a few hundred, a pct a few hundred).
+    fn apply(self, value: i32) -> i32 {
+        let scaled = (i64::from(value) + i64::from(self.flat)) * i64::from(self.pct) / 100;
+        scaled.clamp(i64::from(i32::MIN), i64::from(i32::MAX)) as i32
+    }
+}
+
+/// The two tables and the class family the gate compares against — benilla's `0xcead60` /
+/// `0xcecb30` / `0xcecaac`.
+///
+/// Filled only by the wire (`net::apply::spells::set_spell_modifier`), cleared only at world-enter
+/// ([`clear_on_world_enter`]), and read live at every call site: like the reference, there is no
+/// derived cache to invalidate.
+#[derive(Resource)]
+pub(crate) struct SpellModifiers {
+    flat: [i32; CELLS],
+    pct: [i32; CELLS],
+    /// The local player's class spell-family (`ChrClasses.dbc` field 15). `0` until the avatar
+    /// resolves, which is why the reader's first conjunct (`SpellFamilyName != 0`) exists at all:
+    /// it covers exactly that window, where a family-0 spell would otherwise match.
+    class_family: u32,
+}
+
+impl Default for SpellModifiers {
+    fn default() -> Self {
+        SpellModifiers {
+            flat: [0; CELLS],
+            pct: [0; CELLS],
+            class_family: 0,
+        }
+    }
+}
+
+impl SpellModifiers {
+    /// Store one cell, absolutely — `HandleSetSpellModifier 0x6e9950`'s whole body.
+    ///
+    /// The range check is benilla's, not the reference's (module header): a `mask_bit` of 64 is a
+    /// write into the neighbouring global there, and we would rather drop a packet than reproduce
+    /// an overrun. Nothing legitimate trips it — vmangos derives both bytes from its own enums.
+    pub(crate) fn set(&mut self, flat: bool, mask_bit: u8, op: u8, value: i32) {
+        if usize::from(mask_bit) >= BITS || usize::from(op) >= OPS {
+            warn!(
+                "spell_mods: dropping an out-of-range {} modifier — mask bit {mask_bit} \
+                 (0..=63), op {op} (0..=28), value {value}",
+                if flat { "flat" } else { "pct" }
+            );
+            return;
+        }
+        let cell = index(mask_bit, op);
+        if flat {
+            self.flat[cell] = value;
+        } else {
+            self.pct[cell] = value;
+        }
+    }
+
+    /// Set the gate's right-hand side — the reference's `0x6e6ca0`, whose only caller is the
+    /// local-player create-finalise. [`track_class_family`] is that caller here.
+    pub(crate) fn set_class_family(&mut self, family: u32) {
+        self.class_family = family;
+    }
+
+    /// Drop everything — both tables and the class family, the exact set `0x6e7150` zeroes.
+    pub(crate) fn clear(&mut self) {
+        self.flat = [0; CELLS];
+        self.pct = [0; CELLS];
+        self.class_family = 0;
+    }
+
+    /// `GetSpellModifiers 0x6e6b30` for one spell and one op: the three gates, then the sum over
+    /// every set family bit.
+    ///
+    /// `None` = "no modifier applies", covering **all four** of the reference's false exits — the
+    /// three gate failures and the both-sums-are-zero one (`6e6ba8`/`6e6bad`). The caller uses its
+    /// base value unchanged; see the module header for why this is an `Option` and not a pair.
+    ///
+    /// The op is range-checked here too. The reference does not check it either (`shl edx,2` on an
+    /// unmasked argument) and is safe only because all 35 of its call sites pass a literal ≤ 27 —
+    /// so do ours, and this costs one compare to make that structural rather than conventional.
+    fn modifiers(&self, d: &SpellDisplay, op: u8) -> Option<SpellMod> {
+        if d.spell_family == 0
+            || d.spell_family != self.class_family
+            || d.attributes_ex3 & ATTR_EX3_IGNORE_CASTER_MODIFIERS != 0
+            || usize::from(op) >= OPS
+        {
+            return None;
+        }
+        // All 64 iterations, no early break: `n` set bits accumulate `n` cells from each table
+        // (`6e6b8f`/`6e6b97` are `add [mem],reg`, and the only branch in the body is the skip).
+        // `wrapping_add` because the reference's accumulators do, and because a server we do not
+        // control should not be able to panic a debug build.
+        let (mut flat, mut pct) = (0i32, 0i32);
+        for bit in 0..BITS as u8 {
+            if d.spell_family_flags >> bit & 1 == 0 {
+                continue;
+            }
+            let cell = index(bit, op);
+            flat = flat.wrapping_add(self.flat[cell]);
+            pct = pct.wrapping_add(self.pct[cell]);
+        }
+        if flat == 0 && pct == 0 {
+            return None;
+        }
+        // The `+100` and the clamp, once, here — never in an applier (`6e6bb4` … `6e6bc7`).
+        Some(SpellMod {
+            flat,
+            pct: pct.wrapping_add(100).max(0),
+        })
+    }
+
+    /// Put a spell's modifier for `op` onto `value`, or hand `value` back untouched — the
+    /// reference's applier plus its `test al,al` gate, in one verb so a caller cannot skip the
+    /// gate.
+    pub(crate) fn apply(&self, d: &SpellDisplay, op: u8, value: i32) -> i32 {
+        self.modifiers(d, op).map_or(value, |m| m.apply(value))
+    }
+}
+
+/// Entering the world drops both tables and the class family — `Spell_C::SystemInitialize
+/// 0x6e7150`'s two `rep stosd`s and its `[0xcecaac] = 0`, which the §5 walked to
+/// `CGlueMgr::Update 0x46b930` and pinned to **once per world entry**, not once per process.
+///
+/// There is deliberately nothing else: no talent-change clear (the server re-sends absolute cells),
+/// and no world-LEAVE clear (the reference's own teardown `0x6e99e0` never touches them, and the
+/// next entry is what zeroes them).
+fn clear_on_world_enter(mut mods: ResMut<SpellModifiers>) {
+    mods.clear();
+}
+
+/// Keep the gate's class family in step with the avatar — the reference's `0x6e6ca0`, whose sole
+/// caller is the local-player create-finalise `0x5debcc`: it reads `UNIT_FIELD_BYTES_0` byte 1 and
+/// stores `ChrClasses[class]` field 15.
+///
+/// One writer rather than a line wherever the avatar is built, for the reason
+/// `char_select::publish_world_live` gives: a mirror a future transition can forget is worse than
+/// the coupling it replaces. And it **never writes 0 back** — an absent avatar leaves the last
+/// value standing, because a cross-map worldport drops the entity mid-session while everything the
+/// server told us stays true (decision 0900's shape). Only the world-enter clear zeroes it.
+fn track_class_family(
+    mut mods: ResMut<SpellModifiers>,
+    classes: Option<Res<ChrClassTable>>,
+    self_q: Query<&ObjectStore, With<SelfPlayer>>,
+) {
+    let Some(classes) = classes else { return };
+    let Some(class) = self_q.iter().next().and_then(|s| s.0.unit_class()) else {
+        return;
+    };
+    let family = classes.0.spell_family(u32::from(class));
+    // Guarded so the write is a real edge: an unconditional store would mark the resource changed
+    // every frame, and the tooltip feed rebuilds on exactly that signal.
+    if mods.class_family != family {
+        mods.set_class_family(family);
+    }
+}
+
+pub(crate) struct SpellModsPlugin;
+
+impl Plugin for SpellModsPlugin {
+    fn build(&self, app: &mut App) {
+        app.init_resource::<SpellModifiers>()
+            .add_systems(
+                Update,
+                // After the net stage that merges the avatar's descriptor, and before the feeds
+                // that read a cost through it — so the family is this frame's, never last
+                // frame's, on the frame the avatar first resolves.
+                track_class_family
+                    .after(benilla_world::schedule::WorldStage::Net)
+                    .before(crate::ui_unit::UnitFeed),
+            )
+            .add_systems(OnEnter(ClientState::InWorld), clear_on_world_enter);
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    /// A mage spell (family 3) with the given bits set, against a mage player.
+    fn mage(bits: &[u8]) -> SpellDisplay {
+        SpellDisplay {
+            spell_family: 3,
+            spell_family_flags: bits.iter().fold(0u64, |m, b| m | 1 << b),
+            ..Default::default()
+        }
+    }
+
+    fn mage_tables() -> SpellModifiers {
+        let mut mods = SpellModifiers::default();
+        mods.set_class_family(3);
+        mods
+    }
+
+    /// **The index, and the transposition that would pass a lazier test.** The cell the server
+    /// wrote for `(bit 5, op 14)` must be the cell the reader reads for a spell with bit 5 set —
+    /// and, crucially, must NOT be the one it reads for a spell with bit 14 set, which is where
+    /// `op * 29 + bit` lands the same packet.
+    ///
+    /// Both halves are needed: a symmetric pair like `(14, 14)` agrees under either arithmetic, so
+    /// this uses 5 and 14 and asserts the cross-read is empty.
+    #[test]
+    fn the_index_is_mask_bit_times_29_plus_op() {
+        assert_eq!(index(5, 14), 5 * 29 + 14);
+        assert_ne!(
+            index(5, 14),
+            14 * 29 + 5,
+            "the transposed form is a different cell"
+        );
+
+        let mut mods = mage_tables();
+        mods.set(true, 5, OP_COST, -30);
+
+        // The spell the packet is about: bit 5 set, op 14 read.
+        assert_eq!(mods.apply(&mage(&[5]), OP_COST, 100), 70);
+        // The spell the TRANSPOSED index would have served: bit 14 set. Under `op*29 + bit` the
+        // write would have landed where this read looks, and this would be 70.
+        assert_eq!(
+            mods.apply(&mage(&[14]), OP_COST, 100),
+            100,
+            "bit 14 is not bit 5 — a transposed index would have crossed them"
+        );
+    }
+
+    /// **The pct-0 trap.** The common path is "this spell has no talent on it": the reader's
+    /// scanned-and-nothing-matched exit leaves `pct = 0` in the reference, and a consumer that
+    /// ignored the boolean would multiply by it. Here the exit is `None`, so the base value
+    /// survives — for a spell with no bits at all, for a spell whose bits are all zero cells, and
+    /// for each of the three gate failures.
+    #[test]
+    fn nothing_applying_leaves_the_value_exactly_alone() {
+        let mut mods = mage_tables();
+        // A live modifier somewhere else in the table, so "the tables are empty" is not what is
+        // being tested.
+        mods.set(false, 30, OP_COST, -100);
+
+        assert_eq!(mods.apply(&mage(&[]), OP_COST, 100), 100, "no family bits");
+        assert_eq!(
+            mods.apply(&mage(&[5]), OP_COST, 100),
+            100,
+            "bit 5's cells are zero"
+        );
+        assert_eq!(
+            mods.apply(&mage(&[30]), OP_COST, 100),
+            0,
+            "and the live cell really is live — a −100% cost, not an inert table"
+        );
+
+        // Gate 1: SpellFamilyName == 0 (every creature and item spell in the file).
+        let mut d = mage(&[30]);
+        d.spell_family = 0;
+        assert_eq!(mods.apply(&d, OP_COST, 100), 100);
+        // Gate 2: another class's spell.
+        let mut d = mage(&[30]);
+        d.spell_family = 4;
+        assert_eq!(mods.apply(&d, OP_COST, 100), 100);
+        // Gate 3: IGNORE_CASTER_MODIFIERS.
+        let mut d = mage(&[30]);
+        d.attributes_ex3 = ATTR_EX3_IGNORE_CASTER_MODIFIERS;
+        assert_eq!(mods.apply(&d, OP_COST, 100), 100);
+        // An op with no cells is not a wipe either.
+        assert_eq!(mods.apply(&mage(&[30]), 0, 100), 100);
+    }
+
+    /// The sum runs over **every** set bit of a 64-bit mask — both dwords — and the flat term is
+    /// added before the percentage.
+    #[test]
+    fn every_set_bit_contributes_and_flat_lands_before_pct() {
+        let mut mods = mage_tables();
+        mods.set(true, 5, OP_COST, -10);
+        mods.set(true, 35, OP_COST, -15);
+        mods.set(false, 5, OP_COST, -20);
+        mods.set(false, 35, OP_COST, -30);
+
+        // Bit 35 alone: the HIGH dword, which a 32-bit mask read would drop entirely.
+        assert_eq!(
+            mods.apply(&mage(&[35]), OP_COST, 100),
+            (100 - 15) * 70 / 100
+        );
+        // Both: flat −25 first, then 100 − 50 = 50 percent.
+        assert_eq!(
+            mods.apply(&mage(&[5, 35]), OP_COST, 100),
+            (100 - 25) * 50 / 100
+        );
+        // Order matters — `value * pct / 100 + flat` would give 25, not 37.
+        assert_eq!(mods.apply(&mage(&[5, 35]), OP_COST, 100), 37);
+    }
+
+    /// The division truncates **toward zero**, both signs — C's `/`, not a floor and not a round.
+    #[test]
+    fn the_division_truncates_toward_zero() {
+        let mut mods = mage_tables();
+        // 99 × 50% = 49.5 → 49, not 50.
+        mods.set(false, 5, OP_COST, -50);
+        assert_eq!(mods.apply(&mage(&[5]), OP_COST, 99), 49);
+
+        // The negative side: −99 × 50% = −49.5 → −49 (toward zero), where a floor gives −50.
+        assert_eq!(SpellMod { flat: 0, pct: 50 }.apply(-99), -49);
+        // And the identity really is the identity.
+        assert_eq!(SpellMod::default().apply(-7), -7);
+    }
+
+    /// The percentage sum is clamped at 0 — a −150% modifier zeroes the value, it does not invert
+    /// it (`6e6bbc`'s `sets`/`dec`/`and`, on the SIGNED sum).
+    #[test]
+    fn a_percentage_below_minus_one_hundred_clamps_to_zero() {
+        let mut mods = mage_tables();
+        mods.set(false, 5, OP_COST, -150);
+        assert_eq!(mods.apply(&mage(&[5]), OP_COST, 200), 0);
+    }
+
+    /// Out-of-range wire bytes are dropped, not stored — and dropped without disturbing the cell
+    /// the reference's own overrun would have hit.
+    #[test]
+    fn an_out_of_range_packet_is_dropped() {
+        let mut mods = mage_tables();
+        // `(64, 19)` is the reference's documented overrun into the class-family global.
+        mods.set(true, 64, 19, 999);
+        // `(65, 23)` is the one that lands on PCT element 0 there.
+        mods.set(true, 65, 23, 999);
+        mods.set(true, 0, 29, 999);
+        mods.set(true, 255, 255, 999);
+
+        assert_eq!(mods.class_family, 3, "the class family is untouched");
+        assert!(
+            mods.flat.iter().chain(mods.pct.iter()).all(|&v| v == 0),
+            "not one cell was written"
+        );
+    }
+
+    /// World-enter drops everything — both tables and the family — which is the only clear there
+    /// is.
+    #[test]
+    fn world_enter_clears_both_tables_and_the_family() {
+        // A bare app: the plugin's only Update system takes both of its inputs as an `Option`/an
+        // empty query, so the state machine the clear hangs off is all this needs.
+        let mut app = App::new();
+        app.add_plugins((MinimalPlugins, bevy::state::app::StatesPlugin))
+            .insert_state(ClientState::Login)
+            .add_plugins(SpellModsPlugin);
+
+        {
+            let mut mods = app.world_mut().resource_mut::<SpellModifiers>();
+            mods.set_class_family(3);
+            mods.set(true, 5, OP_COST, -30);
+            mods.set(false, 35, OP_COST, -50);
+            assert_eq!(mods.apply(&mage(&[5]), OP_COST, 100), 70);
+        }
+
+        app.world_mut()
+            .resource_mut::<NextState<ClientState>>()
+            .set(ClientState::InWorld);
+        app.update();
+
+        let mods = app.world().resource::<SpellModifiers>();
+        assert_eq!(mods.class_family, 0);
+        assert!(mods.flat.iter().chain(mods.pct.iter()).all(|&v| v == 0));
+    }
+
+    /// The three worked multi-bit spells from the real `Spell.dbc`, driven through the whole
+    /// module: the same `(bit, op)` cells the server would send, read back through each spell's
+    /// own shipped family mask. Cleanse 4987 is the one that matters — bits 12 **and** 33 — and it
+    /// fails under any read that stops at 32 bits. Skips without client data.
+    #[test]
+    fn real_spells_sum_their_own_family_bits() {
+        let data = benilla_formats::wow_data_or_skip!();
+        let mut chain = benilla_formats::open_chain(&data).expect("open chain");
+        let cat = benilla_formats::load_spell_catalog(&mut chain).expect("load Spell.dbc");
+
+        // A paladin: Cleanse 4987 is family 10, bits 12 and 33.
+        let mut mods = SpellModifiers::default();
+        mods.set_class_family(10);
+        mods.set(true, 12, OP_COST, -5);
+        mods.set(true, 33, OP_COST, -7);
+        mods.set(false, 33, OP_COST, -25);
+        let cleanse = cat.get(4987).expect("Cleanse");
+        assert_eq!(
+            mods.apply(cleanse, OP_COST, 100),
+            (100 - 12) * 75 / 100,
+            "both dwords contribute"
+        );
+        // Cure Poison 526 is a SHAMAN spell (family 11), and bit 35 is the only bit it sets — so
+        // even with that exact cell live, the paladin's family gate refuses it. Same row, wrong
+        // family: conjunct 2 is what keeps one class's talents off another's spells.
+        mods.set(true, 35, OP_COST, -50);
+        assert_eq!(
+            mods.apply(cat.get(526).expect("Cure Poison"), OP_COST, 100),
+            100
+        );
+
+        // A mage: Frostbolt 116, bits 5/19/20/30 — four cells, summed.
+        let mut mods = SpellModifiers::default();
+        mods.set_class_family(3);
+        for bit in [5u8, 19, 20, 30] {
+            mods.set(true, bit, OP_COST, -1);
+        }
+        assert_eq!(
+            mods.apply(cat.get(116).expect("Frostbolt"), OP_COST, 100),
+            96,
+            "four set bits, four cells"
+        );
+    }
+}
diff --git a/crates/benilla-app/src/swing_refusal.rs b/crates/benilla-app/src/swing_refusal.rs
index 08eb7c9b..4aa0c861 100644
--- a/crates/benilla-app/src/swing_refusal.rs
+++ b/crates/benilla-app/src/swing_refusal.rs
@@ -166,8 +166,8 @@ impl SwingRefusal {
 /// shared `0x148`/`0x149` arm's one and only act.
 ///
 /// The StopAttack lives here rather than in the net drain because [`AttackSeam`] is the whole
-/// write set `0x5ecac0` needs and the drain is already at Bevy's SystemParam ceiling — and
-/// because putting it beside the latch keeps arm 4's "stop, and say nothing" legible as one fact.
+/// write set `0x5ecac0` needs, and because putting it beside the latch keeps arm 4's "stop, and
+/// say nothing" legible as one fact.
 fn apply_swing_refusals(
     mut edges: MessageReader<SwingRefusalEdge>,
     time: Res<Time>,
diff --git a/crates/benilla-app/src/target/by_name.rs b/crates/benilla-app/src/target/by_name.rs
index 0cf8fbc7..d0d18a2c 100644
--- a/crates/benilla-app/src/target/by_name.rs
+++ b/crates/benilla-app/src/target/by_name.rs
@@ -514,7 +514,6 @@ pub(super) fn assist_requests(
 /// The followee's **name** is latched here rather than re-read later: it is what
 /// `AUTOFOLLOW_BEGIN` carries into the status text ([`crate::ui_follow`]), and the resolver has
 /// already produced it for the by-name half.
-#[allow(clippy::too_many_arguments)] // a Bevy system's param list IS its dependency set
 pub(super) fn follow_requests(
     mut requests: MessageReader<crate::player::FollowRequest>,
     scan_params: ByNameScan,
diff --git a/crates/benilla-app/src/target/click.rs b/crates/benilla-app/src/target/click.rs
index f271f1f1..89fce85e 100644
--- a/crates/benilla-app/src/target/click.rs
+++ b/crates/benilla-app/src/target/click.rs
@@ -70,7 +70,6 @@ pub(super) fn world_right_click_payload(
 /// fires on the up edge and the replay below turns it into the interact leg — which is the
 /// reference's own shape, `0x7cb910` → `0x4949f0(mask 4)` → `0x492820`, the same terminal the world
 /// right-click's object leg `0x492ce0` reaches.
-#[allow(clippy::too_many_arguments)]
 pub(super) fn select_on_plate_click(
     mut plate: ResMut<crate::vplates::PlateClicks>,
     press: Res<PressPick>,
@@ -132,7 +131,6 @@ pub(super) fn select_on_plate_click(
 /// for the whole look session, as the reference suppresses its own hover during freelook. Reading
 /// the live hover here would take the `_ =>` arm below and *clear* the player's target on every
 /// drag. The reference picks once, on the down edge, and this consumes that same latch.
-#[allow(clippy::too_many_arguments)] // one Bevy system's full input set
 pub(super) fn select_on_click(
     mut clicks: MessageReader<WorldClick>,
     inspect: Res<InspectMode>,
@@ -238,6 +236,11 @@ pub(crate) struct ServiceArms<'w> {
     /// The spirit healer's XP-loss question (bit 5): `0x5df730` does the same, firing
     /// `CONFIRM_XP_LOSS`.
     pub(crate) death: ResMut<'w, crate::death::DeathNet>,
+    /// The spirit GUIDE's arm (bit 6) — the battleground graveyard's resurrect wave. Unlike its
+    /// two no-packet neighbours this one does send, and it sends through the cache the per-frame
+    /// proximity poll also writes, so the click and the poll cannot disagree about which healer
+    /// is current.
+    pub(crate) spirit: ResMut<'w, crate::ui_dialog_verbs::AreaSpiritHealer>,
     /// `[0xb4e2d0]/[0xb4e2d4]`'s mirror — the NPC whose window is open, which the dispatcher
     /// compares the clicked guid against *before* the ladder ([`interaction_already_open_on`]).
     pub(crate) interact: Res<'w, crate::ui_session::InteractNpc>,
@@ -293,7 +296,7 @@ fn interaction_already_open_on(target: u64, interact: &crate::ui_session::Intera
 /// (`unable` only grays): the server holds the swing until we're in reach, as the real client does.
 /// A right-click on empty ground was just a turn — it never deselects.
 // The `ui_feedback` tuple is the 16-SystemParam ceiling's overflow bundle, commented at its site.
-#[allow(clippy::too_many_arguments, clippy::type_complexity)]
+#[allow(clippy::type_complexity)]
 pub(super) fn act_on_right_click(
     mut clicks: MessageReader<WorldRightClick>,
     // **The press pick, not the live hover** (decision 2230) — the same latch the left button has
@@ -341,10 +344,21 @@ pub(super) fn act_on_right_click(
         // `CastLadder` (it would reach `Items`/`CastErrors` twice), so the lock chain's verdict
         // travels to `ui_action::drain::drain_go_openers` instead of becoming a packet here.
         ResMut<crate::ui_action::GoOpenerCasts>,
+        // The meeting stone's use slot (decision 2283), here for the same reason: its four
+        // refusals read the roster and the template cache, so the click hands the object to
+        // `ui_dialog_verbs::drain_meeting_stone_joins` rather than validating and sending here.
+        MessageWriter<crate::ui_dialog_verbs::MeetingStoneUse>,
     ),
 ) {
-    let (mut ui_error_keys, mut cast_errors, mut loot_latch, mut mail, mut item_text, mut openers) =
-        ui_feedback;
+    let (
+        mut ui_error_keys,
+        mut cast_errors,
+        mut loot_latch,
+        mut mail,
+        mut item_text,
+        mut openers,
+        mut stone_uses,
+    ) = ui_feedback;
     if clicks.read().last().is_none() {
         return;
     }
@@ -490,6 +504,36 @@ pub(super) fn act_on_right_click(
                     }
                     return;
                 }
+                // MEETINGSTONE (GO type 23): **not** the shared use-sender. `[0x80bf40+0x1c]`
+                // is `0x5f69d0`, this type's own validator — four client-side refusals and then
+                // `CMSG 0x292 {u64 goGuid}` from `0x4c9ff0` (decision 2283; wow-re's §5 round on
+                // that function). The shared sender `0x5f33e0` is **unreachable** from here: it
+                // has zero direct callers and 29 `.rdata` refs, every one at some vtable's
+                // `+0x1c`, and `0x80bf5c` is not among them — so a meeting stone cannot emit
+                // `CMSG_GAMEOBJ_USE` in the reference at all. Sending `0xB1` anyway is what left
+                // every meeting stone dead here: vmangos' `GameObject::Use` has an explicit
+                // type-23 arm that does nothing ("Should never be called for this type of
+                // object", `GameObject.cpp:1836`), so the packet was answered with silence.
+                //
+                // Four types override `+0x1c`, not one — 9 TEXT, 19 MAILBOX, 23 and 28 — which
+                // corrects the wow-re sentence this file used to rest on (`+0x1c` is `0x5f33e0`
+                // "for every type but MAILBOX"); the round landed that correction too.
+                //
+                // Unlike those two it is NOT a local open — it is a real send, and it therefore
+                // sits *below* the mounted gate above (a stone is lock-less, and only MAILBOX is
+                // exempted there) and behind the same `unable` range suppression every sending
+                // arm takes. The refusals themselves need the roster, the ask-once template and
+                // the wire, which this system cannot also hold, so the verdict travels as a
+                // message to `ui_dialog_verbs::drain_meeting_stone_joins` — the 2199 shape.
+                if go.is_some_and(|(s, _)| {
+                    s.0.gameobject_type_id() == cursor_mode::GO_TYPE_MEETINGSTONE
+                }) {
+                    if !cursor.unable {
+                        debug!("right-click meeting stone: {guid:#x}");
+                        stone_uses.write(crate::ui_dialog_verbs::MeetingStoneUse { go_guid: guid });
+                    }
+                    return;
+                }
                 // Branch on the lock (decisions 0239 / 0545 / 0752): a lockless GameObject is USEd;
                 // a lockable one casts the opener (a known OPEN_LOCK spell, or a carried key's own
                 // ON_USE) at it; an unopenable lock shows the client-local red toast — "The door is
@@ -905,6 +949,24 @@ pub(super) fn act_on_right_click(
                     debug!("right-click interact: {guid:#x} (spirit healer — CONFIRM_XP_LOSS, no packet)");
                     service.death.ask_spirit_healer(guid);
                 }
+                ServiceAction::AcquireSpiritGuide => {
+                    debug!("right-click interact: {guid:#x} (spirit guide — adopting, 0x2E2)");
+                    let outcome = service.spirit.click_guide(guid);
+                    if outcome.cancel_aura {
+                        if let Some(script) = service.script.as_deref_mut() {
+                            script.fire_event("AREA_SPIRIT_HEALER_OUT_OF_RANGE", vec![]);
+                        }
+                        let _ = seam.net.0.send(ClientCommand::CancelAura {
+                            spell_id: crate::ui_dialog_verbs::AREA_SPIRIT_HEALER_AURA,
+                        });
+                    }
+                    if let Some(healer) = outcome.query {
+                        let _ = seam
+                            .net
+                            .0
+                            .send(ClientCommand::AreaSpiritHealerQuery { healer });
+                    }
+                }
                 ServiceAction::Silent(why) => {
                     debug!("right-click interact: {guid:#x} ({arm:?}) — silent: {why}");
                 }
@@ -1341,6 +1403,9 @@ pub(crate) enum ServiceAction {
     AskBinder,
     /// Raise `CONFIRM_XP_LOSS` locally and send nothing (`0x5df730`).
     AskSpiritHealer,
+    /// Adopt this spirit guide as the current-area spirit healer (`0x5df950` → two calls into
+    /// `0x4921c0`, the second of which always transmits) — `CMSG_AREA_SPIRIT_HEALER_QUERY`.
+    AcquireSpiritGuide,
     /// Nothing goes out. The payload is why, for the debug line.
     Silent(&'static str),
 }
@@ -1391,13 +1456,13 @@ pub(crate) fn service_action(
         ServiceArm::Trainer => ServiceAction::Send(ClientCommand::TrainerList { trainer: guid }),
         ServiceArm::SpiritHealer if ghost => ServiceAction::AskSpiritHealer,
         ServiceArm::SpiritHealer => ServiceAction::Silent("spirit healer, and we are alive"),
-        // Ghost-gated like its neighbour, and then a stated gap: the ghost's arm sends opcode
-        // `0x2E2` (the area spirit-healer time query) from one call deeper, and benilla has no
-        // battleground resurrect timer for the reply to fill. For a living player this IS the
-        // reference's answer; for a ghost it is the gap.
-        ServiceArm::SpiritGuide if ghost => {
-            ServiceAction::Silent("spirit guide — the 0x2E2 timer query is unbuilt")
-        }
+        // Ghost-gated like its neighbour. The arm sends `CMSG_AREA_SPIRIT_HEALER_QUERY 0x2E2`
+        // from one call deeper (`0x5df950` → `0x4921c0`), and it does it through the *same*
+        // "set current area spirit healer" routine the per-frame proximity poll uses — with a
+        // deliberate `(0,0)` cache-bust first, so a click on the guide you are already standing
+        // next to re-asks for the wave clock instead of being swallowed by the routine's
+        // unchanged-guid early return.
+        ServiceArm::SpiritGuide if ghost => ServiceAction::AcquireSpiritGuide,
         ServiceArm::SpiritGuide => ServiceAction::Silent("spirit guide, and we are alive"),
         ServiceArm::Innkeeper => ServiceAction::AskBinder,
         ServiceArm::Banker => ServiceAction::Send(ClientCommand::BankerActivate { guid }),
@@ -1883,6 +1948,7 @@ mod tests {
             ServiceAction::SellFromCursor(cmd) => format!("sell {cmd:?}"),
             ServiceAction::AskBinder => "ask-binder".to_string(),
             ServiceAction::AskSpiritHealer => "ask-spirit-healer".to_string(),
+            ServiceAction::AcquireSpiritGuide => "acquire-spirit-guide".to_string(),
             ServiceAction::Silent(_) => "silent".to_string(),
         };
         assert!(matches!(
@@ -1987,6 +2053,7 @@ mod tests {
                     ServiceAction::SellFromCursor(cmd) => format!("SELL {cmd:?}"),
                     ServiceAction::AskBinder => "ask-binder".into(),
                     ServiceAction::AskSpiritHealer => "ask-xp-loss".into(),
+                    ServiceAction::AcquireSpiritGuide => "acquire-spirit-guide".into(),
                     ServiceAction::Silent(w) => format!("silent {w}"),
                 };
                 let empty = describe(service_action(arm, VENDOR, ghost, None));
@@ -2268,6 +2335,8 @@ mod tests {
 
     const F_HEALTH: u16 = 22;
     const F_MAXHEALTH: u16 = 28;
+    /// `GAMEOBJECT_TYPE_ID`, absolute field 21 — the store the GO arms fork on.
+    const GO_TYPE_FIELD: u16 = 21;
     const BOAR: u64 = 0xB0A2;
     const ME: u64 = 0x5E1F;
 
@@ -2295,6 +2364,7 @@ mod tests {
         world.init_resource::<crate::ui_quest::QuestGiver>();
         world.init_resource::<crate::ui_binder::BinderState>();
         world.init_resource::<crate::death::DeathNet>();
+        world.init_resource::<crate::ui_dialog_verbs::AreaSpiritHealer>();
         world.init_resource::<crate::ui_session::InteractNpc>();
         world.init_resource::<crate::ui_action::UiErrorKeys>();
         world.init_resource::<crate::ui_action::CastErrors>();
@@ -2302,6 +2372,7 @@ mod tests {
         world.init_resource::<crate::ui_mail::MailOpen>();
         world.init_resource::<crate::ui_item_text::ItemTextOpen>();
         world.init_resource::<crate::ui_action::GoOpenerCasts>();
+        world.init_resource::<Messages<crate::ui_dialog_verbs::MeetingStoneUse>>();
         world.spawn((SelfPlayer, Guid(ME)));
         let boar = world
             .spawn((Guid(BOAR), store(&[(F_HEALTH, 100), (F_MAXHEALTH, 100)])))
@@ -2349,4 +2420,88 @@ mod tests {
             "the release must act on the unit whose plate the press was over"
         );
     }
+    /// **A meeting stone is JOINED, not USEd** (decision 2283). The GO type's own use slot
+    /// (`0x5f69d0`) replaces the shared `CMSG_GAMEOBJ_USE` sender, so the click must hand the
+    /// object to the join validator and put **no** `0xB1` on the wire — which is what left every
+    /// stone dead, since vmangos' `GameObject::Use` has an explicit do-nothing arm for type 23.
+    ///
+    /// The falsification is the assertion that matters: with the arm removed this test sees a
+    /// `GameObjUse` command and no `MeetingStoneUse` message.
+    #[test]
+    fn a_right_click_on_a_meeting_stone_joins_it_and_sends_no_gameobj_use() {
+        const STONE: u64 = 0x5701;
+        let (tx, rx) = crossbeam_channel::unbounded::<ClientCommand>();
+        let (mut world, _boar) = right_click_world();
+        world.insert_resource(NetCommands(tx));
+        let stone = world
+            .spawn((Guid(STONE), store(&[(GO_TYPE_FIELD, 23)])))
+            .id();
+        *world.resource_mut::<PressPick>() = PressPick {
+            object: HoveredObject {
+                target: Some(stone),
+                guid: Some(STONE),
+                distance: 5.0,
+            },
+            cursor: WorldCursor {
+                kind: cursor_mode::CursorKind::Interact,
+                unable: false,
+            },
+            ..PressPick::default()
+        };
+        world
+            .resource_mut::<Messages<WorldRightClick>>()
+            .write(WorldRightClick);
+        world.run_system_once(act_on_right_click).unwrap();
+
+        let uses: Vec<_> = world
+            .resource::<Messages<crate::ui_dialog_verbs::MeetingStoneUse>>()
+            .iter_current_update_messages()
+            .copied()
+            .collect();
+        assert_eq!(
+            uses,
+            vec![crate::ui_dialog_verbs::MeetingStoneUse { go_guid: STONE }],
+            "the stone must reach the join validator"
+        );
+        assert!(
+            !rx.try_iter()
+                .any(|c| matches!(c, ClientCommand::GameObjUse { .. })),
+            "a meeting stone must never send CMSG_GAMEOBJ_USE — the server drops it on the floor"
+        );
+    }
+
+    /// Out of interact range the click is suppressed with no toast and no packet, exactly as the
+    /// shared arms are (the reference auto-walks instead; `0x610300`, no packet).
+    #[test]
+    fn an_out_of_range_meeting_stone_click_sends_nothing() {
+        const STONE: u64 = 0x5702;
+        let (tx, rx) = crossbeam_channel::unbounded::<ClientCommand>();
+        let (mut world, _boar) = right_click_world();
+        world.insert_resource(NetCommands(tx));
+        let stone = world
+            .spawn((Guid(STONE), store(&[(GO_TYPE_FIELD, 23)])))
+            .id();
+        *world.resource_mut::<PressPick>() = PressPick {
+            object: HoveredObject {
+                target: Some(stone),
+                guid: Some(STONE),
+                distance: 50.0,
+            },
+            cursor: WorldCursor {
+                kind: cursor_mode::CursorKind::Interact,
+                unable: true,
+            },
+            ..PressPick::default()
+        };
+        world
+            .resource_mut::<Messages<WorldRightClick>>()
+            .write(WorldRightClick);
+        world.run_system_once(act_on_right_click).unwrap();
+        assert!(world
+            .resource::<Messages<crate::ui_dialog_verbs::MeetingStoneUse>>()
+            .iter_current_update_messages()
+            .next()
+            .is_none());
+        assert!(rx.try_iter().next().is_none());
+    }
 }
diff --git a/crates/benilla-app/src/target/cursor_mode.rs b/crates/benilla-app/src/target/cursor_mode.rs
index dfb59423..d0901757 100644
--- a/crates/benilla-app/src/target/cursor_mode.rs
+++ b/crates/benilla-app/src/target/cursor_mode.rs
@@ -374,7 +374,7 @@ pub(crate) struct GoOverrides {
 /// (`0x5f6990`), alongside FISHINGNODE(17). It never calls `0x5f2f80`: no faction term, no
 /// `GAMEOBJECT_FLAGS`, no INTERACT_COND, no DYN_FLAGS. It is exactly
 /// `template.data[2] (areaID) != [0xb72038]` — see [`highlightable_flags`]'s `meeting_stone_queued`.
-const GO_TYPE_MEETINGSTONE: i32 = 23;
+pub(super) const GO_TYPE_MEETINGSTONE: i32 = 23;
 
 /// The client's GameObject **highlightable** predicate (decision 0243, wow-re cursor-system §4a,
 /// `0x5f2f80`) over its wire flags: whether the object shows an interact cursor / is clickable at all.
@@ -399,8 +399,10 @@ const GO_TYPE_MEETINGSTONE: i32 = 23;
 /// written only by the meeting-stone server-message handler `0x4ca230`, and read back by the Lua
 /// binding `IsInMeetingStoneQueue`. So a stone is highlightable **unless it is the stone you are
 /// already queued at**, and nothing else about it matters. The caller resolves the equality (as it
-/// does `channel_owned`); benilla has no queue yet, so it compares against 0 — which is the
-/// reference's own not-queued value, not a stand-in for one. Ignored for every other type.
+/// does `channel_owned`) against the live queue — [`crate::ui_dialog_verbs::MeetingStone::area`],
+/// benilla's `[0xb72038]` (decision 2283; it was a hardcoded `0` while no queue existed, which is
+/// the reference's own not-queued value and so was right for exactly as long as we never queued).
+/// Ignored for every other type.
 fn highlightable_flags(
     type_id: i32,
     flags: u32,
@@ -555,26 +557,19 @@ pub(crate) fn go_highlightable(
     )
 }
 
-/// The area the player is currently queued at through the meeting-stone system — the reference's
-/// `[0xb72038]`, which MEETINGSTONE(23)'s highlightable slot compares its `areaID` against.
-///
-/// **Zero until benilla carries the meeting-stone queue.** That is not a placeholder: `0xb72038` is
-/// zero-initialized (`0x4c9eec`) and written only by the queue's own server-message handler
-/// (`0x4ca230`), so 0 *is* the reference's not-queued value and every stone is correctly
-/// highlightable. When the queue lands, this becomes its live area and the predicate is already
-/// right.
-const MEETING_STONE_QUEUED_AREA: u32 = 0;
-
 /// MEETINGSTONE(23)'s highlightable override, resolved for one GameObject: the reference's
 /// `template.data[2] != [0xb72038]`, expressed as its negation so the caller passes the same shape
 /// of boolean as [`fishing_channel_owned`].
 ///
+/// `queued_area` is benilla's `[0xb72038]` — [`crate::ui_dialog_verbs::MeetingStone::area`], stored
+/// unconditionally by every `SMSG 0x295` and `0` when we are not queued (decision 2283).
+///
 /// A template that hasn't answered yet resolves `false` (⇒ highlightable), the same permissive
 /// default the highlight column takes — a stone isn't dead for the first frames of its query. Note a
 /// stone whose `data[2]` really is **0** is *not* highlightable when we are unqueued, which is the
 /// binary's own `0 != 0` and not an edge case worth smoothing away.
-pub(crate) fn meeting_stone_queued(area: Option<u32>) -> bool {
-    area.is_some_and(|a| a == MEETING_STONE_QUEUED_AREA)
+pub(crate) fn meeting_stone_queued(area: Option<u32>, queued_area: u32) -> bool {
+    area.is_some_and(|a| a == queued_area)
 }
 
 /// The FISHINGNODE highlightable override's input (`0x5f6710`): is the local player currently
@@ -780,7 +775,7 @@ fn corpse_cursor(f: CorpseFacts) -> Option<(CursorKind, bool)> {
 /// Resolve this frame's [`WorldCursor`] from the hovered unit — the reference's classifier order:
 /// interactable-NPC service ladder, else loot/skin/attack by state, each grayed by its own range
 /// gate. No hover (or anything unresolvable) → Point.
-#[allow(clippy::type_complexity, clippy::too_many_arguments)]
+#[allow(clippy::type_complexity)]
 pub(super) fn classify_cursor(
     hovered: Res<Hovered>,
     hovered_object: Res<HoveredObject>,
@@ -812,6 +807,10 @@ pub(super) fn classify_cursor(
     // override reads it (the reference keeps the lit pouch on the corpse you are looting even
     // once you have drifted past the range gate).
     loot_latch: Res<crate::ui_loot::LootLatch>,
+    // `[0xb72038]` — the meeting-stone queue, MEETINGSTONE(23)'s own highlightable term
+    // (decision 2283). `Option` because a headless build mounts no UI dialog verbs; absent reads
+    // as the reference's zero-initialized global, i.e. not queued.
+    stone: Option<Res<crate::ui_dialog_verbs::MeetingStone>>,
 ) {
     // A **highlightable** GameObject shows its **data-driven** cursor (wow-re cursor-system §4): a
     // mailbox's Mail, a plaque's Inspect, a vein's Mine / herb's GatherHerbs / picked lock's PickLock
@@ -835,7 +834,10 @@ pub(super) fn classify_cursor(
         let tmpl = hovered_object.guid.and_then(|g| go_inputs.templates.get(g));
         let overrides = GoOverrides {
             channel_owned: fishing_channel_owned(Some(self_store), hovered_object.guid),
-            meeting_stone_queued: meeting_stone_queued(tmpl.and_then(|t| t.meeting_stone_area)),
+            meeting_stone_queued: meeting_stone_queued(
+                tmpl.and_then(|t| t.meeting_stone).map(|m| m.area),
+                stone.as_deref().map_or(0, |s| s.area),
+            ),
         };
         if !go_highlightable(store, reaction, overrides) {
             return None;
@@ -1469,12 +1471,17 @@ mod tests {
             );
         }
         // The caller's half: the resolved boolean is `data[2] == the queued area`, with an
-        // unanswered template reading as not-queued so a stone isn't dead while it queries. Our
-        // queued area is 0 — the reference's own not-queued value — so a stone whose data[2] is
-        // genuinely 0 is NOT highlightable, which is the binary's `0 != 0` and not a bug.
-        assert!(!meeting_stone_queued(None));
-        assert!(!meeting_stone_queued(Some(1519)));
-        assert!(meeting_stone_queued(Some(MEETING_STONE_QUEUED_AREA)));
+        // unanswered template reading as not-queued so a stone isn't dead while it queries. The
+        // right-hand side is the LIVE queue since 2283 — unqueued (`0`) leaves every stone
+        // highlightable, and queueing at one area silences exactly that area's stones.
+        assert!(!meeting_stone_queued(None, 0));
+        assert!(!meeting_stone_queued(Some(1519), 0));
+        assert!(meeting_stone_queued(Some(1519), 1519));
+        assert!(!meeting_stone_queued(Some(1519), 1517));
+        assert!(!meeting_stone_queued(None, 1519));
+        // The binary's own `0 != 0`: a `data[2] == 0` stone reads as the stone we are "queued at"
+        // while we are not queued at all.
+        assert!(meeting_stone_queued(Some(0), 0));
     }
 
     #[test]
diff --git a/crates/benilla-app/src/target/flash.rs b/crates/benilla-app/src/target/flash.rs
index 56d0c8e4..2854444e 100644
--- a/crates/benilla-app/src/target/flash.rs
+++ b/crates/benilla-app/src/target/flash.rs
@@ -73,7 +73,7 @@ fn wave_g(now: u32, last_reset: &mut u32, rising: &mut bool) -> u8 {
 /// Recompute the flash verdict — the client's per-frame OnUpdate gate, evaluated over the one
 /// unit that can qualify (your current target). Runs before the ring update and the nameplate
 /// drive so both consume this frame's verdict.
-#[allow(clippy::type_complexity, clippy::too_many_arguments)] // one Bevy system's full input set
+#[allow(clippy::type_complexity)] // one Bevy system's full input set
 pub(super) fn drive_flash(
     mut flash: ResMut<CombatFlash>,
     time: Res<Time>,
diff --git a/crates/benilla-app/src/target/hover.rs b/crates/benilla-app/src/target/hover.rs
index 839d988a..37f441dc 100644
--- a/crates/benilla-app/src/target/hover.rs
+++ b/crates/benilla-app/src/target/hover.rs
@@ -125,7 +125,7 @@ pub(super) struct PickPose<'w, 's> {
 /// body — held weapons, the helm, the shoulders, a mount — is its own pass-1/pass-2 candidate
 /// resolving to the same unit, because the reference registers the whole CM2 attachment tree into
 /// the pick scene under one candidate node (`0x480d90` walking `[model+0x1dc]`/`[+0x1e4]`).
-#[allow(clippy::type_complexity, clippy::too_many_arguments)]
+#[allow(clippy::type_complexity)]
 pub(super) fn update_hover(
     camera: Query<(&Camera, &GlobalTransform), With<WorldCamera>>,
     window: Query<&Window, With<PrimaryWindow>>,
@@ -614,7 +614,27 @@ fn net_entity_of(
     cur
 }
 
-#[allow(clippy::too_many_arguments)]
+/// The state the GameObject gates read beside the object's own store, bundled because this system
+/// sits at Bevy's 16-`SystemParam` ceiling: the ask-once template cache (GENERIC's eligibility is
+/// its `data[1]`, decision 0762; MEETINGSTONE's is its `data[2]`), the faction catalog behind the
+/// eligibility faction term (decision 0764), and the live meeting-stone queue — benilla's
+/// `[0xb72038]`, the other half of MEETINGSTONE(23)'s own highlightable predicate (decision 2283).
+#[derive(bevy::ecs::system::SystemParam)]
+pub(crate) struct GoGateInputs<'w> {
+    pub(crate) templates: Res<'w, crate::go_templates::GameObjectTemplates>,
+    pub(crate) factions: Option<Res<'w, super::ring::Factions>>,
+    /// `Option` because a headless/net-less build mounts no UI dialog verbs; absent reads as the
+    /// reference's zero-initialized `[0xb72038]`, i.e. not queued.
+    pub(crate) stone: Option<Res<'w, crate::ui_dialog_verbs::MeetingStone>>,
+}
+
+impl GoGateInputs<'_> {
+    /// `[0xb72038]` — the area we are queued at, `0` when we are not (or when there is no VM).
+    pub(crate) fn queued_area(&self) -> u32 {
+        self.stone.as_deref().map_or(0, |s| s.area)
+    }
+}
+
 pub(super) fn update_hovered_object(
     camera: Query<(&Camera, &GlobalTransform), With<WorldCamera>>,
     window: Query<&Window, With<PrimaryWindow>>,
@@ -632,10 +652,9 @@ pub(super) fn update_hovered_object(
     child_of: Query<&ChildOf>,
     guids: Query<&Guid>,
     stores: Query<&ObjectStore>,
-    // GENERIC's eligibility is its template's `data[1]` (decision 0762) — the ask-once cache.
-    go_templates: Res<crate::go_templates::GameObjectTemplates>,
-    // The faction term of eligibility (decision 0764): the GO's own template reaction toward us.
-    factions: Option<Res<super::ring::Factions>>,
+    // The three state reads the GameObject gates need beside the object's own store, as one
+    // param (the 16-`SystemParam` ceiling) — see [`GoGateInputs`].
+    go_gate: GoGateInputs,
     self_q: Query<&ObjectStore, With<crate::net::SelfPlayer>>,
     parts: PickParts,
     // The picker's own state, one bundled param ([`GoPickSet`] — the fn sits at Bevy's
@@ -774,7 +793,7 @@ pub(super) fn update_hovered_object(
                 // permissive default, so a fresh spawn isn't a dead zone for its first frames.
                 stores.get(net).map_or(1, |s| {
                     let reaction = crate::target::cursor_mode::go_reaction(
-                        factions.as_deref(),
+                        go_gate.factions.as_deref(),
                         s.0.gameobject_faction(),
                         self_store,
                     );
@@ -784,7 +803,10 @@ pub(super) fn update_hovered_object(
                             self_store, go_guid,
                         ),
                         meeting_stone_queued: crate::target::cursor_mode::meeting_stone_queued(
-                            go_guid.and_then(|g| go_templates.get(g)?.meeting_stone_area),
+                            go_guid
+                                .and_then(|g| go_gate.templates.get(g)?.meeting_stone)
+                                .map(|m| m.area),
+                            go_gate.queued_area(),
                         ),
                     };
                     u32::from(crate::target::cursor_mode::go_highlightable(
@@ -832,9 +854,9 @@ pub(super) fn update_hovered_object(
     // than the old behaviour (which tooltipped the portcullis itself) and documented rather than
     // silently accepted; closing it wants the single-pick arbitration, which is its own slice.
     if let Ok(store) = stores.get(net_entity) {
-        let tmpl = go_templates.get(guid.0);
+        let tmpl = go_gate.templates.get(guid.0);
         let reaction = crate::target::cursor_mode::go_reaction(
-            factions.as_deref(),
+            go_gate.factions.as_deref(),
             store.0.gameobject_faction(),
             self_store,
         );
@@ -850,7 +872,8 @@ pub(super) fn update_hovered_object(
                     Some(guid.0),
                 ),
                 meeting_stone_queued: crate::target::cursor_mode::meeting_stone_queued(
-                    tmpl.and_then(|t| t.meeting_stone_area),
+                    tmpl.and_then(|t| t.meeting_stone).map(|m| m.area),
+                    go_gate.queued_area(),
                 ),
             },
         ) {
diff --git a/crates/benilla-app/src/target/lock.rs b/crates/benilla-app/src/target/lock.rs
index 40be999b..403eabda 100644
--- a/crates/benilla-app/src/target/lock.rs
+++ b/crates/benilla-app/src/target/lock.rs
@@ -45,16 +45,16 @@ use crate::net::ObjectStore;
 /// spell). The `Option` members are absent without client data.
 #[derive(bevy::ecs::system::SystemParam)]
 pub(crate) struct GoLockInputs<'w> {
-    // ResMut, not Res: the tooltip arm of this bundle drives the ask-once template
-    // request on a miss (the click arm only reads).
-    pub(crate) templates: ResMut<'w, crate::go_templates::GameObjectTemplates>,
+    // Shared: the tooltip arm's ask-once template request on a miss marks itself through
+    // `&self` (decision 2288), so neither arm needs the store exclusively.
+    pub(crate) templates: Res<'w, crate::go_templates::GameObjectTemplates>,
     pub(crate) locks: Option<Res<'w, crate::go_templates::Locks>>,
     pub(crate) lock_types: Option<Res<'w, crate::go_templates::LockTypes>>,
     pub(crate) spells: Option<Res<'w, crate::ui_action::Spells>>,
     /// The skill-line catalog — the opener-value level term's spell→line hop
     /// ([`spell_skill_value`]). Absent without client data, which reads as skill 0 (fail-closed).
     pub(crate) skill_lines: Option<Res<'w, crate::ui_spellbook::SkillLines>>,
-    pub(crate) items: ResMut<'w, crate::items::Items>,
+    pub(crate) items: Res<'w, crate::items::Items>,
 }
 
 /// The GameObject facts the Action gate and the requirement fallback read off the wire — gathered
@@ -148,7 +148,6 @@ pub(crate) const GO_FLAG_LOCKED: u32 = 0x2;
 /// — so iterating a `HashSet` put Blizzard's placeholder name on the cast bar at the hash's whim
 /// (B247). `known` is a [`BTreeSet`] for exactly that reason: ascending spell id is the reference
 /// array's own order after login, the server building `SMSG_INITIAL_SPELLS` out of a `std::map`.
-#[allow(clippy::too_many_arguments)] // the reference fn's own inputs, plus the two out-params
 pub(crate) fn resolve_lock(
     slots: &[LockSlot],
     known: &BTreeSet<u32>,
diff --git a/crates/benilla-app/src/target/mod.rs b/crates/benilla-app/src/target/mod.rs
index 274e9b3b..d0280f41 100644
--- a/crates/benilla-app/src/target/mod.rs
+++ b/crates/benilla-app/src/target/mod.rs
@@ -389,11 +389,25 @@ impl Default for ClickConfig {
 #[derive(Resource, Default)]
 pub(crate) struct AssistAttack(pub(crate) bool);
 
+/// The targeting rows' change callback (decision 2303): two flags.
+pub(crate) fn on_cvar(
+    ev: On<crate::cvars::CvarChanged>,
+    mut click: ResMut<ClickConfig>,
+    mut assist: ResMut<AssistAttack>,
+) {
+    match ev.key().as_str() {
+        "deselectonclick" => click.deselect_on_click = ev.flag(),
+        "assistattack" => assist.0 = ev.flag(),
+        _ => {}
+    }
+}
+
 /// Targeting: click-to-select + the ground selection ring.
 pub(crate) struct TargetPlugin;
 
 impl Plugin for TargetPlugin {
     fn build(&self, app: &mut App) {
+        app.add_observer(on_cvar);
         app.init_resource::<Selection>()
             .init_resource::<ClickConfig>()
             .init_resource::<AssistAttack>()
diff --git a/crates/benilla-app/src/target/reticle.rs b/crates/benilla-app/src/target/reticle.rs
index 8309722e..7a834077 100644
--- a/crates/benilla-app/src/target/reticle.rs
+++ b/crates/benilla-app/src/target/reticle.rs
@@ -18,8 +18,9 @@
 //! per-effect `radius + casterLevel × perLevel` over **EffectRadiusIndex[0] and [1] only**
 //! (slot 2 is never read), max with candidate-1 winning ties/NaN. **Out of range forces the
 //! radius to 0.0** — the decal shrinks to the 1.3888889 default *and* turns red. `r == 0` (no
-//! radius rows — a dest spell with no area) also draws at the default. Class-6 spell modifiers
-//! don't exist yet (the same residual as the range gate, 0792).
+//! radius rows — a dest spell with no area) also draws at the default. Spell-mod op 6
+//! (SPELLMOD_RADIUS) is not folded in: the tables are live ([`crate::spell_mods`]), this consumer
+//! is not wired to them (the same residual as the range gate, 0792).
 //!
 //! **States**: in range → Acceptable at `r`; out of range → Unacceptable at the default size;
 //! cursor over sky / no world hit → **nothing is drawn** (the ref resets its draw state every
diff --git a/crates/benilla-app/src/target/ring.rs b/crates/benilla-app/src/target/ring.rs
index 8752ee32..595a0458 100644
--- a/crates/benilla-app/src/target/ring.rs
+++ b/crates/benilla-app/src/target/ring.rs
@@ -258,7 +258,7 @@ pub(super) fn load_factions(mut commands: Commands, world_assets: Option<Res<Wor
 /// merges `Values` deltas), the handle swapped only on change. No pulse — the reference's unit ring
 /// is steady. If the target's entity is gone (destroyed / streamed out) the selection clears and the
 /// server is told — the reference's teardown clear sends `CMSG_SET_SELECTION 0` on both paths.
-#[allow(clippy::type_complexity, clippy::too_many_arguments)]
+#[allow(clippy::type_complexity)]
 pub(super) fn update_ring(
     mut selection: ResMut<Selection>,
     factions: Option<Res<Factions>>,
diff --git a/crates/benilla-app/src/target/scan.rs b/crates/benilla-app/src/target/scan.rs
index 1764d872..9260fbf3 100644
--- a/crates/benilla-app/src/target/scan.rs
+++ b/crates/benilla-app/src/target/scan.rs
@@ -635,7 +635,6 @@ pub(super) struct CommitOutcome {
 /// don't. Shared with the UI's `TargetUnit` drain (`super::target_unit_requests`) so every
 /// non-mouse selection writer commits identically — a `TargetUnit("player")` mid-combat stops
 /// the swing and does NOT re-point (the tail's self exception).
-#[allow(clippy::too_many_arguments)] // `0x493540`'s own inputs, one press's worth
 pub(super) fn commit(
     selection: &mut Selection,
     seam: &mut crate::creature_anim::AttackSeam,
@@ -695,7 +694,6 @@ pub(super) fn commit(
 ///
 /// Re-score the live world, pool by tier, skip the recent history forward (or walk it backward),
 /// commit through the byte-law [`commit`].
-#[allow(clippy::too_many_arguments)] // the shared core's full input set, one press's worth
 fn cycle(
     side: ScanSide,
     reverse: bool,
@@ -1023,7 +1021,6 @@ pub(crate) struct AttackNearestRequest;
 /// error `0xa0` "There is nothing to attack" (we log; the red error banner is its own arc). The
 /// TAB history is not touched — an auto-pick is not a press (Classic's
 /// `TargetPriorityAutoTargetIgnoreWindow` nuance, disclosed unmodeled).
-#[allow(clippy::too_many_arguments)] // one Bevy system's full input set
 pub(super) fn acquire_and_attack(
     mut requests: MessageReader<AttackNearestRequest>,
     scan: TargetScan,
diff --git a/crates/benilla-app/src/test_support.rs b/crates/benilla-app/src/test_support.rs
new file mode 100644
index 00000000..7e801ff1
--- /dev/null
+++ b/crates/benilla-app/src/test_support.rs
@@ -0,0 +1,131 @@
+//! Helpers for the crate's **structural tests** — the ones that read this crate's own source
+//! and insist on a shape (decisions 1290, 2220, 2279). A structural test exists where the
+//! failure is silent at runtime, so the check has to happen at the line; these are the readers
+//! they share.
+
+/// Every `.rs` file under `root`, recursively.
+pub(crate) fn rust_files(root: &std::path::Path) -> Vec<std::path::PathBuf> {
+    let mut out = Vec::new();
+    let mut stack = vec![root.to_path_buf()];
+    while let Some(dir) = stack.pop() {
+        let Ok(entries) = std::fs::read_dir(&dir) else {
+            continue;
+        };
+        for entry in entries.flatten() {
+            let path = entry.path();
+            if path.is_dir() {
+                stack.push(path);
+            } else if path.extension().is_some_and(|e| e == "rs") {
+                out.push(path);
+            }
+        }
+    }
+    out
+}
+
+/// This crate's `src/` directory.
+pub(crate) fn src_dir() -> std::path::PathBuf {
+    std::path::Path::new(env!("CARGO_MANIFEST_DIR")).join("src")
+}
+
+/// A file's path under `src/`, with forward slashes — the key every `EXEMPT` table uses.
+pub(crate) fn rel_path(file: &std::path::Path) -> String {
+    let src = src_dir();
+    file.strip_prefix(&src)
+        .unwrap_or(file)
+        .to_string_lossy()
+        .replace('\\', "/")
+}
+
+/// One `fn` item as the scanners see it: its name, its parenthesised parameter list, and its
+/// body (the text between the outermost braces), each found by bracket matching so a scan
+/// sees a signature or a body rather than whatever text happens to follow.
+pub(crate) struct FnItem<'a> {
+    pub name: &'a str,
+    pub params: &'a str,
+    pub body: &'a str,
+}
+
+/// Every `fn` in `text`. A `fn` with no body (a trait method signature) comes back with an
+/// empty body; a generic parameter list before the `(` is tolerated in the shapes this
+/// codebase writes.
+pub(crate) fn fn_items(text: &str) -> Vec<FnItem<'_>> {
+    let bytes = text.as_bytes();
+    let mut out = Vec::new();
+    for (i, _) in text.match_indices("fn ") {
+        // `fn` must start a word: `…_fn (` and `Fn(` are not declarations.
+        if i > 0 && (bytes[i - 1].is_ascii_alphanumeric() || bytes[i - 1] == b'_') {
+            continue;
+        }
+        let Some(open) = text[i..].find('(').map(|o| i + o) else {
+            continue;
+        };
+        let name = text[i + 3..open].trim();
+        let name = name.split('<').next().unwrap_or(name).trim();
+        let Some(close) = matching(text, open, b'(', b')') else {
+            continue;
+        };
+        let params = &text[open + 1..close];
+        // The body: the first `{` after the parameter list, unless a `;` (a bodiless
+        // signature) or another `fn` comes first.
+        let tail = &text[close + 1..];
+        let body = match (tail.find('{'), tail.find(';')) {
+            (Some(b), Some(s)) if s < b => "",
+            (Some(b), _) => {
+                let bopen = close + 1 + b;
+                match matching(text, bopen, b'{', b'}') {
+                    Some(bclose) => &text[bopen + 1..bclose],
+                    None => "",
+                }
+            }
+            (None, _) => "",
+        };
+        out.push(FnItem { name, params, body });
+    }
+    out
+}
+
+/// The parenthesised parameter list of every `fn` in `text` — see [`fn_items`].
+pub(crate) fn fn_parameter_lists(text: &str) -> Vec<&str> {
+    fn_items(text).into_iter().map(|f| f.params).collect()
+}
+
+/// The index of the bracket closing the one at `open`, or `None` if it never closes.
+fn matching(text: &str, open: usize, lhs: u8, rhs: u8) -> Option<usize> {
+    let mut depth = 0usize;
+    for (j, &c) in text.as_bytes()[open..].iter().enumerate() {
+        if c == lhs {
+            depth += 1;
+        } else if c == rhs {
+            depth -= 1;
+            if depth == 0 {
+                return Some(open + j);
+            }
+        }
+    }
+    None
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn a_fn_comes_back_with_its_name_its_params_and_its_body() {
+        let text = "fn a(x: u32) -> u32 { x + 1 }\nfn b();\nfn c<T>(t: T) { if t { { } } }";
+        let items = fn_items(text);
+        assert_eq!(items.len(), 3);
+        assert_eq!(
+            (items[0].name, items[0].params, items[0].body),
+            ("a", "x: u32", " x + 1 ")
+        );
+        assert_eq!(
+            (items[1].name, items[1].params, items[1].body),
+            ("b", "", "")
+        );
+        assert_eq!(
+            (items[2].name, items[2].params, items[2].body),
+            ("c", "t: T", " if t { { } } ")
+        );
+    }
+}
diff --git a/crates/benilla-app/src/text_filter.rs b/crates/benilla-app/src/text_filter.rs
index 8d69e023..279fa3e0 100644
--- a/crates/benilla-app/src/text_filter.rs
+++ b/crates/benilla-app/src/text_filter.rs
@@ -464,9 +464,7 @@ mod tests {
     /// empty string**, which is the assumption `mask_uncached`'s zero-length break rests on.
     #[test]
     fn every_shipped_pattern_compiles_and_none_matches_empty() {
-        let Some(data) = benilla_formats::wow_data() else {
-            return;
-        };
+        let data = benilla_formats::wow_data_or_skip!();
         let mut chain = benilla_formats::open_chain(&data).expect("open chain");
         let profanity = benilla_formats::load_chat_profanity(&mut chain).expect("profanity");
         let spam = benilla_formats::load_spam_messages(&mut chain).expect("spam");
@@ -489,9 +487,7 @@ mod tests {
     /// The shipped data end to end: the oracle's own sentences through the real lists.
     #[test]
     fn the_shipped_lists_reproduce_the_oracle_sentences() {
-        let Some(data) = benilla_formats::wow_data() else {
-            return;
-        };
+        let data = benilla_formats::wow_data_or_skip!();
         let mut chain = benilla_formats::open_chain(&data).expect("open chain");
         let profanity = benilla_formats::load_chat_profanity(&mut chain).expect("profanity");
         let spam = benilla_formats::load_spam_messages(&mut chain).expect("spam");
@@ -599,8 +595,19 @@ fn load_text_filter_lists(
 
 pub(crate) struct TextFilterPlugin;
 
+/// The two filter switches' change callback (decision 2303): flags — the reference's own
+/// callbacks (`0x403570`, `0x4035b0`) mirror `SStrToInt(newValue)` into a global the same way.
+pub(crate) fn on_cvar(ev: On<crate::cvars::CvarChanged>, mut switches: ResMut<TextFilterSwitches>) {
+    match ev.key().as_str() {
+        "profanityfilter" => switches.profanity = ev.flag(),
+        "spamfilter" => switches.spam = ev.flag(),
+        _ => {}
+    }
+}
+
 impl Plugin for TextFilterPlugin {
     fn build(&self, app: &mut App) {
+        app.add_observer(on_cvar);
         app.init_resource::<TextFilterSwitches>()
             .init_resource::<TextFilter>()
             .add_systems(
diff --git a/crates/benilla-app/src/text_reshape.rs b/crates/benilla-app/src/text_reshape.rs
index 266e2b69..c29ccde7 100644
--- a/crates/benilla-app/src/text_reshape.rs
+++ b/crates/benilla-app/src/text_reshape.rs
@@ -183,7 +183,6 @@ pub(crate) mod harness {
             .expect("the relayout system runs");
     }
 
-    #[allow(clippy::too_many_arguments)]
     fn relayout_one(
         In(root): In<Entity>,
         mut pipeline: ResMut<TextPipeline>,
diff --git a/crates/benilla-app/src/tutorial.rs b/crates/benilla-app/src/tutorial.rs
index 67de1ef6..9f54ab19 100644
--- a/crates/benilla-app/src/tutorial.rs
+++ b/crates/benilla-app/src/tutorial.rs
@@ -35,7 +35,7 @@ use benilla_ui::script::{ScriptValue, UiScript};
 use crate::char_select::ClientState;
 use crate::net::{ClientCommand, EnteredWorldMessage, NetCommands, ObjectStore, SelfPlayer};
 use crate::player::Player;
-use crate::ui_script::UiInput;
+use crate::ui_script::{UiFeed, UiInput};
 
 /// The popup cue `0x4b5390` plays on both legs (`0x846b68`), gated on `MasterSoundEffects` at
 /// the mixer like every SFX kit.
@@ -599,7 +599,7 @@ impl Plugin for TutorialPlugin {
                     // The gate costs nothing: the cascade still arms and still triggers, `fired`
                     // simply waits, and the first frame with an interface delivers the set.
                     feed_tutorials
-                        .before(UiInput)
+                        .in_set(UiFeed)
                         .run_if(crate::ui_script::ingame_ui_up),
                     drain_tutorials.after(UiInput),
                 ),
diff --git a/crates/benilla-app/src/ui_action/cast_fail.rs b/crates/benilla-app/src/ui_action/cast_fail.rs
index 6fa7b936..8949295f 100644
--- a/crates/benilla-app/src/ui_action/cast_fail.rs
+++ b/crates/benilla-app/src/ui_action/cast_fail.rs
@@ -30,23 +30,56 @@
 //! NO_POWER).
 //!
 //! **The argument arms, and what is still approximate.** Filled: `0x5e` REQUIRES_SPELL_FOCUS and
-//! `0x5d` REQUIRES_AREA here (decision 1313 — `0x6e1f62`/`0x6e1fad`), plus `0x8d`
+//! `0x5d` REQUIRES_AREA here (decision 1313 — `0x6e1f62`/`0x6e1fad`), `0x8d`
 //! PREVENTED_BY_MECHANIC (decision 1948 — `0x6e2190`, and the one arm whose word is produced
-//! locally rather than read off the wire), and `0x78` TOTEMS / `0x5c`
-//! REAGENTS / `0x19`–`0x1b` EQUIPPED_ITEM_CLASS\* in the drain, which owns them because their
-//! fills need the item caches and the query-then-redisplay cache-miss behavior ("Requires Mining
-//! Pick", decisions 0545 + 0552). Still stripped rather than filled — each needs a DBC we do not
-//! load yet: `0x56` ONLY_SHAPESHIFT (form-name list), `0x90` MIN_SKILL (`SkillLine.dbc`),
-//! `0x31` NEED_EXOTIC_AMMO and `0x84`
-//! PROSPECT_NEED_MORE. Stripping is a **deliberate divergence**, now byte-confirmed as one: on a
+//! locally rather than read off the wire), `0x56` ONLY_SHAPESHIFT (decision 2280 — `0x6e1ff8`,
+//! the one arm that reads a **mask** and joins several names), and `0x78` TOTEMS / `0x5c`
+//! REAGENTS / `0x19`–`0x1b` EQUIPPED_ITEM_CLASS\* / `0x31` NEED_EXOTIC_AMMO in the drain, which
+//! owns the totem/reagent pair because their fills need the item caches and the
+//! query-then-redisplay cache-miss behavior ("Requires Mining Pick", decisions 0545 + 0552), and
+//! the other two because they share `0x6e2380`'s subclass catalog.
+//!
+//! **That is every arm in the `0x6e1d8e` table, and the reasons that still read bare read bare
+//! for reasons that are not "a DBC we do not load"** — decision 2292, which found that claim
+//! false in all three places this paragraph used to make it — the same stale blocker that hid
+//! `0x56` behind a DBC we had been loading for a month:
+//!
+//! - `0x30` NEED_AMMO_POUCH — **the reference leaves its own `%s` literal.** There is no arm to
+//!   write: `0x6e1e3d` only clears `[caster+0xd58]` bit `0x200`, and no word is ever supplied.
+//! - `0x31` NEED_EXOTIC_AMMO — modeled, and argless on this stack. `Spell::SendCastResult` fills
+//!   `failureArg1` for four reasons and this is not one of them, so the arm declines.
+//! - `0x84` PROSPECT_NEED_MORE and `0x90` MIN_SKILL — **unreachable on 5875, not
+//!   unimplemented.** Neither is server-sent, and their only raise sites image-wide (`0x49614e`
+//!   and `0x496128`, both inside the item-target validator `0x495d60`) sit behind that
+//!   function's third leg, `Effect[i] == 0x7f` SPELL_EFFECT_PROSPECTING — which no shipped spell
+//!   carries, pinned on the real file by `real_prospecting_effect_is_absent_from_5875`.
+//!   `SkillLine.dbc`, the DBC `0x90` was said to be waiting on, has been loaded since the
+//!   spellbook grew tabs.
+//!
+//! Stripping is a **deliberate divergence**, now byte-confirmed as one: on a
 //! bad id or an absent word the reference jumps to the default arm with the pointer still on the
 //! *unfilled* template, so it displays a literal `Requires %s` (wow-re §WIRE-ARGS C3 — the fill
 //! path's own buffer swap sits after the printf and is skipped). We show the bare stem instead:
 //! "Requires" reads as terse, "Requires %s" reads as broken software (§7 — judge by the result).
+//! **`0x56` is the exception, and it is the reference's own** ([`Fill::Nothing`]): its three
+//! failure exits land on the function epilogue, not on that default arm, so an unfillable
+//! ONLY_SHAPESHIFT displays nothing at all.
 //! `0x0a`'s item-spell leg (`ERR_INVALID_ITEM_TARGET`) is unmodeled — the drain does not know
 //! item-ness.
+//!
+//! 4. **A fourth thing leaves this function, and it is not the displayed text**
+//!    ([`CastFailLine::arg_text`], decision 2285). `0x6e1a00` also calls the combat-log formatter
+//!    `0x62c360`, and hands it `edi` — the **argText** buffer, which layer 2 never touches. So
+//!    the eighteen re-worded reasons say one thing on screen and another in the log: "Spell is
+//!    not ready yet." against "Not yet recovered". Modelling the log as "whatever the red line
+//!    said" is wrong on seven rows; re-deriving it from the key table is wrong on the filled
+//!    arms. Both buffers come out of the one resolution here.
 
-use benilla_formats::{AreaTableCatalog, SpellDisplay, SpellFocusCatalog, SpellMechanicCatalog};
+use std::collections::HashMap;
+
+use benilla_formats::{
+    AreaTableCatalog, ShapeshiftForm, SpellDisplay, SpellFocusCatalog, SpellMechanicCatalog,
+};
 
 use super::Caster;
 
@@ -234,6 +267,30 @@ pub(super) struct FailArgs<'a> {
     pub(super) areas: Option<&'a AreaTableCatalog>,
     /// `SpellMechanic.dbc` (`0xc0d7c4`) — the `0x8d` arm's mechanic name (decision 1948).
     pub(super) mechanics: Option<&'a SpellMechanicCatalog>,
+    /// `SpellShapeshiftForm.dbc` (`0xc0d76c`) — the `0x56` arm's form names, keyed by form id
+    /// exactly as [`crate::ui_action::Spells::forms`] holds them (decision 2280).
+    pub(super) forms: Option<&'a HashMap<u32, ShapeshiftForm>>,
+}
+
+/// What an argument arm produced — **and, when it produced nothing, which exit the reference's
+/// own arm takes**, because the two unfilled outcomes are not the same outcome.
+///
+/// Every other arm in the `0x6e1d8e` table declines through a bounds test that jumps to the
+/// shared default `0x6e21d8`, where `edi` still points at the *unfilled* `SPELL_FAILED_*`
+/// template and the line is displayed anyway ([`Self::Template`] — benilla strips its tokens
+/// rather than showing a raw `%s`). `0x56` alone jumps, from all three of its failure exits, to
+/// the function **epilogue** `0x6e224f`
+/// ([`Self::Nothing`]), past `DisplayError`, past the error sound and past the cast abort
+/// `0x6e4940` alike. That is not a special case anyone chose: the `0x56` arm spends `edi` as its
+/// own loop counter, so it has no text pointer left to hand the default arm.
+pub(super) enum Fill {
+    /// The arm resolved its word — the template's `%s` takes it.
+    Filled(String),
+    /// The arm declined (or benilla does not model it) and the reference still displays the
+    /// template: the shared default `0x6e21d8`.
+    Template,
+    /// The arm declined and the reference displays **nothing**: the epilogue `0x6e224f`.
+    Nothing,
 }
 
 impl FailArgs<'_> {
@@ -259,7 +316,11 @@ impl FailArgs<'_> {
     /// `row + 0x2c + locale*4`, so `"You need to be in %s"` names the zone. This one has **no**
     /// client-side stand-in: the server derives the id from its own `spell_area` rows and nothing
     /// in `Spell.dbc` holds it, so an absent word means an unfilled message.
-    fn fill(&self, reason: u8, spell: Option<&SpellDisplay>) -> Option<String> {
+    fn fill(&self, caster: Caster, reason: u8, spell: Option<&SpellDisplay>) -> Fill {
+        let named = |name: Option<&str>| match name {
+            Some(name) => Fill::Filled(name.to_string()),
+            None => Fill::Template,
+        };
         match reason {
             // **`0x8d` PREVENTED_BY_MECHANIC** (`0x6e2190`) → `SpellMechanic.dbc` (`0xc0d7c4`),
             // so "Can't do that while %s" reads "Can't do that while stunned". Unlike its two
@@ -267,18 +328,74 @@ impl FailArgs<'_> {
             // comes from the crowd-control ladder's own exemption scan (decisions 1941/1948).
             // A `0` or unknown id leaves the template to the strip fallback, which is also what
             // the arm does when the scan named no mechanic at all.
-            0x8D => self.mechanics?.name(self.arg?).map(str::to_string),
-            0x5D => self.areas?.name(self.arg?).map(str::to_string),
+            0x8D => named(self.arg.and_then(|id| self.mechanics?.name(id))),
+            0x5D => named(self.arg.and_then(|id| self.areas?.name(id))),
             0x5E => {
                 let id = self
                     .arg
                     .filter(|&id| id != 0)
-                    .or_else(|| Some(spell?.requires_spell_focus).filter(|&id| id != 0))?;
-                self.focus?.name(id).map(str::to_string)
+                    .or_else(|| spell.map(|d| d.requires_spell_focus).filter(|&id| id != 0));
+                named(id.and_then(|id| self.focus?.name(id)))
             }
-            _ => None,
+            0x56 => self.shapeshift_forms(caster, spell),
+            _ => Fill::Template,
         }
     }
+
+    /// **`0x56` ONLY_SHAPESHIFT** (`0x6e1ff8`) → `SpellShapeshiftForm.dbc` (`0xc0d76c`), so
+    /// `"Must be in %s"` reads "Must be in Cat Form" — the line a bear-form druid gets for
+    /// pressing Prowl. The one arm that reads a **mask** and can name several forms.
+    ///
+    /// Byte-exact, and unlike its neighbours it reads **no wire word at all**: `6e2021` re-reads
+    /// the failing spell's own record, `6e202d: test [eax+0x2c],edx` walks `SpellRec+0x2c`
+    /// (`Stances`, field 11) bit by bit, and `6e2050: mov eax,[esi+edx*4+0x8]` takes each row's
+    /// `Name` at `row + 0x8 + locale*4`. The walk is over the **record array** (`6e20b3: add
+    /// esi,0x38`, stride 56 = one row) with the bit index as the row index, never through the
+    /// id-lookup table — and 5875's file is 32 rows carrying ids 1..32 in file order (verified on
+    /// the extracted DBC), so row index `b` IS form id `b+1`. That is the same "bit b = form id
+    /// b+1" law the spell tooltip's own required-form line already runs on, which is why the
+    /// tooltip could read "Requires Cat Form" while the refusal read "Must be in".
+    ///
+    /// Joined with `", "` (`0x84480c`, `SStrCat 0x64a760`) — the reference's own separator, and
+    /// again the tooltip line's. A row whose `Name` is NULL or **empty** is skipped
+    /// (`6e2058: cmp BYTE PTR [eax],0x0`); 5875 ships fourteen such rows, so this is live data,
+    /// not a guard against nothing.
+    ///
+    /// Two earned negatives. The arm never tests `AttributesEx2` bit `0x80000` — the *permissive*
+    /// mask attribute the tooltip's required-form line does honour (`0x52f115`, decision 1483) —
+    /// so a permissive spell that somehow reached this reason would still name its forms; the
+    /// form gate, not this arm, is what keeps that unreachable. And `StancesNot` (`+0x30`) is
+    /// never read here either.
+    ///
+    /// **Nothing to say is said as nothing** ([`Fill::Nothing`]): an empty mask, an unnamed set
+    /// of forms, no spell record (`6e1ffd`), or an unloaded DBC (`6e2016`, the `[0xc0d770] == 0`
+    /// test) all leave the "nothing appended" flag set at `6e20c1` and jump to the epilogue.
+    fn shapeshift_forms(&self, caster: Caster, spell: Option<&SpellDisplay>) -> Fill {
+        let (Some(forms), Some(stances)) = (self.forms, spell.map(|d| d.stances)) else {
+            return Fill::Nothing;
+        };
+        let mut named = (0..u32::BITS)
+            .filter(|b| stances & (1 << b) != 0)
+            .filter_map(|b| forms.get(&(b + 1)))
+            .map(|f| f.name.as_str())
+            .filter(|n| !n.is_empty());
+        match caster {
+            // **The pet's arm does not join** (decision 2285). `0x6e921a` reads the same store
+            // the same way — `[0xc0d76c]` at `0x6e924f`, stride `0x38` at `0x6e9285`,
+            // `row+0x8+locale*4` at `0x6e9277`, the mask at `0x6e924c` — and then
+            // `0x6e9282: jne 0x6e929a` leaves the loop at the FIRST non-empty name. It is a
+            // break, not a continue: over `[0x6e8eb0, 0x6e93d0)` there is not one `SStrCat`
+            // (`0x64a760`) call and not one reference to the separator `0x84480c`. So a
+            // two-form spell the player reads as "Bear Form, Dire Bear Form" the pet reads as
+            // "Bear Form".
+            Caster::Pet => named.next().map(str::to_string),
+            Caster::Player => {
+                let all: Vec<&str> = named.collect();
+                (!all.is_empty()).then(|| all.join(", "))
+            }
+        }
+        .map_or(Fill::Nothing, Fill::Filled)
+    }
 }
 
 /// The errorId every reason that overrides nothing falls through to — `0x2c`, whose text is the
@@ -300,19 +417,57 @@ pub(super) const PASSTHROUGH: &str = "ERR_SPELL_FAILED_S";
 pub(super) struct CastFailLine {
     pub key: &'static str,
     pub text: String,
+    /// **The reference's OTHER buffer** — `edi` at `0x6e21e2`, which is what the combat-log
+    /// formatter `0x62c360` receives, not the displayed text (decision 2285).
+    ///
+    /// `0x6e1d9a: lea edi,[ebp-0x488]` runs **once, before the argument dispatch**, on the buffer
+    /// `0x6e1d77` has just filled with `GetText("SPELL_FAILED_<name>")` — and the errorId-override
+    /// chain (`0x6e1aab`–`0x6e1c5f`) writes only `[ebp-8]`, never `edi`. So an override changes
+    /// what the SCREEN says and leaves the log on the first-layer string: a cooldown refusal
+    /// toasts "Spell is not ready yet." and logs "Not yet recovered". Only `0x6e21d2` re-points
+    /// `edi`, at `[ebp-0x888]`, which just three arms write — a filled argument arm (the printf
+    /// output, so log == toast), `0x02` (the bare power noun), and `0x4d` (blanked).
+    ///
+    /// Empty means "read the last-error buffer `0xb4da40` instead" — see [`Self::logged`].
+    pub arg_text: String,
 }
 
 impl CastFailLine {
     /// A line the second layer left on its default errorId — the drain builds these for the three
     /// argument arms it owns (`0x78` TOTEMS, `0x5c` REAGENTS, `0x19`-`0x1b` EQUIPPED_ITEM_CLASS*),
-    /// whose fills need the item caches.
+    /// whose fills need the item caches. A filled arm's two buffers hold the same printf output.
     pub(super) fn passthrough(text: String) -> Self {
         Self {
             key: PASSTHROUGH,
+            arg_text: text.clone(),
             text,
         }
     }
 
+    /// What `0x62c360` prints as the reason — `0x6e21e2`'s one-byte test: the argText buffer when
+    /// it is non-empty, else `0x4968a0`'s global last-error cell `0xb4da40`, which `DisplayError`
+    /// has just filled with the text it displayed (`0x496802`).
+    pub(super) fn logged(&self) -> &str {
+        if self.arg_text.is_empty() {
+            &self.text
+        } else {
+            &self.arg_text
+        }
+    }
+
+    /// The `0x4d` arm's `mov BYTE PTR [ebp-0x888],0` (`0x6e20fd` / `0x6e2113`): the argText
+    /// buffer is emptied and `edi` re-pointed at it, so the combat log falls through to the
+    /// last-error cell and reads what the screen reads. The one override whose two surfaces
+    /// agree, and it agrees by being blanked rather than by being equal. (Moot on the pet's
+    /// path, which never reaches a log formatter at all — it is applied there only so the two
+    /// casters' lines carry the same shape.)
+    fn arm_blanked(self) -> Self {
+        Self {
+            arg_text: String::new(),
+            ..self
+        }
+    }
+
     fn fill(self, name: &str) -> Self {
         Self {
             text: self.text.replace("%s", name),
@@ -332,7 +487,23 @@ pub(super) fn cast_fail_text(
     get: &dyn Fn(&str) -> Option<String>,
 ) -> Option<CastFailLine> {
     let get_text = |key: &str| get(key).filter(|s| !s.is_empty());
-    let get_display = |key: &'static str| get_text(key).map(|text| CastFailLine { key, text });
+    // `[ebp-0x488]` — the FIRST-layer string, `SStrCopy`d at `0x6e1d77` and pointed at by `edi`
+    // at `0x6e1d9a`, both of which run before the argument dispatch and neither of which any
+    // errorId override touches. It is therefore what the combat log reads for every reason no
+    // argument arm claims, *including* the eighteen the second layer re-words on screen
+    // ([`CastFailLine::arg_text`], decision 2285). Empty when 5875 ships no such key.
+    let first_layer = CAST_FAIL_KEYS
+        .get(usize::from(reason))
+        .and_then(|k| get_text(k))
+        .map(|t| strip_tokens(&t))
+        .unwrap_or_default();
+    let get_display = |key: &'static str| {
+        get_text(key).map(|text| CastFailLine {
+            key,
+            text,
+            arg_text: first_layer.clone(),
+        })
+    };
     // The errorId overrides — the replaced-message reasons. **Which table is asked is the
     // caster's** (decision 2033): the reference does not flag one handler, it ships two, and they
     // disagree on ten reasons. Everything past this match — the `SPELL_FAILED_*` vocabulary, the
@@ -368,7 +539,7 @@ pub(super) fn cast_fail_text(
             // ability reads "Not enough focus" either way.
             0x4D => {
                 let power = spell.map_or(0, |d| d.power_type);
-                return get_display(power_keys(power).0);
+                return get_display(power_keys(power).0).map(CastFailLine::arm_blanked);
             }
             // What is deliberately absent is as load-bearing as what is here: the pet's index
             // table sends `0x01`/`0x02` (already at full health/power), `0x09` (no target),
@@ -380,11 +551,13 @@ pub(super) fn cast_fail_text(
             // `SPELL_FAILED_DONT_REPORT` has no string in 5875's `GlobalStrings.lua`, so the
             // passthrough below draws nothing and the two agree on screen.
             //
-            // `0x56` ONLY_SHAPESHIFT has a real arm here (`0x6e921a`, errorId `0xd6`) that fills
-            // the template with a `SpellShapeshiftForm.dbc` name and displays it through the bare
-            // `"%s"` of `ERR_SPELL_FAILED_SHAPESHIFT_FORM_S` — the same net line the player's own
-            // unmodeled arm would produce, and stripped the same way here for the same reason
-            // (that DBC is not loaded). Same surface, same silence, no pet-specific work.
+            // `0x56` ONLY_SHAPESHIFT has its own arm here (`0x6e921a`, errorId `0xd6`), and it
+            // is the one place the two casters' form lines actually differ: it names the FIRST
+            // matching form and stops, where the player's joins them all. [`FailArgs::fill`] owns
+            // that fork, below — the line still resolves through the shared layer, because
+            // `ERR_SPELL_FAILED_SHAPESHIFT_FORM_S` is the bare `"%s"` exactly as the passthrough
+            // `0x2c` is, and the message catalog gives ids `0x2c` and `0xd6` the same surface.
+            // What is NOT shared is the log: `0x6e8eb0` never calls `0x62c360` at all.
             _ => {}
         },
         // `Spell_C::HandleCastFailed 0x6e1a00` (`0x6e1aab`–`0x6e1c5f`).
@@ -394,7 +567,13 @@ pub(super) fn cast_fail_text(
                 let t = get_display("ERR_SPELL_FAILED_ALREADY_AT_FULL_POWER_S")?;
                 let power = spell.map_or(0, |d| d.power_type);
                 let name = get_text(power_keys(power).1).unwrap_or_default();
-                return Some(t.fill(&name));
+                // `0x6e211f` copies the localized power NOUN — and nothing else — into
+                // `[ebp-0x888]`, then points `edi` there. So the screen reads the sentence and
+                // the combat log reads the bare word: "You fail to cast Rejuvenation: Mana."
+                return Some(CastFailLine {
+                    arg_text: name.clone(),
+                    ..t.fill(&name)
+                });
             }
             0x09 => return get_display("ERR_GENERIC_NO_TARGET"),
             0x17 => return None, // DONT_REPORT: control-flow hidden (jumps past DisplayError)
@@ -421,7 +600,7 @@ pub(super) fn cast_fail_text(
             0x41 => return get_display("ERR_SPELL_FAILED_NOTUNSHEATHED"),
             0x4D => {
                 let power = spell.map_or(0, |d| d.power_type);
-                return get_display(power_keys(power).0);
+                return get_display(power_keys(power).0).map(CastFailLine::arm_blanked);
             }
             0x59 => return get_display("ERR_SPELL_OUT_OF_RANGE"),
             0x8E => return get_display("ERR_PLAY_TIME_EXCEEDED"),
@@ -430,36 +609,42 @@ pub(super) fn cast_fail_text(
     }
     // The passthrough layer: errorId 0x2c ("%s") displays GetText(SPELL_FAILED_<name>) as-is.
     let Some(key) = CAST_FAIL_KEYS.get(usize::from(reason)) else {
-        return Some(CastFailLine {
-            key: PASSTHROUGH,
-            text: format!("Spell failed ({reason:#04x})"),
-        });
+        return Some(CastFailLine::passthrough(format!(
+            "Spell failed ({reason:#04x})"
+        )));
     };
     let text = get_text(key)?;
-    let line = |text: String| CastFailLine {
-        key: PASSTHROUGH,
-        text,
-    };
+    // On this layer the two buffers are one string: errorId `0x2c` is the bare `"%s"`, so what
+    // `DisplayError` formats IS `[ebp-0x488]`, the same buffer `edi` still points at.
+    let line = CastFailLine::passthrough;
     // The argument arms (`0x6e1d8e`): fill the template's `%s` from the reason's own DBC.
-    if let Some(name) = args.fill(reason, spell) {
-        return Some(line(text.replace("%s", &name)));
+    match args.fill(caster, reason, spell) {
+        Fill::Filled(name) => return Some(line(text.replace("%s", &name))),
+        // The arm's own exit is the epilogue, not the shared default — nothing is displayed, and
+        // nothing is logged either (`0x6e224f` is past `0x62c360` too). See [`Fill`].
+        Fill::Nothing => return None,
+        Fill::Template => {}
     }
     // An arm we don't model (or one whose lookup missed) — strip the tokens so the stem reads
     // clean ("Missing reagent: %s" → "Missing reagent"), never a raw % on screen.
-    if text.contains('%') {
-        let stripped = text
-            .replace("%s", "")
-            .replace("%d", "")
-            .split_whitespace()
-            .collect::<Vec<_>>()
-            .join(" ");
-        return Some(line(
-            stripped
-                .trim_end_matches([' ', ':', '.', '(', ')'])
-                .to_string(),
-        ));
+    Some(line(strip_tokens(&text)))
+}
+
+/// The unmodeled-arm fallback's token strip — "Missing reagent: %s" → "Missing reagent", a
+/// deliberate divergence from the reference's literal `%s` (module docs). Applied to **both**
+/// buffers, so a declined arm never puts a raw token in the combat log either. A string with no
+/// token is returned unchanged.
+fn strip_tokens(text: &str) -> String {
+    if !text.contains('%') {
+        return text.to_string();
     }
-    Some(line(text))
+    text.replace("%s", "")
+        .replace("%d", "")
+        .split_whitespace()
+        .collect::<Vec<_>>()
+        .join(" ")
+        .trim_end_matches([' ', ':', '.', '(', ')'])
+        .to_string()
 }
 
 #[cfg(test)]
@@ -475,6 +660,7 @@ mod tests {
             ("SPELL_FAILED_TOO_CLOSE", "Target too close"),
             ("SPELL_FAILED_NOT_READY", "Not yet recovered"),
             ("SPELL_FAILED_REAGENTS", "Missing reagent: %s"),
+            ("SPELL_FAILED_ONLY_SHAPESHIFT", "Must be in %s"),
             ("ERR_SPELL_OUT_OF_RANGE", "Out of range."),
             ("ERR_GENERIC_NO_TARGET", "You have no target."),
             ("ERR_SPELL_COOLDOWN", "Spell is not ready yet."),
@@ -483,8 +669,10 @@ mod tests {
             ("ERR_OUT_OF_MANA", "Not enough mana"),
             ("ERR_OUT_OF_RAGE", "Not enough rage"),
             (
+                // Verbatim from 5875 — it is NOT "You have nothing to attack with.", which is
+                // what this fixture claimed until the log leg made the difference observable.
                 "ERR_SPELL_FAILED_NOTUNSHEATHED",
-                "You have nothing to attack with.",
+                "You have to be unsheathed to do that!",
             ),
             // The pet's own six, verbatim from the shipped file — and NO `ERR_PET_SPELL_NOPATH`,
             // because 5875 ships none, which is a fact these tests rest on.
@@ -689,6 +877,227 @@ mod tests {
         assert_eq!(kind_of(through.key), MsgKind::Error);
     }
 
+    /// **`0x56` ONLY_SHAPESHIFT, the arm's three shapes** (decision 2280): one form, several
+    /// joined with the reference's `", "`, and a row whose `Name` the DBC leaves empty.
+    ///
+    /// The bit→id law is the reference's record walk read as a lookup — row index `b` is form id
+    /// `b+1` — so Prowl's `Stances = 0x1` names form 1 and Maul's `0x90` names forms 5 and 8, in
+    /// **mask order**, which is the order the loop visits them in and not the order anything
+    /// sorts them into.
+    #[test]
+    fn only_shapeshift_names_the_forms_the_stance_mask_asks_for() {
+        let m = gs();
+        let g = getter(&m);
+        let forms = forms([
+            (1, "Cat Form"),
+            (5, "Bear Form"),
+            (8, "Dire Bear Form"),
+            (9, ""),
+        ]);
+        let text = |stances: u32| {
+            let d = SpellDisplay {
+                stances,
+                ..Default::default()
+            };
+            cast_fail_text(
+                Caster::Player,
+                0x56,
+                Some(&d),
+                FailArgs {
+                    forms: Some(&forms),
+                    ..FailArgs::default()
+                },
+                &g,
+            )
+            .map(|l| l.text)
+        };
+        assert_eq!(text(0x1).as_deref(), Some("Must be in Cat Form"));
+        assert_eq!(
+            text(0x90).as_deref(),
+            Some("Must be in Bear Form, Dire Bear Form"),
+        );
+        // `6e2058: cmp BYTE PTR [eax],0x0` — an empty name is skipped, not joined as a gap.
+        assert_eq!(
+            text(0x90 | 0x100).as_deref(),
+            Some("Must be in Bear Form, Dire Bear Form"),
+        );
+        assert_eq!(text(0x101).as_deref(), Some("Must be in Cat Form"));
+    }
+
+    /// **The `0x56` arm's failure exit is the function epilogue, not the strip fallback** — an
+    /// unfillable ONLY_SHAPESHIFT displays NOTHING (`6e20c6 jne 0x6e224f`, past `DisplayError`),
+    /// where every other declining arm still shows its stripped stem. Four ways in: no spell
+    /// record (`6e1ffd`), an unloaded DBC (`6e2016`), an empty mask, and a mask naming only
+    /// unnamed rows.
+    ///
+    /// The control is the neighbour: `0x5c` REAGENTS declines through the SHARED default and so
+    /// still reads "Missing reagent". If this ever regresses, the tell is the words "Must be in"
+    /// alone on screen — which is exactly how the defect was reported.
+    #[test]
+    fn an_unfillable_only_shapeshift_says_nothing_at_all() {
+        let m = gs();
+        let g = getter(&m);
+        let forms = forms([(1, "Cat Form"), (9, "")]);
+        let line = |spell: Option<&SpellDisplay>, args| {
+            cast_fail_text(Caster::Player, 0x56, spell, args, &g)
+        };
+        let with = FailArgs {
+            forms: Some(&forms),
+            ..FailArgs::default()
+        };
+        let empty_mask = SpellDisplay::default();
+        let unnamed = SpellDisplay {
+            stances: 0x100,
+            ..Default::default()
+        };
+        let cat = SpellDisplay {
+            stances: 0x1,
+            ..Default::default()
+        };
+        assert_eq!(line(None, with), None, "no spell record");
+        assert_eq!(line(Some(&cat), FailArgs::default()), None, "no DBC loaded");
+        assert_eq!(line(Some(&empty_mask), with), None, "an empty stance mask");
+        assert_eq!(
+            line(Some(&unnamed), with),
+            None,
+            "a mask naming only unnamed rows"
+        );
+        // The control: the arm next door still strips rather than falling silent.
+        assert_eq!(
+            cast_fail_text(Caster::Player, 0x5C, None, FailArgs::default(), &g)
+                .unwrap()
+                .text,
+            "Missing reagent"
+        );
+    }
+
+    /// **The pet's `0x56` names ONE form** (`0x6e921a`; decision 2285 corrected 2280, which had
+    /// assumed the two casters produced the same line). `0x6e9282: jne 0x6e929a` leaves the loop
+    /// at the first non-empty name — a break, not a continue, and the earned negative is that the
+    /// whole pet handler contains no `SStrCat` and no reference to the separator.
+    ///
+    /// The single-form case is asserted beside it deliberately: it is where the two agree, and a
+    /// test written only on that case is exactly how the wrong claim passed its own test.
+    #[test]
+    fn the_pets_only_shapeshift_names_the_first_form_and_never_joins() {
+        let m = gs();
+        let g = getter(&m);
+        let forms = forms([(1, "Cat Form"), (5, "Bear Form"), (8, "Dire Bear Form")]);
+        let text = |caster, stances: u32| {
+            let d = SpellDisplay {
+                stances,
+                ..Default::default()
+            };
+            cast_fail_text(
+                caster,
+                0x56,
+                Some(&d),
+                FailArgs {
+                    forms: Some(&forms),
+                    ..FailArgs::default()
+                },
+                &g,
+            )
+            .map(|l| l.text)
+        };
+        // Maul's mask: the player joins, the pet stops at the first.
+        assert_eq!(
+            text(Caster::Player, 0x90).as_deref(),
+            Some("Must be in Bear Form, Dire Bear Form")
+        );
+        assert_eq!(
+            text(Caster::Pet, 0x90).as_deref(),
+            Some("Must be in Bear Form")
+        );
+        // One form: the two agree, and the surface is the same despite the different errorId.
+        assert_eq!(text(Caster::Player, 0x1), text(Caster::Pet, 0x1));
+        assert_eq!(
+            text(Caster::Pet, 0x1).as_deref(),
+            Some("Must be in Cat Form")
+        );
+        // Nothing to name is silence on both handlers, by two different routes.
+        assert_eq!(text(Caster::Pet, 0x0), None);
+    }
+
+    /// **The combat log reads the reference's OTHER buffer** ([`CastFailLine::logged`] —
+    /// `edi` at `0x6e21e2`), which decision 2285 exists to correct. Four classes, and the whole
+    /// point is that "log what the red line said" and "re-derive from the key table" each get
+    /// some of them wrong.
+    #[test]
+    fn the_combat_log_reads_the_argtext_buffer_not_the_displayed_line() {
+        let m = gs();
+        let g = getter(&m);
+        let line = |reason, spell| {
+            cast_fail_text(Caster::Player, reason, spell, FailArgs::default(), &g).expect("a line")
+        };
+
+        // 1b · an errorId override with NO argument arm: `edi` never moved off the first-layer
+        // buffer, so the screen and the log disagree. This is the row 2280 got wrong.
+        let plain = spell(0, 0, 0);
+        let cooldown = line(0x3C, Some(&plain));
+        assert_eq!(cooldown.text, "Spell is not ready yet.");
+        assert_eq!(cooldown.logged(), "Not yet recovered");
+
+        let no_target = line(0x09, None);
+        assert_eq!(no_target.text, "You have no target.");
+        assert_eq!(no_target.logged(), "No target");
+
+        let unsheathed = line(0x41, None);
+        assert_eq!(unsheathed.text, "You have to be unsheathed to do that!");
+        assert_eq!(unsheathed.logged(), "You must be unsheathed");
+
+        // 1a · no override, no arm: one string in both buffers.
+        let ammo = line(0x43, None);
+        assert_eq!(ammo.logged(), ammo.text);
+
+        // 4 · `0x4d` BLANKS the buffer (`0x6e20fd`), so the log falls through to the last-error
+        // cell and reads the screen's wording — the override whose two surfaces agree.
+        let rage = spell(1, 0, 0);
+        let power = line(0x4D, Some(&rage));
+        assert_eq!(power.text, "Not enough rage");
+        assert_eq!(power.logged(), "Not enough rage");
+
+        // A declined arm strips in BOTH buffers — never a raw token in the log either.
+        let reagents = line(0x5C, None);
+        assert_eq!(reagents.logged(), "Missing reagent");
+        assert!(!reagents.logged().contains('%'));
+    }
+
+    /// The `0x02` arm (`0x6e211f`) copies only the localized power NOUN into the argText buffer,
+    /// so the screen reads a sentence and the log reads one word. The reference's own quirk, and
+    /// the one row where a "the log says what the screen says" model is visibly wrong.
+    #[test]
+    fn already_at_full_power_logs_the_bare_power_noun() {
+        let mut m = gs();
+        m.insert(
+            "ERR_SPELL_FAILED_ALREADY_AT_FULL_POWER_S",
+            "You are already at full %s.",
+        );
+        m.insert("RAGE", "Rage");
+        let g = getter(&m);
+        let rage = spell(1, 0, 0);
+        let line =
+            cast_fail_text(Caster::Player, 0x02, Some(&rage), FailArgs::default(), &g).unwrap();
+        assert_eq!(line.text, "You are already at full Rage.");
+        assert_eq!(line.logged(), "Rage");
+    }
+
+    fn forms<const N: usize>(
+        rows: [(u32, &str); N],
+    ) -> HashMap<u32, benilla_formats::ShapeshiftForm> {
+        rows.into_iter()
+            .map(|(id, name)| {
+                (
+                    id,
+                    benilla_formats::ShapeshiftForm {
+                        name: name.to_string(),
+                        ..Default::default()
+                    },
+                )
+            })
+            .collect()
+    }
+
     fn getter<'a>(
         map: &'a HashMap<&'static str, &'static str>,
     ) -> impl Fn(&str) -> Option<String> + 'a {
@@ -945,11 +1354,14 @@ mod tests {
         let areas = benilla_formats::load_area_table_catalog(&mut chain).expect("AreaTable");
         let mechanics =
             benilla_formats::load_spell_mechanic_catalog(&mut chain).expect("SpellMechanic");
+        let forms =
+            benilla_formats::load_shapeshift_forms(&mut chain).expect("SpellShapeshiftForm.dbc");
         let args = |arg: u32| FailArgs {
             arg: Some(arg),
             focus: Some(&focus),
             areas: Some(&areas),
             mechanics: Some(&mechanics),
+            forms: Some(&forms),
         };
         // **0x8d PREVENTED_BY_MECHANIC** (decision 1948) — the crowd-control ladder's renamed
         // refusal, and the one argument arm whose word is produced locally rather than read off
@@ -1008,6 +1420,51 @@ mod tests {
                 .text,
             "You need to be in"
         );
+        // **0x56 ONLY_SHAPESHIFT on the real chain — the reported defect** (decision 2280): the
+        // real `Spell.dbc` `Stances` column, the real `SpellShapeshiftForm.dbc` names and the
+        // real `"Must be in %s"`. Prowl in bear form is the report; Maul is the multi-form join,
+        // which a single-bit test could not tell apart from "name the lowest bit".
+        let catalog = benilla_formats::load_spell_catalog(&mut chain).expect("Spell.dbc");
+        let shifted = |spell_id: u32| {
+            let d = catalog.get(spell_id).expect("a shipped spell");
+            cast_fail_text(
+                Caster::Player,
+                0x56,
+                Some(d),
+                FailArgs {
+                    forms: Some(&forms),
+                    ..FailArgs::default()
+                },
+                &g,
+            )
+            .map(|l| l.text)
+        };
+        // Prowl, all three ranks — `Stances = 0x1`, the one the spellbook tooltip already read as
+        // "Requires Cat Form" while this line read the bare stem.
+        for prowl in [5215, 6783, 9913] {
+            assert_eq!(
+                shifted(prowl).as_deref(),
+                Some("Must be in Cat Form"),
+                "Prowl {prowl}"
+            );
+        }
+        assert_eq!(
+            shifted(6807).as_deref(),
+            Some("Must be in Bear Form, Dire Bear Form"),
+            "Maul's 0x90 names both bear rows, in mask order"
+        );
+        assert_eq!(
+            shifted(1715).as_deref(),
+            Some("Must be in Battle Stance, Berserker Stance"),
+            "Hamstring's 0x50000 skips the Defensive row between them"
+        );
+        // A spell with no stance requirement reaches the epilogue, not the stem.
+        assert_eq!(
+            shifted(22812),
+            None,
+            "Barkskin carries an empty Stances mask"
+        );
+
         // 0x5e alone has a client-side stand-in: the failing spell's own `RequiresSpellFocus`
         // column is the very number the server copied onto the wire, so an absent word still
         // fills. (Spell 4976 "Filling" — the Crystal Phial's — carries focus 11.)
diff --git a/crates/benilla-app/src/ui_action/cast_send.rs b/crates/benilla-app/src/ui_action/cast_send.rs
index 04cef4d5..39bacc0f 100644
--- a/crates/benilla-app/src/ui_action/cast_send.rs
+++ b/crates/benilla-app/src/ui_action/cast_send.rs
@@ -96,12 +96,15 @@ pub(crate) struct CastLadder<'w, 's> {
     pub(crate) spells: Option<Res<'w, Spells>>,
     /// The item cache — the pre-send totem/reagent check reads it (decision 0552), and the item
     /// arms resolve templates through it.
-    pub(crate) items: ResMut<'w, Items>,
+    pub(crate) items: Res<'w, Items>,
     pub(crate) sheath: MessageWriter<'w, crate::creature_anim::SheathRequest>,
     pub(crate) ecs: Commands<'w, 's>,
     pub(crate) pending: ResMut<'w, crate::ui_cast::PendingCast>,
     pub(crate) queued_melee: ResMut<'w, crate::ui_cast::QueuedMeleeSpell>,
     pub(crate) cooldowns: ResMut<'w, crate::cooldowns::Cooldowns>,
+    /// The talent spell-modifier tables — rung 2's cost goes through them
+    /// ([`super::usable::power_cost`]).
+    pub(crate) spell_mods: Res<'w, crate::spell_mods::SpellModifiers>,
     pub(crate) cast_errors: ResMut<'w, CastErrors>,
     pub(crate) auto_repeat: ResMut<'w, AutoRepeatActive>,
     pub(crate) trade_skill_opens: ResMut<'w, crate::ui_tradeskill::TradeSkillOpens>,
@@ -242,6 +245,7 @@ impl CastLadder<'_, '_> {
             &mut self.pending,
             &mut self.queued_melee,
             &mut self.cooldowns,
+            &self.spell_mods,
             &mut self.cast_errors,
             &mut self.auto_repeat,
             &mut self.trade_skill_opens,
@@ -265,7 +269,6 @@ impl CastLadder<'_, '_> {
 /// source while one is already in flight, so mashing a key can no longer fire a duplicate
 /// `CMSG_CAST_SPELL` the server bounces back as a spurious cast-bar cancel. Ranged/auto-repeat
 /// shots keep their own lifecycle — they never arm the guard and are never blocked by it.
-#[allow(clippy::too_many_arguments)] // every input the follow-through + the send itself need
 fn send_spell_cast(
     spell_id: u32,
     ctx: &cast_target::CastContext,
@@ -283,6 +286,7 @@ fn send_spell_cast(
     pending: &mut crate::ui_cast::PendingCast,
     queued_melee: &mut crate::ui_cast::QueuedMeleeSpell,
     cooldowns: &mut crate::cooldowns::Cooldowns,
+    spell_mods: &crate::spell_mods::SpellModifiers,
     cast_errors: &mut CastErrors,
     auto_repeat: &mut AutoRepeatActive,
     trade_skill_opens: &mut crate::ui_tradeskill::TradeSkillOpens,
@@ -521,7 +525,7 @@ fn send_spell_cast(
     // rage-starved spam press (the 0946 campaign's live capture of the loop).
     if !commit.is_item() {
         if let (Some(d), Some(store)) = (def, ctx.rel.self_store) {
-            if !super::usable::can_afford(d, store) {
+            if !super::usable::can_afford(d, store, spell_mods) {
                 debug!("ui_action: cast {spell_id} refused locally — not enough power (0x4d)");
                 cast_errors.push_local(spell_id, 0x4d);
                 return;
@@ -861,6 +865,7 @@ mod tests {
         world.init_resource::<crate::ui_cast::PendingCast>();
         world.init_resource::<crate::ui_cast::QueuedMeleeSpell>();
         world.init_resource::<crate::cooldowns::Cooldowns>();
+        world.init_resource::<crate::spell_mods::SpellModifiers>();
         world.init_resource::<CastErrors>();
         world.init_resource::<AutoRepeatActive>();
         world.init_resource::<crate::ui_tradeskill::TradeSkillOpens>();
diff --git a/crates/benilla-app/src/ui_action/drain.rs b/crates/benilla-app/src/ui_action/drain.rs
index bb884333..a8d6a5b7 100644
--- a/crates/benilla-app/src/ui_action/drain.rs
+++ b/crates/benilla-app/src/ui_action/drain.rs
@@ -416,7 +416,7 @@ pub(super) fn drain_action_uses(
                     crate::ui_items::send_auto_equip(
                         &mut script,
                         &mut gate,
-                        &mut ladder.items,
+                        &ladder.items,
                         &ladder.commands,
                         bag_index,
                         slot0,
diff --git a/crates/benilla-app/src/ui_action/drop_item.rs b/crates/benilla-app/src/ui_action/drop_item.rs
index 3c1492ef..f60ca8b1 100644
--- a/crates/benilla-app/src/ui_action/drop_item.rs
+++ b/crates/benilla-app/src/ui_action/drop_item.rs
@@ -65,7 +65,6 @@ fn feedable_pet(
 ///
 /// One law, one place: whichever entry it came from, the ask runs the same three gates and the same
 /// commit.
-#[allow(clippy::too_many_arguments)]
 pub(crate) fn drop_item_on_unit(
     script: Option<NonSendMut<UiScript>>,
     self_q: Query<(&crate::net::Guid, &crate::net::ObjectStore), With<crate::net::SelfPlayer>>,
diff --git a/crates/benilla-app/src/ui_action/errors.rs b/crates/benilla-app/src/ui_action/errors.rs
index f62ea8f1..f04cd745 100644
--- a/crates/benilla-app/src/ui_action/errors.rs
+++ b/crates/benilla-app/src/ui_action/errors.rs
@@ -60,6 +60,17 @@ pub(crate) struct CastFail {
     /// **Whose** refusal this is — which decides which of the reference's two message tables
     /// resolves it. See [`Caster`].
     pub caster: Caster,
+    /// **This entry is a REDISPLAY** — it was queued once already, declined for want of an item
+    /// template, and is being resolved now that the template landed (the `0x78`/`0x5c`/`0x84`
+    /// cache-miss path, decisions 0545 + 0552).
+    ///
+    /// It exists because the reference's two attempts do not raise the same things (decision
+    /// 2285). The first pass bails at `0x6e1eab`/`0x6e1efc` to the epilogue `0x6e224f`, which is
+    /// past the red line AND past the combat-log formatter; the retry is the DBCACHECALLBACK
+    /// `0x6e29b0`, which calls `CGGameUI::DisplayError 0x496720` **directly** and never reaches
+    /// `0x62c360`. So a reagent refusal that had to wait for its item name shows the toast and is
+    /// never written to the log — where one that resolved first try is written to both.
+    pub redisplay: bool,
 }
 
 /// Who failed to cast — the one input that picks between the reference's **two** cast-failure
@@ -94,6 +105,16 @@ impl CastFail {
             reason,
             arg: None,
             caster: Caster::Player,
+            redisplay: false,
+        }
+    }
+
+    /// The same entry, re-queued for the frame its item template lands on — see
+    /// [`Self::redisplay`].
+    pub(crate) const fn requeued(self) -> Self {
+        Self {
+            redisplay: true,
+            ..self
         }
     }
 }
@@ -112,6 +133,7 @@ impl CastErrors {
             reason,
             arg: Some(arg),
             caster: Caster::Player,
+            redisplay: false,
         });
     }
 
@@ -126,6 +148,7 @@ impl CastErrors {
             reason,
             arg: None,
             caster: Caster::Pet,
+            redisplay: false,
         });
     }
 }
diff --git a/crates/benilla-app/src/ui_action/feed.rs b/crates/benilla-app/src/ui_action/feed.rs
index 109fb9c3..55113e79 100644
--- a/crates/benilla-app/src/ui_action/feed.rs
+++ b/crates/benilla-app/src/ui_action/feed.rs
@@ -79,6 +79,9 @@ pub(super) struct FeedMemory {
 /// `Option<Res<…>>` that are one concept and were pushing this system past Bevy's parameter arity
 /// (decision 1948). Each is `Option` for the same reason `FailArgs`' fields are: a client with no
 /// game data has none, and the arm then declines and the template strips.
+///
+/// The fourth table, `SpellShapeshiftForm.dbc` (`0x56`), is not here: it already rides
+/// [`Spells`], which this system takes anyway, so [`Self::args`] takes that and joins them.
 #[derive(bevy::ecs::system::SystemParam)]
 pub(super) struct FailNameTables<'w> {
     /// `SpellFocusObject.dbc` — the crafting book's catalog, for `0x5e`.
@@ -90,17 +93,17 @@ pub(super) struct FailNameTables<'w> {
 }
 
 impl FailNameTables<'_> {
-    fn args(&self) -> cast_fail::FailArgs<'_> {
+    fn args<'a>(&'a self, spells: Option<&'a Spells>) -> cast_fail::FailArgs<'a> {
         cast_fail::FailArgs {
             arg: None,
             focus: self.focus.as_deref().map(|f| &f.catalog),
             areas: self.areas.as_deref().map(|a| &a.0),
             mechanics: self.mechanics.as_deref().map(|m| &m.catalog),
+            forms: spells.map(|s| &s.forms),
         }
     }
 }
 
-#[allow(clippy::too_many_arguments)] // a Bevy system's full input set
 pub(super) fn feed_actions(
     script: Option<NonSendMut<UiScript>>,
     mut actions: ResMut<PlayerActions>,
@@ -111,7 +114,7 @@ pub(super) fn feed_actions(
     mut ui_error_texts: ResMut<UiErrorTexts>,
     spells: Option<Res<Spells>>,
     self_q: Query<&ObjectStore, With<SelfPlayer>>,
-    mut items: ResMut<Items>,
+    items: Res<Items>,
     icons: Option<Res<ItemDisplays>>,
     sub_classes: Option<Res<crate::ui_items::ItemSubClasses>>,
     name_tables: FailNameTables,
@@ -141,11 +144,11 @@ pub(super) fn feed_actions(
     let self_store = self_q.iter().next();
     let mut await_template: Vec<crate::ui_action::CastFail> = Vec::new();
     // The same failures, worded for the combat log. Collected beside the red line rather than
-    // instead of it: `0x6e1a00` calls `0x62c360` AND `DisplayError`, and they say different
-    // things — "Not enough mana." on the screen, "You fail to cast Frostbolt: Not enough mana."
+    // instead of it: `0x6e1a00` calls `0x62c360` AND `DisplayError`, which frame the one string
+    // two ways — "Not enough mana." on the screen, "You fail to cast Frostbolt: Not enough mana."
     // in the log.
     let mut fail_lines: Vec<crate::ui_chat::combat::PendingCombat> = Vec::new();
-    let fail_args = name_tables.args();
+    let fail_args = name_tables.args(spells.as_deref());
     let texts: Vec<cast_fail::CastFailLine> = cast_errors
         .0
         .drain(..)
@@ -159,82 +162,166 @@ pub(super) fn feed_actions(
             let pet = caster == crate::ui_action::Caster::Pet;
             let d = spells.as_ref().and_then(|s| s.catalog.get(spell_id));
             let get = |key: &str| script.lua().globals().get::<String>(key).ok();
-            // 0x19/0x1a/0x1b EQUIPPED_ITEM_CLASS* — the other argument-formatted family whose
-            // `%s` benilla models (`0x6e1db7`, the arm that resolves an item class/subclass name
-            // through `0x6e2380`): "Must have a **Wand** equipped", the SINGULAR DisplayName,
-            // where the spell tooltip's own requirement line takes the verbose plural. Purely a
-            // DBC read, so no query/redisplay round trip. A multi-bit mask resolves too — through
-            // ItemSubClassMask.dbc's group name, else the FIRST matching subclass (law
-            // §3-EQUIPITEM; the tooltip's twin joins instead).
-            if let (0x19..=0x1b, Some(d), Some(subs)) = (reason, d, sub_classes.as_deref()) {
-                if let Some(name) = (d.equipped_item_class >= 0)
-                    .then(|| {
-                        subs.0.requirement_display_name(
-                            d.equipped_item_class as u32,
-                            d.equipped_item_subclass_mask,
-                        )
-                    })
-                    .flatten()
+            // The displayed line first, the log line off it — the reference's own order, and the
+            // reason the two can no longer drift apart (see the combat-log twin below).
+            let line = (|| -> Option<cast_fail::CastFailLine> {
+                // 0x19/0x1a/0x1b EQUIPPED_ITEM_CLASS* — the other argument-formatted family whose
+                // `%s` benilla models (`0x6e1db7`, the arm that resolves an item class/subclass name
+                // through `0x6e2380`): "Must have a **Wand** equipped", the SINGULAR DisplayName,
+                // where the spell tooltip's own requirement line takes the verbose plural. Purely a
+                // DBC read, so no query/redisplay round trip. A multi-bit mask resolves too — through
+                // ItemSubClassMask.dbc's group name, else the FIRST matching subclass (law
+                // §3-EQUIPITEM; the tooltip's twin joins instead).
+                if let (0x19..=0x1b, Some(d), Some(subs)) = (reason, d, sub_classes.as_deref()) {
+                    if let Some(name) = (d.equipped_item_class >= 0)
+                        .then(|| {
+                            subs.0.requirement_display_name(
+                                d.equipped_item_class as u32,
+                                d.equipped_item_subclass_mask,
+                            )
+                        })
+                        .flatten()
+                    {
+                        let key = cast_fail::CAST_FAIL_KEYS[reason as usize];
+                        return get(key)
+                            .filter(|s| !s.is_empty())
+                            .map(|t| cast_fail::CastFailLine::passthrough(t.replace("%s", &name)));
+                    }
+                }
+                // `0x31` NEED_EXOTIC_AMMO (`0x6e1e54`) — the same `0x6e2380` helper as the arm
+                // above, one class over: `requirement_display_name(6 /* Projectile */, 1 << arg)`
+                // reads the singular DisplayName at `row + 0x28 + locale*4`, so "Requires exotic
+                // ammo: %s" names the ammo type. The shift is masked to five bits because the
+                // reference's is — `0x6e1e5c: shl edx,cl` takes x86's own `cl & 31` — and a
+                // subclass naming no row declines to the strip fallback exactly as
+                // `0x6e1e6a: je 0x6e21d8` does.
+                //
+                // **The player's arm only.** The pet handler's index table (`0x6e93d0`) is gated
+                // `cmp reason,0x8d; ja default` and carries no `0x31` entry, so a pet's exotic-ammo
+                // refusal takes its generic arm `0x6e936a` and shows the bare template — unlike
+                // `0x19`–`0x1b` just above, which the pet's own table *does* fill (`0x6e904d`).
+                // Same shape as `0x78`/`0x5c` below, and the same trap decision 2033 named.
+                //
+                // **It declines on a vmangos server, every time**, and that is the server's shape
+                // rather than a gap here: `Spell::SendCastResult` fills `failureArg1` for
+                // NOT_READY, REQUIRES_SPELL_FOCUS, REQUIRES_AREA and the EQUIPPED_ITEM_CLASS
+                // family and for nothing else, so `0x31` arrives with no word and the line reads
+                // "Requires exotic ammo:". Modeled anyway because the arm is the mechanism and the
+                // word is the server's to supply (decision 2292).
+                if let (false, 0x31, Some(arg), Some(subs)) =
+                    (pet, reason, fail.arg, sub_classes.as_deref())
                 {
-                    let key = cast_fail::CAST_FAIL_KEYS[reason as usize];
+                    const ITEM_CLASS_PROJECTILE: u32 = 6;
+                    if let Some(name) = subs
+                        .0
+                        .requirement_display_name(ITEM_CLASS_PROJECTILE, 1u32 << (arg & 31))
+                    {
+                        let key = cast_fail::CAST_FAIL_KEYS[reason as usize];
+                        return get(key)
+                            .filter(|s| !s.is_empty())
+                            .map(|t| cast_fail::CastFailLine::passthrough(t.replace("%s", &name)));
+                    }
+                }
+                // `0x78` TOTEMS / `0x5c` REAGENTS — **the player's arms only**. The pet handler's
+                // index table (`0x6e93d0`) sends both to its generic arm, so a pet's refusal takes the
+                // shared passthrough below and never runs the bag walk or the item query (decision
+                // 2033).
+                if !pet && (reason == 0x78 || reason == 0x5c) {
+                    let d = d?;
+                    let failing = if reason == 0x78 {
+                        self_store
+                            .and_then(|s| first_missing_totem(d, s, &items))
+                            // No store to test against (a race): name the first tool at all.
+                            .or_else(|| d.totems.iter().copied().find(|&t| t != 0))
+                    } else {
+                        self_store
+                            .and_then(|s| first_short_reagent(d, s, &items))
+                            .or_else(|| d.reagents.iter().map(|&(id, _)| id).find(|&id| id != 0))
+                    }?;
+                    let cached = items
+                        .template(failing, 0, &commands)
+                        .map(|i| i.name.clone());
+                    let name = match cached {
+                        Some(name) => name,
+                        // Answered-unknown → the ref's callback fallback literal (`0x838044`);
+                        // still pending → keep the entry queued for the redisplay.
+                        None if items.template_answered_unknown(failing) => "UNKNOWN".to_string(),
+                        None => {
+                            // The cache-miss re-queue — and it comes back MARKED, because the
+                            // reference's retry is a different raise (see `CastFail::redisplay`).
+                            await_template.push(fail.requeued());
+                            return None;
+                        }
+                    };
+                    let key = if reason == 0x78 {
+                        "SPELL_FAILED_TOTEMS"
+                    } else {
+                        "SPELL_FAILED_REAGENTS"
+                    };
                     return get(key)
                         .filter(|s| !s.is_empty())
                         .map(|t| cast_fail::CastFailLine::passthrough(t.replace("%s", &name)));
                 }
-            }
-            // `0x78` TOTEMS / `0x5c` REAGENTS — **the player's arms only**. The pet handler's
-            // index table (`0x6e93d0`) sends both to its generic arm, so a pet's refusal takes the
-            // shared passthrough below and never runs the bag walk or the item query (decision
-            // 2033).
-            if !pet && (reason == 0x78 || reason == 0x5c) {
-                let d = d?;
-                let failing = if reason == 0x78 {
-                    self_store
-                        .and_then(|s| first_missing_totem(d, s, &items))
-                        // No store to test against (a race): name the first tool at all.
-                        .or_else(|| d.totems.iter().copied().find(|&t| t != 0))
-                } else {
-                    self_store
-                        .and_then(|s| first_short_reagent(d, s, &items))
-                        .or_else(|| d.reagents.iter().map(|&(id, _)| id).find(|&id| id != 0))
-                }?;
-                let cached = items
-                    .template(failing, 0, &commands)
-                    .map(|i| i.name.clone());
-                let name = match cached {
-                    Some(name) => name,
-                    // Answered-unknown → the ref's callback fallback literal (`0x838044`);
-                    // still pending → keep the entry queued for the redisplay.
-                    None if items.template_answered_unknown(failing) => "UNKNOWN".to_string(),
-                    None => {
-                        await_template.push(fail);
-                        return None;
-                    }
-                };
-                let key = if reason == 0x78 {
-                    "SPELL_FAILED_TOTEMS"
-                } else {
-                    "SPELL_FAILED_REAGENTS"
-                };
-                return get(key)
-                    .filter(|s| !s.is_empty())
-                    .map(|t| cast_fail::CastFailLine::passthrough(t.replace("%s", &name)));
-            }
-            // The combat-log twin. **Only the `…SELF` half is reachable here**: `SMSG_CAST_FAILED`
-            // is addressed to the caster alone, so benilla never learns that somebody *else's*
-            // cast failed — the `…OTHER` keys exist and stay unproduced, exactly as the reference
-            // leaves its own two unreachable `…SELFSTART` keys.
+                cast_fail::cast_fail_text(
+                    caster,
+                    reason,
+                    d,
+                    cast_fail::FailArgs {
+                        arg: fail.arg,
+                        ..fail_args
+                    },
+                    &get,
+                )
+            })();
+            // The retest instrument for this whole bug class (decision 1313). A red-line defect is
+            // reported as *seen* — B255 arrived as a screenshot of the word "Requires" — and until
+            // this line the only way to read what the client resolved was to look at the screen.
+            // Logging the reason, its wire argument and the resolved line makes an argument arm
+            // that silently declined (a missing word, an unnamed id) legible from a probe run.
+            // The line's `Debug` carries BOTH buffers, so a probe also reads the toast string
+            // beside the log string — the one reading that makes 2285's class of drift visible
+            // without opening the chat window.
+            debug!(
+                "ui_action: cast fail — {caster:?} spell {spell_id} reason {reason:#04x} \
+                 arg {:?} → {:?}",
+                fail.arg, line
+            );
+            // **The combat-log twin — the reference's OTHER buffer, not the displayed text**
+            // (decision 2285, correcting 2280). It runs after the resolution because the
+            // reference's does: `0x6e1a00` calls `DisplayError 0x496720` at `0x6e21dd` and the
+            // log formatter `0x62c360` at `0x6e21fc`. But what it hands the formatter is `edi`
+            // (`0x6e21e2`), the **argText** buffer — which is the first-layer
+            // `SPELL_FAILED_<name>` string for every reason no argument arm claims, *including*
+            // the eighteen the second layer re-words on screen. A cooldown refusal toasts "Spell
+            // is not ready yet." and logs "Not yet recovered"; `0x09` toasts "You have no target."
+            // and logs "No target". [`CastFailLine::logged`] is that one-byte test.
+            //
+            // The trap this corrects is that deriving the log's `%s` a *second* time, from the
+            // key table, gets six of the seven divergent rows right by accident and the filled
+            // arms wrong — which is how a raw "Must be in %s" sat in the log while the red line
+            // read "Must be in Cat Form". One resolution, two buffers, is the shape that holds.
+            //
+            // A refusal that resolved to nothing logs nothing, which is the same control flow:
+            // `0x17` DONT_REPORT, the keys 5875 leaves out of `GlobalStrings.lua`, and `0x56`'s
+            // no-forms exit all jump past `0x62c360` as well as past `DisplayError`.
+            //
+            // **A redisplay is not a raise.** The item-cache retry (`0x6e29b0`) calls
+            // `DisplayError` directly and never reaches the log formatter, so an entry that had
+            // to wait for its item name shows the toast alone — `CastFail::redisplay`.
+            //
+            // **Only the `…SELF` half is reachable here**: `SMSG_CAST_FAILED` is addressed to the
+            // caster alone, so benilla never learns that somebody *else's* cast failed — the
+            // `…OTHER` keys exist and stay unproduced, exactly as the reference leaves its own
+            // two unreachable `…SELFSTART` keys.
             //
-            // The reason `%s` is the FIRST-layer string — `GetText("SPELL_FAILED_<name>")`, which
-            // is what `0x6e1a00` holds when it calls the formatter — not the errorId-substituted
-            // message the red line shows. An empty one drops the line rather than printing a
-            // sentence with a hole, the same rule every other family here follows.
             // **The pet's refusal is not logged.** `0x6e1a00` calls the log formatter `0x62c360`
             // beside its `DisplayError`; `Spell_C::HandlePetCastFailed 0x6e8eb0` calls neither it
             // nor the error sound — its entire call set is the two packet readers, `0x496720` and
             // the string plumbing. Before decision 2033 a pet's refused Growl printed "You fail to
             // cast Growl: ..." in the combat log, attributed to the player.
-            if let (Some(display), false) = (d, pet) {
+            if let (Some(shown), Some(display), false, false) =
+                (line.as_ref(), d, pet, fail.redisplay)
+            {
                 // `0x62aff0`: `Attributes` bit 4 marks an ABILITY, which "performs" rather than
                 // "casts".
                 const ATTR_IS_ABILITY: u32 = 0x10;
@@ -243,11 +330,7 @@ pub(super) fn feed_actions(
                 } else {
                     crate::ui_chat::combat::SPELLFAILCAST
                 };
-                let why = cast_fail::CAST_FAIL_KEYS
-                    .get(usize::from(reason))
-                    .and_then(|k| get(k))
-                    .filter(|t| !t.is_empty());
-                if let (Some(why), false) = (why, display.name.is_empty()) {
+                if !display.name.is_empty() {
                     fail_lines.push(crate::ui_chat::combat::PendingCombat {
                         kind: crate::ui_chat::ChatEventKind::SpellFailedLocalPlayer,
                         family,
@@ -256,7 +339,7 @@ pub(super) fn feed_actions(
                         object: 0,
                         fills: crate::ui_chat::combat::Fills {
                             spell: display.name.clone(),
-                            named: why,
+                            named: shown.logged().to_string(),
                             ..Default::default()
                         },
                         named: crate::ui_chat::combat::Named::Ready,
@@ -264,27 +347,7 @@ pub(super) fn feed_actions(
                     });
                 }
             }
-            let text = cast_fail::cast_fail_text(
-                caster,
-                reason,
-                d,
-                cast_fail::FailArgs {
-                    arg: fail.arg,
-                    ..fail_args
-                },
-                &get,
-            );
-            // The retest instrument for this whole bug class (decision 1313). A red-line defect is
-            // reported as *seen* — B255 arrived as a screenshot of the word "Requires" — and until
-            // this line the only way to read what the client resolved was to look at the screen.
-            // Logging the reason, its wire argument and the resolved text makes an argument arm
-            // that silently declined (a missing word, an unnamed id) legible from a probe run.
-            debug!(
-                "ui_action: cast fail — {caster:?} spell {spell_id} reason {reason:#04x} \
-                 arg {:?} → {:?}",
-                fail.arg, text
-            );
-            text
+            line
         })
         .collect();
     cast_errors.0.extend(await_template);
@@ -427,7 +490,7 @@ pub(super) fn feed_actions(
                             d,
                             sp,
                             store,
-                            &mut items,
+                            &items,
                             icons.as_deref(),
                             &commands,
                         )
@@ -555,7 +618,7 @@ pub(super) fn feed_actions(
                                 d,
                                 sp,
                                 Some(store),
-                                &mut items,
+                                &items,
                                 icons.as_deref(),
                                 &commands,
                             );
@@ -600,13 +663,12 @@ pub(super) fn feed_actions(
 /// The spellbook's `GetSpellTexture` (`0x4b3f50`) deliberately runs ONLY arms 1 and 3 — it never
 /// serves `ActiveIconID` (proof by exhaustion in the note). `ui_spellbook` keeps that asymmetry;
 /// do not "fix" it to match the bar.
-#[allow(clippy::too_many_arguments)] // the resolver's full input set, twice-called above
 fn spell_action_icon(
     spell_id: u32,
     d: &benilla_formats::SpellDisplay,
     spells: &super::Spells,
     store: Option<&crate::net::ObjectStore>,
-    items: &mut Items,
+    items: &Items,
     icons: Option<&ItemDisplays>,
     commands: &NetCommands,
 ) -> Option<String> {
diff --git a/crates/benilla-app/src/ui_action/feed_tests.rs b/crates/benilla-app/src/ui_action/feed_tests.rs
index 9767afc5..3d953600 100644
--- a/crates/benilla-app/src/ui_action/feed_tests.rs
+++ b/crates/benilla-app/src/ui_action/feed_tests.rs
@@ -506,6 +506,7 @@ fn a_pets_refused_cast_writes_no_combat_log_line() {
         reason: 0x5F,
         arg: None,
         caster: Caster::Player,
+        redisplay: false,
     });
     errors.push_pet(GROWL, 0x5F);
 
diff --git a/crates/benilla-app/src/ui_action/mod.rs b/crates/benilla-app/src/ui_action/mod.rs
index 7235ffba..256dd71e 100644
--- a/crates/benilla-app/src/ui_action/mod.rs
+++ b/crates/benilla-app/src/ui_action/mod.rs
@@ -65,6 +65,13 @@ pub(crate) struct CooldownEvents;
 // `cast_send`, so a second send path cannot be written by accident (decision 0914).
 pub(crate) use cast_send::{CastCommit, CastLadder};
 pub(crate) use cast_target::AutoSelfCast;
+
+/// `autoSelfCast`'s change callback (decision 2303): a flag.
+pub(crate) fn on_cvar(ev: On<crate::cvars::CvarChanged>, mut auto: ResMut<AutoSelfCast>) {
+    if ev.is("autoSelfCast") {
+        auto.0 = ev.flag();
+    }
+}
 pub(crate) use errors::{
     attack_actor_blocked, attack_actor_refusal, keyed_line, keyed_line_s, reagent_totem_refusal,
     show_messages, ui_error_text, CastErrors, CastFail, Caster, FillArg, MessageSink, MountErrors,
@@ -211,9 +218,10 @@ impl Spells {
     /// `wave-cooldown.md`/`moving-cast-gate.md`, byte-verified): `CastingTimeIndex` resolves the
     /// [`Self::cast_times`] row, `base + perLevel·(casterLevel − baseLevel)` floors to the
     /// row's minimum (row 1, the all-zero instant sentinel, resolves 0). The level term keys on
-    /// the `SpellRec+0x70` column ([`SpellDisplay::base_level`]); spellmod op `0xa`
-    /// (SPELLMOD_CASTING_TIME) is unmodeled — benilla has no spellmod system — a named
-    /// micro-divergence (a talent-shortened 0-second cast doesn't exist in the 1.12 data).
+    /// the `SpellRec+0x70` column ([`SpellDisplay::base_level`]). Spell-mod op `0xa`
+    /// (SPELLMOD_CASTING_TIME) is still unread here — the tables themselves are live
+    /// ([`crate::spell_mods`]), only this consumer is not wired to them, so a talent-shortened
+    /// cast still shows its untalented length.
     /// A missing row reads 0 (instant), like a failed catalog load everywhere else.
     pub(crate) fn cast_time_ms(
         &self,
@@ -356,6 +364,7 @@ pub(crate) struct UiActionPlugin;
 
 impl Plugin for UiActionPlugin {
     fn build(&self, app: &mut App) {
+        app.add_observer(on_cvar);
         app.init_resource::<PlayerActions>()
             .init_resource::<LearnedAbilities>()
             .init_resource::<CastErrors>()
@@ -388,12 +397,11 @@ impl Plugin for UiActionPlugin {
                     ranks::normalize_action_ranks
                         .in_set(UnitFeed)
                         .before(feed::feed_actions),
-                    feed::feed_actions.in_set(UnitFeed).before(UiInput),
+                    feed::feed_actions.in_set(UnitFeed),
                     state::feed_action_state
                         .in_set(UnitFeed)
                         .in_set(CooldownEvents)
-                        .after(feed::feed_actions)
-                        .before(UiInput),
+                        .after(feed::feed_actions),
                     drain::drain_action_sets.after(UiInput),
                     drain::drain_action_uses.after(UiInput),
                     // The T binding (0997): the attack arm's twin door, after the dispatch wrote
@@ -421,9 +429,7 @@ impl Plugin for UiActionPlugin {
                     // the next frame's cursor drive reads the mode. The cursor pre-empt, the
                     // right-press cancel, and the click commit register in the TARGET chain
                     // (ordering against the classifier and the select click is theirs to own).
-                    targeting::feed_targeting_to_vm
-                        .in_set(UnitFeed)
-                        .before(UiInput),
+                    targeting::feed_targeting_to_vm.in_set(UnitFeed),
                     targeting::drain_stop_targeting.after(UiInput),
                     // The item half's commit (decision 0923) — the bag / paper-doll click seam's
                     // `0x495d60`. A UI drain like the others: after the input pass, so a click
diff --git a/crates/benilla-app/src/ui_action/state.rs b/crates/benilla-app/src/ui_action/state.rs
index e5245eed..088f7d33 100644
--- a/crates/benilla-app/src/ui_action/state.rs
+++ b/crates/benilla-app/src/ui_action/state.rs
@@ -384,7 +384,7 @@ fn resolve_through_macro(
 }
 
 /// Compute + diff-push every occupied slot's dynamic state, and fire the reference event edges.
-#[allow(clippy::too_many_arguments, clippy::type_complexity)] // a Bevy system's full input set
+#[allow(clippy::type_complexity)] // a Bevy system's full input set
 pub(super) fn feed_action_state(
     script: Option<NonSendMut<UiScript>>,
     actions: Res<PlayerActions>,
@@ -395,13 +395,15 @@ pub(super) fn feed_action_state(
     // One tuple param (Bevy's 16-SystemParam ceiling): our own cast tracking — the in-flight
     // guard, the queued on-next-swing strike, the running channel, and the awaiting-click
     // ground targeting — plus the macro→spell binding the MACRO arm resolves through
-    // (decision 0983), which rides here for the same ceiling reason.
+    // (decision 0983) and the talent spell-modifier tables that leg 12's cost reads through,
+    // both of which ride here for the same ceiling reason.
     cast_state: (
         Res<crate::ui_cast::PendingCast>,
         Res<crate::ui_cast::QueuedMeleeSpell>,
         Res<crate::ui_cast::ActiveChannel>,
         Res<super::SpellTargeting>,
         Res<crate::ui_macro::MacroBoundSpells>,
+        Res<crate::spell_mods::SpellModifiers>,
     ),
     self_q: Query<(&ObjectStore, &Transform, Has<Engaged>, Option<&Casting>), With<SelfPlayer>>,
     selection: Res<Selection>,
@@ -409,7 +411,7 @@ pub(super) fn feed_action_state(
     units: Query<(&ObjectStore, &Transform), Without<SelfPlayer>>,
     factions: Option<Res<crate::target::Factions>>,
     reputations: Res<crate::net::Reputations>,
-    mut items: ResMut<Items>,
+    items: Res<Items>,
     commands: Res<NetCommands>,
     mut memory: Local<crate::ui_script::VmMemo<StateMemory>>,
 ) {
@@ -434,7 +436,7 @@ pub(super) fn feed_action_state(
         memory.last_cd_trace = Some(now);
     }
 
-    let (pending, queued_melee, channel, targeting, bound) = &cast_state;
+    let (pending, queued_melee, channel, targeting, bound, spell_mods) = &cast_state;
     let me = self_q.iter().next();
     // The bags, walked ONCE for the frame: every reagent, totem and item-count question below
     // reads this table. It used to be one whole walk per question — per reagent per spell slot,
@@ -531,9 +533,10 @@ pub(super) fn feed_action_state(
                         reputations: &reputations,
                         cooldowns: &cooldowns,
                         carried: &carried,
+                        spell_mods,
                     };
                     let (u, oom) =
-                        usable::spell_usable(button.action, d, sp, &ctx, &mut items, &commands);
+                        usable::spell_usable(button.action, d, sp, &ctx, &items, &commands);
                     st.usable = u;
                     st.not_enough_mana = oom;
                 } else {
@@ -596,6 +599,7 @@ pub(super) fn feed_action_state(
                         reputations: &reputations,
                         cooldowns: &cooldowns,
                         carried: &carried,
+                        spell_mods,
                     };
                     let (u, oom) = usable::item_usable(
                         button.action,
@@ -603,7 +607,7 @@ pub(super) fn feed_action_state(
                         count > 0 || st.equipped,
                         &ctx,
                         spells.as_deref(),
-                        &mut items,
+                        &items,
                         &commands,
                     );
                     st.usable = u;
@@ -842,6 +846,7 @@ mod tests {
         app.insert_resource(actions)
             .insert_resource(bound)
             .init_resource::<Cooldowns>()
+            .init_resource::<crate::spell_mods::SpellModifiers>()
             .init_resource::<crate::ui_script::UiClock>()
             .init_resource::<AutoRepeatActive>()
             .init_resource::<crate::ui_cast::PendingCast>()
@@ -946,6 +951,7 @@ mod tests {
                     radii: Default::default(),
                 })
                 .init_resource::<Cooldowns>()
+                .init_resource::<crate::spell_mods::SpellModifiers>()
                 .init_resource::<crate::ui_script::UiClock>()
                 .init_resource::<AutoRepeatActive>()
                 .init_resource::<crate::ui_cast::PendingCast>()
diff --git a/crates/benilla-app/src/ui_action/targeting/cursor.rs b/crates/benilla-app/src/ui_action/targeting/cursor.rs
index 49e54256..24f06b1b 100644
--- a/crates/benilla-app/src/ui_action/targeting/cursor.rs
+++ b/crates/benilla-app/src/ui_action/targeting/cursor.rs
@@ -45,8 +45,9 @@ fn range_row(spells: Option<&Spells>, spell_id: u32) -> Option<&SpellRange> {
 /// radius: per-effect `radius + casterLevel × perLevel` over **EffectRadiusIndex[0] and [1]
 /// only** (slot 2 is never read by the client), the max with candidate 1 winning ties/NaN,
 /// clamped to 20.0 (`0x4820f0`'s `[0x804478]` literal — `min`, NaN → 20). `0.0` = no radius
-/// rows; the reticle then draws at its literal default size. Class-6 spell modifiers are
-/// unmodelled (the 0792 residual, same as the range gate).
+/// rows; the reticle then draws at its literal default size. Spell-mod op 6 (SPELLMOD_RADIUS) is
+/// not read here — the tables are live ([`crate::spell_mods`]), this consumer is not wired to
+/// them (the 0792 residual, same as the range gate).
 pub(crate) fn ground_cast_radius(spells: Option<&Spells>, spell_id: u32, level: u32) -> f32 {
     let Some(spells) = spells else { return 0.0 };
     let Some(d) = spells.catalog.get(spell_id) else {
@@ -111,7 +112,6 @@ pub(crate) fn ground_cast_radius(spells: Option<&Spells>, spell_id: u32, level:
 /// The cursor is still a **whole-word** surface in one respect — every seam shows the `Cast`
 /// *kind*, only `unable` differs — which is why it reads [`SpellTargeting::spell`]. The reticle is
 /// per-seam and reads [`SpellTargeting::spell_for`] (decision 0943).
-#[allow(clippy::too_many_arguments)]
 pub(crate) fn drive_targeting_cursor(
     targeting: Res<SpellTargeting>,
     occlusion: Res<PickOcclusion>,
diff --git a/crates/benilla-app/src/ui_action/targeting/world.rs b/crates/benilla-app/src/ui_action/targeting/world.rs
index 190941a2..32aa41df 100644
--- a/crates/benilla-app/src/ui_action/targeting/world.rs
+++ b/crates/benilla-app/src/ui_action/targeting/world.rs
@@ -177,6 +177,7 @@ mod tests {
         world.init_resource::<crate::ui_cast::PendingCast>();
         world.init_resource::<crate::ui_cast::QueuedMeleeSpell>();
         world.init_resource::<crate::cooldowns::Cooldowns>();
+        world.init_resource::<crate::spell_mods::SpellModifiers>();
         world.init_resource::<crate::ui_action::CastErrors>();
         world.init_resource::<crate::ui_action::UiErrorKeys>();
         world.init_resource::<crate::ui_action::AutoRepeatActive>();
diff --git a/crates/benilla-app/src/ui_action/usable.rs b/crates/benilla-app/src/ui_action/usable.rs
index 17b246fa..c6889b16 100644
--- a/crates/benilla-app/src/ui_action/usable.rs
+++ b/crates/benilla-app/src/ui_action/usable.rs
@@ -29,6 +29,7 @@ use benilla_formats::{
 use crate::cooldowns::Cooldowns;
 use crate::items::Items;
 use crate::net::{NetCommands, ObjectStore, Reputations};
+use crate::spell_mods::{SpellModifiers, OP_COST};
 use crate::target::{can_attack, ring_reaction, Factions};
 
 use super::Spells;
@@ -49,6 +50,8 @@ pub(crate) struct UsableCtx<'a> {
     pub(crate) factions: Option<&'a Factions>,
     pub(crate) reputations: &'a Reputations,
     pub(crate) cooldowns: &'a Cooldowns,
+    /// The talent spell-modifier tables — leg 12's cost goes through them ([`power_cost`]).
+    pub(crate) spell_mods: &'a SpellModifiers,
     /// Every carried entry's count, walked ONCE by the caller for the frame
     /// ([`crate::ui_items::carried_counts`]) — leg 3 reads reagents and totems off it instead
     /// of walking the bags per reagent per slot.
@@ -158,7 +161,7 @@ pub(crate) fn equipped_item_reason(d: &SpellDisplay) -> u8 {
 pub(crate) fn equipped_item_fits(
     d: &SpellDisplay,
     store: &ObjectStore,
-    items: &mut Items,
+    items: &Items,
     commands: &NetCommands,
 ) -> bool {
     // The reference's four short-circuits, all answering "fits" without looking at a single slot
@@ -309,7 +312,7 @@ pub(crate) fn item_usable(
     held: bool,
     ctx: &UsableCtx,
     spells: Option<&Spells>,
-    items: &mut Items,
+    items: &Items,
     commands: &NetCommands,
 ) -> (bool, bool) {
     if !held {
@@ -342,7 +345,7 @@ pub(crate) fn spell_usable(
     d: &SpellDisplay,
     spells: &Spells,
     ctx: &UsableCtx,
-    items: &mut Items,
+    items: &Items,
     commands: &NetCommands,
 ) -> (bool, bool) {
     // Early-out (`0x6e3d99`): a tradeskill "spell" is always usable.
@@ -450,7 +453,7 @@ pub(crate) fn spell_usable(
         return (false, false);
     }
     // Leg 12 (`0x6e3fba`–`0x6e3feb`): the power gate — the SOLE notEnoughMana writer (B2).
-    if !can_afford(d, ctx.store) {
+    if !can_afford(d, ctx.store, ctx.spell_mods) {
         return (false, true);
     }
     (true, false)
@@ -461,12 +464,17 @@ pub(crate) fn spell_usable(
 /// `CalculatePowerCost` shape, clamped at 0 on the way out; every nonzero row is a creature
 /// spell, so the clamp choice is dormant for players), and `ManaCostPercentage` of the pool
 /// 0948 chose per type (base mana for mana spells — the vmangos basis — max pool otherwise,
-/// health included for negative types). One law, every consumer: the usable walk's leg 12, the
-/// press-path power gate (0948), and the tooltip's cost cell (1074) — mirroring the byte fn's
-/// own caller set (`0x609657`/`0x60968d`/`0x4e5201`/`0x6e3fdb`/`0x52e8ad`/`0x507de3`). The
-/// reference's per-school unit mods and spell-mods (talent cost cuts) are not modeled — 0948's
-/// standing gap, now stated once here.
-pub(crate) fn power_cost(d: &SpellDisplay, store: &ObjectStore) -> u32 {
+/// health included for negative types) — and then the talent cost cut, `SPELLMOD_COST` (op 14),
+/// which `0x6e31b0` applies inside itself at `6e32e3` through the integer applier `0x6e6af0`
+/// ([`crate::spell_mods`]). One law, every consumer: the usable walk's leg 12, the press-path
+/// power gate (0948), and the tooltip's cost cell (1074) — mirroring the byte fn's own caller
+/// set (`0x609657`/`0x60968d`/`0x4e5201`/`0x6e3fdb`/`0x52e8ad`/`0x507de3`). The reference's
+/// per-school unit mods are still not modeled — what remains of 0948's standing gap.
+///
+/// **The modifier is why this one is behavioural and not only cosmetic**: the press-path gate
+/// refuses a cast it judges unaffordable and sends **no packet at all** (`0x609657`'s failure
+/// block), so an unmodified cost makes benilla refuse casts a talented character can afford.
+pub(crate) fn power_cost(d: &SpellDisplay, store: &ObjectStore, mods: &SpellModifiers) -> u32 {
     let power_type = d.power_type as i32;
     let base = if d.mana_cost_pct == 0 {
         0
@@ -484,7 +492,11 @@ pub(crate) fn power_cost(d: &SpellDisplay, store: &ObjectStore) -> u32 {
     let cost = i64::from(d.mana_cost)
         + level_delta * i64::from(d.mana_cost_per_level)
         + i64::from(base) * i64::from(d.mana_cost_pct) / 100;
-    u32::try_from(cost).unwrap_or(0)
+    // The talent cut, on the data terms and before the 0-clamp on the way out. The relative order
+    // of the two is dormant for players — every nonzero `manaCostPerlevel` row is a creature spell
+    // (above), so nothing reaches the modifier negative.
+    let cost = cost.clamp(i64::from(i32::MIN), i64::from(i32::MAX)) as i32;
+    u32::try_from(mods.apply(d, OP_COST, cost)).unwrap_or(0)
 }
 
 /// Whether the caster can afford `d`'s power cost — the shared availability-vs-cost compare
@@ -492,14 +504,14 @@ pub(crate) fn power_cost(d: &SpellDisplay, store: &ObjectStore) -> u32 {
 /// (`0x6094f0` @ `0x60962c`, decision 0948): raw `UNIT_FIELD_POWER[type]` — ANY negative
 /// PowerType reads `UNIT_FIELD_HEALTH` instead (the ref's `jl` at `0x609631`; Bloodrage's −2) —
 /// signed-compared against [`power_cost`]'s number.
-pub(crate) fn can_afford(d: &SpellDisplay, store: &ObjectStore) -> bool {
+pub(crate) fn can_afford(d: &SpellDisplay, store: &ObjectStore, mods: &SpellModifiers) -> bool {
     let power_type = d.power_type as i32;
     let avail = if power_type < 0 {
         store.0.unit_health().unwrap_or(0)
     } else {
         store.0.unit_power(power_type as u8).unwrap_or(0)
     };
-    avail >= power_cost(d, store)
+    avail >= power_cost(d, store, mods)
 }
 
 #[cfg(test)]
@@ -559,7 +571,7 @@ mod tests {
                 );
             }
             let store = ObjectStore(ObjectFields::from_pairs(&pairs));
-            equipped_item_fits(&needs_a_weapon, &store, &mut deps.items, &deps.commands)
+            equipped_item_fits(&needs_a_weapon, &store, &deps.items, &deps.commands)
         };
 
         // CONTROL — armed, the sword satisfies it.
@@ -622,7 +634,7 @@ mod tests {
                 );
             }
             let store = ObjectStore(ObjectFields::from_pairs(&pairs));
-            equipped_item_fits(d, &store, &mut deps.items, &deps.commands)
+            equipped_item_fits(d, &store, &deps.items, &deps.commands)
         };
 
         let sound = |field| (field, 0x2au64, 0u32, 0u32, 0u32);
@@ -695,7 +707,7 @@ mod tests {
                     ..Default::default()
                 },
                 &store,
-                &mut deps.items,
+                &deps.items,
                 &deps.commands,
             )
         };
@@ -716,6 +728,7 @@ mod tests {
         cooldowns: &'a Cooldowns,
         reputations: &'a Reputations,
         carried: &'a std::collections::HashMap<u32, u32>,
+        spell_mods: &'a SpellModifiers,
     ) -> UsableCtx<'a> {
         UsableCtx {
             store,
@@ -724,6 +737,7 @@ mod tests {
             reputations,
             cooldowns,
             carried,
+            spell_mods,
         }
     }
 
@@ -731,20 +745,68 @@ mod tests {
         let cooldowns = Cooldowns::default();
         let reputations = Reputations(Vec::new());
         let spells = Spells::empty_for_tests();
-        let mut items = Items::default();
+        let items = Items::default();
         let (tx, _rx) = crossbeam_channel::unbounded();
         let commands = NetCommands(tx);
         let carried = crate::ui_items::carried_counts(&store.0, &items);
+        let spell_mods = SpellModifiers::default();
         spell_usable(
             1,
             d,
             &spells,
-            &ctx(store, &cooldowns, &reputations, &carried),
-            &mut items,
+            &ctx(store, &cooldowns, &reputations, &carried, &spell_mods),
+            &items,
             &commands,
         )
     }
 
+    /// **The behavioural half of the spell-modifier system, and the reason op 14 is the first op
+    /// wired** (wow-re `spellmod-table-law.md` §9): the press-path gate compares the caster's
+    /// power against [`power_cost`] and, when short, refuses locally and sends **no**
+    /// `CMSG_CAST_SPELL` at all (`0x609657`'s fall-through failure block). With the tables unread,
+    /// a talent-discounted spell the server would happily accept is refused by the client.
+    ///
+    /// So: a mage with 80 mana and a 100-mana spell cannot cast it; one `SMSG_SET_PCT_SPELL_MODIFIER`
+    /// for that spell's `(family bit, op 14)` cell flips both the number and the verdict.
+    #[test]
+    fn a_talent_cost_cut_reaches_the_cost_and_the_press_path_gate() {
+        // Family 3 (mage), family bit 5 — the shape a real talent's `SpellFamilyMask` names.
+        let d = SpellDisplay {
+            spell_family: 3,
+            spell_family_flags: 1 << 5,
+            mana_cost: 100,
+            ..Default::default()
+        };
+        let store = ObjectStore(ObjectFields::from_pairs(&[(23, 80)]));
+
+        let mut mods = SpellModifiers::default();
+        mods.set_class_family(3);
+        assert_eq!(
+            power_cost(&d, &store, &mods),
+            100,
+            "no packet yet — the flat DBC cost"
+        );
+        assert!(
+            !can_afford(&d, &store, &mods),
+            "80 mana does not buy a 100 mana spell"
+        );
+
+        // The server's cell for (bit 5, op 14): −30%.
+        mods.set(false, 5, OP_COST, -30);
+        assert_eq!(power_cost(&d, &store, &mods), 70);
+        assert!(
+            can_afford(&d, &store, &mods),
+            "the talent brings it inside the pool, so TryCast must send the cast"
+        );
+
+        // A warrior's copy of the same spell id takes nothing — the family gate, from this side.
+        let other_class = SpellDisplay {
+            spell_family: 4,
+            ..d
+        };
+        assert_eq!(power_cost(&other_class, &store, &mods), 100);
+    }
+
     /// Each modeled gate trips alone, and only the power leg raises notEnoughMana (B2).
     #[test]
     fn gates_trip_independently_and_only_power_sets_oom() {
@@ -860,7 +922,7 @@ mod tests {
         let cooldowns = Cooldowns::default();
         let reputations = Reputations(Vec::new());
         let spells = Spells::empty_for_tests();
-        let mut items = Items::default();
+        let items = Items::default();
         let (tx, _rx) = crossbeam_channel::unbounded();
         let commands = NetCommands(tx);
         let execute = SpellDisplay {
@@ -880,9 +942,10 @@ mod tests {
                 reputations: &reputations,
                 cooldowns: &cooldowns,
                 carried: &carried,
+                spell_mods: &SpellModifiers::default(),
             };
             assert_eq!(
-                spell_usable(5308, &execute, &spells, &ctx, &mut items, &commands),
+                spell_usable(5308, &execute, &spells, &ctx, &items, &commands),
                 (expect, false)
             );
         }
diff --git a/crates/benilla-app/src/ui_action/weapon_icon.rs b/crates/benilla-app/src/ui_action/weapon_icon.rs
index 53f93edb..9e841e72 100644
--- a/crates/benilla-app/src/ui_action/weapon_icon.rs
+++ b/crates/benilla-app/src/ui_action/weapon_icon.rs
@@ -43,7 +43,7 @@ const ITEM_CLASS_WEAPON: u32 = 2;
 /// item whose icon would otherwise be shown.
 fn main_hand_item(
     store: &ObjectStore,
-    items: &mut Items,
+    items: &Items,
     icons: Option<&ItemDisplays>,
     commands: &NetCommands,
 ) -> Option<(u32, Option<String>)> {
@@ -73,7 +73,7 @@ fn main_hand_item(
 pub(crate) fn melee_auto_attack_icon(
     store: &ObjectStore,
     forms: &std::collections::HashMap<u32, benilla_formats::ShapeshiftForm>,
-    items: &mut Items,
+    items: &Items,
     icons: Option<&ItemDisplays>,
     commands: &NetCommands,
 ) -> String {
@@ -111,7 +111,7 @@ pub(crate) fn melee_auto_attack_icon(
 /// return hands over to the normal SpellIconID path).
 pub(crate) fn ranged_weapon_icon(
     store: &ObjectStore,
-    items: &mut Items,
+    items: &Items,
     icons: Option<&ItemDisplays>,
     commands: &NetCommands,
 ) -> Option<String> {
@@ -143,7 +143,7 @@ pub(super) fn auto_attack_icon(
     spell: &SpellDisplay,
     store: Option<&ObjectStore>,
     forms: &std::collections::HashMap<u32, benilla_formats::ShapeshiftForm>,
-    items: &mut Items,
+    items: &Items,
     icons: Option<&ItemDisplays>,
     commands: &NetCommands,
 ) -> Option<String> {
@@ -216,13 +216,7 @@ mod tests {
                 ..Default::default()
             },
         )]);
-        melee_auto_attack_icon(
-            &store,
-            &forms,
-            &mut deps.items,
-            Some(&icons),
-            &deps.commands,
-        )
+        melee_auto_attack_icon(&store, &forms, &deps.items, Some(&icons), &deps.commands)
     }
 
     /// **The disarmed guard on the Attack button** (`0x4e68df`, decision 1863 closing 0231's
diff --git a/crates/benilla-app/src/ui_auction/mod.rs b/crates/benilla-app/src/ui_auction/mod.rs
index f37527af..f72e8add 100644
--- a/crates/benilla-app/src/ui_auction/mod.rs
+++ b/crates/benilla-app/src/ui_auction/mod.rs
@@ -24,7 +24,8 @@
 //! refusal. The window opening clears the gate, so the first search is always allowed. (INTERIM,
 //! decision 1511 — pinned to the in-flight §5's TU-2.)
 //!
-//! The net bridge ([`crate::net::apply::auction`]) fills [`AuctionOpen`] from the wire. Each frame
+//! The packet handlers ([`net`], in the net handler table — decision 2305) fill [`AuctionOpen`]
+//! from the wire. Each frame
 //! [`feed_auction`] resolves each [`AuctionListEntry`] to a Lua-facing row (name/quality/icon via
 //! the ask-once item-template cache + `ItemDisplayInfo.dbc`, seller via the ask-once name cache,
 //! the time-left bucket from the wire's milliseconds), applies the sort, pushes the snapshot, and
@@ -49,13 +50,15 @@ use crate::items::Items;
 use crate::names::NameCache;
 use crate::net::{ClientCommand, NetCommands, ObjectStore, SelfPlayer};
 use crate::ui_action::{show_messages, ui_error_text, MessageSink, Shown, UiError};
-use crate::ui_script::UiInput;
+use crate::ui_script::{UiFeed, UiInput};
 use crate::ui_session::{close_npc_session_out_of_range, NpcSession};
 
 mod sort;
 
 use sort::SortStack;
 
+mod net;
+
 /// The browse query rate limit, in seconds. **VERIFIED** (wow-re §5 TU-2): the reference arms the
 /// gate with `tick + 0x1388` *after* the packet goes out, re-checks it inside the query itself,
 /// and its refusal path fires **nothing at all** — no event, no error. That silence is why the
@@ -371,6 +374,7 @@ pub(crate) struct UiAuctionPlugin;
 
 impl Plugin for UiAuctionPlugin {
     fn build(&self, app: &mut App) {
+        net::register(app);
         app.init_resource::<AuctionOpen>().add_systems(
             Update,
             (
@@ -380,7 +384,16 @@ impl Plugin for UiAuctionPlugin {
                 // out the same frame. After the UnitFeed set so a row's tooltip reads a landed
                 // item-template store.
                 close_npc_session_out_of_range::<AuctionOpen>.before(feed_auction),
-                feed_auction.after(crate::ui_unit::UnitFeed).before(UiInput),
+                // Gated on the interface being up (decision 2279): `AuctionOpen::messages` is
+                // filled by the server's unprompted sold/outbid/expired notices, and one landing
+                // in the same drain as the login burst would be resolved and shown on the boot
+                // VM — lost — if this ran in 2214's one-frame window. The queue is bounded by
+                // what the server sends while no interface is up, and the refresh flags the same
+                // packets set survive as wire re-asks either way.
+                feed_auction
+                    .after(crate::ui_unit::UnitFeed)
+                    .in_set(UiFeed)
+                    .run_if(crate::ui_script::ingame_ui_up),
                 drain_auction.after(UiInput),
             ),
         );
@@ -411,13 +424,12 @@ fn time_left_bucket(ms: u32) -> u32 {
 /// row's full enchant/property/suffix tail (an auction row carries all three, so it gets the
 /// complete link rather than the zeroed one a bag slot settles for). `None`s stay `None` while a
 /// query is in flight — the row shows a placeholder and fills in when the answer lands.
-#[allow(clippy::too_many_arguments)] // one resolve per ask-once cache the row reads
 fn resolve_row(
     entry: &AuctionListEntry,
     self_guid: Option<u64>,
-    items: &mut Items,
+    items: &Items,
     icons: Option<&ItemDisplays>,
-    names: &mut NameCache,
+    names: &NameCache,
     commands: &NetCommands,
     rolls: crate::items::RollCatalogs,
 ) -> AuctionRow {
@@ -507,13 +519,12 @@ pub(crate) fn categories(
 }
 
 /// Resolve + sort one list into its display rows.
-#[allow(clippy::too_many_arguments)] // one resolve per ask-once cache the row reads
 fn rows_for(
     slot: &AuctionListSlot,
     self_guid: Option<u64>,
-    items: &mut Items,
+    items: &Items,
     icons: Option<&ItemDisplays>,
-    names: &mut NameCache,
+    names: &NameCache,
     commands: &NetCommands,
     rolls: crate::items::RollCatalogs,
 ) -> Vec<AuctionRow> {
@@ -561,13 +572,12 @@ type AuctionCatalogs<'w> = (
 
 /// Push the current auction house into the VM and fire the show/close/list-update events on a
 /// transition or content change. Diffed against a `VmMemo`, exactly like the merchant/mail feeds.
-#[allow(clippy::too_many_arguments)] // one parameter per ask-once cache a row reads
 fn feed_auction(
     script: Option<NonSendMut<UiScript>>,
     mut auction: ResMut<AuctionOpen>,
-    mut items: ResMut<Items>,
+    items: Res<Items>,
     icons: Option<Res<ItemDisplays>>,
-    mut names: ResMut<NameCache>,
+    names: Res<NameCache>,
     commands: Res<NetCommands>,
     time: Res<Time>,
     catalogs: AuctionCatalogs,
@@ -645,9 +655,9 @@ fn feed_auction(
             let rows = rows_for(
                 slot,
                 self_guid,
-                &mut items,
+                &items,
                 icons.as_deref(),
-                &mut names,
+                &names,
                 &commands,
                 rolls,
             );
@@ -726,15 +736,14 @@ fn feed_auction(
 }
 
 /// Drain the Lua intents into the auction `CMSG`s.
-#[allow(clippy::too_many_arguments)]
 fn drain_auction(
     script: Option<NonSendMut<UiScript>>,
     mut auction: ResMut<AuctionOpen>,
     commands: Res<NetCommands>,
     time: Res<Time>,
-    mut items: ResMut<Items>,
+    items: Res<Items>,
     icons: Option<Res<ItemDisplays>>,
-    mut names: ResMut<NameCache>,
+    names: Res<NameCache>,
     self_q: Query<(&ObjectStore, &crate::net::Guid), With<SelfPlayer>>,
     // The click→auction-id map re-derives the same sorted rows the feed pushed, so it resolves
     // them the same way, roll included (1547).
@@ -827,9 +836,9 @@ fn drain_auction(
             let rows = rows_for(
                 &auction.lists[bid.list],
                 self_guid,
-                &mut items,
+                &items,
                 icons.as_deref(),
-                &mut names,
+                &names,
                 &commands,
                 rolls,
             );
@@ -845,9 +854,9 @@ fn drain_auction(
             let rows = rows_for(
                 &auction.lists[OWNER],
                 self_guid,
-                &mut items,
+                &items,
                 icons.as_deref(),
-                &mut names,
+                &names,
                 &commands,
                 rolls,
             );
diff --git a/crates/benilla-app/src/net/apply/auction.rs b/crates/benilla-app/src/ui_auction/net.rs
similarity index 70%
rename from crates/benilla-app/src/net/apply/auction.rs
rename to crates/benilla-app/src/ui_auction/net.rs
index 1ac2fff7..52dff545 100644
--- a/crates/benilla-app/src/net/apply/auction.rs
+++ b/crates/benilla-app/src/ui_auction/net.rs
@@ -1,23 +1,120 @@
-//! The auction house's wire→session bridge (decision 1511 P1) — every `SMSG_AUCTION_*` lands here
-//! and becomes state on [`AuctionOpen`], which [`crate::ui_auction::feed_auction`] turns into the
-//! window's events on the next frame. Nothing here touches the VM: the feed owns the script.
+//! The auction house's packet handlers (decision 1511 P1; in the net handler table since 2305 —
+//! the first family out of the drain's dispatch match) — every `SMSG_AUCTION_*` lands here and
+//! becomes state on [`AuctionOpen`], which [`super::feed_auction`] turns into the window's events
+//! on the next frame. Nothing here touches the VM: the feed owns the script.
 
 use benilla_protocol::messages::{
     auction_action, auction_error, AuctionBidderNotification, AuctionCommandTail, AuctionListEntry,
     AuctionOwnerNotification,
 };
+use benilla_protocol::{SessionEvent, SessionEventKind};
 use benilla_ui::script::{BIDDER, LIST, OWNER};
+use bevy::prelude::*;
 
-use crate::ui_auction::{AuctionMessage, AuctionOpen};
+use super::{AuctionMessage, AuctionOpen};
+use crate::net::NetHandlerApp;
+
+/// Register the house's handlers — called from [`super::UiAuctionPlugin`]. One per `SMSG_AUCTION_*`
+/// kind, plus the session-end listener.
+pub(super) fn register(app: &mut App) {
+    use SessionEventKind as K;
+    app.net_handler(K::AuctionHello, on_hello)
+        .net_handler(K::AuctionCommandResult, on_command_result)
+        .net_handler(K::AuctionListResult, on_list_result)
+        .net_handler(K::AuctionOwnerListResult, on_owner_list_result)
+        .net_handler(K::AuctionBidderListResult, on_bidder_list_result)
+        .net_handler(K::AuctionBidderNotification, on_bidder_notification)
+        .net_handler(K::AuctionOwnerNotification, on_owner_notification)
+        .net_handler(K::AuctionRemovedNotification, on_removed_notification)
+        .net_handler(K::Disconnected, on_session_end);
+}
+
+fn on_hello(In(ev): In<SessionEvent>, mut auction: ResMut<AuctionOpen>) {
+    if let SessionEvent::AuctionHello {
+        auctioneer,
+        house_id,
+    } = ev
+    {
+        auction_hello(auctioneer, house_id, &mut auction);
+    }
+}
+
+fn on_command_result(In(ev): In<SessionEvent>, mut auction: ResMut<AuctionOpen>) {
+    if let SessionEvent::AuctionCommandResult {
+        auction_id,
+        action,
+        error,
+        tail,
+    } = ev
+    {
+        auction_command_result(auction_id, action, error, &tail, &mut auction);
+    }
+}
+
+fn on_list_result(In(ev): In<SessionEvent>, mut auction: ResMut<AuctionOpen>) {
+    if let SessionEvent::AuctionListResult {
+        auctions,
+        total_count,
+    } = ev
+    {
+        auction_list_result(auctions, total_count, &mut auction);
+    }
+}
+
+fn on_owner_list_result(In(ev): In<SessionEvent>, mut auction: ResMut<AuctionOpen>) {
+    if let SessionEvent::AuctionOwnerListResult {
+        auctions,
+        total_count,
+    } = ev
+    {
+        auction_owner_list_result(auctions, total_count, &mut auction);
+    }
+}
+
+fn on_bidder_list_result(In(ev): In<SessionEvent>, mut auction: ResMut<AuctionOpen>) {
+    if let SessionEvent::AuctionBidderListResult {
+        auctions,
+        total_count,
+    } = ev
+    {
+        auction_bidder_list_result(auctions, total_count, &mut auction);
+    }
+}
+
+fn on_bidder_notification(In(ev): In<SessionEvent>, mut auction: ResMut<AuctionOpen>) {
+    if let SessionEvent::AuctionBidderNotification(n) = ev {
+        auction_bidder_notification(&n, &mut auction);
+    }
+}
+
+fn on_owner_notification(In(ev): In<SessionEvent>, mut auction: ResMut<AuctionOpen>) {
+    if let SessionEvent::AuctionOwnerNotification(n) = ev {
+        auction_owner_notification(&n, &mut auction);
+    }
+}
+
+fn on_removed_notification(In(ev): In<SessionEvent>, mut auction: ResMut<AuctionOpen>) {
+    if let SessionEvent::AuctionRemovedNotification { item_entry, .. } = ev {
+        auction_removed_notification(item_entry, &mut auction);
+    }
+}
+
+/// An open auction house dies with the socket (decision 1511): every auction command
+/// re-validates the auctioneer server-side, so a session that survived a reconnect would be a
+/// window whose every button silently failed. A listener on the session end, which the drain's
+/// dispatch match still owns ([`crate::net::handlers::BROADCAST`]).
+fn on_session_end(In(_): In<SessionEvent>, mut auction: ResMut<AuctionOpen>) {
+    auction.clear_session();
+}
 
 /// `MSG_AUCTION_HELLO`'s reply — **this**, not our send, is what opens the window (wow-re: the
 /// window's opener runs inside the hello handler). The house id keys the deposit rate.
-pub(super) fn auction_hello(auctioneer: u64, house_id: u32, auction: &mut AuctionOpen) {
+fn auction_hello(auctioneer: u64, house_id: u32, auction: &mut AuctionOpen) {
     auction.open(auctioneer, house_id);
 }
 
 /// One of the three list results. They share a frame and a record; only the tab differs.
-pub(super) fn auction_list(
+fn auction_list(
     which: usize,
     auctions: Vec<AuctionListEntry>,
     total_count: u32,
@@ -34,7 +131,7 @@ pub(super) fn auction_list(
     auction.set_list(which, auctions, total_count);
 }
 
-pub(super) fn auction_list_result(
+fn auction_list_result(
     auctions: Vec<AuctionListEntry>,
     total_count: u32,
     auction: &mut AuctionOpen,
@@ -42,7 +139,7 @@ pub(super) fn auction_list_result(
     auction_list(LIST, auctions, total_count, auction);
 }
 
-pub(super) fn auction_owner_list_result(
+fn auction_owner_list_result(
     auctions: Vec<AuctionListEntry>,
     total_count: u32,
     auction: &mut AuctionOpen,
@@ -54,7 +151,7 @@ pub(super) fn auction_owner_list_result(
 /// currently hold the bid on, so **one auction can appear twice in a page** — deduped here by
 /// auction id, keeping the first occurrence, because a duplicated row would be two rows the player
 /// can click that address the same auction.
-pub(super) fn auction_bidder_list_result(
+fn auction_bidder_list_result(
     auctions: Vec<AuctionListEntry>,
     total_count: u32,
     auction: &mut AuctionOpen,
@@ -73,7 +170,7 @@ pub(super) fn auction_bidder_list_result(
 /// server writes `auc ? auc->Id : 0`), so it is not a correlation handle on an error; and several
 /// refusals send **no packet at all** (a bid the player cannot afford, a cancel whose cut they
 /// cannot pay), which is why nothing in this arc blocks its UI waiting for an ack.
-pub(super) fn auction_command_result(
+fn auction_command_result(
     auction_id: u32,
     action: u32,
     error: u32,
@@ -154,10 +251,7 @@ fn command_error_key(error: u32) -> Option<&'static str> {
 ///
 /// **`bid_or_zero == 0` means WON**, not "no bid" — the server overloads the field, and reading it
 /// the obvious way turns every win into an outbid notice.
-pub(super) fn auction_bidder_notification(
-    notice: &AuctionBidderNotification,
-    auction: &mut AuctionOpen,
-) {
+fn auction_bidder_notification(notice: &AuctionBidderNotification, auction: &mut AuctionOpen) {
     let won = notice.bid_or_zero == 0;
     auction.messages.push(AuctionMessage::chat_item(
         if won {
@@ -172,10 +266,7 @@ pub(super) fn auction_bidder_notification(
 
 /// `SMSG_AUCTION_OWNER_NOTIFICATION` — one of ours sold, or took a bid. An all-zero bidder guid is
 /// the "sold" signal (the server zeroes it on a sale).
-pub(super) fn auction_owner_notification(
-    notice: &AuctionOwnerNotification,
-    auction: &mut AuctionOpen,
-) {
+fn auction_owner_notification(notice: &AuctionOwnerNotification, auction: &mut AuctionOpen) {
     // **Two stages, and the first one decides whether anything is said at all** (wow-re §11.4).
     // A NON-zero bidder guid is "somebody bid on your auction": the row updates and the client says
     // nothing — `[0x4cd25f, 0x4cd3bd)` holds no display call. Only a zeroed guid reaches the message
@@ -197,7 +288,7 @@ pub(super) fn auction_owner_notification(
 ///
 /// One id, unconditionally (wow-re §11.4: `0x4cd480` has exactly one `call 0x496720` and no branch
 /// selecting an id).
-pub(super) fn auction_removed_notification(item_entry: u32, auction: &mut AuctionOpen) {
+fn auction_removed_notification(item_entry: u32, auction: &mut AuctionOpen) {
     auction.messages.push(AuctionMessage::chat_item(
         "ERR_AUCTION_REMOVED_S",
         item_entry,
@@ -210,6 +301,42 @@ mod tests {
     use super::*;
     use benilla_ui::messages::MsgKind;
 
+    /// The registration, end to end: a hello and a session end through the real table.
+    #[test]
+    fn the_table_routes_the_hello_and_the_session_end_to_the_house() {
+        let mut app = App::new();
+        app.add_plugins(MinimalPlugins)
+            .init_resource::<AuctionOpen>();
+        register(&mut app);
+        let through_the_match = |_: &mut World, unclaimed: Vec<SessionEvent>| {
+            let kinds: Vec<SessionEventKind> =
+                unclaimed.iter().map(SessionEventKind::from).collect();
+            assert_eq!(
+                kinds,
+                vec![SessionEventKind::Disconnected],
+                "the broadcast reaches the match too"
+            );
+        };
+        crate::net::handlers::dispatch(
+            app.world_mut(),
+            vec![SessionEvent::AuctionHello {
+                auctioneer: 0x10,
+                house_id: 1,
+            }],
+            |_, unclaimed| assert!(unclaimed.is_empty()),
+        );
+        assert_eq!(app.world().resource::<AuctionOpen>().auctioneer, Some(0x10));
+        crate::net::handlers::dispatch(
+            app.world_mut(),
+            vec![SessionEvent::Disconnected {
+                reason: "socket".into(),
+                end: benilla_protocol::SessionEnd::Lost,
+            }],
+            through_the_match,
+        );
+        assert_eq!(app.world().resource::<AuctionOpen>().auctioneer, None);
+    }
+
     fn keys(auction: &AuctionOpen) -> Vec<(&'static str, MsgKind, Option<u32>)> {
         auction
             .messages
diff --git a/crates/benilla-app/src/ui_aura.rs b/crates/benilla-app/src/ui_aura.rs
index 32dda837..f822355d 100644
--- a/crates/benilla-app/src/ui_aura.rs
+++ b/crates/benilla-app/src/ui_aura.rs
@@ -158,13 +158,7 @@ impl Plugin for UiAuraPlugin {
             .init_resource::<AuraFeedMemory>()
             // Feed before the VM dispatch (like the unit feed), so a frame's OnEvent sees the fresh
             // list; drain the cancels after, once the VM has queued them.
-            .add_systems(
-                Update,
-                feed_auras
-                    .in_set(UnitFeed)
-                    .in_set(AuraEvents)
-                    .before(UiInput),
-            )
+            .add_systems(Update, feed_auras.in_set(UnitFeed).in_set(AuraEvents))
             .add_systems(Update, drain_aura_cancels.after(UiInput))
             // The ONLY teardown of the aura state, and it hangs off the session edge — never off
             // the avatar entity's existence, which a worldport interrupts mid-session (0900).
@@ -522,7 +516,6 @@ fn tracking_state_of(
     })
 }
 
-#[allow(clippy::too_many_arguments)]
 fn feed_auras(
     script: Option<NonSendMut<UiScript>>,
     self_q: Query<(&ObjectStore, &Guid), With<SelfPlayer>>,
diff --git a/crates/benilla-app/src/ui_bank.rs b/crates/benilla-app/src/ui_bank.rs
index df6f7233..42d1c045 100644
--- a/crates/benilla-app/src/ui_bank.rs
+++ b/crates/benilla-app/src/ui_bank.rs
@@ -25,7 +25,7 @@ use bevy::prelude::*;
 use benilla_ui::script::{BankState, UiScript};
 
 use crate::net::{ClientCommand, NetCommands, ObjectStore, SelfPlayer};
-use crate::ui_script::UiInput;
+use crate::ui_script::{UiFeed, UiInput};
 use crate::ui_session::{close_npc_session_out_of_range, npc_switched, NpcSession};
 
 /// The client-side `BankBagSlotPrices.dbc` table (decision 0604: the purchase ladder is client
@@ -95,7 +95,7 @@ impl Plugin for UiBankPlugin {
                     // Range-close before the feed so the clear turns into BANKFRAME_CLOSED the
                     // same frame; push before the input pass; drain after it (the merchant shape).
                     close_npc_session_out_of_range::<BankOpen>.before(feed_bank),
-                    feed_bank.before(UiInput),
+                    feed_bank.in_set(UiFeed),
                     drain_bank.after(UiInput),
                 ),
             );
@@ -127,7 +127,6 @@ fn bank_slot_error_key(result: u32) -> Option<&'static str> {
 /// window with `UnitName("npc")`, off the interaction token [`crate::ui_session`] already points
 /// at the banker. Firing an argument the reference does not fire is a divergence an addon can
 /// see, and it bought nothing once the reference's file was the one reading the event.
-#[allow(clippy::too_many_arguments)]
 fn feed_bank(
     script: Option<NonSendMut<UiScript>>,
     open: Res<BankOpen>,
diff --git a/crates/benilla-app/src/ui_battlefield.rs b/crates/benilla-app/src/ui_battlefield.rs
index 1cf4adce..c1dbd71e 100644
--- a/crates/benilla-app/src/ui_battlefield.rs
+++ b/crates/benilla-app/src/ui_battlefield.rs
@@ -38,7 +38,7 @@ use crate::net::{ClientCommand, EnteredWorldMessage, NetCommands};
 use crate::player::Player;
 use crate::ui_dialog_verbs::BattlefieldQueue;
 use crate::ui_party::GroupState;
-use crate::ui_script::UiInput;
+use crate::ui_script::{UiFeed, UiInput};
 
 /// The leash radius, squared: the CRT initialiser's `fld [0x806574]; fmul` of the `.rdata` f32
 /// `5.55555534362793` (§7.1).
@@ -215,14 +215,13 @@ fn group_fits(catalog: Option<&MapCatalog>, map_id: u32, group: Option<&GroupSta
 /// Every frame, before the dialog feed fires `UPDATE_BATTLEFIELD_STATUS` and the score feed
 /// fires `UPDATE_BATTLEFIELD_SCORE`: the list (when it changed), the queue slots (always), the
 /// `BATTLEFIELDS_SHOW` event with its anchor, the leash, and the speaking handlers' lines.
-#[allow(clippy::too_many_arguments)] // one Bevy system's full input set
 fn feed_battlefield(
     script: Option<NonSendMut<UiScript>>,
     mut state: ResMut<Battlefield>,
     queue: Res<BattlefieldQueue>,
     maps: Option<Res<MapCatalogRes>>,
     player: Res<Player>,
-    mut names: ResMut<NameCache>,
+    names: Res<NameCache>,
     commands: Res<NetCommands>,
     mut sink: crate::ui_action::MessageSink,
 ) {
@@ -366,11 +365,13 @@ impl Plugin for BattlefieldPlugin {
         app.init_resource::<Battlefield>().add_systems(
             Update,
             (
-                reset_on_world_enter.before(feed_battlefield),
+                reset_on_world_enter
+                    .in_set(crate::ui_script::UiFeed)
+                    .before(feed_battlefield),
                 feed_battlefield
                     .before(crate::ui_battlefield_score::feed_battlefield_score)
                     .before(crate::ui_dialog_verbs::feed_dialog_verbs)
-                    .before(UiInput),
+                    .in_set(UiFeed),
                 drain_battlefield.after(UiInput),
             ),
         );
diff --git a/crates/benilla-app/src/ui_battlefield_positions.rs b/crates/benilla-app/src/ui_battlefield_positions.rs
index 78ce02e0..0b8aa1c1 100644
--- a/crates/benilla-app/src/ui_battlefield_positions.rs
+++ b/crates/benilla-app/src/ui_battlefield_positions.rs
@@ -35,7 +35,7 @@ use crate::names::NameCache;
 use crate::net::{ClientCommand, EnteredWorldMessage, GuidIndex, NetCommands, NetEntity, SelfGuid};
 use crate::ui_dialog_verbs::BattlefieldQueue;
 use crate::ui_party::GroupState;
-use crate::ui_script::UiInput;
+use crate::ui_script::{UiFeed, UiInput};
 use crate::ui_world_map::{project_on_displayed, WorldMapUiData};
 
 /// The reference's request throttle: `RequestBattlefieldPositions` sends at most once per 5000 ms.
@@ -101,7 +101,6 @@ fn flag_token(faction: Option<&str>) -> Option<&'static str> {
     }
 }
 
-#[allow(clippy::too_many_arguments)]
 fn feed_battlefield_positions(
     script: Option<NonSendMut<UiScript>>,
     mut state: ResMut<BattlefieldPositions>,
@@ -112,7 +111,7 @@ fn feed_battlefield_positions(
     group: Res<GroupState>,
     guids: Res<GuidIndex>,
     unit_pos: Query<&GlobalTransform, With<NetEntity>>,
-    mut names: ResMut<NameCache>,
+    names: Res<NameCache>,
     commands: Res<NetCommands>,
     // What the empty push last carried (`(has_list, icon_scale bits)`): with no list the engine
     // is told once per change, not per frame; with one, every frame — the positions move.
@@ -232,7 +231,7 @@ impl Plugin for BattlefieldPositionsPlugin {
             Update,
             (
                 reset_on_world_enter.before(feed_battlefield_positions),
-                feed_battlefield_positions.before(UiInput),
+                feed_battlefield_positions.in_set(UiFeed),
                 drain_battlefield_positions.after(UiInput),
             ),
         );
diff --git a/crates/benilla-app/src/ui_battlefield_score.rs b/crates/benilla-app/src/ui_battlefield_score.rs
index 9532ddc7..d058da2d 100644
--- a/crates/benilla-app/src/ui_battlefield_score.rs
+++ b/crates/benilla-app/src/ui_battlefield_score.rs
@@ -26,7 +26,7 @@ use benilla_ui::script::{BattlefieldScoreRow, BattlefieldScores, BattlefieldStat
 use crate::names::NameCache;
 use crate::net::{ClientCommand, NetCommands};
 use crate::ui_dialog_verbs::BattlefieldQueue;
-use crate::ui_script::UiInput;
+use crate::ui_script::{UiFeed, UiInput};
 use crate::world_state_ui::WorldStateUiRes;
 
 /// `RequestBattlefieldScoreData`'s throttle — `0x4aa170`: `now + 0x1388`.
@@ -69,7 +69,7 @@ pub(crate) fn score_columns(catalog: &WorldStateUiRes, map: u32) -> Vec<Battlefi
 /// Resolve the raw board through the name cache; `None` while any name is still in flight.
 fn resolve_board(
     log: &PvpLogData,
-    names: &mut NameCache,
+    names: &NameCache,
     commands: &NetCommands,
 ) -> Option<Vec<BattlefieldScoreRow>> {
     let mut rows = Vec::with_capacity(log.rows.len());
@@ -109,7 +109,7 @@ pub(crate) fn feed_battlefield_score(
     board: Res<BattlefieldScoreboard>,
     mut queue: ResMut<BattlefieldQueue>,
     catalog: Option<Res<WorldStateUiRes>>,
-    mut names: ResMut<NameCache>,
+    names: Res<NameCache>,
     commands: Res<NetCommands>,
     mut last: Local<crate::ui_script::VmMemo<Option<BattlefieldScores>>>,
 ) {
@@ -120,7 +120,7 @@ pub(crate) fn feed_battlefield_score(
     script.set_battlefield_run_time_ms(queue.run_time_ms(now));
 
     let fresh = board.log.as_ref().and_then(|log| {
-        let rows = resolve_board(log, &mut names, &commands)?;
+        let rows = resolve_board(log, &names, &commands)?;
         let columns = queue
             .active_map()
             .zip(catalog.as_deref())
@@ -182,7 +182,7 @@ impl Plugin for BattlefieldScorePlugin {
                 // status-3 message, as in the client.
                 feed_battlefield_score
                     .before(crate::ui_dialog_verbs::feed_dialog_verbs)
-                    .before(UiInput),
+                    .in_set(UiFeed),
                 drain_battlefield_score.after(UiInput),
             ),
         );
diff --git a/crates/benilla-app/src/ui_bind_confirm.rs b/crates/benilla-app/src/ui_bind_confirm.rs
index 698fd31f..d0fd018c 100644
--- a/crates/benilla-app/src/ui_bind_confirm.rs
+++ b/crates/benilla-app/src/ui_bind_confirm.rs
@@ -169,7 +169,7 @@ impl BindGate<'_> {
     pub(crate) fn equip_binds(
         &self,
         script: &UiScript,
-        items: &mut Items,
+        items: &Items,
         commands: &crate::net::NetCommands,
         item_guid: u64,
     ) -> bool {
@@ -198,7 +198,7 @@ impl BindGate<'_> {
     /// the fire site is reached the item has already passed it.
     pub(crate) fn use_binds(
         &self,
-        items: &mut Items,
+        items: &Items,
         commands: &crate::net::NetCommands,
         item_guid: u64,
     ) -> bool {
diff --git a/crates/benilla-app/src/ui_binder.rs b/crates/benilla-app/src/ui_binder.rs
index 0604f976..22a0feec 100644
--- a/crates/benilla-app/src/ui_binder.rs
+++ b/crates/benilla-app/src/ui_binder.rs
@@ -45,7 +45,7 @@ use bevy::prelude::*;
 
 use crate::area::AreaTableRes;
 use crate::net::{ClientCommand, NetCommands};
-use crate::ui_script::UiInput;
+use crate::ui_script::{UiFeed, UiInput};
 use crate::ui_session::{close_npc_session_out_of_range, NpcSession};
 
 /// The innkeeper's pending bind question. Written by the net drain's `BinderConfirm` arm, read by
@@ -266,7 +266,7 @@ impl Plugin for UiBinderPlugin {
                 // Range-close before the feed so walking away takes the dialog down the same
                 // frame (the gossip window's ordering, for the same reason).
                 close_npc_session_out_of_range::<BinderState>.before(feed_binder),
-                feed_binder.before(UiInput),
+                feed_binder.in_set(UiFeed),
                 drain_binder.after(UiInput),
             ),
         );
diff --git a/crates/benilla-app/src/ui_cast.rs b/crates/benilla-app/src/ui_cast.rs
index 1457f46e..c8b30405 100644
--- a/crates/benilla-app/src/ui_cast.rs
+++ b/crates/benilla-app/src/ui_cast.rs
@@ -16,7 +16,6 @@ use benilla_ui::script::{ScriptValue, UiScript};
 use crate::creature_anim::{CastEvent, CastEventKind, Casting, PlaySeq};
 use crate::net::{ClientCommand, GuidIndex, NetCommands, SelfGuid};
 use crate::ui_action::Spells;
-use crate::ui_script::UiInput;
 use crate::ui_unit::UnitFeed;
 
 /// One edge of our own cast's lifecycle, queued by the net bridge for the cast bar.
@@ -34,7 +33,8 @@ pub(crate) enum CastBarEdge {
     /// `SMSG_SPELL_DELAYED` — pushback: our cast took a hit and the server extended it by
     /// `delay_ms`. The bar slides its window out (spark jumps back), it does NOT cancel.
     Delayed { delay_ms: u32 },
-    /// `MSG_CHANNEL_START` (self-only on the wire) — a channel opened; the bar counts *down*.
+    /// `MSG_CHANNEL_START` (self-only on the wire) — a channel opened; the bar counts *down*,
+    /// and is labelled by [`channel_start_args`]'s law rather than the spell's name.
     ChannelStart { spell_id: u32, duration_ms: u32 },
     /// `MSG_CHANNEL_UPDATE` (self-only): time left; `0` = the channel is over.
     ChannelUpdate { remaining_ms: u32 },
@@ -426,7 +426,6 @@ pub(crate) struct LocalMoveStart(pub(crate) bool);
 /// ~1.9 s in the reference bottle (whose `Config.wtf` caps `maxfps` at 30, and the ref steps
 /// alpha PER TICK), the director's observed "2–3 s"; our transcription normalizes those steps
 /// to the same 30 Hz reference tick so the tail matches at any render rate (`CastingBar.xml`).
-#[allow(clippy::too_many_arguments)] // one resolution's full input set (the reap needs the ECS half)
 fn local_self_cancel(
     script: Option<NonSendMut<UiScript>>,
     mut moved: ResMut<LocalMoveStart>,
@@ -576,12 +575,7 @@ fn local_self_cancel(
 /// **This is the CAST bar's law and it does not generalise to the channel bar** — which is why
 /// this is `SPELLCAST_START`'s label and not a shared helper. `0x6e7a2d` is the only
 /// `SpellRec+0x24 & 4` test in the whole image (censused twice), and the channel handler
-/// `0x6e7550` gates on entirely different bits: `AttributesEx3 & 0x2000` fires **no event at all**,
-/// and the name is `Name[locale]` only when `AttributesEx & 0x2000_0000` is set, otherwise the
-/// literal `GetText("CHANNELING")`. Neither is modelled yet — [`CastBarEdge::ChannelStart`] still
-/// passes the plain name — so a channel bar can read a spell name where the reference reads
-/// "Channeling". Named residual, not an oversight: it is a visible change to every channelled
-/// spell and wants the director's eye, not a silent fold-in.
+/// `0x6e7550` gates on entirely different bits. That law is [`channel_start_args`]'s, next door.
 fn cast_bar_label(spells: Option<&crate::ui_action::Spells>, id: u32) -> String {
     spells
         .and_then(|s| s.catalog.get(id))
@@ -590,11 +584,83 @@ fn cast_bar_label(spells: Option<&crate::ui_action::Spells>, id: u32) -> String
         .unwrap_or_default()
 }
 
+/// The CHANNEL bar's own law — `SpellChannelStart 0x6e7550`, whole. Returns the
+/// `SPELLCAST_CHANNEL_START` argument list, or `None` where the reference fires **no event at
+/// all** and the bar never appears.
+///
+/// The handler is 147 bytes and every one of its gates is here, in its order (decomp
+/// `FUN_006e7550`; disassembly quoted in wow-re `system/spell/scratch/wave-cast.md` §0x6e7550):
+///
+/// ```text
+/// 6e7571  test eax,eax / jle 6e75d8      ; (1) duration <= 0            -> NO EVENT
+/// 6e7579  test eax,eax / jl              ; (2) id < 0                   -> NO EVENT
+/// 6e757d  cmp eax,[0xc0d78c] / jg        ; (2) id past the table        -> NO EVENT
+/// 6e758e  test eax,eax / je              ; (2) no SpellRec at that slot -> NO EVENT
+/// 6e7595  test ch,0x20                   ; (3) AttributesEx3 & 0x2000   -> NO EVENT
+/// 6e759a  test [rec+0x1c],0x20000000     ; (4) AttributesEx bit 29 ...
+/// 6e75a9  mov eax,[rec+0x1e0+locale*4]   ;     ... set   -> Name[locale]
+/// 6e75bc  ecx=0x870dd0 call 0x703bf0     ;     ... clear -> GetText("CHANNELING")
+/// 6e75cb  push 0x156 / call 0x703f50     ; fmt 0x8432cc "%d%s" — (duration, name)
+/// ```
+///
+/// **Bit 29 is the reverse default of the cast bar's naming rule.** A cast bar prints the spell's
+/// name unless a bit says not to; a channel bar prints the literal word "Channeling" unless a bit
+/// says to name the spell. Only **9** of the 323 channeled rows in the shipped 5875 `Spell.dbc`
+/// opt in (the four Fishing ranks, Cannibalize, Dream Vision, Using Control Console, and the two
+/// Blood Siphons that gate (3) hides anyway) — so on a real server this reads "Channeling" for
+/// Blizzard, Arcane Missiles, Mind Flay, Drain Life/Soul/Mana, Rain of Fire, Hurricane,
+/// Tranquility, Evocation and First Aid alike. Ours passed the plain `Spell.dbc` name to every
+/// one of them until decision 2284.
+///
+/// The word itself is read the way the reference reads it — `FrameScript_GetText` on the
+/// GlobalStrings key, i.e. the Lua global `CHANNELING`, off the player's own chain — not from a
+/// table of ours, so a localized or patched install gets its own word. A missing global resolves
+/// to `""` (`0x882748`, the shared empty string; `GetText` never returns NULL), and the event
+/// still fires: an untitled bar, not a hidden one.
+///
+/// **What this does NOT gate is [`ActiveChannel`]** (and so the action button's lit ring). The
+/// reference's channel mirror is `SPELLCAST+0x10` (`0xceac58`), written at the cast SEND
+/// (`0x6e4f88`) and never touched by this handler — so a Blood Siphon suppressed here still
+/// counts as the current channel there, and ours keeps arming it from the packet for the same
+/// reason.
+fn channel_start_args(
+    script: &UiScript,
+    spells: Option<&crate::ui_action::Spells>,
+    id: u32,
+    duration_ms: u32,
+) -> Option<Vec<ScriptValue>> {
+    if duration_ms == 0 {
+        return None;
+    }
+    // Gates (2) and (3): no record at that id, or the record forbids a channel bar outright. The
+    // `filter` is the `je`/`jne` pair — both leave with the event unfired.
+    let display = spells
+        .and_then(|s| s.catalog.get(id))
+        .filter(|d| !d.no_channel_bar())?;
+    let name = if display.channel_bar_own_name() {
+        display.name.clone()
+    } else {
+        script
+            .lua()
+            .globals()
+            .get::<String>("CHANNELING")
+            .unwrap_or_default()
+    };
+    Some(vec![
+        ScriptValue::Int(i64::from(duration_ms)),
+        ScriptValue::Str(name),
+    ])
+}
+
 /// Drain the queue into FrameScript events — the reference `CastingBarFrame` contract
 /// (extracted 1.12 `CastingBarFrame.lua`): `SPELLCAST_START(name, ms)`,
-/// `SPELLCAST_CHANNEL_START(ms, name)`, `SPELLCAST_CHANNEL_UPDATE(remaining_ms)`, and the
-/// argless STOP / FAILED / INTERRUPTED / CHANNEL_STOP. A channel update of `0` fires
-/// CHANNEL_STOP — the server ends both the natural finish and the interrupt that way.
+/// `SPELLCAST_CHANNEL_START(ms, name)` — arg order reversed, and not a slip —
+/// `SPELLCAST_CHANNEL_UPDATE(remaining_ms)`, and the argless STOP / FAILED / INTERRUPTED /
+/// CHANNEL_STOP. A channel update of `0` fires CHANNEL_STOP — the server ends both the natural
+/// finish and the interrupt that way.
+///
+/// An edge can resolve to **no event**: [`channel_start_args`] returns `None` for the three
+/// conditions under which `0x6e7550` returns without firing, and the bar then never appears.
 ///
 /// Also pushes the frame's stoppable mirror (running auto-repeat OR the [`Inflight`] slot — NOT
 /// a channel, which `SpellStopCasting()` answers nil for: wow-re `esc-stopcasting.md`) into the
@@ -605,7 +671,6 @@ fn cast_bar_label(spells: Option<&crate::ui_action::Spells>, id: u32) -> String
 /// queued strike makes `IsCasting` true in the reference, so `SpellStopCasting()` returns `1` and
 /// `ToggleGameMenu`'s ladder never reaches `ClearTarget()` (`UIParent.lua` l.1489 vs l.1492).
 /// Reading only the ordinary-cast half here is what dropped the target on the first Esc.
-#[allow(clippy::too_many_arguments)] // a Bevy system's full input set
 fn feed_cast_bar(
     script: Option<NonSendMut<UiScript>>,
     mut feed: ResMut<CastBarFeed>,
@@ -633,49 +698,72 @@ fn feed_cast_bar(
     script.set_casting(
         auto_repeat.0.is_some() || inflight(&pending, &queued_melee, started, now).is_some(),
     );
-    // The two bars take their names from DIFFERENT laws — see [`cast_bar_label`]. The plain
-    // `Spell.dbc` name is the channel bar's (incomplete) one; the cast bar's is attribute-gated.
-    let channel_name = |id: u32| -> String {
-        spells
-            .as_ref()
-            .and_then(|s| s.catalog.get(id))
-            .map(|d| d.name.clone())
-            .unwrap_or_default()
-    };
     for edge in feed.0.drain(..) {
-        let (event, args): (&str, Vec<ScriptValue>) = match edge {
+        let Some((event, args)): Option<(&str, Vec<ScriptValue>)> = (match edge {
             CastBarEdge::Start {
                 spell_id,
                 cast_time_ms,
-            } => (
+            } => Some((
                 "SPELLCAST_START",
                 vec![
                     ScriptValue::Str(cast_bar_label(spells.as_deref(), spell_id)),
                     ScriptValue::Int(i64::from(cast_time_ms)),
                 ],
-            ),
-            CastBarEdge::Stop => ("SPELLCAST_STOP", vec![]),
-            CastBarEdge::Failed => ("SPELLCAST_FAILED", vec![]),
-            CastBarEdge::Interrupted => ("SPELLCAST_INTERRUPTED", vec![]),
-            CastBarEdge::Delayed { delay_ms } => (
+            )),
+            CastBarEdge::Stop => Some(("SPELLCAST_STOP", vec![])),
+            CastBarEdge::Failed => Some(("SPELLCAST_FAILED", vec![])),
+            CastBarEdge::Interrupted => Some(("SPELLCAST_INTERRUPTED", vec![])),
+            CastBarEdge::Delayed { delay_ms } => Some((
                 "SPELLCAST_DELAYED",
                 vec![ScriptValue::Int(i64::from(delay_ms))],
-            ),
+            )),
             CastBarEdge::ChannelStart {
                 spell_id,
                 duration_ms,
-            } => (
-                "SPELLCAST_CHANNEL_START",
-                vec![
-                    ScriptValue::Int(i64::from(duration_ms)),
-                    ScriptValue::Str(channel_name(spell_id)),
-                ],
-            ),
-            CastBarEdge::ChannelUpdate { remaining_ms: 0 } => ("SPELLCAST_CHANNEL_STOP", vec![]),
-            CastBarEdge::ChannelUpdate { remaining_ms } => (
-                "SPELLCAST_CHANNEL_UPDATE",
-                vec![ScriptValue::Int(i64::from(remaining_ms))],
-            ),
+            } => {
+                let args = channel_start_args(&script, spells.as_deref(), spell_id, duration_ms);
+                // The channel half of the cast trace. The other five edges are traced at RECV
+                // (`net::apply::spells`); these two are traced HERE because the decision that
+                // wants watching — which of `0x6e7550`'s legs the spell took — is made here,
+                // and the drain runs the same frame the packet lands.
+                if *crate::net::CAST_TRACE {
+                    match args.as_deref() {
+                        Some([_, ScriptValue::Str(label)]) => info!(
+                            "cast-trace: CHANNEL_START — spell {spell_id} {duration_ms}ms, \
+                             bar label {label:?}"
+                        ),
+                        _ => info!(
+                            "cast-trace: CHANNEL_START — spell {spell_id} {duration_ms}ms, \
+                             NO BAR (0x6e7550 gate: zero duration, no Spell.dbc row, or \
+                             AttributesEx3 & 0x2000)"
+                        ),
+                    }
+                }
+                args.map(|args| ("SPELLCAST_CHANNEL_START", args))
+            }
+            // `0x6e75f0`'s whole shape: nonzero re-times the window, zero ends it. It reads no
+            // SpellRec, so neither leg has an attribute gate — a channel whose START was
+            // suppressed still sends these, and the stock Lua's `IsShown()` guards absorb them.
+            CastBarEdge::ChannelUpdate { remaining_ms } => {
+                let over = remaining_ms == 0;
+                if *crate::net::CAST_TRACE {
+                    if over {
+                        info!("cast-trace: CHANNEL_STOP — update 0, the channel is over");
+                    } else {
+                        info!("cast-trace: CHANNEL_UPDATE — {remaining_ms}ms left");
+                    }
+                }
+                Some(if over {
+                    ("SPELLCAST_CHANNEL_STOP", vec![])
+                } else {
+                    (
+                        "SPELLCAST_CHANNEL_UPDATE",
+                        vec![ScriptValue::Int(i64::from(remaining_ms))],
+                    )
+                })
+            }
+        }) else {
+            continue;
         };
         script.fire_event(event, args);
     }
@@ -696,10 +784,7 @@ impl Plugin for UiCastPlugin {
             .init_resource::<LocalMoveStart>()
             .add_systems(
                 Update,
-                (local_self_cancel, feed_cast_bar)
-                    .chain()
-                    .in_set(UnitFeed)
-                    .before(UiInput),
+                (local_self_cancel, feed_cast_bar).chain().in_set(UnitFeed),
             );
     }
 }
@@ -744,6 +829,128 @@ mod tests {
         assert_eq!(cast_bar_label(None, 6478), "");
     }
 
+    /// The CHANNEL bar's law — [`channel_start_args`], the other half of `0x6e7550`, and the
+    /// **opposite default** to the cast bar's above: a channel says "Channeling" unless
+    /// `AttributesEx & 0x2000_0000` permits its own name. Shapes are the real shipped rows.
+    #[test]
+    fn the_channel_bar_says_channeling_unless_the_spell_may_name_itself() {
+        use benilla_formats::{SpellCatalog, SpellDisplay};
+        let row = |name: &str, attributes_ex: u32, attributes_ex3: u32| SpellDisplay {
+            name: name.to_string(),
+            attributes_ex,
+            attributes_ex3,
+            ..Default::default()
+        };
+        let spells = crate::ui_action::Spells {
+            catalog: SpellCatalog::from_displays(
+                [
+                    // Blizzard rank 1 — the real 5875 columns (bit 29 clear).
+                    (10, row("Blizzard", 0x1000_008c, 0)),
+                    // Fishing — one of the nine that name themselves.
+                    (7620, row("Fishing", 0x2100_4004, 0x0800_0000)),
+                    // Blood Siphon — the whole-event suppressor, both shipped rows.
+                    (24322, row("Blood Siphon", 0x2001_808c, 0x2000)),
+                ]
+                .into_iter()
+                .collect(),
+            ),
+            ..crate::ui_action::Spells::empty_for_tests()
+        };
+        // `FrameScript_GetText` reads the Lua global, so the VM is the source of the word — the
+        // chain-backed end-to-end is `ui_script::cast_tests`; here it is set by hand so the four
+        // gates are exercised without client data.
+        let script = UiScript::new().expect("VM");
+        script.eval::<()>("CHANNELING = \"Channeling\"").unwrap();
+
+        let name_of = |id: u32, ms: u32| -> Option<String> {
+            channel_start_args(&script, Some(&spells), id, ms).map(|args| match &args[1] {
+                ScriptValue::Str(s) => s.clone(),
+                other => panic!("arg 2 is the name, got {other:?}"),
+            })
+        };
+        assert_eq!(
+            name_of(10, 8_000).as_deref(),
+            Some("Channeling"),
+            "Blizzard has AttributesEx bit 29 clear, so the bar reads the generic word"
+        );
+        assert_eq!(
+            name_of(7620, 20_000).as_deref(),
+            Some("Fishing"),
+            "bit 29 set takes Name[locale] instead"
+        );
+        assert_eq!(
+            name_of(24322, 8_000),
+            None,
+            "AttributesEx3 & 0x2000 fires NO event — a suppressed bar, not a blank one"
+        );
+        assert_eq!(name_of(10, 0), None, "0x6e7574: duration <= 0 -> no event");
+        assert_eq!(
+            name_of(133, 8_000),
+            None,
+            "0x6e7590: no SpellRec -> no event"
+        );
+        assert_eq!(
+            channel_start_args(&script, None, 10, 8_000),
+            None,
+            "no client data is the same no-record leg"
+        );
+
+        // Arg ORDER is the reverse of SPELLCAST_START's, and the stock Lua reads it that way.
+        assert_eq!(
+            channel_start_args(&script, Some(&spells), 10, 8_000).unwrap()[0],
+            ScriptValue::Int(8_000),
+            "fmt 0x8432cc is \"%d%s\" — duration first"
+        );
+    }
+
+    /// The word itself comes off the PLAYER's chain, not a table of ours — `FrameScript_GetText`
+    /// on the GlobalStrings key, so a localized install gets its own. Pinned against the real
+    /// `Interface\FrameXML\GlobalStrings.lua` (l.478 in the shipped enUS file, whose trailing
+    /// comment is literally "Channeling tag for the channeling bar"). Skips without client data.
+    #[test]
+    fn the_channeling_word_comes_off_the_players_own_chain() {
+        let _data = benilla_formats::wow_data_or_skip!();
+        use benilla_formats::{SpellCatalog, SpellDisplay};
+        let script = UiScript::new().expect("VM");
+        crate::ui_script::test_ui::load_ui(&script, r"Interface\FrameXML\GlobalStrings.lua");
+        let spells = crate::ui_action::Spells {
+            catalog: SpellCatalog::from_displays(
+                [(
+                    10,
+                    SpellDisplay {
+                        name: "Blizzard".into(),
+                        attributes_ex: 0x1000_008c,
+                        ..Default::default()
+                    },
+                )]
+                .into_iter()
+                .collect(),
+            ),
+            ..crate::ui_action::Spells::empty_for_tests()
+        };
+        assert_eq!(
+            channel_start_args(&script, Some(&spells), 10, 8_000).unwrap()[1],
+            ScriptValue::Str("Channeling".into()),
+        );
+    }
+
+    /// The suppressed channel still arms [`ActiveChannel`], so its action button stays lit: the
+    /// reference's channel mirror is `SPELLCAST+0x10` (`0xceac58`), written at the cast SEND
+    /// (`0x6e4f88`) and never touched by `0x6e7550`. That is why all four of the handler's gates
+    /// live in the DRAIN and none of them in `net::apply::spells::channel_start`, which arms this.
+    #[test]
+    fn suppressing_the_channel_bar_does_not_clear_the_channel_mirror() {
+        let t0 = Instant::now();
+        // What `MSG_CHANNEL_START` does for Blood Siphon 24322 — the suppressed row.
+        let mut channel = ActiveChannel::default();
+        channel.start(24322, 8_000, t0);
+        assert_eq!(
+            channel.current(t0 + Duration::from_secs(1)),
+            Some(24322),
+            "the wire edge arms the mirror regardless of what the bar does with it"
+        );
+    }
+
     #[test]
     fn a_fresh_guard_is_open() {
         let g = PendingCast::default();
diff --git a/crates/benilla-app/src/ui_char.rs b/crates/benilla-app/src/ui_char.rs
index 7ef82f2d..cb544a0e 100644
--- a/crates/benilla-app/src/ui_char.rs
+++ b/crates/benilla-app/src/ui_char.rs
@@ -55,7 +55,7 @@ use crate::net::{ClientCommand, NetCommands, ObjectStore, SelfPlayer};
 use crate::pending_item_ops::PendingItemOps;
 use crate::portrait::PaperDollBooth;
 use crate::ui_items::{find_equip_slot, item_link};
-use crate::ui_script::{gate, UiInput};
+use crate::ui_script::{gate, UiFeed, UiInput};
 
 /// Equipment slots, 0-based (`EQUIPMENT_SLOT_*`): the inv-slot array index of the main hand,
 /// off hand, and ranged slots the weapon-skill / offhand / wand resolutions read.
@@ -132,9 +132,9 @@ impl Plugin for UiCharPlugin {
                 // fire" rule, across the two feeds.
                 feed_char
                     .before(crate::ui_items::feed::feed_containers)
-                    .before(UiInput),
-                watch_skill_ups.before(UiInput),
-                feed_skills.before(UiInput),
+                    .in_set(UiFeed),
+                watch_skill_ups.in_set(UiFeed),
+                feed_skills.in_set(UiFeed),
                 drain_skill_abandons.after(UiInput),
             ),
         );
@@ -440,12 +440,7 @@ fn slot_entry(store: &ObjectStore, items: &Items, slot0: u8) -> Option<u32> {
 
 /// The equipped item's weapon-skill line id: the vmangos `Item.cpp` subclass table for a class-2
 /// item, unarmed (162) for an empty hand or a non-weapon / unmapped subclass.
-fn weapon_skill_id(
-    store: &ObjectStore,
-    items: &mut Items,
-    commands: &NetCommands,
-    slot0: u8,
-) -> u32 {
+fn weapon_skill_id(store: &ObjectStore, items: &Items, commands: &NetCommands, slot0: u8) -> u32 {
     let Some(entry) = slot_entry(store, items, slot0) else {
         return SKILL_UNARMED;
     };
@@ -589,7 +584,7 @@ pub(crate) fn unit_combat_stats(store: &ObjectStore) -> UnitCombatStats {
 
 /// The player's snapshot: [`unit_combat_stats`] plus the half only *we* have — the two values that
 /// need the equipped items' templates, and the three `PLAYER_SKILL_INFO` pairs.
-fn combat_stats(store: &ObjectStore, items: &mut Items, commands: &NetCommands) -> UnitCombatStats {
+fn combat_stats(store: &ObjectStore, items: &Items, commands: &NetCommands) -> UnitCombatStats {
     // The offhand-speed gate is an offhand *weapon* (a shield doesn't swing); the wand check is
     // the ranged item's subclass. Both read the equipped item's template (ask-once in flight →
     // false this frame, refined when it lands).
@@ -642,14 +637,13 @@ fn combat_stats(store: &ObjectStore, items: &mut Items, commands: &NetCommands)
 /// equipped-bag icons 20..=23) and the bank bags' own `PLAYER_FIELD_BANK_BAG_SLOT_*` (live ids
 /// 64..=69). Everything past the guid — template, enchants, durability, the pending lock — is
 /// identical for both, which is the whole reason there is one function here and not two.
-#[allow(clippy::too_many_arguments)] // the slot resolve's full read set — the bag feed's twin
 fn slot_view(
-    items: &mut Items,
+    items: &Items,
     icons: Option<&ItemDisplays>,
     rolls: crate::items::RollCatalogs,
     commands: &NetCommands,
     pending: &PendingItemOps,
-    names: &mut crate::names::NameCache,
+    names: &crate::names::NameCache,
     // `ItemSubClass.dbc` — the count gate below reads its `DisplayFlags` bit 2. `None` (the DBC
     // failed to load) leaves every bag at 0, which is the plain-bag answer and the safe one.
     sub_classes: Option<&crate::ui_items::ItemSubClasses>,
@@ -809,15 +803,14 @@ fn ammo_count(store: &ObjectStore, items: &Items, ammo_id: u32) -> u32 {
 /// the four equipped-bag icons (decision 0216 slice 2's bag bar — the bag ITEM occupying `INV_SLOT`
 /// 19..22, not its contents) — all the client's 1-based `GetInventorySlotInfo` ids over the
 /// 0-based inv-slot array.
-#[allow(clippy::too_many_arguments)] // [`slot_view`]'s read set, plus the descriptor it walks
 fn inventory_slots(
     store: &ObjectStore,
-    items: &mut Items,
+    items: &Items,
     icons: Option<&ItemDisplays>,
     rolls: crate::items::RollCatalogs,
     commands: &NetCommands,
     pending: &PendingItemOps,
-    names: &mut crate::names::NameCache,
+    names: &crate::names::NameCache,
     sub_classes: Option<&crate::ui_items::ItemSubClasses>,
     classes: Option<&benilla_formats::ChrClasses>,
 ) -> InventorySlots {
@@ -905,15 +898,14 @@ fn inventory_slots(
 /// `BankButtonIDToInvSlotID(i, 1)` (BankFrame.lua:28-35, 194-198), and the guids stream in the
 /// player descriptor whether or not a banker is open. So they ride the inventory feed, beside the
 /// doll snapshot, rather than the `BankState` the bank window pushes.
-#[allow(clippy::too_many_arguments)] // [`slot_view`]'s read set, one band over
 fn bank_bag_slots(
     store: &ObjectStore,
-    items: &mut Items,
+    items: &Items,
     icons: Option<&ItemDisplays>,
     rolls: crate::items::RollCatalogs,
     commands: &NetCommands,
     pending: &PendingItemOps,
-    names: &mut crate::names::NameCache,
+    names: &crate::names::NameCache,
     sub_classes: Option<&crate::ui_items::ItemSubClasses>,
 ) -> BankBagSlots {
     let mut bags: BankBagSlots = Default::default();
@@ -1047,7 +1039,6 @@ pub(crate) fn fire_stat_transitions(
     }
 }
 
-#[allow(clippy::too_many_arguments)]
 pub(crate) fn feed_char(
     // `ChrClasses.dbc` field 16, for the fit rule's relic half — `ui_items::find_equip_slot`
     // (1803). Absent client data reads every class as an ordinary ranged wielder.
@@ -1055,7 +1046,7 @@ pub(crate) fn feed_char(
     script: Option<NonSendMut<UiScript>>,
     self_q: Query<&ObjectStore, With<SelfPlayer>>,
     changed_self: Query<(), (With<SelfPlayer>, Changed<ObjectStore>)>,
-    mut items: ResMut<Items>,
+    items: Res<Items>,
     icons: Option<Res<ItemDisplays>>,
     // `SpellItemEnchantment`'s name column — the equipped tooltip's enchant lines (decision 0915).
     enchants: Option<Res<crate::items::Enchants>>,
@@ -1065,7 +1056,7 @@ pub(crate) fn feed_char(
     mut feed: ResMut<CharFeedState>,
     mut booth: ResMut<PaperDollBooth>,
     pending: Res<PendingItemOps>,
-    mut names: ResMut<crate::names::NameCache>,
+    names: Res<crate::names::NameCache>,
     // `ItemSubClass.dbc` — `GetInventoryItemCount`'s bag gate (`slot_view`'s own note).
     sub_classes: Option<Res<crate::ui_items::ItemSubClasses>>,
 ) {
@@ -1168,7 +1159,7 @@ pub(crate) fn feed_char(
         return;
     }
 
-    let stats = combat_stats(store, &mut items, &commands);
+    let stats = combat_stats(store, &items, &commands);
     if memo.last_stats.as_ref() != Some(&stats) {
         gate.audit("feed_char", "the combat-stats snapshot");
         // PUSH before firing: event dispatch runs the Lua handlers synchronously, so the snapshot
@@ -1182,7 +1173,7 @@ pub(crate) fn feed_char(
 
     let inv = inventory_slots(
         store,
-        &mut items,
+        &items,
         icons.as_deref(),
         crate::items::RollCatalogs {
             enchants: enchants.as_deref(),
@@ -1190,13 +1181,13 @@ pub(crate) fn feed_char(
         },
         &commands,
         &pending,
-        &mut names,
+        &names,
         sub_classes.as_deref(),
         classes.as_deref().map(|t| &t.0),
     );
     let bank_bags = bank_bag_slots(
         store,
-        &mut items,
+        &items,
         icons.as_deref(),
         crate::items::RollCatalogs {
             enchants: enchants.as_deref(),
@@ -1204,7 +1195,7 @@ pub(crate) fn feed_char(
         },
         &commands,
         &pending,
-        &mut names,
+        &names,
         sub_classes.as_deref(),
     );
     // One transition for both bands: they are the same descriptor read at two offsets, and
diff --git a/crates/benilla-app/src/ui_chat.rs b/crates/benilla-app/src/ui_chat.rs
index 9f17526b..141fd711 100644
--- a/crates/benilla-app/src/ui_chat.rs
+++ b/crates/benilla-app/src/ui_chat.rs
@@ -10,7 +10,7 @@
 
 use bevy::prelude::*;
 
-use crate::ui_script::UiInput;
+use crate::ui_script::{UiFeed, UiInput};
 
 #[cfg(test)]
 mod ace_gate_tests;
@@ -34,7 +34,7 @@ mod event;
 mod feed;
 mod frames;
 /// The idle handler — the 5-minute auto-sit / auto-AFK and the 30-minute camp.
-mod idle;
+pub(crate) mod idle;
 mod input;
 /// The language gate — the exemptions and the fluency lookup behind the chat garble (B262).
 mod language;
@@ -75,6 +75,7 @@ pub(crate) struct UiChatPlugin;
 
 impl Plugin for UiChatPlugin {
     fn build(&self, app: &mut App) {
+        app.add_observer(combat::on_cvar);
         app.init_resource::<ChatLog>()
             .init_resource::<away::AfkMirror>()
             .init_resource::<away::AfkMirrorMemo>()
@@ -85,9 +86,9 @@ impl Plugin for UiChatPlugin {
             .init_resource::<recruitment::GuildRecruitmentCascade>()
             .init_resource::<language::ChatLanguages>()
             .init_resource::<combat::CombatLogRanges>()
-            // `CombatLogPeriodicSpells`' knob, beside its sibling range set — both are
-            // `KnobParams` members, so a missing one is not a dormant default but a
-            // STARTUP PANIC in `cvars::load_config` (which takes them all as `ResMut`).
+            // `CombatLogPeriodicSpells`' knob, beside its sibling range set — both are what
+            // `combat::on_cvar` writes, so a missing one is not a dormant default but a
+            // PANIC on the first write of either row (2303; before that, at startup).
             // 947ba585f registered it only in the `cvar_app()` test helper, and the client
             // stopped booting; the unit suites never noticed because each builds its own
             // world. `scripts/smoke.sh` is the gate that sees this class.
@@ -145,7 +146,12 @@ impl Plugin for UiChatPlugin {
             // The world broadcasts' resolve pass — before the drain that renders what it produces,
             // so an alarm or a shutdown countdown lands on the frame it decodes like every other
             // chat source.
-            .add_systems(Update, broadcast::feed_broadcasts.before(feed::feed_chat))
+            .add_systems(
+                Update,
+                broadcast::feed_broadcasts
+                    .in_set(crate::ui_script::UiFeed)
+                    .before(feed::feed_chat),
+            )
             // **Never against the boot VM** (B376's second half). `feed_chat` takes the whole
             // queue with `mem::take` and fires each line as a real `CHAT_MSG_*` — so a drain
             // against a VM with no ChatFrame does not defer the lines, it DESTROYS them, with no
@@ -183,7 +189,7 @@ impl Plugin for UiChatPlugin {
             .add_systems(
                 Update,
                 feed::feed_chat
-                    .before(UiInput)
+                    .in_set(UiFeed)
                     .after(crate::ui_unit::UnitFeed)
                     .after(crate::ui_guild::GuildFeed)
                     .run_if(crate::ui_script::ingame_ui_up),
@@ -194,11 +200,16 @@ impl Plugin for UiChatPlugin {
             .add_systems(Update, idle::stamp_input.before(UiInput))
             // A fresh VM gets the joined-channel mirror re-pushed once (decision 1291) — before
             // the feed, so the reload frame's first routed line already renders numbered.
-            .add_systems(Update, channels::seed_channels.before(feed::feed_chat))
+            .add_systems(
+                Update,
+                channels::seed_channels
+                    .in_set(crate::ui_script::UiFeed)
+                    .before(feed::feed_chat),
+            )
             // RequestTimePlayed() -> CMSG_PLAYED_TIME, and SMSG_PLAYED_TIME -> TIME_PLAYED_MSG.
             // Beside the chat feed because /played is a chat command and the answer prints there
             // too; before the input pass for the same reason feed_chat is.
-            .add_systems(Update, feed::played_time_bridge.before(UiInput))
+            .add_systems(Update, feed::played_time_bridge.in_set(UiFeed))
             // The input: open on ENTER (after the UI input pass has set UiKeyboardCapture, so we
             // don't reopen the box that's already eating keys), then drain any submitted line. Both
             // touch the single NonSend VM, so they chain. In-world only (decision 0193): at the
@@ -227,7 +238,7 @@ impl Plugin for UiChatPlugin {
                 )
                     .chain()
                     .after(UiInput)
-                    .run_if(in_state(crate::char_select::ClientState::InWorld)),
+                    .in_set(crate::char_select::InWorldGated),
             )
             // The zone-channel auto-join (0288 P6): the client half of a handshake vmangos
             // deliberately leaves to us. In-world only, and it early-outs on an unchanged zone.
@@ -250,10 +261,8 @@ impl Plugin for UiChatPlugin {
                 Update,
                 (
                     channels::end_session_channels_on_disconnect,
-                    channels::auto_join_zone_channels
-                        .run_if(in_state(crate::char_select::ClientState::InWorld)),
-                    recruitment::guild_recruitment_cascade
-                        .run_if(in_state(crate::char_select::ClientState::InWorld)),
+                    channels::auto_join_zone_channels.in_set(crate::char_select::InWorldGated),
+                    recruitment::guild_recruitment_cascade.in_set(crate::char_select::InWorldGated),
                 )
                     .chain()
                     .after(benilla_world::terrain_stream::AreaAuthoritySet),
diff --git a/crates/benilla-app/src/ui_chat/away.rs b/crates/benilla-app/src/ui_chat/away.rs
index f6a06d69..196f1d32 100644
--- a/crates/benilla-app/src/ui_chat/away.rs
+++ b/crates/benilla-app/src/ui_chat/away.rs
@@ -283,14 +283,14 @@ pub(crate) fn reconcile_afk_mirror(
 /// reference tables that happen to overlap, not one shared idea.
 pub(crate) fn movement_clears_afk(
     binds: Res<crate::bindings::BindingsState>,
-    cvars: Res<crate::cvars::CvarPersist>,
+    cvars: Res<crate::cvars::Cvars>,
     script: Option<NonSendMut<benilla_ui::script::UiScript>>,
     commands: Res<crate::net::NetCommands>,
     mut chat: ResMut<ChatLog>,
     mut mirror: ResMut<AfkMirror>,
 ) {
     use crate::bindings::cmd;
-    if !mirror.is_afk() || cvars.stored("autoClearAFK").is_some_and(|v| v == "0") {
+    if !mirror.is_afk() || cvars.flag("autoClearAFK") == Some(false) {
         return;
     }
     // The inline-array idiom `player::follow`'s `move_start` uses — its six, plus JUMP.
diff --git a/crates/benilla-app/src/ui_chat/channels.rs b/crates/benilla-app/src/ui_chat/channels.rs
index 90f34e92..f87ac012 100644
--- a/crates/benilla-app/src/ui_chat/channels.rs
+++ b/crates/benilla-app/src/ui_chat/channels.rs
@@ -523,7 +523,6 @@ fn zone_is_settled(player: Option<&crate::player::Player>) -> bool {
 /// `flags & INITIAL` read fresh. The DBC bit only seeds the mask on a character with no file
 /// (`0x4997fc`). This is what makes `/leave General` stick: the leave clears the bit in the
 /// character's file, and the next login's walk never registers the row ([`plan_walk`]).
-#[allow(clippy::too_many_arguments)] // a Bevy system's param list IS its dependency set
 pub(super) fn auto_join_zone_channels(
     commands: Res<NetCommands>,
     mut channels: ResMut<ChannelState>,
diff --git a/crates/benilla-app/src/ui_chat/combat.rs b/crates/benilla-app/src/ui_chat/combat.rs
index 521ae4b8..3342719a 100644
--- a/crates/benilla-app/src/ui_chat/combat.rs
+++ b/crates/benilla-app/src/ui_chat/combat.rs
@@ -172,6 +172,17 @@ impl CombatLogRanges {
         self.death
     }
 
+    /// Whether `name` is one of the eight — asked before [`Self::set`] so an observer holding
+    /// the resource mutably does not flag a change it did not make.
+    pub(crate) fn is_range_cvar(&self, name: &str) -> bool {
+        name.eq_ignore_ascii_case(DEATH_LOG_RANGE_CVAR)
+            || (0..self.class.len()).any(|i| {
+                UnitClass::from_index(i)
+                    .range_cvar()
+                    .is_some_and(|c| c.eq_ignore_ascii_case(name))
+            })
+    }
+
     /// Apply one `SetCVar` to the table — `true` if the name was one of the eight.
     ///
     /// The class names are walked through [`UnitClass::range_cvar`] so this module keeps exactly
@@ -195,6 +206,20 @@ impl CombatLogRanges {
     }
 }
 
+/// The combat log rows' change callback (decision 2303): the eight display ranges (yards, the
+/// CVar's float field) and the periodic-effects switch.
+pub(crate) fn on_cvar(
+    ev: On<crate::cvars::CvarChanged>,
+    mut ranges: ResMut<CombatLogRanges>,
+    mut periodic: ResMut<LogPeriodicSpells>,
+) {
+    if ev.is(LOG_PERIODIC_CVAR) {
+        periodic.0 = ev.flag();
+    } else if ranges.is_range_cvar(&ev.name) {
+        ranges.set(&ev.name, ev.num());
+    }
+}
+
 /// **`CombatLogPeriodicSpells`** — "Log Periodic Effects", and its blast radius is wider than the
 /// options row's wording.
 ///
@@ -229,10 +254,9 @@ pub(crate) const LOG_PERIODIC_CVAR: &str = "CombatLogPeriodicSpells";
 /// **The combat-feedback CVars, as one system parameter** — what a packet handler needs to know
 /// about the player's settings before it emits a line or a floating number.
 ///
-/// Bundled for the reason [`crate::cvars::KnobParams`] is: `net::apply::apply_net_updates` lives
-/// against Bevy's 16-parameter ceiling, and three more `Res` would have gone into a nested tuple
-/// as positional fields nobody can read at the use site. They are one concern anyway — the
-/// reference reads all three inside the same combat-log/world-text translation unit.
+/// Bundled because they are one concern — the reference reads all three inside the same
+/// combat-log/world-text translation unit — and read by the net drain as the combat-feedback
+/// member of its catalogs (`net::apply::params::Catalogs`).
 #[derive(bevy::ecs::system::SystemParam)]
 pub(crate) struct CombatFeedbackCvars<'w> {
     /// The eight display ranges.
@@ -370,7 +394,6 @@ impl UnitClass {
 /// [`crate::target::ring::can_attack_from_player`] is specialised to the local player as the
 /// attacker (1530). We run the direction we have. It differs only for a unit that can attack you
 /// while you cannot attack it, which needs the general two-unit form to answer.
-#[allow(clippy::too_many_arguments)]
 pub(crate) fn classify(
     guid: u64,
     self_guid: &SelfGuid,
@@ -1065,11 +1088,7 @@ pub(crate) fn power_word(script: &benilla_ui::script::UiScript, power: u32) -> O
 /// same ask-once name cache every other client-composed chat line waits on. `None` = not yet
 /// answered; the caller re-tries next frame, exactly as the reference's deferred-name queue
 /// (`DAT_00c4e208`, drained by the name-ready callback `0x6294b0`) replays its message.
-pub(crate) fn object_name(
-    guid: u64,
-    names: &mut NameCache,
-    commands: &NetCommands,
-) -> Option<String> {
+pub(crate) fn object_name(guid: u64, names: &NameCache, commands: &NetCommands) -> Option<String> {
     // Guid 0 = "the name is already in the fills" — no wire endpoint is ever guid 0, so the
     // sentinel costs nothing and is what lets `/chattest` drive the real drain with literal names.
     if guid == 0 {
diff --git a/crates/benilla-app/src/ui_chat/combat/watch.rs b/crates/benilla-app/src/ui_chat/combat/watch.rs
index e6c6d7db..6ae5fa85 100644
--- a/crates/benilla-app/src/ui_chat/combat/watch.rs
+++ b/crates/benilla-app/src/ui_chat/combat/watch.rs
@@ -15,14 +15,13 @@
 //! [`crate::creature_anim::arm_aura_state_fx`] uses for the aura state kits — and for the same
 //! reason: the *edge* is the event, and a descriptor snapshot is all the wire gives us.
 
-use bevy::ecs::entity::EntityHashMap;
 use bevy::prelude::*;
 
 use super::{
     aura_gone_kind, classify, death_kind, in_range, periodic_kind, CombatLogRanges, Family, Fills,
     Named, PendingCombat, UnitClass, Variant,
 };
-use crate::net::{GuidIndex, ObjectStore, Reputations, SelfGuid};
+use crate::net::{FieldChanged, GuidIndex, ObjectStore, Reputations, SelfGuid};
 use crate::target::ring::Factions;
 use crate::ui_chat::{ChatEventKind, ChatLog};
 use crate::ui_party::GroupState;
@@ -82,7 +81,6 @@ impl WatchCtx<'_> {
 }
 
 /// Queue one single-endpoint line, gated the way its formatter gates.
-#[allow(clippy::too_many_arguments)] // the line's own facts, plus the two contexts the gate reads
 fn queue_one(
     log: &mut ChatLog,
     ctx: &WatchCtx,
@@ -117,9 +115,11 @@ const DESTROYED_EFFECTS: [u32; 10] = [50, 74, 87, 88, 89, 90, 104, 105, 106, 107
 /// The unit-death reflex's chat line (`0x625190` → `0x62c160`).
 ///
 /// **The edge is the event.** The wire never says "this unit died"; it says the unit's health is
-/// zero, or sets its dead flag, in an ordinary descriptor update — so the line comes off a diff
-/// against the previous frame, and a unit that streams in *already* dead produces none (which is
-/// what the reference does too: its reflex fires on the transition, not on the state).
+/// zero in an ordinary descriptor update — so the line comes off the `UNIT_FIELD_HEALTH` field
+/// edge, the reference's own watcher `0x6046f0` whose alive→dead arm (`OLD > 0 && NEW ≤ 0` at
+/// `0x6047a3`) reaches the reflex (decision 2297), and a unit that streams in *already* dead
+/// produces none (the edge stream is create-suppressed: the reflex fires on the transition, not
+/// on the state).
 ///
 /// **The XP-award suppression is deliberately not modelled**, and is named rather than dropped:
 /// `[CGUnit+0xc58] bit 3`, set only in the `SMSG_LOG_XPGAIN` chain, makes the death reflex emit the
@@ -130,27 +130,18 @@ const DESTROYED_EFFECTS: [u32; 10] = [50, 74, 87, 88, 89, 90, 104, 105, 106, 107
 pub(crate) fn death_lines(
     ctx: WatchCtx,
     stores: Query<(Entity, &ObjectStore)>,
-    guids: Query<&crate::net::Guid>,
-    changed: Query<Entity, Changed<ObjectStore>>,
+    mut edges: MessageReader<FieldChanged>,
     poses: Query<&Transform>,
     mut log: ResMut<ChatLog>,
-    mut was_dead: Local<EntityHashMap<bool>>,
 ) {
-    for entity in changed.iter() {
-        let Ok((_, store)) = stores.get(entity) else {
-            continue;
-        };
-        let dead = store.0.unit_is_dead();
-        let seen = was_dead.insert(entity, dead);
-        // No previous frame for this entity: it streamed in at whatever state it is in, which is
-        // not a death.
-        let Some(false) = seen else { continue };
-        if !dead {
+    for e in edges.read() {
+        if !(e.unit_field(benilla_protocol::field::FIELD_UNIT_HEALTH) && e.old > 0 && e.new == 0) {
             continue;
         }
-        let Ok(&crate::net::Guid(guid)) = guids.get(entity) else {
+        let Ok((_, store)) = stores.get(e.entity) else {
             continue;
         };
+        let guid = e.guid;
         let class = ctx.classify(guid, &stores);
         // A summoned thing is *destroyed*; a living one *dies*. The test is the creating spell's
         // first effect, which is why it needs the spell catalog at all.
@@ -178,23 +169,26 @@ pub(crate) fn death_lines(
             Named::Ready,
         );
     }
-    was_dead.retain(|e, _| stores.contains(*e));
 }
 
 /// The aura lines (`0x62b480` / `0x62b800`).
 ///
-/// **Three edges out of one diff**, because the reference reads two descriptor arrays through two
-/// callbacks and words three sentences:
+/// **Three edges out of two watches**, because the reference reads two descriptor arrays through
+/// two callbacks and words three sentences — and since decision 2297 those are literally the
+/// triggers here, one field edge each, with no snapshot of the slots kept anywhere:
 ///
-/// - a slot that filled → `AURAADDED{SELF,OTHER}{HARMFUL,HELPFUL}`, at the PERIODIC chat types
-///   (harmful takes the `…_DAMAGE` row, helpful the `…_BUFFS` one) — not the `AURA_GONE` block,
-///   which is the departure's alone;
-/// - a slot that emptied → `AURAREMOVED{SELF,OTHER}`, at `0x41`/`0x42`/`0x43`;
-/// - a slot whose stack count ROSE → `AURAAPPLICATIONADDED*`, and only when the spell can stack at
-///   all. We approximate the reference's `SpellRec->StackAmount > 1` gate with the observed count:
-///   a stack that rose past one is a spell that stacks. It differs only for a first application of
+/// - a `UNIT_FIELD_AURA` slot whose NEW value is a spell → `AURAADDED{SELF,OTHER}{HARMFUL,HELPFUL}`,
+///   at the PERIODIC chat types (harmful takes the `…_DAMAGE` row, helpful the `…_BUFFS` one) —
+///   not the `AURA_GONE` block, which is the departure's alone (`0x604d00`'s add arm);
+/// - a slot whose OLD value was a spell → `AURAREMOVED{SELF,OTHER}`, at `0x41`/`0x42`/`0x43`
+///   (the remove arm; a replace is one of each, the arrival worded first);
+/// - a `UNIT_FIELD_AURAAPPLICATIONS` byte that ROSE, on a slot whose spell did not move this
+///   frame → `AURAAPPLICATIONADDED*` (`0x604ea0`), and only when the spell can stack at all. We
+///   approximate the reference's `SpellRec->StackAmount > 1` gate with the observed count: a
+///   stack that rose past one is a spell that stacks. It differs only for a first application of
 ///   a stacking aura, which the reference words as a plain `AURAADDED*` — and so do we, because a
-///   0→1 step is a *fill*, not an increase.
+///   fresh slot's count is not a rise (its `AURA` dword moved in the same block, so its byte is
+///   skipped here).
 ///
 /// **HARMFUL is the SLOT INDEX, not a flag** (§4.4, three byte sites): slots `0x20`–`0x2f` are
 /// harmful, every other slot helpful. `UNIT_FIELD_AURAFLAGS` is only an occupancy predicate — using
@@ -202,121 +196,125 @@ pub(crate) fn death_lines(
 pub(crate) fn aura_lines(
     ctx: WatchCtx,
     stores: Query<(Entity, &ObjectStore)>,
-    guids: Query<&crate::net::Guid>,
-    changed: Query<Entity, Changed<ObjectStore>>,
+    mut edges: MessageReader<FieldChanged>,
     poses: Query<&Transform>,
     mut log: ResMut<ChatLog>,
-    // Per entity, per slot: `(spell id, stacks)` as of the last frame. Slot-keyed rather than
-    // spell-keyed because the sentence's harmful/helpful half IS the slot.
-    mut seen: Local<EntityHashMap<Vec<(u8, u32, u8)>>>,
 ) {
+    use benilla_protocol::field::{FIELD_UNIT_AURA, FIELD_UNIT_AURAAPPLICATIONS};
     /// The first harmful aura slot — `0x20`. Slots below it are helpful (§4.4).
-    const FIRST_HARMFUL_SLOT: u8 = 0x20;
+    const FIRST_HARMFUL_SLOT: u16 = 0x20;
+    const SLOTS: u16 = benilla_protocol::messages::UNIT_AURA_SLOTS as u16;
+    let harmful = |slot: u16| slot >= FIRST_HARMFUL_SLOT;
 
-    for entity in changed.iter() {
-        let Ok((_, store)) = stores.get(entity) else {
-            continue;
-        };
-        let now: Vec<(u8, u32, u8)> = store
-            .0
-            .unit_auras()
-            .map(|a| (a.slot, a.spell_id, a.stacks))
-            .collect();
-        let prev = seen.insert(entity, now.clone());
-        // First sight of this unit: its standing auras are not arrivals.
-        let Some(prev) = prev else { continue };
-        let Ok(&crate::net::Guid(guid)) = guids.get(entity) else {
-            continue;
-        };
-        let class = ctx.classify(guid, &stores);
-        let harmful = |slot: u8| slot >= FIRST_HARMFUL_SLOT;
-        let find =
-            |list: &[(u8, u32, u8)], slot: u8| list.iter().find(|(s, _, _)| *s == slot).copied();
+    // The whole frame's batch first: the applications leg must know which slots' `AURA` dword
+    // moved in the same block, and the two arrays sit 66 dwords apart in the ascending walk.
+    let batch: Vec<FieldChanged> = edges.read().copied().collect();
+    let slot_edges: Vec<&FieldChanged> = batch
+        .iter()
+        .filter(|e| e.unit_array_slot(FIELD_UNIT_AURA, SLOTS).is_some())
+        .collect();
+    let slot_moved = |entity: Entity, slot: u16| {
+        slot_edges
+            .iter()
+            .any(|e| e.entity == entity && e.index - FIELD_UNIT_AURA == slot)
+    };
 
-        for &(slot, spell_id, stacks) in &now {
-            let Some(spell) = ctx.spell_name(spell_id) else {
-                continue;
-            };
-            let fills = |amount: i64| Fills {
-                spell: spell.clone(),
-                amount,
-                ..Default::default()
-            };
-            match find(&prev, slot) {
-                // The slot held a DIFFERENT spell, or nothing: this aura arrived.
-                Some((_, was, _)) if was == spell_id => {
-                    let Some((_, _, before)) = find(&prev, slot) else {
-                        continue;
-                    };
-                    if stacks <= before || stacks <= 1 {
-                        continue;
-                    }
-                    let Some(kind) = periodic_kind(class, !harmful(slot)) else {
-                        continue;
-                    };
-                    queue_one(
-                        &mut log,
-                        &ctx,
-                        &poses,
-                        kind,
-                        if harmful(slot) {
-                            super::AURAAPPLICATIONADDED_HARMFUL
-                        } else {
-                            super::AURAAPPLICATIONADDED_HELPFUL
-                        },
-                        (guid, class),
-                        ctx.ranges.class(class),
-                        fills(i64::from(stacks)),
-                        Named::Ready,
-                    );
-                }
-                _ => {
-                    let Some(kind) = periodic_kind(class, !harmful(slot)) else {
-                        continue;
-                    };
-                    queue_one(
-                        &mut log,
-                        &ctx,
-                        &poses,
-                        kind,
-                        if harmful(slot) {
-                            super::AURAADDED_HARMFUL
-                        } else {
-                            super::AURAADDED_HELPFUL
-                        },
-                        (guid, class),
-                        ctx.ranges.class(class),
-                        fills(0),
-                        Named::Ready,
-                    );
-                }
+    for e in &slot_edges {
+        let slot = e.index - FIELD_UNIT_AURA;
+        let class = ctx.classify(e.guid, &stores);
+        // Arrival first: the slot now holds a spell (a fill, or a replace's new half).
+        if e.new != 0 {
+            if let (Some(spell), Some(kind)) =
+                (ctx.spell_name(e.new), periodic_kind(class, !harmful(slot)))
+            {
+                queue_one(
+                    &mut log,
+                    &ctx,
+                    &poses,
+                    kind,
+                    if harmful(slot) {
+                        super::AURAADDED_HARMFUL
+                    } else {
+                        super::AURAADDED_HELPFUL
+                    },
+                    (e.guid, class),
+                    ctx.ranges.class(class),
+                    Fills {
+                        spell,
+                        ..Default::default()
+                    },
+                    Named::Ready,
+                );
             }
         }
-        // Departures: a slot that held a spell and no longer holds THAT spell.
-        for &(slot, spell_id, _) in &prev {
-            if find(&now, slot).is_some_and(|(_, id, _)| id == spell_id) {
+        // Departure: the slot held a spell and no longer holds THAT spell.
+        if e.old != 0 {
+            if let Some(spell) = ctx.spell_name(e.old) {
+                queue_one(
+                    &mut log,
+                    &ctx,
+                    &poses,
+                    aura_gone_kind(class),
+                    super::AURAREMOVED,
+                    (e.guid, class),
+                    ctx.ranges.class(class),
+                    Fills {
+                        spell,
+                        ..Default::default()
+                    },
+                    Named::Ready,
+                );
+            }
+        }
+    }
+
+    // The stack-count leg: byte-packed, four slots per dword, the wire byte `stack - 1`.
+    for e in batch.iter().filter(|e| {
+        e.unit_array_slot(FIELD_UNIT_AURAAPPLICATIONS, SLOTS / 4)
+            .is_some()
+    }) {
+        let word = e.index - FIELD_UNIT_AURAAPPLICATIONS;
+        let Ok((_, store)) = stores.get(e.entity) else {
+            continue; // gone in the same drain
+        };
+        for byte in 0..4u16 {
+            let slot = word * 4 + byte;
+            let (before, now) = ((e.old >> (byte * 8)) & 0xff, (e.new >> (byte * 8)) & 0xff);
+            // A rise past one, on a slot whose spell stayed put this block.
+            if now <= before || now == 0 || slot_moved(e.entity, slot) {
                 continue;
             }
-            let Some(spell) = ctx.spell_name(spell_id) else {
+            let Some(aura) = store.0.unit_aura(slot as u8) else {
+                continue;
+            };
+            let Some(spell) = ctx.spell_name(aura.spell_id) else {
+                continue;
+            };
+            let class = ctx.classify(e.guid, &stores);
+            let Some(kind) = periodic_kind(class, !harmful(slot)) else {
                 continue;
             };
             queue_one(
                 &mut log,
                 &ctx,
                 &poses,
-                aura_gone_kind(class),
-                super::AURAREMOVED,
-                (guid, class),
+                kind,
+                if harmful(slot) {
+                    super::AURAAPPLICATIONADDED_HARMFUL
+                } else {
+                    super::AURAAPPLICATIONADDED_HELPFUL
+                },
+                (e.guid, class),
                 ctx.ranges.class(class),
                 Fills {
                     spell,
+                    amount: i64::from(now + 1),
                     ..Default::default()
                 },
                 Named::Ready,
             );
         }
     }
-    seen.retain(|e, _| stores.contains(*e));
 }
 
 /// The pet-loyalty line (`0x5ff860` → `0x62d440`) — `UNIT_FIELD_BYTES_1` byte 1 moving.
@@ -327,26 +325,19 @@ pub(crate) fn aura_lines(
 pub(crate) fn pet_loyalty_lines(
     ctx: WatchCtx,
     stores: Query<(Entity, &ObjectStore)>,
-    guids: Query<&crate::net::Guid>,
-    changed: Query<Entity, Changed<ObjectStore>>,
+    mut edges: MessageReader<FieldChanged>,
     mut log: ResMut<ChatLog>,
-    mut seen: Local<EntityHashMap<u8>>,
 ) {
-    for entity in changed.iter() {
-        let Ok((_, store)) = stores.get(entity) else {
+    for e in edges.read() {
+        if !e.unit_field(benilla_protocol::field::FIELD_UNIT_BYTES_1) {
             continue;
-        };
-        let level = store.0.unit_loyalty_level();
-        let Some(before) = seen.insert(entity, level) else {
-            continue;
-        };
+        }
+        // Byte 1 of the word — the same shift `ObjectFields::unit_loyalty_level` reads through.
+        let (before, level) = (((e.old >> 8) & 0xff) as u8, ((e.new >> 8) & 0xff) as u8);
         if level == before || level == 0 || before == 0 {
             continue;
         }
-        let Ok(&crate::net::Guid(guid)) = guids.get(entity) else {
-            continue;
-        };
-        if ctx.classify(guid, &stores) != UnitClass::MyPet {
+        if ctx.classify(e.guid, &stores) != UnitClass::MyPet {
             continue;
         }
         log.push_combat(PendingCombat {
@@ -364,5 +355,4 @@ pub(crate) fn pet_loyalty_lines(
             tries: 0,
         });
     }
-    seen.retain(|e, _| stores.contains(*e));
 }
diff --git a/crates/benilla-app/src/ui_chat/feed.rs b/crates/benilla-app/src/ui_chat/feed.rs
index 71d17d70..af366b4d 100644
--- a/crates/benilla-app/src/ui_chat/feed.rs
+++ b/crates/benilla-app/src/ui_chat/feed.rs
@@ -765,13 +765,12 @@ pub(super) struct SpeakerEffects<'w> {
 
 /// Drain [`ChatLog`]: resolve names (ask-once, bounded), build events, [`route`] them. Also ticks
 /// the whisper-chime throttle.
-#[allow(clippy::too_many_arguments)] // a Bevy system's param list IS its dependency set
 pub(super) fn feed_chat(
     script: Option<NonSendMut<benilla_ui::script::UiScript>>,
     mut log: ResMut<ChatLog>,
     mut windows: ResMut<ChatWindows>,
     mut channels: ResMut<ChannelState>,
-    mut names: ResMut<NameCache>,
+    names: Res<NameCache>,
     mut speaker: SpeakerEffects,
     commands: Res<NetCommands>,
     // The text-emote sentence seam (decision 1274): the tables, plus the guid the composer's
@@ -788,7 +787,7 @@ pub(super) fn feed_chat(
     // The combat log's item-name seam (1703): the four families whose sentence names an ITEM
     // (`TRADESKILL_LOG`, `FEEDPET_LOG`, `ITEMENCHANTMENT*`, `SPELLDURABILITYDAMAGE`) resolve it
     // here, through the same ask-once cache the reference's own deferred queue re-runs against.
-    mut items: ResMut<crate::items::Items>,
+    items: Res<crate::items::Items>,
     // The two 1.12 text filters (decision 2077), bundled for the same reason `SpeakerEffects` is:
     // this list is at the sixteen-parameter ceiling. This IS the reference's `0x49a870`, so both
     // arms belong here and nowhere else.
@@ -863,7 +862,7 @@ pub(super) fn feed_chat(
                         subject_guid,
                         &guids,
                         &stores,
-                        &mut names,
+                        &names,
                         &commands,
                     );
                     let (text, clean) = crate::npc_text::substitute_checked(
@@ -1258,7 +1257,7 @@ pub(super) fn feed_chat(
                     if guid == 0 {
                         continue;
                     }
-                    match super::combat::object_name(guid, &mut names, &commands) {
+                    match super::combat::object_name(guid, &names, &commands) {
                         Some(name) if slot == 0 => line.fills.attacker = name,
                         Some(name) => line.fills.victim = name,
                         None => wait = true,
@@ -1279,7 +1278,7 @@ pub(super) fn feed_chat(
                         }
                     }
                     super::combat::Named::Unit(guid) => {
-                        match super::combat::object_name(guid, &mut names, &commands) {
+                        match super::combat::object_name(guid, &names, &commands) {
                             Some(name) => line.fills.named = name,
                             None => wait = true,
                         }
diff --git a/crates/benilla-app/src/ui_chat/idle.rs b/crates/benilla-app/src/ui_chat/idle.rs
index def9e066..09c6c221 100644
--- a/crates/benilla-app/src/ui_chat/idle.rs
+++ b/crates/benilla-app/src/ui_chat/idle.rs
@@ -60,6 +60,25 @@ use super::feed::ChatLog;
 #[derive(Resource, Debug, Clone, Copy, Default)]
 pub(crate) struct LastInput(Duration);
 
+impl LastInput {
+    /// Stamp the clock as an **unattended probe** — the one caller outside [`stamp_input`].
+    ///
+    /// A probe is a client with nobody at the keyboard, and this timer is the one place where that
+    /// is not a harmless difference: a probe that stands still in a battleground goes AFK at five
+    /// minutes exactly as the reference would, and vmangos then removes an AFK player from the
+    /// battleground outright (`Player::ToggleAFK` → `LeaveBattleground`). Two faithful behaviours,
+    /// one on each side, combining to eject an instrument before a match can end — which is what
+    /// `capture::probe_bg`'s first long run found, at t=300 s, with the census reading Stormwind.
+    ///
+    /// So a probe that means to stand in for a **present** player says so here, rather than the
+    /// alternative dodges: turning the idle handler off (it would stop testing the thing the
+    /// reference does), or having the probe jiggle the mouse (a synthetic input event to fool our
+    /// own dispatcher, which is a lie told one layer lower down and harder to see).
+    pub(crate) fn stamp_present(&mut self, now: Duration) {
+        self.0 = now;
+    }
+}
+
 /// **5 minutes** — `0x482ecd lea ecx,[eax-0x493e0]`, `0x493e0` = 300 000 ms.
 const AUTO_AFK_AFTER: Duration = Duration::from_millis(300_000);
 
@@ -217,7 +236,6 @@ pub(crate) fn idle_action(idle: Duration, gates: IdleGates) -> IdleAction {
 
 /// The handler proper. In-world only: `0x482ea0` is `WorldFrame::Render`, so there is no idle
 /// timer at the glue screens.
-#[allow(clippy::too_many_arguments)]
 pub(crate) fn idle_handler(
     time: Res<Time<Real>>,
     last: Res<LastInput>,
diff --git a/crates/benilla-app/src/ui_chat/input/mod.rs b/crates/benilla-app/src/ui_chat/input/mod.rs
index d42c70c0..2348cddd 100644
--- a/crates/benilla-app/src/ui_chat/input/mod.rs
+++ b/crates/benilla-app/src/ui_chat/input/mod.rs
@@ -15,19 +15,18 @@ use bevy::prelude::*;
 mod parse;
 #[cfg(test)]
 pub(super) use parse::lua_quoted_string;
-pub(super) use parse::{console_command, parse_line, ParsedChat};
+pub(super) use parse::{parse_line, ParsedChat};
 
 use crate::creature_anim::{move_flags, MovementState};
 use crate::net::{ClientCommand, NetCommands, SelfPlayer};
 use crate::target::Selection;
 
-#[allow(clippy::too_many_arguments)] // a Bevy system's param list IS its dependency set
 /// The target half of the ref's `GetSlashCmdTarget` (ChatFrame.lua:650-658): a bare party
 /// command falls back to the current selection iff it's a PLAYER; anything else is `None` (the
 /// ref's silent no-op). The name is cache-resolved — a streamed player target is always cached.
 fn target_player_name(
     selection: &Selection,
-    names: &mut crate::names::NameCache,
+    names: &crate::names::NameCache,
     commands: &NetCommands,
 ) -> Option<String> {
     let guid = selection.guid?;
@@ -67,7 +66,6 @@ pub(super) fn emote_target(selection: &Selection, me: Option<Entity>) -> u64 {
     }
 }
 
-#[allow(clippy::too_many_arguments)]
 /// The client-local diagnostics' inputs, as one [`SystemParam`] — [`drain_chat_input`] is at the
 /// 16-parameter ceiling, and a named struct beats a nested tuple nobody can read.
 ///
@@ -118,7 +116,10 @@ pub(super) struct ChatProbes<'w, 's> {
 ///   [`crate::target`]'s shared resolver so they commit through the same SetSelection path a click
 ///   does. Chat never writes [`Selection`] itself.
 #[derive(bevy::ecs::system::SystemParam)]
-pub(super) struct ChatOut<'w> {
+pub(super) struct ChatOut<'w, 's> {
+    /// The console registry's lane: a `/console` line runs against the world at the next sync
+    /// point ([`crate::console::execute`]).
+    console: Commands<'w, 's>,
     stand: MessageWriter<'w, crate::player::StandStateRequest>,
     sheath: MessageWriter<'w, crate::creature_anim::SheathRequest>,
     target: MessageWriter<'w, crate::target::TargetByNameRequest>,
@@ -136,10 +137,6 @@ pub(super) struct ChatOut<'w> {
     /// since a resource reachable twice from one system is a `B0002` panic on the first live frame
     /// (1903). Nothing else in this system touches `UiErrorKeys`.
     ui_errors: ResMut<'w, crate::ui_action::UiErrorKeys>,
-    /// `/console detailDoodadAlpha` — the ground-clutter cutout reference. Rides this bundle for
-    /// the same arity reason as `ui_errors` above, and like it, nothing else in this system
-    /// touches `ClutterConfig` (a resource reachable twice from one system is a `B0002` panic).
-    clutter: ResMut<'w, benilla_world::clutter::ClutterConfig>,
 }
 
 // One parameter per concern — the chat drain fans out to every command's consumer.
@@ -170,12 +167,11 @@ fn engine_verbs(
         out.push((String::new(), ParsedChat::Uninvite { name: Some(name) }));
     }
     for line in script.take_console_lines() {
-        // `ConsoleExec` already wrote the CVar lines to the store; what reaches here is a
-        // console COMMAND — a name the engine's own command table owns rather than
-        // `CVar::Register`'s, which is why `detailDoodadAlpha` lives here and not in the CVar
-        // store (wow-re: registrar `0x63f9e0`, so it never persists — 2012).
-        let parsed = console_command(&line);
-        out.push((line, parsed));
+        // `ConsoleExec` already wrote the valued CVar lines to the store; what reaches here is
+        // a console COMMAND — a name the engine's own command table owns rather than
+        // `CVar::Register`'s (`detailDoodadAlpha`: registrar `0x63f9e0`, so it never persists —
+        // 2012) — or a bare CVar name for the registry to print (2303).
+        out.push((line.clone(), ParsedChat::Console { line }));
     }
     for cmd in script.take_channel_commands() {
         out.push((String::new(), ParsedChat::Channel(cmd)));
@@ -203,7 +199,6 @@ fn manual_join_or_leave(
     }
 }
 
-#[allow(clippy::too_many_arguments)]
 pub(super) fn drain_chat_input(
     script: Option<NonSendMut<benilla_ui::script::UiScript>>,
     mut chat_log: ResMut<super::feed::ChatLog>,
@@ -644,7 +639,7 @@ pub(super) fn drain_chat_input(
             },
             ParsedChat::Invite { name } => {
                 if let Some(name) =
-                    name.or_else(|| target_player_name(&selection, &mut names, &commands))
+                    name.or_else(|| target_player_name(&selection, &names, &commands))
                 {
                     let _ = commands.0.send(ClientCommand::GroupInvite { name });
                 }
@@ -657,14 +652,14 @@ pub(super) fn drain_chat_input(
             }
             ParsedChat::Uninvite { name } => {
                 if let Some(name) =
-                    name.or_else(|| target_player_name(&selection, &mut names, &commands))
+                    name.or_else(|| target_player_name(&selection, &names, &commands))
                 {
                     let _ = commands.0.send(ClientCommand::GroupUninvite { name });
                 }
             }
             ParsedChat::Promote { name } => {
                 if let Some(name) =
-                    name.or_else(|| target_player_name(&selection, &mut names, &commands))
+                    name.or_else(|| target_player_name(&selection, &names, &commands))
                 {
                     // The 1.12 wire form is a guid (CMSG_GROUP_SET_LEADER) — resolve against the
                     // roster; a miss answers with the server's own would-be error string
@@ -695,7 +690,7 @@ pub(super) fn drain_chat_input(
             // player gate, arbiter echo) instead of a second one here.
             ParsedChat::Duel { name } => {
                 if let Some(name) =
-                    name.or_else(|| target_player_name(&selection, &mut names, &commands))
+                    name.or_else(|| target_player_name(&selection, &names, &commands))
                 {
                     script.queue_duel_request(benilla_ui::script::DuelRequest::StartByName(name));
                 }
@@ -713,7 +708,7 @@ pub(super) fn drain_chat_input(
             // GetSlashCmdTarget(msg)` guard does.
             ParsedChat::Target { name } => {
                 if let Some(name) =
-                    name.or_else(|| target_player_name(&selection, &mut names, &commands))
+                    name.or_else(|| target_player_name(&selection, &names, &commands))
                 {
                     chat_out
                         .target
@@ -949,46 +944,26 @@ pub(super) fn drain_chat_input(
             ParsedChat::Quit => {
                 script.queue_session_request(benilla_ui::script::SessionRequest::Quit)
             }
-            // `/reload` and `/console reloadUI` — the same deferred rebuild `ReloadUI()` queues
-            // (decision 1291), through the same session seam as the exit verbs above.
+            // `/reload` — the same deferred rebuild `ReloadUI()` queues (decision 1291), through
+            // the same session seam as the exit verbs above.
             ParsedChat::ReloadUi => {
                 script.queue_session_request(benilla_ui::script::SessionRequest::ReloadUi)
             }
-            // `/console detailDoodadAlpha [0..255]` — the reference's own console command
-            // (`0x6739a0`), and the dial that decides where ground clutter first appears: the
-            // detail-doodad draw alpha-tests `texel.a x distance_ramp` against it, so 128 (the
-            // default) hides everything past ~61 yd of the 70 yd fade horizon and a lower value
-            // walks that onset out toward the horizon. Non-persistent, exactly as the reference's
-            // command table is.
-            ParsedChat::DetailDoodadAlpha { value } => {
-                let text = match value {
-                    Some(v) => {
-                        chat_out.clutter.alpha_ref = f32::from(v) / 255.0;
-                        format!("detailDoodadAlpha set to {v}")
+            // A `/console` line for the command registry (decision 2303). Deferred to the world
+            // because a command's body is `fn(&mut World, &str)` — the reference's handlers run
+            // against the whole client too — and its lines land in the chat frame as system
+            // text, the seam `/console` output has always used.
+            ParsedChat::Console { line } => {
+                chat_out.console.queue(move |world: &mut World| {
+                    let lines = crate::console::execute(world, &line);
+                    let mut log = world.resource_mut::<super::feed::ChatLog>();
+                    for text in lines {
+                        log.push_event(super::event::ChatEvent::text_only(
+                            super::event::ChatEventKind::System,
+                            text,
+                        ));
                     }
-                    None => format!(
-                        "detailDoodadAlpha is {} (usage: /console detailDoodadAlpha 0-255)",
-                        (chat_out.clutter.alpha_ref * 255.0).round() as u32
-                    ),
-                };
-                chat_log.push_event(super::event::ChatEvent::text_only(
-                    super::event::ChatEventKind::System,
-                    text,
-                ));
-            }
-            ParsedChat::ConsoleUnknown { cmd } => {
-                const IMPLEMENTED: &str = "reloadUI, detailDoodadAlpha, and `<cvar> <value>`";
-                let text = if cmd.is_empty() {
-                    format!("console: no command given (this client implements: {IMPLEMENTED})")
-                } else {
-                    format!(
-                        "console: '{cmd}' is not implemented (this client implements: {IMPLEMENTED})"
-                    )
-                };
-                chat_log.push_event(super::event::ChatEvent::text_only(
-                    super::event::ChatEventKind::System,
-                    text,
-                ));
+                });
             }
             // The reference's own handler body, run in the VM (the 0668 posture) — `/trade`,
             // `/inspect`, the loot-method trio, and `/script`'s raw chunk.
@@ -1574,8 +1549,8 @@ fn is_dnd(self_q: &Query<&crate::net::ObjectStore, With<crate::net::SelfPlayer>>
 /// `autoClearAFK` — registered default `"1"` (`0x5e24d4 push 0x82e748`). Its reader tests
 /// `[cvar+0x28]` for non-zero (`0x5eb84b`), and with the CVar OFF the clear is a **total** no-op:
 /// no echo, no mirror write, no packet.
-fn auto_clear_afk(cvars: &crate::cvars::CvarPersist) -> bool {
-    cvars.stored("autoClearAFK").is_none_or(|v| v != "0")
+fn auto_clear_afk(cvars: &crate::cvars::Cvars) -> bool {
+    cvars.flag("autoClearAFK").unwrap_or(true)
 }
 
 /// Turn an addon's `SendChatMessage` calls into sends (decision 1199).
@@ -1594,7 +1569,7 @@ pub(super) fn drain_addon_chat_sends(
     // The optimistic AFK mirror (`[0xb6e5cc]`) the `/afk` toggle reads and writes — 2088.
     mut mirror: ResMut<super::away::AfkMirror>,
     // `autoClearAFK`, whose registered default is `"1"` — the gate on the implicit clear.
-    cvars: Res<crate::cvars::CvarPersist>,
+    cvars: Res<crate::cvars::Cvars>,
     // Our own descriptor, for the DND arm's LIVE `PLAYER_FLAGS & 0x4` read (DND has no mirror).
     self_q: Query<&crate::net::ObjectStore, With<crate::net::SelfPlayer>>,
 ) {
diff --git a/crates/benilla-app/src/ui_chat/input/parse.rs b/crates/benilla-app/src/ui_chat/input/parse.rs
index b07557d6..96a66ea3 100644
--- a/crates/benilla-app/src/ui_chat/input/parse.rs
+++ b/crates/benilla-app/src/ui_chat/input/parse.rs
@@ -163,23 +163,17 @@ pub(in crate::ui_chat) enum ParsedChat {
     /// straight out of the shipped `GlobalStrings.lua` (decision 0983). Resolved in the drain,
     /// which holds the VM, so the text can never go stale against the install.
     MacroHelp,
-    /// `/reload`, `/console reloadUI`, or `ReloadUI()` typed through `/script` — tear the UI
-    /// session down and build a new one without leaving the world (decision 1291). Queued on the
-    /// session seam like [`ParsedChat::Logout`]; [`crate::ui_script::run_pending_reload`] runs it
-    /// at the top of the next frame.
+    /// `/reload`, or `ReloadUI()` typed through `/script` — tear the UI session down and build a
+    /// new one without leaving the world (decision 1291). Queued on the session seam like
+    /// [`ParsedChat::Logout`]; [`crate::ui_script::run_pending_reload`] runs it at the top of
+    /// the next frame. (`/console reloadUI` reaches the same request through the command
+    /// registry's `reloadUI`.)
     ReloadUi,
-    /// `/console detailDoodadAlpha [0..255]` — the **ground-clutter cutout reference**, a real
-    /// console command in the reference (`0x6739a0`; registrar `0x63f9e0`, a command table and not
-    /// `CVar::Register`, so it never persists — 1804 does not apply to it). It decides where grass
-    /// first appears: the detail-doodad draw alpha-tests `texel.a x distance_ramp` against this, so
-    /// at the default 128 nothing survives past ~61 yd of the 70 yd horizon, and lowering it walks
-    /// that onset out toward the horizon. Bare = report the current value (the reference reads an
-    /// uninitialised stack slot there; a readout is the useful reading of "no argument").
-    DetailDoodadAlpha { value: Option<u8> },
-    /// A `/console` command this client does not implement — the engine console is otherwise not
-    /// here. Answered with a system line naming what was asked, because a claimed alias that
-    /// silently drops its argument reads as a hang.
-    ConsoleUnknown { cmd: String },
+    /// A `/console` line the engine's CVar store did not consume — a command name, or a bare
+    /// CVar name to print — for the command registry ([`crate::console::execute`], decision
+    /// 2303): the reference's `ConsoleCommand` table, which every subsystem registers into and
+    /// which answers an unknown line by saying so.
+    Console { line: String },
     /// A slash line matching neither a chat command nor an `EmotesText` name — dropped.
     Unknown,
 }
@@ -278,27 +272,6 @@ pub(in crate::ui_chat) fn lua_quoted_string(s: &str) -> String {
 
 /// The per-command argument grammar. Each arm is the reference handler's own body reduced to what
 /// it does with `msg` — the aliases that reach it are the table's business, never this function's.
-/// Classify one **console command** line — what is left after `ConsoleExec` has written the CVar
-/// lines (2008), i.e. a name the engine's own command table owns rather than `CVar::Register`'s.
-/// Pure, so the arms are testable without a VM; called from `engine_verbs`'s console drain.
-pub(in crate::ui_chat) fn console_command(line: &str) -> ParsedChat {
-    let mut words = line.split_whitespace();
-    match words.next() {
-        Some(cmd) if cmd.eq_ignore_ascii_case("reloadui") => ParsedChat::ReloadUi,
-        // The reference rejects an out-of-range value rather than saturating
-        // (`0x6739b9: cmp eax,0xff; jbe`), so out-of-range and unparseable are the same `None`
-        // here and the handler says so. A bare name reports the current value.
-        Some(cmd) if cmd.eq_ignore_ascii_case("detaildoodadalpha") => {
-            ParsedChat::DetailDoodadAlpha {
-                value: words.next().and_then(|v| v.parse::<u8>().ok()),
-            }
-        }
-        _ => ParsedChat::ConsoleUnknown {
-            cmd: line.trim().to_string(),
-        },
-    }
-}
-
 fn slash_command(index: SlashIndex, args: &str) -> ParsedChat {
     use SlashIndex as S;
     match index {
diff --git a/crates/benilla-app/src/ui_chat/logging.rs b/crates/benilla-app/src/ui_chat/logging.rs
index 8bcd81d7..9d1d830f 100644
--- a/crates/benilla-app/src/ui_chat/logging.rs
+++ b/crates/benilla-app/src/ui_chat/logging.rs
@@ -130,7 +130,11 @@ pub(super) fn sync_chat_logging(
 pub(super) fn plugin(app: &mut App) {
     app.add_systems(
         Update,
-        sync_chat_logging.run_if(in_state(crate::char_select::ClientState::InWorld)),
+        // After the tick: the flags are Lua's (`LoggingChat`/`LoggingCombat`), read the frame
+        // they move.
+        sync_chat_logging
+            .after(crate::ui_script::UiInput)
+            .in_set(crate::char_select::InWorldGated),
     );
 }
 
diff --git a/crates/benilla-app/src/ui_chat/settings.rs b/crates/benilla-app/src/ui_chat/settings.rs
index 76288545..b495232f 100644
--- a/crates/benilla-app/src/ui_chat/settings.rs
+++ b/crates/benilla-app/src/ui_chat/settings.rs
@@ -809,11 +809,16 @@ pub(super) fn plugin(app: &mut App) {
         // [`restore_chat_looks`], decision 2119. Only the watcher belongs in `Update`.
         .add_systems(
             Update,
-            watch_chat_looks.run_if(in_state(crate::char_select::ClientState::InWorld)),
+            // After the tick: every write it watches is Lua's.
+            watch_chat_looks
+                .after(crate::ui_script::UiInput)
+                .in_set(crate::char_select::InWorldGated),
         )
         .add_systems(
             Update,
-            save_chat_looks.run_if(in_state(crate::char_select::ClientState::InWorld)),
+            save_chat_looks
+                .after(crate::ui_script::UiInput)
+                .in_set(crate::char_select::InWorldGated),
         );
     // **The session-end flush is not registered here.** It is called from inside
     // `ui_script::end_ui_session` ([`fold_dying_vm_chat_cache`]) so that it covers `/reload` — a
diff --git a/crates/benilla-app/src/ui_chat/tests.rs b/crates/benilla-app/src/ui_chat/tests.rs
index ed5edf35..873a76ef 100644
--- a/crates/benilla-app/src/ui_chat/tests.rs
+++ b/crates/benilla-app/src/ui_chat/tests.rs
@@ -2540,47 +2540,6 @@ fn level_up_gains_are_matched_by_level_and_a_miss_is_not_an_absence() {
     );
 }
 
-/// `detailDoodadAlpha` — the reference's own console command (`0x6739a0`), and the dial that
-/// decides where ground clutter first appears (the detail-doodad draw alpha-tests
-/// `texel.a × distance_ramp` against it). It is a **console command**, not a CVar (registrar
-/// `0x63f9e0`, not `CVar::Register`), so it arrives through the console drain rather than the
-/// CVar store `ConsoleExec` writes — this pins the classifier that splits the two. The three
-/// cases the reference distinguishes: in range sets it, out of range is REJECTED rather than
-/// saturated (`0x6739b9: cmp eax,0xff; jbe`), and unparseable is that same rejection.
-#[test]
-fn console_detail_doodad_alpha_parses() {
-    use super::input::{console_command, ParsedChat};
-    assert_eq!(
-        console_command("detailDoodadAlpha 8"),
-        ParsedChat::DetailDoodadAlpha { value: Some(8) }
-    );
-    // The console is case-insensitive, like the engine's own table lookup.
-    assert_eq!(
-        console_command("DETAILDOODADALPHA 255"),
-        ParsedChat::DetailDoodadAlpha { value: Some(255) }
-    );
-    assert_eq!(
-        console_command("detailDoodadAlpha 256"),
-        ParsedChat::DetailDoodadAlpha { value: None }
-    );
-    assert_eq!(
-        console_command("detailDoodadAlpha wat"),
-        ParsedChat::DetailDoodadAlpha { value: None }
-    );
-    // Bare = report the current value; and the sibling command still routes.
-    assert_eq!(
-        console_command("detailDoodadAlpha"),
-        ParsedChat::DetailDoodadAlpha { value: None }
-    );
-    assert_eq!(console_command("reloadUI"), ParsedChat::ReloadUi);
-    assert_eq!(
-        console_command("nosuchthing"),
-        ParsedChat::ConsoleUnknown {
-            cmd: "nosuchthing".to_string()
-        }
-    );
-}
-
 /// **The ding block is printed once, by the reference's own window.**
 ///
 /// `benilla.toc` sources `Interface\FrameXML\ChatFrame.xml` off the player's chain, and stock
diff --git a/crates/benilla-app/src/ui_craft.rs b/crates/benilla-app/src/ui_craft.rs
index 993890df..7c3de858 100644
--- a/crates/benilla-app/src/ui_craft.rs
+++ b/crates/benilla-app/src/ui_craft.rs
@@ -59,10 +59,7 @@ impl Plugin for UiCraftPlugin {
     fn build(&self, app: &mut App) {
         app.init_resource::<CraftOpen>().add_systems(
             Update,
-            (
-                feed_craft.in_set(UnitFeed).before(UiInput),
-                drain_craft.after(UiInput),
-            ),
+            (feed_craft.in_set(UnitFeed), drain_craft.after(UiInput)),
         );
     }
 }
@@ -131,7 +128,6 @@ fn craft_tooltip(spell_id: u32, d: &benilla_formats::SpellDisplay) -> CraftToolt
 }
 
 /// Build the craft snapshot — `None` when the window is closed or the catalogs haven't loaded.
-#[allow(clippy::too_many_arguments)] // a Bevy system's full input set (the feed precedent)
 fn feed_craft(
     script: Option<NonSendMut<UiScript>>,
     open: Res<CraftOpen>,
@@ -141,7 +137,7 @@ fn feed_craft(
     focus: Option<Res<SpellFocus>>,
     icons: Option<Res<ItemDisplays>>,
     self_store: Query<&ObjectStore, With<SelfPlayer>>,
-    mut items: ResMut<Items>,
+    items: Res<Items>,
     commands: Res<NetCommands>,
     mut last: Local<crate::ui_script::VmMemo<Option<CraftState>>>,
 ) {
diff --git a/crates/benilla-app/src/ui_dialog_verbs.rs b/crates/benilla-app/src/ui_dialog_verbs.rs
index 655cf0f8..214a64bb 100644
--- a/crates/benilla-app/src/ui_dialog_verbs.rs
+++ b/crates/benilla-app/src/ui_dialog_verbs.rs
@@ -14,9 +14,11 @@
 //! * **Area spirit healer** — `SMSG_AREA_SPIRIT_HEALER_TIME {guid, ms}` arms the wave clock and
 //!   fires `AREA_SPIRIT_HEALER_IN_RANGE` when the guid is the cached healer's; Accept sends
 //!   `0x2E3` with that guid, Cancel is the cancel-aura of spell 2584 plus `_OUT_OF_RANGE`. **The
-//!   cache has no writer yet**: the reference's per-frame proximity scan (20 yd to acquire, 22 to
-//!   retain, `0x4923b0`) is not carved for its unit filter, so no healer is ever cached here and
-//!   Accept stays silent — named in the record, not guessed at.
+//!   cache has two writers** (2291), which is what made Accept reachable at all: the reference's
+//!   per-frame proximity scan [`poll_area_spirit_healer`] (`0x4923b0` — ghost-gated, acquire at
+//!   20 yd, retain to 22) and the SPIRITGUIDE click arm [`AreaSpiritHealer::click_guide`]
+//!   (`0x5df950`, whose deliberate cache-bust makes a second click re-ask). Until 2291 this said
+//!   "no writer yet", which was true when 1963 wrote it and false from the moment the scan landed.
 //! * **Battlefield queue** — `SMSG_BATTLEFIELD_STATUS` fills one of three slots and fires
 //!   `UPDATE_BATTLEFIELD_STATUS`; `AcceptBattlefieldPort(index, accept)` sends the slot's map id
 //!   with the answer as one byte.
@@ -33,12 +35,15 @@
 //!   `CancelMeetingStoneRequest()` sends `0x293` unless in a party led by someone else
 //!   (`ERR_MEETING_STONE_NOT_LEADER`). The four display-only replies (`0x297/0x298/0x299/0x2BB`)
 //!   are chat lines with no state; the status-1 arm also triggers the Meeting Stones tutorial
-//!   (`crate::tutorial`, 1976).
+//!   (`crate::tutorial`, 1976). **JOINING** is the click's own leg (decision 2283): type 23's
+//!   use slot is its own validator, not the shared `CMSG_GAMEOBJ_USE` sender — four client-side
+//!   refusals ([`meeting_stone_join_refusal`]), then `CMSG 0x292 {u64 goGuid}`.
 
 use std::time::Instant;
 
 use benilla_protocol::messages::{BattlefieldStatus, MeetingStoneNotice};
 use benilla_ui::script::{ScriptValue, UiScript};
+use bevy::ecs::system::NonSendMut;
 use bevy::prelude::*;
 
 use crate::area::AreaTableRes;
@@ -47,7 +52,7 @@ use crate::names::NameCache;
 
 use crate::net::{ClientCommand, NetCommands, ObjectStore, SelfGuid, SelfPlayer};
 use crate::ui_party::GroupState;
-use crate::ui_script::UiInput;
+use crate::ui_script::{UiFeed, UiInput};
 use crate::ui_session::{close_npc_session_out_of_range, NpcSession};
 
 /// The pet trainer's pending question: the latch (`0xc4d7b0/b4`) and the cost (`0xc4d7b8`).
@@ -118,10 +123,49 @@ impl InstanceBoot {
     }
 }
 
+/// `SPIRITGUIDE` — `UNIT_NPC_FLAGS` bit 6, the flag the acquire callback `0x4924c0` tests at
+/// `0x4924fc shr eax,0x6; test al,1` (wow-re `interact-dead-fork-and-npc-service-ladder.md` §C).
+const NPC_FLAG_SPIRITGUIDE: u32 = 1 << 6;
+
+/// The area spirit healer's aura, `0xA18` = 2584 — the one spell `0x4921c0`'s cancel leg and
+/// `CancelAreaSpiritHeal` both name, and the only spell id `0x6e7040` fires
+/// `AREA_SPIRIT_HEALER_OUT_OF_RANGE` for (`0x6e70b6 cmp esi,0xa18`).
+pub(crate) const AREA_SPIRIT_HEALER_AURA: u32 = 2584;
+
+/// The area spirit healer's **acquire** radius — the `.rdata` f32 `[0x8044d0] = 20.0`, compared
+/// squared in the enumerate callback `0x4924c0`.
+const SPIRIT_GUIDE_ACQUIRE_YD: f32 = 20.0;
+/// The **retain** radius: the same f32 times `[0x804580] = 1.1`, i.e. 22.0 (`0x492406`). A healer
+/// is adopted inside 20 yd and kept until 22 — the hysteresis is the reference's, and without it
+/// a body standing on the boundary would send a query every frame it jittered across.
+const SPIRIT_GUIDE_RETAIN_YD: f32 = SPIRIT_GUIDE_ACQUIRE_YD * 1.1;
+
+/// What [`AreaSpiritHealer::set_healer`] owes the rest of the frame.
+///
+/// The reference does both of these inside `0x4921c0` itself; here the resource is a plain data
+/// type with no access to the VM or the socket, so it *reports* them and the systems pay them.
+#[derive(Default, PartialEq, Eq, Debug)]
+pub(crate) struct SetHealerOutcome {
+    /// A wave deadline was pending and the healer changed, so `0x4921fc mov ecx,0xa18;
+    /// call 0x6e7040` ran: `AREA_SPIRIT_HEALER_OUT_OF_RANGE` fires and `CMSG_CANCEL_AURA(2584)`
+    /// goes out. **This is how walking away from a graveyard closes the wave dialog** — no Lua
+    /// call is involved, which is why the event has no argument and no caller.
+    pub(crate) cancel_aura: bool,
+    /// The newly adopted healer, if the change landed on a non-zero guid: `CMSG 0x2E2` with it.
+    pub(crate) query: Option<u64>,
+}
+
 /// The current-area spirit healer (`[0xb4e330/334]`) and its wave clock (`[0xb4e338]`).
+///
+/// **The writer is [`Self::set_healer`], and it is the reference's `0x4921c0` to the branch.**
+/// 1963 shipped this resource with the note "no writer yet" because the acquire side was thought
+/// to be uncarved; it is not — wow-re recorded the whole trio, in two different nodes, before that
+/// record landed (`ui/scratch/staticpopup-dialog-bindings.md` §6 for the setter and the poll's
+/// radii, `object-layer/scratch/interact-dead-fork-and-npc-service-ladder.md` §C row 6 for the
+/// click arm). Both roads in are built here.
 #[derive(Resource, Default)]
 pub(crate) struct AreaSpiritHealer {
-    /// The cached healer. No writer yet — see the module doc.
+    /// The cached healer (`[0xb4e330/334]`), written only by [`Self::set_healer`].
     healer: Option<u64>,
     deadline: Option<Instant>,
     in_range: bool,
@@ -137,6 +181,60 @@ impl AreaSpiritHealer {
         }
     }
 
+    /// **`0x4921c0` — "set current area spirit healer"**, decoded at the branch:
+    ///
+    /// ```text
+    /// if (cached == new) return;            // 0x4921cf/0x4921dd — guards EVERYTHING below
+    /// cached = new;                         // 0x4921e5 / 0x4921f5
+    /// if (deadline != 0) CancelAura(0xA18); // 0x4921fc — fires _OUT_OF_RANGE, sends 0x136
+    /// deadline = 0;                         // 0x492211
+    /// if (cached != 0) send CMSG 0x2E2;     // 0x492217 / 0x492219
+    /// ```
+    ///
+    /// The early return at the top is the load-bearing part and the one a paraphrase loses: with
+    /// the guid unchanged this routine does **nothing at all** — no cancel, no deadline clear, no
+    /// packet. That is what lets the per-frame poll call it unconditionally (it clears by calling
+    /// `set_healer(None)` every frame it has no ghost) at zero cost.
+    pub(crate) fn set_healer(&mut self, new: Option<u64>) -> SetHealerOutcome {
+        // The reference keeps a 0:0 guid where we keep `None`; normalise so a zero guid arriving
+        // from the wire cannot masquerade as a real healer.
+        let new = new.filter(|&g| g != 0);
+        if self.healer == new {
+            return SetHealerOutcome::default();
+        }
+        self.healer = new;
+        let cancel_aura = self.deadline.take().is_some();
+        if cancel_aura {
+            // The cancel closes the dialog, so the `_IN_RANGE` this frame would have owed is
+            // stale — the reference cannot have one pending here either (the event is fired from
+            // the handler, which runs the poll first).
+            self.in_range = false;
+        }
+        SetHealerOutcome {
+            cancel_aura,
+            query: new,
+        }
+    }
+
+    /// The **spirit-guide click arm**'s two calls (`0x5df950`: `0x4921c0(0,0)` then
+    /// `0x4921c0(guid)`). The first is a deliberate cache-bust — its own early return suppresses
+    /// the send for a zero guid — so the second **always** transmits, even for the healer already
+    /// cached. Clicking the guide you are standing next to therefore re-asks for the clock, which
+    /// is exactly what a player does when the dialog has been dismissed.
+    pub(crate) fn click_guide(&mut self, guid: u64) -> SetHealerOutcome {
+        let bust = self.set_healer(None);
+        let set = self.set_healer(Some(guid));
+        SetHealerOutcome {
+            cancel_aura: bust.cancel_aura || set.cancel_aura,
+            query: set.query,
+        }
+    }
+
+    /// The cached healer — `AcceptAreaSpiritHeal`'s guid and the poll's retain subject.
+    pub(crate) fn healer(&self) -> Option<u64> {
+        self.healer
+    }
+
     fn secs(&self, now: Instant) -> u32 {
         self.deadline
             .map(|d| d.saturating_duration_since(now).as_secs())
@@ -389,7 +487,7 @@ fn stone_line(
 #[derive(bevy::ecs::system::SystemParam)]
 pub(crate) struct MeetingStoneInputs<'w, 's> {
     areas: Option<Res<'w, AreaTableRes>>,
-    names: ResMut<'w, NameCache>,
+    names: Res<'w, NameCache>,
     commands: Res<'w, NetCommands>,
     visuals: Option<Res<'w, SpellVisuals>>,
     fx: MessageWriter<'w, SpellKitFx>,
@@ -537,11 +635,183 @@ fn meeting_stone_enter_world(
     let _ = commands.0.send(ClientCommand::MeetingStoneStatusQuery);
 }
 
+/// A right-click on a `GAMEOBJECT_TYPE_MEETINGSTONE` (23) that got past the shared gates — the
+/// GO click ladder's hand-off to this module (decision 2283).
+///
+/// It travels as a message for the same reason the GameObject opener's cast does (2199): the
+/// click system sits at Bevy's 16-`SystemParam` ceiling and cannot also hold the roster, the
+/// template cache and the wire. The reference has no such split — `0x5f69d0` is one function —
+/// so the *verdict* stays one function here too ([`meeting_stone_join_refusal`]); only the
+/// plumbing is two systems.
+#[derive(Message, Clone, Copy, Debug, PartialEq, Eq)]
+pub(crate) struct MeetingStoneUse {
+    pub(crate) go_guid: u64,
+}
+
+/// What MEETINGSTONE(23)'s own use slot `0x5f69d0` does with one click — its three outcomes, as
+/// the binary has them (decision 2283).
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub(crate) enum StoneJoin {
+    /// `0x5f69f8` — no local player object: `false` with **no message and no packet**. Not a
+    /// refusal; the validator never starts.
+    Silent,
+    /// One of the four refusals: `push <id>; call 0x496720` then `xor al,al; ret`. Every one is a
+    /// catalog **kind 2** row, so it paints the error frame (`UI_ERROR_MESSAGE`), never a chat
+    /// line — and none carries a sound (type tag `0x44`, cue `"NONE"`).
+    Refuse(&'static str),
+    /// The tail `0x5f6af6`: `CMSG 0x292 {u64 goGuid}`, and nothing else at all.
+    Send,
+}
+
+/// The four client-side refusals inside MEETINGSTONE(23)'s own use slot (`0x5f69d0`, whose tail
+/// `0x5f6af6` is the sole caller of the `CMSG 0x292` builder `0x4c9ff0`) — **VERIFIED at the
+/// bytes** by wow-re's §5 round on that function (four cold workers plus the orchestrator's own
+/// derivation, arbitrated; `system/object-layer/scratch/meeting-stone-use-validator.md` §4).
+///
+/// Two gates run before any of them. `0x5f69f8`: no local player ⇒ [`StoneJoin::Silent`].
+/// `0x5f6a10 je 0x5f6a65`: **not in a group ⇒ both group refusals are skipped**, and a solo player
+/// drops straight to the level test.
+///
+/// | # | at | refusal | predicate | key |
+/// |---|---|---|---|---|
+/// | 1 | `0x5f6a2f` | in a group we do not lead | the leader guid `[0xbc75f8]` against the active player's, full 64-bit | `ERR_MEETING_STONE_MUST_BE_LEADER` (`0x1b1`) |
+/// | 2 | `0x5f6a4f` | the group is full | `0x4e86d0` is `GetNumPartyMembers` — the **other** members, 0..4 — and `cmp eax,4 / jb` refuses at ≥ 4 | `ERR_MEETING_STONE_GROUP_FULL` (`0x1ae`) |
+/// | 3 | `0x5f6ab4` | the wrong level for this stone | `data[0] <= level <= data[1]`, **both bounds inclusive and unsigned**, over the player's own `UNIT_FIELD_LEVEL` | `ERR_MEETING_STONE_INVALID_LEVEL` (`0x1b0`) |
+/// | 4 | `0x5f6ad3` | in a raid | `[0xb713e0] != 0` — the raid member **count** (`GetNumRaidMembers`) | `ERR_MEETING_STONE_NO_RAID_GROUP` (`0x1b2`) |
+///
+/// **Three of the four are refused a second time by the server** (vmangos
+/// `HandleMeetingStoneJoinOpcode` → `MEETINGSTONE_FAIL_PARTYLEADER` / `_FULL_GROUP` /
+/// `_RAID_GROUP`, which come back as `SMSG 0x2BB` and print the same three strings 1974 already
+/// built). That copy is not redundant — it is what makes the refusal instant. **The level term is
+/// the client's alone**: `HandleMeetingStoneJoinOpcode` reads `gInfo->meetingstone.areaID` and
+/// nothing else off the template, so a client that skips it queues a level-1 character for a
+/// sixty-level dungeon and the server agrees.
+///
+/// **An unanswered template REFUSES, and that is the reference's own arithmetic rather than a
+/// fail-closed choice of ours.** `0x5f8150` reads the cached template through `[GO+0x214]`, and an
+/// uncached object returns **0 for both bounds** — so every level ≥ 1 falls outside `0..=0` and
+/// takes the level refusal. The permissive "skip the term while the query is in flight" default
+/// the highlight column takes is *wrong* here, and the first cut of this had it. The same
+/// arithmetic makes a shipped `data[0] = data[1] = 0` refuse everyone; `0/60` is the open band.
+pub(crate) fn meeting_stone_join_refusal(
+    group: Option<&GroupState>,
+    self_guid: Option<u64>,
+    level: Option<u32>,
+    stone: Option<crate::go_templates::MeetingStoneTemplate>,
+) -> StoneJoin {
+    // `0x5f69f8` — the validator needs an active player before it asks anything.
+    let (Some(self_guid), Some(level)) = (self_guid, level) else {
+        return StoneJoin::Silent;
+    };
+    // `0x5f6a10` — no group at all skips past both group terms.
+    let in_group = group.is_some_and(|g| g.in_group);
+    if in_group {
+        if group.map(|g| g.leader) != Some(self_guid) {
+            return StoneJoin::Refuse("ERR_MEETING_STONE_MUST_BE_LEADER");
+        }
+        if group.is_some_and(|g| g.members.len() >= MEETING_STONE_PARTY_CAP) {
+            return StoneJoin::Refuse("ERR_MEETING_STONE_GROUP_FULL");
+        }
+    }
+    // An uncached template reads `0/0` here, which refuses — see the doc above.
+    let (min_level, max_level) = stone.map_or((0, 0), |s| (s.min_level, s.max_level));
+    if level < min_level || level > max_level {
+        return StoneJoin::Refuse("ERR_MEETING_STONE_INVALID_LEVEL");
+    }
+    if in_group && group.is_some_and(|g| g.group_type == crate::ui_party::GROUPTYPE_RAID) {
+        return StoneJoin::Refuse("ERR_MEETING_STONE_NO_RAID_GROUP");
+    }
+    StoneJoin::Send
+}
+
+/// How many **other** party members make the stone's `GROUP_FULL` refusal fire — a party it could
+/// add nobody to.
+///
+/// **Four, not five, and the difference is a real trap.** A vanilla party holds five *including*
+/// the player, and vmangos refuses on exactly that: `Group::IsFull()` is
+/// `m_memberSlots.size() >= MAX_GROUP_SIZE (5)`, counting the leader
+/// (`Group/Group.h:49,232`) → `MEETINGSTONE_FAIL_FULL_GROUP`. But `SMSG_GROUP_LIST` never lists
+/// the recipient (0440), so [`GroupState::members`] is the other four and the comparison is
+/// against **4** with no `+ 1`. Adding one — the first cut of this did — refuses a legal
+/// four-person party the server would have queued, and the string says which reading is right:
+/// `ERR_MEETING_STONE_GROUP_FULL` is *"You are already in a full group"*, and a group of four is
+/// not full.
+const MEETING_STONE_PARTY_CAP: usize = 4;
+
+/// The join drain: MEETINGSTONE(23)'s use slot, with the click's guid.
+fn drain_meeting_stone_joins(
+    script: Option<NonSendMut<UiScript>>,
+    mut uses: MessageReader<MeetingStoneUse>,
+    group: Option<Res<GroupState>>,
+    self_guid: Res<SelfGuid>,
+    templates: Res<crate::go_templates::GameObjectTemplates>,
+    self_q: Query<&ObjectStore, With<SelfPlayer>>,
+    commands: Res<NetCommands>,
+    mut sink: crate::ui_action::MessageSink,
+) {
+    let Some(mut script) = script else {
+        uses.clear();
+        return;
+    };
+    let level = self_q.single().ok().and_then(|s| s.0.unit_level());
+    let mut lines = Vec::new();
+    for &MeetingStoneUse { go_guid } in uses.read() {
+        let stone = templates.get(go_guid).and_then(|t| t.meeting_stone);
+        let verdict = meeting_stone_join_refusal(group.as_deref(), self_guid.0, level, stone);
+        // The interact chain's last link for this type, on the same `use` tag the click's own
+        // lines carry (2283): a stone that goes nowhere is one of four refusals, the no-player
+        // silence, or a send the server ignored — and one trace now says which.
+        if benilla_assets::trace::enabled_for("use") {
+            benilla_assets::trace::line(
+                "use",
+                &match verdict {
+                    StoneJoin::Silent => format!("meeting stone {go_guid:#x}: no local player"),
+                    StoneJoin::Refuse(key) => {
+                        format!("meeting stone {go_guid:#x} refused: {key}")
+                    }
+                    StoneJoin::Send => {
+                        format!("SEND CMSG_MEETINGSTONE_JOIN guid={go_guid:#x}")
+                    }
+                },
+            );
+        }
+        match verdict {
+            StoneJoin::Silent => {}
+            StoneJoin::Refuse(key) => lines.extend(crate::ui_action::keyed_line(&script, key)),
+            StoneJoin::Send => {
+                debug!("meeting stone: join {go_guid:#x}");
+                let _ = commands.0.send(ClientCommand::MeetingStoneJoin { go_guid });
+            }
+        }
+    }
+    if !lines.is_empty() {
+        crate::ui_action::show_messages(&mut script, &mut sink, "ui_dialog_verbs", lines);
+    }
+}
+
 /// The leave-world sweep's leg: the text dropped, the area kept.
 fn meeting_stone_leave_world(mut stone: ResMut<MeetingStone>) {
     stone.leave_world();
 }
 
+/// Drop the cached spirit guide when the world does.
+///
+/// **A resurrect wave is the most session-bound state this module holds**, and it was the one
+/// resource here with no leave-world leg. A ghost who logs out at a Warsong Gulch graveyard with a
+/// guide latched and a wave armed carried `healer`, `deadline` and `in_range` into the character
+/// screen and into the *next* character's session — where, on the first frame the interface came
+/// up, [`feed_dialog_verbs`] pushed the stale healer into the fresh VM and could fire
+/// `AREA_SPIRIT_HEALER_IN_RANGE` at a living body standing in Stormwind, and the poll's ghost gate
+/// then cleared it and sent a `CMSG_CANCEL_AURA(2584)` the reference never sends there.
+///
+/// The reference does not need this leg because its equivalents are process-lifetime globals whose
+/// poll keeps running over the character screen's frames; ours is a resource in a world that goes
+/// away. Resetting at the seam is how every other per-session cache here behaves
+/// (`crate::ui_aura::end_session_aura_state` is the established shape).
+fn area_spirit_healer_leave_world(mut spirit: ResMut<AreaSpiritHealer>) {
+    *spirit = AreaSpiritHealer::default();
+}
+
 pub(crate) fn feed_dialog_verbs(
     script: Option<NonSendMut<UiScript>>,
     mut pet: ResMut<PetUnlearnState>,
@@ -578,7 +848,7 @@ pub(crate) fn feed_dialog_verbs(
     }
 
     let secs = spirit.secs(now);
-    script.set_area_spirit_healer(spirit.healer.is_some(), secs);
+    script.set_area_spirit_healer(spirit.healer().is_some(), secs);
     if std::mem::take(&mut spirit.in_range) {
         script.fire_event("AREA_SPIRIT_HEALER_IN_RANGE", vec![]);
     }
@@ -635,7 +905,7 @@ fn drain_latch_verbs(
 
     // AcceptAreaSpiritHeal: the cached healer's guid (the binding was silent without one).
     let accepts = script.take_area_spirit_accepts();
-    if let Some(healer) = spirit.healer {
+    if let Some(healer) = spirit.healer() {
         for _ in 0..accepts {
             let _ = commands
                 .0
@@ -687,6 +957,127 @@ fn drain_queue_verbs(
     }
 }
 
+/// **The per-frame area-spirit-healer poll — `0x4923b0`**, which the reference runs from
+/// `CGWorldFrame`'s own `OnUpdate` (`0x4818ca`) on **every frame**, mouse focus or not.
+///
+/// ```text
+/// player = the active player object; none            -> set_healer(None); return
+/// not a GHOST ([[player+0xe68]+8] bit 4)              -> set_healer(None); return
+/// if cached:
+///     the cached guid no longer resolves to a unit    -> set_healer(None)
+///     else d²(player, healer) > 22²                   -> set_healer(None)
+/// if still cached: return                             // 0x492487
+/// enumerate every object: the first (last, really —   // 0x492495
+///   the callback never stops the walk) unit that is
+///   SPIRITGUIDE, CanAssist, and within 20 yd          -> set_healer(it)
+/// ```
+///
+/// **Ghost-gated at the top**, so a living player never holds a healer and never sends a query —
+/// the graveyard's wave clock only exists for the dead. That gate is why this costs nothing in
+/// ordinary play: one flag read per frame and out.
+///
+/// The callback `0x4924c0` returns 1 unconditionally, so the enumeration is **not** stopped by a
+/// match — the last qualifying unit in enumeration order is the one that sticks. `set_healer`'s
+/// own early return makes that harmless for a stable set (only a genuine change sends), and
+/// reproducing "last wins" rather than "nearest wins" matters at a graveyard with two guides in
+/// range: the reference does not pick the closer one, and neither does this.
+fn poll_area_spirit_healer(
+    mut spirit: ResMut<AreaSpiritHealer>,
+    me: Query<(&ObjectStore, &Transform), With<SelfPlayer>>,
+    units: Query<
+        (
+            &crate::net::Guid,
+            &crate::net::NetEntity,
+            &ObjectStore,
+            &Transform,
+        ),
+        Without<SelfPlayer>,
+    >,
+    factions: Option<Res<crate::target::Factions>>,
+    reputations: Res<crate::net::Reputations>,
+    index: Option<Res<crate::net::GuidIndex>>,
+    stores: Query<&ObjectStore>,
+    commands: Res<NetCommands>,
+    mut script: Option<NonSendMut<UiScript>>,
+) {
+    let mut apply = |outcome: SetHealerOutcome| {
+        if outcome.cancel_aura {
+            // `0x6e7040(0xA18)` does both halves, and both are the reference's: the event with no
+            // argument, and the packet with no guid.
+            if let Some(script) = script.as_deref_mut() {
+                script.fire_event("AREA_SPIRIT_HEALER_OUT_OF_RANGE", vec![]);
+            }
+            let _ = commands.0.send(ClientCommand::CancelAura {
+                spell_id: AREA_SPIRIT_HEALER_AURA,
+            });
+        }
+        if let Some(healer) = outcome.query {
+            let _ = commands
+                .0
+                .send(ClientCommand::AreaSpiritHealerQuery { healer });
+        }
+    };
+
+    let Ok((self_store, self_tf)) = me.single() else {
+        apply(spirit.set_healer(None));
+        return;
+    };
+    if !self_store.0.player_is_ghost() {
+        apply(spirit.set_healer(None));
+        return;
+    }
+    let here = self_tf.translation;
+
+    // The retain leg. A cached guid that no longer streams to us is dropped exactly as one that
+    // walked out of range is — the reference's `ObjectPtr` miss falls into the same clear.
+    if let Some(cached) = spirit.healer() {
+        let still = units.iter().find(|(guid, ..)| guid.0 == cached);
+        let keep = still.is_some_and(|(_, _, _, tf)| {
+            tf.translation.distance_squared(here) <= SPIRIT_GUIDE_RETAIN_YD * SPIRIT_GUIDE_RETAIN_YD
+        });
+        if !keep {
+            apply(spirit.set_healer(None));
+        }
+    }
+    if spirit.healer().is_some() {
+        return;
+    }
+
+    // The acquire walk. `can_assist` is `0x6066f0`, the same predicate the target scanner and the
+    // buff gate already run — its owner chase wants a store by guid, which is what the index is
+    // for.
+    let store_of = |guid: u64| -> Option<ObjectStore> {
+        let entity = *index.as_ref()?.0.get(&guid)?;
+        stores.get(entity).ok().cloned()
+    };
+    let mut adopted = None;
+    for (guid, kind, store, tf) in units.iter() {
+        if kind.kind != benilla_protocol::EntityKind::Unit {
+            continue;
+        }
+        if store.0.unit_npc_flags() & NPC_FLAG_SPIRITGUIDE == 0 {
+            continue;
+        }
+        if tf.translation.distance_squared(here) > SPIRIT_GUIDE_ACQUIRE_YD * SPIRIT_GUIDE_ACQUIRE_YD
+        {
+            continue;
+        }
+        if !crate::target::can_assist(
+            Some(store),
+            factions.as_deref(),
+            &reputations,
+            Some(self_store),
+            store_of,
+        ) {
+            continue;
+        }
+        adopted = Some(guid.0); // last wins — the callback never stops the walk
+    }
+    if let Some(guid) = adopted {
+        apply(spirit.set_healer(Some(guid)));
+    }
+}
+
 pub(crate) struct UiDialogVerbsPlugin;
 
 impl Plugin for UiDialogVerbsPlugin {
@@ -696,32 +1087,105 @@ impl Plugin for UiDialogVerbsPlugin {
             .init_resource::<AreaSpiritHealer>()
             .init_resource::<BattlefieldQueue>()
             .init_resource::<MeetingStone>()
+            .add_message::<MeetingStoneUse>()
             .add_systems(
                 Update,
                 (
                     close_npc_session_out_of_range::<PetUnlearnState>.before(feed_dialog_verbs),
-                    feed_dialog_verbs.before(UiInput),
+                    // Gated on the interface being up (decision 2279): `InstanceBoot::events`
+                    // is server-driven — vmangos sends `SMSG_RAID_GROUP_ONLY` from
+                    // `Player::UpdateHomebindTime` on the first map tick after a login inside a
+                    // raid instance with no raid group, i.e. inside the login burst's own
+                    // drain — and `INSTANCE_BOOT_START`, the event that raises the stock
+                    // countdown popup, would be fired at the boot VM in 2214's one-frame window
+                    // and lost. Gated, the queue waits; nothing here clears without a VM.
+                    feed_dialog_verbs
+                        .in_set(UiFeed)
+                        .run_if(crate::ui_script::ingame_ui_up),
+                    // **After the frame's pick, which is the reference's own order.** The poll
+                    // is `0x4923b0`, called from `CGWorldFrame`'s OnUpdate at `0x4818ca` — and
+                    // that same function ran the mouse pick eighty bytes earlier, at `0x48184a`.
+                    // So a right-click that adopts a spirit guide is decided BEFORE the poll gets
+                    // to look, not after; ordering it `.after(TargetUpdate)` (the set
+                    // `act_on_right_click` chains inside) reproduces that, and settles the one
+                    // real write-write pair this system has — both it and the click's
+                    // `ServiceArms` hold `AreaSpiritHealer`.
+                    //
+                    // The cost is that an adopt reaches `feed_dialog_verbs` on the NEXT frame
+                    // rather than this one, because `UiInput` sits before `WorldStage::Input` and
+                    // `TargetUpdate` after it — the two orders cannot both hold. That is the
+                    // right way round to lose: the event this system fires itself
+                    // (`_OUT_OF_RANGE`) is immediate, and what lags is one frame of a clock the
+                    // server ticks in seconds.
+                    //
+                    // **Gated on the interface being up** like its neighbour, and safely so: this
+                    // poll is LEVEL-triggered, not edge-triggered. It re-derives the whole cache
+                    // from the ghost flag, the streamed guides and the distances every frame, so a
+                    // frame it does not run is a frame it simply has not got to yet — the very
+                    // next one adopts and queries. That is what makes it exempt in substance from
+                    // the one-shot loss 2214's window causes (2220/2232): there is no edge here to
+                    // lose. The `_OUT_OF_RANGE` it can fire is the one thing that needs the VM,
+                    // and it can only follow an adopt this same system made.
+                    poll_area_spirit_healer
+                        .after(crate::target::TargetUpdate)
+                        .run_if(crate::ui_script::ingame_ui_up)
+                        .in_set(crate::char_select::InWorldGated),
                     // In-world only: the claim is about the VM, but the query is a world
                     // packet, and the boot VM exists at the glue screen too.
                     meeting_stone_enter_world
+                        .in_set(crate::ui_script::UiFeed)
                         .before(feed_meeting_stone)
-                        .run_if(in_state(crate::char_select::ClientState::InWorld)),
-                    feed_meeting_stone.before(UiInput),
-                    drain_latch_verbs.after(UiInput),
+                        .in_set(crate::char_select::InWorldGated),
+                    feed_meeting_stone.in_set(UiFeed),
+                    // **Before the target chain, not merely after the input pass** — and this one
+                    // is a correctness order, not a tidiness one.
+                    //
+                    // `drain_latch_verbs` takes `AcceptAreaSpiritHeal`'s presses with
+                    // `take_area_spirit_accepts()` **unconditionally**, and only then gates the
+                    // send on `spirit.healer()`. Both systems that can *clear* that healer —
+                    // `poll_area_spirit_healer` (which drops it past the 22 yd retain radius) and
+                    // `act_on_right_click` (which re-points it at another guide) — live in or
+                    // after `TargetUpdate`, and `.after(UiInput)` alone constrains this against
+                    // neither: `UiInput` sits *before* `WorldStage::Input` and `TargetUpdate`
+                    // after it. So with the order undeclared, a ghost who clicks **Accept** on the
+                    // same frame they step out of range either sends
+                    // `CMSG_AREA_SPIRIT_HEALER_QUEUE` or has the press silently eaten — decided by
+                    // graph layout, with no message either way.
+                    //
+                    // `before` is the reference's own answer, not a coin toss: the dialog's Lua
+                    // handler runs inside the UI dispatch, while `0x4923b0` (the poll) and
+                    // `0x48184a` (the pick) both run later in the same frame off `CGWorldFrame`'s
+                    // OnUpdate. The press is resolved against the healer the frame *began* with.
+                    // Its neighbour `drain_meeting_stone_joins` below argued the same hazard and
+                    // declared its way out of it; this one was missed.
+                    drain_latch_verbs
+                        .after(UiInput)
+                        .before(crate::target::TargetUpdate),
                     drain_queue_verbs.after(UiInput),
+                    // MEETINGSTONE(23)'s use slot (2283): the click resolved the object, this
+                    // runs the validator and sends. Ordered after the **target chain**, not just
+                    // after the input pass like its neighbours — `UiInput` sits *before*
+                    // `WorldStage::Input` and `TargetUpdate` after it, so "after UiInput" alone
+                    // says nothing about the writer and would let the join drift a frame. A
+                    // message survives that (two-frame lifetime) and 16 ms would not be visible,
+                    // but a click's own packet should not leave on an undefined frame.
+                    drain_meeting_stone_joins
+                        .after(UiInput)
+                        .after(crate::target::TargetUpdate),
                 ),
             )
             .add_systems(
                 OnExit(crate::char_select::ClientState::InWorld),
-                meeting_stone_leave_world,
+                (meeting_stone_leave_world, area_spirit_healer_leave_world),
             );
     }
 }
 
-/// The area spirit healer's aura, `0xA18` — `CancelAreaSpiritHeal`'s one spell (the engine's
-/// `dialog_verbs::AREA_SPIRIT_HEALER_SPELL`), read here only to check its flags against the data.
+/// The area spirit healer's aura as the test below names it — the same 2584 as
+/// [`AREA_SPIRIT_HEALER_AURA`], kept under its own name because the test is about
+/// `CancelAreaSpiritHeal`'s spell and the constant above is about `0x4921c0`'s.
 #[cfg(test)]
-const AREA_SPIRIT_HEALER_SPELL: u32 = 2584;
+const AREA_SPIRIT_HEALER_SPELL: u32 = AREA_SPIRIT_HEALER_AURA;
 
 /// The generic cancel-aura routine's refusal (`0x6e7040`, wow-re `staticpopup-dialog-bindings.md`
 /// §6): it returns without sending when the spell's `AttributesEx` has bit 13 set and bit 2
@@ -736,6 +1200,500 @@ fn cancel_gate_could_apply(attributes_ex: u32) -> bool {
 mod tests {
     use super::*;
 
+    /// `UNIT_FIELD_LEVEL`, absolute field 34.
+    const LEVEL_FIELD: u16 = 34;
+
+    /// **`0x4921c0`'s early return guards everything.** The first two compares
+    /// (`0x4921cf cmp ecx,eax` / `0x4921dd cmp edx,ecx`) jump straight to the epilogue at
+    /// `0x492282` when the guid is unchanged — so a repeat call sends no packet, cancels no aura
+    /// and does **not** clear the pending deadline. That last one is the part a paraphrase loses,
+    /// and it is what lets the per-frame poll call this routine unconditionally.
+    #[test]
+    fn setting_the_same_healer_is_a_complete_no_op() {
+        let mut spirit = AreaSpiritHealer::default();
+        assert_eq!(
+            spirit.set_healer(Some(7)),
+            SetHealerOutcome {
+                cancel_aura: false,
+                query: Some(7)
+            },
+            "a fresh adopt asks for the clock"
+        );
+        let now = Instant::now();
+        spirit.on_time(7, 30_000, now);
+        assert_eq!(spirit.secs(now), 30, "the wave clock is armed");
+
+        assert_eq!(
+            spirit.set_healer(Some(7)),
+            SetHealerOutcome::default(),
+            "the same guid again: no query, no cancel"
+        );
+        assert_eq!(
+            spirit.secs(now),
+            30,
+            "and the deadline SURVIVES — 0x492211's clear sits past the early return"
+        );
+    }
+
+    /// The change legs, in the order the routine runs them: a pending deadline is cancelled
+    /// (`0x4921fc`, which is how walking out of range fires `_OUT_OF_RANGE` with no Lua call),
+    /// the deadline is zeroed unconditionally (`0x492211`), and only a **non-zero** new guid
+    /// sends (`0x492217`'s `je`).
+    #[test]
+    fn dropping_a_healer_cancels_the_wave_and_sends_nothing() {
+        let mut spirit = AreaSpiritHealer::default();
+        spirit.set_healer(Some(7));
+        let now = Instant::now();
+        spirit.on_time(7, 30_000, now);
+
+        assert_eq!(
+            spirit.set_healer(None),
+            SetHealerOutcome {
+                cancel_aura: true,
+                query: None
+            },
+            "walking away: the aura cancel, and no query for a zero guid"
+        );
+        assert_eq!(spirit.secs(now), 0, "the clock is zeroed");
+        assert_eq!(spirit.healer(), None);
+
+        // And a drop with no clock armed cancels nothing.
+        spirit.set_healer(Some(9));
+        assert_eq!(
+            spirit.set_healer(None),
+            SetHealerOutcome {
+                cancel_aura: false,
+                query: None
+            },
+            "no deadline pending — 0x4921fa's `je` skips the cancel"
+        );
+    }
+
+    /// `SMSG_AREA_SPIRIT_HEALER_TIME` is addressed: a clock for a healer that is **not** the
+    /// cached one is dropped (`0x4922a0 cmp eax,[ebp+8]`), which is what keeps a stale reply from
+    /// a graveyard you already left out of the dialog.
+    #[test]
+    fn a_clock_for_another_healer_is_ignored() {
+        let mut spirit = AreaSpiritHealer::default();
+        spirit.set_healer(Some(7));
+        let now = Instant::now();
+        spirit.on_time(8, 30_000, now);
+        assert_eq!(spirit.secs(now), 0, "not our healer");
+        spirit.on_time(7, 0, now);
+        assert_eq!(spirit.secs(now), 0, "a zero time arms nothing");
+        spirit.on_time(7, 25_000, now);
+        assert_eq!(spirit.secs(now), 25);
+    }
+
+    /// **The click's cache-bust.** `0x5df950` calls the setter twice — `(0,0)` then the guid —
+    /// precisely so the second call is never swallowed by the unchanged-guid early return. So
+    /// clicking the guide you are already standing next to DOES re-ask for the clock, which is
+    /// the behaviour a player relies on after dismissing the dialog.
+    #[test]
+    fn clicking_the_cached_guide_still_asks_again() {
+        let mut spirit = AreaSpiritHealer::default();
+        spirit.set_healer(Some(7));
+        let now = Instant::now();
+        spirit.on_time(7, 30_000, now);
+
+        let outcome = spirit.click_guide(7);
+        assert_eq!(
+            outcome.query,
+            Some(7),
+            "the bust makes the second call a real change"
+        );
+        assert!(
+            outcome.cancel_aura,
+            "and the bust's own leg cancelled the pending wave"
+        );
+        assert_eq!(spirit.healer(), Some(7));
+    }
+
+    /// `UNIT_FIELD_FLAGS`, absolute field 46 — `UNIT_FLAG_PVP` (`0x1000`) is what carries a
+    /// non-player-controlled unit through `can_assist`'s last gate.
+    const UNIT_FLAGS_FIELD: u16 = 46;
+    /// `UNIT_NPC_FLAGS`, absolute field 147.
+    const NPC_FLAGS_FIELD: u16 = 147;
+    /// `PLAYER_FLAGS`, absolute field 190; bit `0x10` is GHOST.
+    const PLAYER_FLAGS_FIELD: u16 = 190;
+
+    fn fields(pairs: &[(u16, u32)]) -> ObjectStore {
+        ObjectStore(benilla_protocol::ObjectFields::from_pairs(pairs))
+    }
+
+    /// A world holding exactly what [`poll_area_spirit_healer`] reads, with the body at the origin
+    /// and one candidate unit at `dist` yards along +X.
+    ///
+    /// `ghost` drives `PLAYER_FLAGS 0x10`; `guide` drives `UNIT_NPC_FLAGS` bit 6. The candidate
+    /// carries `UNIT_FLAG_PVP` and faction template **35** ("friendly to all"), against a body on
+    /// template **1** (PLAYER, Human) — a real friendly pair out of the shipped DBC, so
+    /// `can_assist` passes for the same reason it passes on the live server rather than by
+    /// accident. A test that wants the acquire walk to *run* must therefore hand over the real
+    /// catalog; `None` serves the cases that refuse **before** the walk (not a ghost, not a guide,
+    /// too far), which is why those need no client data and never skip.
+    fn poll_world(
+        ghost: bool,
+        guide: bool,
+        dist: f32,
+        factions: Option<benilla_formats::FactionCatalog>,
+    ) -> (World, crossbeam_channel::Receiver<ClientCommand>) {
+        let (tx, rx) = crossbeam_channel::unbounded::<ClientCommand>();
+        let mut world = World::new();
+        world.insert_resource(NetCommands(tx));
+        world.init_resource::<AreaSpiritHealer>();
+        world.init_resource::<crate::net::Reputations>();
+        world.init_resource::<crate::net::GuidIndex>();
+        if let Some(catalog) = factions {
+            world.insert_resource(crate::target::Factions::from_catalog(catalog));
+        }
+        world.spawn((
+            SelfPlayer,
+            fields(&[
+                (PLAYER_FLAGS_FIELD, if ghost { 0x10 } else { 0 }),
+                (FACTION_TEMPLATE_FIELD, 1),
+            ]),
+            Transform::from_xyz(0.0, 0.0, 0.0),
+        ));
+        world.spawn((
+            crate::net::Guid(GUIDE),
+            crate::net::NetEntity {
+                kind: benilla_protocol::EntityKind::Unit,
+                display_id: None,
+                scale: 1.0,
+            },
+            fields(&[
+                (NPC_FLAGS_FIELD, if guide { 1 << 6 } else { 0 }),
+                (UNIT_FLAGS_FIELD, 0x1000),
+                (FACTION_TEMPLATE_FIELD, 35),
+            ]),
+            Transform::from_xyz(dist, 0.0, 0.0),
+        ));
+        (world, rx)
+    }
+
+    /// `UNIT_FIELD_FACTIONTEMPLATE`, absolute field 35.
+    const FACTION_TEMPLATE_FIELD: u16 = 35;
+
+    /// The shipped FactionTemplate.dbc, or an early return when this machine has no client data —
+    /// the same `wow_data_or_skip!` shape `target::ring`'s own reaction tests use.
+    macro_rules! catalog_or_skip {
+        () => {{
+            let data = benilla_formats::wow_data_or_skip!();
+            let mut chain = benilla_formats::open_chain(&data).expect("open chain");
+            benilla_formats::load_faction_catalog(&mut chain).expect("FactionTemplate.dbc")
+        }};
+    }
+
+    const GUIDE: u64 = 0x9111;
+
+    fn run_poll(world: &mut World) {
+        use bevy::ecs::system::RunSystemOnce;
+        world.run_system_once(poll_area_spirit_healer).unwrap();
+    }
+
+    fn queries(rx: &crossbeam_channel::Receiver<ClientCommand>) -> Vec<u64> {
+        rx.try_iter()
+            .filter_map(|c| match c {
+                ClientCommand::AreaSpiritHealerQuery { healer } => Some(healer),
+                _ => None,
+            })
+            .collect()
+    }
+
+    /// **The ghost gate is the poll's first test** (`0x4923b0`, the `0x5df74a`-shaped read of
+    /// `[[player+0xe68]+8] bit 4`). A living body standing on top of a spirit guide adopts nothing
+    /// and sends nothing — which is what keeps the resurrect dialog off the screen of everyone who
+    /// is merely walking through a graveyard.
+    #[test]
+    fn a_living_body_never_adopts_a_spirit_guide() {
+        let (mut world, rx) = poll_world(false, true, 1.0, None);
+        run_poll(&mut world);
+        assert_eq!(world.resource::<AreaSpiritHealer>().healer(), None);
+        assert!(queries(&rx).is_empty(), "no clock is asked for");
+    }
+
+    /// The acquire leg: a ghost inside 20 yd adopts, and the adopt is what sends
+    /// `CMSG_AREA_SPIRIT_HEALER_QUERY` — the packet that was unreachable before 2291.
+    #[test]
+    fn a_ghost_adopts_a_guide_inside_the_acquire_radius_and_asks_for_the_clock() {
+        let catalog = catalog_or_skip!();
+        let (mut world, rx) = poll_world(true, true, 19.0, Some(catalog));
+        run_poll(&mut world);
+        assert_eq!(world.resource::<AreaSpiritHealer>().healer(), Some(GUIDE));
+        assert_eq!(
+            queries(&rx),
+            vec![GUIDE],
+            "exactly one query, for that guide"
+        );
+    }
+
+    /// …and 20 yd is a real boundary, not decoration: one yard further and nothing is adopted.
+    #[test]
+    fn a_guide_past_the_acquire_radius_is_not_adopted() {
+        let (mut world, rx) = poll_world(true, true, 21.0, None);
+        run_poll(&mut world);
+        assert_eq!(world.resource::<AreaSpiritHealer>().healer(), None);
+        assert!(queries(&rx).is_empty());
+    }
+
+    /// **The hysteresis, which is the whole reason there are two radii.** A guide adopted at 19 yd
+    /// is RETAINED at 21 — past the acquire radius — and only dropped past 22
+    /// (`20.0 × 1.1`). Equal radii would re-query every frame a body jittered over the boundary.
+    /// The drop is not silent: it cancels the wave (`CMSG_CANCEL_AURA` on 2584), which on vmangos
+    /// takes the player out of the resurrect queue.
+    #[test]
+    fn an_adopted_guide_is_retained_past_the_acquire_radius_and_dropped_past_the_retain_one() {
+        let catalog = catalog_or_skip!();
+        let (mut world, rx) = poll_world(true, true, 19.0, Some(catalog));
+        run_poll(&mut world);
+        assert_eq!(world.resource::<AreaSpiritHealer>().healer(), Some(GUIDE));
+        let _ = queries(&rx);
+
+        // 21 yd: outside acquire, inside retain — kept, and no second query.
+        let guide = world
+            .query_filtered::<Entity, With<crate::net::Guid>>()
+            .iter(&world)
+            .next()
+            .expect("the guide entity");
+        world
+            .entity_mut(guide)
+            .insert(Transform::from_xyz(21.0, 0.0, 0.0));
+        run_poll(&mut world);
+        assert_eq!(
+            world.resource::<AreaSpiritHealer>().healer(),
+            Some(GUIDE),
+            "retained between the two radii"
+        );
+        assert!(queries(&rx).is_empty(), "a retained guide is not re-asked");
+
+        // 23 yd: outside both — dropped.
+        world
+            .entity_mut(guide)
+            .insert(Transform::from_xyz(23.0, 0.0, 0.0));
+        run_poll(&mut world);
+        assert_eq!(world.resource::<AreaSpiritHealer>().healer(), None);
+    }
+
+    /// The unit filter is the `SPIRITGUIDE` bit and nothing else. A unit standing in the same spot
+    /// without it — a battle master, a herald, another player's corpse-side NPC — is skipped.
+    #[test]
+    fn a_unit_without_the_spiritguide_flag_is_never_adopted() {
+        let (mut world, rx) = poll_world(true, false, 1.0, None);
+        run_poll(&mut world);
+        assert_eq!(world.resource::<AreaSpiritHealer>().healer(), None);
+        assert!(queries(&rx).is_empty());
+    }
+
+    /// Resurrecting drops the guide. The poll is **level**-triggered, so the release happens on the
+    /// first frame the ghost flag clears — with the guide still standing right there.
+    #[test]
+    fn losing_the_ghost_state_drops_the_guide() {
+        let catalog = catalog_or_skip!();
+        let (mut world, _rx) = poll_world(true, true, 5.0, Some(catalog));
+        run_poll(&mut world);
+        assert_eq!(world.resource::<AreaSpiritHealer>().healer(), Some(GUIDE));
+
+        let me = world
+            .query_filtered::<Entity, With<SelfPlayer>>()
+            .iter(&world)
+            .next()
+            .expect("the body");
+        world
+            .entity_mut(me)
+            .insert(fields(&[(PLAYER_FLAGS_FIELD, 0)]));
+        run_poll(&mut world);
+        assert_eq!(
+            world.resource::<AreaSpiritHealer>().healer(),
+            None,
+            "alive again: the cache clears even though the guide has not moved"
+        );
+    }
+
+    /// The four client-side refusals of MEETINGSTONE(23)'s use slot (`0x5f69d0`, decision 2283),
+    /// in the reference's own order — and the pass that reaches `CMSG 0x292`.
+    #[test]
+    fn the_meeting_stone_join_refuses_in_the_references_order() {
+        use crate::go_templates::MeetingStoneTemplate;
+        const ME: u64 = 0x5e1f;
+        const MATE: u64 = 0xa11e;
+        // A stone anybody 15-60 may use — the shape most of 1.12's dungeon stones carry.
+        let stone = Some(MeetingStoneTemplate {
+            min_level: 15,
+            max_level: 60,
+            area: 1519,
+        });
+        let party = |leader: u64, others: usize, group_type: u8| GroupState {
+            in_group: true,
+            group_type,
+            leader,
+            members: (0..others)
+                .map(|i| benilla_protocol::messages::GroupMemberEntry {
+                    name: format!("Mate{i}"),
+                    guid: 0xb000 + i as u64,
+                    status: 1,
+                    flags: 0,
+                })
+                .collect(),
+            ..GroupState::default()
+        };
+
+        // Solo, in range of the level band: nothing refuses.
+        assert_eq!(
+            meeting_stone_join_refusal(None, Some(ME), Some(40), stone),
+            StoneJoin::Send
+        );
+        // Leading a party of FOUR (three others): still fine — a full party is five, and the
+        // stone's job is to find the fifth. This is the assertion the `+ 1` bug failed.
+        assert_eq!(
+            meeting_stone_join_refusal(Some(&party(ME, 3, 0)), Some(ME), Some(40), stone),
+            StoneJoin::Send
+        );
+
+        // 1 — in a party someone else leads.
+        assert_eq!(
+            meeting_stone_join_refusal(Some(&party(MATE, 1, 0)), Some(ME), Some(40), stone),
+            StoneJoin::Refuse("ERR_MEETING_STONE_MUST_BE_LEADER")
+        );
+        // 2 — leading a FULL party: four others, five including us, which is what
+        // `Group::IsFull()` refuses server-side too.
+        assert_eq!(
+            meeting_stone_join_refusal(Some(&party(ME, 4, 0)), Some(ME), Some(40), stone),
+            StoneJoin::Refuse("ERR_MEETING_STONE_GROUP_FULL")
+        );
+        // 3 — the level band, both ends, inclusive.
+        assert_eq!(
+            meeting_stone_join_refusal(None, Some(ME), Some(14), stone),
+            StoneJoin::Refuse("ERR_MEETING_STONE_INVALID_LEVEL")
+        );
+        assert_eq!(
+            meeting_stone_join_refusal(None, Some(ME), Some(61), stone),
+            StoneJoin::Refuse("ERR_MEETING_STONE_INVALID_LEVEL")
+        );
+        assert_eq!(
+            meeting_stone_join_refusal(None, Some(ME), Some(15), stone),
+            StoneJoin::Send
+        );
+        assert_eq!(
+            meeting_stone_join_refusal(None, Some(ME), Some(60), stone),
+            StoneJoin::Send
+        );
+        // 4 — a raid. Its leader is refused too, which is what puts it BELOW the leader term.
+        assert_eq!(
+            meeting_stone_join_refusal(Some(&party(ME, 1, 1)), Some(ME), Some(40), stone),
+            StoneJoin::Refuse("ERR_MEETING_STONE_NO_RAID_GROUP")
+        );
+
+        // The order is observable where two terms hold at once: a raid we do not lead answers
+        // MUST_BE_LEADER, not NO_RAID_GROUP.
+        assert_eq!(
+            meeting_stone_join_refusal(Some(&party(MATE, 4, 1)), Some(ME), Some(40), stone),
+            StoneJoin::Refuse("ERR_MEETING_STONE_MUST_BE_LEADER")
+        );
+
+        // **An unanswered template refuses**, because `0x5f8150` reads `0/0` off an uncached
+        // object and every level >= 1 is outside `0..=0`. The permissive "skip the term while the
+        // query is in flight" default the highlight column takes is not this slot's — the first
+        // cut of this code had it, and the §5 round is what corrected it.
+        assert_eq!(
+            meeting_stone_join_refusal(None, Some(ME), Some(5), None),
+            StoneJoin::Refuse("ERR_MEETING_STONE_INVALID_LEVEL")
+        );
+        // The same arithmetic on a shipped `0/0` band; `0/60` is the open one.
+        let closed = Some(MeetingStoneTemplate {
+            min_level: 0,
+            max_level: 0,
+            area: 1519,
+        });
+        let open = Some(MeetingStoneTemplate {
+            min_level: 0,
+            max_level: 60,
+            area: 1519,
+        });
+        assert_eq!(
+            meeting_stone_join_refusal(None, Some(ME), Some(1), closed),
+            StoneJoin::Refuse("ERR_MEETING_STONE_INVALID_LEVEL")
+        );
+        assert_eq!(
+            meeting_stone_join_refusal(None, Some(ME), Some(60), open),
+            StoneJoin::Send
+        );
+
+        // `0x5f69f8` — no active player: SILENT, and not one of the four refusals. Neither a
+        // missing guid nor a level the store has not streamed reaches a message or a packet.
+        assert_eq!(
+            meeting_stone_join_refusal(None, Some(ME), None, stone),
+            StoneJoin::Silent
+        );
+        assert_eq!(
+            meeting_stone_join_refusal(None, None, Some(40), stone),
+            StoneJoin::Silent
+        );
+    }
+
+    /// The join drain end to end: a clicked stone the player may use puts `CMSG 0x292` on the
+    /// wire with that object's guid, and a refused one puts **nothing** there.
+    #[test]
+    fn the_join_drain_sends_the_clicked_stone_and_refuses_silently_on_the_wire() {
+        use crate::go_templates::GameObjectTemplates;
+        // A real GameObject guid: `counter | (entry << 24) | (HIGH_GAMEOBJECT << 48)` — the
+        // template cache is keyed by the entry the guid carries, so a made-up number would
+        // silently miss and skip the level term.
+        const STONE_ENTRY: u32 = 0x5701;
+        const STONE: u64 = 0xF110 << 48 | (STONE_ENTRY as u64) << 24 | 0x22;
+        const ME: u64 = 0x5e1f;
+        const MATE: u64 = 0xa11e;
+
+        let (tx, rx) = crossbeam_channel::unbounded();
+        let mut app = App::new();
+        let mut templates = GameObjectTemplates::default();
+        let mut data = [0i32; 24];
+        (data[0], data[1], data[2]) = (15, 60, 1519);
+        assert_eq!(benilla_protocol::guid::entry(STONE), Some(STONE_ENTRY));
+        templates.insert(STONE_ENTRY, 23, "Stonard Meeting Stone".into(), &data);
+        app.insert_resource(templates)
+            .insert_resource(NetCommands(tx))
+            .insert_resource(SelfGuid(Some(ME)))
+            .init_resource::<GroupState>()
+            .init_resource::<crate::ui_action::UiErrorKeys>()
+            .init_resource::<crate::ui_chat::ChatLog>()
+            .init_resource::<crate::sound::MessageSounds>()
+            .add_message::<MeetingStoneUse>()
+            .add_systems(Update, drain_meeting_stone_joins);
+        app.insert_non_send_resource(UiScript::new().expect("VM"));
+        app.world_mut().spawn((
+            SelfPlayer,
+            ObjectStore(benilla_protocol::ObjectFields::from_pairs(&[(
+                LEVEL_FIELD,
+                40,
+            )])),
+        ));
+
+        let joins = |rx: &crossbeam_channel::Receiver<ClientCommand>| {
+            rx.try_iter()
+                .filter_map(|c| match c {
+                    ClientCommand::MeetingStoneJoin { go_guid } => Some(go_guid),
+                    _ => None,
+                })
+                .collect::<Vec<_>>()
+        };
+
+        app.world_mut()
+            .write_message(MeetingStoneUse { go_guid: STONE });
+        app.update();
+        assert_eq!(joins(&rx), vec![STONE], "the clicked stone's own guid");
+
+        // Now in a party led by someone else: the same click sends nothing at all.
+        app.world_mut().resource_mut::<GroupState>().in_group = true;
+        app.world_mut().resource_mut::<GroupState>().leader = MATE;
+        app.world_mut()
+            .write_message(MeetingStoneUse { go_guid: STONE });
+        app.update();
+        assert!(
+            joins(&rx).is_empty(),
+            "a refusal is a local line, never a packet"
+        );
+    }
+
     /// **The `/reload` re-query** — the meeting-stone half of 1290's class, and the reference's
     /// own behaviour rather than an invention of ours.
     ///
diff --git a/crates/benilla-app/src/ui_dressup.rs b/crates/benilla-app/src/ui_dressup.rs
index 1f4815bf..796a8303 100644
--- a/crates/benilla-app/src/ui_dressup.rs
+++ b/crates/benilla-app/src/ui_dressup.rs
@@ -2,7 +2,7 @@
 //! window's `DressUpModel` widget verbs ([`DressUpIntent`], queued engine-side) and the booth's
 //! look ([`DressUpPreview`]).
 //!
-//! Three jobs, each frame, before the VM ticks ([`UiInput`]):
+//! Three jobs, each frame, in the feed phase before the VM ticks ([`UiFeed`]):
 //!
 //! - **Apply the intents, in order.** `Dress` drops every substitution (the ref's
 //!   `SetUnit("player")` on open and `Dress()` on Reset); `Undress` strips every worn piece but
@@ -37,7 +37,7 @@ use crate::entities::equip_slot;
 use crate::items::Items;
 use crate::net::{NetCommands, NetEntity, ObjectStore, SelfPlayer};
 use crate::portrait::{DressUpLook, DressUpPreview};
-use crate::ui_script::UiInput;
+use crate::ui_script::UiFeed;
 
 /// The equipment slots a dressing-room look reads off the player — every rendered slot
 /// (`EQUIPMENT_SLOT_*`), which is exactly the set [`equip_slot`] can map an item into.
@@ -198,7 +198,7 @@ impl DressUpRoom {
     /// Resolve whatever is still waiting on a template answer. `Items::template` asks once and
     /// answers on a later frame; an id the server never answers for simply stays pending, showing
     /// the player's own gear in that slot rather than a hole.
-    fn resolve_pending(&mut self, items: &mut Items, commands: &NetCommands) {
+    fn resolve_pending(&mut self, items: &Items, commands: &NetCommands) {
         let mut pending = std::mem::take(&mut self.pending);
         pending.retain(|item| {
             let Some(t) = items.template(*item, 0, commands) else {
@@ -229,7 +229,7 @@ pub(crate) struct DressUpUiPlugin;
 impl Plugin for DressUpUiPlugin {
     fn build(&self, app: &mut App) {
         app.init_resource::<DressUpRoom>()
-            .add_systems(Update, feed_dressup.in_set(UiInput));
+            .add_systems(Update, feed_dressup.in_set(UiFeed));
     }
 }
 
@@ -237,7 +237,7 @@ fn feed_dressup(
     script: Option<NonSendMut<UiScript>>,
     mut room: ResMut<DressUpRoom>,
     mut preview: ResMut<DressUpPreview>,
-    mut items: ResMut<Items>,
+    items: Res<Items>,
     commands: Res<NetCommands>,
     self_q: Query<(&ObjectStore, &NetEntity), With<SelfPlayer>>,
     // The guild identity cache (1257) — `ResMut` because it is lazy: a miss is what sends the
@@ -268,14 +268,14 @@ fn feed_dressup(
     // law, 0208 §5 / 1751).
     preview.yaw = script.model_pane_facing("DressUpModel");
 
-    room.resolve_pending(&mut items, &commands);
+    room.resolve_pending(&items, &commands);
 
     // The guild join is the caller's, not [`player_look`]'s: that function resolves an *outfit* out
     // of the descriptor and the room's substitutions, and the crest is neither — it comes off a
     // separate lazy cache this system holds the handle to.
     let look = match (room.open, self_q.single().ok()) {
         (true, Some((store, net))) => {
-            player_look(store, net, &room, &mut items, &commands).map(|l| DressUpLook {
+            player_look(store, net, &room, &items, &commands).map(|l| DressUpLook {
                 emblem: crate::ui_guild::unit_guild_emblem(&store.0, &mut guilds, &commands),
                 ..l
             })
@@ -294,7 +294,7 @@ fn player_look(
     store: &ObjectStore,
     net: &NetEntity,
     room: &DressUpRoom,
-    items: &mut Items,
+    items: &Items,
     commands: &NetCommands,
 ) -> Option<DressUpLook> {
     let s = &store.0;
@@ -417,9 +417,9 @@ mod tests {
         let mut room = DressUpRoom::default();
         room.apply(DressUpIntent::Dress);
         room.apply(DressUpIntent::TryOn(2000));
-        room.resolve_pending(&mut items, &cmds);
+        room.resolve_pending(&items, &cmds);
 
-        let look = player_look(&store, &net(), &room, &mut items, &cmds).expect("a look");
+        let look = player_look(&store, &net(), &room, &items, &cmds).expect("a look");
         assert_eq!(
             look.equipment[4].display_id, 7000,
             "the tried-on chest shows"
@@ -446,9 +446,9 @@ mod tests {
 
         let mut room = DressUpRoom::default();
         room.apply(DressUpIntent::TryOn(2000));
-        room.resolve_pending(&mut items, &cmds);
+        room.resolve_pending(&items, &cmds);
         assert_eq!(
-            player_look(&store, &net(), &room, &mut items, &cmds)
+            player_look(&store, &net(), &room, &items, &cmds)
                 .unwrap()
                 .equipment[4]
                 .display_id,
@@ -457,7 +457,7 @@ mod tests {
 
         room.apply(DressUpIntent::Dress);
         assert_eq!(
-            player_look(&store, &net(), &room, &mut items, &cmds)
+            player_look(&store, &net(), &room, &items, &cmds)
                 .unwrap()
                 .equipment[4]
                 .display_id,
@@ -485,9 +485,9 @@ mod tests {
         let mut room = DressUpRoom::default();
         room.apply(DressUpIntent::Dress);
         room.apply(DressUpIntent::TryOn(2000));
-        room.resolve_pending(&mut items, &cmds);
+        room.resolve_pending(&items, &cmds);
         room.apply(DressUpIntent::Undress);
-        let look = player_look(&store, &net(), &room, &mut items, &cmds).unwrap();
+        let look = player_look(&store, &net(), &room, &items, &cmds).unwrap();
         assert_eq!(look.equipment[4].display_id, 0, "the tried-on chest is off");
         assert_eq!(look.equipment[0].display_id, 0, "the worn helm is off");
         assert_eq!(
@@ -496,8 +496,8 @@ mod tests {
         );
 
         room.apply(DressUpIntent::TryOn(2000));
-        room.resolve_pending(&mut items, &cmds);
-        let look = player_look(&store, &net(), &room, &mut items, &cmds).unwrap();
+        room.resolve_pending(&items, &cmds);
+        let look = player_look(&store, &net(), &room, &items, &cmds).unwrap();
         assert_eq!(
             look.equipment[4].display_id, 7000,
             "a try-on lands on the bare body"
@@ -508,7 +508,7 @@ mod tests {
         );
 
         room.apply(DressUpIntent::Dress);
-        let look = player_look(&store, &net(), &room, &mut items, &cmds).unwrap();
+        let look = player_look(&store, &net(), &room, &items, &cmds).unwrap();
         assert_eq!(
             look.equipment[4].display_id, 5000,
             "Dress puts the player's own chest back"
@@ -528,10 +528,10 @@ mod tests {
 
         let mut room = DressUpRoom::default();
         room.apply(DressUpIntent::TryOn(2000));
-        room.resolve_pending(&mut items, &cmds);
+        room.resolve_pending(&items, &cmds);
         assert_eq!(room.pending, vec![2000], "still waiting on the answer");
         assert_eq!(
-            player_look(&store, &net(), &room, &mut items, &cmds)
+            player_look(&store, &net(), &room, &items, &cmds)
                 .unwrap()
                 .equipment[4]
                 .display_id,
@@ -546,10 +546,10 @@ mod tests {
         assert_eq!(asks, 1);
 
         items.insert_template(2000, Some(worn("Shiny Chest", 7000, 5)));
-        room.resolve_pending(&mut items, &cmds);
+        room.resolve_pending(&items, &cmds);
         assert!(room.pending.is_empty());
         assert_eq!(
-            player_look(&store, &net(), &room, &mut items, &cmds)
+            player_look(&store, &net(), &room, &items, &cmds)
                 .unwrap()
                 .equipment[4]
                 .display_id,
@@ -567,7 +567,7 @@ mod tests {
         items.insert_template(3000, Some(worn("Healing Potion", 9000, 0)));
         let mut room = DressUpRoom::default();
         room.apply(DressUpIntent::TryOn(3000));
-        room.resolve_pending(&mut items, &cmds);
+        room.resolve_pending(&items, &cmds);
         assert!(room.pending.is_empty(), "resolved, just not worn anywhere");
         assert!(room.worn.iter().all(Option::is_none));
     }
@@ -593,9 +593,9 @@ mod tests {
             let mut room = DressUpRoom::default();
             room.apply(DressUpIntent::Dress);
             room.apply(DressUpIntent::TryOn(item));
-            room.resolve_pending(&mut items, &cmds);
+            room.resolve_pending(&items, &cmds);
 
-            let look = player_look(&store, &net(), &room, &mut items, &cmds).expect("a look");
+            let look = player_look(&store, &net(), &room, &items, &cmds).expect("a look");
             assert_eq!(
                 look.equipment[17].display_id, display,
                 "the {what} is in the ranged slot, which is what puts it in a hand"
@@ -622,7 +622,7 @@ mod tests {
 
         let mut room = DressUpRoom::default();
         room.apply(DressUpIntent::Dress);
-        let look = player_look(&store, &net(), &room, &mut items, &cmds).expect("a look");
+        let look = player_look(&store, &net(), &room, &items, &cmds).expect("a look");
         assert_eq!(
             look.equipment[17].display_id, 0,
             "the worn bow stays stowed"
@@ -644,11 +644,11 @@ mod tests {
         let mut room = DressUpRoom::default();
         room.apply(DressUpIntent::Dress);
         room.apply(DressUpIntent::TryOn(2500));
-        room.resolve_pending(&mut items, &cmds);
+        room.resolve_pending(&items, &cmds);
         room.apply(DressUpIntent::TryOn(2700));
-        room.resolve_pending(&mut items, &cmds);
+        room.resolve_pending(&items, &cmds);
 
-        let look = player_look(&store, &net(), &room, &mut items, &cmds).expect("a look");
+        let look = player_look(&store, &net(), &room, &items, &cmds).expect("a look");
         assert_eq!(look.equipment[15].display_id, 8700, "the axe is in hand");
         assert_eq!(look.equipment[17].display_id, 0, "…and the bow is gone");
     }
@@ -668,13 +668,13 @@ mod tests {
         let mut room = DressUpRoom::default();
         room.apply(DressUpIntent::Dress);
         room.apply(DressUpIntent::TryOn(1600));
-        room.resolve_pending(&mut items, &cmds);
+        room.resolve_pending(&items, &cmds);
 
-        let look = player_look(&player(&[(15, 1500)]), &net(), &room, &mut items, &cmds).unwrap();
+        let look = player_look(&player(&[(15, 1500)]), &net(), &room, &items, &cmds).unwrap();
         assert_eq!(look.equipment[15].display_id, 5500, "the one-hander stays");
         assert_eq!(look.equipment[16].display_id, 5600, "…beside the shield");
 
-        let look = player_look(&player(&[(15, 1550)]), &net(), &room, &mut items, &cmds).unwrap();
+        let look = player_look(&player(&[(15, 1550)]), &net(), &room, &items, &cmds).unwrap();
         assert_eq!(
             look.equipment[15].display_id, 0,
             "the two-hander is evicted"
@@ -714,9 +714,9 @@ mod tests {
             let mut room = DressUpRoom::default();
             room.apply(DressUpIntent::Dress);
             room.apply(DressUpIntent::TryOn(2000));
-            room.resolve_pending(&mut items, &cmds);
+            room.resolve_pending(&items, &cmds);
 
-            let look = player_look(&store, &net(), &room, &mut items, &cmds).expect("a look");
+            let look = player_look(&store, &net(), &room, &items, &cmds).expect("a look");
             assert_eq!(look.equipment[7].display_id, 7000, "the boots went on");
             assert_eq!(
                 (look.equipment[15].display_id, look.equipment[16].display_id),
@@ -747,7 +747,7 @@ mod tests {
 
         let mut room = DressUpRoom::default();
         room.apply(DressUpIntent::Dress);
-        let look = player_look(&store, &net(), &room, &mut items, &cmds).expect("a look");
+        let look = player_look(&store, &net(), &room, &items, &cmds).expect("a look");
         assert_eq!(
             look.equipment[0].display_id, 0,
             "the player's own helm is hidden"
@@ -761,8 +761,8 @@ mod tests {
         // A try-on is not their own gear, so nothing suppresses it — this is the branch the
         // reference reaches by never testing the flag on the TryOn path at all.
         room.apply(DressUpIntent::TryOn(2000));
-        room.resolve_pending(&mut items, &cmds);
-        let look = player_look(&store, &net(), &room, &mut items, &cmds).expect("a look");
+        room.resolve_pending(&items, &cmds);
+        let look = player_look(&store, &net(), &room, &items, &cmds).expect("a look");
         assert_eq!(
             look.equipment[0].display_id, 7000,
             "the tried-on helm previews regardless of the preference"
@@ -770,7 +770,7 @@ mod tests {
 
         // …and Reset drops the substitution, so the mannequin goes back to bare-headed.
         room.apply(DressUpIntent::Dress);
-        let look = player_look(&store, &net(), &room, &mut items, &cmds).expect("a look");
+        let look = player_look(&store, &net(), &room, &items, &cmds).expect("a look");
         assert_eq!(
             look.equipment[0].display_id, 0,
             "Reset re-clones the hidden helm away"
diff --git a/crates/benilla-app/src/ui_duel.rs b/crates/benilla-app/src/ui_duel.rs
index 0daad436..9553505a 100644
--- a/crates/benilla-app/src/ui_duel.rs
+++ b/crates/benilla-app/src/ui_duel.rs
@@ -49,7 +49,7 @@ use crate::names::NameCache;
 use crate::net::{ClientCommand, Guid, GuidIndex, NetCommands, SelfPlayer};
 use crate::target::Selection;
 use crate::ui_action::Spells;
-use crate::ui_script::UiInput;
+use crate::ui_script::{UiFeed, UiInput};
 
 /// `SPELL_EFFECT_DUEL` — the `Effect[0]` value that identifies the duel spell in the player's own
 /// spellbook (7266 "Duel" on 1.12 data, granted to every race/class at creation). The reference
@@ -255,7 +255,7 @@ pub(crate) mod apply {
 fn feed_duel(
     script: Option<NonSendMut<UiScript>>,
     mut duel: ResMut<DuelState>,
-    mut names: ResMut<NameCache>,
+    names: Res<NameCache>,
     commands: Res<NetCommands>,
     mut sink: crate::ui_action::MessageSink,
     mut fed: Local<crate::ui_script::VmMemo<FedDuel>>,
@@ -343,7 +343,6 @@ fn tick_countdown(time: Res<Time>, mut duel: ResMut<DuelState>, mut started: Loc
 }
 
 /// Drain the Era API's duel intents into their sends.
-#[allow(clippy::too_many_arguments)] // a Bevy system's param list IS its dependency set
 fn drain_duel(
     script: Option<NonSendMut<UiScript>>,
     duel: Res<DuelState>,
@@ -469,7 +468,7 @@ impl Plugin for UiDuelPlugin {
                 // the VM — so the tick has to run first or every "Duel starting: N" lands a
                 // frame late.
                 tick_countdown.before(feed_duel),
-                feed_duel.before(UiInput),
+                feed_duel.in_set(UiFeed),
                 drain_duel.after(UiInput),
             ),
         );
diff --git a/crates/benilla-app/src/ui_follow.rs b/crates/benilla-app/src/ui_follow.rs
index 53e1bd7a..62f80780 100644
--- a/crates/benilla-app/src/ui_follow.rs
+++ b/crates/benilla-app/src/ui_follow.rs
@@ -53,7 +53,7 @@ use bevy::prelude::*;
 use benilla_ui::script::{FollowRequest as ScriptFollowRequest, ScriptValue, UiScript};
 
 use crate::player::{FollowRequest, FollowState};
-use crate::ui_script::UiInput;
+use crate::ui_script::{UiFeed, UiInput};
 
 /// What the VM has last been told, so the two events fire exactly on transitions and never once a
 /// frame. Mirrors [`FollowState::guid`]; `None` means the VM believes no follow is running.
@@ -126,7 +126,7 @@ impl Plugin for UiFollowPlugin {
     fn build(&self, app: &mut App) {
         app.init_resource::<FollowFeed>().add_systems(
             Update,
-            (feed_follow.before(UiInput), drain_follow.after(UiInput)),
+            (feed_follow.in_set(UiFeed), drain_follow.after(UiInput)),
         );
     }
 }
diff --git a/crates/benilla-app/src/ui_gamma.rs b/crates/benilla-app/src/ui_gamma.rs
index 84e838a1..34a7839c 100644
--- a/crates/benilla-app/src/ui_gamma.rs
+++ b/crates/benilla-app/src/ui_gamma.rs
@@ -315,8 +315,18 @@ fn use_gamma_ui_shaders(
 
 pub(crate) struct UiGammaPlugin;
 
+/// Brightness's change callback (2182, 2303). The clamp is OURS and the reference has none —
+/// the reason it costs one is on [`GAMMA_RANGE`], and nothing a player can reach from the panel
+/// meets it.
+pub(crate) fn on_cvar(ev: On<crate::cvars::CvarChanged>, mut gamma: ResMut<DisplayGamma>) {
+    if ev.is(benilla_ui::script::CVAR_GAMMA) {
+        gamma.0 = ev.num().clamp(*GAMMA_RANGE.start(), *GAMMA_RANGE.end());
+    }
+}
+
 impl Plugin for UiGammaPlugin {
     fn build(&self, app: &mut App) {
+        app.add_observer(on_cvar);
         app.init_resource::<DisplayGamma>()
             .add_plugins(ExtractComponentPlugin::<UiGammaLane>::default())
             .add_systems(Update, stamp_lane_gamma);
diff --git a/crates/benilla-app/src/ui_gm_ticket.rs b/crates/benilla-app/src/ui_gm_ticket.rs
index f012e553..a7fddcf6 100644
--- a/crates/benilla-app/src/ui_gm_ticket.rs
+++ b/crates/benilla-app/src/ui_gm_ticket.rs
@@ -69,7 +69,7 @@ use benilla_assets::coords::bevy_to_wow;
 
 use crate::net::{ClientCommand, NetCommands};
 use crate::player::Player;
-use crate::ui_script::{UiInput, VmMemo};
+use crate::ui_script::{UiFeed, UiInput, VmMemo};
 
 /// Spell 7355 "Stuck" — what `Stuck()` casts, and the Help window's "Auto-Unstuck".
 ///
@@ -449,7 +449,7 @@ impl Plugin for UiGmTicketPlugin {
             .add_systems(
                 Update,
                 (
-                    feed_gm_ticket.before(UiInput),
+                    feed_gm_ticket.in_set(UiFeed),
                     drain_gm_ticket.after(UiInput),
                 ),
             );
diff --git a/crates/benilla-app/src/ui_gossip.rs b/crates/benilla-app/src/ui_gossip.rs
index e7b900c3..32c7e830 100644
--- a/crates/benilla-app/src/ui_gossip.rs
+++ b/crates/benilla-app/src/ui_gossip.rs
@@ -34,7 +34,7 @@ use benilla_ui::script::{GossipMenu, GossipOptionView, GossipQuestRow, ScriptVal
 use crate::names::NameCache;
 use crate::net::{ClientCommand, Guid, NetCommands, ObjectStore, SelfPlayer};
 use crate::ui_quest::{row_is_active, row_is_one_click};
-use crate::ui_script::UiInput;
+use crate::ui_script::{UiFeed, UiInput};
 use crate::ui_session::{close_npc_session_out_of_range, npc_switched, NpcSession};
 
 /// The open gossip menu, filled by the net bridge ([`crate::net`]) and read by [`feed_gossip`]. The
@@ -201,7 +201,7 @@ impl Plugin for UiGossipPlugin {
                 // push before the input pass so an open/close is on screen the same frame; drain
                 // after it so a click's intent goes out the same frame (mirrors ui_items).
                 close_npc_session_out_of_range::<GossipState>.before(feed_gossip),
-                feed_gossip.before(UiInput),
+                feed_gossip.in_set(UiFeed),
                 drain_gossip.after(UiInput),
             ),
         );
@@ -309,12 +309,11 @@ fn snapshot(state: &GossipState) -> Option<GossipMenu> {
 /// Push the current menu into the VM and fire the open/close events on a transition (or a content
 /// change — the greeting arriving a frame after the menu). Diffed against a `Local` memory, exactly
 /// like the container feed's per-bag diff.
-#[allow(clippy::too_many_arguments)]
 fn feed_gossip(
     script: Option<NonSendMut<UiScript>>,
     state: Res<GossipState>,
     self_q: Query<(&ObjectStore, &Guid), With<SelfPlayer>>,
-    mut names: ResMut<NameCache>,
+    names: Res<NameCache>,
     commands: Res<NetCommands>,
     states: Res<crate::world_state::WorldStates>,
     mut last: Local<crate::ui_script::VmMemo<Option<GossipMenu>>>,
@@ -351,7 +350,7 @@ fn feed_gossip(
     let mut fresh = snapshot(&state);
     // Expand the greeting's chat-text macros ($N/$B/$G/$<n>w) client-side, as the real client does.
     if let Some(greeting) = fresh.as_mut().map(|m| &mut m.greeting) {
-        let player = crate::npc_text::player_identity(&self_q, &mut names, &commands);
+        let player = crate::npc_text::player_identity(&self_q, &names, &commands);
         *greeting = crate::npc_text::substitute(
             greeting,
             &crate::npc_text::MacroContext {
diff --git a/crates/benilla-app/src/ui_guild/mod.rs b/crates/benilla-app/src/ui_guild/mod.rs
index cc2fa0f6..cf1e5b56 100644
--- a/crates/benilla-app/src/ui_guild/mod.rs
+++ b/crates/benilla-app/src/ui_guild/mod.rs
@@ -35,8 +35,6 @@
 //!   (`0x4d1160`). See [`RosterUpdate`]: the two halves are one mechanism, and implementing either
 //!   without the other breaks it.
 
-use std::collections::{HashMap, HashSet};
-
 use benilla_formats::GuildEmblem;
 use benilla_protocol::messages::{
     guild_event, GuildCommandResult, GuildEventNotice, GuildInfo, GuildQueryResponse, GuildRoster,
@@ -47,7 +45,8 @@ use benilla_ui::script::{LastOnline, UnitGuild};
 use bevy::prelude::*;
 
 use crate::net::{ClientCommand, NetCommands};
-use crate::ui_script::UiInput;
+use crate::query_cache::QueryCache;
+use crate::ui_script::{UiFeed, UiInput};
 
 mod feed;
 mod lines;
@@ -158,14 +157,14 @@ pub(crate) struct GuildState {
     guild_id: u32,
     /// Our own `PLAYER_GUILDRANK` (field 192), **0-based**, `0` = guild master.
     rank_index: u32,
-    /// Guild id → identity, from `SMSG_GUILD_QUERY_RESPONSE`. Holds negatives (module doc).
-    identities: HashMap<u32, Identity>,
+    /// Guild id → identity, from `SMSG_GUILD_QUERY_RESPONSE`, ask-once through [`QueryCache`]
+    /// (decision 2288). Holds negatives (module doc).
+    identities: QueryCache<u32, Identity>,
     /// Bumped by every landed identity ([`Self::apply_query_response`]) — never by an ask. The
     /// gated unit feeds' watch counter (decision 1439): `unit_guild`'s miss resolves later, and
-    /// `is_changed` cannot flag the landing because the miss itself takes `&mut self` per frame.
+    /// `is_changed` could not flag the landing while the miss itself took `&mut self` per frame
+    /// (2288 made it `&self`; the counter stays as the finer signal).
     identity_generation: u64,
-    /// Guild ids with a `CMSG_GUILD_QUERY` in flight — the ask-once gate.
-    queried: HashSet<u32>,
     /// The message of the day. Kept beside the roster rather than inside it because `GE_MOTD`
     /// updates it on its own, and at login vmangos sends that event *before* any roster exists
     /// (`CharacterHandler.cpp:558`).
@@ -209,6 +208,12 @@ pub(crate) struct GuildState {
     pending_info: Vec<GuildInfo>,
 }
 
+impl crate::query_cache::AskOnce for GuildState {
+    fn clear_pending(&mut self) {
+        self.identities.clear_pending();
+    }
+}
+
 impl GuildState {
     /// Are we in a guild? Our own `PLAYER_GUILDID`, nothing else — answerable before any packet.
     pub(crate) fn in_guild(&self) -> bool {
@@ -269,25 +274,24 @@ impl GuildState {
     /// Ask for a guild's identity if we do not already hold one — the lazy cache fill (module
     /// doc). Nothing else in this client ever sends `CMSG_GUILD_QUERY`: no world-entry priming, no
     /// sweep. A negative (`""` name) counts as held, so it is never re-asked.
-    fn request_identity(&mut self, guild_id: u32, commands: &NetCommands) {
-        if guild_id != 0
-            && !self.identities.contains_key(&guild_id)
-            && self.queried.insert(guild_id)
-        {
-            let _ = commands.0.send(ClientCommand::GuildQuery { guild_id });
+    fn request_identity(&self, guild_id: u32, commands: &NetCommands) {
+        if guild_id != 0 {
+            self.identities.get_or_ask(guild_id, || {
+                let _ = commands.0.send(ClientCommand::GuildQuery { guild_id });
+            });
         }
     }
 
     /// A guild's identity, if we hold a real one. `None` covers both "not asked yet / in flight"
     /// and "no such guild".
     fn identity(&self, guild_id: u32) -> Option<&Identity> {
-        self.identities.get(&guild_id).filter(|i| i.exists())
+        self.identities.get(guild_id).filter(|i| i.exists())
     }
 
     /// [`Self::request_identity`] then [`Self::identity`] — the read that also asks, shaped like
     /// [`crate::names::NameCache::resolve`]: it answers `None` for *this* call and the answer
     /// arrives later, which is the reference's behaviour and not a gap to paper over.
-    fn resolve_identity(&mut self, guild_id: u32, commands: &NetCommands) -> Option<&Identity> {
+    fn resolve_identity(&self, guild_id: u32, commands: &NetCommands) -> Option<&Identity> {
         self.request_identity(guild_id, commands);
         self.identity(guild_id)
     }
@@ -302,7 +306,7 @@ impl GuildState {
     /// while it has not arrived or the player has no guild. A miss sends the query, the lazy-cache
     /// idiom every other read of this cache uses.
     pub(crate) fn own_emblem_record(
-        &mut self,
+        &self,
         guild_id: u32,
         commands: &NetCommands,
     ) -> Option<[i32; 5]> {
@@ -320,8 +324,7 @@ impl GuildState {
     /// dropped so the next query anywhere re-fetches it — the tabards of every member in sight
     /// re-dress off the arrival, as the reference's guild-appearance refresh does.
     pub(crate) fn evict_own_identity(&mut self) {
-        if self.identities.remove(&self.guild_id).is_some() {
-            self.queried.remove(&self.guild_id);
+        if self.identities.evict(self.guild_id) {
             self.identity_generation = self.identity_generation.wrapping_add(1);
             self.dirty = true;
         }
@@ -329,11 +332,10 @@ impl GuildState {
 
     /// `SMSG_GUILD_QUERY_RESPONSE` — fill (or negatively fill) the identity cache.
     fn apply_query_response(&mut self, response: GuildQueryResponse) {
-        self.queried.remove(&response.guild_id);
         let ours = response.guild_id == self.guild_id;
         self.identities.insert(
             response.guild_id,
-            Identity {
+            Some(Identity {
                 name: response.name,
                 rank_names: response.rank_names,
                 emblem: GuildEmblem {
@@ -343,7 +345,7 @@ impl GuildState {
                     border_color: response.border_color,
                     background_color: response.background_color,
                 },
-            },
+            }),
         );
         self.identity_generation = self.identity_generation.wrapping_add(1);
         self.dirty = true;
@@ -385,8 +387,7 @@ impl GuildState {
                 // this packet.
                 let rank = notice.params.first().and_then(|p| p.parse::<usize>().ok());
                 let name = notice.params.get(1).cloned().unwrap_or_default();
-                if let (Some(rank), Some(identity)) =
-                    (rank, self.identities.get_mut(&self.guild_id))
+                if let (Some(rank), Some(identity)) = (rank, self.identities.get_mut(self.guild_id))
                 {
                     if let Some(slot) = identity.rank_names.get_mut(rank) {
                         *slot = name;
@@ -779,14 +780,24 @@ pub(crate) struct GuildFeed;
 /// The guild windows' session: the wire mirror, the VM feed, and the outbound intents.
 pub(crate) struct UiGuildPlugin;
 
+/// Guild Member Alert's change callback (1589, 2303) — conjunct 2 of the sign-on/sign-off
+/// line's condition; a flag.
+pub(crate) fn on_cvar(ev: On<crate::cvars::CvarChanged>, mut notify: ResMut<GuildMemberNotify>) {
+    if ev.is("guildMemberNotify") {
+        notify.0 = ev.flag();
+    }
+}
+
 impl Plugin for UiGuildPlugin {
     fn build(&self, app: &mut App) {
+        app.add_observer(on_cvar);
+        crate::query_cache::register::<GuildState>(app);
         app.init_resource::<GuildState>()
             .init_resource::<GuildMemberNotify>()
             .add_systems(
                 Update,
                 (
-                    feed::feed_guild.before(UiInput).in_set(GuildFeed),
+                    feed::feed_guild.in_set(UiFeed).in_set(GuildFeed),
                     feed::drain_guild.after(UiInput),
                 )
                     // **Never against the boot VM** (1348/1978, and B376's half of it): the feed
@@ -993,8 +1004,8 @@ mod tests {
             name: String::new(),
             ..Default::default()
         });
-        assert!(guild.identities.contains_key(&7), "cached as a negative");
-        assert!(!guild.queried.contains(&7), "and no longer in flight");
+        assert!(guild.identities.answered(7), "cached as a negative");
+        assert!(!guild.identities.is_pending(7), "and no longer in flight");
         assert!(
             guild.resolve_identity(7, &commands).is_none(),
             "an empty name is not a guild"
@@ -1091,7 +1102,9 @@ mod tests {
     #[test]
     fn leaving_the_guild_drops_the_roster_but_not_the_identities() {
         let mut guild = GuildState::default();
-        guild.identities.insert(7, identity("Legacy", &["GM"]));
+        guild
+            .identities
+            .insert(7, Some(identity("Legacy", &["GM"])));
         assert!(guild.mirror_self(7, 0), "joined");
         guild.apply_roster(GuildRoster {
             motd: "Raid at eight".into(),
@@ -1107,7 +1120,7 @@ mod tests {
         assert!(guild.members.is_empty());
         assert!(guild.motd.is_empty());
         assert_eq!(guild.selection, 0);
-        assert!(guild.identities.contains_key(&7), "identities survive");
+        assert!(guild.identities.answered(7), "identities survive");
 
         assert!(!guild.mirror_self(0, 0), "no edge when nothing moved");
     }
@@ -1182,13 +1195,13 @@ mod tests {
         guild.mirror_self(7, 0);
         guild
             .identities
-            .insert(7, identity("Legacy", &["GM", "Off"]));
+            .insert(7, Some(identity("Legacy", &["GM", "Off"])));
         guild.apply_event(&event(
             guild_event::UPDATE_RANK_NAME,
             &["1", "Officer"],
             None,
         ));
-        assert_eq!(guild.identities[&7].rank_name(1), "Officer");
+        assert_eq!(guild.identities.get(7).unwrap().rank_name(1), "Officer");
         assert!(guild.dirty);
     }
 
@@ -1256,7 +1269,7 @@ mod tests {
         let mut guild = GuildState::default();
         guild
             .identities
-            .insert(7, identity("Legacy", &["GM", "Off"]));
+            .insert(7, Some(identity("Legacy", &["GM", "Off"])));
 
         // A creature, and a guildless player: no PLAYER_GUILDID at all.
         let guildless = ObjectFields::from_pairs(&[]);
@@ -1297,9 +1310,9 @@ mod tests {
         let mut guild = GuildState::default();
         guild
             .identities
-            .insert(7, identity("Legacy", &["GM", "Off"]));
+            .insert(7, Some(identity("Legacy", &["GM", "Off"])));
         // The negative cache: a query that came back empty is "no such guild", not a blank name.
-        guild.identities.insert(8, identity("", &[]));
+        guild.identities.insert(8, Some(identity("", &[])));
 
         let guildless = ObjectFields::from_pairs(&[]);
         assert_eq!(unit_guild_name(&guildless, &mut guild, &commands), None);
diff --git a/crates/benilla-app/src/ui_hide.rs b/crates/benilla-app/src/ui_hide.rs
index 0002a40a..035e6765 100644
--- a/crates/benilla-app/src/ui_hide.rs
+++ b/crates/benilla-app/src/ui_hide.rs
@@ -7,7 +7,7 @@
 
 use bevy::prelude::*;
 
-use crate::char_select::ClientState;
+use crate::char_select::{ClientState, InWorldGated};
 use crate::ui_script::UiInput;
 
 /// Is the player UI hidden right now? (`ALT-Z` — [`toggle_ui_hidden`].)
@@ -37,9 +37,7 @@ impl Plugin for UiHidePlugin {
                 Update,
                 // After `UiInput`, like every other gameplay key reader: an EditBox that consumed
                 // this frame's keys has already published its capture flag by then.
-                toggle_ui_hidden
-                    .after(UiInput)
-                    .run_if(in_state(ClientState::InWorld)),
+                toggle_ui_hidden.after(UiInput).in_set(InWorldGated),
             )
             .add_systems(OnExit(ClientState::InWorld), show_ui);
     }
diff --git a/crates/benilla-app/src/ui_honor.rs b/crates/benilla-app/src/ui_honor.rs
index b98697b7..813631ac 100644
--- a/crates/benilla-app/src/ui_honor.rs
+++ b/crates/benilla-app/src/ui_honor.rs
@@ -56,7 +56,7 @@ use bevy::prelude::*;
 use benilla_ui::script::{HonorState, InspectHonorData, ScriptValue, UiScript};
 
 use crate::net::{ClientCommand, NetCommands, ObjectStore, SelfPlayer};
-use crate::ui_script::{UiInput, VmMemo};
+use crate::ui_script::{UiFeed, VmMemo};
 
 /// The inspect-honor reply we currently hold, or `None` before one lands.
 ///
@@ -90,7 +90,7 @@ impl Plugin for UiHonorPlugin {
     fn build(&self, app: &mut App) {
         app.init_resource::<InspectHonor>()
             .init_resource::<HonorFeedState>()
-            .add_systems(Update, feed_honor.in_set(UiInput));
+            .add_systems(Update, feed_honor.in_set(UiFeed));
     }
 }
 
@@ -164,7 +164,6 @@ fn events_for(before: Option<&HonorState>, after: &HonorState) -> (bool, bool) {
 }
 
 /// Push the self snapshot and the inspect reply, fire what moved, and drain the pane's request.
-#[allow(clippy::too_many_arguments)] // a Bevy system's param list IS its dependency set
 fn feed_honor(
     script: Option<NonSendMut<UiScript>>,
     self_store: Query<&ObjectStore, With<SelfPlayer>>,
diff --git a/crates/benilla-app/src/ui_inspect.rs b/crates/benilla-app/src/ui_inspect.rs
index 1cbd448d..2bbf48bc 100644
--- a/crates/benilla-app/src/ui_inspect.rs
+++ b/crates/benilla-app/src/ui_inspect.rs
@@ -47,7 +47,7 @@ use crate::entities::ItemDisplays;
 use crate::items::Items;
 use crate::net::{ClientCommand, GuidIndex, NetCommands, ObjectStore};
 use crate::portrait::InspectBooth;
-use crate::ui_script::UiInput;
+use crate::ui_script::UiFeed;
 
 /// Which unit the inspect window is bound to — the ref's `InspectFrame.unit`, mirrored app-side so
 /// the feed knows whether to resolve anything. The **token** is the identity (not the guid): the
@@ -81,7 +81,7 @@ impl Plugin for InspectUiPlugin {
     fn build(&self, app: &mut App) {
         app.init_resource::<InspectTarget>()
             .init_resource::<InspectFeedState>()
-            .add_systems(Update, feed_inspect.in_set(UiInput));
+            .add_systems(Update, feed_inspect.in_set(UiFeed));
     }
 }
 
@@ -99,7 +99,7 @@ impl Plugin for InspectUiPlugin {
 /// data the reference's own inspect tooltip has.
 fn inspect_slot_view(
     store: &ObjectStore,
-    items: &mut Items,
+    items: &Items,
     icons: Option<&ItemDisplays>,
     rolls: crate::items::RollCatalogs,
     commands: &NetCommands,
@@ -155,13 +155,12 @@ fn inspect_slot_view(
     })
 }
 
-#[allow(clippy::too_many_arguments)]
 fn feed_inspect(
     script: Option<NonSendMut<UiScript>>,
     mut target: ResMut<InspectTarget>,
     mut feed: ResMut<InspectFeedState>,
     mut booth: ResMut<InspectBooth>,
-    mut items: ResMut<Items>,
+    items: Res<Items>,
     icons: Option<Res<ItemDisplays>>,
     // `SpellItemEnchantment`'s name column — the inspected item's enchant line (decision 0915) —
     // and `ItemRandomProperties`, the roll behind its "of the Monkey" name (1547).
@@ -234,7 +233,7 @@ fn feed_inspect(
     for slot in 1..=19u8 {
         slots[usize::from(slot)] = inspect_slot_view(
             store,
-            &mut items,
+            &items,
             icons.as_deref(),
             crate::items::RollCatalogs {
                 enchants: catalogs.0.as_deref(),
diff --git a/crates/benilla-app/src/ui_instance.rs b/crates/benilla-app/src/ui_instance.rs
index 9cd9409c..49cf12ca 100644
--- a/crates/benilla-app/src/ui_instance.rs
+++ b/crates/benilla-app/src/ui_instance.rs
@@ -113,7 +113,7 @@ use bevy::prelude::*;
 
 use crate::net::{ClientCommand, NetCommands};
 use crate::ui_chat::{ChatEvent, ChatEventKind, ChatLog};
-use crate::ui_script::UiInput;
+use crate::ui_script::{UiFeed, UiInput};
 
 /// The window `CanShowResetInstances()` offers the row in, in seconds — `cmp eax, 0x15f90` at
 /// `0x495ce6` against `time(0) - <when we left>`, unsigned, so the boundary is inclusive.
@@ -590,7 +590,7 @@ impl Plugin for UiInstancePlugin {
                 // a map change and its answer should not be a frame apart.
                 clear_witness_on_logout.before(track_instance_state),
                 track_instance_state.before(feed_instance),
-                feed_instance.before(UiInput),
+                feed_instance.in_set(UiFeed),
                 drain_instance.after(UiInput),
             ),
         );
diff --git a/crates/benilla-app/src/ui_item_text.rs b/crates/benilla-app/src/ui_item_text.rs
index bf54a382..bfb0caff 100644
--- a/crates/benilla-app/src/ui_item_text.rs
+++ b/crates/benilla-app/src/ui_item_text.rs
@@ -28,8 +28,6 @@
 //! bar) never fires — no translation mechanic on a private server's readables, and the `language`
 //! column (`data[1]`/`LanguageID`) is carried by neither source here.
 
-use std::collections::{HashMap, HashSet};
-
 use bevy::prelude::*;
 
 use benilla_ui::script::{ItemTextState, UiScript};
@@ -38,8 +36,9 @@ use crate::go_templates::GameObjectTemplates;
 use crate::items::Items;
 use crate::names::NameCache;
 use crate::net::{ClientCommand, NetCommands};
+use crate::query_cache::QueryCache;
 use crate::ui_mail::MailOpen;
-use crate::ui_script::UiInput;
+use crate::ui_script::{UiFeed, UiInput};
 
 /// One page of a book as the wire gave it (`SMSG_PAGE_TEXT_QUERY_RESPONSE`).
 pub(crate) struct PageText {
@@ -56,27 +55,30 @@ pub(crate) struct PageText {
 /// per-page fetch is still here for the server that answers one at a time.
 #[derive(Resource, Default)]
 pub(crate) struct PageTexts {
-    pages: HashMap<u32, PageText>,
-    pending: HashSet<u32>,
+    pages: QueryCache<u32, PageText>,
+}
+
+impl crate::query_cache::AskOnce for PageTexts {
+    fn clear_pending(&mut self) {
+        self.pages.clear_pending();
+    }
 }
 
 impl PageTexts {
     /// Record a page (and clear its in-flight flag).
     pub(crate) fn insert(&mut self, page_id: u32, text: String, next: u32) {
-        self.pending.remove(&page_id);
-        self.pages.insert(page_id, PageText { text, next });
+        self.pages.insert(page_id, Some(PageText { text, next }));
     }
 
     /// The cached page, asking for it once if this is the first asker. `guid` names the object
     /// doing the reading (the reference writes it after the page id; vmangos discards it).
-    fn get_or_ask(&mut self, page_id: u32, guid: u64, commands: &NetCommands) -> Option<&PageText> {
-        if !self.pages.contains_key(&page_id) && self.pending.insert(page_id) {
+    fn get_or_ask(&self, page_id: u32, guid: u64, commands: &NetCommands) -> Option<&PageText> {
+        self.pages.get_or_ask(page_id, || {
             debug!("page text: asking page {page_id} (object {guid:#x})");
             let _ = commands
                 .0
                 .send(ClientCommand::PageTextQuery { page_id, guid });
-        }
-        self.pages.get(&page_id)
+        })
     }
 }
 
@@ -180,6 +182,7 @@ pub(crate) struct UiItemTextPlugin;
 
 impl Plugin for UiItemTextPlugin {
     fn build(&self, app: &mut App) {
+        crate::query_cache::register::<PageTexts>(app);
         app.init_resource::<ItemTextOpen>()
             .init_resource::<PageTexts>()
             .add_systems(
@@ -187,7 +190,7 @@ impl Plugin for UiItemTextPlugin {
                 (
                     // Feed before the input pass so an open paints the same frame; drain after it so
                     // a Close click clears the same frame (the ui_mail ordering).
-                    feed_item_text.before(UiInput),
+                    feed_item_text.in_set(UiFeed),
                     drain_item_text.after(UiInput),
                 ),
             );
@@ -214,8 +217,8 @@ struct Readable {
 /// is FrameXML's "Parchment". A GameObject whose template is not cached yet is asked for.
 pub(crate) fn object_material(
     guid: u64,
-    items: &mut Items,
-    go_templates: &mut GameObjectTemplates,
+    items: &Items,
+    go_templates: &GameObjectTemplates,
     materials: Option<&PageMaterials>,
     commands: &NetCommands,
 ) -> Option<String> {
@@ -239,7 +242,7 @@ pub(crate) fn object_material(
 /// single resolve serves both sources.
 fn readable(
     guid: u64,
-    items: &mut Items,
+    items: &Items,
     go_templates: &GameObjectTemplates,
     materials: Option<&PageMaterials>,
     commands: &NetCommands,
@@ -267,14 +270,13 @@ fn readable(
 /// paint a Stone plaque in parchment ink. READY holds until the body and, for a letter, the creator
 /// line are both in. (The window itself only shows on READY — `ItemTextFrame.lua` calls
 /// `ShowUIPanel` there, not on BEGIN.)
-#[allow(clippy::too_many_arguments)]
 fn feed_item_text(
     script: Option<NonSendMut<UiScript>>,
     mut open: ResMut<ItemTextOpen>,
-    mut mail: ResMut<MailOpen>,
-    mut pages: ResMut<PageTexts>,
-    mut items: ResMut<Items>,
-    mut names: ResMut<NameCache>,
+    mail: Res<MailOpen>,
+    pages: Res<PageTexts>,
+    items: Res<Items>,
+    names: Res<NameCache>,
     go_templates: Res<GameObjectTemplates>,
     materials: Option<Res<PageMaterials>>,
     commands: Res<NetCommands>,
@@ -299,7 +301,7 @@ fn feed_item_text(
     }
     let Some(readable) = readable(
         sess.object_guid,
-        &mut items,
+        &items,
         &go_templates,
         materials.as_deref(),
         &commands,
@@ -346,13 +348,15 @@ fn feed_item_text(
                 },
             };
             // The body: the shared ask-once item-text cache (fetch if this is the first asker).
-            let body = mail.bodies.get(text_id).cloned();
-            if body.is_none() && mail.pending_bodies.insert(*text_id) {
-                let _ = commands.0.send(ClientCommand::ItemTextQuery {
-                    text_id: *text_id,
-                    mail_id: 0,
-                });
-            }
+            let body = mail
+                .bodies
+                .get_or_ask(*text_id, || {
+                    let _ = commands.0.send(ClientCommand::ItemTextQuery {
+                        text_id: *text_id,
+                        mail_id: 0,
+                    });
+                })
+                .cloned();
             let Some(text) = body else {
                 return; // body query in flight
             };
@@ -378,7 +382,7 @@ fn feed_item_text(
 
     // Page/book text is server-authored, so it runs the `$`-macro expander — the reference does it
     // from two sites in `ItemTextFrame.cpp` (decision 0754), subject = the local player.
-    let subject = crate::npc_text::player_identity(&self_q, &mut names, &commands);
+    let subject = crate::npc_text::player_identity(&self_q, &names, &commands);
     let text = crate::npc_text::substitute(
         &text,
         &crate::npc_text::MacroContext {
@@ -423,7 +427,7 @@ fn drain_item_text(
         let ReadSource::Pages { visited } = &mut sess.source else {
             continue; // a letter has no pages; its buttons never show
         };
-        if turn_page(visited, delta, |id| pages.pages.get(&id).map(|p| p.next)) {
+        if turn_page(visited, delta, |id| pages.pages.get(id).map(|p| p.next)) {
             // Repaint on the next feed, without re-firing BEGIN (within this VM; a fresh VM
             // re-begins regardless, which is the reload repaint).
             sess.told.get(&script).ready = false;
@@ -539,7 +543,7 @@ mod quest_material_tests {
     /// (FrameXML's Parchment); an uncached GameObject is asked for and answers nothing meanwhile.
     #[test]
     fn a_quest_sourced_from_an_object_paints_the_objects_material() {
-        let mut items = Items::default();
+        let items = Items::default();
         let mut gos = GameObjectTemplates::default();
         let (tx, rx) = crossbeam_channel::unbounded();
         let commands = NetCommands(tx);
@@ -554,44 +558,24 @@ mod quest_material_tests {
         gos.insert(100, 2, "Wanted Poster".into(), &data);
         gos.insert(102, 10, "Chest".into(), &data);
         assert_eq!(
-            object_material(
-                go_guid(100),
-                &mut items,
-                &mut gos,
-                Some(&catalog),
-                &commands
-            )
-            .as_deref(),
+            object_material(go_guid(100), &items, &gos, Some(&catalog), &commands).as_deref(),
             Some("Stone")
         );
         assert_eq!(
-            object_material(
-                go_guid(102),
-                &mut items,
-                &mut gos,
-                Some(&catalog),
-                &commands
-            )
-            .as_deref(),
+            object_material(go_guid(102), &items, &gos, Some(&catalog), &commands).as_deref(),
             Some("Marble"),
             "a chest reads data[9]"
         );
         // A creature quest-giver: neither template, nothing asked.
         let creature = (u64::from(benilla_protocol::guid::HIGH_UNIT) << 48) | (6 << 24) | 1;
         assert_eq!(
-            object_material(creature, &mut items, &mut gos, Some(&catalog), &commands),
+            object_material(creature, &items, &gos, Some(&catalog), &commands),
             None
         );
         assert!(rx.try_recv().is_err(), "a creature source asks for nothing");
         // An uncached object: nothing yet, and the template is asked for.
         assert_eq!(
-            object_material(
-                go_guid(777),
-                &mut items,
-                &mut gos,
-                Some(&catalog),
-                &commands
-            ),
+            object_material(go_guid(777), &items, &gos, Some(&catalog), &commands),
             None
         );
         assert!(
diff --git a/crates/benilla-app/src/ui_items/drain.rs b/crates/benilla-app/src/ui_items/drain.rs
index 644a0c38..9d949ae6 100644
--- a/crates/benilla-app/src/ui_items/drain.rs
+++ b/crates/benilla-app/src/ui_items/drain.rs
@@ -30,11 +30,10 @@ use super::{slot_guid, slot_guid_count, wire_pos, INVTYPE_AMMO};
 ///   `bonding == 2` item raises `AUTOEQUIP_BIND_CONFIRM` and sends NOTHING. `suppress` is the
 ///   reference's own parameter, set on the re-issue `EquipPendingItem` drives — which is what stops
 ///   the accept from asking the same question again forever.
-#[allow(clippy::too_many_arguments)]
 pub(crate) fn send_auto_equip(
     script: &mut UiScript,
     gate: &mut crate::ui_bind_confirm::BindGate,
-    items: &mut Items,
+    items: &Items,
     commands: &NetCommands,
     bag_index: u8,
     slot: u8,
@@ -90,7 +89,7 @@ pub(crate) fn send_auto_equip(
 /// visibly dimmed), pre-existing and out of this slice's scope to fix.
 pub(super) fn drain_container_autoequips(
     script: Option<NonSendMut<UiScript>>,
-    mut items: ResMut<Items>,
+    items: Res<Items>,
     self_q: Query<&ObjectStore, With<SelfPlayer>>,
     commands: Res<NetCommands>,
     mut gate: crate::ui_bind_confirm::BindGate,
@@ -114,7 +113,7 @@ pub(super) fn drain_container_autoequips(
         send_auto_equip(
             &mut script,
             &mut gate,
-            &mut items,
+            &items,
             &commands,
             bag_index,
             wire_slot,
@@ -256,7 +255,6 @@ pub(super) fn drain_inventory_uses(
     }
 }
 
-#[allow(clippy::too_many_arguments)]
 pub(super) fn drain_container_uses(
     script: Option<NonSendMut<UiScript>>,
     self_q: Query<&ObjectStore, With<SelfPlayer>>,
@@ -419,7 +417,7 @@ pub(super) fn drain_container_uses(
             if send_auto_equip(
                 &mut script,
                 &mut gate,
-                &mut ladder.items,
+                &ladder.items,
                 &ladder.commands,
                 bag_index,
                 wire_slot,
@@ -664,7 +662,7 @@ pub(super) fn drain_container_moves(
     script: Option<NonSendMut<UiScript>>,
     commands: Res<NetCommands>,
     self_q: Query<&ObjectStore, With<SelfPlayer>>,
-    mut items: ResMut<Items>,
+    items: Res<Items>,
     mut pending: ResMut<PendingItemOps>,
     mut gate: crate::ui_bind_confirm::BindGate,
 ) {
@@ -701,7 +699,7 @@ pub(super) fn drain_container_moves(
         send_container_move(
             &mut script,
             &mut gate,
-            &mut items,
+            &items,
             &commands,
             store,
             &mut pending,
@@ -726,11 +724,10 @@ fn is_equip_position(bag_index: u8, slot: u8) -> bool {
 /// same body with `suppress` set, rather than a second copy of it that has to be kept agreeing.
 ///
 /// Returns whether the move was sent (`false` = deferred behind `EQUIP_BIND_CONFIRM`).
-#[allow(clippy::too_many_arguments)]
 pub(crate) fn send_container_move(
     script: &mut UiScript,
     gate: &mut crate::ui_bind_confirm::BindGate,
-    items: &mut Items,
+    items: &Items,
     commands: &NetCommands,
     store: Option<&ObjectStore>,
     pending: &mut PendingItemOps,
@@ -909,6 +906,7 @@ mod tests {
             .init_resource::<crate::ui_cast::PendingCast>()
             .init_resource::<crate::ui_cast::QueuedMeleeSpell>()
             .init_resource::<crate::cooldowns::Cooldowns>()
+            .init_resource::<crate::spell_mods::SpellModifiers>()
             .init_resource::<crate::ui_action::CastErrors>()
             .init_resource::<crate::ui_action::UiErrorKeys>()
             .init_resource::<crate::ui_action::AutoRepeatActive>()
@@ -1043,7 +1041,7 @@ pub(super) fn drain_bind_confirm_answers(
     script: Option<NonSendMut<UiScript>>,
     self_q: Query<&ObjectStore, With<SelfPlayer>>,
     mut pending: ResMut<PendingItemOps>,
-    mut items: ResMut<Items>,
+    items: Res<Items>,
     commands: Res<NetCommands>,
     mut gate: crate::ui_bind_confirm::BindGate,
 ) {
@@ -1075,7 +1073,7 @@ pub(super) fn drain_bind_confirm_answers(
                 send_container_move(
                     &mut script,
                     &mut gate,
-                    &mut items,
+                    &items,
                     &commands,
                     store,
                     &mut pending,
@@ -1097,7 +1095,7 @@ pub(super) fn drain_bind_confirm_answers(
                 send_auto_equip(
                     &mut script,
                     &mut gate,
-                    &mut items,
+                    &items,
                     &commands,
                     bag_index,
                     slot,
@@ -1657,6 +1655,7 @@ mod bind_confirm_tests {
             .init_resource::<crate::ui_cast::PendingCast>()
             .init_resource::<crate::ui_cast::QueuedMeleeSpell>()
             .init_resource::<crate::cooldowns::Cooldowns>()
+            .init_resource::<crate::spell_mods::SpellModifiers>()
             .init_resource::<crate::ui_action::CastErrors>()
             .init_resource::<crate::ui_action::UiErrorKeys>()
             .init_resource::<crate::ui_action::AutoRepeatActive>()
diff --git a/crates/benilla-app/src/ui_items/feed.rs b/crates/benilla-app/src/ui_items/feed.rs
index 0de1d04c..31ba0cba 100644
--- a/crates/benilla-app/src/ui_items/feed.rs
+++ b/crates/benilla-app/src/ui_items/feed.rs
@@ -149,7 +149,6 @@ fn standing_label(rank: u32, get: &dyn Fn(&str) -> Option<String>) -> Option<Str
 /// `0x506f70`; its bare name otherwise), the skill requirement's name off `SkillLine.dbc`, the
 /// reputation requirement off `Faction.dbc` names (the red check is the engine's, against the
 /// player's rank map).
-#[allow(clippy::too_many_arguments)] // one app-resolved catalog per argument, by design
 fn template_view(
     t: &ItemInfo,
     spells: Option<&crate::ui_action::Spells>,
@@ -273,7 +272,7 @@ fn template_view(
 pub(super) fn feed_item_sets(
     script: Option<NonSendMut<UiScript>>,
     sets: Option<Res<super::ItemSets>>,
-    mut items: ResMut<Items>,
+    items: Res<Items>,
     commands: Res<NetCommands>,
     spells: Option<Res<crate::ui_action::Spells>>,
     skill_lines: Option<Res<crate::ui_spellbook::SkillLines>>,
@@ -388,7 +387,6 @@ pub(super) fn feed_random_properties(
     *pushed.get(&script) = true;
 }
 
-#[allow(clippy::too_many_arguments)]
 pub(super) fn feed_item_stats(
     script: Option<NonSendMut<UiScript>>,
     mut items: ResMut<Items>,
@@ -493,7 +491,6 @@ pub(super) fn feed_item_stats(
 /// bits) + the full skill-rank map, read off the self player's descriptor, plus the equip
 /// proficiencies (`SMSG_SET_PROFICIENCY`) and the faction → reputation-rank map (DBC base for our
 /// race/class + the `SMSG_INITIALIZE_FACTIONS` standing, ranked) — pushed on change.
-#[allow(clippy::too_many_arguments)] // a Bevy system's full input set
 pub(super) fn feed_player_req(
     script: Option<NonSendMut<UiScript>>,
     self_q: Query<&ObjectStore, With<SelfPlayer>>,
@@ -607,16 +604,15 @@ pub(super) fn feed_player_req(
 /// read the action feed's ITEM arm does). `None` = the slot is empty (guid 0/unsent) — an
 /// *unresolved* occupied slot is `Some` with empty fields instead, so the bag shows the item
 /// exists before its query answers.
-#[allow(clippy::too_many_arguments)] // the slot resolve's full read set (stores + both clocks)
 fn resolve_slot(
     guid: u64,
-    items: &mut Items,
+    items: &Items,
     icons: Option<&ItemDisplays>,
     rolls: crate::items::RollCatalogs,
     commands: &NetCommands,
     cooldowns: &crate::cooldowns::Cooldowns,
     spells: Option<&benilla_formats::SpellCatalog>,
-    names: &mut crate::names::NameCache,
+    names: &crate::names::NameCache,
     // The petition record cache, for a charter slot's tooltip lines — a LAZY fill, so it is taken
     // mutably for the same reason `names` is: the read is what issues the query.
     petitions: &mut crate::ui_petition::PetitionState,
@@ -786,7 +782,7 @@ fn resolve_slot(
 fn bag_family_name(
     player: Option<&ObjectStore>,
     bag_slot: u8,
-    items: &mut Items,
+    items: &Items,
     families: Option<&benilla_formats::ItemBagFamilyCatalog>,
     commands: &NetCommands,
 ) -> Option<String> {
@@ -840,12 +836,12 @@ pub(crate) fn resolve_item_locks(
         .extend(pending.resolve(|bag, slot1| slot_guid_count(player, bag, slot1, &items)));
 }
 
-#[allow(clippy::too_many_arguments, clippy::type_complexity)] // the param list IS the input set
+#[allow(clippy::type_complexity)] // the param list IS the input set
 pub(crate) fn feed_containers(
     script: Option<NonSendMut<UiScript>>,
     // `ChrClasses.dbc` field 16, for the fit rule's relic half — see `find_equip_slot` (1803).
     classes: Option<Res<crate::chr_classes::ChrClassTable>>,
-    mut items: ResMut<Items>,
+    items: Res<Items>,
     icons: Option<Res<ItemDisplays>>,
     // The two item-DBC catalogs, as one param (the 16-SystemParam ceiling): `SpellItemEnchantment`'s
     // name column — the tooltip's enchant lines (decision 0915) — and `ItemRandomProperties`, the
@@ -870,7 +866,7 @@ pub(crate) fn feed_containers(
     bag_families: Option<Res<crate::ui_items::ItemBagFamilies>>,
     pending: Res<PendingItemOps>,
     mut lock_cleared: ResMut<LockTransitions>,
-    mut names: ResMut<crate::names::NameCache>,
+    names: Res<crate::names::NameCache>,
     // Paired into one param (the 16-SystemParam ceiling this signature already sits at): the UI
     // clock, and the petition record cache a charter slot's tooltip lines read — `ResMut` because
     // that cache is LAZY and the hover is what issues its query.
@@ -1004,7 +1000,7 @@ pub(crate) fn feed_containers(
                 bag_family_name(
                     player,
                     e.bag_slot,
-                    &mut items,
+                    &items,
                     bag_families.as_deref().map(|c| &c.0),
                     &commands,
                 )
@@ -1068,13 +1064,13 @@ pub(crate) fn feed_containers(
             let guid = store.0.player_pack_slot(i).unwrap_or(0);
             if let Some(mut slot) = resolve_slot(
                 guid,
-                &mut items,
+                &items,
                 icons.as_deref(),
                 rolls,
                 &commands,
                 &cooldowns,
                 spell_catalog,
-                &mut names,
+                &names,
                 &mut petitions,
                 now,
                 ui_now,
@@ -1123,13 +1119,13 @@ pub(crate) fn feed_containers(
             for (j, &guid) in slot_guids.iter().enumerate() {
                 if let Some(mut slot) = resolve_slot(
                     guid,
-                    &mut items,
+                    &items,
                     icons.as_deref(),
                     rolls,
                     &commands,
                     &cooldowns,
                     spell_catalog,
-                    &mut names,
+                    &names,
                     &mut petitions,
                     now,
                     ui_now,
@@ -1158,13 +1154,13 @@ pub(crate) fn feed_containers(
             let guid = store.0.player_bank_slot(i).unwrap_or(0);
             if let Some(mut slot) = resolve_slot(
                 guid,
-                &mut items,
+                &items,
                 icons.as_deref(),
                 rolls,
                 &commands,
                 &cooldowns,
                 spell_catalog,
-                &mut names,
+                &names,
                 &mut petitions,
                 now,
                 ui_now,
@@ -1209,13 +1205,13 @@ pub(crate) fn feed_containers(
             for (j, &guid) in slot_guids.iter().enumerate() {
                 if let Some(mut slot) = resolve_slot(
                     guid,
-                    &mut items,
+                    &items,
                     icons.as_deref(),
                     rolls,
                     &commands,
                     &cooldowns,
                     spell_catalog,
-                    &mut names,
+                    &names,
                     &mut petitions,
                     now,
                     ui_now,
@@ -1248,13 +1244,13 @@ pub(crate) fn feed_containers(
             let guid = store.0.player_keyring_slot(i).unwrap_or(0);
             if let Some(mut slot) = resolve_slot(
                 guid,
-                &mut items,
+                &items,
                 icons.as_deref(),
                 rolls,
                 &commands,
                 &cooldowns,
                 spell_catalog,
-                &mut names,
+                &names,
                 &mut petitions,
                 now,
                 ui_now,
@@ -1276,7 +1272,7 @@ pub(crate) fn feed_containers(
         // `HasKey()` — the gate that decides whether the keyring exists in the UI at all. Pushed
         // beside the containers because it is the same knowledge (item templates) read over the
         // same slot arrays, and it must be fresh on exactly the frames a BAG_UPDATE fires.
-        let key = has_key(&store.0, &mut items, &commands);
+        let key = has_key(&store.0, &items, &commands);
         if key != memory.had_key {
             gate.audit("feed_containers", "the HasKey() flip");
             debug!(
diff --git a/crates/benilla-app/src/ui_items/mod.rs b/crates/benilla-app/src/ui_items/mod.rs
index 4e5f0022..1e38fd77 100644
--- a/crates/benilla-app/src/ui_items/mod.rs
+++ b/crates/benilla-app/src/ui_items/mod.rs
@@ -575,7 +575,7 @@ pub(crate) fn collect_inventory(
 ///
 /// A slot whose item template is still in flight can't be judged and reads as "not a key"; the
 /// answer lands within a frame or two and the feed re-pushes.
-pub(crate) fn has_key(store: &ObjectFields, items: &mut Items, commands: &NetCommands) -> bool {
+pub(crate) fn has_key(store: &ObjectFields, items: &Items, commands: &NetCommands) -> bool {
     // Every guid mode 0x4f reaches, in the walker's own order — a container is recursed into as it
     // is passed (the depth-first rule), which is why each bag's contents follow its own slot.
     // Collected first, then judged: the template lookup needs `items` mutably (the ask-once query).
@@ -843,7 +843,7 @@ pub(crate) fn send_item_use(
     };
     // The disarm ladder, asked of the caster's own inventory (decision 1903).
     let disarmed_hand = ctx.rel.self_store.and_then(|store| {
-        crate::items::disarmed_equipment_slot(store, &mut ladder.items, &ladder.commands)
+        crate::items::disarmed_equipment_slot(store, &ladder.items, &ladder.commands)
     });
     match item_use_route(it, aura_cancels, disarmed_hand) {
         ItemUseRoute::CantUseDisarmed => {
@@ -894,7 +894,7 @@ pub(crate) fn send_item_use(
             if !suppress
                 && it
                     .guid
-                    .is_some_and(|g| gate.use_binds(&mut ladder.items, &ladder.commands, g)) =>
+                    .is_some_and(|g| gate.use_binds(&ladder.items, &ladder.commands, g)) =>
         {
             gate.defer_use(script, it);
             false
@@ -1174,16 +1174,15 @@ impl Plugin for UiItemsPlugin {
                     // pie waits for the NEXT store change).
                     feed_containers
                         .in_set(UnitFeed)
-                        .before(crate::ui_action::CooldownEvents)
-                        .before(UiInput),
+                        .before(crate::ui_action::CooldownEvents),
                     // The shared item-tooltip store: answer stat asks before the input pass so a
                     // re-hover the very next frame already sees them.
-                    feed_item_stats.in_set(UnitFeed).before(UiInput),
-                    feed_item_sets.in_set(UnitFeed).before(UiInput),
+                    feed_item_stats.in_set(UnitFeed),
+                    feed_item_sets.in_set(UnitFeed),
                     // The roll table, pushed whole once per VM (1547) — before the input pass, so
                     // the first hover of the session already resolves a drop's suffix lines.
-                    feed_random_properties.in_set(UnitFeed).before(UiInput),
-                    feed_player_req.in_set(UnitFeed).before(UiInput),
+                    feed_random_properties.in_set(UnitFeed),
+                    feed_player_req.in_set(UnitFeed),
                     // After the input pass, so a click's UseContainerItem goes out the same frame.
                     drain_container_uses.after(UiInput),
                     // The left-click pick/place/split drain — a queued move → CMSG_SWAP_INV_ITEM /
@@ -1766,13 +1765,13 @@ mod find_item_tests {
         item(&mut items, 0xF2, BREAD, None);
 
         // Nothing at all.
-        assert!(!has_key(&player(&[]), &mut items, &commands));
+        assert!(!has_key(&player(&[]), &items, &commands));
         // A non-key in the backpack is not a key.
-        assert!(!has_key(&player(&[(23, 0xF2)]), &mut items, &commands));
+        assert!(!has_key(&player(&[(23, 0xF2)]), &items, &commands));
         // The director's own case: the key sitting in keyring slot 1.
-        assert!(has_key(&player(&[(81, 0xF1)]), &mut items, &commands));
+        assert!(has_key(&player(&[(81, 0xF1)]), &items, &commands));
         // And in the backpack, before it has been filed.
-        assert!(has_key(&player(&[(23, 0xF1)]), &mut items, &commands));
+        assert!(has_key(&player(&[(23, 0xF1)]), &items, &commands));
 
         // The BANK — reachable only because HasKey passes 0x4f rather than the walker's default
         // 0x47. `find_item` must NOT see the same copy (its mode omits 0x08).
@@ -1780,7 +1779,7 @@ mod find_item_tests {
         banked.insert(39u16, 0xF1u64);
         let store = bank_player(&banked);
         assert!(
-            has_key(&store, &mut items, &commands),
+            has_key(&store, &items, &commands),
             "a key in the bank still gives you a keyring"
         );
         assert_eq!(
diff --git a/crates/benilla-app/src/ui_layout.rs b/crates/benilla-app/src/ui_layout.rs
index 48f175af..14a98660 100644
--- a/crates/benilla-app/src/ui_layout.rs
+++ b/crates/benilla-app/src/ui_layout.rs
@@ -337,9 +337,17 @@ impl Plugin for UiLayoutPlugin {
         // which is the reference's own single write site and the only one a `/reload` reaches.
         app.init_resource::<LayoutFile>().add_systems(
             Update,
-            (load_layout, watch_layout, save_layout)
-                .chain()
-                .run_if(in_state(crate::char_select::ClientState::InWorld)),
+            (
+                // The restore is a push the tick should see the frame it lands: the feed phase.
+                load_layout.in_set(crate::ui_script::UiFeed),
+                // The watcher and the save read what the drag pump — Lua's, in the tick — did:
+                // after it. Load precedes watch through the phases, as the old chain had it,
+                // so the watcher never reads the restore's own move.
+                (watch_layout, save_layout)
+                    .chain()
+                    .after(crate::ui_script::UiInput),
+            )
+                .in_set(crate::char_select::InWorldGated),
         );
     }
 }
diff --git a/crates/benilla-app/src/ui_logout.rs b/crates/benilla-app/src/ui_logout.rs
index a9eede50..3e863b9f 100644
--- a/crates/benilla-app/src/ui_logout.rs
+++ b/crates/benilla-app/src/ui_logout.rs
@@ -45,7 +45,7 @@ use benilla_ui::script::{SessionRequest, UiScript};
 use bevy::prelude::*;
 
 use crate::net::{ClientCommand, LoggedOutMessage, NetCommands, SelfGuid};
-use crate::ui_script::UiInput;
+use crate::ui_script::{UiFeed, UiInput};
 
 /// The reference's refusal line, as a **catalog key** rather than a literal — message id `0x180`,
 /// the sole argument of the `DisplayError` at `0x5aaf26` (decision 1821). VERIFIED, superseding
@@ -264,7 +264,7 @@ impl Plugin for UiLogoutPlugin {
         app.init_resource::<LogoutState>().add_systems(
             Update,
             (
-                feed_logout.before(UiInput),
+                feed_logout.in_set(UiFeed),
                 drain_logout.after(UiInput),
                 exit_on_logout_complete.after(UiInput),
             ),
diff --git a/crates/benilla-app/src/ui_loot.rs b/crates/benilla-app/src/ui_loot.rs
index f1cc6f62..a7035baf 100644
--- a/crates/benilla-app/src/ui_loot.rs
+++ b/crates/benilla-app/src/ui_loot.rs
@@ -34,7 +34,7 @@ use crate::names::NameCache;
 use crate::net::{ClientCommand, NetCommands};
 use crate::ui_items::KEYRING_CONTAINER;
 use crate::ui_party::{GroupState, GROUPTYPE_RAID, GROUP_MEMBER_SUBGROUP};
-use crate::ui_script::UiInput;
+use crate::ui_script::{UiFeed, UiInput};
 
 /// The coin-pile row icons (direct `Interface\Icons` paths — `SetTexture` takes them as-is, no DBC),
 /// **six of them, one per decade of copper**, all VERIFIED to extract from `interface.MPQ`.
@@ -372,7 +372,7 @@ impl LootState {
 
     /// The guid of the loot source whose window is open (`None` = closed). Read by the GameObject
     /// lid-close watcher ([`crate::go_anim`]) to close a chest's lid when its loot window closes
-    /// (decision 0250) — the faithful client-authoritative close, any path (player close or the
+    /// (decision 2271) — the faithful client-authoritative close, any path (player close or the
     /// server's release on the last item).
     pub(crate) fn source(&self) -> Option<u64> {
         self.source
@@ -470,7 +470,7 @@ impl LootState {
 /// `show_loot_spam` is 1.12's own `showLootSpam` — the *Detailed Loot Information* checkbox, whose
 /// subject is **group loot rolls**, not loot messages generally (decision 1589, the Chat page).
 /// It rides here rather than on [`crate::ui_loot_roll`] because it is one loot knob among the
-/// loot knobs and `cvars::KnobParams` fetches this resource already. VERIFIED at the bytes (wow-re
+/// loot knobs and [`on_cvar`] writes both. VERIFIED at the bytes (wow-re
 /// `system/object-layer/scratch/lootroll-chat-and-lifecycle.md` §4): the CVar is `0xb4e2bc`,
 /// registered at `0x48fd1c` with default `"1"` and flags 5, and a byte census over the whole
 /// binary finds exactly four references — one writer and three readers, all three inside the
@@ -618,8 +618,19 @@ pub(crate) struct LootMoveStart(pub(crate) bool);
 
 pub(crate) struct UiLootPlugin;
 
+/// The loot rows' change callback (decision 2303): two flags.
+pub(crate) fn on_cvar(ev: On<crate::cvars::CvarChanged>, mut loot: ResMut<LootConfig>) {
+    match ev.key().as_str() {
+        "autolootdefault" => loot.auto_loot = ev.flag(),
+        // The loot-roll detail switch (1589) — a flag over the roll-line composer's two shapes.
+        "showlootspam" => loot.show_loot_spam = ev.flag(),
+        _ => {}
+    }
+}
+
 impl Plugin for UiLootPlugin {
     fn build(&self, app: &mut App) {
+        app.add_observer(on_cvar);
         app.init_resource::<LootState>()
             .init_resource::<LootConfig>()
             .init_resource::<LootLatch>()
@@ -630,7 +641,7 @@ impl Plugin for UiLootPlugin {
                 (
                     // Push before the input pass so an open/close is on screen the same frame; drain
                     // after it so a click's intent goes out the same frame (mirrors ui_merchant).
-                    feed_loot.before(UiInput),
+                    feed_loot.in_set(UiFeed),
                     drain_loot.after(UiInput),
                     // Predicate B, per frame, after the net drain that arms the latch. The anim
                     // driver then orders itself after THIS (`crate::creature_anim`), closing the
@@ -685,7 +696,7 @@ fn coin_icon(copper: u32) -> &'static str {
 /// rather than at each call site.
 fn resolve_item(
     item: &LootItem,
-    items: &mut Items,
+    items: &Items,
     icons: Option<&ItemDisplays>,
     commands: &NetCommands,
     rolls: RollCatalogs,
@@ -754,7 +765,7 @@ fn templates_outstanding(items: &Items, snap: &LootSnapshot) -> bool {
 /// shift up).
 fn snapshot(
     loot: &LootState,
-    items: &mut Items,
+    items: &Items,
     icons: Option<&ItemDisplays>,
     commands: &NetCommands,
     rolls: RollCatalogs,
@@ -886,7 +897,7 @@ fn receive_line(r: &PendingReceive, name: &str, quality: u32) -> String {
 /// an entry the server never answers for).
 fn drain_receives(
     loot: &mut LootState,
-    items: &mut Items,
+    items: &Items,
     icons: Option<&ItemDisplays>,
     commands: &NetCommands,
     chat: &mut crate::ui_chat::ChatLog,
@@ -943,11 +954,10 @@ fn drain_receives(
 /// Push the current loot into the VM and fire open/update/close on a transition (or a content change
 /// — an async name landing, a removed row, the coin clearing). Also routes refusals + receive lines
 /// into the chat window. Diffed against a `Local` memory, exactly like the merchant/gossip feeds.
-#[allow(clippy::too_many_arguments)]
 fn feed_loot(
     script: Option<NonSendMut<UiScript>>,
     mut loot: ResMut<LootState>,
-    mut items: ResMut<Items>,
+    items: Res<Items>,
     icons: Option<Res<ItemDisplays>>,
     commands: Res<NetCommands>,
     mut chat: ResMut<crate::ui_chat::ChatLog>,
@@ -974,7 +984,7 @@ fn feed_loot(
     };
     drain_receives(
         &mut loot,
-        &mut items,
+        &items,
         icons.as_deref(),
         &commands,
         &mut chat,
@@ -986,7 +996,7 @@ fn feed_loot(
         group: &group,
         names: &names,
     };
-    let fresh = snapshot(&loot, &mut items, icons.as_deref(), &commands, rolls, who);
+    let fresh = snapshot(&loot, &items, icons.as_deref(), &commands, rolls, who);
     if fresh == *last {
         return;
     }
@@ -1041,7 +1051,7 @@ fn feed_loot(
                             // raises the confirm, and every later one in the same sweep is left
                             // in the window untouched — not taken, not asked about. Otherwise a
                             // three-blue corpse would stack three dialogs over one pending slot.
-                            if bind_confirm_required(&mut items, &commands, item_id) {
+                            if bind_confirm_required(&items, &commands, item_id) {
                                 if bind_confirm_fired {
                                     continue;
                                 }
@@ -1106,7 +1116,7 @@ fn feed_loot(
 /// has no name on it either, so it is not a row anyone has clicked. Asking (rather than peeking)
 /// costs nothing — the entry is already in flight from the snapshot — and keeps the answer right
 /// for the next click if one somehow arrives first.
-fn bind_confirm_required(items: &mut Items, commands: &NetCommands, item_id: u32) -> bool {
+fn bind_confirm_required(items: &Items, commands: &NetCommands, item_id: u32) -> bool {
     items
         .template(item_id, 0, commands)
         .is_some_and(|t| t.bonding == BIND_WHEN_PICKED_UP && t.quality >= BIND_CONFIRM_MIN_QUALITY)
@@ -1164,7 +1174,6 @@ fn close_on_move_start(
 /// `CLootButton`'s arm) and `LootSlot` is the LOOT_BIND confirmation continuation (`flag == 1`,
 /// which sends only for the pending slot). Keeping them apart is what makes a second click on a
 /// bind-on-pickup row re-raise the confirm instead of looting behind it.
-#[allow(clippy::too_many_arguments)] // one Bevy system's full input set
 fn drain_loot(
     script: Option<NonSendMut<UiScript>>,
     mut loot: ResMut<LootState>,
@@ -1176,7 +1185,7 @@ fn drain_loot(
     // The bind-on-pickup deferral reads the row's template (`bonding`, `quality`). Already cached
     // by then in every reachable case — the snapshot asks for it to put a NAME on the row, and a
     // row with no name is a row nobody has clicked.
-    mut items: ResMut<Items>,
+    items: Res<Items>,
     // The controller's move-start report (decision 2097) and the selection teardown the close
     // asks for — ahead of the VM check below, because neither depends on Lua.
     mut move_start: ResMut<LootMoveStart>,
@@ -1220,7 +1229,7 @@ fn drain_loot(
                 // confirm at all, which is why picking up a quest trinket never asks. The event
                 // carries the row out, the row is stashed, and NOTHING is sent; not even the
                 // pickup sound, which the reference plays only on the arm that actually sends.
-                if bind_confirm_required(&mut items, &commands, item_id) {
+                if bind_confirm_required(&items, &commands, item_id) {
                     debug!("ui_loot: row {index} (wire {wire_slot}) binds on pickup — confirming");
                     loot.pending_bind_confirm = Some(index);
                     script.fire_event(
@@ -2376,7 +2385,7 @@ mod tests {
 
     #[test]
     fn coin_row_uses_real_words_and_the_ladders_icon() {
-        let mut items = Items::default();
+        let items = Items::default();
         let (tx, _rx) = crossbeam_channel::unbounded();
         let commands = NetCommands(tx);
         let (grp, nm) = nobody();
@@ -2385,7 +2394,7 @@ mod tests {
         loot.open(0x42, loot_type::CORPSE, 4, vec![]);
         let snap = snapshot(
             &loot,
-            &mut items,
+            &items,
             None,
             &commands,
             RollCatalogs::NONE,
@@ -2404,7 +2413,7 @@ mod tests {
 
     #[test]
     fn snapshot_prepends_coin_and_resolves_items() {
-        let mut items = Items::default();
+        let items = Items::default();
         let (tx, _rx) = crossbeam_channel::unbounded();
         let commands = NetCommands(tx);
         let (grp, nm) = nobody();
@@ -2412,7 +2421,7 @@ mod tests {
         // Closed → no snapshot.
         assert!(snapshot(
             &loot,
-            &mut items,
+            &items,
             None,
             &commands,
             RollCatalogs::NONE,
@@ -2425,7 +2434,7 @@ mod tests {
         loot.open(0x42, loot_type::CORPSE, 12_345, vec![item(0, 117, 3)]);
         let snap = snapshot(
             &loot,
-            &mut items,
+            &items,
             None,
             &commands,
             RollCatalogs::NONE,
@@ -2451,7 +2460,7 @@ mod tests {
         loot.clear_money();
         let snap = snapshot(
             &loot,
-            &mut items,
+            &items,
             None,
             &commands,
             RollCatalogs::NONE,
@@ -2469,7 +2478,7 @@ mod tests {
         loot.remove_slot(0);
         let snap = snapshot(
             &loot,
-            &mut items,
+            &items,
             None,
             &commands,
             RollCatalogs::NONE,
diff --git a/crates/benilla-app/src/ui_loot_roll.rs b/crates/benilla-app/src/ui_loot_roll.rs
index c094671e..7d6d4f79 100644
--- a/crates/benilla-app/src/ui_loot_roll.rs
+++ b/crates/benilla-app/src/ui_loot_roll.rs
@@ -94,7 +94,7 @@ use crate::items::Items;
 use crate::names::NameCache;
 use crate::net::{ClientCommand, NetCommands, SelfGuid};
 use crate::ui_chat::{ChatEvent, ChatEventKind, ChatLog};
-use crate::ui_script::UiInput;
+use crate::ui_script::{UiFeed, UiInput};
 
 /// Give up re-checking a pending announcement's names after this many frames — the same budget and
 /// reasoning as [`crate::ui_loot`]'s receive lines (a negative-cached entry never resolves).
@@ -299,7 +299,7 @@ impl Plugin for UiLootRollPlugin {
                 // Same ordering rule as the loot window (ui_loot): push before the input pass so a
                 // freshly opened roll is on screen the same frame, drain after it so a Need/Greed/
                 // Pass click goes out the same frame.
-                feed_loot_rolls.before(UiInput),
+                feed_loot_rolls.in_set(UiFeed),
                 drain_loot_rolls.after(UiInput),
             ),
         );
@@ -434,8 +434,8 @@ fn format_line_detailed(
 fn render(
     line: &RollLine,
     self_guid: Option<u64>,
-    items: &mut Items,
-    names: &mut NameCache,
+    items: &Items,
+    names: &NameCache,
     commands: &NetCommands,
     rolls: crate::items::RollCatalogs,
     detailed: bool,
@@ -484,12 +484,11 @@ fn render(
 /// Surface the queued announcement lines in the chat window once their names resolve, colored
 /// `LOOT` green (the roll lines ride `CHAT_MSG_LOOT` in the real client, like the receive lines).
 /// Unresolved lines retry up to [`LINE_MAX_TRIES`] frames, then drop.
-#[allow(clippy::too_many_arguments)] // the line resolve's full read set
 fn drain_lines(
     rolls: &mut LootRolls,
     self_guid: Option<u64>,
-    items: &mut Items,
-    names: &mut NameCache,
+    items: &Items,
+    names: &NameCache,
     commands: &NetCommands,
     chat: &mut ChatLog,
     catalogs: crate::items::RollCatalogs,
@@ -524,7 +523,7 @@ fn drain_lines(
 /// cache (`None`/`false` while in flight; the frame shows its placeholder and fills in later).
 fn snapshot(
     rolls: &LootRolls,
-    items: &mut Items,
+    items: &Items,
     icons: Option<&ItemDisplays>,
     commands: &NetCommands,
     catalogs: crate::items::RollCatalogs,
@@ -575,12 +574,11 @@ fn snapshot(
 
 /// Tick the open rolls, push them into the VM, fire the open/close events, and drain the queued
 /// announcement lines into chat.
-#[allow(clippy::too_many_arguments)]
 fn feed_loot_rolls(
     script: Option<NonSendMut<UiScript>>,
     mut rolls: ResMut<LootRolls>,
-    mut items: ResMut<Items>,
-    mut names: ResMut<NameCache>,
+    items: Res<Items>,
+    names: Res<NameCache>,
     icons: Option<Res<ItemDisplays>>,
     commands: Res<NetCommands>,
     self_guid: Res<SelfGuid>,
@@ -607,8 +605,8 @@ fn feed_loot_rolls(
     drain_lines(
         &mut rolls,
         self_guid.0,
-        &mut items,
-        &mut names,
+        &items,
+        &names,
         &commands,
         &mut chat,
         catalogs,
@@ -619,7 +617,7 @@ fn feed_loot_rolls(
     // item out of the model in its OnShow, and the roll it is about was added to `active` in the
     // same `start()` call that queued `opened`, so pushing after would hand every fresh roll an
     // empty lookup. Same order as ui_loot's window feed, for the same reason.
-    let fresh = snapshot(&rolls, &mut items, icons.as_deref(), &commands, catalogs);
+    let fresh = snapshot(&rolls, &items, icons.as_deref(), &commands, catalogs);
     if fresh != *last {
         script.set_loot_rolls(fresh.clone());
         *last = fresh;
diff --git a/crates/benilla-app/src/ui_macro/mod.rs b/crates/benilla-app/src/ui_macro/mod.rs
index c8d14ffb..43fa68c6 100644
--- a/crates/benilla-app/src/ui_macro/mod.rs
+++ b/crates/benilla-app/src/ui_macro/mod.rs
@@ -19,7 +19,7 @@ use bevy::prelude::*;
 
 use benilla_ui::script::{MacroState, ScriptValue, UiScript};
 
-use crate::char_select::ClientState;
+use crate::char_select::InWorldGated;
 use benilla_assets::{LockRecover, WorldAssets};
 
 pub(crate) mod run;
@@ -71,19 +71,24 @@ impl Plugin for UiMacroPlugin {
                     // old answer to the ordering half alone — after `AssetSet::Open` this ran
                     // before the VM existed and silently pushed no icon list at all — and a
                     // session-keyed claim answers both halves at once.
-                    load_icon_catalog,
+                    load_icon_catalog.in_set(crate::ui_script::UiFeed),
                     // Before the action feeds read it (they run in `UnitFeed`), so a macro edited
                     // this frame reports its new spell's cooldown the same frame.
-                    rebind_macro_spells.before(crate::ui_unit::UnitFeed),
+                    rebind_macro_spells
+                        .in_set(crate::ui_script::UiFeed)
+                        .before(crate::ui_unit::UnitFeed),
                     // Load runs in-world only: the per-character file needs the character, and the
                     // roster only names it once a login is live. It self-gates on the identity, so
                     // a re-entry with a different character reloads and a re-entry with the same
                     // one is a no-op.
-                    load_macros.run_if(in_state(ClientState::InWorld)),
+                    load_macros
+                        .in_set(crate::ui_script::UiFeed)
+                        .in_set(InWorldGated),
                     // The save edge is checked every frame, in or out of world: the macro window is
                     // `whileDead = 1` and reachable from the game menu, and a `/logout` must not
-                    // strand an unsaved edit.
-                    save_dirty_macros.after(load_macros),
+                    // strand an unsaved edit. After the tick that dirtied it — which also puts it
+                    // after the load, in the feed phase.
+                    save_dirty_macros.after(crate::ui_script::UiInput),
                 ),
             );
     }
diff --git a/crates/benilla-app/src/ui_mail/mod.rs b/crates/benilla-app/src/ui_mail/mod.rs
index b822c7fb..45168c83 100644
--- a/crates/benilla-app/src/ui_mail/mod.rs
+++ b/crates/benilla-app/src/ui_mail/mod.rs
@@ -45,8 +45,6 @@
 //! [`benilla_ui::script::UiScript::set_has_new_mail`] current, and fires `UPDATE_PENDING_MAIL` at
 //! the three sites the reference fires it (see [`MailPending::notify`]).
 
-use std::collections::{HashMap, HashSet};
-
 use benilla_protocol::messages::{mail_error, mail_message_type, MailListEntry};
 use bevy::prelude::*;
 
@@ -56,7 +54,8 @@ use crate::entities::ItemDisplays;
 use crate::items::Items;
 use crate::names::NameCache;
 use crate::net::{ClientCommand, EnteredWorldMessage, NetCommands, ObjectStore, SelfPlayer};
-use crate::ui_script::UiInput;
+use crate::query_cache::QueryCache;
+use crate::ui_script::{UiFeed, UiInput};
 use crate::ui_session::{close_npc_session_out_of_range, NpcSession};
 
 mod pending;
@@ -112,10 +111,8 @@ pub(crate) struct MailOpen {
     pub(crate) mailbox: Option<u64>,
     /// The inbox rows (wire order = 1-based display order).
     pub(crate) mails: Vec<MailListEntry>,
-    /// Ask-once letter-body cache: `item_text_id` → body text.
-    pub(crate) bodies: HashMap<u32, String>,
-    /// `item_text_id`s with a `CMSG_ITEM_TEXT_QUERY` in flight (ask-once dedup).
-    pub(crate) pending_bodies: HashSet<u32>,
+    /// Ask-once letter-body cache: `item_text_id` → body text, through [`QueryCache`] (2288).
+    pub(crate) bodies: QueryCache<u32, String>,
     /// Fire `MAIL_SHOW` next feed — set on every mailbox click (the reference opens the window per
     /// use; wow-re §5). Consumed by [`feed_mail`].
     show_requested: bool,
@@ -133,6 +130,12 @@ pub(crate) struct MailOpen {
     pub(crate) errors: Vec<&'static str>,
 }
 
+impl crate::query_cache::AskOnce for MailOpen {
+    fn clear_pending(&mut self) {
+        self.bodies.clear_pending();
+    }
+}
+
 impl MailOpen {
     /// A mailbox right-click (decision 0544): open (or re-show) the window's session and request its
     /// `MAIL_SHOW`. A *different* mailbox resets the session (rows + throttle); the same one keeps
@@ -172,7 +175,6 @@ impl MailOpen {
         self.mailbox = None;
         self.mails.clear();
         self.bodies.clear();
-        self.pending_bodies.clear();
         self.show_requested = false;
         self.last_list_query = None;
         self.send_acks.clear();
@@ -203,6 +205,7 @@ pub(crate) struct UiMailPlugin;
 
 impl Plugin for UiMailPlugin {
     fn build(&self, app: &mut App) {
+        crate::query_cache::register::<MailOpen>(app);
         app.init_resource::<MailOpen>()
             .init_resource::<MailPending>()
             .add_systems(
@@ -214,7 +217,7 @@ impl Plugin for UiMailPlugin {
                     // out the same frame (the ui_merchant ordering exactly). After the UnitFeed set
                     // so the SetInboxItem tooltip reads a landed item-template store.
                     close_npc_session_out_of_range::<MailOpen>.before(feed_mail),
-                    feed_mail.after(crate::ui_unit::UnitFeed).before(UiInput),
+                    feed_mail.after(crate::ui_unit::UnitFeed).in_set(UiFeed),
                     drain_mail.after(UiInput),
                     // The world-enter one-shot (decision 0548 §7: "once at UI/login load") — its
                     // own system, ordering-independent of the feed/drain pair above.
@@ -283,14 +286,13 @@ use invoice::auction_mail;
 /// item-template cache + `ItemDisplayInfo.dbc`, the body from the cache, the stationery basename
 /// from `Stationery.dbc`. `None`s stay `None` while a query is in flight — the row shows a
 /// placeholder and fills in when the answer lands (the merchant/loot pattern).
-#[allow(clippy::too_many_arguments)] // one resolve per ask-once cache the row reads
 fn resolve_row(
     entry: &MailListEntry,
-    bodies: &HashMap<u32, String>,
-    items: &mut Items,
+    bodies: &QueryCache<u32, String>,
+    items: &Items,
     icons: Option<&ItemDisplays>,
     stationery: Option<&Stationery>,
-    names: &mut NameCache,
+    names: &NameCache,
     commands: &NetCommands,
     rolls: crate::items::RollCatalogs,
     macros: &crate::npc_text::MacroContext,
@@ -347,7 +349,7 @@ fn resolve_row(
     // `$`-substituted text below: the invoice is machine-written colon fields, and running a macro
     // expander over them would be expanding the auction house's own bookkeeping.
     let raw_body = (entry.item_text_id != 0)
-        .then(|| bodies.get(&entry.item_text_id))
+        .then(|| bodies.get(entry.item_text_id))
         .flatten();
 
     // ── The auction house's mail (`ui_mail::invoice`, wow-re §11.1a) ─────────────────────────
@@ -446,7 +448,7 @@ fn resolve_row(
 fn stationeries(
     catalog: &Stationery,
     self_q: &Query<(&ObjectStore, &crate::net::Guid), With<SelfPlayer>>,
-    items: &mut Items,
+    items: &Items,
     icons: Option<&ItemDisplays>,
     commands: &NetCommands,
 ) -> Vec<StationeryView> {
@@ -482,13 +484,12 @@ fn stationeries(
     out.into_iter().map(|(_, v)| v).collect()
 }
 
-#[allow(clippy::too_many_arguments)] // mirrors `resolve_row`'s cache set
 fn snapshot(
     mail: &MailOpen,
-    items: &mut Items,
+    items: &Items,
     icons: Option<&ItemDisplays>,
     stationery: Option<&Stationery>,
-    names: &mut NameCache,
+    names: &NameCache,
     commands: &NetCommands,
     rolls: crate::items::RollCatalogs,
     macros: &crate::npc_text::MacroContext,
@@ -531,14 +532,13 @@ struct MailFeedExtras<'w, 's> {
     stationeries: Local<'s, crate::ui_script::VmMemo<Vec<StationeryView>>>,
 }
 
-#[allow(clippy::too_many_arguments)]
 fn feed_mail(
     script: Option<NonSendMut<UiScript>>,
     mut mail: ResMut<MailOpen>,
-    mut items: ResMut<Items>,
+    items: Res<Items>,
     icons: Option<Res<ItemDisplays>>,
     stationery: Option<Res<Stationery>>,
-    mut names: ResMut<NameCache>,
+    names: Res<NameCache>,
     commands: Res<NetCommands>,
     mut pending: ResMut<MailPending>,
     time: Res<Time>,
@@ -605,7 +605,7 @@ fn feed_mail(
     // The macro subject, resolved before the row walk borrows the name cache again. `None` until
     // the player is streamed and named — the feed diffs on the substituted text, so a letter opened
     // that early re-substitutes as soon as it lands.
-    let subject = crate::npc_text::player_identity(&self_q, &mut names, &commands);
+    let subject = crate::npc_text::player_identity(&self_q, &names, &commands);
     let macros = crate::npc_text::MacroContext {
         subject: subject.as_ref(),
         states: &states,
@@ -615,10 +615,10 @@ fn feed_mail(
         let get_text = |key: &str| script.lua().globals().get::<String>(key).ok();
         snapshot(
             &mail,
-            &mut items,
+            &items,
             icons.as_deref(),
             stationery.as_deref(),
-            &mut names,
+            &names,
             &commands,
             rolls,
             &macros,
@@ -649,7 +649,7 @@ fn feed_mail(
     let usable = stationery
         .as_deref()
         .filter(|_| !self_q.is_empty())
-        .map(|catalog| stationeries(catalog, &self_q, &mut items, icons.as_deref(), &commands))
+        .map(|catalog| stationeries(catalog, &self_q, &items, icons.as_deref(), &commands))
         .unwrap_or_default();
     let memo = last_stationeries.get(&script);
     if *memo != usable {
@@ -773,13 +773,12 @@ fn drain_mail(
                 .0
                 .send(ClientCommand::MailMarkAsRead { mailbox, mail_id });
         }
-        if text_id != 0
-            && !mail.bodies.contains_key(&text_id)
-            && mail.pending_bodies.insert(text_id)
-        {
-            let _ = commands
-                .0
-                .send(ClientCommand::ItemTextQuery { text_id, mail_id });
+        if text_id != 0 {
+            mail.bodies.get_or_ask(text_id, || {
+                let _ = commands
+                    .0
+                    .send(ClientCommand::ItemTextQuery { text_id, mail_id });
+            });
         }
     }
 
@@ -968,7 +967,7 @@ mod tests {
         let mut m = MailOpen::default();
         m.click(0x1);
         m.mails.push(entry(1, Some(0xA), 0, 30.0));
-        m.bodies.insert(7, "hi".into());
+        m.bodies.insert(7, Some("hi".into()));
         m.clear();
         assert!(m.mailbox.is_none());
         assert!(m.mails.is_empty());
@@ -984,21 +983,21 @@ mod tests {
     #[test]
     fn resolve_row_derives_the_reply_and_delete_law() {
         let states = crate::world_state::WorldStates::default();
-        let mut items = Items::default();
+        let items = Items::default();
         let (tx, _rx) = crossbeam_channel::unbounded();
         let commands = NetCommands(tx);
-        let mut names = NameCache::default();
-        let bodies = HashMap::new();
+        let names = NameCache::default();
+        let bodies = QueryCache::default();
 
         // A plain letter from a player (no attachments) → replyable AND deletable.
         let from_player = entry(1, Some(0xA), 0, 30.0);
         let row = resolve_row(
             &from_player,
             &bodies,
-            &mut items,
+            &items,
             None,
             None,
-            &mut names,
+            &names,
             &commands,
             crate::items::RollCatalogs::NONE,
             &no_macros(&states),
@@ -1015,10 +1014,10 @@ mod tests {
         let row = resolve_row(
             &with_money,
             &bodies,
-            &mut items,
+            &items,
             None,
             None,
-            &mut names,
+            &names,
             &commands,
             crate::items::RollCatalogs::NONE,
             &no_macros(&states),
@@ -1032,10 +1031,10 @@ mod tests {
         let row = resolve_row(
             &returned,
             &bodies,
-            &mut items,
+            &items,
             None,
             None,
-            &mut names,
+            &names,
             &commands,
             crate::items::RollCatalogs::NONE,
             &no_macros(&states),
@@ -1049,10 +1048,10 @@ mod tests {
         let row = resolve_row(
             &system,
             &bodies,
-            &mut items,
+            &items,
             None,
             None,
-            &mut names,
+            &names,
             &commands,
             crate::items::RollCatalogs::NONE,
             &no_macros(&states),
@@ -1064,12 +1063,12 @@ mod tests {
     #[test]
     fn resolve_row_reads_the_item_and_body_caches() {
         let states = crate::world_state::WorldStates::default();
-        let mut items = Items::default();
+        let items = Items::default();
         let (tx, _rx) = crossbeam_channel::unbounded();
         let commands = NetCommands(tx);
-        let mut names = NameCache::default();
-        let mut bodies = HashMap::new();
-        bodies.insert(99, "the letter body".into());
+        let names = NameCache::default();
+        let mut bodies = QueryCache::default();
+        bodies.insert(99, Some("the letter body".into()));
 
         let mut e = entry(1, Some(0xA), 0, 30.0);
         e.item_text_id = 99;
@@ -1086,10 +1085,10 @@ mod tests {
         let row = resolve_row(
             &e,
             &bodies,
-            &mut items,
+            &items,
             None,
             None,
-            &mut names,
+            &names,
             &commands,
             crate::items::RollCatalogs::NONE,
             &no_macros(&states),
diff --git a/crates/benilla-app/src/ui_merchant.rs b/crates/benilla-app/src/ui_merchant.rs
index abdd1b53..f7e7ea91 100644
--- a/crates/benilla-app/src/ui_merchant.rs
+++ b/crates/benilla-app/src/ui_merchant.rs
@@ -30,7 +30,7 @@ use crate::items::Items;
 use crate::names::NameCache;
 use crate::net::{ClientCommand, Guid, NetCommands, ObjectStore, SelfPlayer};
 use crate::ui_items::{item_link, slot_guid, wire_pos};
-use crate::ui_script::UiInput;
+use crate::ui_script::{UiFeed, UiInput};
 use crate::ui_session::{close_npc_session_out_of_range, npc_switched, NpcSession};
 use benilla_protocol::messages::BAG_PLAYER_INVENTORY;
 
@@ -145,9 +145,7 @@ impl Plugin for UiMerchantPlugin {
                     // unordered, the first paint races feed_item_stats/feed_player_req and the
                     // usable reds drop until the next content repaint.
                     close_npc_session_out_of_range::<MerchantOpen>.before(feed_merchant),
-                    feed_merchant
-                        .after(crate::ui_unit::UnitFeed)
-                        .before(UiInput),
+                    feed_merchant.after(crate::ui_unit::UnitFeed).in_set(UiFeed),
                     drain_merchant.after(UiInput),
                 ),
             );
@@ -209,7 +207,7 @@ fn sell_error_key(reason: u8) -> Option<&'static str> {
 /// placeholder and fills in when the answer lands, exactly like a bag slot).
 fn resolve_item(
     item: &VendorItem,
-    items: &mut Items,
+    items: &Items,
     icons: Option<&ItemDisplays>,
     commands: &NetCommands,
 ) -> MerchantItem {
@@ -277,7 +275,7 @@ fn buyback_order(store: &benilla_protocol::ObjectFields) -> Vec<u8> {
 fn resolve_buyback(
     idx: u8,
     store: &benilla_protocol::ObjectFields,
-    items: &mut Items,
+    items: &Items,
     icons: Option<&ItemDisplays>,
     commands: &NetCommands,
 ) -> MerchantItem {
@@ -328,7 +326,7 @@ fn resolve_buyback(
 /// No reputation model yet → discount 0.
 fn item_repair_cost(
     guid: u64,
-    items: &mut Items,
+    items: &Items,
     tables: &RepairTables,
     commands: &NetCommands,
 ) -> u32 {
@@ -356,12 +354,12 @@ fn item_repair_cost(
 /// buyback).
 fn repair_all_cost(
     store: &benilla_protocol::ObjectFields,
-    items: &mut Items,
+    items: &Items,
     tables: &RepairTables,
     commands: &NetCommands,
 ) -> u32 {
     let mut total: u64 = 0;
-    let mut add = |guid: u64, items: &mut Items| {
+    let mut add = |guid: u64, items: &Items| {
         if guid != 0 {
             total += u64::from(item_repair_cost(guid, items, tables, commands));
         }
@@ -393,10 +391,9 @@ fn repair_all_cost(
 
 /// Build the Lua-facing snapshot from [`MerchantOpen`] + the player/vendor descriptors — `None`
 /// when no vendor is open.
-#[allow(clippy::too_many_arguments)]
 fn snapshot(
     open: &MerchantOpen,
-    items: &mut Items,
+    items: &Items,
     icons: Option<&ItemDisplays>,
     commands: &NetCommands,
     player: Option<&benilla_protocol::ObjectFields>,
@@ -433,17 +430,16 @@ fn snapshot(
 /// content change — the async name landing, a post-buy stock update). Also surfaces refusals on the
 /// red error line and pushes the player's purse each frame it changes. Diffed against a `Local`
 /// memory, exactly like the gossip/container feeds.
-#[allow(clippy::too_many_arguments)]
 fn feed_merchant(
     script: Option<NonSendMut<UiScript>>,
     open: Res<MerchantOpen>,
-    mut items: ResMut<Items>,
+    items: Res<Items>,
     icons: Option<Res<ItemDisplays>>,
     commands: Res<NetCommands>,
     self_q: Query<&ObjectStore, With<SelfPlayer>>,
     units: Query<(&crate::net::Guid, &ObjectStore), Without<SelfPlayer>>,
     tables: Option<Res<RepairTables>>,
-    mut names: ResMut<NameCache>,
+    names: Res<NameCache>,
     mut errors: ResMut<MerchantErrors>,
     mut last: Local<crate::ui_script::VmMemo<Option<MerchantState>>>,
     mut last_money: Local<crate::ui_script::VmMemo<Option<u64>>>,
@@ -497,7 +493,7 @@ fn feed_merchant(
     let player = self_q.iter().next().map(|s| &s.0);
     let fresh = snapshot(
         &open,
-        &mut items,
+        &items,
         icons.as_deref(),
         &commands,
         player,
@@ -801,14 +797,14 @@ mod tests {
 
     #[test]
     fn resolve_maps_unlimited_stock_to_minus_one() {
-        let mut items = Items::default();
+        let items = Items::default();
         let (tx, _rx) = crossbeam_channel::unbounded();
         let commands = NetCommands(tx);
         // Unlimited stock → numAvailable -1; a finite count passes through.
-        let unlimited = resolve_item(&row(159, 1, STOCK_UNLIMITED), &mut items, None, &commands);
+        let unlimited = resolve_item(&row(159, 1, STOCK_UNLIMITED), &items, None, &commands);
         assert_eq!(unlimited.num_available, -1);
         assert_eq!(unlimited.item_id, 159);
-        let finite = resolve_item(&row(4540, 2, 5), &mut items, None, &commands);
+        let finite = resolve_item(&row(4540, 2, 5), &items, None, &commands);
         assert_eq!(finite.num_available, 5);
         // No template answer yet → name + tooltip stats in flight (nil), the rest present.
         assert!(finite.name.is_none());
@@ -878,7 +874,7 @@ mod tests {
                 bag_family: 0,
             }),
         );
-        let resolved = resolve_item(&row(2129, 1, 3), &mut items, None, &commands);
+        let resolved = resolve_item(&row(2129, 1, 3), &items, None, &commands);
         let stats = resolved.stats.expect("template answered → stats present");
         assert_eq!(
             (
diff --git a/crates/benilla-app/src/ui_mirror.rs b/crates/benilla-app/src/ui_mirror.rs
index 591528f7..ea3daed0 100644
--- a/crates/benilla-app/src/ui_mirror.rs
+++ b/crates/benilla-app/src/ui_mirror.rs
@@ -22,7 +22,6 @@ use bevy::prelude::*;
 use benilla_protocol::messages::{MirrorTimerKind, MirrorTimerStart};
 
 use crate::ui_action::Spells;
-use crate::ui_script::UiInput;
 use crate::ui_unit::UnitFeed;
 
 /// One mirror-timer edge off the wire, queued by the net bridge for the bars.
@@ -197,7 +196,7 @@ pub(crate) struct UiMirrorPlugin;
 impl Plugin for UiMirrorPlugin {
     fn build(&self, app: &mut App) {
         app.init_resource::<MirrorTimerFeed>()
-            .add_systems(Update, feed_mirror_timers.in_set(UnitFeed).before(UiInput));
+            .add_systems(Update, feed_mirror_timers.in_set(UnitFeed));
     }
 }
 
diff --git a/crates/benilla-app/src/ui_models/mod.rs b/crates/benilla-app/src/ui_models/mod.rs
index 59a47174..50d7b3f9 100644
--- a/crates/benilla-app/src/ui_models/mod.rs
+++ b/crates/benilla-app/src/ui_models/mod.rs
@@ -653,7 +653,7 @@ impl Plugin for UiModelsPlugin {
             // published (the UI pass's `paint_script`) — see [`forget_dead_vm_tiles`].
             .add_systems(
                 Update,
-                forget_dead_vm_tiles.before(crate::ui_script::UiInput),
+                forget_dead_vm_tiles.in_set(crate::ui_script::UiFeed),
             )
             // After the extract published this frame's requests, and before the pose/palette
             // passes read the roots' transforms (they run in PostUpdate).
@@ -755,6 +755,63 @@ fn setup_tiles(
     let _ = light_buf;
 }
 
+/// pipe_warm's **orthographic twin camera** (decision 2262) — the ortho leg's view key space, the
+/// way [`crate::portrait::spawn_warm_booth`] is the custom-projection one (0958).
+///
+/// bevy_pbr folds the view's projection **class** into `MeshPipelineKey` (`bevy_pbr-0.18.1`
+/// `render/mesh.rs:397` — `Perspective | Orthographic | Custom`, emitted as the
+/// `VIEW_PROJECTION_*` shader def at `:2549`), so one material is a *different pipeline* per
+/// class. 0958's census closed with "the whole 3-D view space is `(samples, projection class)`,
+/// and both classes of both sample counts are now warm" — true on 2026-08-04, when the only
+/// classes were the world camera's Perspective and the booths' custom `WowPortraitProjection`.
+/// Decision 2013 added [`setup_tiles`]' orthographic camera a month later and nothing widened the
+/// warm pass, so the first UI model tile of a session — a cooldown pie, a minimap ping, an
+/// item-push card — compiled its batches live, uncovered, on the render thread.
+///
+/// This camera is that missing class in the tile camera's exact shape: [`booth_view_shape`]
+/// (`Msaa::Off`, HDR, no tonemap) and `FfxGlow::UI_PANE`, spawned right beside the real one above
+/// so the two cannot drift apart. The REAL tile camera is deliberately not borrowed for warming —
+/// it is `is_active: false` until a pane packs a cell, and switching it on would draw the whole
+/// menagerie into the live atlas. Only the projection's CLASS keys the pipeline, never its
+/// numbers; they mirror the real camera's regardless, for the same anti-drift reason.
+pub(crate) fn spawn_warm_tile_cam(
+    commands: &mut Commands,
+    images: &mut Assets<Image>,
+) -> (Entity, RenderLayers) {
+    let layer = RenderLayers::layer(crate::portrait::WARM_ORTHO_LAYER);
+    // The atlas's own minimum size, the way `spawn_warm_booth` takes the real booths'. A render
+    // target's SIZE reaches no pipeline key (the combine pair is keyed on format; mesh pipelines
+    // specialise at queue time, before anything rasterises), so this could be tiny — and a 64²
+    // arm was measured against this one: 4.59 s vs 4.61 s of warm drain, i.e. nothing. The pass's
+    // extra cost is the wider cross it reveals, not the pixels this camera fills, so the size
+    // stays the one that matches the camera being warmed.
+    let image = images.add(new_target_image_sized(ATLAS_MIN, ATLAS_MIN));
+    let cam = commands
+        .spawn((
+            Name::new("pipe_warm orthographic twin camera"),
+            booth_view_shape(),
+            Camera {
+                order: TILE_CAMERA_ORDER - 1,
+                clear_color: ClearColorConfig::Custom(Color::NONE),
+                ..default()
+            },
+            RenderTarget::Image(image.into()),
+            benilla_world::ffx_glow::FfxGlow::UI_PANE,
+            Projection::Orthographic(OrthographicProjection {
+                near: 0.1,
+                far: 2000.0,
+                scaling_mode: ScalingMode::Fixed {
+                    width: ATLAS_MIN as f32,
+                    height: ATLAS_MIN as f32,
+                },
+                ..OrthographicProjection::default_3d()
+            }),
+            layer.clone(),
+        ))
+        .id();
+    (cam, layer)
+}
+
 /// The bevy-space → tile-camera-space rotation: WoW `+X` (bevy `−Z`) to the right, WoW `+Y`
 /// (bevy `−X`) up, WoW `+Z` (bevy `+Y`) toward the viewer — the ortho leg's axes (§2). A proper
 /// rotation (determinant +1), so winding survives.
@@ -817,7 +874,7 @@ fn forget_dead_vm_tiles(
 
 /// The per-frame pass: feed the engine the facts it asked for, keep one tile per visible pane,
 /// pack the atlas, place every tile at its cell and its play head, and aim the camera.
-#[allow(clippy::too_many_arguments, clippy::type_complexity)] // a Bevy system's full input set
+#[allow(clippy::type_complexity)] // a Bevy system's full input set
 fn sync_tiles(
     mut commands: Commands,
     script: Option<NonSendMut<UiScript>>,
@@ -1780,7 +1837,6 @@ struct BuiltTile {
 /// Spawn a file's parts, rig and emitters under `root` on the tile layer — the booth bake's
 /// recipe (`portrait::booth::spawn_booth_model`) for a file with no unit. `None` when a material
 /// is not resident yet (the caller retries next frame rather than latch a world-lit twin).
-#[allow(clippy::too_many_arguments)]
 fn build_tile(
     commands: &mut Commands,
     root: Entity,
diff --git a/crates/benilla-app/src/ui_net.rs b/crates/benilla-app/src/ui_net.rs
index 3f8735a0..f5d6720f 100644
--- a/crates/benilla-app/src/ui_net.rs
+++ b/crates/benilla-app/src/ui_net.rs
@@ -18,20 +18,24 @@ use bevy::prelude::*;
 
 use benilla_ui::script::UiScript;
 
+use benilla_assets::LockRecover;
+
 use crate::net::PingShared;
-use crate::ui_script::UiInput;
+use crate::ui_script::UiFeed;
 
 pub(crate) struct UiNetPlugin;
 
 impl Plugin for UiNetPlugin {
     fn build(&self, app: &mut App) {
-        app.add_systems(Update, feed_net_stats.before(UiInput));
+        app.add_systems(Update, feed_net_stats.in_set(UiFeed));
     }
 }
 
 /// Push the averaged round trip behind `GetNetStats()`.
 fn feed_net_stats(script: Option<NonSendMut<UiScript>>, ping: Res<PingShared>) {
     let Some(mut script) = script else { return };
-    let latency = ping.0.lock().expect("ping clock").avg_latency_ms();
+    // Recovered, not unwrapped: the net threads hold this lock too, and a panic there must end
+    // the connection, not the app (decision 2265 §B1).
+    let latency = ping.0.lock_recover().avg_latency_ms();
     script.set_latency_ms(latency);
 }
diff --git a/crates/benilla-app/src/ui_party/feed.rs b/crates/benilla-app/src/ui_party/feed.rs
index 2756b6ba..c424ccd4 100644
--- a/crates/benilla-app/src/ui_party/feed.rs
+++ b/crates/benilla-app/src/ui_party/feed.rs
@@ -13,7 +13,9 @@ use benilla_ui::script::{
 use bevy::prelude::*;
 
 use crate::names::NameCache;
-use crate::net::{ClientCommand, Guid, GuidIndex, NetCommands, ObjectStore, SelfPlayer};
+use crate::net::{
+    ClientCommand, FieldChanged, FieldEdges, Guid, GuidIndex, NetCommands, ObjectStore, SelfPlayer,
+};
 use crate::target::Selection;
 use crate::ui_script::gate;
 
@@ -103,7 +105,6 @@ pub(crate) const GROUP_MEMBER_SUBGROUP: u8 = 0x07;
 /// events on their edges. The per-member unit state is the 0434 §2 **merged view**: a streamed
 /// member's live descriptor wins; the `PARTY_MEMBER_STATS` snapshot covers the rest — and the
 /// roster status byte overlays both (the descriptor never carries connected/AFK/DND).
-#[allow(clippy::too_many_arguments)] // a Bevy system's param list IS its dependency set
 pub(super) fn feed_party(
     // `ChrClasses.dbc` field 16 — `UnitHasRelicSlot`'s only input. Absent when the client data
     // failed to load, in which case no class reads as having a relic slot.
@@ -114,6 +115,8 @@ pub(super) fn feed_party(
     stores: Query<&ObjectStore>,
     changed_stores: Query<(), Changed<ObjectStore>>,
     mut removed_stores: RemovedComponents<ObjectStore>,
+    // The per-field edges (decision 2297), for `fire_transitions`' watch-bridge arms.
+    mut edges: MessageReader<FieldChanged>,
     self_q: Query<(Entity, &Guid, &ObjectStore), With<SelfPlayer>>,
     factions: Option<Res<crate::target::Factions>>,
     names: Res<NameCache>,
@@ -134,6 +137,7 @@ pub(super) fn feed_party(
         return;
     };
     let (fed, vm_reset) = fed.get_reset(&script);
+    let edges = FieldEdges::collect(&mut edges);
     // The ready-check summary the timeout tick composed (decision 1989) — a client-composed
     // `CHAT_MSG_SYSTEM` line, pushed the way every other one is. Ahead of the gate: the tick
     // runs on the frame clock, not on anything the gate watches.
@@ -334,7 +338,13 @@ pub(super) fn feed_party(
             gate.audit("feed_party", "a party-token snapshot");
             script.set_unit(token, snap.clone());
             if let Some(cur) = &snap {
-                crate::ui_unit::fire_transitions(&mut script, token, fed.units[i].as_ref(), cur);
+                crate::ui_unit::fire_transitions(
+                    &mut script,
+                    token,
+                    fed.units[i].as_ref(),
+                    cur,
+                    &edges,
+                );
             }
             fed.units[i] = snap;
         }
@@ -418,6 +428,7 @@ pub(super) fn feed_party(
                     token,
                     fed.raid_units[i].as_ref(),
                     cur,
+                    &edges,
                 );
             }
             fed.raid_units[i] = snap;
@@ -872,7 +883,7 @@ pub(super) fn drain_party(
     script: Option<NonSendMut<UiScript>>,
     mut group: ResMut<GroupState>,
     selection: Res<Selection>,
-    mut names: ResMut<NameCache>,
+    names: Res<NameCache>,
     self_q: Query<&Guid, With<SelfPlayer>>,
     commands: Res<NetCommands>,
     mut tutorials: Option<MessageWriter<crate::tutorial::TutorialEvent>>,
diff --git a/crates/benilla-app/src/ui_party/mod.rs b/crates/benilla-app/src/ui_party/mod.rs
index bdf3cf37..bea9d671 100644
--- a/crates/benilla-app/src/ui_party/mod.rs
+++ b/crates/benilla-app/src/ui_party/mod.rs
@@ -32,7 +32,7 @@ use benilla_protocol::messages::{
 };
 use bevy::prelude::*;
 
-use crate::ui_script::UiInput;
+use crate::ui_script::{UiFeed, UiInput};
 
 mod feed;
 pub(crate) use feed::{
@@ -47,7 +47,7 @@ impl Plugin for UiPartyPlugin {
         app.init_resource::<GroupState>().add_systems(
             Update,
             (
-                feed::feed_party.before(UiInput),
+                feed::feed_party.in_set(UiFeed),
                 feed::drain_party.after(UiInput),
             ),
         );
diff --git a/crates/benilla-app/src/ui_pass.rs b/crates/benilla-app/src/ui_pass.rs
index 1cacca5d..bef5e7f9 100644
--- a/crates/benilla-app/src/ui_pass.rs
+++ b/crates/benilla-app/src/ui_pass.rs
@@ -353,7 +353,7 @@ fn clear_ui_overlays(mut quads: ResMut<UiQuads>) {
 /// doesn't need a mesh-visible layer at all).
 const UI_RENDER_LAYER: usize = 1;
 
-fn ui_render_layers() -> RenderLayers {
+pub(crate) fn ui_render_layers() -> RenderLayers {
     RenderLayers::layer(UI_RENDER_LAYER)
 }
 
@@ -480,6 +480,21 @@ impl UiQuadMaterial {
     }
 }
 
+/// The mesh every `UiQuadMaterial` quad that is **not** part of the HUD batch stream draws with:
+/// a 1×1 rectangle at the origin, scaled and placed by its own Transform (decision 1466 — a
+/// panning composite never rewrites a vertex buffer).
+///
+/// It has ONE author because a `Material2d` pipeline is keyed on `(view key, MESH LAYOUT)`, and
+/// these two quad families have different layouts: `Rectangle` gives POSITION + NORMAL + UV_0
+/// (`bevy_mesh` `primitives/dim2.rs`), the HUD's batch mesh POSITION + UV_0 + COLOR
+/// ([`rebuild_ui_mesh`]). So `UiQuadMaterial` is **two** pipelines, not one — the claim pipe_warm
+/// carried until decision 2262, which is why the composite's compiled live on the first step into
+/// a WMO interior. `pipe_warm`'s menagerie warms this exact mesh; drifting it here would take the
+/// warm rig with it.
+pub(crate) fn tile_quad_mesh() -> Mesh {
+    Rectangle::new(1.0, 1.0).into()
+}
+
 impl Material2d for UiQuadMaterial {
     /// Our own vertex stage, in the same file: bevy's carries no per-instance data past the
     /// transform, and the run's tint rides the instance tag (see [`tint_tag`]).
diff --git a/crates/benilla-app/src/ui_pet/bar.rs b/crates/benilla-app/src/ui_pet/bar.rs
index 4e7f20ac..7610d1de 100644
--- a/crates/benilla-app/src/ui_pet/bar.rs
+++ b/crates/benilla-app/src/ui_pet/bar.rs
@@ -264,7 +264,6 @@ pub(super) fn active_aura_press(
 /// `pet-action-bar-api.md` §9). Diffing the pushed state is the same edge from the other side:
 /// the slots' content and usability are the bar's, the ten triples are the bank's. `UNIT_PET` is
 /// `feed_pet_unit`'s; `UNIT_FLAGS`/`UNIT_AURA` for `"pet"` are the unit feed's.
-#[allow(clippy::too_many_arguments)]
 pub(super) fn feed_pet_bar(
     script: Option<NonSendMut<UiScript>>,
     bar: Res<PetBar>,
diff --git a/crates/benilla-app/src/ui_pet/drain.rs b/crates/benilla-app/src/ui_pet/drain.rs
index bfcedb40..300c4ab8 100644
--- a/crates/benilla-app/src/ui_pet/drain.rs
+++ b/crates/benilla-app/src/ui_pet/drain.rs
@@ -53,7 +53,6 @@ pub(super) const UNIT_FLAG_POSSESSED: u32 = 0x0100_0000;
 ///
 /// The optimism is bounded by the same packet that owns everything else — the next
 /// `SMSG_PET_SPELLS` (a re-summon, a learn, a stable swap) replaces state and contents together.
-#[allow(clippy::too_many_arguments)] // one Bevy system's full input set
 pub(super) fn drain_pet_actions(
     script: Option<NonSendMut<UiScript>>,
     mut bar: ResMut<PetBar>,
diff --git a/crates/benilla-app/src/ui_pet/mod.rs b/crates/benilla-app/src/ui_pet/mod.rs
index 825e7215..8be067d2 100644
--- a/crates/benilla-app/src/ui_pet/mod.rs
+++ b/crates/benilla-app/src/ui_pet/mod.rs
@@ -155,13 +155,11 @@ impl Plugin for UiPetPlugin {
                 // edges against last frame's answer and the Pet tab never came up.
                 feed_pet_bar
                     .in_set(UnitFeed)
-                    .after(crate::ui_pet_stats::PetSnapshot)
-                    .before(UiInput),
+                    .after(crate::ui_pet_stats::PetSnapshot),
                 feed_pet_unit
                     .in_set(UnitFeed)
-                    .after(crate::ui_pet_stats::PetSnapshot)
-                    .before(UiInput),
-                feed_pet_menu.in_set(UnitFeed).before(UiInput),
+                    .after(crate::ui_pet_stats::PetSnapshot),
+                feed_pet_menu.in_set(UnitFeed),
                 drain_pet_actions.after(UiInput),
                 drain_pet_menu.after(UiInput),
             ),
@@ -182,6 +180,8 @@ pub(crate) struct PetUnit<'w, 's> {
     index: Res<'w, GuidIndex>,
     stores: Query<'w, 's, &'static ObjectStore>,
     self_guid: Res<'w, crate::net::SelfGuid>,
+    /// The per-field edges (decision 2297), for `fire_transitions`' watch-bridge arms.
+    pub(super) edges: MessageReader<'w, 's, crate::net::FieldChanged>,
 }
 
 impl PetUnit<'_, '_> {
diff --git a/crates/benilla-app/src/ui_pet/unit.rs b/crates/benilla-app/src/ui_pet/unit.rs
index a7b4f250..ca449b95 100644
--- a/crates/benilla-app/src/ui_pet/unit.rs
+++ b/crates/benilla-app/src/ui_pet/unit.rs
@@ -59,11 +59,10 @@ pub(super) const UNIT_FLAG_PET_IN_COMBAT: u32 = 0x0000_0800;
 /// The reaction argument is `0`: the pet frame reads no reaction (only `"target"` resolves one —
 /// [`crate::ui_unit::feed_units`]' own note), and the party feed passes the same for the same
 /// reason.
-#[allow(clippy::too_many_arguments)] // a Bevy system's param list IS its dependency set
 pub(super) fn feed_pet_unit(
     script: Option<NonSendMut<UiScript>>,
     bar: Res<PetBar>,
-    pet: PetUnit,
+    mut pet: PetUnit,
     changed_stores: Query<(), Changed<ObjectStore>>,
     mut removed_stores: RemovedComponents<ObjectStore>,
     mut names: ResMut<NameCache>,
@@ -74,6 +73,7 @@ pub(super) fn feed_pet_unit(
         return;
     };
     let (memory, vm_reset) = memory.get_reset(&script);
+    let edges = crate::net::FieldEdges::collect(&mut pet.edges);
     // The gate (1439): the bar (the token's identity), any descriptor change or DESPAWN (the
     // snapshot, the combat flag, and the rename timestamp all live on the pet's store), and the
     // name cache by its landed counter.
@@ -141,7 +141,7 @@ pub(super) fn feed_pet_unit(
                         cur.max_health,
                     );
                 }
-                fire_transitions(&mut script, "pet", memory.pushed.as_ref(), cur);
+                fire_transitions(&mut script, "pet", memory.pushed.as_ref(), cur, &edges);
                 memory.pushed = Some(cur.clone());
             }
         }
diff --git a/crates/benilla-app/src/ui_pet_book.rs b/crates/benilla-app/src/ui_pet_book.rs
index dcd2c0a1..fd718e8d 100644
--- a/crates/benilla-app/src/ui_pet_book.rs
+++ b/crates/benilla-app/src/ui_pet_book.rs
@@ -72,8 +72,7 @@ impl Plugin for UiPetBookPlugin {
                 // tab flipped this frame already reads a populated book.
                 feed_pet_book
                     .in_set(UnitFeed)
-                    .before(crate::ui_action::CooldownEvents)
-                    .before(UiInput),
+                    .before(crate::ui_action::CooldownEvents),
                 // After the input pass, and — like `ui_pet`'s own drain — writing back into
                 // `PetBar`, whose next feed carries the mirrored autocast bit.
                 drain_pet_book.after(UiInput),
@@ -89,7 +88,6 @@ struct FeedMemory {
     pushed: PetBookState,
 }
 
-#[allow(clippy::too_many_arguments)] // a Bevy system's full input set
 fn feed_pet_book(
     script: Option<NonSendMut<UiScript>>,
     bar: Res<PetBar>,
@@ -176,7 +174,6 @@ fn book_changed(fresh: &PetBookState, old: &PetBookState) -> bool {
 }
 
 /// One book slot, fully resolved.
-#[allow(clippy::too_many_arguments)]
 fn slot_view(
     entry: PetActionEntry,
     d: &SpellDisplay,
diff --git a/crates/benilla-app/src/ui_pet_doll.rs b/crates/benilla-app/src/ui_pet_doll.rs
index 9634563b..73a1f404 100644
--- a/crates/benilla-app/src/ui_pet_doll.rs
+++ b/crates/benilla-app/src/ui_pet_doll.rs
@@ -1,7 +1,7 @@
 //! The app-side **pet paper-doll feed** (decision 1057) — `PetPaperDollFrame`'s data, the
 //! [`crate::ui_char`] pattern pointed at the pet.
 //!
-//! Two jobs, each frame, before the VM ticks ([`UiInput`]):
+//! Two jobs, each frame, in the feed phase before the VM ticks ([`crate::ui_script::UiFeed`]):
 //!
 //! - **The pet's [`UnitCombatStats`]**, built through [`crate::ui_char::unit_combat_stats`] — the
 //!   descriptor-only core, which is all a creature has. It is the *same* snapshot type and the
@@ -35,7 +35,6 @@ use benilla_ui::script::{UiScript, UnitCombatStats};
 use crate::portrait::PetDollBooth;
 use crate::ui_char::{fire_stat_transitions, unit_combat_stats};
 use crate::ui_pet::{PetBar, PetUnit};
-use crate::ui_script::UiInput;
 use crate::ui_unit::UnitFeed;
 
 pub(crate) struct UiPetDollPlugin;
@@ -44,7 +43,7 @@ impl Plugin for UiPetDollPlugin {
     fn build(&self, app: &mut App) {
         // Rides the unit feed beside the pet bar's and the stat block's, and before the VM ticks —
         // the whole page repaints out of the one pass that pushes the pet's health.
-        app.add_systems(Update, feed_pet_doll.in_set(UnitFeed).before(UiInput));
+        app.add_systems(Update, feed_pet_doll.in_set(UnitFeed));
     }
 }
 
diff --git a/crates/benilla-app/src/ui_pet_stats.rs b/crates/benilla-app/src/ui_pet_stats.rs
index f378f325..553a9b79 100644
--- a/crates/benilla-app/src/ui_pet_stats.rs
+++ b/crates/benilla-app/src/ui_pet_stats.rs
@@ -34,7 +34,6 @@ use benilla_ui::script::{PetStats, ScriptValue, UiScript};
 use crate::names::NameCache;
 use crate::net::{NetCommands, ObjectStore};
 use crate::ui_pet::{PetBar, PetUnit};
-use crate::ui_script::UiInput;
 use crate::ui_unit::UnitFeed;
 
 /// `UNIT_FIELD_BYTES_0` byte 1 == 3 — **Hunter**, the class the four stat bindings gate on
@@ -93,13 +92,7 @@ impl Plugin for UiPetStatsPlugin {
     fn build(&self, app: &mut App) {
         // Rides the unit feed beside the pet bar's own, and before the VM ticks — the pet frame
         // repaints out of the same pass that pushes its health.
-        app.add_systems(
-            Update,
-            feed_pet_stats
-                .in_set(UnitFeed)
-                .in_set(PetSnapshot)
-                .before(UiInput),
-        );
+        app.add_systems(Update, feed_pet_stats.in_set(UnitFeed).in_set(PetSnapshot));
     }
 }
 
@@ -125,7 +118,7 @@ impl Plugin for UiPetStatsPlugin {
 /// (decision 1676).
 fn family_for(
     pet: Option<&ObjectStore>,
-    names: &mut NameCache,
+    names: &NameCache,
     commands: &NetCommands,
     tables: Option<&PetFamilyTables>,
 ) -> (Option<String>, Option<String>, Vec<String>) {
@@ -235,7 +228,6 @@ fn stats_for(
     )
 }
 
-#[allow(clippy::too_many_arguments)]
 fn feed_pet_stats(
     script: Option<NonSendMut<UiScript>>,
     bar: Res<PetBar>,
@@ -243,7 +235,7 @@ fn feed_pet_stats(
     self_store: Query<&ObjectStore, With<crate::net::SelfPlayer>>,
     tables: Option<Res<PetStatTables>>,
     family_tables: Option<Res<PetFamilyTables>>,
-    mut names: ResMut<NameCache>,
+    names: Res<NameCache>,
     commands: Res<NetCommands>,
     mut last: Local<crate::ui_script::VmMemo<Option<(bool, PetStats)>>>,
 ) {
@@ -252,7 +244,7 @@ fn feed_pet_stats(
     };
     let last = last.get(&script);
     let store = pet.store(bar.spells.pet_guid);
-    let family = family_for(store, &mut names, &commands, family_tables.as_deref());
+    let family = family_for(store, &names, &commands, family_tables.as_deref());
     let fresh = stats_for(store, self_store.iter().next(), tables.as_deref(), family);
     // Push only on change. Happiness moves on its own clock and the frame repaints off UNIT_*
     // events, so a per-frame push would be pure churn — but the DIFF is what makes this cheap,
@@ -593,8 +585,8 @@ mod tests {
         let (cmds, rx) = commands();
 
         // 1. No pet at all.
-        let mut names = NameCache::default();
-        assert_eq!(family_for(None, &mut names, &cmds, Some(&t)), no_family());
+        let names = NameCache::default();
+        assert_eq!(family_for(None, &names, &cmds, Some(&t)), no_family());
         assert!(rx.try_recv().is_err(), "nothing to ask about");
 
         // 2. A pet whose creature query has NOT answered yet — nil, and the ask goes out (once).
@@ -603,7 +595,7 @@ mod tests {
             (PETNUMBER, 7),
         ]));
         assert_eq!(
-            family_for(Some(&pet), &mut names, &cmds, Some(&t)),
+            family_for(Some(&pet), &names, &cmds, Some(&t)),
             no_family(),
             "un-queried is nil, not a guess"
         );
@@ -618,17 +610,14 @@ mod tests {
 
         // 3. The answer lands with family 0 — a template with no family. Still nil, and this is
         //    the common case for every non-tameable creature.
-        let mut names = cache_with(IMP_ENTRY, 0);
-        assert_eq!(
-            family_for(Some(&pet), &mut names, &cmds, Some(&t)),
-            no_family()
-        );
+        let names = cache_with(IMP_ENTRY, 0);
+        assert_eq!(family_for(Some(&pet), &names, &cmds, Some(&t)), no_family());
 
         // 4. The answer lands with the Imp's real family (23, from the live `creature_template`).
         //    A warlock minion: a word, and an EMPTY diet — mask 0 in the shipped DBC.
-        let mut names = cache_with(IMP_ENTRY, 23);
+        let names = cache_with(IMP_ENTRY, 23);
         assert_eq!(
-            family_for(Some(&pet), &mut names, &cmds, Some(&t)),
+            family_for(Some(&pet), &names, &cmds, Some(&t)),
             (
                 Some("Imp".into()),
                 // The family row's own icon column (decision 1676) — and the shipped value for a
@@ -645,8 +634,8 @@ mod tests {
         );
 
         // 5. A hunter's boar (entry 113 → family 5): a word AND the six-diet list, in bit order.
-        let mut names = cache_with(BOAR_ENTRY, 5);
-        let (name, icon, diet) = family_for(Some(&boar()), &mut names, &cmds, Some(&t));
+        let names = cache_with(BOAR_ENTRY, 5);
+        let (name, icon, diet) = family_for(Some(&boar()), &names, &cmds, Some(&t));
         assert_eq!(name.as_deref(), Some("Boar"));
         assert_eq!(
             icon.as_deref(),
@@ -655,11 +644,8 @@ mod tests {
         assert_eq!(diet, ["Meat", "Fish", "Cheese", "Bread", "Fungus", "Fruit"]);
 
         // 6. No DBC tables at all: nil, degraded to exactly the blank level line 1057 shipped.
-        let mut names = cache_with(BOAR_ENTRY, 5);
-        assert_eq!(
-            family_for(Some(&boar()), &mut names, &cmds, None),
-            no_family()
-        );
+        let names = cache_with(BOAR_ENTRY, 5);
+        assert_eq!(family_for(Some(&boar()), &names, &cmds, None), no_family());
     }
 
     /// **The family WORD survives the hunter gate; the DIET does not** — the carved split
@@ -749,6 +735,7 @@ mod tests {
             .init_resource::<crate::ui_cast::QueuedMeleeSpell>()
             .init_resource::<crate::ui_action::AutoRepeatActive>()
             .add_message::<crate::creature_anim::SheathRequest>()
+            .add_message::<crate::net::FieldChanged>()
             .insert_resource(NetCommands(tx))
             .add_plugins((UiPetStatsPlugin, UiPetPlugin));
 
diff --git a/crates/benilla-app/src/ui_petition/feed.rs b/crates/benilla-app/src/ui_petition/feed.rs
index 816014dd..ef7440d2 100644
--- a/crates/benilla-app/src/ui_petition/feed.rs
+++ b/crates/benilla-app/src/ui_petition/feed.rs
@@ -58,12 +58,11 @@ pub(super) struct FedPetition {
 }
 
 /// Build the snapshot, push it, drain the queued lines, and fire the four events on their edges.
-#[allow(clippy::too_many_arguments)]
 pub(super) fn feed_petition(
     script: Option<NonSendMut<UiScript>>,
     registrar: Res<GuildRegistrarState>,
     mut petition: ResMut<PetitionState>,
-    mut names: ResMut<NameCache>,
+    names: Res<NameCache>,
     self_q: Query<&ObjectStore, With<SelfPlayer>>,
     self_guid: Res<SelfGuid>,
     commands: Res<NetCommands>,
@@ -111,7 +110,7 @@ pub(super) fn feed_petition(
         .unwrap_or_default();
 
     let record = open.as_ref().and_then(|o| {
-        let r = petition.records.get(&o.petition_id)?;
+        let r = petition.records.get(o.petition_id)?;
         Some(PetitionRecordView {
             petition_type: if r.is_charter {
                 PETITION_TYPE_CHARTER
@@ -219,12 +218,11 @@ pub(super) fn feed_petition(
 /// flight, a record is cached, and we are **not** its owner. Closing somebody else's charter tells
 /// them so. `CloseGuildRegistrar`, by contrast, really does send nothing — verified by a closure
 /// walk that found no `CDataStore` build on its whole path.
-#[allow(clippy::too_many_arguments)]
 pub(super) fn drain_petition(
     script: Option<NonSendMut<UiScript>>,
     mut registrar: ResMut<GuildRegistrarState>,
     mut petition: ResMut<PetitionState>,
-    mut names: ResMut<NameCache>,
+    names: Res<NameCache>,
     items: Res<Items>,
     self_q: Query<&ObjectStore, With<SelfPlayer>>,
     self_guid: Res<SelfGuid>,
diff --git a/crates/benilla-app/src/ui_petition/mod.rs b/crates/benilla-app/src/ui_petition/mod.rs
index 56e112d9..e458dca1 100644
--- a/crates/benilla-app/src/ui_petition/mod.rs
+++ b/crates/benilla-app/src/ui_petition/mod.rs
@@ -87,8 +87,6 @@
 //! 6. **Using a charter item opens it** — see [`crate::ui_items::ItemUseRoute::ShowPetition`],
 //!    where the evidence and its limits are written down.
 
-use std::collections::{HashMap, HashSet};
-
 use benilla_protocol::messages::{
     petition_result, PetitionQueryResponse, PetitionRename, PetitionShowList,
     PetitionShowSignatures, PetitionSignResults,
@@ -97,7 +95,8 @@ use bevy::prelude::*;
 
 use crate::names::NameCache;
 use crate::net::{ClientCommand, NetCommands};
-use crate::ui_script::UiInput;
+use crate::query_cache::QueryCache;
+use crate::ui_script::{UiFeed, UiInput};
 use crate::ui_session::NpcSession;
 
 mod feed;
@@ -194,12 +193,10 @@ impl NpcSession for GuildRegistrarState {
 #[derive(Resource, Default)]
 pub(crate) struct PetitionState {
     open: Option<OpenCharter>,
-    /// The lazy record cache, keyed by petition id — the guild-identity cache's twin. Session
-    /// state: a petition id means nothing across a reconnect.
-    records: HashMap<u32, Record>,
-    /// Petition ids with a `CMSG_PETITION_QUERY` in flight, so the ask happens once per id per
-    /// connection ([`crate::names::NameCache`]'s rule).
-    querying: HashSet<u32>,
+    /// The lazy record cache, keyed by petition id — the guild-identity cache's twin, ask-once
+    /// through [`QueryCache`] (decision 2288). Session state: a petition id means nothing across
+    /// a reconnect.
+    records: QueryCache<u32, Record>,
     /// `[0xbdce1c]` — set while a sign we sent is outstanding, cleared when its result lands.
     ///
     /// It exists for one reader, and that reader is easy to miss: the decline leg of a close is
@@ -262,6 +259,12 @@ struct Record {
     is_charter: bool,
 }
 
+impl crate::query_cache::AskOnce for PetitionState {
+    fn clear_pending(&mut self) {
+        self.records.clear_pending();
+    }
+}
+
 impl PetitionState {
     /// `SMSG_PETITION_SHOW_SIGNATURES` — open the window on this charter, and fire the record
     /// query if we have never seen this petition.
@@ -282,13 +285,12 @@ impl PetitionState {
     /// The lazy record fill: ask once per petition id, and answer nothing for the call that missed.
     /// The arrival simply lands in the cache; the feed's next rebuild picks it up (see
     /// [`feed`]'s note on why there is no flag).
-    fn request_record(&mut self, petition_id: u32, item: u64, commands: &NetCommands) {
-        if self.records.contains_key(&petition_id) || !self.querying.insert(petition_id) {
-            return;
-        }
-        let _ = commands
-            .0
-            .send(ClientCommand::PetitionQuery { petition_id, item });
+    fn request_record(&self, petition_id: u32, item: u64, commands: &NetCommands) {
+        self.records.get_or_ask(petition_id, || {
+            let _ = commands
+                .0
+                .send(ClientCommand::PetitionQuery { petition_id, item });
+        });
     }
 
     /// One step per landed or patched record — see [`Self::records_epoch`]'s own field doc.
@@ -299,16 +301,15 @@ impl PetitionState {
     /// `SMSG_PETITION_QUERY_RESPONSE` — fill the cache.
     fn apply_record(&mut self, response: PetitionQueryResponse) {
         self.records_epoch = self.records_epoch.wrapping_add(1);
-        self.querying.remove(&response.petition_id);
         self.records.insert(
             response.petition_id,
-            Record {
+            Some(Record {
                 owner: response.owner,
                 name: response.name,
                 body_text: response.body_text,
                 required: response.min_signatures as i32,
                 is_charter: response.flags & 1 != 0,
-            },
+            }),
         );
     }
 
@@ -326,14 +327,14 @@ impl PetitionState {
         &mut self,
         petition_id: u32,
         item: u64,
-        names: &mut NameCache,
+        names: &NameCache,
         commands: &NetCommands,
     ) -> Option<benilla_ui::script::PetitionSlotView> {
         if petition_id == 0 {
             return None;
         }
         self.request_record(petition_id, item, commands);
-        let rec = self.records.get(&petition_id)?;
+        let rec = self.records.get(petition_id)?;
         let (is_charter, title, owner_guid) = (rec.is_charter, rec.name.clone(), rec.owner);
         Some(benilla_ui::script::PetitionSlotView {
             is_charter,
@@ -360,7 +361,7 @@ impl PetitionState {
         &mut self,
         item: u64,
         signer: u64,
-        names: &mut NameCache,
+        names: &NameCache,
         commands: &NetCommands,
     ) -> Option<String> {
         let open = self.open.as_mut().filter(|o| o.item == item)?;
@@ -388,7 +389,7 @@ impl PetitionState {
         let Some(open) = self.open.as_ref() else {
             return;
         };
-        if self.signing || !self.records.contains_key(&open.petition_id) || open.owner == me {
+        if self.signing || !self.records.answered(open.petition_id) || open.owner == me {
             return;
         }
         let _ = commands
@@ -413,6 +414,7 @@ pub(crate) struct UiPetitionPlugin;
 
 impl Plugin for UiPetitionPlugin {
     fn build(&self, app: &mut App) {
+        crate::query_cache::register::<PetitionState>(app);
         app.init_resource::<GuildRegistrarState>()
             .init_resource::<PetitionState>()
             .add_systems(
@@ -422,7 +424,7 @@ impl Plugin for UiPetitionPlugin {
                     // frame — every other NPC window's ordering.
                     crate::ui_session::close_npc_session_out_of_range::<GuildRegistrarState>
                         .before(feed::feed_petition),
-                    feed::feed_petition.before(UiInput),
+                    feed::feed_petition.in_set(UiFeed),
                     feed::drain_petition.after(UiInput),
                 ),
             );
@@ -489,7 +491,7 @@ pub(crate) mod apply {
     ///   success additionally **closes the window** (`0x5ef037` fires `PETITION_CLOSED`).
     pub(crate) fn sign_results(
         petition: &mut PetitionState,
-        names: &mut NameCache,
+        names: &NameCache,
         self_guid: u64,
         results: PetitionSignResults,
         commands: &NetCommands,
@@ -557,7 +559,12 @@ pub(crate) mod apply {
         else {
             return;
         };
-        petition.records.entry(id).or_default().name = rename.name;
+        if !petition.records.answered(id) {
+            petition.records.insert(id, Some(Record::default()));
+        }
+        if let Some(record) = petition.records.get_mut(id) {
+            record.name = rename.name;
+        }
         // A patched title is a changed record: the tooltip's line 3 reads it too.
         petition.records_epoch = petition.records_epoch.wrapping_add(1);
     }
@@ -595,7 +602,7 @@ mod tests {
     /// return, spelled once here rather than at three assertion sites.
     fn open_title(p: &PetitionState) -> Option<&str> {
         let open = p.open.as_ref()?;
-        p.records.get(&open.petition_id).map(|r| r.name.as_str())
+        p.records.get(open.petition_id).map(|r| r.name.as_str())
     }
 
     fn signatures(item: u64, owner: u64, id: u32, signers: &[u64]) -> PetitionShowSignatures {
diff --git a/crates/benilla-app/src/ui_quest.rs b/crates/benilla-app/src/ui_quest.rs
index 66c5e127..7cfa6928 100644
--- a/crates/benilla-app/src/ui_quest.rs
+++ b/crates/benilla-app/src/ui_quest.rs
@@ -30,7 +30,7 @@ use crate::items::Items;
 use crate::names::NameCache;
 use crate::net::{ClientCommand, Guid, GuidIndex, NetCommands, ObjectStore, SelfPlayer};
 use crate::ui_action::{show_messages, ui_error_text, MessageSink, Shown, Spells, UiError};
-use crate::ui_script::UiInput;
+use crate::ui_script::{UiFeed, UiInput};
 use crate::ui_session::{close_npc_session_out_of_range, npc_switched, NpcSession};
 
 /// The open questgiver view — exactly the wire packet that opened the current panel. The feed turns
@@ -264,7 +264,7 @@ impl Plugin for UiQuestPlugin {
                 // drain after it so a click's intent goes out the same frame (mirrors
                 // ui_gossip/merchant).
                 close_npc_session_out_of_range::<QuestGiver>.before(feed_quest),
-                feed_quest.before(UiInput),
+                feed_quest.in_set(UiFeed),
                 drain_quest.after(UiInput),
             ),
         );
@@ -360,7 +360,7 @@ type Pool = Vec<(u32, u32)>;
 /// in flight — the row shows a placeholder and fills in, exactly like a bag slot / vendor row).
 fn resolve_item(
     it: &QuestRewardItem,
-    items: &mut Items,
+    items: &Items,
     icons: Option<&ItemDisplays>,
     commands: &NetCommands,
 ) -> QuestItemView {
@@ -389,7 +389,7 @@ fn resolve_item(
 
 fn resolve_items(
     src: &[QuestRewardItem],
-    items: &mut Items,
+    items: &Items,
     icons: Option<&ItemDisplays>,
     commands: &NetCommands,
 ) -> Vec<QuestItemView> {
@@ -425,7 +425,7 @@ pub(crate) fn reward_spell_view(
 
 fn snapshot(
     giver: &QuestGiver,
-    items: &mut Items,
+    items: &Items,
     icons: Option<&ItemDisplays>,
     commands: &NetCommands,
     macros: &crate::npc_text::MacroContext,
@@ -498,18 +498,17 @@ fn panel_event(panel: QuestPanel) -> &'static str {
 /// change → the panel's open event; same panel, content changed → `QUEST_ITEM_UPDATE`; closed →
 /// `QUEST_FINISHED`). Diffed against a `Local`, exactly like the gossip/merchant feeds. The NPC
 /// name rides as arg1 (resolved through the NameCache, ask-once — the merchant's pattern).
-#[allow(clippy::too_many_arguments)]
 fn feed_quest(
     script: Option<NonSendMut<UiScript>>,
     mut giver: ResMut<QuestGiver>,
-    mut items: ResMut<Items>,
+    items: Res<Items>,
     icons: Option<Res<ItemDisplays>>,
     commands: Res<NetCommands>,
-    mut names: ResMut<NameCache>,
+    names: Res<NameCache>,
     states: Res<crate::world_state::WorldStates>,
     self_q: Query<(&ObjectStore, &Guid), With<SelfPlayer>>,
     spells: Option<Res<Spells>>,
-    mut go_templates: ResMut<crate::go_templates::GameObjectTemplates>,
+    go_templates: Res<crate::go_templates::GameObjectTemplates>,
     materials: Option<Res<crate::ui_item_text::PageMaterials>>,
     mut sink: MessageSink,
     mut last: Local<crate::ui_script::VmMemo<Option<QuestState>>>,
@@ -540,10 +539,10 @@ fn feed_quest(
         })
         .collect();
     show_messages(&mut script, &mut sink, "ui_quest", lines);
-    let player = crate::npc_text::player_identity(&self_q, &mut names, &commands);
+    let player = crate::npc_text::player_identity(&self_q, &names, &commands);
     let fresh = snapshot(
         &giver,
-        &mut items,
+        &items,
         icons.as_deref(),
         &commands,
         &crate::npc_text::MacroContext {
@@ -560,8 +559,8 @@ fn feed_quest(
         st.background_material = giver.npc.and_then(|source| {
             crate::ui_item_text::object_material(
                 source,
-                &mut items,
-                &mut go_templates,
+                &items,
+                &go_templates,
                 materials.as_deref(),
                 &commands,
             )
@@ -878,7 +877,7 @@ mod tests {
             }),
         );
         assert!(giver.is_open());
-        let mut items = Items::default();
+        let items = Items::default();
         let (tx, _rx) = crossbeam_channel::unbounded();
         let commands = NetCommands(tx);
         let player = crate::npc_text::Subject {
@@ -889,7 +888,7 @@ mod tests {
         };
         let snap = snapshot(
             &giver,
-            &mut items,
+            &items,
             None,
             &commands,
             &crate::npc_text::MacroContext {
@@ -929,12 +928,12 @@ mod tests {
                 is_complete: true,
             }),
         );
-        let mut items = Items::default();
+        let items = Items::default();
         let (tx, _rx) = crossbeam_channel::unbounded();
         let commands = NetCommands(tx);
         let snap = snapshot(
             &giver,
-            &mut items,
+            &items,
             None,
             &commands,
             &crate::npc_text::MacroContext {
diff --git a/crates/benilla-app/src/ui_quest_log.rs b/crates/benilla-app/src/ui_quest_log.rs
index 2f268dbd..dee3e84d 100644
--- a/crates/benilla-app/src/ui_quest_log.rs
+++ b/crates/benilla-app/src/ui_quest_log.rs
@@ -35,7 +35,7 @@
 //! rather than left dead, so the retired law can't be reached for by accident.
 
 use crate::ui_items::{count_of, InventoryScope};
-use std::collections::{HashMap, HashSet};
+use std::collections::HashSet;
 
 use bevy::prelude::*;
 
@@ -54,8 +54,9 @@ use crate::entities::ItemDisplays;
 use crate::items::Items;
 use crate::names::NameCache;
 use crate::net::{ClientCommand, Guid, NetCommands, ObjectStore, SelfPlayer};
+use crate::query_cache::QueryCache;
 use crate::ui_action::Spells;
-use crate::ui_script::UiInput;
+use crate::ui_script::{UiFeed, UiInput};
 use crate::ui_unit::UnitFeed;
 
 /// The top bit `QuestObjective::creature_or_go` carries for a gameobject objective —
@@ -73,16 +74,15 @@ struct Row {
 
 /// The quest-log state cache + per-frame bookkeeping.
 ///
-/// - `templates`/`pending` — the `SMSG_QUEST_QUERY_RESPONSE` cache, ask-once by quest id (the exact
-///   twin of [`Items`]'s item-template cache).
+/// - `templates` — the `SMSG_QUEST_QUERY_RESPONSE` cache, ask-once by quest id through
+///   [`QueryCache`] (the exact twin of [`Items`]'s item-template cache).
 /// - `entry_slots` — this frame's pushed entry order → descriptor slot, so
 ///   [`drain_quest_log_abandons`] can turn a confirmed abandon's 1-based Lua index back into the
 ///   `CMSG_QUESTLOG_REMOVE_QUEST` slot it came from (slots aren't contiguous — an abandoned/turned-in
 ///   quest leaves a gap).
 #[derive(Resource, Default)]
 pub(crate) struct QuestLog {
-    templates: HashMap<u32, QuestTemplate>,
-    pending: HashSet<u32>,
+    templates: QueryCache<u32, QuestTemplate>,
     entry_slots: Vec<Option<u8>>,
     /// Collapsed section headers, keyed by header TITLE (two zones sharing a name share a header
     /// row, so the fold state naturally shares too). Owned here — the engine only reports the
@@ -93,31 +93,28 @@ pub(crate) struct QuestLog {
     header_keys: Vec<Option<String>>,
 }
 
+impl crate::query_cache::AskOnce for QuestLog {
+    fn clear_pending(&mut self) {
+        self.templates.clear_pending();
+    }
+}
+
 impl QuestLog {
     /// The template for `quest_id`, if known — ask-once: a miss sends `CMSG_QUEST_QUERY` (deduped
     /// while in flight) and returns `None`; a cached negative (the server doesn't know the id) is
     /// also `None`, without a re-ask. The exact twin of [`Items::template`].
-    pub(crate) fn template(
-        &mut self,
-        quest_id: u32,
-        commands: &NetCommands,
-    ) -> Option<&QuestTemplate> {
-        if !self.templates.contains_key(&quest_id) {
-            if self.pending.insert(quest_id) {
-                debug!("ui_quest_log: asking quest template (quest {quest_id})");
-                let _ = commands
-                    .0
-                    .send(ClientCommand::QuestQuery { quest: quest_id });
-            }
-            return None;
-        }
-        self.templates.get(&quest_id)
+    pub(crate) fn template(&self, quest_id: u32, commands: &NetCommands) -> Option<&QuestTemplate> {
+        self.templates.get_or_ask(quest_id, || {
+            debug!("ui_quest_log: asking quest template (quest {quest_id})");
+            let _ = commands
+                .0
+                .send(ClientCommand::QuestQuery { quest: quest_id });
+        })
     }
 
     /// Record a template answer (`SMSG_QUEST_QUERY_RESPONSE`).
     pub(crate) fn insert_template(&mut self, template: QuestTemplate) {
-        self.pending.remove(&template.quest_id);
-        self.templates.insert(template.quest_id, template);
+        self.templates.insert(template.quest_id, Some(template));
     }
 
     /// Disconnect: drop everything, including the templates. Unlike item templates (which persist —
@@ -126,7 +123,6 @@ impl QuestLog {
     /// to re-ask that there's no reason to risk it.
     pub(crate) fn clear_session(&mut self) {
         self.templates.clear();
-        self.pending.clear();
         self.entry_slots.clear();
         self.collapsed.clear();
         self.header_keys.clear();
@@ -137,6 +133,7 @@ pub(crate) struct UiQuestLogPlugin;
 
 impl Plugin for UiQuestLogPlugin {
     fn build(&self, app: &mut App) {
+        crate::query_cache::register::<QuestLog>(app);
         app.init_resource::<QuestLog>()
             .add_systems(
                 Startup,
@@ -146,10 +143,10 @@ impl Plugin for UiQuestLogPlugin {
             .add_systems(
                 Update,
                 (
-                    feed_quest_log.in_set(UnitFeed).before(UiInput),
+                    feed_quest_log.in_set(UnitFeed),
                     // Before the script tick, so a QuestTimerFrame OnUpdate this frame reads this
                     // frame's clock (the `minimap::feed_game_time` shape).
-                    feed_server_clock.before(UiInput),
+                    feed_server_clock.in_set(UiFeed),
                     drain_quest_log_abandons.after(UiInput),
                     drain_quest_log_pushes.after(UiInput),
                     drain_quest_log_collapses.after(UiInput),
@@ -293,7 +290,7 @@ fn money_split(money: i32) -> (u32, u32) {
 fn resolve_template_item(
     entry: u32,
     count: u32,
-    items: &mut Items,
+    items: &Items,
     icons: Option<&ItemDisplays>,
     commands: &NetCommands,
 ) -> QuestItemView {
@@ -336,13 +333,12 @@ fn resolve_template_item(
 ///
 /// Still not emitted, and still gaps rather than errors (1156 §4): the `event` line and the
 /// reputation line.
-#[allow(clippy::too_many_arguments)]
 fn build_objectives(
     template: &QuestTemplate,
     log_slot: &QuestLogSlot,
     store: &ObjectFields,
-    items: &mut Items,
-    names: &mut NameCache,
+    items: &Items,
+    names: &NameCache,
     commands: &NetCommands,
     // The VM's own `GlobalStrings.lua`, for the leaderboard's three format keys.
     get: &dyn Fn(&str) -> Option<String>,
@@ -392,7 +388,7 @@ fn build_objectives(
 /// not — see [`build_objectives`]), so this no longer needs the descriptor slot at all.
 fn build_detail(
     template: &QuestTemplate,
-    items: &mut Items,
+    items: &Items,
     icons: Option<&ItemDisplays>,
     commands: &NetCommands,
     macros: &crate::npc_text::MacroContext,
@@ -542,13 +538,12 @@ fn order_groups(rows: &[GroupRow]) -> Vec<(i32, String, Vec<usize>)> {
 /// and push a [`QuestLogState`] snapshot on change (diffed against a `Local`, the crate's standard
 /// feed shape). Also refreshes [`QuestLog::active_quest_ids`]/`entry_slots` for the greeting split
 /// and the abandon drain.
-#[allow(clippy::too_many_arguments)]
 fn feed_quest_log(
     script: Option<NonSendMut<UiScript>>,
     self_q: Query<(&ObjectStore, &Guid), With<SelfPlayer>>,
     mut quest_log: ResMut<QuestLog>,
-    mut names: ResMut<NameCache>,
-    mut items: ResMut<Items>,
+    names: Res<NameCache>,
+    items: Res<Items>,
     icons: Option<Res<ItemDisplays>>,
     commands: Res<NetCommands>,
     header_names: Option<Res<QuestHeaderNamesRes>>,
@@ -665,7 +660,7 @@ fn feed_quest_log(
         let keyed: Vec<GroupRow> = rows
             .iter()
             .map(|r| {
-                let t = quest_log.templates.get(&r.quest_id);
+                let t = quest_log.templates.get(r.quest_id);
                 let zos = t.map(|t| t.zone_or_sort).unwrap_or(0);
                 GroupRow {
                     zone_or_sort: zos,
@@ -690,7 +685,7 @@ fn feed_quest_log(
 
     // Above the row loop because every row's detail substitutes through it now (the chat macros
     // in a quest's description/objectives paragraph), not just the selection's.
-    let player = crate::npc_text::player_identity(&self_q, &mut names, &commands);
+    let player = crate::npc_text::player_identity(&self_q, &names, &commands);
     let macros = crate::npc_text::MacroContext {
         subject: player.as_ref(),
         states: &states,
@@ -741,21 +736,13 @@ fn feed_quest_log(
                         // button we wrongly enabled would push, and the party would get a detail panel
                         // for a quest the server then refuses (decision 1733).
                         t.flags & quest_flags::SHARABLE != 0,
-                        build_objectives(
-                            t,
-                            &r.log_slot,
-                            &store.0,
-                            &mut items,
-                            &mut names,
-                            &commands,
-                            &get,
-                        ),
+                        build_objectives(t, &r.log_slot, &store.0, &items, &names, &commands, &get),
                         // Every row, not just the selection (decision 2247) — the detail bindings
                         // resolve the live selection against these at call time, the way the
                         // reference peeks its quest cache inside the call.
                         Some(build_detail(
                             t,
-                            &mut items,
+                            &items,
                             icons.as_deref(),
                             &commands,
                             &macros,
@@ -1427,8 +1414,8 @@ mod tests {
             timer: 0,
         };
         let store = ObjectFields::default(); // empty bags — the item objective reads 0/5
-        let mut items = Items::default();
-        let mut names = NameCache::default();
+        let items = Items::default();
+        let names = NameCache::default();
         let (tx, _rx) = crossbeam_channel::unbounded();
         let commands = NetCommands(tx);
 
@@ -1436,8 +1423,8 @@ mod tests {
             &template,
             &log_slot,
             &store,
-            &mut items,
-            &mut names,
+            &items,
+            &names,
             &commands,
             &probe_strings,
         );
@@ -1477,8 +1464,8 @@ mod tests {
             timer: 0,
         };
         let store = ObjectFields::default();
-        let mut items = Items::default();
-        let mut names = NameCache::default();
+        let items = Items::default();
+        let names = NameCache::default();
         let (tx, _rx) = crossbeam_channel::unbounded();
         let commands = NetCommands(tx);
 
@@ -1486,8 +1473,8 @@ mod tests {
             &template,
             &log_slot,
             &store,
-            &mut items,
-            &mut names,
+            &items,
+            &names,
             &commands,
             &probe_strings,
         );
@@ -1519,8 +1506,8 @@ mod tests {
             timer: 0,
         };
         let store = ObjectFields::default();
-        let mut items = Items::default();
-        let mut names = NameCache::default();
+        let items = Items::default();
+        let names = NameCache::default();
         let (tx, _rx) = crossbeam_channel::unbounded();
         let commands = NetCommands(tx);
 
@@ -1528,8 +1515,8 @@ mod tests {
             &template,
             &log_slot,
             &store,
-            &mut items,
-            &mut names,
+            &items,
+            &names,
             &commands,
             &probe_strings,
         );
@@ -1558,8 +1545,8 @@ mod tests {
             timer: 0,
         };
         let store = ObjectFields::default();
-        let mut items = Items::default();
-        let mut names = NameCache::default();
+        let items = Items::default();
+        let names = NameCache::default();
         let (tx, _rx) = crossbeam_channel::unbounded();
         let commands = NetCommands(tx);
 
@@ -1567,8 +1554,8 @@ mod tests {
             &template,
             &log_slot,
             &store,
-            &mut items,
-            &mut names,
+            &items,
+            &names,
             &commands,
             &probe_strings,
         );
@@ -1593,8 +1580,8 @@ mod tests {
             timer: 0,
         };
         let store = ObjectFields::default();
-        let mut items = Items::default();
-        let mut names = NameCache::default();
+        let items = Items::default();
+        let names = NameCache::default();
         let (tx, _rx) = crossbeam_channel::unbounded();
         let commands = NetCommands(tx);
 
@@ -1602,8 +1589,8 @@ mod tests {
             &template,
             &log_slot,
             &store,
-            &mut items,
-            &mut names,
+            &items,
+            &names,
             &commands,
             &probe_strings,
         );
diff --git a/crates/benilla-app/src/ui_quest_share.rs b/crates/benilla-app/src/ui_quest_share.rs
index 427f1e8f..ee9fc878 100644
--- a/crates/benilla-app/src/ui_quest_share.rs
+++ b/crates/benilla-app/src/ui_quest_share.rs
@@ -48,7 +48,7 @@ use bevy::prelude::*;
 use crate::names::NameCache;
 use crate::net::{ClientCommand, NetCommands};
 use crate::ui_action::{show_messages, ui_error_text, MessageSink, Shown, UiError};
-use crate::ui_script::UiInput;
+use crate::ui_script::{UiFeed, UiInput};
 
 /// How many frames a queued line waits for its `%s` before it is dropped — [`crate::ui_loot`]'s
 /// `RECEIVE_MAX_TRIES`, and the same reasoning: a name query is one round trip, so any real answer
@@ -144,7 +144,7 @@ impl Plugin for QuestSharePlugin {
         app.init_resource::<QuestShare>().add_systems(
             Update,
             (
-                feed_quest_share.before(UiInput),
+                feed_quest_share.in_set(UiFeed),
                 drain_quest_share.after(UiInput),
             ),
         );
@@ -156,7 +156,7 @@ impl Plugin for QuestSharePlugin {
 fn feed_quest_share(
     script: Option<NonSendMut<UiScript>>,
     mut share: ResMut<QuestShare>,
-    mut names: ResMut<NameCache>,
+    names: Res<NameCache>,
     commands: Res<NetCommands>,
     mut sink: MessageSink,
 ) {
diff --git a/crates/benilla-app/src/ui_reputation.rs b/crates/benilla-app/src/ui_reputation.rs
index 2bc23dbe..18b8d436 100644
--- a/crates/benilla-app/src/ui_reputation.rs
+++ b/crates/benilla-app/src/ui_reputation.rs
@@ -39,7 +39,7 @@ use benilla_ui::script::{FactionEntry, ReputationSend, ReputationState, UiScript
 
 use crate::net::{ClientCommand, NetCommands, ObjectStore, Reputations, SelfPlayer};
 use crate::target::Factions;
-use crate::ui_script::UiInput;
+use crate::ui_script::{UiFeed, UiInput};
 
 /// The cumulative standing edges of the eight ranks: `RANK_BOUNDS[r]` is rank `r`'s absolute floor
 /// and `RANK_BOUNDS[r + 1]` its ceiling. The widths between them are vmangos's `PointsInRank`
@@ -57,7 +57,7 @@ impl Plugin for UiReputationPlugin {
         app.add_systems(
             Update,
             (
-                feed_reputation.before(UiInput),
+                feed_reputation.in_set(UiFeed),
                 drain_reputation_sends.after(UiInput),
             ),
         );
diff --git a/crates/benilla-app/src/ui_script/bagnon_render_tests.rs b/crates/benilla-app/src/ui_script/bagnon_render_tests.rs
index d87a6238..161498cb 100644
--- a/crates/benilla-app/src/ui_script/bagnon_render_tests.rs
+++ b/crates/benilla-app/src/ui_script/bagnon_render_tests.rs
@@ -534,7 +534,11 @@ fn the_item_button_helpers_paint_a_slots_icon_and_count() {
 fn the_roster_seat_names_the_character_the_addons_will_meet() {
     let seat = super::seat_from_roster(&roster()).expect("a pending pick seats a player");
     assert_eq!(seat.name.as_deref(), Some("Harness"));
-    assert_eq!(seat.level, 60);
+    // **0, not 60 — the reference's answer, byte-verified** (decision 2263). `UnitLevel 0x517fc0`
+    // carries no `"player"` fast path at all: it resolves the token, misses (no object, no roster
+    // record for a zero GUID) and reaches `0x51813e push 0; push 0` — the NUMBER 0, one return.
+    // The roster's real level arrives with the descriptor, within the second.
+    assert_eq!(seat.level, 0);
     assert_eq!(seat.race_file.as_deref(), Some("Human"));
     assert_eq!(seat.class_file.as_deref(), Some("WARRIOR"));
     assert_eq!(seat.sex, 2, "the wire's 0 is UnitSex's 2");
@@ -543,7 +547,17 @@ fn the_roster_seat_names_the_character_the_addons_will_meet() {
         Some("Alliance"),
         "nil here is 24 corpus addons stopping on AceDB-2.0's file-scope concatenation"
     );
-    assert!(seat.exists && seat.is_player);
+    // **`exists` is false, and that is the correction 2263 made** (it was `true` from 1230 until
+    // then). `UnitExists 0x515fb0` has no fast path either; its resolver reads the GUID out of the
+    // OBJECT (`0x515994`), so with none it holds `0:0`, and the roster fallback `0x491900` bails
+    // on a zero GUID at `0x4e80aa je` BEFORE fetching the active player — so the `0 == 0` that
+    // would answer "that's me" never runs, and `0x516001` pushes nil.
+    //
+    // Safe to correct only *because* of the record above: 1230 seated a whole unit in order to
+    // deliver a name at addon file scope, and the name no longer needs a unit to exist. The rest
+    // of the seat is untouched and still load-bearing — the faction side below above all.
+    assert!(!seat.exists);
+    assert!(seat.is_player);
     // Deliberately NOT invented — the descriptor says these, within the second.
     assert_eq!((seat.health, seat.max_health), (0, 0));
 
diff --git a/crates/benilla-app/src/ui_script/battlefield_minimap_tests.rs b/crates/benilla-app/src/ui_script/battlefield_minimap_tests.rs
new file mode 100644
index 00000000..5ef0c935
--- /dev/null
+++ b/crates/benilla-app/src/ui_script/battlefield_minimap_tests.rs
@@ -0,0 +1,1109 @@
+//! The **battle map** — `Blizzard_BattlefieldMinimap`, the reference's own LoadOnDemand addon,
+//! driven through the road stock `UIParent.lua` drives it down: `ToggleBattlefieldMinimap()`
+//! (SHIFT-M) → `BattlefieldMinimap_LoadUI()` → `UIParentLoadAddOn`.
+//!
+//! benilla has registered the addon as a chain row since 1957 and a live run confirmed it loads —
+//! and that was the whole of the evidence. Nothing had ever checked that its twelve overlay
+//! textures get cut from `GetMapOverlayInfo`, that its POI pool grows, that the battleground blips
+//! and the flag carrier reach it, that its arrow is the *mini* singleton rather than the world
+//! map's, or that its tab, dropdown and opacity slider work at all. This file is that check: the
+//! whole addon, top to bottom, against the engine verbs it actually calls.
+//!
+//! **The harness is the whole manifest, not a cut dependency prefix** — the deliberate difference
+//! from `tradeskill_frame.rs` / `talent_frame.rs` / `auction_frame.rs`, whose windows each sit on
+//! a handful of FrameXML files. This one reads `MiniMapBattlefieldFrame.status` (Minimap.xml),
+//! `GetNumWorldStateUI` and `SHOW_BATTLEFIELD_MINIMAP` (WorldStateFrame.lua), `UIOptionsFrame`
+//! (UIOptionsFrame.xml), `OpacityFrameSlider` (ColorPickerFrame.xml), the `WorldMapUnitTemplate`
+//! family (WorldMapFrameTemplates.xml) and `MAX_PARTY_MEMBERS`/`MAX_RAID_MEMBERS` — five corners
+//! of the manifest, which is exactly the state a player is in when they press SHIFT-M. It also
+//! lives *in* the crate rather than under `tests/`, because the LoadOnDemand road needs
+//! [`super::test_ui::seat_chain_addon`] and an integration test cannot reach it (see
+//! `tests/common/mod.rs`'s own note on the `#[cfg(test)]` boundary).
+
+use benilla_ui::script::{
+    BattlefieldFlagView, BattlefieldPositionView, QuadContent, UiScript, UnitState,
+    WorldMapContinentView, WorldMapLandmarkView, WorldMapOverlayView, WorldMapZoneView,
+    WorldStateUiView, ARROW_MODEL,
+};
+
+/// **The manifest's own warning floor** — one row, and it is a decided permanent gap rather than
+/// anything this addon does: stock `OptionsFrame.lua:300` reads `GetCVar("gxRefresh")` and 2177
+/// keeps that CVar unregistered on purpose, because nothing here can set a refresh rate.
+/// `world_entry_tests`' own `KNOWN` list carries the same row for the same reason. Pinning the
+/// *exact* set rather than allowing any warning is what makes [`quiet`] a real assertion: a
+/// warning the addon causes shows up as a second row.
+const MANIFEST_WARNINGS: [&str; 1] = ["unknown CVar 'gxRefresh' (not host-registered) — ignored"];
+
+/// Zero Lua errors, and no host warning the manifest did not already carry.
+fn quiet(s: &UiScript) {
+    assert!(s.errors().is_empty(), "script errors: {:#?}", s.errors());
+    assert_eq!(
+        s.warnings(),
+        MANIFEST_WARNINGS,
+        "host warnings beyond the manifest's own"
+    );
+}
+
+/// The full interface with the addon **registered but not loaded** — the state a character is in
+/// the moment before SHIFT-M.
+///
+/// The player exists because the in-game UI materializes on world entry (1051) and several stock
+/// OnLoads format `UnitName("player")` into their labels; a manifest load with no player is a
+/// state the client never reaches (1848).
+fn session() -> UiScript {
+    let mut s = UiScript::new().unwrap();
+    s.set_screen_size(1024.0, 768.0);
+    s.set_unit(
+        "player",
+        Some(UnitState {
+            exists: true,
+            name: Some("Probefour".into()),
+            level: 60,
+            ..Default::default()
+        }),
+    );
+    let failures = super::load_default_ui(&s);
+    assert!(failures.is_empty(), "manifest load errors: {failures:#?}");
+    super::test_ui::seat_chain_addon(&mut s, "Blizzard_BattlefieldMinimap");
+    s.resolve();
+    quiet(&s);
+    s
+}
+
+/// The arrow file's facts, as the host hands them over (2007/2015) — `MinimapArrow.m2`'s one
+/// looping 3.333 s Stand and its header box, which the implicit rect and the re-centring read.
+/// Seated *after* the manifest on purpose: the world map's own arrow is created during that load,
+/// so this is the mini arrow's facts and only the mini arrow's.
+fn arrow_facts(s: &mut UiScript) {
+    use benilla_ui::widget::{ModelFileFacts, SequenceFacts};
+    s.set_model_facts(
+        ARROW_MODEL,
+        ModelFileFacts {
+            sequences: vec![SequenceFacts {
+                anim_id: 0,
+                duration_ms: 3333,
+                looping: true,
+            }],
+            bbox: ([-0.0127, -0.0118, 0.0], [0.0135, 0.0145, 0.0]),
+            cameras: 0,
+        },
+    );
+}
+
+/// One `WorldMapOverlay` row, revealed by a single explore bit.
+fn overlay(texture: &str, w: u32, h: u32, ox: u32, oy: u32, bit: u32) -> WorldMapOverlayView {
+    WorldMapOverlayView {
+        texture: format!("Interface\\WorldMap\\WarsongGulch\\{texture}"),
+        width: w,
+        height: h,
+        offset_x: ox,
+        offset_y: oy,
+        explore_bits: vec![bit],
+        hit_rect: (0, 0, 0, 0),
+        area_name: None,
+    }
+}
+
+/// A one-zone catalog whose zone **has overlays that make the slicing loop do real work**.
+///
+/// The sizes are chosen so both arms of the reference's tile walk run. `SilverwingHold` is
+/// 300×200: `ceil(300/256) = 2` wide, `ceil(200/256) = 1` tall, so its second column takes the
+/// remainder arm (`mod(300,256) = 44` px in a 64-px power-of-two file) while the first takes the
+/// full-tile arm, and its single row takes the remainder arm vertically (`mod(200,256) = 200` in a
+/// 256-px file). `WarsongLumberMill` is exactly 256×256 — the one case where *both* `mod`s come
+/// out zero and the reference's `if ( texturePixelWidth == 0 ) then texturePixelWidth = 256` guard
+/// is what keeps the tile from collapsing. Between them they need three textures, which is also
+/// what makes the second half of [`the_overlay_textures_are_cut_from_the_revealed_overlays`] — the
+/// tail that parks — observable.
+fn catalog() -> Vec<WorldMapContinentView> {
+    vec![WorldMapContinentView {
+        name: "Kalimdor".into(),
+        map_file: "Kalimdor".into(),
+        world_rect: (0.0, 0.0, 1.0, 1.0),
+        loc_rect: (10000.0, -10000.0, 10000.0, -10000.0),
+        zone_grid: Vec::new(),
+        zones: vec![WorldMapZoneView {
+            name: "Warsong Gulch".into(),
+            area_id: 3277,
+            map_file: "WarsongGulch".into(),
+            loc_rect: (1000.0, 0.0, 1000.0, 0.0),
+            overlays: vec![
+                overlay("SilverwingHold", 300, 200, 100, 50, 1),
+                overlay("WarsongLumberMill", 256, 256, 400, 300, 2),
+            ],
+        }],
+    }]
+}
+
+/// Put the session in a battleground and press SHIFT-M.
+///
+/// The world-state push is the gate, not scenery: `BattlefieldMinimap_Toggle` shows nothing unless
+/// `MiniMapBattlefieldFrame.status == "active"` **or** `GetNumWorldStateUI() > 0`, which is the
+/// reference refusing to open a battle map outside a battle. The catalog + explored bitset put the
+/// displayed map on a zone that has revealed overlays, and `player_zone` is what the window's own
+/// `<OnShow>` `SetMapToCurrentZone()` lands on.
+fn open(s: &mut UiScript) {
+    s.set_world_map_catalog(catalog());
+    s.set_world_map_explored(vec![0b110; 64]);
+    s.set_world_map_feed(
+        Some((1, 1)),
+        Some((0.5, 0.5)),
+        0.0,
+        None,
+        Vec::new(),
+        Vec::new(),
+    );
+    s.set_world_state_ui(vec![WorldStateUiView {
+        ui_state: 1,
+        text: "Flags captured: 2".into(),
+        ..Default::default()
+    }]);
+    s.tick(0.0);
+    s.fire_event("UPDATE_WORLD_STATES", vec![]);
+    s.run("ToggleBattlefieldMinimap()").expect("SHIFT-M");
+    assert!(
+        s.eval::<bool>("return BattlefieldMinimap:IsShown()")
+            .unwrap(),
+        "the battle map is up"
+    );
+}
+
+/// The window's own per-frame update, driven the way its `<OnUpdate>` script runs it: `this` is
+/// the frame and the elapsed time its one argument.
+fn update(s: &mut UiScript, elapsed: f64) {
+    s.run(&format!(
+        "this = BattlefieldMinimap BattlefieldMinimap_OnUpdate({elapsed}) this = nil"
+    ))
+    .unwrap();
+}
+
+/// A frame's centre in the screen units the pointer speaks (its own layout centre × its effective
+/// scale) — what a hit test and a `mouse_move` want.
+fn screen_centre(s: &mut UiScript, frame: &str) -> (f32, f32) {
+    s.resolve();
+    let (x, y, eff) = s
+        .eval::<(f64, f64, f64)>(&format!(
+            "local a, b = {frame}:GetCenter() return a, b, {frame}:GetEffectiveScale()"
+        ))
+        .unwrap_or_else(|e| panic!("{frame}:GetCenter() — {e}"));
+    ((x * eff) as f32, (y * eff) as f32)
+}
+
+/// The mini arrow's screen centre. It is anonymous and it is the window's **last** child (its
+/// `Create…` runs in the `<OnLoad>`, after the XML's own forty-eight), so it is found by kind
+/// rather than by name or position.
+fn arrow_centre(s: &mut UiScript) -> (f32, f32) {
+    s.resolve();
+    let (x, y, eff) = s
+        .eval::<(f64, f64, f64)>(
+            r#"for _, c in ipairs({ BattlefieldMinimap:GetChildren() }) do
+                   if c:GetObjectType() == "Model" then
+                       local a, b = c:GetCenter()
+                       return a, b, c:GetEffectiveScale()
+                   end
+               end"#,
+        )
+        .expect("the battle map has a Model child");
+    ((x * eff) as f32, (y * eff) as f32)
+}
+
+fn shown(s: &UiScript, frame: &str) -> bool {
+    s.eval::<bool>(&format!("return {frame}:IsShown()"))
+        .unwrap_or_else(|e| panic!("{frame}:IsShown() — {e}"))
+}
+
+fn num(s: &UiScript, expr: &str) -> f64 {
+    s.eval::<f64>(&format!("return {expr}"))
+        .unwrap_or_else(|e| panic!("{expr} — {e}"))
+}
+
+/// **The addon loads on demand and every frame its XML declares materializes.**
+///
+/// Driven down the reference's own road — `ToggleBattlefieldMinimap()` is what SHIFT-M is bound
+/// to, and its first line is `BattlefieldMinimap_LoadUI()` → `UIParentLoadAddOn(...)` → the
+/// registry's `LoadAddOn`. Loading it any other way (running the `.xml` as a chain file, the way
+/// the auction and tradeskill suites load theirs) would skip the registry, `ADDON_LOADED` and its
+/// `arg1` filter — and the `ADDON_LOADED` arm is where the tab gets its seat, the dropdown gets
+/// initialized and the opacity gets applied, so it would skip most of the window's initial state
+/// too.
+///
+/// The gate is asserted in both directions first: the load happens either way, but a battle map
+/// opens only inside a battle.
+#[test]
+fn the_addon_loads_on_demand_through_uiparents_own_road() {
+    let _data = benilla_formats::wow_data_or_skip!();
+    let mut s = session();
+    assert_eq!(
+        s.eval::<Option<i64>>("return IsAddOnLoaded(\"Blizzard_BattlefieldMinimap\")")
+            .unwrap(),
+        None,
+        "nothing is loaded before the first toggle"
+    );
+
+    // Out of a battleground: the addon still loads — `BattlefieldMinimap_LoadUI()` runs
+    // unconditionally — and then `BattlefieldMinimap_Toggle`'s own gate declines to show it.
+    s.run("ToggleBattlefieldMinimap()").unwrap();
+    assert_eq!(
+        s.eval::<i64>("return IsAddOnLoaded(\"Blizzard_BattlefieldMinimap\")")
+            .unwrap(),
+        1,
+        "the demand load ran"
+    );
+    assert!(
+        !shown(&s, "BattlefieldMinimap"),
+        "…and a battle map does not open outside a battle: no active queue, no world-state rows"
+    );
+    assert_eq!(
+        s.eval::<String>("return SHOW_BATTLEFIELD_MINIMAP").unwrap(),
+        "0",
+        "the RegisterForSave global stays at WorldStateFrame.lua's own boot value"
+    );
+
+    // Every frame, region and font string the `.xml` declares, by name. The loop answers the FIRST
+    // missing one rather than a bare false, so a regression names itself.
+    let missing: Option<String> = s
+        .eval(
+            r#"
+            local names = {
+                "BattlefieldMinimap", "BattlefieldMinimapBackground", "BattlefieldMinimapCorner",
+                "BattlefieldMinimapCloseButton", "BattlefieldMinimapCorpse",
+                "BattlefieldMinimapTab", "BattlefieldMinimapTabLeft", "BattlefieldMinimapTabMiddle",
+                "BattlefieldMinimapTabRight", "BattlefieldMinimapTabFlash",
+                "BattlefieldMinimapTabText", "BattlefieldMinimapTabDropDown",
+            }
+            for i = 1, 12 do table.insert(names, "BattlefieldMinimap" .. i) end
+            for i = 1, 4 do table.insert(names, "BattlefieldMinimapParty" .. i) end
+            for i = 1, 40 do table.insert(names, "BattlefieldMinimapRaid" .. i) end
+            for i = 1, 2 do table.insert(names, "BattlefieldMinimapFlag" .. i) end
+            for _, n in ipairs(names) do
+                if not getglobal(n) then return n end
+            end
+            return nil
+            "#,
+        )
+        .unwrap();
+    assert_eq!(missing, None, "a declared frame never materialized");
+
+    // `BattlefieldMinimapRaidUnitTemplate`'s own OnLoad ran on each of the forty: the unit token
+    // from the frame's `id=`, and the party blip art on its `$parentIcon`.
+    assert_eq!(
+        s.eval::<String>("return BattlefieldMinimapRaid17.unit")
+            .unwrap(),
+        "raid17"
+    );
+    assert_eq!(
+        s.eval::<String>("return BattlefieldMinimapRaid17Icon:GetTexture()")
+            .unwrap(),
+        "Interface\\WorldMap\\WorldMapPartyIcon"
+    );
+
+    // The `ADDON_LOADED` arm: the saved-variable table came up on `BattlefieldMinimapDefaults`…
+    assert_eq!(
+        s.eval::<(f64, bool, bool)>(
+            "return BattlefieldMinimapOptions.opacity, BattlefieldMinimapOptions.locked, \
+             BattlefieldMinimapOptions.showPlayers"
+        )
+        .unwrap(),
+        (0.7, true, true)
+    );
+    // …the tab took its default seat (no saved position → the `-225-CONTAINER_OFFSET_X` corner,
+    // whose two constants are ContainerFrame.lua's and UIParent.lua's)…
+    let (point, relative, rel_point, x, y) = s
+        .eval::<(String, String, String, f64, f64)>(
+            "local p, r, rp, ox, oy = BattlefieldMinimapTab:GetPoint(1) \
+             return p, r:GetName(), rp, ox, oy",
+        )
+        .unwrap();
+    assert_eq!(
+        (point.as_str(), relative.as_str(), rel_point.as_str()),
+        ("BOTTOMLEFT", "UIParent", "BOTTOMRIGHT")
+    );
+    assert_eq!(
+        (x, y),
+        (
+            -225.0 - num(&s, "CONTAINER_OFFSET_X"),
+            num(&s, "BATTLEFIELD_TAB_OFFSET_Y")
+        )
+    );
+    // …and `BattlefieldMinimap_SetOpacity()` ran off the seeded slider value, so the window is
+    // already wearing the default 0.7 opacity (its alpha is `1 - value`) before it is ever shown.
+    assert!(
+        (num(&s, "BattlefieldMinimapBackground:GetAlpha()") - 0.3).abs() < 1e-6,
+        "the load-time opacity pass reached the border texture"
+    );
+
+    // Now inside a battleground, the same toggle opens it.
+    open(&mut s);
+    assert_eq!(
+        s.eval::<String>("return SHOW_BATTLEFIELD_MINIMAP").unwrap(),
+        "1"
+    );
+    assert!(
+        shown(&s, "BattlefieldMinimapTab"),
+        "the tab comes up with it"
+    );
+    quiet(&s);
+}
+
+/// **The twelve map tiles and the overlay textures are cut from the map the engine is showing.**
+///
+/// Two loops, both reading host verbs the addon shares with the world map. The tiles are
+/// `GetMapInfo()`'s art folder repeated `NUM_WORLDMAP_DETAIL_TILES` times; the overlays are
+/// `GetNumMapOverlays()` / `GetMapOverlayInfo(i)` sliced into 256-px tiles, each scaled by the
+/// window's own `BattlefieldMinimap1:GetWidth()/256` — a **56/256 = 0.21875** shrink, which is the
+/// whole reason this window's overlay geometry is not the world map's and has to be checked
+/// separately.
+///
+/// Every number below is that arithmetic done by hand from [`catalog`]'s two overlays, so the test
+/// fails on a wrong scale, a wrong remainder, a dropped power-of-two round-up or a sign flip in
+/// the y offset — not merely on "something was drawn".
+#[test]
+fn the_overlay_textures_are_cut_from_the_revealed_overlays() {
+    let _data = benilla_formats::wow_data_or_skip!();
+    let mut s = session();
+    open(&mut s);
+
+    // The window's `<OnShow>` already ran `SetMapToCurrentZone()` and `BattlefieldMinimap_Update()`,
+    // so the displayed map is the player's zone and the tiles are laid.
+    assert_eq!(
+        s.eval::<String>("return GetMapInfo()").unwrap(),
+        "WarsongGulch"
+    );
+    for i in [1, 7, 12] {
+        assert_eq!(
+            s.eval::<String>(&format!("return BattlefieldMinimap{i}:GetTexture()"))
+                .unwrap(),
+            format!("Interface\\WorldMap\\WarsongGulch\\WarsongGulch{i}"),
+            "detail tile {i}"
+        );
+    }
+
+    assert_eq!(s.eval::<i64>("return GetNumMapOverlays()").unwrap(), 2);
+    assert_eq!(
+        s.eval::<i64>("return NUM_BATTLEFIELDMAP_OVERLAYS").unwrap(),
+        3,
+        "2 + 1 tiles: the 300×200 overlay needs two, the 256×256 one needs one"
+    );
+
+    // The reference reads back `(ULx, ULy, LLx, LLy, URx, URy, LRx, LRy)` since 1840; the old
+    // `(left, right, top, bottom)` rect is positions 1, 5, 2, 4.
+    let tex_rect = |s: &UiScript, n: u32| -> (f64, f64, f64, f64) {
+        let (l, t, _, b, r, ..): (f64, f64, f64, f64, f64, f64, f64, f64) = s
+            .eval(&format!(
+                "return BattlefieldMinimapOverlay{n}:GetTexCoord()"
+            ))
+            .unwrap();
+        (l, r, t, b)
+    };
+    let seat = |s: &UiScript, n: u32| -> (String, String, f64, f64) {
+        s.eval(&format!(
+            "local p, r, rp, x, y = BattlefieldMinimapOverlay{n}:GetPoint(1) return p, rp, x, y"
+        ))
+        .unwrap()
+    };
+    const SCALE: f64 = 56.0 / 256.0;
+
+    // Tile 1 of SilverwingHold: a full 256-px column, 200 px tall in a 256-px file, at the
+    // overlay's own (100, 50) offset — x right, y DOWN, both through the shrink.
+    assert_eq!(
+        s.eval::<String>("return BattlefieldMinimapOverlay1:GetTexture()")
+            .unwrap(),
+        "Interface\\WorldMap\\WarsongGulch\\SilverwingHold1"
+    );
+    assert_eq!(
+        (
+            num(&s, "BattlefieldMinimapOverlay1:GetWidth()"),
+            num(&s, "BattlefieldMinimapOverlay1:GetHeight()")
+        ),
+        (256.0 * SCALE, 200.0 * SCALE)
+    );
+    assert_eq!(tex_rect(&s, 1), (0.0, 1.0, 0.0, 200.0 / 256.0));
+    assert_eq!(
+        seat(&s, 1),
+        (
+            "TOPLEFT".into(),
+            "TOPLEFT".into(),
+            100.0 * SCALE,
+            -(50.0 * SCALE)
+        )
+    );
+
+    // Tile 2: the remainder column — 44 px of art in the 64-px power-of-two file the client rounds
+    // up to, seated exactly one full tile (256 × scale) to the right of tile 1.
+    assert_eq!(
+        s.eval::<String>("return BattlefieldMinimapOverlay2:GetTexture()")
+            .unwrap(),
+        "Interface\\WorldMap\\WarsongGulch\\SilverwingHold2"
+    );
+    assert_eq!(
+        num(&s, "BattlefieldMinimapOverlay2:GetWidth()"),
+        44.0 * SCALE
+    );
+    assert_eq!(tex_rect(&s, 2), (0.0, 44.0 / 64.0, 0.0, 200.0 / 256.0));
+    assert_eq!(
+        seat(&s, 2),
+        (
+            "TOPLEFT".into(),
+            "TOPLEFT".into(),
+            (100.0 + 256.0) * SCALE,
+            -(50.0 * SCALE)
+        )
+    );
+
+    // Tile 3 is the second overlay's only tile: exactly 256×256, the case where both `mod`s are
+    // zero and the reference's `== 0 then 256` guards are load-bearing — a missing guard would
+    // give this a zero-width, zero-height, `0..0` cropped tile.
+    assert_eq!(
+        s.eval::<String>("return BattlefieldMinimapOverlay3:GetTexture()")
+            .unwrap(),
+        "Interface\\WorldMap\\WarsongGulch\\WarsongLumberMill1"
+    );
+    assert_eq!(
+        (
+            num(&s, "BattlefieldMinimapOverlay3:GetWidth()"),
+            num(&s, "BattlefieldMinimapOverlay3:GetHeight()")
+        ),
+        (56.0, 56.0)
+    );
+    assert_eq!(tex_rect(&s, 3), (0.0, 1.0, 0.0, 1.0));
+    for n in 1..=3 {
+        assert!(
+            shown(&s, &format!("BattlefieldMinimapOverlay{n}")),
+            "overlay tile {n} is lit"
+        );
+    }
+
+    // Un-explore the lumber mill: the host stops returning that overlay, the repaint lights two
+    // tiles and PARKS the third — the pool never shrinks, exactly as the world map's does not.
+    s.set_world_map_explored(vec![0b010; 64]);
+    s.tick(0.0); // the push queues WORLD_MAP_UPDATE, the addon's own repaint event
+    assert_eq!(s.eval::<i64>("return GetNumMapOverlays()").unwrap(), 1);
+    assert!(shown(&s, "BattlefieldMinimapOverlay1") && shown(&s, "BattlefieldMinimapOverlay2"));
+    assert!(
+        !shown(&s, "BattlefieldMinimapOverlay3"),
+        "the tail parks hidden rather than being destroyed"
+    );
+    assert_eq!(
+        s.eval::<i64>("return NUM_BATTLEFIELDMAP_OVERLAYS").unwrap(),
+        3,
+        "…and the pool keeps its high-water mark"
+    );
+    quiet(&s);
+}
+
+/// **The POI layer** — `GetNumMapLandmarks` / `GetMapLandmarkInfo` → `BattlefieldMinimap_CreatePOI`
+/// → `WorldMap_GetPOITextureCoords`, the same three verbs the world map's own pool walks, but
+/// seated against the 225×150 battle map and sized by `GetBattlefieldMapIconScale()` rather than
+/// left at the flat 12 px the world map uses.
+///
+/// That scale is the point of the second half: the reference multiplies `DEFAULT_POI_ICON_SIZE` by
+/// it on every repaint, so a battleground whose `MinimapIconScale` is not 1 draws bigger icons on
+/// the battle map and identical ones on the world map.
+#[test]
+fn the_poi_pool_grows_from_the_landmarks_and_parks_its_tail() {
+    let _data = benilla_formats::wow_data_or_skip!();
+    let mut s = session();
+    open(&mut s);
+    assert_eq!(s.eval::<i64>("return NUM_BATTLEFIELDMAP_POIS").unwrap(), 0);
+
+    let landmark = |name: &str, icon: u32, uv: (f32, f32)| WorldMapLandmarkView {
+        name: name.into(),
+        description: String::new(),
+        texture_index: icon,
+        uv,
+    };
+    // Icon 6 is `ICON_POI_REDFLAG`, icon 9 the second row's first cell — two different cells of
+    // the 8×8 `POIIcons` atlas, so a hard-coded crop cannot pass both.
+    s.set_world_map_landmarks(vec![
+        landmark("Silverwing Flag", 6, (0.25, 0.5)),
+        landmark("Warsong Flag", 9, (0.75, 0.25)),
+    ]);
+    s.tick(0.0);
+
+    assert_eq!(s.eval::<i64>("return NUM_BATTLEFIELDMAP_POIS").unwrap(), 2);
+    assert!(shown(&s, "BattlefieldMinimapPOI1") && shown(&s, "BattlefieldMinimapPOI2"));
+    // Cell 6 = column 6, row 0; cell 9 = column 1, row 1. `coordIncrement` is 16/128 = 0.125.
+    let cell = |s: &UiScript, n: u32| -> (f64, f64) {
+        let (l, t, ..): (f64, f64, f64, f64, f64, f64, f64, f64) = s
+            .eval(&format!(
+                "return BattlefieldMinimapPOI{n}Texture:GetTexCoord()"
+            ))
+            .unwrap();
+        (l, t)
+    };
+    assert_eq!(cell(&s, 1), (0.75, 0.0));
+    assert_eq!(cell(&s, 2), (0.125, 0.125));
+    // Seated CENTER against the window's TOPLEFT, x × its width and y × MINUS its height — v runs
+    // down the sheet where frame y runs up, and the sign is what mirrors every icon if it is wrong.
+    assert_eq!(
+        s.eval::<(String, String, String, f64, f64)>(
+            "local p, r, rp, x, y = BattlefieldMinimapPOI1:GetPoint(1) return p, r:GetName(), rp, x, y"
+        )
+        .unwrap(),
+        (
+            "CENTER".into(),
+            "BattlefieldMinimap".into(),
+            "TOPLEFT".into(),
+            0.25 * 225.0,
+            -0.5 * 150.0
+        )
+    );
+    // The default scale leaves the icon at `DEFAULT_POI_ICON_SIZE`.
+    assert_eq!(num(&s, "BattlefieldMinimapPOI1:GetWidth()"), 12.0);
+
+    // A battleground whose map row carries a bigger `MinimapIconScale` grows every icon by it.
+    s.set_battlefield_positions(Vec::new(), None, 1.5);
+    s.run("BattlefieldMinimap_Update()").unwrap();
+    assert_eq!(
+        (
+            num(&s, "BattlefieldMinimapPOI1:GetWidth()"),
+            num(&s, "BattlefieldMinimapPOI1:GetHeight()")
+        ),
+        (18.0, 18.0),
+        "DEFAULT_POI_ICON_SIZE × GetBattlefieldMapIconScale()"
+    );
+
+    // One landmark left: the pool keeps both frames, re-seats the first and parks the second.
+    s.set_world_map_landmarks(vec![landmark("Warsong Flag", 9, (0.75, 0.25))]);
+    s.tick(0.0);
+    assert_eq!(
+        s.eval::<i64>("return NUM_BATTLEFIELDMAP_POIS").unwrap(),
+        2,
+        "the pool never shrinks"
+    );
+    assert!(shown(&s, "BattlefieldMinimapPOI1"));
+    assert_eq!(
+        cell(&s, 1),
+        (0.125, 0.125),
+        "slot 1 was re-seated on the surviving landmark, not left on the stale one"
+    );
+    assert!(!shown(&s, "BattlefieldMinimapPOI2"), "slot 2 parked hidden");
+    quiet(&s);
+}
+
+/// **The battleground blips** — the four position verbs the window polls every frame, plus the
+/// party slots it shares with the world map, driven through the real `<OnUpdate>`.
+///
+/// The team-member loop is the subtle one: with no raid up, `playerCount` stays 0, so
+/// `BattlefieldMinimapRaid<i>` takes `GetBattlefieldPosition(i)` — the raid frames double as the
+/// battleground roster. The `(0, 0)` pair is the hide sentinel on every one of these verbs, and
+/// the name each row carries is what the blip's tooltip shows for a teammate who is in neither
+/// your party nor your raid.
+#[test]
+fn the_battleground_blips_and_the_flag_follow_the_position_family() {
+    let _data = benilla_formats::wow_data_or_skip!();
+    let mut s = session();
+    open(&mut s);
+
+    s.set_battlefield_positions(
+        vec![
+            BattlefieldPositionView {
+                uv: (0.25, 0.75),
+                name: Some("Alliedguy".into()),
+            },
+            BattlefieldPositionView {
+                uv: (0.0, 0.0),
+                name: None,
+            },
+        ],
+        Some(BattlefieldFlagView {
+            uv: (0.4, 0.6),
+            token: Some("HordeFlag".into()),
+        }),
+        1.0,
+    );
+    s.set_world_map_feed(
+        Some((1, 1)),
+        Some((0.5, 0.25)),
+        0.0,
+        None,
+        vec![Some((0.1, 0.2)), None],
+        Vec::new(),
+    );
+    update(&mut s, 0.1);
+
+    assert!(
+        shown(&s, "BattlefieldMinimapRaid1"),
+        "the placed teammate shows"
+    );
+    assert_eq!(
+        s.eval::<String>("return BattlefieldMinimapRaid1.name")
+            .unwrap(),
+        "Alliedguy",
+        "…carrying the name the tooltip reads for a non-group teammate"
+    );
+    assert_eq!(
+        s.eval::<(String, String, f64, f64)>(
+            "local p, r, rp, x, y = BattlefieldMinimapRaid1:GetPoint(1) return p, rp, x, y"
+        )
+        .unwrap(),
+        (
+            "CENTER".into(),
+            "TOPLEFT".into(),
+            0.25 * 225.0,
+            -0.75 * 150.0
+        )
+    );
+    assert!(
+        !shown(&s, "BattlefieldMinimapRaid2"),
+        "the (0,0) teammate hides"
+    );
+    assert!(
+        !shown(&s, "BattlefieldMinimapRaid40"),
+        "…and so does every slot past the roster"
+    );
+
+    // The party arm reads `GetPlayerMapPosition("party"..i)`, the world map's own feed.
+    assert!(shown(&s, "BattlefieldMinimapParty1"));
+    assert_eq!(
+        s.eval::<(f64, f64)>(
+            "local _, _, _, x, y = BattlefieldMinimapParty1:GetPoint(1) return x, y"
+        )
+        .unwrap(),
+        (0.1 * 225.0, -0.2 * 150.0)
+    );
+    assert!(
+        !shown(&s, "BattlefieldMinimapParty2"),
+        "a slot with no position hides"
+    );
+
+    // The carrier takes flag frame 1, wearing the token's own art; the second frame stays parked.
+    assert!(shown(&s, "BattlefieldMinimapFlag1"));
+    assert_eq!(
+        s.eval::<String>("return BattlefieldMinimapFlag1Texture:GetTexture()")
+            .unwrap(),
+        "Interface\\WorldStateFrame\\HordeFlag"
+    );
+    assert!(!shown(&s, "BattlefieldMinimapFlag2"));
+
+    // Hovering a teammate's blip names them — `BattlefieldMinimapUnit_OnEnter` prefers the row's
+    // own `name` over `UnitName(unit)`, which is the only way a non-group teammate gets a label.
+    let (bx, by) = screen_centre(&mut s, "BattlefieldMinimapRaid1");
+    assert_eq!(
+        s.hit_test_name(bx, by).as_deref(),
+        Some("BattlefieldMinimapRaid1"),
+        "the blip is what the cursor is over"
+    );
+    s.mouse_move(bx, by);
+    assert!(s.eval::<bool>("return GameTooltip:IsShown()").unwrap());
+    assert_eq!(
+        s.eval::<String>("return GameTooltipTextLeft1:GetText()")
+            .unwrap(),
+        "Alliedguy"
+    );
+    s.mouse_move(5.0, 5.0);
+
+    // The dropdown's "Show Teammates" off: the party and raid blips go in one pass, before any of
+    // the position verbs are consulted — and **the flag carrier stays**. That asymmetry is the
+    // reference's own: `Blizzard_BattlefieldMinimap.lua:245-252`'s `not showPlayers` arm hides
+    // `BattlefieldMinimapParty1..4` and `BattlefieldMinimapRaid1..40` and nothing else, so the two
+    // flag frames simply keep whatever the last showPlayers-on pass left on them. Pinned in both
+    // directions on purpose: "hide everything" is the obvious tidy-up and it is not what 1.12 does.
+    s.run("BattlefieldMinimapOptions.showPlayers = false")
+        .unwrap();
+    update(&mut s, 0.1);
+    for f in ["BattlefieldMinimapRaid1", "BattlefieldMinimapParty1"] {
+        assert!(!shown(&s, f), "{f} hides while teammates are switched off");
+    }
+    assert!(
+        shown(&s, "BattlefieldMinimapFlag1"),
+        "…but the carrier's flag is not in that arm's two loops, so it stays up"
+    );
+
+    // Back on, and then leaving the battleground — the empty push — hides them for real.
+    s.run("BattlefieldMinimapOptions.showPlayers = true")
+        .unwrap();
+    update(&mut s, 0.1);
+    assert!(shown(&s, "BattlefieldMinimapRaid1"));
+    s.set_battlefield_positions(Vec::new(), None, 1.0);
+    update(&mut s, 0.1);
+    assert!(
+        !shown(&s, "BattlefieldMinimapRaid1") && !shown(&s, "BattlefieldMinimapFlag1"),
+        "leaving the battleground takes the blips with it"
+    );
+    quiet(&s);
+}
+
+/// **The player arrow is the MINI singleton, not the world map's.**
+///
+/// The two are separate slots in the engine (`Arrow::World` / `Arrow::Mini`), each created once per
+/// session by its own `Create…` verb and never freed — so the failure this guards against is the
+/// addon's `CreateMiniWorldMapArrowFrame(BattlefieldMinimap)` being answered with the world map's
+/// existing arrow, which would leave the battle map with no arrow at all and yank the world map's
+/// across the screen on every `PositionMini…`.
+///
+/// Told apart by the one property that distinguishes them at the renderer: the mini's model scale
+/// is `G48 · 10/9` where the world map's is `G48 · 5/3` (`G48 = 1/√(aspect²+1)`, so at 4:3 that is
+/// 0.6667 against 1.0). The seat is cross-checked in Lua against the window's own TOPLEFT.
+#[test]
+fn the_player_arrow_is_the_minis_own_singleton_seated_by_the_update() {
+    let _data = benilla_formats::wow_data_or_skip!();
+    let mut s = session();
+    arrow_facts(&mut s);
+    open(&mut s);
+
+    // `BattlefieldMinimap_OnLoad` made it: an anonymous `Model` child of the window.
+    assert_eq!(
+        s.eval::<i64>(
+            r#"local n = 0
+               for _, c in ipairs({ BattlefieldMinimap:GetChildren() }) do
+                   if c:GetObjectType() == "Model" then n = n + 1 end
+               end
+               return n"#
+        )
+        .unwrap(),
+        1,
+        "exactly one arrow pane, parented to the battle map"
+    );
+
+    s.set_world_map_feed(
+        Some((1, 1)),
+        Some((0.25, 0.75)),
+        1.25,
+        None,
+        Vec::new(),
+        Vec::new(),
+    );
+    update(&mut s, 0.1);
+
+    // The seat, read back in Lua — the arrow is anonymous, so it is found among the children by
+    // kind. Same CENTER-on-TOPLEFT law as every blip.
+    let seat = s
+        .eval::<(bool, String, String, f64, f64)>(
+            r#"for _, c in ipairs({ BattlefieldMinimap:GetChildren() }) do
+                   if c:GetObjectType() == "Model" then
+                       local p, r, rp, x, y = c:GetPoint(1)
+                       return c:IsShown(), p, rp, x, y
+                   end
+               end"#,
+        )
+        .unwrap();
+    assert_eq!(
+        seat,
+        (
+            true,
+            "CENTER".into(),
+            "TOPLEFT".into(),
+            0.25 * 225.0,
+            -0.75 * 150.0
+        )
+    );
+
+    // The renderer's side: the arrow model, turned to the player's facing by
+    // `UpdateWorldMapArrowFrames`, at the MINI's own model scale, on a rect centred where Lua says.
+    let (cx, cy) = arrow_centre(&mut s);
+    let pane = s
+        .extract()
+        .into_iter()
+        .find(|q| {
+            matches!(&q.content, QuadContent::ModelPane { model: Some(m), .. } if m == ARROW_MODEL)
+                && q.rect.is_some_and(|r| {
+                    ((r.left + r.right) / 2.0 - cx).abs() < 0.5
+                        && ((r.top + r.bottom) / 2.0 - cy).abs() < 0.5
+                })
+        })
+        .expect("the battle map's arrow pane is in the render list");
+    let QuadContent::ModelPane {
+        facing,
+        model_scale,
+        ..
+    } = pane.content
+    else {
+        unreachable!()
+    };
+    assert!(
+        (facing - 1.25).abs() < 1e-6,
+        "turned to the player's facing, got {facing}"
+    );
+    assert!(
+        (model_scale - 10.0 / 9.0 * 0.6).abs() < 1e-4,
+        "the MINI arrow's own `G48 · 10/9` scale — the world map's would be 1.0 here, got \
+         {model_scale}"
+    );
+
+    // Off the displayed map: the `(0, 0)` sentinel routes through `ShowMiniWorldMapArrowFrame(nil)`
+    // and the pane leaves the render list entirely.
+    s.set_world_map_feed(Some((1, 1)), None, 0.0, None, Vec::new(), Vec::new());
+    update(&mut s, 0.1);
+    s.resolve();
+    assert!(
+        !s.extract().into_iter().any(|q| matches!(
+            &q.content,
+            QuadContent::ModelPane { model: Some(m), .. } if m == ARROW_MODEL
+        ) && q.rect.is_some()),
+        "off-map hides the arrow"
+    );
+    quiet(&s);
+}
+
+/// **The tab** — the strip of chat-frame art the window hangs from: it comes and goes with the
+/// window, fades in under the cursor on the reference's own three-frame ramp, and refuses to be
+/// dragged while the options say the map is locked.
+///
+/// The hover ramp is worth spelling out because it looks like a bug and is not. Frame 1 takes the
+/// `else` arm and only *starts* hovering (it stores the cursor into the globals `CURSOR_OLD_X/Y`
+/// and never into `BattlefieldMinimap.oldX/oldy` — the reference's own slip). Frame 2 therefore
+/// compares a nil `oldX` against the cursor, misses, and resets `hoverTime` to 0 while finally
+/// recording the position. Only frame 3 can accumulate, so the `BATTLEFIELD_TAB_SHOW_DELAY` clock
+/// does not start until the third update after the cursor arrives. A "fix" that fades on frame 2
+/// goes red here, which is the point.
+#[test]
+fn the_tab_follows_the_window_fades_in_on_hover_and_gates_its_drag_on_the_lock() {
+    let _data = benilla_formats::wow_data_or_skip!();
+    let mut s = session();
+    open(&mut s);
+
+    assert_eq!(
+        s.eval::<String>("return BattlefieldMinimapTabText:GetText()")
+            .unwrap(),
+        "Battle Map",
+        "the tab wears BATTLEFIELD_MINIMAP, resized by PanelTemplates_TabResize in the OnShow"
+    );
+    assert_eq!(
+        num(&s, "BattlefieldMinimapTab:GetAlpha()"),
+        0.0,
+        "…and starts invisible: the OnLoad's own SetAlpha(0)"
+    );
+
+    // The hover ramp.
+    let (mx, my) = screen_centre(&mut s, "BattlefieldMinimap");
+    s.mouse_move(mx, my);
+    update(&mut s, 0.3);
+    assert_eq!(
+        s.eval::<(Option<i64>, f64, Option<f64>)>(
+            "return BattlefieldMinimap.hover, BattlefieldMinimap.hoverTime, BattlefieldMinimap.oldX"
+        )
+        .unwrap(),
+        (Some(1), 0.0, None),
+        "frame 1 only starts hovering — and leaves oldX nil, the reference's own slip"
+    );
+    update(&mut s, 0.3);
+    assert_eq!(
+        num(&s, "BattlefieldMinimap.hoverTime"),
+        0.0,
+        "frame 2 misses the nil oldX and RESTARTS the clock"
+    );
+    update(&mut s, 0.3);
+    assert_eq!(
+        s.eval::<(f64, Option<i64>)>(
+            "return BattlefieldMinimap.hoverTime, BattlefieldMinimap.hasBeenFaded"
+        )
+        .unwrap(),
+        (0.3, Some(1)),
+        "frame 3 finally crosses BATTLEFIELD_TAB_SHOW_DELAY and starts the fade"
+    );
+    // `UIFrameFadeIn` runs on the fade manager's own update, from 0 to DEFAULT_BATTLEFIELD_TAB_ALPHA
+    // over BATTLEFIELD_TAB_FADE_TIME.
+    s.tick(0.05);
+    let part_way = num(&s, "BattlefieldMinimapTab:GetAlpha()");
+    assert!(
+        part_way > 0.0 && part_way < 0.75,
+        "part way through the 0.15 s fade, got {part_way}"
+    );
+    s.tick(0.2);
+    assert_eq!(num(&s, "BattlefieldMinimapTab:GetAlpha()"), 0.75);
+
+    // The cursor leaves: the else arm fades it back to the alpha it was remembered at.
+    s.mouse_move(5.0, 5.0);
+    update(&mut s, 0.1);
+    assert_eq!(
+        s.eval::<Option<i64>>("return BattlefieldMinimap.hover")
+            .unwrap(),
+        None,
+        "the hover state is cleared on the way out"
+    );
+    s.tick(0.2);
+    assert_eq!(num(&s, "BattlefieldMinimapTab:GetAlpha()"), 0.0);
+
+    // The lock. A left click on a locked tab returns before `StartMoving`, and `StartMoving` is
+    // what stamps the userPlaced bit (2193), so the bit is the observable in both directions.
+    assert!(!s
+        .eval::<bool>("return BattlefieldMinimapTab:IsUserPlaced()")
+        .unwrap());
+    s.run("BattlefieldMinimapTab:Click(\"LeftButton\")")
+        .unwrap();
+    assert!(
+        !s.eval::<bool>("return BattlefieldMinimapTab:IsUserPlaced()")
+            .unwrap(),
+        "a locked tab does not start a drag"
+    );
+    s.run("BattlefieldMinimapOptions.locked = false BattlefieldMinimapTab:Click(\"LeftButton\")")
+        .unwrap();
+    assert!(
+        s.eval::<bool>("return BattlefieldMinimapTab:IsUserPlaced()")
+            .unwrap(),
+        "unlocked, the same click starts one"
+    );
+    s.run("BattlefieldMinimapTab:StopMovingOrSizing()").unwrap();
+
+    // `PLAYER_LOGOUT` writes a user-placed tab's centre into the saved table and hands the seat
+    // back to the file's own anchor; a tab nobody moved clears the row instead.
+    s.resolve();
+    let centre = s
+        .eval::<(f64, f64)>("return BattlefieldMinimapTab:GetCenter()")
+        .unwrap();
+    s.fire_event("PLAYER_LOGOUT", vec![]);
+    assert_eq!(
+        s.eval::<(f64, f64)>(
+            "return BattlefieldMinimapOptions.position.x, BattlefieldMinimapOptions.position.y"
+        )
+        .unwrap(),
+        centre
+    );
+    assert!(
+        !s.eval::<bool>("return BattlefieldMinimapTab:IsUserPlaced()")
+            .unwrap(),
+        "…and the bit is handed back, so the row is what restores the seat next login"
+    );
+    s.fire_event("PLAYER_LOGOUT", vec![]);
+    assert_eq!(
+        s.eval::<Option<i64>>("return BattlefieldMinimapOptions.position ~= nil and 1 or nil")
+            .unwrap(),
+        None,
+        "a tab nobody placed clears the saved row"
+    );
+
+    // The second toggle closes it, and the tab goes with it through the window's own OnHide.
+    s.run("ToggleBattlefieldMinimap()").unwrap();
+    assert!(!shown(&s, "BattlefieldMinimap") && !shown(&s, "BattlefieldMinimapTab"));
+    assert_eq!(
+        s.eval::<String>("return SHOW_BATTLEFIELD_MINIMAP").unwrap(),
+        "0"
+    );
+
+    // And leaving the battleground closes it on the client's own event, not on a toggle: the
+    // `PLAYER_ENTERING_WORLD` arm hides a battle map with no battle behind it.
+    s.run("ToggleBattlefieldMinimap()").unwrap();
+    assert!(shown(&s, "BattlefieldMinimap"));
+    s.set_world_state_ui(Vec::new());
+    s.tick(0.0);
+    s.fire_event("PLAYER_ENTERING_WORLD", vec![]);
+    assert!(
+        !shown(&s, "BattlefieldMinimap"),
+        "no world-state rows and no active queue: the window hides itself"
+    );
+    quiet(&s);
+}
+
+/// **The tab's right-click menu and the opacity slider it opens** — the window's whole options
+/// surface, and the only place `BattlefieldMinimapOptions` is written by a player.
+///
+/// Worth stating what this path does **not** touch, because it is easy to assume otherwise:
+/// `BattlefieldMinimap_SetOpacity` reads no CVar. Its input is `OpacityFrameSlider:GetValue()` —
+/// ColorPickerFrame.xml's shared vertical slider, which the addon borrows by pointing
+/// `OpacityFrame.opacityFunc` at itself — and what persists is the addon's own
+/// `SavedVariablesPerCharacter` table plus WorldStateFrame.lua's `RegisterForSave` global
+/// `SHOW_BATTLEFIELD_MINIMAP`. There is no battle-map opacity CVar in 1.12 to register or to give
+/// a reference default to, so 1804's rule does not reach this window.
+///
+/// The alpha formula has two tiers and both are pinned: the border and the twelve detail tiles get
+/// `1 - value`, while the overlays, the close button and the corner get a further 0.15 off it
+/// (and, below 0.15, nothing off at all) — so a regression that applies one tier everywhere shows
+/// up as the map art and its explored overlays being the same brightness.
+#[test]
+fn the_dropdown_and_the_opacity_slider_drive_the_saved_options() {
+    let _data = benilla_formats::wow_data_or_skip!();
+    let mut s = session();
+    open(&mut s);
+
+    // A real right-click on the tab — `RegisterForClicks` admits `RightButtonUp`, and the handler's
+    // first arm opens the menu on the tab's own anchor.
+    s.run("BattlefieldMinimapTab:Click(\"RightButton\")")
+        .unwrap();
+    assert!(shown(&s, "DropDownList1"), "the menu opened");
+    let row = |s: &UiScript, n: u32| -> (String, bool) {
+        (
+            s.eval(&format!("return DropDownList1Button{n}:GetText()"))
+                .unwrap(),
+            s.eval(&format!("return DropDownList1Button{n}Check:IsShown()"))
+                .unwrap(),
+        )
+    };
+    // Both toggles come up checked off `BattlefieldMinimapDefaults`; the opacity row is an action,
+    // so it carries no check.
+    assert_eq!(row(&s, 1), ("Show Teammates".into(), true));
+    assert_eq!(row(&s, 2), ("Lock Battle Map".into(), true));
+    assert_eq!(row(&s, 3), ("Change Opacity".into(), false));
+
+    s.run("DropDownList1Button1:Click()").unwrap();
+    assert!(
+        !s.eval::<bool>("return BattlefieldMinimapOptions.showPlayers")
+            .unwrap(),
+        "row 1 flips Show Teammates"
+    );
+    s.run("BattlefieldMinimapTab:Click(\"RightButton\")")
+        .unwrap();
+    assert_eq!(
+        row(&s, 1),
+        ("Show Teammates".into(), false),
+        "…and the menu re-initializes off the new value"
+    );
+    s.run("DropDownList1Button2:Click()").unwrap();
+    assert!(
+        !s.eval::<bool>("return BattlefieldMinimapOptions.locked")
+            .unwrap(),
+        "row 2 flips the lock"
+    );
+
+    // Row 3 borrows the shared opacity frame: re-anchored onto the battle map's left edge, with
+    // both of its hooks pointed at this window.
+    s.run("BattlefieldMinimapTab:Click(\"RightButton\")")
+        .unwrap();
+    s.run("DropDownList1Button3:Click()").unwrap();
+    assert!(shown(&s, "OpacityFrame"));
+    assert_eq!(
+        s.eval::<(String, String, String, f64, f64)>(
+            "local p, r, rp, x, y = OpacityFrame:GetPoint(1) return p, r:GetName(), rp, x, y"
+        )
+        .unwrap(),
+        (
+            "TOPRIGHT".into(),
+            "BattlefieldMinimap".into(),
+            "TOPLEFT".into(),
+            0.0,
+            7.0
+        )
+    );
+
+    // Dragging the slider repaints through `OpacityFrame.opacityFunc` — the slider's own
+    // `<OnValueChanged>` is the only caller, so this is the live path, not a direct call.
+    s.run("OpacityFrameSlider:SetValue(0.25)").unwrap();
+    let alpha = |s: &UiScript, f: &str| num(s, &format!("{f}:GetAlpha()"));
+    for f in [
+        "BattlefieldMinimapBackground",
+        "BattlefieldMinimap1",
+        "BattlefieldMinimap12",
+    ] {
+        assert!(
+            (alpha(&s, f) - 0.75).abs() < 1e-6,
+            "{f} takes the plain 1 - value"
+        );
+    }
+    for f in [
+        "BattlefieldMinimapOverlay1",
+        "BattlefieldMinimapCloseButton",
+        "BattlefieldMinimapCorner",
+    ] {
+        assert!(
+            (alpha(&s, f) - 0.6).abs() < 1e-6,
+            "{f} takes a further 0.15 off, got {}",
+            alpha(&s, f)
+        );
+    }
+    // At the bottom of the second tier the subtraction stops rather than going negative.
+    s.run("OpacityFrameSlider:SetValue(0.9)").unwrap();
+    assert!((alpha(&s, "BattlefieldMinimapBackground") - 0.1).abs() < 1e-6);
+    assert!(
+        (alpha(&s, "BattlefieldMinimapOverlay1") - 0.1).abs() < 1e-6,
+        "under 0.15 the overlays keep the plain alpha"
+    );
+
+    // Dismissing the frame runs `saveOpacityFunc`, which is what puts the value in the saved table.
+    s.run("OpacityFrameCloseButton:Click()").unwrap();
+    assert!(!shown(&s, "OpacityFrame"));
+    assert!(
+        (num(&s, "BattlefieldMinimapOptions.opacity") - 0.9).abs() < 1e-6,
+        "the close saved the slider's value for next login"
+    );
+    quiet(&s);
+}
diff --git a/crates/benilla-app/src/ui_script/buff_tests.rs b/crates/benilla-app/src/ui_script/buff_tests.rs
index afe1d717..e424ec60 100644
--- a/crates/benilla-app/src/ui_script/buff_tests.rs
+++ b/crates/benilla-app/src/ui_script/buff_tests.rs
@@ -69,7 +69,6 @@ fn harness() -> UiScript {
 
 /// Build an [`AuraState`] as the feed would push it. `expiration_time` 0 = permanent (no wire
 /// duration — the reference's "until cancelled"); the `GetTime()` clock starts at 0 in the harness.
-#[allow(clippy::too_many_arguments)]
 fn aura(
     spell_id: u32,
     name: &str,
diff --git a/crates/benilla-app/src/ui_script/cast_tests.rs b/crates/benilla-app/src/ui_script/cast_tests.rs
index 59ffa1db..b2c6c711 100644
--- a/crates/benilla-app/src/ui_script/cast_tests.rs
+++ b/crates/benilla-app/src/ui_script/cast_tests.rs
@@ -181,17 +181,32 @@ fn failed_cast_turns_red_holds_then_fades() {
 fn channel_counts_down_not_up() {
     let mut s = harness();
     // SPELLCAST_CHANNEL_START(ms, name) — args reversed vs START, per the reference contract.
+    // The name is whatever `ui_cast::channel_start_args` composed; for all but nine of the 323
+    // channeled rows that is the literal word, which is what the feed hands Starshards too.
     s.fire_event(
         "SPELLCAST_CHANNEL_START",
         vec![
             ScriptValue::Int(6000),
-            ScriptValue::Str("Starshards".into()),
+            ScriptValue::Str("Channeling".into()),
         ],
     );
     assert!(s.eval::<bool>("return CastingBarFrame:IsShown()").unwrap());
     assert_eq!(
         s.eval::<String>("return CastingBarText:GetText()").unwrap(),
-        "Starshards"
+        "Channeling"
+    );
+
+    // **In 1.12 the channel bar is ORANGE** — the same `SetStatusBarColor(1.0, 0.7, 0.0)` the cast
+    // bar takes (stock `CastingBarFrame.lua` l.76 vs l.21, byte-identical to the copy in the
+    // player's `patch.MPQ`); green is the COMPLETION flash and nothing else. A channel is told
+    // apart by draining instead of filling, and by its label. **Classic Era's channel bar IS
+    // green** (`CastingBarType.Channel`'s `classicFillColor = CASTBAR_CLASSIC_GREEN`) — a real
+    // behaviour of a different client, which is why this is a gate and not a comment: if we ever
+    // take Era's colour it is a deliberate deviation that has to come here first (decision 2284).
+    let (r, g, b) = bar_color(&s);
+    assert!(
+        (r - 1.0).abs() < 1e-6 && (g - 0.7).abs() < 1e-6 && b.abs() < 1e-6,
+        "a channel opens orange, exactly like a cast (got {r} {g} {b})"
     );
 
     let full = bar_value(&s);
@@ -226,6 +241,68 @@ fn channel_counts_down_not_up() {
     assert!(s.errors().is_empty(), "script errors: {:?}", s.errors());
 }
 
+/// **A completed channel closes on the BAR's own clock, because the server's stop runs a second
+/// late** — and that is the path every naturally-finished channel in the game takes.
+///
+/// vmangos does not send `MSG_CHANNEL_UPDATE(0)` when a channel simply runs out.
+/// `Spell::SendChannelUpdate(0, interrupted=false)` schedules a `ChannelResetEvent` **+1000 ms**
+/// ("Else, we have some visual bugs (arcane projectile, last tick)"), and only that event's
+/// `CancelSpellChannelingAnimationInstantly()` finally emits the packet. The *interrupt* path calls
+/// the same function inline, which is why a broken channel stops at once and a finished one does
+/// not.
+///
+/// So for a whole second after the fill empties there is no stop edge at all, and the stock
+/// `OnUpdate` is what ends it: once `GetTime()` reaches `endTime` it clamps, `time == this.endTime`
+/// trips, and the frame hands itself to `fadeOut` with **no green flash** — a finished channel
+/// fades, where a cast completes green. The late packet then lands on a hidden frame and both of
+/// `CastingBarFrame_OnEvent`'s stop-arm guards reject it.
+///
+/// Worth a test of its own because nothing else exercises it: the sibling test above fires
+/// `SPELLCAST_CHANNEL_STOP` by hand, which is the *interrupt* timing, not this one.
+#[test]
+fn a_finished_channel_fades_on_its_own_clock_and_the_late_stop_is_inert() {
+    let mut s = harness();
+    s.fire_event(
+        "SPELLCAST_CHANNEL_START",
+        vec![
+            ScriptValue::Int(1000),
+            ScriptValue::Str("Channeling".into()),
+        ],
+    );
+    assert!(s.eval::<bool>("return CastingBarFrame:IsShown()").unwrap());
+
+    // The whole second the channel runs: still up, still orange, no stop packet has been sent.
+    for _ in 0..9 {
+        s.tick(0.1);
+    }
+    assert!(
+        s.eval::<bool>("return CastingBarFrame:IsShown()").unwrap(),
+        "still channelling at 0.9 s of a 1 s channel"
+    );
+    let (r, g, b) = bar_color(&s);
+    assert!(
+        (r - 1.0).abs() < 1e-6 && (g - 0.7).abs() < 1e-6 && b.abs() < 1e-6,
+        "never flashes green — a finished channel fades, it does not complete (got {r} {g} {b})"
+    );
+
+    // Past endTime with nothing from the server: the frame ends itself.
+    for _ in 0..40 {
+        s.tick(0.1);
+    }
+    assert!(
+        !s.eval::<bool>("return CastingBarFrame:IsShown()").unwrap(),
+        "the bar closed on its own clock, a full second before the server says so"
+    );
+
+    // ~1 s after the fill emptied, the deferred ChannelResetEvent finally fires.
+    s.fire_event("SPELLCAST_CHANNEL_STOP", vec![]);
+    assert!(
+        !s.eval::<bool>("return CastingBarFrame:IsShown()").unwrap(),
+        "the late stop lands on a hidden frame and does nothing"
+    );
+    assert!(s.errors().is_empty(), "script errors: {:?}", s.errors());
+}
+
 // ── The draw list ────────────────────────────────────────────────────────────────────────────────
 
 const FLASH: &str = "UI-CastingBar-Flash";
diff --git a/crates/benilla-app/src/ui_script/extract/mod.rs b/crates/benilla-app/src/ui_script/extract/mod.rs
index b39e753b..72569ad2 100644
--- a/crates/benilla-app/src/ui_script/extract/mod.rs
+++ b/crates/benilla-app/src/ui_script/extract/mod.rs
@@ -387,7 +387,6 @@ fn splice_simple(eq: &benilla_ui::script::ExtractedQuad) -> bool {
 /// `booths.panes` is the one exception, because [`convert_entry`] writes it through the shared
 /// bridge; re-adding the same tokens is idempotent, so a verify run's panes end up where the full
 /// path would have put them anyway.
-#[allow(clippy::too_many_arguments)]
 fn verify_splice(
     prev: &GateInputs,
     quads: &UiQuads,
@@ -522,7 +521,6 @@ pub(crate) fn seat_text_measurer(script: &mut UiScript, atlas: &UiFontAtlas, sea
 /// p90 of 16 px of lag per frame at 640x360 while a guard walked (the `vpl` trace, 2026-09-10), and
 /// proportionally more at a real window. That is the director's "way more jittered when the
 /// creature is moving".
-#[allow(clippy::too_many_arguments)] // a Bevy system: each param is one resource, the app's convention
 pub(super) fn tick_script(
     script: Option<NonSendMut<UiScript>>,
     window: Query<&Window, With<PrimaryWindow>>,
@@ -776,7 +774,6 @@ pub(super) fn tick_script(
 /// walked after that camera exists. The re-resolve is what makes the plates' fresh anchors real —
 /// it is the layout ledger's incremental pass, so on a frame where nothing but the plates moved it
 /// solves the plates and nothing else.
-#[allow(clippy::too_many_arguments)] // a Bevy system: each param is one resource, the app's convention
 pub(super) fn paint_script(
     script: Option<NonSendMut<UiScript>>,
     window: Query<&Window, With<PrimaryWindow>>,
@@ -1381,7 +1378,6 @@ pub(super) fn paint_script(
 /// splice both call this, which is what makes the splice's output equal the full path's by
 /// construction. An arm is splice-eligible only if it writes nothing but `out` — keep
 /// [`splice_simple`] in agreement when an arm's side effects change.
-#[allow(clippy::too_many_arguments)] // the conversion's whole environment, threaded explicitly
 fn convert_entry(
     eq: benilla_ui::script::ExtractedQuad,
     s: f32,
diff --git a/crates/benilla-app/src/ui_script/frame_flag_gate.rs b/crates/benilla-app/src/ui_script/frame_flag_gate.rs
index 8289b15d..17f64443 100644
--- a/crates/benilla-app/src/ui_script/frame_flag_gate.rs
+++ b/crates/benilla-app/src/ui_script/frame_flag_gate.rs
@@ -436,8 +436,13 @@ fn describe(frame: &str, flag: Flag, ours: &str, theirs: &str) -> String {
 /// `parent="UIParent"` back on `BlackoutWorld` and it names that.
 #[test]
 fn the_shipped_frames_carry_the_references_flags() {
+    // Two gates, because the corpus and the manifest are two assets: the extracted reference
+    // dir below, and the chain `load_default_ui` reads — under `WOW_DATA=` (1451) the first is
+    // still there and the second is not.
+    let _data = benilla_formats::wow_data_or_skip!();
     let Some(reference) = reference_frames() else {
-        return; // no install — the same skip every client-data test here takes
+        eprintln!("skipping: no extracted reference FrameXML (WoW/_extracted_framexml)");
+        return;
     };
     let nesting = reference_nesting().expect("the same corpus the frames came from");
     assert!(
diff --git a/crates/benilla-app/src/ui_script/lifecycle.rs b/crates/benilla-app/src/ui_script/lifecycle.rs
index aca510e3..88a5b5af 100644
--- a/crates/benilla-app/src/ui_script/lifecycle.rs
+++ b/crates/benilla-app/src/ui_script/lifecycle.rs
@@ -46,7 +46,7 @@ pub(crate) fn setup_script(world: &mut World) {
 /// down at `0x490c97`). Because [`end_ui_session`] routes every login through here, every session's
 /// VM gets the registry and every `inherits="GameFontNormal"` in FrameXML resolves. A design that
 /// dropped the VM and skipped index 0 on the in-game load would fail exactly there — verified in
-/// wow-re's §5 for this change (1291).
+/// wow-re's §5 for this change (2277).
 fn install_boot_vm(world: &mut World) {
     let mut script = match UiScript::new() {
         Ok(s) => s,
@@ -238,7 +238,7 @@ pub(crate) fn arm_entry_ui_load(world: &mut World) {
 /// phase can write CVars — the character screen's AddOns panel is the live case, a *Load out of
 /// date AddOns* click — and `sync_cvars` (1291) registers them onto whichever VM is in the world,
 /// so this is the last moment that table exists. Folded into the persist state, the
-/// `set_cvar_saved_base` + `register_cvars` pair in the load below starts the new VM at the
+/// `set_cvar_saved_base` + `seed_cvars` pair in the load below starts the new VM at the
 /// player's value. That is exactly the route `/reload` has always taken through
 /// [`end_ui_session`]; 2226 makes the first login take it too.
 ///
@@ -483,15 +483,19 @@ pub(crate) fn load_ingame_ui_on_world_entry(world: &mut World) {
     // gets a turn — so this edge would load a client with no CVar table at all. Nothing had ever
     // noticed, because until now no interface file read a CVar at load.
     //
-    // The two lines are `sync_cvars`'s own first two, in its own order, and the order is
-    // load-bearing: the saved config goes in FIRST so registration starts each key at the player's
-    // value rather than the factory one (1291) — reversed, a reload would quietly reset every
-    // knobless CVar to its default. `sync_cvars` still does its full knob-derived pass on the next
-    // `Update`; both calls are idempotent, and a re-register never clobbers a live value.
-    if let Some(persist) = world.get_resource::<crate::cvars::CvarPersist>() {
-        script.set_cvar_saved_base(persist.saved_base());
+    // The two lines are `sync_cvars`'s own seed, in its own order, and the order is
+    // load-bearing: the file's unclaimed entries go in FIRST so an addon's `RegisterCVar` starts
+    // its key at the player's value rather than the declared one (1291); then the registry's
+    // whole table at its live values (2303) — the store that outlived the last VM. `sync_cvars`
+    // still runs its own per-VM seed on the next `Update`; both are idempotent. A world with no
+    // registry (a bare test app) gets the registered defaults.
+    match world.get_resource::<crate::cvars::Cvars>() {
+        Some(cvars) => {
+            script.set_cvar_saved_base(cvars.orphans());
+            script.seed_cvars(cvars.vm_seed());
+        }
+        None => script.register_cvars(crate::cvars::registered_pairs()),
     }
-    script.register_cvars(crate::cvars::registered_pairs());
     // The realm name goes in BEFORE the UI loads, because `GetRealmName()` is read at addon file
     // scope — `MyAddonDB[GetRealmName()] = …` is the corpus idiom, and 24 addons stop on it
     // (decision 1195). The roster carries the auth realm-list entry this session connected to.
@@ -502,6 +506,21 @@ pub(crate) fn load_ingame_ui_on_world_entry(world: &mut World) {
     script.set_realm_name(&realm);
     // …and so does the PLAYER, for the same reason and with more riding on it — see
     // [`seat_from_roster`], which is where the why lives.
+    //
+    // **The player RECORD first, and separately** (decisions 2261/2263). The reference keeps the
+    // local player's name, race, class and gender somewhere no cache, feed or object can reach — a
+    // copy of the char-enum row written at the Enter World commit (`0x5abd9e`) and never cleared —
+    // and `UnitName`/`UnitRace`/`UnitClass`/`UnitSex` read only that, unconditionally, even after
+    // the descriptor exists. The snapshot below is the descriptor's stand-in until the real one
+    // streams in and is replaced when it does; the record outlives every push. Seeded here because
+    // our VM is rebuilt per login (1290) while the reference's record simply persists, so each new
+    // VM has to be told once — before the addon walk, like the realm.
+    if let Some(record) = world
+        .get_resource::<crate::char_select::Roster>()
+        .and_then(record_from_roster)
+    {
+        script.set_player_record(record);
+    }
     if let Some(seat) = world
         .get_resource::<crate::char_select::Roster>()
         .and_then(seat_from_roster)
@@ -516,14 +535,9 @@ pub(crate) fn load_ingame_ui_on_world_entry(world: &mut World) {
     // character select reached here inside the save debounce; the fold carries that click now, by
     // the route the reload path always used. Absent both (a bare test world) is the registrar
     // default: check ON.
-    let version_check = script
-        .cvar("checkAddonVersion")
-        .map(|v| v != "0")
-        .unwrap_or_else(|| {
-            world
-                .get_resource::<crate::cvars::CvarPersist>()
-                .is_none_or(crate::cvars::CvarPersist::addon_version_check)
-        });
+    let version_check = world
+        .get_resource::<crate::cvars::Cvars>()
+        .is_none_or(crate::cvars::Cvars::addon_version_check);
     // **…and the rest of the same class** (decision 2241). Each of these was a per-VM claim in
     // `Update`, which answers *which* VM and not *when inside its life* — and every one of them
     // backs a Lua getter the load burst below reads:
@@ -660,6 +674,43 @@ pub(crate) fn load_ingame_ui_on_world_entry(world: &mut World) {
     }
 }
 
+/// The wire's gender byte (0 male, 1 female) on `UnitSex`'s own 2/3 scale — the one mapping, so
+/// the record and the snapshot can never disagree about which is which.
+fn roster_sex(gender: u8) -> u8 {
+    match gender {
+        0 => 2,
+        1 => 3,
+        _ => 0,
+    }
+}
+
+/// **The local player record the UI loads under** — our copy of the char-enum row the reference
+/// copies at the Enter World commit (decision 2263; the bytes are on
+/// [`benilla_ui::script::PlayerRecord`]).
+///
+/// The same roster row [`seat_from_roster`] builds the `"player"` *snapshot* from, and
+/// deliberately the same `race_names`/`class_names` lookups: the reference resolves the record's
+/// race and class bytes through `ChrRaces`/`ChrClasses` at call time, so resolving them once here
+/// is the same answer, and sharing the lookup is what stops the record and the snapshot drifting
+/// into two opinions about what race 4 is.
+///
+/// **The level is not here, and that is byte-verified, not an omission** — the reference's record
+/// carries a level at `+0x108` and ships an accessor for it (`0x5abe00`) that *nothing calls*, so
+/// `UnitLevel("player")` reads the descriptor.
+pub(crate) fn record_from_roster(
+    roster: &crate::char_select::Roster,
+) -> Option<benilla_ui::script::PlayerRecord> {
+    let row = roster.pending_row()?;
+    let race = crate::ui_unit::race_names(row.race);
+    let class = crate::ui_unit::class_names(row.class);
+    Some(benilla_ui::script::PlayerRecord {
+        name: row.name.clone(),
+        race: race.map(|(n, f)| (n.to_string(), f.to_string())),
+        class: class.map(|(n, f)| (n.to_string(), f.to_string())),
+        sex: roster_sex(row.gender),
+    })
+}
+
 /// The `"player"` snapshot the UI loads **under**, built from the roster row of the pick in
 /// flight — `None` when there is no pick (a capture, a scenario, a test world).
 ///
@@ -693,20 +744,32 @@ pub(crate) fn seat_from_roster(
     let row = roster.pending_row()?;
     let race = crate::ui_unit::race_names(row.race);
     let class = crate::ui_unit::class_names(row.class);
+    let sex = roster_sex(row.gender);
     Some(benilla_ui::script::UnitState {
-        exists: true,
+        // **`exists` is FALSE, and the level is 0 — the reference's answers, byte-verified**
+        // (decision 2263). `UnitExists("player")` `0x515fb0` has no fast path: it resolves the
+        // token, and the resolver reads the GUID out of the OBJECT (`0x515994`), not out of
+        // `[mgr+0xc0]` — so with no object it holds `0:0`. The roster fallback `0x491900` then
+        // bails on a zero GUID at `0x4e80aa je` *before* it fetches the active player, so the
+        // `0 == 0` that would otherwise answer "yes, that's me" is never reached: `0x516001
+        // lua_pushnil`. `UnitLevel 0x517fc0` likewise carries no `"player"` compare at all and
+        // reaches its total-miss arm `0x51813e push 0; push 0` — the **number 0**, not nil. The
+        // two misses are deliberately asymmetric and a client that modelled "no data" uniformly
+        // would be wrong on one of them (wow-re `ui/scratch/unit-verbs-before-player-object.md`
+        // §2-§3; it also corrected that repo's own `main`, which had published the opposite).
+        //
+        // This seat is no longer what makes the player *answerable* — the record above is — so it
+        // no longer has to claim a unit exists in order to deliver a name. What it still carries
+        // is the handful of fields the corpus reads at file scope that are neither the record's
+        // nor the descriptor's to say yet, the faction side below chief among them.
+        exists: false,
         name: Some(row.name.clone()),
-        level: u32::from(row.level),
         race: race.map(|(n, _)| n.to_string()),
         race_file: race.map(|(_, f)| f.to_string()),
         class: class.map(|(n, _)| n.to_string()),
         class_file: class.map(|(_, f)| f.to_string()),
         // The wire's 0/1 on `UnitSex`'s 2/3 scale — `ui_unit::snapshot`'s own mapping.
-        sex: match row.gender {
-            0 => 2,
-            1 => 3,
-            _ => 0,
-        },
+        sex,
         is_player: true,
         player_controlled: true,
         // Nil here is not "no faction", it is a state a player character cannot be in, and
@@ -793,7 +856,7 @@ pub(crate) fn arm_leaving_world_on_self_create(
 ///
 /// **The last step is not "destroy the Lua state"** — which is what three of wow-re's own notes
 /// said, until this client's teardown made the question load-bearing and a §5 cross-check settled
-/// it (`system/ui/scratch/lua-state-lifecycle.md`; 1291). `0x490c97` is the frame-script owner's
+/// it (`system/ui/scratch/lua-state-lifecycle.md`; 2277). `0x490c97` is the frame-script owner's
 /// scalar-deleting destructor — the widget tree and the native virtual-font registry — and the Lua
 /// state outlives it. The state is closed and re-opened at `0x703b80`, which reaches `InitLua` by a
 /// **tail-`jmp`** (`0x703b8e`) rather than a call, which is exactly why a call-census missed it.
diff --git a/crates/benilla-app/src/ui_script/mod.rs b/crates/benilla-app/src/ui_script/mod.rs
index 837d8774..8e373bf1 100644
--- a/crates/benilla-app/src/ui_script/mod.rs
+++ b/crates/benilla-app/src/ui_script/mod.rs
@@ -281,13 +281,31 @@ pub(crate) struct UiPassState {
 #[derive(Resource, Default)]
 pub(crate) struct PointerOverUiPanel(pub(crate) bool);
 
+/// The player-UI FEED phase — every push into the VM that this frame's tick must see: the
+/// snapshot feeds, the one-shot drains that `fire_event`, the per-VM seeds. Chained
+/// `UiFeed` → [`UiInput`] → [`UiPaint`] and ordered after [`WorldStage::Net`] (decision 2304), so
+/// a feed reads what this frame's packets did, and a handler its event fires reads what every
+/// other feed pushed — the reference's own frame, where packet dispatch precedes every
+/// `FrameScript_SignalEvent` and both precede `OnUpdate`. The failure the order closes was found
+/// in the unit feed first ([`crate::ui_unit::UnitFeed`]'s doc): unordered, `apply_net_updates`
+/// could land between two feeds, and a synchronous handler fired by the later one re-read the
+/// earlier one's pre-mutation push. **No run condition on the set** — whether a feed may run
+/// before the in-game interface exists is a judgement per feed (2232), and the ones that may not
+/// ride `UnitFeed`, a gated sub-phase of this one. Every system holding the VM in `Update`
+/// declares its side of the tick — this set, or `.after(UiInput)` — and
+/// `game_plugins::schedule_tests` holds it on the built schedule.
+#[derive(SystemSet, Debug, Clone, Copy, PartialEq, Eq, Hash)]
+pub(crate) struct UiFeed;
+
 /// The player-UI PAINT pass — the quad walk ([`extract::paint_script`]), ordered after the world's
 /// camera update so that world-anchored widgets are drawn from this frame's camera (decision 2168).
+/// The last of the three UI phases (see [`UiFeed`]).
 #[derive(SystemSet, Debug, Clone, Copy, PartialEq, Eq, Hash)]
 pub(crate) struct UiPaint;
 
-/// The player-UI input pass — hit-testing + handler firing. Ordered before [`WorldStage::Input`] so
-/// the [`PlayerUiHover`] it produces is folded into `PointerOverUi` before `player::control` reads it.
+/// The player-UI input pass — the tick, hit-testing + handler firing. Ordered before
+/// [`WorldStage::Input`] so the [`PlayerUiHover`] it produces is folded into `PointerOverUi` before
+/// `player::control` reads it; the middle of the three UI phases (see [`UiFeed`]).
 #[derive(SystemSet, Debug, Clone, Copy, PartialEq, Eq, Hash)]
 pub(crate) struct UiInput;
 
@@ -403,8 +421,31 @@ pub(crate) fn seam_scale(window_h: f32, ui_scale: f32) -> f32 {
 /// tick → resolve → extract pipeline into [`UiQuads`], plus the input pass ([`feed_ui_input`]).
 pub(crate) struct UiScriptPlugin;
 
+/// `uiScale`'s change callback (decision 2303): the dial's own `[0.5, 1.5]` clamp.
+pub(crate) fn on_cvar(ev: On<crate::cvars::CvarChanged>, mut scale: ResMut<UiScaleCvar>) {
+    if ev.is("uiScale") {
+        scale.0 = ev.num().clamp(0.5, 1.5);
+    }
+}
+
+/// `/console reloadUI` — the reference's own console command, and the same deferred rebuild
+/// `ReloadUI()` and `/reload` queue (decision 1291): through the session seam, run by
+/// [`run_pending_reload`] at the top of the next frame.
+fn console_reload_ui(world: &mut World, _args: &str) -> Vec<String> {
+    match world.get_non_send_resource_mut::<UiScript>() {
+        Some(mut script) => {
+            script.queue_session_request(benilla_ui::script::SessionRequest::ReloadUi);
+            Vec::new()
+        }
+        None => vec!["reloadUI: no interface to reload".to_string()],
+    }
+}
+
 impl Plugin for UiScriptPlugin {
     fn build(&self, app: &mut App) {
+        use crate::console::ConsoleCommandApp;
+        app.add_observer(on_cvar);
+        app.console_command("reloadUI", "Reload the interface.", console_reload_ui);
         // **The quit root of the shutdown tail, on the exit edge** (decision 1528). It was
         // `.add_systems(Update, shutdown_on_exit)` below, which cannot see the `AppExit` a player
         // produces — the close button's is written in `PostUpdate` — so quitting from in-world
@@ -474,29 +515,40 @@ impl Plugin for UiScriptPlugin {
                 PreUpdate,
                 (run_pending_reload, lifecycle::run_pending_entry_load).chain(),
             )
-            // `GetFramerate()`'s host half (decision 1195), before the VM ticks so an `OnUpdate`
+            // **The three UI phases, in order** (decision 2304): every push after the net
+            // drain, then the tick, then the paint. `UiFeed`'s own doc has the why; `UiInput`
+            // sits before the world's input stage so the hover it produces reaches the pointer
+            // arbiter in time (its doc).
+            .configure_sets(
+                Update,
+                (
+                    UiFeed.after(WorldStage::Net),
+                    UiInput.before(WorldStage::Input),
+                    UiPaint,
+                )
+                    .chain(),
+            )
+            // `GetFramerate()`'s host half (decision 1195), in the feed phase so an `OnUpdate`
             // handler reads this frame's number rather than the previous one's.
-            .add_systems(Update, feed_framerate.before(UiInput))
+            .add_systems(Update, feed_framerate.in_set(UiFeed))
             // `tick_script` resolves layout; `feed_ui_input` hit-tests against those rects, so they
-            // chain (also required because both take the single `NonSend` VM). The pair runs before
-            // `WorldStage::Input` so the hover result reaches the pointer arbiter in time. The input
-            // pass is in-world only (decision 0193): the character-select glue screen owns the
-            // pointer + keyboard there (its exit edge resets the latches this pass normally drives).
+            // chain (also required because both take the single `NonSend` VM). The input pass is
+            // in-world only (decision 0193): the character-select glue screen owns the pointer +
+            // keyboard there (its exit edge resets the latches this pass normally drives).
             .init_resource::<UiPassState>()
             .init_resource::<PointerOverUiPanel>()
             .add_systems(
                 Update,
                 (
                     extract::tick_script,
-                    input::feed_ui_input.run_if(in_state(crate::char_select::ClientState::InWorld)),
+                    input::feed_ui_input.in_set(crate::char_select::InWorldGated),
                 )
                     .chain()
                     .in_set(UiInput)
                     // The binding dispatch (0997) runs in this same set, after the feed: it
                     // reads the capture gate the feed just wrote, so a key a focused box
                     // consumed this frame never also fires a binding.
-                    .before(crate::bindings::BindingSet)
-                    .before(WorldStage::Input),
+                    .before(crate::bindings::BindingSet),
             )
             // **The paint half, after the camera** (decision 2168): the quad walk runs once the
             // world's own update has happened, so a widget anchored to the world — the nameplates,
@@ -527,8 +579,8 @@ impl Plugin for UiScriptPlugin {
         app.add_systems(
             Update,
             demo_unit_feed
+                .in_set(UiFeed)
                 .after(UnitFeed)
-                .before(UiInput)
                 .run_if(capture_ui_active),
         );
     }
@@ -1174,6 +1226,11 @@ mod quest_timer_tests;
 #[cfg(test)]
 mod battlefield_tests;
 
+/// The battle map — the reference's `Blizzard_BattlefieldMinimap` addon, demand-loaded the way
+/// SHIFT-M loads it, over the overlay/POI/position/arrow verbs it shares with the world map.
+#[cfg(test)]
+mod battlefield_minimap_tests;
+
 #[cfg(test)]
 mod tutorial_tests;
 
diff --git a/crates/benilla-app/src/ui_script/session.rs b/crates/benilla-app/src/ui_script/session.rs
index b3cc389c..81d17241 100644
--- a/crates/benilla-app/src/ui_script/session.rs
+++ b/crates/benilla-app/src/ui_script/session.rs
@@ -245,63 +245,7 @@ mod tests {
         ("cursor.rs", "last_ptr"),
     ];
 
-    /// Every `.rs` file under `root`, recursively.
-    fn rust_files(root: &std::path::Path) -> Vec<std::path::PathBuf> {
-        let mut out = Vec::new();
-        let mut stack = vec![root.to_path_buf()];
-        while let Some(dir) = stack.pop() {
-            let Ok(entries) = std::fs::read_dir(&dir) else {
-                continue;
-            };
-            for entry in entries.flatten() {
-                let path = entry.path();
-                if path.is_dir() {
-                    stack.push(path);
-                } else if path.extension().is_some_and(|e| e == "rs") {
-                    out.push(path);
-                }
-            }
-        }
-        out
-    }
-
-    /// The parenthesised parameter list of every `fn` in `text`, by paren matching — so the scan
-    /// sees a signature rather than a whole body, and a `Local` in some unrelated expression
-    /// cannot be mistaken for a system parameter.
-    fn fn_parameter_lists(text: &str) -> Vec<&str> {
-        let bytes = text.as_bytes();
-        let mut out = Vec::new();
-        for (i, _) in text.match_indices("fn ") {
-            // `fn` must start a word: `…_fn (` and `Fn(` are not declarations.
-            if i > 0 && (bytes[i - 1].is_ascii_alphanumeric() || bytes[i - 1] == b'_') {
-                continue;
-            }
-            let Some(open) = text[i..].find('(').map(|o| i + o) else {
-                continue;
-            };
-            // A generic parameter list can carry parens, but never before the argument list's `(`
-            // in the shapes this codebase writes; a `<` with an unbalanced `(` would just scan on.
-            let mut depth = 0usize;
-            let mut close = None;
-            for (j, c) in text[open..].char_indices() {
-                match c {
-                    '(' => depth += 1,
-                    ')' => {
-                        depth -= 1;
-                        if depth == 0 {
-                            close = Some(open + j);
-                            break;
-                        }
-                    }
-                    _ => {}
-                }
-            }
-            if let Some(close) = close {
-                out.push(&text[open + 1..close]);
-            }
-        }
-        out
-    }
+    use crate::test_support::{fn_parameter_lists, rust_files};
 
     /// Every `name: Local<Ty>` in a parameter list, as `(name, Ty)` — angle-bracket matched, so a
     /// nested generic comes back whole.
diff --git a/crates/benilla-app/src/ui_script/tooltip_anchor_tests.rs b/crates/benilla-app/src/ui_script/tooltip_anchor_tests.rs
index 4fa81f39..ad13fc37 100644
--- a/crates/benilla-app/src/ui_script/tooltip_anchor_tests.rs
+++ b/crates/benilla-app/src/ui_script/tooltip_anchor_tests.rs
@@ -565,3 +565,44 @@ fn a_cursor_seated_gameobject_plate_survives_an_addons_on_show_hook() {
         s.errors()
     );
 }
+
+/// **The CORNER arm must end up owned too — the other half of the existence gate** (decision 2259).
+///
+/// The reference's corner arm (`0x492a42`) writes no owner itself; the owner is restored purely by
+/// the `+0x444` handler, `OnTooltipSetDefaultAnchor` → `GameTooltip_SetDefaultAnchor(this,
+/// UIParent)` → `SetOwner(UIParent, "ANCHOR_NONE")`. And the owner really is 0 on the way in:
+/// `Tooltip::Hide 0x530a60` *is* `SetOwner(NULL, 0, 0, 0)`, so every hover starts un-owned.
+///
+/// That makes this test the precondition for narrowing the placement fork at all. Moving an object
+/// from the cursor arm to the corner arm is only safe while the corner arm produces an OWNED,
+/// SHOWN plate — otherwise those objects would build their lines and then hide, which is precisely
+/// the failure 2255 had just fixed on the cursor arm.
+#[test]
+fn a_corner_seated_gameobject_plate_is_owned_and_shown() {
+    let mut s = harness(&[]);
+    assert!(s.world_tooltip_gameobject("Ironforge Main Gate", &[], None));
+    let owned: bool = s.eval("return GameTooltip:IsOwned(UIParent)").unwrap();
+    assert!(owned, "the corner plate is owned; errors: {:?}", s.errors());
+    let shown: bool = s
+        .eval("return GameTooltip:IsShown() and true or false")
+        .unwrap();
+    assert!(shown, "and it is on screen; errors: {:?}", s.errors());
+}
+
+/// And it survives the same addon hook the cursor arm had to: `!Questie`'s `OnShow` handler ends in
+/// `GameTooltip:Show()`, and `:Show()` is the existence gate `0x530a80`.
+#[test]
+fn a_corner_seated_gameobject_plate_survives_an_addons_on_show_hook() {
+    let mut s = harness(&[]);
+    s.run(r#"GameTooltip:SetScript("OnShow", function() GameTooltip:Show() end)"#)
+        .unwrap();
+    assert!(s.world_tooltip_gameobject("Ironforge Main Gate", &[], None));
+    let shown: bool = s
+        .eval("return GameTooltip:IsShown() and true or false")
+        .unwrap();
+    assert!(
+        shown,
+        "the corner plate is still up; errors: {:?}",
+        s.errors()
+    );
+}
diff --git a/crates/benilla-app/src/ui_script/trainer_tests.rs b/crates/benilla-app/src/ui_script/trainer_tests.rs
index 862cb611..25f6023d 100644
--- a/crates/benilla-app/src/ui_script/trainer_tests.rs
+++ b/crates/benilla-app/src/ui_script/trainer_tests.rs
@@ -136,7 +136,6 @@ fn text_center(quads: &[ExtractedQuad], needle: &str) -> (f32, f32) {
 
 /// One service in a named skill line, spelling out every field so the intent is legible at the call
 /// site.
-#[allow(clippy::too_many_arguments)]
 fn service(
     spell_id: u32,
     name: &str,
diff --git a/crates/benilla-app/src/ui_script/world_entry_tests.rs b/crates/benilla-app/src/ui_script/world_entry_tests.rs
index 9ce2209d..c783efe3 100644
--- a/crates/benilla-app/src/ui_script/world_entry_tests.rs
+++ b/crates/benilla-app/src/ui_script/world_entry_tests.rs
@@ -1657,3 +1657,68 @@ ScreenProbeHeight = GetScreenHeight()
     drop(world);
     let _ = std::fs::remove_dir_all(&tmp);
 }
+
+/// **The entry load seeds the player record, not just the snapshot** (decisions 2261/2263).
+///
+/// [`super::seat_from_roster`]'s `"player"` push is the descriptor's stand-in and is *replaced*
+/// the moment the real one streams in — which is how decision 2260's nameless push reached
+/// `UnitName("player")`. The buffer is seeded beside it, from the same roster row, and the verb
+/// reads only that; so the token can be replaced by a nameless snapshot or removed outright and
+/// the name still answers, exactly as the reference's never-cleared `0xc27d88` does.
+#[test]
+fn the_entry_load_seeds_a_record_the_feed_cannot_take_away() {
+    let _l = ENV_LOCK
+        .lock()
+        .unwrap_or_else(std::sync::PoisonError::into_inner);
+    let (tmp, _capture, _home) = hermetic_probe("nameseed");
+    let mut world = booted_world();
+    log_in_as(&mut world, "Nelprifour", 0x2A);
+
+    assert_eq!(
+        probe_saw(&world).as_deref(),
+        Some("Nelprifour"),
+        "addon file scope reads the live character, as it always has (1230)"
+    );
+
+    let mut script = world
+        .get_non_send_resource_mut::<benilla_ui::script::UiScript>()
+        .expect("a VM");
+    // The feed's 2260 push: the descriptor landed, the name cache missed for our own guid.
+    script.set_unit(
+        "player",
+        Some(benilla_ui::script::UnitState {
+            exists: true,
+            has_object: true,
+            name: None,
+            ..Default::default()
+        }),
+    );
+    assert_eq!(
+        script
+            .eval::<Option<String>>(r#"return UnitName("player")"#)
+            .unwrap()
+            .as_deref(),
+        Some("Nelprifour"),
+        "the record answers, so a nameless snapshot is invisible to the verb"
+    );
+    assert_eq!(
+        script
+            .eval::<Option<String>>(r#"local _, t = UnitClass("player"); return t"#)
+            .unwrap()
+            .as_deref(),
+        Some("WARRIOR"),
+        "…and the same for the other three fields the reference reads off that record (2263)"
+    );
+
+    // …and so does the logout despawn, which removes the token altogether.
+    script.set_unit("player", None);
+    assert_eq!(
+        script
+            .eval::<Option<String>>(r#"return UnitName("player")"#)
+            .unwrap()
+            .as_deref(),
+        Some("Nelprifour")
+    );
+
+    let _ = std::fs::remove_dir_all(&tmp);
+}
diff --git a/crates/benilla-app/src/ui_session.rs b/crates/benilla-app/src/ui_session.rs
index 3a2da7fd..3ef4700b 100644
--- a/crates/benilla-app/src/ui_session.rs
+++ b/crates/benilla-app/src/ui_session.rs
@@ -169,7 +169,6 @@ pub(crate) struct InteractNpc(pub(crate) Option<Entity>, pub(crate) Option<u64>)
 /// no cross-system race over who owns the `"npc"` token — the sessions are mutually exclusive, and a
 /// bare `.or` chain is the whole rule. `Option<Res<_>>` keeps it safe in a headless test that mounts
 /// the portrait plugin without every window plugin.
-#[allow(clippy::too_many_arguments)]
 pub(crate) fn feed_interact_npc(
     gossip: Option<Res<crate::ui_gossip::GossipState>>,
     quest: Option<Res<crate::ui_quest::QuestGiver>>,
diff --git a/crates/benilla-app/src/ui_shapeshift.rs b/crates/benilla-app/src/ui_shapeshift.rs
index 291cf943..f84f8049 100644
--- a/crates/benilla-app/src/ui_shapeshift.rs
+++ b/crates/benilla-app/src/ui_shapeshift.rs
@@ -214,7 +214,6 @@ impl Plugin for UiShapeshiftPlugin {
                 // after the input pass so a stance click goes out the same frame.
                 feed_shapeshift_bar
                     .in_set(UnitFeed)
-                    .before(UiInput)
                     .before(crate::ui_action::CooldownEvents)
                     .before(crate::ui_aura::AuraEvents),
                 drain_shapeshift_casts.after(UiInput),
@@ -225,7 +224,7 @@ impl Plugin for UiShapeshiftPlugin {
 
 /// Build the bar list from the known-spell set × the catalog, per the module-doc mechanism, and
 /// diff-push it.
-#[allow(clippy::too_many_arguments, clippy::type_complexity)] // a Bevy system's full input set
+#[allow(clippy::type_complexity)] // a Bevy system's full input set
 fn feed_shapeshift_bar(
     script: Option<NonSendMut<UiScript>>,
     actions: Res<PlayerActions>,
@@ -237,9 +236,10 @@ fn feed_shapeshift_bar(
     units: Query<&ObjectStore, Without<SelfPlayer>>,
     factions: Option<Res<crate::target::Factions>>,
     reputations: Res<Reputations>,
-    mut items: ResMut<Items>,
+    items: Res<Items>,
     commands: Res<NetCommands>,
     clock: Res<crate::ui_script::UiClock>,
+    spell_mods: Res<crate::spell_mods::SpellModifiers>,
     mut memory: Local<crate::ui_script::VmMemo<StanceMemory>>,
 ) {
     let Some(mut script) = script else {
@@ -302,8 +302,9 @@ fn feed_shapeshift_bar(
                         reputations: &reputations,
                         cooldowns: &cooldowns,
                         carried: &carried,
+                        spell_mods: &spell_mods,
                     };
-                    usable::spell_usable(id, d, &spells, &ctx, &mut items, &commands).0
+                    usable::spell_usable(id, d, &spells, &ctx, &items, &commands).0
                 });
             let texture = form_texture(d, active);
             let cooldown = cooldowns
diff --git a/crates/benilla-app/src/ui_social/feed.rs b/crates/benilla-app/src/ui_social/feed.rs
index 6e7d3f0a..cb93dbaf 100644
--- a/crates/benilla-app/src/ui_social/feed.rs
+++ b/crates/benilla-app/src/ui_social/feed.rs
@@ -60,11 +60,10 @@ pub(super) struct FedSocial {
 
 /// Build the display snapshot, push it to the VM, fire the list events, and drain the owed
 /// result lines.
-#[allow(clippy::too_many_arguments)] // a Bevy system's param list IS its dependency set
 pub(super) fn feed_social(
     script: Option<NonSendMut<UiScript>>,
     mut social: ResMut<SocialState>,
-    mut names: ResMut<NameCache>,
+    names: Res<NameCache>,
     areas: Option<Res<AreaTableRes>>,
     commands: Res<NetCommands>,
     mut sink: MessageSink,
@@ -81,7 +80,7 @@ pub(super) fn feed_social(
         let get = |key: &str| script.lua().globals().get::<String>(key).ok();
         // Each owed line carries a catalog key, so the surface AND the sound come from its row —
         // `ERR_FRIEND_ONLINE_SS`'s is `FRIENDJOINGAME`, which a straight chat push could not play.
-        let owed: Vec<Shown> = drain_result_lines(&mut social, &mut names, &commands)
+        let owed: Vec<Shown> = drain_result_lines(&mut social, &names, &commands)
             .iter()
             .filter_map(|e| {
                 crate::ui_action::ui_error_text(e, &get).map(|text| Shown::keyed(e.key, text))
@@ -89,7 +88,7 @@ pub(super) fn feed_social(
             .collect();
         // The row's away tag, through `CHAT_FLAG_AFK`/`_DND` — the chat frame's own pair.
         let away = |status: u8| status_flag_key(status).and_then(&get).unwrap_or_default();
-        let (friends, display_order) = friend_rows(&social, &mut names, &commands, areas, &away);
+        let (friends, display_order) = friend_rows(&social, &names, &commands, areas, &away);
         (owed, friends, display_order)
     };
 
@@ -97,7 +96,7 @@ pub(super) fn feed_social(
     // update that removes their zone.
     crate::ui_action::show_messages(&mut script, &mut sink, "ui_social", owed);
 
-    let (ignores, ignore_order) = ignore_rows(&social, &mut names, &commands);
+    let (ignores, ignore_order) = ignore_rows(&social, &names, &commands);
     let who = who_rows(&social, areas);
 
     let selected_friend = index_of(&display_order, social.selected_friend);
@@ -171,7 +170,7 @@ fn answer_goes_to_the_frame(to_ui: bool, shown: usize) -> bool {
 /// it" must not look the same.
 fn drain_result_lines(
     social: &mut SocialState,
-    names: &mut NameCache,
+    names: &NameCache,
     commands: &NetCommands,
 ) -> Vec<UiError> {
     let mut still_pending = Vec::new();
@@ -252,7 +251,7 @@ fn who_lines(rows: &[WhoInfo], total: u32, get: &dyn Fn(&str) -> Option<String>)
 /// drain can map a row index back to a player.
 fn friend_rows(
     social: &SocialState,
-    names: &mut NameCache,
+    names: &NameCache,
     commands: &NetCommands,
     areas: Option<&AreaTableCatalog>,
     away: &dyn Fn(u8) -> String,
@@ -304,7 +303,7 @@ fn friend_rows(
 /// The ignore rows: names only, same ordering rule.
 fn ignore_rows(
     social: &SocialState,
-    names: &mut NameCache,
+    names: &NameCache,
     commands: &NetCommands,
 ) -> (Vec<String>, Vec<u64>) {
     let mut rows: Vec<(u64, String)> = social
diff --git a/crates/benilla-app/src/ui_social/mod.rs b/crates/benilla-app/src/ui_social/mod.rs
index 3c3069fe..307bda54 100644
--- a/crates/benilla-app/src/ui_social/mod.rs
+++ b/crates/benilla-app/src/ui_social/mod.rs
@@ -42,7 +42,7 @@
 use benilla_protocol::messages::{friend_result, friend_status, FriendEntry, FriendStatusUpdate};
 use bevy::prelude::*;
 
-use crate::ui_script::UiInput;
+use crate::ui_script::{UiFeed, UiInput};
 
 mod feed;
 mod query;
@@ -322,7 +322,7 @@ impl Plugin for UiSocialPlugin {
         app.init_resource::<SocialState>().add_systems(
             Update,
             (
-                feed::feed_social.before(UiInput),
+                feed::feed_social.in_set(UiFeed),
                 feed::drain_social.after(UiInput),
             ),
         );
diff --git a/crates/benilla-app/src/ui_spellbook.rs b/crates/benilla-app/src/ui_spellbook.rs
index aaac0715..83b4031e 100644
--- a/crates/benilla-app/src/ui_spellbook.rs
+++ b/crates/benilla-app/src/ui_spellbook.rs
@@ -103,8 +103,7 @@ impl Plugin for UiSpellbookPlugin {
                     // book buttons re-read them (that set's own doc).
                     feed_spellbook
                         .in_set(UnitFeed)
-                        .before(crate::ui_action::CooldownEvents)
-                        .before(UiInput),
+                        .before(crate::ui_action::CooldownEvents),
                     drain_spell_casts.after(UiInput),
                 ),
             );
@@ -145,7 +144,6 @@ struct FeedMemory {
     self_present: gate::Watch,
 }
 
-#[allow(clippy::too_many_arguments)] // a Bevy system's full input set
 fn feed_spellbook(
     script: Option<NonSendMut<UiScript>>,
     actions: Res<PlayerActions>,
@@ -153,7 +151,7 @@ fn feed_spellbook(
     skill_lines: Option<Res<SkillLines>>,
     self_q: Query<&ObjectStore, With<SelfPlayer>>,
     changed_self: Query<(), (With<SelfPlayer>, Changed<ObjectStore>)>,
-    mut items: ResMut<Items>,
+    items: Res<Items>,
     icons: Option<Res<ItemDisplays>>,
     commands: Res<NetCommands>,
     cooldowns: Res<crate::cooldowns::Cooldowns>,
@@ -238,13 +236,13 @@ fn feed_spellbook(
     // not spell 6603's `Temp` placeholder (decision 0230) — resolved here where the self player +
     // item stores are in hand, once for the whole page (it's the same for any auto-attack spell).
     let attack_icon = store
-        .map(|s| melee_auto_attack_icon(s, &spells.forms, &mut items, icons.as_deref(), &commands));
+        .map(|s| melee_auto_attack_icon(s, &spells.forms, &items, icons.as_deref(), &commands));
     // The ranged auto-repeat shots (Auto Shot, wand Shoot) borrow the equipped ranged weapon's
     // icon the same way (decision 0231's ranged case; `None` — unarmed/thrown — keeps the
     // spell's own icon, never Spell-Reset). Character-level like the melee icon: one resolve
     // serves the page.
     let ranged_icon =
-        store.and_then(|s| ranged_weapon_icon(s, &mut items, icons.as_deref(), &commands));
+        store.and_then(|s| ranged_weapon_icon(s, &items, icons.as_deref(), &commands));
     let (mut fresh, tab_lines) = build_book(
         &actions.spells,
         &spells.catalog,
diff --git a/crates/benilla-app/src/ui_stable.rs b/crates/benilla-app/src/ui_stable.rs
index 38dfe80e..a2d1adf4 100644
--- a/crates/benilla-app/src/ui_stable.rs
+++ b/crates/benilla-app/src/ui_stable.rs
@@ -41,7 +41,7 @@ use benilla_ui::script::{StableIntent, StablePetSlot, StableState, UiScript, NUM
 use crate::names::NameCache;
 use crate::net::{ClientCommand, NetCommands};
 use crate::ui_pet_stats::{PetFamilyTables, PetStatTables};
-use crate::ui_script::UiInput;
+use crate::ui_script::{UiFeed, UiInput};
 use crate::ui_session::{close_npc_session_out_of_range, npc_switched, NpcSession};
 
 pub(crate) struct UiStablePlugin;
@@ -57,7 +57,7 @@ impl Plugin for UiStablePlugin {
                     // frame; push before the input pass so an open/close is on screen the same frame;
                     // drain after it (the trainer/merchant/gossip ordering).
                     close_npc_session_out_of_range::<StableOpen>.before(feed_stable),
-                    feed_stable.before(UiInput),
+                    feed_stable.in_set(UiFeed),
                     drain_stable.after(UiInput),
                     // AFTER the VM ticks, unlike every other booth feed: this one reads the
                     // *selection*, which a click on a slot writes during `UiInput` — and
@@ -143,7 +143,7 @@ impl NpcSession for StableOpen {
 /// gating the whole row: a pet whose query is in flight still shows its name and level.
 fn resolve_pet(
     wire: &StabledPet,
-    names: &mut NameCache,
+    names: &NameCache,
     families: Option<&PetFamilyTables>,
     stats: Option<&PetStatTables>,
     commands: &NetCommands,
@@ -193,10 +193,9 @@ fn resolve_pet(
 }
 
 /// Build the Lua-facing snapshot from [`StableOpen`] — `None` when no stable is open.
-#[allow(clippy::too_many_arguments)]
 fn snapshot(
     open: &StableOpen,
-    names: &mut NameCache,
+    names: &NameCache,
     families: Option<&PetFamilyTables>,
     stats: Option<&PetStatTables>,
     next_slot_cost: u32,
@@ -228,7 +227,6 @@ fn snapshot(
 
 /// Push the current stable into the VM and fire the show/update/close events on a transition (or a
 /// content change). Diffed against a `Local` memory, exactly like the trainer/merchant feeds.
-#[allow(clippy::too_many_arguments)] // the resolver's full catalog set
 fn feed_stable(
     script: Option<NonSendMut<UiScript>>,
     // ResMut only to consume the fresh-list latch; the feed never authors stable content.
@@ -238,7 +236,7 @@ fn feed_stable(
     stats: Option<Res<PetStatTables>>,
     prices: Option<Res<StableSlotPrices>>,
     commands: Res<NetCommands>,
-    mut names: ResMut<NameCache>,
+    names: Res<NameCache>,
     mut errors: ResMut<StableErrors>,
     mut last: Local<crate::ui_script::VmMemo<Option<StableState>>>,
     mut last_npc: Local<crate::ui_script::VmMemo<Option<u64>>>,
@@ -273,7 +271,7 @@ fn feed_stable(
     let has_live_pet = bar.spells.pet_guid != 0;
     let fresh = snapshot(
         &open,
-        &mut names,
+        &names,
         families.as_deref(),
         stats.as_deref(),
         next_slot_cost,
diff --git a/crates/benilla-app/src/ui_summon.rs b/crates/benilla-app/src/ui_summon.rs
index 995803b2..b913a923 100644
--- a/crates/benilla-app/src/ui_summon.rs
+++ b/crates/benilla-app/src/ui_summon.rs
@@ -75,7 +75,7 @@ use bevy::prelude::*;
 use crate::area::AreaTableRes;
 use crate::names::NameCache;
 use crate::net::{ClientCommand, NetCommands};
-use crate::ui_script::UiInput;
+use crate::ui_script::{UiFeed, UiInput};
 
 /// The pending summon question — the reference's four-global bank (module doc, pin 1). Written by
 /// the net drain's `SummonRequest` arm through [`apply::request`], read by [`feed_summon`] (which
@@ -130,7 +130,7 @@ impl SummonState {
 fn feed_summon(
     script: Option<NonSendMut<UiScript>>,
     mut summon: ResMut<SummonState>,
-    mut names: ResMut<NameCache>,
+    names: Res<NameCache>,
     commands: Res<NetCommands>,
     areas: Option<Res<AreaTableRes>>,
     // Real, not virtual: the deadline was stamped on this clock by the net drain, and the server's
@@ -301,7 +301,7 @@ impl Plugin for UiSummonPlugin {
                 // Before the feed, so the frame a session ends is already a frame the feed sees no
                 // memory of the last one ([`crate::death`]'s ordering, for the same reason).
                 end_session_summon.before(feed_summon),
-                feed_summon.before(UiInput),
+                feed_summon.in_set(UiFeed),
                 drain_summon.after(UiInput),
             ),
         );
diff --git a/crates/benilla-app/src/ui_tabard.rs b/crates/benilla-app/src/ui_tabard.rs
index 2260e892..d3bfaafa 100644
--- a/crates/benilla-app/src/ui_tabard.rs
+++ b/crates/benilla-app/src/ui_tabard.rs
@@ -35,7 +35,7 @@ use benilla_ui::script::{TabardHost, TabardIntent, UiScript, TABARD_COUNTS, TABA
 use crate::net::{ClientCommand, EnteredWorldMessage, NetCommands, ObjectStore, SelfPlayer};
 use crate::portrait::PaperDollBooth;
 use crate::ui_guild::GuildState;
-use crate::ui_script::UiInput;
+use crate::ui_script::{UiFeed, UiInput};
 use crate::ui_session::{close_npc_session_out_of_range, NpcSession};
 
 /// The open designer: the vendor it was opened on (`[0xbdcee8]`), and the save-in-flight latch
@@ -149,13 +149,12 @@ pub(crate) fn preflight(
     Ok(design.map(|v| v as u32))
 }
 
-#[allow(clippy::too_many_arguments)]
 fn feed_tabard(
     script: Option<NonSendMut<UiScript>>,
     mut open: ResMut<TabardOpen>,
     mut design: ResMut<TabardDesign>,
     mut booth: ResMut<PaperDollBooth>,
-    mut guilds: ResMut<GuildState>,
+    guilds: Res<GuildState>,
     self_q: Query<&ObjectStore, With<SelfPlayer>>,
     commands: Res<NetCommands>,
     mut last_host: Local<crate::ui_script::VmMemo<Option<TabardHost>>>,
@@ -223,7 +222,7 @@ fn feed_tabard(
 fn drain_tabard(
     script: Option<NonSendMut<UiScript>>,
     mut open: ResMut<TabardOpen>,
-    mut guilds: ResMut<GuildState>,
+    guilds: Res<GuildState>,
     self_q: Query<&ObjectStore, With<SelfPlayer>>,
     commands: Res<NetCommands>,
     mut sink: crate::ui_action::MessageSink,
@@ -299,7 +298,7 @@ impl Plugin for TabardUiPlugin {
                 (
                     reset_on_world_enter.before(feed_tabard),
                     close_npc_session_out_of_range::<TabardOpen>.before(feed_tabard),
-                    feed_tabard.before(UiInput),
+                    feed_tabard.in_set(UiFeed),
                     drain_tabard.after(UiInput),
                 ),
             );
diff --git a/crates/benilla-app/src/ui_talent.rs b/crates/benilla-app/src/ui_talent.rs
index 2d314558..93a0b3af 100644
--- a/crates/benilla-app/src/ui_talent.rs
+++ b/crates/benilla-app/src/ui_talent.rs
@@ -66,7 +66,7 @@ impl Plugin for UiTalentPlugin {
                 (
                     // Feed before UiInput (an N-key open this frame sees a populated window);
                     // the learn drain after (a click's wire goes out the same frame).
-                    feed_talents.in_set(UnitFeed).before(UiInput),
+                    feed_talents.in_set(UnitFeed),
                     drain_talent_learns.after(UiInput),
                 ),
             );
@@ -97,7 +97,6 @@ struct FeedMemory {
     points: Option<(u32, u32)>,
 }
 
-#[allow(clippy::too_many_arguments)] // a Bevy system's param list IS its dependency set
 fn feed_talents(
     script: Option<NonSendMut<UiScript>>,
     talents: Option<Res<Talents>>,
@@ -222,7 +221,6 @@ fn rank_of(t: &Talent, known: &BTreeSet<u32>) -> u32 {
 }
 
 /// Build the pushed snapshot — the app's whole resolve (module doc).
-#[allow(clippy::too_many_arguments)] // the catalogs, the player's state, and the string table
 pub(crate) fn build_pages(
     catalog: &TalentCatalog,
     known: &BTreeSet<u32>,
diff --git a/crates/benilla-app/src/ui_talent_wipe.rs b/crates/benilla-app/src/ui_talent_wipe.rs
index fe710487..fd74b447 100644
--- a/crates/benilla-app/src/ui_talent_wipe.rs
+++ b/crates/benilla-app/src/ui_talent_wipe.rs
@@ -51,7 +51,7 @@ use benilla_ui::script::{ScriptValue, UiScript};
 use bevy::prelude::*;
 
 use crate::net::{ClientCommand, NetCommands, ObjectStore, SelfPlayer};
-use crate::ui_script::UiInput;
+use crate::ui_script::{UiFeed, UiInput};
 use crate::ui_session::{close_npc_session_out_of_range, NpcSession};
 
 /// The pending respec question. Written by the net drain's `TalentWipeConfirm` arm, read by
@@ -206,7 +206,7 @@ impl Plugin for UiTalentWipePlugin {
                 // Range-close before the feed so walking away takes the dialog down the same
                 // frame (the binder question's ordering, for the same reason).
                 close_npc_session_out_of_range::<TalentWipeState>.before(feed_talent_wipe),
-                feed_talent_wipe.before(UiInput),
+                feed_talent_wipe.in_set(UiFeed),
                 drain_talent_wipe.after(UiInput),
             ),
         );
diff --git a/crates/benilla-app/src/ui_taxi/mod.rs b/crates/benilla-app/src/ui_taxi/mod.rs
index 9c5a0023..71447d52 100644
--- a/crates/benilla-app/src/ui_taxi/mod.rs
+++ b/crates/benilla-app/src/ui_taxi/mod.rs
@@ -36,7 +36,7 @@ use benilla_ui::script::{TaxiUiState, UiScript};
 use crate::names::NameCache;
 use crate::net::{ClientCommand, NetCommands};
 use crate::player::Player;
-use crate::ui_script::UiInput;
+use crate::ui_script::{UiFeed, UiInput};
 use crate::ui_session::{close_npc_session_out_of_range, NpcSession};
 
 mod routing;
@@ -130,13 +130,12 @@ impl NpcSession for TaxiState {
 /// on `OK` instead — the flight starts and the map has nothing left to show), present a
 /// first-visit discovery, and push the `UnitOnTaxi` ride flag off [`Player::server_riding`].
 /// Diffed against `Local` memory, the trainer/merchant feed shape.
-#[allow(clippy::too_many_arguments)]
 fn feed_taxi(
     script: Option<NonSendMut<UiScript>>,
     mut state: ResMut<TaxiState>,
     catalogs: Option<Res<TaxiCatalogs>>,
     player: Res<Player>,
-    mut names: ResMut<NameCache>,
+    names: Res<NameCache>,
     commands: Res<NetCommands>,
     mut cache: ResMut<TaxiRouteCache>,
     mut last: Local<crate::ui_script::VmMemo<Option<TaxiUiState>>>,
@@ -338,7 +337,7 @@ impl Plugin for UiTaxiPlugin {
                     // frame; push before the input pass so an open/close is on screen the same
                     // frame; drain after it (mirrors ui_merchant/ui_trainer).
                     close_npc_session_out_of_range::<TaxiState>.before(feed_taxi),
-                    feed_taxi.before(UiInput),
+                    feed_taxi.in_set(UiFeed),
                     drain_taxi.after(UiInput),
                 ),
             );
diff --git a/crates/benilla-app/src/ui_text/layout/mod.rs b/crates/benilla-app/src/ui_text/layout/mod.rs
index ff3a911b..50c35b2b 100644
--- a/crates/benilla-app/src/ui_text/layout/mod.rs
+++ b/crates/benilla-app/src/ui_text/layout/mod.rs
@@ -201,7 +201,6 @@ pub(crate) struct LinkSpan {
 /// line block vertically (default `Middle`, the client's FontString default; degenerate zero-height
 /// rects keep top). Each line is measured once (a first pass laying glyphs at a zero line-origin),
 /// then shifted by the justification offset.
-#[allow(clippy::too_many_arguments)] // the shared layout context, plus the seat
 pub(crate) fn layout_text_quads(
     e: &mut TextEngine,
     text: &str,
@@ -218,7 +217,6 @@ pub(crate) fn layout_text_quads(
 /// [`layout_text_quads`] that also collects the laid-out [`LinkSpan`]s — the message-frame path
 /// (chat lines carry `|H` item/player links; the app feeds the spans back to the engine's click
 /// hit-test, `benilla_ui::script::UiScript::set_link_spans`).
-#[allow(clippy::too_many_arguments)] // the shared layout context, plus one out-param
 pub(crate) fn layout_text_quads_links(
     e: &mut TextEngine,
     text: &str,
@@ -243,7 +241,6 @@ pub(crate) fn layout_text_quads_links(
     )
 }
 
-#[allow(clippy::too_many_arguments)] // the public pair above is the real surface; this is their body
 fn layout_text_quads_inner(
     e: &mut TextEngine,
     text: &str,
diff --git a/crates/benilla-app/src/ui_tooltip/mod.rs b/crates/benilla-app/src/ui_tooltip/mod.rs
index 37952b12..797aab59 100644
--- a/crates/benilla-app/src/ui_tooltip/mod.rs
+++ b/crates/benilla-app/src/ui_tooltip/mod.rs
@@ -25,7 +25,6 @@ use crate::target::{
     go_is_nearest, ring_reaction, Hovered, HoveredObject, GO_FLAG_LOCKED, GO_TYPE_GENERIC,
 };
 use crate::ui_action::{PlayerActions, Spells};
-use crate::ui_script::UiInput;
 use crate::ui_unit::{enrich_unit, snapshot, UnitFeed};
 
 pub struct UiTooltipPlugin;
@@ -35,8 +34,8 @@ impl Plugin for UiTooltipPlugin {
         app.add_systems(
             Update,
             (
-                drive_mouseover_tooltip.in_set(UnitFeed).before(UiInput),
-                feed_spell_tooltips.in_set(UnitFeed).before(UiInput),
+                drive_mouseover_tooltip.in_set(UnitFeed),
+                feed_spell_tooltips.in_set(UnitFeed),
             ),
         );
     }
@@ -60,6 +59,9 @@ struct ViewCtx<'a> {
     items: &'a mut Items,
     commands: &'a NetCommands,
     sub_classes: Option<&'a benilla_formats::ItemSubClassCatalog>,
+    /// The talent spell-modifier tables — the cost cell shows the RESOLVED cost, which since
+    /// `SPELLMOD_COST` landed means the modified one (`crate::ui_action::usable::power_cost`).
+    spell_mods: &'a crate::spell_mods::SpellModifiers,
     /// The VM's own `GlobalStrings.lua` (decision 2045) — every cell this builder composes is a
     /// key, and this is where they resolve. `text` is the `%d`-filling twin the `$`-engine's
     /// keyed tokens take (`benilla_formats::TokenContext::text`).
@@ -118,9 +120,9 @@ fn spell_tooltip_view(
     // replaces was unfaithful (B152). No store (a DBC-only view) degrades to the flat cost.
     // HAPPINESS_COST has no GlobalStrings entry and no 5875 player spell reaches powerType 4;
     // the unit word is a dead arm kept for the array's shape.
-    let resolved_cost = vctx
-        .store
-        .map_or(d.mana_cost, |s| crate::ui_action::usable::power_cost(d, s));
+    let resolved_cost = vctx.store.map_or(d.mana_cost, |s| {
+        crate::ui_action::usable::power_cost(d, s, vctx.spell_mods)
+    });
     let cost = {
         // The one `0x6e7130` table, not a local `if power_type == 1` — decision 2117 found three
         // hand-rolled copies of it and one of them had been applied at a single site out of four.
@@ -422,7 +424,6 @@ struct SpellFeedMemory {
 /// display + next-rank reads), and the live aura spells (`SetPlayerBuff`) — so a first hover
 /// never misses, exactly like the reference's all-local reads. The renderers' recorded asks
 /// (the odd id outside those sets) answer through the same build as the fallback.
-#[allow(clippy::too_many_arguments)]
 fn feed_spell_tooltips(
     script: Option<NonSendMut<UiScript>>,
     actions: Option<Res<PlayerActions>>,
@@ -438,10 +439,17 @@ fn feed_spell_tooltips(
     home_bind: Option<Res<crate::net::HomeBind>>,
     area_names: Option<Res<crate::ui_quest_log::QuestHeaderNamesRes>>,
     mut items: ResMut<Items>,
-    sub_classes: Option<Res<crate::ui_items::ItemSubClasses>>,
+    // One tuple param (Bevy's 16-SystemParam ceiling): the two lookups the view builder reads
+    // straight through — the item sub-class names for the required-item line, and the talent
+    // spell-modifier tables the cost cell resolves through.
+    lookups: (
+        Option<Res<crate::ui_items::ItemSubClasses>>,
+        Res<crate::spell_mods::SpellModifiers>,
+    ),
     commands: Res<NetCommands>,
     mut memory: Local<crate::ui_script::VmMemo<SpellFeedMemory>>,
 ) {
+    let (sub_classes, spell_mods) = &lookups;
     let Some(mut script) = script else {
         return;
     };
@@ -567,6 +575,14 @@ fn feed_spell_tooltips(
         memory.combat_reach = Some(reaches);
         wanted.extend(memory.pushed.drain());
     }
+    // …and so does the cost cell, whose resolved number now goes through the talent
+    // spell-modifier tables: a respec changes what every affected spell costs, and this feed is
+    // the one consumer of `power_cost` that memoizes its build (the action bar recomputes every
+    // frame). The reference has no cache here at all — it reads the tables live at every call
+    // site — so this is what keeps the cell honest about the same change (`crate::spell_mods`).
+    if spell_mods.is_changed() {
+        wanted.extend(memory.pushed.drain());
+    }
     let watched: Vec<u32> = memory.reagents.keys().copied().collect();
     let reagent_state: std::collections::BTreeMap<u32, (u32, bool)> = watched
         .into_iter()
@@ -598,6 +614,7 @@ fn feed_spell_tooltips(
             items: &mut items,
             commands: &commands,
             sub_classes: sub_classes.as_deref().map(|c| &c.0),
+            spell_mods,
             get: &get,
             text: &text,
         };
@@ -697,7 +714,6 @@ fn locked_line_tint(outcome: Option<crate::target::lock::LockOutcome>) -> Toolti
     }
 }
 
-#[allow(clippy::too_many_arguments)]
 fn drive_mouseover_tooltip(
     script: Option<NonSendMut<UiScript>>,
     hovered: Res<Hovered>,
@@ -708,7 +724,7 @@ fn drive_mouseover_tooltip(
     // The stored GAMEOBJECT_STATE the lock lines' Action gate reads (decision 0752).
     anims: Query<&crate::go_anim::GoAnim>,
     self_q: Query<&ObjectStore, With<SelfPlayer>>,
-    mut names: ResMut<NameCache>,
+    names: Res<NameCache>,
     commands: Res<NetCommands>,
     // The standing pair as one param — see [`crate::target::ReactionInputs`]. Bundled here and
     // not elsewhere because this system sits on Bevy's tuple limit.
@@ -717,7 +733,7 @@ fn drive_mouseover_tooltip(
     // hover and the click can never disagree about whether a lock is satisfiable — the same reason
     // `usable` and the click share one resolver (0752). Carries the go-template, Lock.dbc and
     // item caches this system used to take as three separate params.
-    mut go_inputs: crate::target::lock::GoLockInputs,
+    go_inputs: crate::target::lock::GoLockInputs,
     // The known-spell set the resolver's SKILL arm scans.
     player_actions: Res<crate::ui_action::PlayerActions>,
     // The cursor seat crosses the VM seam (0582/0584): the anchor below is UI units, not px.
@@ -845,22 +861,30 @@ fn drive_mouseover_tooltip(
         // distinction the director's two reference observations agree on — a **GENERIC(5)**
         // signpost follows the cursor, an interactable GameObject sits in the corner.
         //
-        // Not merely a guess-shaped proxy: after 0762 the only objects that are eligible for a
-        // tooltip *and* never highlightable are GENERIC ones, so "GENERIC" and "not interactable"
-        // pick out the same set here. They diverge only for the three always-eligible types
-        // (SPELL_FOCUS 8 / DUEL_ARBITER 16 / FISHINGHOLE 25), which is exactly where a pin would
-        // settle it. Flagged INTERIM in 0766 rather than presented as verified.
+        // 0766 keyed this on "is it GENERIC(5)" and said plainly that it was a proxy: the real
+        // client asks the object's own `[vtbl+0x5c]`, and what selects it was not then pinned.
+        // **It is pinned now, and it is narrower** (decision 2259): `[vtbl+0x5c]` is `0x5f8630`,
+        // whose body is `template.data[0x621b00(type, semantic 0x13)] != 0`, and key `0x13`
+        // resolves for exactly ONE of the 31 GO types — GENERIC(5), at `data[0]`. Every other type
+        // gets `-1` back and `0x5f8150`'s unsigned bound turns that into FALSE.
         //
-        // **THE PIN HAS ARRIVED, AND IT IS NARROWER THAN THIS LINE** (2255): `[vtbl+0x5c]` is
-        // `0x5f8630` = `template.data[0x621b00(type, 0x13)] != 0`, and semantic key `0x13` exists
-        // on exactly ONE of the 31 types — GENERIC(5), at `data[0]`. So the cursor arm is "GENERIC
-        // **with `data[0]` set**", and a GENERIC with it clear is corner-seated; the three
-        // always-eligible types above are corner-seated too, so 0766's "GENERIC" reading wins over
-        // its "not interactable" one. Applying it moves 190 of the 1387 hoverable type-5 templates
-        // from the cursor to the corner — a visible change, so it is its own slice and not a
-        // passenger on a bug fix (2255 carries the counts and the reasoning).
-        let cursor_seated =
-            stores.get(entity).map(|s| s.0.gameobject_type_id()) == Ok(GO_TYPE_GENERIC);
+        // So the cursor arm is **GENERIC with `data[0]` set**, and a GENERIC with it clear is
+        // corner-seated like everything else. That also settles 0766's named divergence: the three
+        // always-eligible types (SPELL_FOCUS 8 / DUEL_ARBITER 16 / FISHINGHOLE 25) carry no key
+        // `0x13`, so all three are corner-seated — 0766's "GENERIC" reading wins over its "not
+        // interactable" one.
+        //
+        // **`data[0]` is not `data[1]`.** The neighbouring slot is the mouseover-ELIGIBILITY column
+        // (0762, semantic `0x12`, `0x5f4830`), and the two answer different questions: `data[1]`
+        // says whether the object is hoverable at all, `data[0]` only says *where its plate sits*.
+        // 342 of the 447 type-5 entries in the reference's own `gameobjectcache.wdb` carry both;
+        // the objects that differ are hoverable and corner-seated, not silent.
+        let cursor_seated = stores.get(entity).map(|s| s.0.gameobject_type_id())
+            == Ok(GO_TYPE_GENERIC)
+            && go_inputs
+                .templates
+                .get(guid)
+                .is_some_and(|t| t.floating_tooltip);
         // Window px → the VM's y-up 768-virtual units (÷s, the input seam's own conversion) —
         // the anchor this point seats is resolved in UI units, so a raw-px point lands the
         // plate (s−1)× the cursor's distance from the bottom-left corner away from it.
diff --git a/crates/benilla-app/src/ui_tooltip/tests.rs b/crates/benilla-app/src/ui_tooltip/tests.rs
index 808dfe8c..d19a2e01 100644
--- a/crates/benilla-app/src/ui_tooltip/tests.rs
+++ b/crates/benilla-app/src/ui_tooltip/tests.rs
@@ -19,6 +19,9 @@ struct TestCtx {
     /// glue tests onto the loader's own assembly.
     get: Box<Getter>,
     text: Box<Filler>,
+    /// Empty tables, which is the un-talented character every cell here is graded as: the cost
+    /// cell's modifier hop must be the identity when nothing has been sent.
+    spell_mods: crate::spell_mods::SpellModifiers,
 }
 
 /// The two lookup shapes, named so the harness's fields read.
@@ -36,6 +39,7 @@ impl TestCtx {
             commands: NetCommands(tx),
             _rx: rx,
             get: Box::new(move |key| benilla_ui::strings::global(for_get.lua(), key)),
+            spell_mods: crate::spell_mods::SpellModifiers::default(),
             text: Box::new(move |key, args: &[i64]| {
                 let template = benilla_ui::strings::global(for_text.lua(), key)?;
                 let args: Vec<_> = args
@@ -85,6 +89,7 @@ impl TestCtx {
             items: &mut self.items,
             commands: &self.commands,
             sub_classes,
+            spell_mods: &self.spell_mods,
             get: self.get.as_ref(),
             text: self.text.as_ref(),
         }
diff --git a/crates/benilla-app/src/ui_trade.rs b/crates/benilla-app/src/ui_trade.rs
index ddf001de..f3948210 100644
--- a/crates/benilla-app/src/ui_trade.rs
+++ b/crates/benilla-app/src/ui_trade.rs
@@ -57,7 +57,7 @@ use crate::names::NameCache;
 use crate::net::{ClientCommand, GuidIndex, NetCommands, ObjectStore, SelfPlayer};
 use crate::target::Selection;
 use crate::ui_party::GroupState;
-use crate::ui_script::UiInput;
+use crate::ui_script::{UiFeed, UiInput};
 use crate::ui_session::NpcSession;
 
 /// One side's offer as the wire delivered it — the seven slots (index 0 = trade slot 1 … index 6 =
@@ -492,8 +492,16 @@ impl NpcSession for TradeSession {
 
 pub(crate) struct UiTradePlugin;
 
+/// Block Trades' change callback (1764, 2303): a flag.
+pub(crate) fn on_cvar(ev: On<crate::cvars::CvarChanged>, mut block: ResMut<BlockTrades>) {
+    if ev.is("BlockTrades") {
+        block.0 = ev.flag();
+    }
+}
+
 impl Plugin for UiTradePlugin {
     fn build(&self, app: &mut App) {
+        app.add_observer(on_cvar);
         app.init_resource::<TradeSession>()
             .init_resource::<BlockTrades>()
             .add_systems(
@@ -504,7 +512,7 @@ impl Plugin for UiTradePlugin {
                     // the same frame (the ui_mail ordering exactly). After the UnitFeed set so the
                     // resolved item-template store is landed. No range-guard registration — a
                     // trade's cancel is server-driven (the module doc).
-                    feed_trade.after(crate::ui_unit::UnitFeed).before(UiInput),
+                    feed_trade.after(crate::ui_unit::UnitFeed).in_set(UiFeed),
                     // The incoming request's answer needs no VM at all — it is wire policy over
                     // engine state — so it sits ahead of the feed, and an accepted request's
                     // `partner` is on screen the same frame the window opens.
@@ -594,11 +602,10 @@ fn streamed_player<'a>(
     index.0.get(&guid).and_then(|e| stores.get(*e).ok())
 }
 
-#[allow(clippy::too_many_arguments)]
 fn answer_trade_request(
     mut trade: ResMut<TradeSession>,
     commands: Res<NetCommands>,
-    mut names: ResMut<NameCache>,
+    names: Res<NameCache>,
     mut errors: ResMut<crate::ui_action::UiErrorKeys>,
     social: Res<crate::ui_social::SocialState>,
     cinematic: Res<crate::cinematic::Cinematic>,
@@ -720,7 +727,7 @@ fn answer_trade_request(
 /// is decision 0592 P3.
 fn resolve_slot(
     item: &TradeItem,
-    items: &mut Items,
+    items: &Items,
     icons: Option<&ItemDisplays>,
     commands: &NetCommands,
 ) -> TradeSlotItem {
@@ -756,7 +763,7 @@ fn own_item_at(
     bag: i64,
     slot: u32,
     store: Option<&ObjectStore>,
-    items: &mut Items,
+    items: &Items,
     commands: &NetCommands,
 ) -> Option<TradeItem> {
     let (guid, count) = crate::ui_items::slot_guid_count(store, bag, slot, items);
@@ -788,7 +795,7 @@ fn own_item_at(
 /// Resolve one side's wire offer into the Lua-facing side state.
 fn resolve_side(
     offer: &TradeOffer,
-    items: &mut Items,
+    items: &Items,
     icons: Option<&ItemDisplays>,
     commands: &NetCommands,
 ) -> TradeSideState {
@@ -805,9 +812,9 @@ fn resolve_side(
 /// Build the Lua-facing snapshot from [`TradeSession`] — `None` when no trade window is open.
 fn snapshot(
     trade: &TradeSession,
-    items: &mut Items,
+    items: &Items,
     icons: Option<&ItemDisplays>,
-    names: &mut NameCache,
+    names: &NameCache,
     commands: &NetCommands,
 ) -> Option<TradeState> {
     if !trade.open {
@@ -827,13 +834,12 @@ fn snapshot(
 /// against `Local` memory, exactly like the mail/merchant feeds. The accept-update fires **after** the
 /// show/update block so an open frame's `TRADE_SHOW` (which hides the highlights) is followed by the
 /// glow, not overwritten by it.
-#[allow(clippy::too_many_arguments)]
 fn feed_trade(
     script: Option<NonSendMut<UiScript>>,
     mut trade: ResMut<TradeSession>,
-    mut items: ResMut<Items>,
+    items: Res<Items>,
     icons: Option<Res<ItemDisplays>>,
-    mut names: ResMut<NameCache>,
+    names: Res<NameCache>,
     commands: Res<NetCommands>,
     mut errors: ResMut<crate::ui_action::UiErrorKeys>,
     // The status arms' second guard (`0x468460(guid, TYPEMASK_PLAYER)`) — see
@@ -855,7 +861,7 @@ fn feed_trade(
     let last_player_gold = last_player_gold.get(&script);
     let last_their_gold = last_their_gold.get(&script);
 
-    let fresh = snapshot(&trade, &mut items, icons.as_deref(), &mut names, &commands);
+    let fresh = snapshot(&trade, &items, icons.as_deref(), &names, &commands);
     let opened = !*last_open && trade.is_open();
     let closed = *last_open && !trade.is_open();
     let changed = fresh != *last;
@@ -979,14 +985,13 @@ fn feed_trade(
 /// the token → player guid → `CMSG_INITIATE_TRADE` (recording the target so `OPEN_WINDOW` can name
 /// it); `AcceptTrade`/`CancelTradeAccept` → the accept/un-accept verbs (with the optimistic local
 /// glow); `CloseTrade` → `CMSG_CANCEL_TRADE` + a local clear.
-#[allow(clippy::too_many_arguments)]
 fn drain_trade(
     script: Option<NonSendMut<UiScript>>,
     mut trade: ResMut<TradeSession>,
     commands: Res<NetCommands>,
     selection: Res<Selection>,
     group: Res<GroupState>,
-    mut items: ResMut<Items>,
+    items: Res<Items>,
     self_q: Query<&ObjectStore, With<SelfPlayer>>,
 ) {
     let Some(mut script) = script else {
@@ -1043,7 +1048,7 @@ fn drain_trade(
         if let Some(trade_slot) = id.checked_sub(1).and_then(|n| u8::try_from(n).ok()) {
             // Optimistic own display: vmangos echoes the placement only to the partner, so resolve the
             // bag item and fill our own column client-side (decision 0592 P2).
-            if let Some(item) = own_item_at(bag, slot, store, &mut items, &commands) {
+            if let Some(item) = own_item_at(bag, slot, store, &items, &commands) {
                 trade.place_own_item(id, item);
             }
             info!(target: "trade", "set item: slot {id} <- bag {bag}/{slot} (wire {wire_bag}/{wire_slot}); sending CMSG_SET_TRADE_ITEM");
diff --git a/crates/benilla-app/src/ui_tradeskill.rs b/crates/benilla-app/src/ui_tradeskill.rs
index 86bc3646..da98230a 100644
--- a/crates/benilla-app/src/ui_tradeskill.rs
+++ b/crates/benilla-app/src/ui_tradeskill.rs
@@ -96,7 +96,7 @@ impl Plugin for UiTradeSkillPlugin {
                     // the same frame; the feed pushes before the input pass (the trainer's order);
                     // the drain + repeat machine run after it so a Create click casts this frame.
                     open_trade_skill.before(feed_trade_skill),
-                    feed_trade_skill.in_set(UnitFeed).before(UiInput),
+                    feed_trade_skill.in_set(UnitFeed),
                     drain_trade_skill.after(UiInput),
                 ),
             );
@@ -227,7 +227,7 @@ pub(crate) fn difficulty(rank: u32, low: u32, high: u32) -> TradeSkillDifficulty
 fn recipe_icon(
     d: &benilla_formats::SpellDisplay,
     icons: Option<&ItemDisplays>,
-    items: &mut Items,
+    items: &Items,
     commands: &NetCommands,
 ) -> Option<String> {
     let item = d.effect_item_type[0];
@@ -240,7 +240,6 @@ fn recipe_icon(
 
 /// Build one recipe row: reagents/tools/product resolved through the ask-once template cache
 /// (`None` names re-resolve next frame when the template lands — the item-row precedent).
-#[allow(clippy::too_many_arguments)] // the resolver's full catalog set
 fn resolve_recipe(
     spell_id: u32,
     rank: u32,
@@ -250,7 +249,7 @@ fn resolve_recipe(
     icons: Option<&ItemDisplays>,
     subclasses: Option<&crate::ui_items::ItemSubClasses>,
     store: &ObjectStore,
-    items: &mut Items,
+    items: &Items,
     commands: &NetCommands,
     cooldowns: &crate::cooldowns::Cooldowns,
     now: Instant,
@@ -365,7 +364,6 @@ fn resolve_recipe(
 /// Build the book: the known attr-`0x20` recipes of the open line, difficulty-banded against the
 /// current rank. No sort applied here — the engine owns ALL ordering (group + tier + name, the
 /// VERIFIED two-level law, decision 0446 wow-re `tradeskill` TU-B).
-#[allow(clippy::too_many_arguments)] // a Bevy system's full input set (the feed precedent)
 fn feed_trade_skill(
     script: Option<NonSendMut<UiScript>>,
     open: Res<TradeSkillOpen>,
@@ -377,7 +375,7 @@ fn feed_trade_skill(
     subclasses: Option<Res<crate::ui_items::ItemSubClasses>>,
     repeat: Res<TradeSkillRepeat>,
     self_store: Query<&ObjectStore, With<SelfPlayer>>,
-    mut items: ResMut<Items>,
+    items: Res<Items>,
     commands: Res<NetCommands>,
     cooldowns: Res<crate::cooldowns::Cooldowns>,
     mut last: Local<crate::ui_script::VmMemo<Option<TradeSkillState>>>,
@@ -418,7 +416,7 @@ fn feed_trade_skill(
                     icons.as_deref(),
                     subclasses.as_deref(),
                     store,
-                    &mut items,
+                    &items,
                     &commands,
                     &cooldowns,
                     now,
@@ -585,7 +583,7 @@ mod tests {
         let icons = landed_item(&mut deps);
         let d = recipe(SPELL_EFFECT_CREATE_ITEM, 777);
         assert_eq!(
-            recipe_icon(&d, Some(&icons), &mut deps.items, &deps.commands),
+            recipe_icon(&d, Some(&icons), &deps.items, &deps.commands),
             Some("ITEM".into()),
         );
     }
@@ -600,7 +598,7 @@ mod tests {
         let icons = landed_item(&mut deps);
         let d = recipe(SPELL_EFFECT_ENCHANT_ITEM, 777);
         assert_eq!(
-            recipe_icon(&d, Some(&icons), &mut deps.items, &deps.commands),
+            recipe_icon(&d, Some(&icons), &deps.items, &deps.commands),
             Some("ITEM".into()),
         );
     }
@@ -616,24 +614,24 @@ mod tests {
         // EffectItemType[0] == 0: 0x55ba30 short-circuits on a zero id before hashing.
         let none = recipe(SPELL_EFFECT_ENCHANT_ITEM, 0);
         assert_eq!(
-            recipe_icon(&none, Some(&icons), &mut deps.items, &deps.commands),
+            recipe_icon(&none, Some(&icons), &deps.items, &deps.commands),
             None,
         );
 
         // A template that never lands (the async row) — nil, and the ask goes out exactly once.
         let missing = recipe(SPELL_EFFECT_CREATE_ITEM, 999);
         assert_eq!(
-            recipe_icon(&missing, Some(&icons), &mut deps.items, &deps.commands),
+            recipe_icon(&missing, Some(&icons), &deps.items, &deps.commands),
             None,
         );
         assert_eq!(
-            recipe_icon(&missing, Some(&icons), &mut deps.items, &deps.commands),
+            recipe_icon(&missing, Some(&icons), &deps.items, &deps.commands),
             None,
         );
         assert_eq!(deps.queried_entries(), vec![999], "ask-once, not ask-often");
 
         // The template landed but ItemDisplayInfo is unresolved — still nil, still not "SPELL".
         let d = recipe(SPELL_EFFECT_CREATE_ITEM, 777);
-        assert_eq!(recipe_icon(&d, None, &mut deps.items, &deps.commands), None);
+        assert_eq!(recipe_icon(&d, None, &deps.items, &deps.commands), None);
     }
 }
diff --git a/crates/benilla-app/src/ui_trainer/law.rs b/crates/benilla-app/src/ui_trainer/law.rs
index 36d62246..eeb8f02f 100644
--- a/crates/benilla-app/src/ui_trainer/law.rs
+++ b/crates/benilla-app/src/ui_trainer/law.rs
@@ -57,7 +57,7 @@ pub(super) fn service_icon(
     trainer_type: u32,
     spells: &SpellCatalog,
     icons: Option<&ItemDisplays>,
-    items: &mut Items,
+    items: &Items,
     commands: &NetCommands,
 ) -> Option<String> {
     let wire = spells.get(wire_spell)?;
diff --git a/crates/benilla-app/src/ui_trainer/mod.rs b/crates/benilla-app/src/ui_trainer/mod.rs
index aaec197f..a9240c20 100644
--- a/crates/benilla-app/src/ui_trainer/mod.rs
+++ b/crates/benilla-app/src/ui_trainer/mod.rs
@@ -38,7 +38,7 @@ use crate::items::Items;
 use crate::names::NameCache;
 use crate::net::{ClientCommand, NetCommands};
 use crate::ui_action::{PlayerActions, Spells};
-use crate::ui_script::UiInput;
+use crate::ui_script::{UiFeed, UiInput};
 use crate::ui_session::{close_npc_session_out_of_range, npc_switched, NpcSession};
 use crate::ui_spellbook::SkillLines;
 
@@ -143,7 +143,7 @@ impl Plugin for UiTrainerPlugin {
                     // push before the input pass so an open/close is on screen the same frame; drain
                     // after it (mirrors ui_merchant/ui_gossip).
                     close_npc_session_out_of_range::<TrainerOpen>.before(feed_trainer),
-                    feed_trainer.before(UiInput),
+                    feed_trainer.in_set(UiFeed),
                     drain_trainer.after(UiInput),
                 ),
             );
@@ -186,7 +186,6 @@ fn train_error_log_line(code: u32) -> &'static str {
 /// the ability-req names + rank from the same spell catalog, the state/cost/gates straight off the
 /// wire. `known` is the player's known-spell set ([`PlayerActions::spells`]) — each prerequisite
 /// ability is coloured by whether the player already knows that specific spell (see below).
-#[allow(clippy::too_many_arguments)] // the resolver's full catalog set
 fn resolve_service(
     wire: &TrainerSpell,
     trainer_type: u32,
@@ -194,7 +193,7 @@ fn resolve_service(
     skill_lines: Option<&SkillLineCatalog>,
     known: &BTreeSet<u32>,
     icons: Option<&ItemDisplays>,
-    items: &mut Items,
+    items: &Items,
     commands: &NetCommands,
     // The VM's own `GlobalStrings.lua`, for [`service_group`]'s three header labels.
     get: &dyn Fn(&str) -> Option<String>,
@@ -305,14 +304,13 @@ fn resolve_service(
 
 /// Build the Lua-facing snapshot from [`TrainerOpen`] + the spell/skill catalogs — `None` when no
 /// trainer is open.
-#[allow(clippy::too_many_arguments)] // the catalogs, the player's state, and the string table
 fn snapshot(
     open: &TrainerOpen,
     spells: &SpellCatalog,
     skill_lines: Option<&SkillLineCatalog>,
     known: &BTreeSet<u32>,
     icons: Option<&ItemDisplays>,
-    items: &mut Items,
+    items: &Items,
     commands: &NetCommands,
     get: &dyn Fn(&str) -> Option<String>,
 ) -> Option<TrainerState> {
@@ -347,7 +345,6 @@ fn snapshot(
 /// content change). Diffed against a `Local` memory, exactly like the gossip/merchant feeds. A
 /// different trainer while the window is already open is a real close+open (the client's `ShowUIPanel`
 /// early-returns when visible, so the open sound only re-plays after a hide — decision 0096).
-#[allow(clippy::too_many_arguments)]
 fn feed_trainer(
     script: Option<NonSendMut<UiScript>>,
     // ResMut only to consume the fresh-packet latch below — the feed never authors trainer content.
@@ -358,10 +355,10 @@ fn feed_trainer(
     // A tradeskill trainer's rows front the CREATED ITEM's icon, so the feed needs the ask-once
     // template cache + `ItemDisplayInfo.dbc` — the tradeskill window's own pair ([`service_icon`]).
     icons: Option<Res<ItemDisplays>>,
-    mut items: ResMut<Items>,
+    items: Res<Items>,
     mut errors: ResMut<TrainerErrors>,
     commands: Res<NetCommands>,
-    mut names: ResMut<NameCache>,
+    names: Res<NameCache>,
     mut last: Local<crate::ui_script::VmMemo<Option<TrainerState>>>,
     mut last_trainer: Local<crate::ui_script::VmMemo<Option<u64>>>,
     mut last_name: Local<crate::ui_script::VmMemo<Option<String>>>,
@@ -403,7 +400,7 @@ fn feed_trainer(
         Some(&skill_lines.catalog),
         &actions.spells,
         icons.as_deref(),
-        &mut items,
+        &items,
         &commands,
         &|key: &str| {
             script
diff --git a/crates/benilla-app/src/ui_trainer/tests.rs b/crates/benilla-app/src/ui_trainer/tests.rs
index cde15bee..481b5e3a 100644
--- a/crates/benilla-app/src/ui_trainer/tests.rs
+++ b/crates/benilla-app/src/ui_trainer/tests.rs
@@ -43,7 +43,7 @@ fn resolve_service(
     skill_lines: Option<&SkillLineCatalog>,
     known: &BTreeSet<u32>,
 ) -> TrainerService {
-    let mut deps = Deps::new();
+    let deps = Deps::new();
     super::resolve_service(
         wire,
         trainer_type,
@@ -51,7 +51,7 @@ fn resolve_service(
         skill_lines,
         known,
         None,
-        &mut deps.items,
+        &deps.items,
         &deps.commands,
         &probe_strings,
     )
@@ -73,14 +73,14 @@ fn wire(spell: u32, state: u8, cost: u32, req_level: u8, req_skill: u32) -> Trai
 
 /// [`snapshot`] with the icon trio defaulted.
 fn snap(open: &TrainerOpen, spells: &SpellCatalog) -> Option<TrainerState> {
-    let mut deps = Deps::new();
+    let deps = Deps::new();
     snapshot(
         open,
         spells,
         None,
         &BTreeSet::new(),
         None,
-        &mut deps.items,
+        &deps.items,
         &deps.commands,
         &probe_strings,
     )
@@ -134,7 +134,7 @@ fn icon_of(
         trainer_type,
         spells,
         icons.as_ref(),
-        &mut deps.items,
+        &deps.items,
         &deps.commands,
     )
 }
@@ -222,7 +222,7 @@ fn trainer_icon_scans_every_effect_slot_for_either_learn_effect() {
 #[test]
 fn trainer_icon_is_nil_until_the_product_template_lands_and_asks_once() {
     let spells = icon_catalog();
-    let mut deps = Deps::new();
+    let deps = Deps::new();
     let icons = ItemDisplays::icons_for_tests(ItemDisplayCatalog::from_displays(HashMap::new()));
 
     let first = service_icon(
@@ -230,7 +230,7 @@ fn trainer_icon_is_nil_until_the_product_template_lands_and_asks_once() {
         TRAINER_TYPE_TRADESKILL,
         &spells,
         Some(&icons),
-        &mut deps.items,
+        &deps.items,
         &deps.commands,
     );
     assert_eq!(first, None, "no template yet → nil, not the wrapper's icon");
@@ -246,7 +246,7 @@ fn trainer_icon_is_nil_until_the_product_template_lands_and_asks_once() {
         TRAINER_TYPE_TRADESKILL,
         &spells,
         Some(&icons),
-        &mut deps.items,
+        &deps.items,
         &deps.commands,
     );
     assert!(
@@ -276,14 +276,14 @@ fn trainer_icon_on_real_data_reaches_for_the_crafted_item() {
 
     // A tradeskill trainer: gate 3 fires for item 2847 and the icon waits on the template —
     // crucially it is NOT the crown.
-    let mut deps = Deps::new();
+    let deps = Deps::new();
     let icons = ItemDisplays::icons_for_tests(ItemDisplayCatalog::from_displays(HashMap::new()));
     let icon = service_icon(
         2756,
         TRAINER_TYPE_TRADESKILL,
         &spells,
         Some(&icons),
-        &mut deps.items,
+        &deps.items,
         &deps.commands,
     );
     assert_eq!(
@@ -297,8 +297,8 @@ fn trainer_icon_on_real_data_reaches_for_the_crafted_item() {
     );
 
     // A class trainer with the same wire spell: the wrapper's own icon, not the recipe's.
-    let mut deps = Deps::new();
-    let class_icon = service_icon(2756, 0, &spells, None, &mut deps.items, &deps.commands);
+    let deps = Deps::new();
+    let class_icon = service_icon(2756, 0, &spells, None, &deps.items, &deps.commands);
     assert_eq!(class_icon, wrapper_icon);
     assert_ne!(
         class_icon, recipe_icon,
@@ -596,9 +596,9 @@ fn tooltip_hops_to_the_taught_spell_where_the_icon_pins_the_wire() {
     );
     // The icon law, same row, same catalog: the WIRE spell's own art. Pinned together so the
     // disagreement is visible in one place and can't be "fixed" into agreement.
-    let mut deps = Deps::new();
+    let deps = Deps::new();
     assert_eq!(
-        super::service_icon(100, 0, &spells, None, &mut deps.items, &deps.commands),
+        super::service_icon(100, 0, &spells, None, &deps.items, &deps.commands),
         Some("WRAPPER".into()),
     );
 }
diff --git a/crates/benilla-app/src/ui_unit.rs b/crates/benilla-app/src/ui_unit.rs
index 95f23c9e..7747952c 100644
--- a/crates/benilla-app/src/ui_unit.rs
+++ b/crates/benilla-app/src/ui_unit.rs
@@ -34,17 +34,23 @@ use benilla_protocol::messages::ObjectType;
 use benilla_ui::script::{power_token, ScriptValue, UiScript, UnitState, WornDisplay};
 
 use crate::names::NameCache;
-use crate::net::{Guid, NetCommands, ObjectStore, Reputations, SelfPlayer};
+use crate::net::{
+    FieldChanged, FieldEdges, Guid, NetCommands, ObjectStore, Reputations, SelfPlayer,
+};
 use crate::target::{ring_reaction, Factions, Selection};
 use crate::ui_script::{gate, UiInput};
 
-/// The feed pass — runs **after [`benilla_world::schedule::WorldStage::Net`]** (the feeds snapshot state
-/// the net apply writes; unordered, `apply_net_updates` could land BETWEEN two feeds, and a
-/// synchronous event fired by the later one then re-read the earlier one's pre-mutation push —
-/// the spellbook's cooldown pie stayed cold until a manual reopen, reproduced live 2026-07-31)
-/// and before [`UiInput`], so the snapshot + events it produces are in place when the VM ticks
-/// and dispatches this frame. A named set so the demo override ([`crate::ui_script`]) can order
-/// itself after it. Configured in [`UiUnitPlugin`] — the set's home.
+/// The unit-feed pass — the GATED sub-phase of [`crate::ui_script::UiFeed`], which carries the
+/// order: after [`benilla_world::schedule::WorldStage::Net`] and before [`UiInput`], so the
+/// snapshot + events it produces are in place when the VM ticks and dispatches this frame. That
+/// order was found here first (the feeds snapshot state the net apply writes; unordered,
+/// `apply_net_updates` could land BETWEEN two feeds, and a synchronous event fired by the later
+/// one then re-read the earlier one's pre-mutation push — the spellbook's cooldown pie stayed
+/// cold until a manual reopen, reproduced live 2026-07-31), and decision 2304 made it every
+/// feed's. What stays this set's own is the gate: every member either fires a login one-shot or
+/// latches a per-VM memo, so none may run before the in-game interface exists (1348). A named
+/// set so the demo override ([`crate::ui_script`]) can order itself after it. Configured in
+/// [`UiUnitPlugin`] — the set's home.
 #[derive(SystemSet, Debug, Clone, Copy, PartialEq, Eq, Hash)]
 pub(crate) struct UnitFeed;
 
@@ -251,7 +257,8 @@ impl Plugin for UiUnitPlugin {
         app.configure_sets(
             Update,
             UnitFeed
-                .after(benilla_world::schedule::WorldStage::Net) // the set's own doc: the why
+                // A sub-phase of the feed phase, which carries the order (the set's own doc)…
+                .in_set(crate::ui_script::UiFeed)
                 // …and never before the in-game UI exists (1348). The whole SET, not just
                 // `feed_units`: every feed in it either fires a login one-shot or latches a
                 // per-VM memo, and both are lost forever against the boot VM. The window and
@@ -274,6 +281,7 @@ impl Plugin for UiUnitPlugin {
         // nothing. (1348's own `the_login_one_shots_wait_for_the_in_game_ui` is the harness that
         // found this — it builds this plugin alone.)
         .add_message::<crate::net::WorldportMessage>()
+        .add_message::<crate::net::FieldChanged>()
         // The world latch (2239): this plugin owns one of its two producers, so it declares the
         // resource as well as the message — same reason, and `init_resource` is idempotent
         // against `UiScriptPlugin`'s own.
@@ -293,17 +301,20 @@ impl Plugin for UiUnitPlugin {
                 fire_combat_text,
             )
                 .chain()
-                .in_set(UnitFeed)
-                .before(UiInput),
+                .in_set(UnitFeed),
         )
         .add_systems(Update, drain_pvp_toggles.after(UiInput))
         .add_systems(Update, drain_worn_display_toggles.after(UiInput))
         .add_systems(Update, drain_action_bar_toggles.after(UiInput))
         .add_systems(Update, feed_default_language.in_set(UnitFeed))
         .add_systems(Update, feed_known_languages.in_set(UnitFeed))
-        // `load_exhaustion_rows` pushes into the VM, so it runs per VM in `Update` (1290);
-        // `load_default_languages` only builds a Bevy resource and stays a one-shot.
-        .add_systems(Update, load_exhaustion_rows)
+        // `load_exhaustion_rows` pushes into the VM, so it runs per VM in `Update` (1290), in
+        // the feed phase; `load_default_languages` only builds a Bevy resource and stays a
+        // one-shot.
+        .add_systems(
+            Update,
+            load_exhaustion_rows.in_set(crate::ui_script::UiFeed),
+        )
         .add_systems(PostStartup, (load_default_languages, load_languages));
     }
 }
@@ -1038,6 +1049,9 @@ pub(crate) struct UnitStores<'w, 's> {
     changed: Query<'w, 's, (), Changed<ObjectStore>>,
     /// Whose object left the manager — the other half of that gate, and cleared every run.
     removed: RemovedComponents<'w, 's, ObjectStore>,
+    /// The per-field edges this run (decision 2297) — [`fire_transitions`]' three mirror-diff
+    /// arms fire off these, per token naming the moved unit.
+    edges: MessageReader<'w, 's, FieldChanged>,
 }
 
 /// Build a unit snapshot from a streamed object's descriptor (decision 0061's `ObjectFields`) plus
@@ -1417,12 +1431,16 @@ fn creature_type_word(t: u32) -> Option<&'static str> {
 }
 
 /// Diff a token's fresh snapshot against the last one pushed and fire the per-field Era events.
-/// `prev = None` (the token just appeared) treats every present field as a transition.
+/// `prev = None` (the token just appeared) treats every present field as a transition — except
+/// the three arms that are the reference's per-field watch bridge, which fire off `edges`, the
+/// descriptor edges this run (decision 2297): those fire per token naming a unit whose dword
+/// moved, and a unit's create moves nothing.
 pub(crate) fn fire_transitions(
     script: &mut UiScript,
     token: &str,
     prev: Option<&UnitState>,
     cur: &UnitState,
+    edges: &FieldEdges,
 ) {
     let tok = || ScriptValue::Str(token.to_string());
     let changed = |f: fn(&UnitState) -> u64| prev.is_none_or(|p| f(p) != f(cur));
@@ -1444,8 +1462,11 @@ pub(crate) fn fire_transitions(
     // fires `0x51bd50` → `0x515e50` on any change of the dword's bytes, once per token mapping to
     // the unit, `arg1` the token. The create leg runs no notify pass, so a unit's FIRST snapshot
     // is not a transition here — unlike the fields above, whose first-appearance fire is this
-    // feed's own posture (1953, corrected in 1957). The stock pet bar filters it for `"pet"`.
-    if prev.is_some() && changed(|u| u64::from(u.flags)) {
+    // feed's own posture (1953, corrected in 1957). Since 2297 that is literally the trigger:
+    // the field edge for this unit's dword, which a create never emits, and which a retarget
+    // onto a unit with different flags does not emit either (the old `prev.is_some()` snapshot
+    // diff fired on that). The stock pet bar filters it for `"pet"`.
+    if edges.moved(cur.guid, benilla_protocol::field::FIELD_UNIT_FLAGS) {
         script.fire_event("UNIT_FLAGS", vec![tok()]);
     }
     // `PLAYER_FLAGS_CHANGED` (id 407) — the `UNIT_FLAGS` arm above, one descriptor field over, and
@@ -1482,7 +1503,7 @@ pub(crate) fn fire_transitions(
     // construction: it is only ever called *per token*, so a tokenless player is never reached
     // (wow-re `object-layer/scratch/player-flags-delta-arms.md`, the 2078 correction round).
     //
-    // `prev.is_some()` for the same reason `UNIT_FLAGS` carries it: this is a mirror-diff watcher,
+    // Off the field edge for the same reason `UNIT_FLAGS` is: this is a mirror-diff watcher,
     // and a unit's first snapshot is its CREATE, which runs no notify pass (1098 §4).
     //
     // **The sole 1.12 consumer is the target frame's PARTY-LEADER icon, not an AFK/DND badge** —
@@ -1492,7 +1513,7 @@ pub(crate) fn fire_transitions(
     // `ui/scratch/unit-predicate-return-shape.md` §5, a zero-hit whole-image byte census); the
     // `<AFK>`/`<DND>` the era shows are the chat line's `arg6` flag. This comment is here because
     // the gap list said "the AFK/DND badge" for months and sent the first look at the wrong window.
-    if prev.is_some() && changed(|u| u64::from(u.player_flags)) {
+    if edges.moved(cur.guid, benilla_protocol::field::FIELD_PLAYER_FLAGS) {
         script.fire_event("PLAYER_FLAGS_CHANGED", vec![tok()]);
     }
     // `UNIT_DYNAMIC_FLAGS` (id 137) — the third arm of the same bridge, and one benilla had
@@ -1508,10 +1529,10 @@ pub(crate) fn fire_transitions(
     //
     // Byte-verified, not inherited (see [`UnitState::dynamic_flags`]): the name-table slot for
     // 137 resolves to `"UNIT_DYNAMIC_FLAGS"`, and the watch length is one dword, so the trigger
-    // is the RAW word and not the four bits this struct decodes. `prev.is_some()` for the same
-    // reason the two arms above carry it — a unit's first snapshot is its CREATE, and the create
+    // is the RAW word and not the four bits this struct decodes. Off the field edge for the same
+    // reason the two arms above are — a unit's first snapshot is its CREATE, and the create
     // block runs no notify pass.
-    if prev.is_some() && changed(|u| u64::from(u.dynamic_flags)) {
+    if edges.moved(cur.guid, benilla_protocol::field::FIELD_UNIT_DYNAMIC_FLAGS) {
         script.fire_event("UNIT_DYNAMIC_FLAGS", vec![tok()]);
     }
     // The POWER pair is named per resource in 1.12, not once with the token as arg2: the reference's
@@ -1577,7 +1598,6 @@ pub(crate) fn fire_transitions(
     }
 }
 
-#[allow(clippy::too_many_arguments)]
 fn feed_units(
     script: Option<NonSendMut<UiScript>>,
     // `ChrClasses.dbc` field 16, the only thing `UnitHasRelicSlot` reads. Absent when the client
@@ -1595,7 +1615,7 @@ fn feed_units(
     index: Option<Res<crate::net::GuidIndex>>,
     mut stores: UnitStores,
     mut feed: ResMut<UnitFeedState>,
-    mut names: ResMut<NameCache>,
+    names: Res<NameCache>,
     commands: Res<NetCommands>,
     factions: Option<Res<Factions>>,
     reputations: Res<Reputations>,
@@ -1635,6 +1655,7 @@ fn feed_units(
     // disjoint fields they are — through the `ResMut` deref they would alias.
     let feed = &mut *feed;
     let (memo, vm_reset) = feed.vm.get_reset(&script);
+    let edges = FieldEdges::collect(&mut stores.edges);
 
     // The gate (1439): every input the two snapshots and the edge diffs below read — any
     // descriptor change or DESPAWN (a removed store is invisible to `Changed`), the selection,
@@ -2184,7 +2205,7 @@ fn feed_units(
                 let prev = memo.last.get(token);
                 if prev != Some(cur) {
                     gate.audit("feed_units", "a unit-token transition");
-                    fire_transitions(&mut script, token, prev, cur);
+                    fire_transitions(&mut script, token, prev, cur, &edges);
                     memo.last.insert(token.to_string(), cur.clone());
                 }
             }
@@ -2430,7 +2451,7 @@ mod tests {
     /// reference's watch bridge has no watch to fire on the create leg (1953, corrected 1957).
     #[test]
     fn a_flags_change_fires_unit_flags_with_the_token() {
-        let fired = |prev: Option<UnitState>, cur: UnitState| -> Vec<String> {
+        let fired = |prev: Option<UnitState>, cur: UnitState, edges: &FieldEdges| -> Vec<String> {
             let mut s = UiScript::new().unwrap();
             s.run(
                 r#"
@@ -2441,30 +2462,53 @@ mod tests {
             "#,
             )
             .unwrap();
-            fire_transitions(&mut s, "pet", prev.as_ref(), &cur);
+            fire_transitions(&mut s, "pet", prev.as_ref(), &cur, edges);
             s.eval::<Vec<String>>("return SEEN").unwrap()
         };
+        const PET: u64 = 0xF140_0000_0000_0001;
         let base = UnitState {
             exists: true,
             has_object: true,
+            guid: PET,
             flags: 0x8,
             ..Default::default()
         };
+        let moved = FieldEdges::of(&[(PET, benilla_protocol::field::FIELD_UNIT_FLAGS)]);
         assert_eq!(
             fired(
                 Some(base.clone()),
                 UnitState {
                     flags: 0x8 | 0x0400_0000,
                     ..base.clone()
-                }
+                },
+                &moved,
             ),
             vec!["UNIT_FLAGS:pet".to_string()]
         );
         assert_eq!(
-            fired(Some(base.clone()), base.clone()),
+            fired(Some(base.clone()), base.clone(), &FieldEdges::default()),
+            Vec::<String>::new()
+        );
+        // The create block runs no notify pass: no edge, no event — whatever the snapshot says.
+        assert_eq!(
+            fired(None, base.clone(), &FieldEdges::default()),
+            Vec::<String>::new()
+        );
+        // …and the trigger is the UNIT'S edge, not the token's history: a token acquired on the
+        // very frame the field moved hears it (the reference fans out to whoever names the unit
+        // at notify time), and another unit's edge is not this one's.
+        assert_eq!(
+            fired(None, base.clone(), &moved),
+            vec!["UNIT_FLAGS:pet".to_string()]
+        );
+        assert_eq!(
+            fired(
+                Some(base.clone()),
+                base.clone(),
+                &FieldEdges::of(&[(PET + 1, benilla_protocol::field::FIELD_UNIT_FLAGS)]),
+            ),
             Vec::<String>::new()
         );
-        assert_eq!(fired(None, base.clone()), Vec::<String>::new());
     }
 
     /// The two edges on the player's own state (1953): the control flag's, which fires LOST on
@@ -2558,7 +2602,7 @@ mod tests {
             "#,
             )
             .unwrap();
-            fire_transitions(&mut s, "target", Some(&prev), &cur);
+            fire_transitions(&mut s, "target", Some(&prev), &cur, &FieldEdges::default());
             s.eval::<Vec<String>>("return SEEN").unwrap()
         };
         let base = UnitState {
@@ -2622,7 +2666,7 @@ mod tests {
     /// decodes, proving the trigger is the raw dword and not the two bools next to it.
     #[test]
     fn player_flags_changed_fires_per_token_on_any_bit_and_never_on_first_sight() {
-        let fired = |prev: Option<UnitState>, cur: UnitState| -> Vec<String> {
+        let fired = |prev: Option<UnitState>, cur: UnitState, edges: &FieldEdges| -> Vec<String> {
             let mut s = UiScript::new().unwrap();
             s.run(
                 r#"
@@ -2633,12 +2677,14 @@ mod tests {
             "#,
             )
             .unwrap();
-            fire_transitions(&mut s, "target", prev.as_ref(), &cur);
+            fire_transitions(&mut s, "target", prev.as_ref(), &cur, edges);
             s.eval::<Vec<String>>("return SEEN").unwrap()
         };
+        const THEM: u64 = 0x2a;
         let base = UnitState {
             exists: true,
             has_object: true,
+            guid: THEM,
             ..Default::default()
         };
         let with = |flags: u32| UnitState {
@@ -2647,38 +2693,40 @@ mod tests {
             ghost: flags & 0x10 != 0,
             ..base.clone()
         };
+        let moved = FieldEdges::of(&[(THEM, benilla_protocol::field::FIELD_PLAYER_FLAGS)]);
+        let still = FieldEdges::default();
 
         // The 1.12 consumer's own bit: `PLAYER_FLAGS_GROUP_LEADER 0x1`, `UnitIsPartyLeader`'s
         // descriptor leg — leadership passing to the player you are targeting.
         assert_eq!(
-            fired(Some(with(0)), with(0x1)),
+            fired(Some(with(0)), with(0x1), &moved),
             vec!["PLAYER_FLAGS_CHANGED:target".to_string()],
             "arg1 is the unit token, and there is no arg2 (0x515e50 -> 0x703f50(id, \"%s\", token))"
         );
         // …and back down. The reference tests the XOR-diff, not the new value.
         assert_eq!(
-            fired(Some(with(0x1)), with(0)),
+            fired(Some(with(0x1)), with(0), &moved),
             vec!["PLAYER_FLAGS_CHANGED:target".to_string()]
         );
 
         // **The control that proves the trigger is the RAW DWORD.** `PLAYER_FLAGS_HIDE_HELM 0x400`
         // is a bit no `UnitState` field decodes — the fire at `0x5eea35` carries no bit test, so
-        // it announces this exactly as loudly as the leader bit. A version of this arm driven off
-        // `group_leader`/`ghost` passes every assertion above and fails here.
+        // it announces this exactly as loudly as the leader bit: the edge is the dword's, and the
+        // snapshot's decoded bools are never consulted.
         assert_eq!(
-            fired(Some(with(0)), with(0x400)),
+            fired(Some(with(0)), with(0x400), &moved),
             vec!["PLAYER_FLAGS_CHANGED:target".to_string()],
             "an undecoded bit still fires it — the handler tests no bit at all"
         );
 
         // First sight is the CREATE, and a CREATE runs no notify pass (1098 §4) — the same
-        // posture `UNIT_FLAGS` holds one field over.
+        // posture `UNIT_FLAGS` holds one field over: no edge, no event.
         assert!(
-            fired(None, with(0x1)).is_empty(),
+            fired(None, with(0x1), &still).is_empty(),
             "a unit's first snapshot is its create, not a transition"
         );
         // The control that stops all of the above passing by firing always.
-        assert!(fired(Some(with(0x1)), with(0x1)).is_empty());
+        assert!(fired(Some(with(0x1)), with(0x1), &still).is_empty());
     }
 
     /// **`UNIT_DYNAMIC_FLAGS` — an event benilla had never fired at all** (decision 2140).
@@ -2693,7 +2741,7 @@ mod tests {
     /// assertion here and fails that one.
     #[test]
     fn unit_dynamic_flags_fires_per_token_on_any_bit_and_never_on_first_sight() {
-        let fired = |prev: Option<UnitState>, cur: UnitState| -> Vec<String> {
+        let fired = |prev: Option<UnitState>, cur: UnitState, edges: &FieldEdges| -> Vec<String> {
             let mut s = UiScript::new().unwrap();
             s.run(
                 r#"
@@ -2704,12 +2752,16 @@ mod tests {
             "#,
             )
             .unwrap();
-            fire_transitions(&mut s, "target", prev.as_ref(), &cur);
+            fire_transitions(&mut s, "target", prev.as_ref(), &cur, edges);
             s.eval::<Vec<String>>("return SEEN").unwrap()
         };
+        const MOB: u64 = 0xF130_0000_0000_0007;
+        let moved = FieldEdges::of(&[(MOB, benilla_protocol::field::FIELD_UNIT_DYNAMIC_FLAGS)]);
+        let still = FieldEdges::default();
         let with = |dyn_flags: u32| UnitState {
             exists: true,
             has_object: true,
+            guid: MOB,
             dynamic_flags: dyn_flags,
             tapped: dyn_flags & 0x4 != 0,
             tapped_by_player: dyn_flags & 0x8 != 0,
@@ -2719,20 +2771,20 @@ mod tests {
         // The bit the corpus registers this event for: `0x4` TAPPED, the grey-bar state
         // (`CT_UnitFrames/CT_TargetFrame.xml:200`, `TipBuddy/TipBuddy.lua:17`).
         assert_eq!(
-            fired(Some(with(0)), with(0x4)),
+            fired(Some(with(0)), with(0x4), &moved),
             vec!["UNIT_DYNAMIC_FLAGS:target".to_string()],
             "arg1 is the unit token, and there is no arg2"
         );
         // The control that proves the trigger is the RAW DWORD: a bit this struct never decodes.
         assert_eq!(
-            fired(Some(with(0)), with(0x2)),
+            fired(Some(with(0)), with(0x2), &moved),
             vec!["UNIT_DYNAMIC_FLAGS:target".to_string()],
             "an undecoded bit still fires it — the watch is a memcmp over the dword"
         );
         // The create block runs no notify pass (1098 §4), like both arms beside it.
-        assert!(fired(None, with(0x4)).is_empty());
+        assert!(fired(None, with(0x4), &still).is_empty());
         // And the control that stops the rest passing by firing always.
-        assert!(fired(Some(with(0x4)), with(0x4)).is_empty());
+        assert!(fired(Some(with(0x4)), with(0x4), &still).is_empty());
     }
 
     /// **The two SELF-ONLY arms of the same handler, each on its own bits** — the half that was
@@ -2749,6 +2801,7 @@ mod tests {
         const FIELD_PLAYER_FLAGS: u16 = 190;
 
         let mut app = App::new();
+        app.add_message::<FieldChanged>();
         app.init_resource::<Selection>()
             .init_resource::<UnitFeedState>()
             .init_resource::<NameCache>()
@@ -3354,6 +3407,7 @@ mod tests {
             .init_resource::<crate::sound::MessageSounds>()
             .init_resource::<crate::ui_guild::GuildState>()
             .init_resource::<InteractNpc>();
+        app.add_message::<FieldChanged>();
         let (tx, _rx) = crossbeam_channel::unbounded();
         app.insert_resource(NetCommands(tx));
         app.insert_non_send_resource(UiScript::new().unwrap());
diff --git a/crates/benilla-app/src/ui_world_map.rs b/crates/benilla-app/src/ui_world_map.rs
index 517f7537..9cee6983 100644
--- a/crates/benilla-app/src/ui_world_map.rs
+++ b/crates/benilla-app/src/ui_world_map.rs
@@ -10,14 +10,20 @@
 //!   `Map.dbc` localized names ("Eastern Kingdoms", not the art folder's "Azeroth"); zones
 //!   sorted case-insensitively by AreaTable localized name (the `0x4a6390` comparator's
 //!   `SStrCmpI`); the zone grids remapped from raw AreaTable ids by the client's one-hop parent
-//!   rollup + (mapId, areaId) match — here straight to 1-based zone indices.
+//!   rollup + (mapId, areaId) match — here straight to 1-based zone indices. Beside that it
+//!   builds the **orphan list** ([`DirectAreaEntry`]) — the instance maps, which belong to no
+//!   continent and so appear in neither list above; the reference fills the same second container
+//!   in the same walk (`0x4a5d00`), and it is what the `−2` direct-area selection resolves
+//!   against.
 //! - [`feed_world_map`] (every frame): reads the engine-owned selection back, projects the
 //!   player's world position onto the displayed map via [`benilla_world::map_proj`] (world sheet:
-//!   WorldMapContinent constants; continent/zone: the WorldMapArea rect lerp), resolves the
-//!   player's `(continent, zone)` from `CurrentArea` through the AreaTable parent chain, and
-//!   pushes the trio + facing. (The client matches its zone-level area global directly —
-//!   `0x4a6650`; our MCNK `CurrentArea` is the leaf sub-area, so the parent walk lands on the
-//!   same zone.) It also runs the **landmark pass** — the reference's `0x4a67a0` builder
+//!   WorldMapContinent constants; continent/zone: the WorldMapArea rect lerp; an instance map:
+//!   that row's own rect), resolves where the player's own position puts the selection
+//!   ([`resolve_player_selection`], the reference's `0x4a6650` — continent × zone, then the
+//!   orphan list) from `CurrentArea` through the AreaTable parent chain, and pushes the trio +
+//!   facing. (The client matches its zone-level area global directly; our MCNK `CurrentArea` is
+//!   the leaf sub-area, so the parent walk lands on the same zone.) It also runs the **landmark
+//!   pass** — the reference's `0x4a67a0` builder
 //!   ([`landmark_gates_pass`], decision 1586): the `AreaPOI.dbc` rows the displayed level admits,
 //!   then the guard-directions marker. That pass is keyed rather than per-frame ([`LandmarkKey`]),
 //!   because the reference rebuilds it on events, not on a clock.
@@ -50,6 +56,11 @@ use benilla_world::world_map::CurrentMap;
 #[derive(Resource)]
 pub(crate) struct WorldMapUiData {
     continents: Vec<ContinentEntry>,
+    /// The **orphan list** — the instance maps, which are no continent's child and so appear in
+    /// neither list above. `0x4a5d00`'s third array, in `WorldMapArea.dbc` file order with no
+    /// sort; the rows the `−2` direct-area selection resolves against (see [`DirectAreaEntry`]).
+    /// It also carries what the engine is pushed, so the two copies cannot drift apart.
+    direct: Vec<DirectAreaEntry>,
 }
 
 pub(crate) struct ContinentEntry {
@@ -64,6 +75,24 @@ struct ZoneEntry {
     rect: ZoneRect,
 }
 
+/// One orphan row: an instance map (a battleground, a dungeon) selected **directly** rather than
+/// through the continent/zone pair. In 5875 there are exactly three, all battlegrounds.
+struct DirectAreaEntry {
+    /// The `WorldMapArea` row **ID** — the value the reference's third selection cell
+    /// `[0x845074]` holds verbatim (`0x4a6717 mov edx,[esi]`). Not a position in this list:
+    /// nothing indexes it, the resolver looks rows up by id.
+    id: u32,
+    /// The row's `Map.dbc` id. The resolver matches the player's own map against this
+    /// (`0x4a66f6`), and the projection admits a body only when its map is this one
+    /// (`0x4a7437`) — which is what makes a teammate elsewhere answer the (0,0) hide sentinel.
+    map_id: u32,
+    /// The row's own loc rect — the window `0x4a7360`'s direct-area leg projects through, the
+    /// same tail the zone case uses.
+    rect: ZoneRect,
+    /// What the engine is handed for this row (`GetMapInfo`'s art folder, the overlays).
+    view: WorldMapZoneView,
+}
+
 fn zone_rect(a: &WorldMapArea) -> ZoneRect {
     ZoneRect {
         left: a.loc_left,
@@ -73,6 +102,55 @@ fn zone_rect(a: &WorldMapArea) -> ZoneRect {
     }
 }
 
+/// One `WorldMapArea` row as the engine sees it — a zone, a city, or an instance map: the client
+/// makes no structural distinction (the same `0x4a6cf0` id lookup answers `GetMapInfo` for all
+/// three, and the same overlay gate reveals their art), so neither do we.
+///
+/// `name` is passed in because the zone list sorts on it before the views are built.
+fn map_row_view(
+    wma_id: u32,
+    a: &WorldMapArea,
+    name: String,
+    areas: &benilla_formats::AreaTableCatalog,
+    wmo: &benilla_formats::WorldMapOverlayCatalog,
+) -> WorldMapZoneView {
+    WorldMapZoneView {
+        name,
+        area_id: a.area_id,
+        map_file: a.name.clone(),
+        loc_rect: (a.loc_left, a.loc_right, a.loc_top, a.loc_bottom),
+        // The row's discovery overlays: WorldMapOverlay rows joined by its WMA id, their reveal
+        // bits = each covered area's AreaTable exploreFlag.
+        overlays: wmo
+            .for_area(wma_id)
+            .iter()
+            .map(|o| WorldMapOverlayView {
+                texture: format!("Interface\\WorldMap\\{}\\{}", a.name, o.texture_name),
+                width: o.texture_width,
+                height: o.texture_height,
+                offset_x: o.offset_x,
+                offset_y: o.offset_y,
+                explore_bits: o
+                    .area_id
+                    .iter()
+                    .filter(|&&aid| aid != 0)
+                    .filter_map(|&aid| areas.get(aid).map(|r| r.explore_flag))
+                    .collect(),
+                hit_rect: (
+                    o.hit_rect_top,
+                    o.hit_rect_left,
+                    o.hit_rect_bottom,
+                    o.hit_rect_right,
+                ),
+                // The zone-level hover's label inside that rect: the FIRST area slot's AreaTable
+                // name — `0x4a7fa0` reads `+0x8` only (wow-re 15b2a8ea §1d); a slot that resolves
+                // to no row makes the overlay invisible to the hover, never to the draw.
+                area_name: areas.name(o.area_id[0]).map(str::to_string),
+            })
+            .collect(),
+    }
+}
+
 /// Build the catalog off the patch chain — the pure half of [`seed_world_map_catalog`], split out
 /// so a test can drive the REAL `WorldMapArea` × `AreaTable` × `WorldMapContinent` × `Map` ×
 /// `.zmp` build rather than a hand-written stand-in. A fixture catalog can only ever prove the
@@ -84,7 +162,7 @@ pub(crate) fn build_catalog(
     chain: &mut benilla_formats::Chain,
     areas: &benilla_formats::AreaTableCatalog,
     maps: &MapCatalogRes,
-) -> Option<(Vec<WorldMapContinentView>, Vec<ContinentEntry>)> {
+) -> Option<(Vec<WorldMapContinentView>, WorldMapUiData)> {
     let loaded = load_world_map_area_catalog(&mut *chain).and_then(|wma| {
         let wmc = load_world_map_continent_catalog(&mut *chain)?;
         let wmo = load_world_map_overlay_catalog(&mut *chain)?;
@@ -184,42 +262,7 @@ pub(crate) fn build_catalog(
             zone_grid,
             zones: zones
                 .iter()
-                .map(|(wma_id, a, name)| WorldMapZoneView {
-                    name: name.clone(),
-                    area_id: a.area_id,
-                    map_file: a.name.clone(),
-                    loc_rect: (a.loc_left, a.loc_right, a.loc_top, a.loc_bottom),
-                    // The zone's discovery overlays: WorldMapOverlay rows joined by the zone's
-                    // WMA id, their reveal bits = each covered area's AreaTable exploreFlag.
-                    overlays: wmo
-                        .for_area(*wma_id)
-                        .iter()
-                        .map(|o| WorldMapOverlayView {
-                            texture: format!("Interface\\WorldMap\\{}\\{}", a.name, o.texture_name),
-                            width: o.texture_width,
-                            height: o.texture_height,
-                            offset_x: o.offset_x,
-                            offset_y: o.offset_y,
-                            explore_bits: o
-                                .area_id
-                                .iter()
-                                .filter(|&&aid| aid != 0)
-                                .filter_map(|&aid| areas.get(aid).map(|r| r.explore_flag))
-                                .collect(),
-                            hit_rect: (
-                                o.hit_rect_top,
-                                o.hit_rect_left,
-                                o.hit_rect_bottom,
-                                o.hit_rect_right,
-                            ),
-                            // The zone-level hover's label inside that rect: the FIRST area
-                            // slot's AreaTable name — `0x4a7fa0` reads `+0x8` only (wow-re
-                            // 15b2a8ea §1d); a slot that resolves to no row makes the overlay
-                            // invisible to the hover, never to the draw.
-                            area_name: areas.name(o.area_id[0]).map(str::to_string),
-                        })
-                        .collect(),
-                })
+                .map(|(wma_id, a, name)| map_row_view(*wma_id, a, name.clone(), areas, &wmo))
                 .collect(),
         });
         entries.push(ContinentEntry {
@@ -235,7 +278,43 @@ pub(crate) fn build_catalog(
                 .collect(),
         });
     }
-    Some((views, entries))
+
+    // ── The THIRD list: the orphans — the instance maps (wow-re
+    // `system/ui/scratch/worldmap-direct-area-selection.md` §2). `0x4a5d00` fills a container
+    // beside the continents with every row that has `areaID != 0` and whose mapID matches **no**
+    // continent record's mapID, in `WorldMapArea.dbc` **file order with no sort** — the passes at
+    // `0x4a6130` (count) and `0x4a61c9` (fill), whose predicate is the exact complement of the
+    // child rule above. In 5875 that is Alterac Valley (WMA 401, map 30), Warsong Gulch (443,
+    // 489) and Arathi Basin (461, 529), and nothing else.
+    //
+    // The `areaID != 0` gate is carried although it is **provably inert on the shipped data**:
+    // every `areaID == 0` row becomes a continent record and so matches its own mapID at
+    // `0x4a6170`. It is the reference's predicate, not a filter we inferred from the data.
+    let continent_maps: Vec<u32> = entries.iter().map(|c| c.map_id).collect();
+    let direct: Vec<DirectAreaEntry> = wma
+        .iter()
+        .filter(|(_, a)| a.area_id != 0 && !continent_maps.contains(&a.map_id))
+        .map(|(id, a)| DirectAreaEntry {
+            id,
+            map_id: a.map_id,
+            rect: zone_rect(a),
+            view: map_row_view(
+                id,
+                a,
+                areas.name(a.area_id).unwrap_or(a.name.as_str()).to_string(),
+                areas,
+                &wmo,
+            ),
+        })
+        .collect();
+
+    Some((
+        views,
+        WorldMapUiData {
+            continents: entries,
+            direct,
+        },
+    ))
 }
 
 /// The built catalog, kept for the life of the process. A static `WorldMapArea` × `AreaTable` ×
@@ -247,6 +326,9 @@ pub(crate) fn build_catalog(
 /// the test plants a catalog and drives the entry edge, which is the ordering question without
 /// the DBC walk (the walk itself is covered against the real chain by
 /// `world_map_tests::the_real_feralas_catalog_names_dire_maul_under_the_cursor`).
+///
+/// The **continent** half only: the orphan half of the same build rides [`WorldMapUiData`], where
+/// each instance map's row already sits beside its projection rect.
 #[derive(Resource)]
 pub(crate) struct WorldMapCatalog(pub(crate) Vec<WorldMapContinentView>);
 
@@ -269,32 +351,41 @@ pub(crate) struct WorldMapCatalog(pub(crate) Vec<WorldMapContinentView>);
 /// load, and the getters read it whenever they are asked.
 pub(crate) fn seed_world_map_catalog(world: &mut World, script: &mut UiScript) {
     if !world.contains_resource::<WorldMapCatalog>() {
-        let Some((views, entries)) = build_catalog_from_world(world) else {
+        let Some((views, data)) = build_catalog_from_world(world) else {
             return;
         };
         info!(
-            "world map: catalog — {} continents, {} zones",
+            "world map: catalog — {} continents, {} zones, {} instance maps",
             views.len(),
-            views.iter().map(|c| c.zones.len()).sum::<usize>()
+            views.iter().map(|c| c.zones.len()).sum::<usize>(),
+            data.direct.len()
         );
-        world.insert_resource(WorldMapUiData {
-            continents: entries,
-        });
+        world.insert_resource(data);
         world.insert_resource(WorldMapCatalog(views));
     }
     let Some(catalog) = world.get_resource::<WorldMapCatalog>() else {
         return;
     };
     script.set_world_map_catalog(catalog.0.clone());
+    // The orphan half of the same build, pushed at the same edge and for the same reason (the
+    // reference fills both containers in one walk). It rides [`WorldMapUiData`] rather than
+    // [`WorldMapCatalog`] because that is where the rows and their projection rects already live
+    // together — one list, one order, nothing to drift.
+    if let Some(data) = world.get_resource::<WorldMapUiData>() {
+        script.set_world_map_direct_areas(
+            data.direct
+                .iter()
+                .map(|d| (d.id, d.view.clone()))
+                .collect::<Vec<_>>(),
+        );
+    }
 }
 
 /// [`build_catalog`] over the resources the app holds — `None` when the patch chain or either DBC
 /// catalog is missing, which in a real run cannot happen at this edge: all three are `Startup`
 /// systems and the initial state transition is after `PostStartup` (decision 1038). A bare test
 /// world takes the `None`.
-fn build_catalog_from_world(
-    world: &World,
-) -> Option<(Vec<WorldMapContinentView>, Vec<ContinentEntry>)> {
+fn build_catalog_from_world(world: &World) -> Option<(Vec<WorldMapContinentView>, WorldMapUiData)> {
     let assets = world.get_resource::<WorldAssets>()?;
     let maps = world.get_resource::<MapCatalogRes>()?;
     let areas = world.get_resource::<crate::area::AreaTableRes>()?;
@@ -302,31 +393,37 @@ fn build_catalog_from_world(
     build_catalog(&mut chain, &areas.0, maps)
 }
 
-/// Which of the map's three levels is displayed — the reference's `(continent, zone)` globals
-/// `[0x84506c]`/`[0x845070]` reduced to the thing every landmark gate actually branches on.
+/// Which of the map's levels is displayed — the reference's three selection cells
+/// `[0x84506c]`/`[0x845070]`/`[0x845074]` reduced to the thing every landmark gate actually
+/// branches on.
 ///
-/// The reference has a fourth, `ORPHAN` (`continent == -2`, a map selected directly rather than
-/// through the continent/zone pair). We have no way to reach it: [`UiScript::world_map_selection`]
-/// is a `(u32, u32)` pair with `0` for "whole", so a direct-area selection is unrepresentable.
-/// Where the reference's gates test "zone **or** orphan", ours test zone — the same answer for
-/// every state our map can be in.
+/// **The direct-area state answers [`MapLevel::Zone`], and that is the reference's own law rather
+/// than an approximation** (wow-re `worldmap-direct-area-selection.md` §6). Both gates that read
+/// this enum test "zone **or** orphan": the AreaPOI level flag falls into the zone-level
+/// `test [rec+0x20],0x4` at `-2` (`0x4a79de cmp eax,-2; jne`), and `GetMapLandmarkInfo`'s
+/// `textureIndex` substitution is reached when the zone cell is `-1` **and** the continent is `-2`
+/// (`0x4a8856`/`0x4a885f` both fall through to `0x4a8868`). A fourth variant would be two arms
+/// that copy `Zone` exactly — so the fact is recorded here instead.
 #[derive(Clone, Copy, PartialEq, Eq, Debug)]
 enum MapLevel {
     /// Both continents on one sheet (the reference's `continent == -1`).
     World,
     /// One continent, no zone selected (`continent >= 0, zone == -1`).
     Continent,
-    /// One zone (`continent >= 0, zone >= 0`).
+    /// One zone (`continent >= 0, zone >= 0`) — or an instance map (`continent == -2`).
     Zone,
 }
 
 impl MapLevel {
-    /// Our 1-based `(continent, zone)` selection, `0` = "whole", mapped onto the reference's
-    /// `-1`-for-whole pair.
-    fn of(continent: u32, zone: u32) -> Self {
-        match (continent, zone) {
-            (0, _) => Self::World,
-            (_, 0) => Self::Continent,
+    /// The engine's selection ([`UiScript::world_map_selection`]) — our 1-based
+    /// `(continent, zone)` with `0` for "whole", plus the direct-area row id — mapped onto the
+    /// reference's levels. The direct cell is read FIRST: it shares the `(0, 0)` pair with the
+    /// world sheet and overrides it.
+    fn of((continent, zone, direct): (u32, u32, Option<u32>)) -> Self {
+        match (continent, zone, direct) {
+            (_, _, Some(_)) => Self::Zone,
+            (0, _, None) => Self::World,
+            (_, 0, None) => Self::Continent,
             _ => Self::Zone,
         }
     }
@@ -346,7 +443,9 @@ impl MapLevel {
 /// input that silently hides map icons when it is wrong.
 #[derive(PartialEq, Eq)]
 struct LandmarkKey {
-    selection: (u32, u32),
+    /// All three selection cells — the direct-area one included, or an instance map's landmark
+    /// list would never rebuild when the selection moved onto it.
+    selection: (u32, u32, Option<u32>),
     map: u32,
     states: u64,
     /// Owned rather than borrowed, and compared before it is ever cloned — see
@@ -364,7 +463,7 @@ impl LandmarkKey {
     /// changed — compares without allocating.
     fn matches(
         &self,
-        selection: (u32, u32),
+        selection: (u32, u32, Option<u32>),
         map: u32,
         states: u64,
         explored: &[u32],
@@ -467,27 +566,57 @@ fn landmark_texture_index(poi: &benilla_formats::AreaPoi, level: MapLevel) -> u3
     }
 }
 
-/// `SetMapToCurrentZone`'s resolver, whose two halves fail SEPARATELY — see the call site in
-/// [`feed_world_map`] for the byte citation. `map_id` is the player's `Map.dbc` id; `top_zone` is
-/// their current area walked up to its top-level zone, or `None` while the area feed has not
-/// answered. The answer is the 1-based `(continent, zone)` the Lua selection verbs speak, with
-/// **zone 0 meaning the continent map** — the reference's `SetMap(continent, −1)` as
-/// `GetCurrentMapZone` reads it back.
-fn resolve_player_zone(
+/// `0x4a6650`'s answer — which map the player's own position selects — in the Lua-visible
+/// encoding. Its two legs are mutually exclusive by construction: the resolver runs the continent
+/// loop first and reaches the orphan loop only on a miss (`0x4a66c3`).
+#[derive(Clone, Copy, PartialEq, Eq, Debug, Default)]
+struct PlayerSelection {
+    /// The continent/zone leg: the 1-based pair, with **zone 0 meaning the continent map** (the
+    /// reference's `SetMap(continent, −1)` as `GetCurrentMapZone` reads it back). `None` = no
+    /// continent record carried the player's map.
+    zone: Option<(u32, u32)>,
+    /// The orphan leg: the `WorldMapArea` row **ID** whose mapID is the player's own map.
+    direct: Option<u32>,
+}
+
+/// `SetMapToCurrentZone`'s resolver (`0x4a7e20` is `call 0x4a6650`, and the engine's own
+/// world-enter sync `0x4947ac` calls the same function — there is no second resolver).
+///
+/// Three exits, in the reference's own precedence:
+///
+/// 1. **A continent whose mapID is the player's**, and then its child zones — whose two halves
+///    fail SEPARATELY (see the call site in [`feed_world_map`] for the byte citation).
+/// 2. **Only on a continent miss**, the orphan list, matched on `row.mapID == playerMapId`, first
+///    match wins: the direct-area selection `SetMap(-2, row.id)` (`0x4a6717`–`0x4a671e`). This is
+///    the leg a battleground takes — map 489 is no continent's, so nothing above can match.
+/// 3. Neither: the world view (both cells `None`), which is also what an empty orphan list gives.
+fn resolve_player_selection(
     data: &WorldMapUiData,
     map_id: u32,
     top_zone: Option<u32>,
-) -> Option<(u32, u32)> {
-    let ci = data.continents.iter().position(|c| c.map_id == map_id)?;
-    let zone = top_zone
-        .and_then(|top| {
-            data.continents[ci]
-                .zones
-                .iter()
-                .position(|z| z.area_id == top)
-        })
-        .map_or(0, |zi| zi as u32 + 1);
-    Some((ci as u32 + 1, zone))
+) -> PlayerSelection {
+    if let Some(ci) = data.continents.iter().position(|c| c.map_id == map_id) {
+        let zone = top_zone
+            .and_then(|top| {
+                data.continents[ci]
+                    .zones
+                    .iter()
+                    .position(|z| z.area_id == top)
+            })
+            .map_or(0, |zi| zi as u32 + 1);
+        return PlayerSelection {
+            zone: Some((ci as u32 + 1, zone)),
+            direct: None,
+        };
+    }
+    PlayerSelection {
+        zone: None,
+        direct: data
+            .direct
+            .iter()
+            .find(|d| d.map_id == map_id)
+            .map(|d| d.id),
+    }
 }
 
 /// The engine-side world-enter sync's gate and answer — `0x494780`'s `old == 0` leg into the
@@ -502,39 +631,56 @@ fn resolve_player_zone(
 ///   would sync on frame 1 to the bare continent and — since the reference never re-syncs — stay
 ///   there.
 /// - **Every exit of `0x4a6650` writes the selection**, including its two failure legs
-///   (`0x4a667e`/`0x4a670b` ⇒ `SetMap(−1, −1)`). So an unresolvable player — an instance map, no
-///   continent row — still counts as synced, at the world view, rather than re-arming the gate
-///   every frame. That is `player_zone.unwrap_or((0, 0))`: our `None` IS the reference's
-///   `(−1, −1)`, which `GetCurrentMapContinent` reads back to Lua as `0`.
+///   (`0x4a667e`/`0x4a670b` ⇒ `SetMap(−1, −1)`). So an unresolvable player — a map in neither
+///   list — still counts as synced, at the world view, rather than re-arming the gate every
+///   frame. That is the all-`None` [`PlayerSelection`]: it IS the reference's `(−1, −1)`, which
+///   `GetCurrentMapContinent` reads back to Lua as `0`.
+///
+/// A player logging straight into a battleground takes the *direct* leg here, which is why this
+/// hands the whole answer on rather than the pair: the sync happens once per session, so dropping
+/// the third cell would strand such a session on the world sheet for its whole life.
 fn world_enter_selection(
     synced: bool,
     top_zone: Option<u32>,
-    player_zone: Option<(u32, u32)>,
-) -> Option<(u32, u32)> {
-    (!synced && top_zone.is_some()).then(|| player_zone.unwrap_or((0, 0)))
+    player: PlayerSelection,
+) -> Option<PlayerSelection> {
+    (!synced && top_zone.is_some()).then_some(player)
 }
 
 /// Per frame: selection read-back → projection → feed push (see the module doc).
 /// One projection law for every blip on the DISPLAYED map: world-sheet mode (selection
 /// `(0, _)`) projects through the POSITION's own map's continent constants; continent and zone
-/// mode through the selected rect, gated to that continent's map. Off-map — the wrong continent,
-/// an instance map, outside the rect — is `None`, the reference's `(0, 0)` hide sentinel once it
+/// mode through the selected rect, gated to that continent's map; **direct-area mode through the
+/// selected row's own rect**, gated to that row's map. Off-map — the wrong continent, a body in
+/// another instance, outside the rect — is `None`, the reference's `(0, 0)` hide sentinel once it
 /// reaches Lua.
+///
+/// The direct arm is `0x4a7360`'s own (`0x4a73e0 jl 0x4a7414`): it reads `[0x845074]`, resolves
+/// the row, requires `[row+0x4] == mapId` (`0x4a7437`) and then runs the **same tail the zone case
+/// uses** — it never touches the continent record array. The gate is what makes it right for
+/// every caller and not just the player: `0x4a7870` passes the *unit's own* map id, so a
+/// teammate standing in the battleground projects and one who is elsewhere answers `(0, 0)`.
 pub(crate) fn project_on_displayed(
     data: &WorldMapUiData,
-    selection: (u32, u32),
+    selection: (u32, u32, Option<u32>),
     pos_map: u32,
     px: f32,
     py: f32,
 ) -> Option<(f32, f32)> {
     match selection {
-        (0, _) => data
+        // The direct cell first: it shares the `(0, 0)` pair with the world sheet.
+        (_, _, Some(id)) => data
+            .direct
+            .iter()
+            .find(|d| d.id == id && d.map_id == pos_map)
+            .map(|d| map_proj::zone_uv(d.rect, px, py)),
+        (0, _, None) => data
             .continents
             .iter()
             .find(|cont| cont.map_id == pos_map)
             .and_then(|cont| cont.proj)
             .map(|p| map_proj::world_uv(p, px, py)),
-        (c, z) => data
+        (c, z, None) => data
             .continents
             .get(c as usize - 1)
             .filter(|cont| cont.map_id == pos_map)
@@ -561,7 +707,6 @@ struct FeedMemos {
     map_synced: bool,
 }
 
-#[allow(clippy::too_many_arguments)]
 fn feed_world_map(
     script: Option<NonSendMut<UiScript>>,
     data: Option<Res<WorldMapUiData>>,
@@ -626,11 +771,15 @@ fn feed_world_map(
     // every consumer that assumes a zone uv — Astrolabe, and so every addon built on it — silently
     // mis-scales it.
     //
-    // NOT modelled, and deliberately: the `−2` orphan/direct-area leg for a map that is no
-    // continent's child (the instance maps). We have no orphan list, so those still land on the
-    // world view rather than the reference's direct-area selection.
+    // And when NO continent matched, the resolver falls through to its third leg: the orphan
+    // list, i.e. the instance maps (`0x4a66c3`). Inside a battleground that is the only leg that
+    // can answer — map 489 is no continent's child — and it selects the battleground's own
+    // `WorldMapArea` row directly, `SetMap(-2, row.id)`. Both halves travel to the engine
+    // together; with only the pair, `GetMapInfo()` answers nil in there and the stock
+    // `Blizzard_BattlefieldMinimap.lua:83-86` returns on the fourth line of its update, which is
+    // a battle map and a world map that draw nothing at all.
     let top_zone = world.area().and_then(|aid| areas.0.top_zone(aid));
-    let player_zone = resolve_player_zone(&data, map.0, top_zone);
+    let player_sel = resolve_player_selection(&data, map.0, top_zone);
 
     // ── First world-enter: the ENGINE selects the player's zone, with no Lua in the loop.
     //
@@ -657,19 +806,20 @@ fn feed_world_map(
     // precondition. Per **VM**, not per process: a new login is a new session's first enter.
     {
         let memo = memo.get(&script);
-        if let Some((c, z)) = world_enter_selection(memo.map_synced, top_zone, player_zone) {
+        if let Some(sel) = world_enter_selection(memo.map_synced, top_zone, player_sel) {
             memo.map_synced = true;
-            script.sync_world_map_to_player_zone(c, z);
+            let (c, z) = sel.zone.unwrap_or((0, 0));
+            script.sync_world_map_to_player_zone(c, z, sel.direct);
         }
     }
 
-    // The player's UV on the DISPLAYED map. Off-map (wrong continent, outside the rect, or an
-    // instance map) resolves to None/(0,0) — the reference's hide-the-blip sentinel.
-    let (c, z) = script.world_map_selection();
+    // The player's UV on the DISPLAYED map. Off-map (wrong continent, another instance, outside
+    // the rect) resolves to None/(0,0) — the reference's hide-the-blip sentinel.
+    let selection = script.world_map_selection();
     // One projection law for every blip on the displayed map (the player now, the corpse below,
     // the battleground teammates in `ui_battlefield_positions`): [`project_on_displayed`].
     let project =
-        |pos_map: u32, px: f32, py: f32| project_on_displayed(&data, (c, z), pos_map, px, py);
+        |pos_map: u32, px: f32, py: f32| project_on_displayed(&data, selection, pos_map, px, py);
     let uv = project(map.0, wx, wy);
     // The corpse marker (decision 0308 §5): the query answer's DISPLAY position/map (a dungeon
     // corpse projects at its entrance — the server rewrote it). `zone_uv`'s outside-the-rect
@@ -692,9 +842,9 @@ fn feed_world_map(
         .get(&script)
         .landmarks
         .as_ref()
-        .is_some_and(|k| k.matches((c, z), map.0, states_gen, &explored, marker));
+        .is_some_and(|k| k.matches(selection, map.0, states_gen, &explored, marker));
     if !unchanged {
-        let level = MapLevel::of(c, z);
+        let level = MapLevel::of(selection);
         let mut landmarks = Vec::new();
         // The DBC rows first, in file order, each through the builder's gate chain — that order
         // IS the Lua landmark index (`0x4a6819`'s walk over `[0xc0e054]`).
@@ -735,7 +885,7 @@ fn feed_world_map(
             }
         }
         memo.get(&script).landmarks = Some(LandmarkKey {
-            selection: (c, z),
+            selection,
             map: map.0,
             states: states_gen,
             explored: explored.clone(),
@@ -788,13 +938,18 @@ fn feed_world_map(
     };
 
     script.set_world_map_feed(
-        player_zone,
+        player_sel.zone,
         uv,
         player.facing(),
         corpse_uv,
         party_uv,
         raid_uv,
     );
+    // The orphan leg of the same resolver answer, beside the pair: `SetMapToCurrentZone` reads
+    // both back, and the stock battlefield minimap calls it itself on `PLAYER_ENTERING_WORLD`
+    // while it is shown — the call that lands a player zoning into a battleground on the
+    // battleground's own map.
+    script.set_world_map_player_direct_area(player_sel.direct);
 }
 
 /// **Alt+click the world map to go there** — the dev jump.
@@ -816,7 +971,6 @@ fn feed_world_map(
 /// also runs and drills into the clicked zone, which is what you want anyway — you arrive, and the
 /// map is showing where you arrived. Adding a modifier fork to the reference's click law to
 /// suppress that would be a dev affordance rewriting a faithful one.
-#[allow(clippy::too_many_arguments)]
 fn dev_map_jump(
     buttons: Res<ButtonInput<MouseButton>>,
     keys: Res<ButtonInput<KeyCode>>,
@@ -849,28 +1003,40 @@ fn dev_map_jump(
     else {
         return;
     };
-    let (c, z) = script.world_map_selection();
-    let Some(cont) = c
-        .checked_sub(1)
-        .and_then(|i| data.continents.get(i as usize))
-    else {
-        info!(
-            "map-jump: no exact click→world law at the world level — zoom into a continent first"
-        );
-        return;
-    };
-    let rect = match z.checked_sub(1) {
-        None => cont.rect,
-        Some(i) => match cont.zones.get(i as usize) {
-            Some(zone) => zone.rect,
+    let (c, z, direct) = script.world_map_selection();
+    // An instance map is a rect like any other — the same `0x4a7100` zone-mode inverse — so the
+    // jump works off a battleground map too; only the world sheet has no exact inverse.
+    let (rect, map_id) = match direct {
+        Some(id) => match data.direct.iter().find(|d| d.id == id) {
+            Some(d) => (d.rect, d.map_id),
             None => return,
         },
+        None => {
+            let Some(cont) = c
+                .checked_sub(1)
+                .and_then(|i| data.continents.get(i as usize))
+            else {
+                info!(
+                    "map-jump: no exact click→world law at the world level — zoom into a \
+                     continent first"
+                );
+                return;
+            };
+            let rect = match z.checked_sub(1) {
+                None => cont.rect,
+                Some(i) => match cont.zones.get(i as usize) {
+                    Some(zone) => zone.rect,
+                    None => return,
+                },
+            };
+            (rect, cont.map_id)
+        }
     };
     // `zone_world` lerps BOTH axes by its single `t` (the binary's own shape) — so it is called
     // once per axis, which is how the reference's own callers consume it.
     let (_, wy) = map_proj::zone_world(rect, u);
     let (wx, _) = map_proj::zone_world(rect, v);
-    let text = format!(".go xy {wx:.2} {wy:.2} {}", cont.map_id);
+    let text = format!(".go xy {wx:.2} {wy:.2} {map_id}");
     info!("map-jump: {text}");
     let _ = net.0.send(crate::net::ClientCommand::Chat {
         kind: crate::net::ChatKind::Say,
@@ -1067,13 +1233,21 @@ mod tests {
         assert!(!is_degenerate((1e-6, 0.0)));
     }
 
-    /// Our `(continent, zone)` pair, `0` = whole, onto the reference's levels.
+    /// The engine's three selection cells — our `(continent, zone)` pair with `0` = whole, plus
+    /// the direct-area id — onto the reference's levels.
     #[test]
     fn the_selection_pair_maps_onto_the_reference_levels() {
-        assert_eq!(MapLevel::of(0, 0), MapLevel::World);
-        assert_eq!(MapLevel::of(0, 3), MapLevel::World, "continent 0 wins");
-        assert_eq!(MapLevel::of(2, 0), MapLevel::Continent);
-        assert_eq!(MapLevel::of(2, 7), MapLevel::Zone);
+        assert_eq!(MapLevel::of((0, 0, None)), MapLevel::World);
+        assert_eq!(
+            MapLevel::of((0, 3, None)),
+            MapLevel::World,
+            "continent 0 wins"
+        );
+        assert_eq!(MapLevel::of((2, 0, None)), MapLevel::Continent);
+        assert_eq!(MapLevel::of((2, 7, None)), MapLevel::Zone);
+        // An instance map takes the ZONE arms of both gates it feeds — `0x4a79de`'s level flag
+        // and `0x4a8856`'s forced textureIndex 15 — even though it shares the world sheet's pair.
+        assert_eq!(MapLevel::of((0, 0, Some(443))), MapLevel::Zone);
     }
 
     /// The REAL `AreaPOI.dbc`, run through the whole gate chain the way the feed does — the
@@ -1210,7 +1384,9 @@ mod player_zone_tests {
         }
     }
 
-    /// Azeroth (map 0) with Elwynn at catalog index 9 (→ Lua zone 10), plus Kalimdor (map 1).
+    /// Azeroth (map 0) with Elwynn at catalog index 9 (→ Lua zone 10), plus Kalimdor (map 1) —
+    /// and one orphan, Warsong Gulch's real row (`WorldMapArea` 443 on map 489), which is in
+    /// neither continent's list because no continent record carries its map.
     fn data() -> WorldMapUiData {
         WorldMapUiData {
             continents: vec![
@@ -1233,6 +1409,18 @@ mod player_zone_tests {
                         .collect(),
                 },
             ],
+            direct: vec![DirectAreaEntry {
+                id: 443,
+                map_id: 489,
+                rect: rect(),
+                view: WorldMapZoneView {
+                    name: "Warsong Gulch".into(),
+                    area_id: 3277,
+                    map_file: "WarsongGulch".into(),
+                    loc_rect: (1.0, -1.0, 1.0, -1.0),
+                    overlays: Vec::new(),
+                },
+            }],
         }
     }
 
@@ -1245,27 +1433,92 @@ mod player_zone_tests {
     #[test]
     fn an_unresolved_zone_falls_back_to_the_continent_not_the_world() {
         let d = data();
+        let on_continent = |c, z| PlayerSelection {
+            zone: Some((c, z)),
+            direct: None,
+        };
 
         // Both halves resolve: Elwynn is continent 2, zone 10.
-        assert_eq!(resolve_player_zone(&d, 0, Some(12)), Some((2, 10)));
+        assert_eq!(
+            resolve_player_selection(&d, 0, Some(12)),
+            on_continent(2, 10)
+        );
 
         // The continent resolves, the zone does not — an area the catalog has no row for.
         assert_eq!(
-            resolve_player_zone(&d, 0, Some(4242)),
-            Some((2, 0)),
+            resolve_player_selection(&d, 0, Some(4242)),
+            on_continent(2, 0),
             "SetMap(continent, -1); GetCurrentMapZone reads that back as 0"
         );
 
         // The area feed has not answered yet — same leg, not the world view.
         assert_eq!(
-            resolve_player_zone(&d, 0, None),
-            Some((2, 0)),
+            resolve_player_selection(&d, 0, None),
+            on_continent(2, 0),
             "a zone we do not know YET is still this continent"
         );
 
-        // No continent match at all (an instance map) — the one leg that is genuinely None, and
-        // whose reference counterpart is the -2 orphan list we do not model.
-        assert_eq!(resolve_player_zone(&d, 389, Some(12)), None);
+        // No continent match and no orphan either (map 389 is Ragefire Chasm — a dungeon with no
+        // `WorldMapArea` row at all): both cells empty, which IS the reference's `SetMap(-1, -1)`.
+        assert_eq!(
+            resolve_player_selection(&d, 389, Some(12)),
+            PlayerSelection::default()
+        );
+    }
+
+    /// **The third leg — a battleground.** No continent record carries map 489, so `0x4a6650`'s
+    /// continent loop misses and only then does the orphan loop run, matching on the row's own
+    /// mapID and selecting `SetMap(-2, 443)` — the row's **ID**, not its place in the list.
+    /// Everything that draws the battle map hangs off that: `GetMapInfo()` answers nil without it,
+    /// and `Blizzard_BattlefieldMinimap.lua:83-86` returns before it draws a single tile.
+    #[test]
+    fn a_battleground_takes_the_orphan_leg_and_projects_on_its_own_rect() {
+        let d = data();
+
+        assert_eq!(
+            resolve_player_selection(&d, 489, Some(3277)),
+            PlayerSelection {
+                zone: None,
+                direct: Some(443),
+            },
+            "the orphan leg selects the WorldMapArea row id"
+        );
+        // The continent loop runs FIRST: a map that IS a continent's never reaches the orphan
+        // list, even were a row to shadow it.
+        assert_eq!(
+            resolve_player_selection(&d, 0, Some(12)).direct,
+            None,
+            "a continent match short-circuits before the orphan loop"
+        );
+
+        // The projection: the direct state goes through the selected row's OWN rect (the same
+        // tail the zone case uses), gated to that row's map. The fixture rect is [-1, 1] on both
+        // axes, so the origin is its centre.
+        let sel = (0, 0, Some(443));
+        assert_eq!(
+            project_on_displayed(&d, sel, 489, 0.0, 0.0),
+            Some((0.5, 0.5)),
+            "a body in the battleground lands on the battleground map"
+        );
+        assert_eq!(
+            project_on_displayed(&d, sel, 0, 0.0, 0.0),
+            None,
+            "`0x4a7437`: a body on another map is refused, which is the (0,0) hide sentinel"
+        );
+        assert_eq!(
+            project_on_displayed(&d, (0, 0, Some(9999)), 489, 0.0, 0.0),
+            None,
+            "an id no row carries resolves to nothing rather than indexing anything"
+        );
+        // And the direct cell WINS over the pair it shares its `(0, 0)` with — read the pair
+        // alone and an instance map projects as the world sheet.
+        assert_eq!(
+            project_on_displayed(&d, (0, 0, None), 489, 0.0, 0.0),
+            None,
+            "the world sheet has no continent for map 489 at all"
+        );
+        assert_eq!(MapLevel::of(sel), MapLevel::Zone);
+        assert_eq!(MapLevel::of((0, 0, None)), MapLevel::World);
     }
 
     /// **The engine selects the player's zone itself, on the first world-enter** — the side call
@@ -1281,25 +1534,206 @@ mod player_zone_tests {
     /// perfectly non-zero pair.
     #[test]
     fn the_engine_selects_the_players_zone_on_first_world_enter() {
+        let on_continent = |c, z| PlayerSelection {
+            zone: Some((c, z)),
+            direct: None,
+        };
         // Frame 1, no area yet: the reference cannot be here at all (`0x67e510` bails before
         // `0x494780` on a zero zone id), so neither are we — syncing now would take the
         // continent leg and, since the engine never re-syncs, strand us there.
-        assert_eq!(world_enter_selection(false, None, Some((2, 0))), None);
+        assert_eq!(world_enter_selection(false, None, on_continent(2, 0)), None);
 
         // The area answers: sync, once, to the player's own zone.
         assert_eq!(
-            world_enter_selection(false, Some(12), Some((2, 10))),
-            Some((2, 10))
+            world_enter_selection(false, Some(12), on_continent(2, 10)),
+            Some(on_continent(2, 10))
         );
 
         // And never again. A later zone change — even cross-continent — leaves the selection
         // alone: the guard is `old == 0`, and only the world-session teardown `0x491180`
         // re-zeroes `[0xb4e314]`.
-        assert_eq!(world_enter_selection(true, Some(40), Some((2, 22))), None);
+        assert_eq!(
+            world_enter_selection(true, Some(40), on_continent(2, 22)),
+            None
+        );
 
         // An unresolvable player still counts as synced rather than re-arming the gate every
         // frame: EVERY exit of `0x4a6650` writes the selection, and its two failure legs write
         // `SetMap(-1, -1)` — which `GetCurrentMapContinent` reads back to Lua as `0`.
-        assert_eq!(world_enter_selection(false, Some(12), None), Some((0, 0)));
+        assert_eq!(
+            world_enter_selection(false, Some(12), PlayerSelection::default()),
+            Some(PlayerSelection::default())
+        );
+
+        // Logging STRAIGHT INTO a battleground: the once-per-session sync carries the direct cell
+        // too. Dropping it here would strand that whole session on the world sheet, because
+        // nothing re-arms the gate.
+        let bg = PlayerSelection {
+            zone: None,
+            direct: Some(443),
+        };
+        assert_eq!(world_enter_selection(false, Some(3277), bg), Some(bg));
+    }
+}
+
+#[cfg(test)]
+mod direct_area_tests {
+    use super::*;
+
+    /// The real catalog off the player's own chain, or a skip.
+    fn real_catalog() -> Option<(Vec<WorldMapContinentView>, WorldMapUiData)> {
+        let data = benilla_formats::wow_data_or_skip!(None);
+        let mut chain = benilla_formats::open_chain(&data).expect("chain");
+        let areas = benilla_formats::load_area_table_catalog(&mut chain).expect("AreaTable");
+        let maps = benilla_assets::MapCatalogRes(
+            benilla_formats::load_map_catalog(&mut chain).expect("Map"),
+        );
+        Some(build_catalog(&mut chain, &areas, &maps).expect("the real catalog"))
+    }
+
+    /// **The whole population of the direct-area state in 1.12.1**, off the shipped
+    /// `WorldMapArea.dbc` (51 rows): the three battlegrounds, in the file order `0x4a5d00`'s fill
+    /// pass appends in — Alterac Valley, Warsong Gulch, Arathi Basin — and nothing else. The
+    /// complement rule is what produces them: `areaID != 0` (so not a continent row) and a mapID
+    /// no continent record carries (so not a zone either). Skips without client data.
+    #[test]
+    fn the_real_dbc_carries_exactly_the_three_battleground_orphans() {
+        let Some((views, data)) = real_catalog() else {
+            return;
+        };
+
+        assert_eq!(
+            data.direct
+                .iter()
+                .map(|d| (d.id, d.map_id, d.view.map_file.as_str()))
+                .collect::<Vec<_>>(),
+            vec![
+                (401, 30, "AlteracValley"),
+                (443, 489, "WarsongGulch"),
+                (461, 529, "ArathiBasin"),
+            ],
+            "file order, no sort — the reference's fill pass appends as it walks"
+        );
+
+        // They are in NEITHER continent list: that is the whole reason a third state exists.
+        for d in &data.direct {
+            assert!(
+                !views
+                    .iter()
+                    .any(|c| c.zones.iter().any(|z| z.map_file == d.view.map_file)),
+                "{} is no continent's child",
+                d.view.map_file
+            );
+        }
+        assert!(
+            data.continents
+                .iter()
+                .all(|c| c.map_id == 0 || c.map_id == 1),
+            "and the continents are still only Azeroth and Kalimdor"
+        );
+
+        // Alterac Valley is the only battleground with overlay art (3 rows keyed on WMA 401);
+        // the other two have none, so a fully explored character still sees bare detail tiles.
+        let overlays = |folder: &str| {
+            data.direct
+                .iter()
+                .find(|d| d.view.map_file == folder)
+                .map(|d| d.view.overlays.len())
+        };
+        assert_eq!(overlays("AlteracValley"), Some(3));
+        assert_eq!(overlays("WarsongGulch"), Some(0));
+        assert_eq!(overlays("ArathiBasin"), Some(0));
+    }
+
+    /// **The bug, end to end, on the real data**: a body standing in Warsong Gulch (map 489)
+    /// resolves to the direct area, the engine selects it with no Lua in the loop, and
+    /// `GetMapInfo()` answers `"WarsongGulch"` — the art-folder identifier the stock
+    /// `Blizzard_BattlefieldMinimap.lua:83-86` needs before it will draw a single tile, and the
+    /// name that closes `Interface\WorldMap\WarsongGulch\WarsongGulch1..12` (all twelve ship).
+    /// The continent reads back `-1` (`-2 + 1`) and the zone `0`.
+    ///
+    /// The player's own blip comes with it: the rect centre projects to the middle of the map.
+    /// Skips without client data.
+    #[test]
+    fn a_body_in_warsong_gulch_lands_on_the_warsong_gulch_map() {
+        let Some((views, data)) = real_catalog() else {
+            return;
+        };
+
+        // The resolver: map 489 is no continent's, so the orphan loop answers with the row id.
+        let player = resolve_player_selection(&data, 489, Some(3277));
+        assert_eq!(
+            player,
+            PlayerSelection {
+                zone: None,
+                direct: Some(443),
+            }
+        );
+
+        let mut script = UiScript::new().expect("a bare engine");
+        script.set_world_map_catalog(views);
+        script.set_world_map_direct_areas(
+            data.direct
+                .iter()
+                .map(|d| (d.id, d.view.clone()))
+                .collect::<Vec<_>>(),
+        );
+        // The engine-side first-world-enter sync — `0x4947ac` into the same resolver, no Lua.
+        let (c, z) = player.zone.unwrap_or((0, 0));
+        script.sync_world_map_to_player_zone(c, z, player.direct);
+
+        assert_eq!(
+            script
+                .eval::<(String, i64, i64)>(
+                    "return GetMapInfo(), GetCurrentMapContinent(), GetCurrentMapZone()"
+                )
+                .expect("the getters answer"),
+            ("WarsongGulch".into(), -1, 0)
+        );
+
+        // The blip. The WSG row's rect centre in world coords → the middle of the map art; a body
+        // on Azeroth is refused outright (the reference's `(0, 0)` hide sentinel).
+        let wsg = data
+            .direct
+            .iter()
+            .find(|d| d.id == 443)
+            .expect("the Warsong Gulch row");
+        let (wx, wy) = (
+            (wsg.rect.top + wsg.rect.bottom) / 2.0,
+            (wsg.rect.left + wsg.rect.right) / 2.0,
+        );
+        let selection = script.world_map_selection();
+        assert_eq!(selection, (0, 0, Some(443)));
+        let uv = project_on_displayed(&data, selection, 489, wx, wy).expect("inside the rect");
+        assert!(
+            (uv.0 - 0.5).abs() < 1e-5 && (uv.1 - 0.5).abs() < 1e-5,
+            "the rect centre is the middle of the battle map, got {uv:?}"
+        );
+        assert_eq!(project_on_displayed(&data, selection, 0, wx, wy), None);
+
+        // THE REFRESH TRAP: a world-state push or an exploration update re-selects, and a
+        // re-selection built from the continent/zone pair alone would silently drop the battle
+        // map for the world view (the reference re-passes `direct != -1 ? direct : zone` at all
+        // five of its in-place refresh sites).
+        script.set_world_map_explored(vec![u32::MAX; 64]);
+        script.set_world_map_player_direct_area(player.direct);
+        script
+            .run("SetMapToCurrentZone()")
+            .expect("the OnShow verb");
+        assert_eq!(
+            script
+                .eval::<(String, i64)>("return GetMapInfo(), GetCurrentMapContinent()")
+                .expect("the getters answer"),
+            ("WarsongGulch".into(), -1),
+            "the instance selection survives every refresh path"
+        );
+
+        // And a continent selection clears it — `0x4a67a0`'s other legs all store `-1` there.
+        script.run("SetMapZoom(1)").expect("SetMapZoom");
+        assert_eq!(
+            script.world_map_selection(),
+            (1, 0, None),
+            "selecting a continent clears the direct cell"
+        );
     }
 }
diff --git a/crates/benilla-app/src/video.rs b/crates/benilla-app/src/video.rs
index 6e1d0a76..d829c03d 100644
--- a/crates/benilla-app/src/video.rs
+++ b/crates/benilla-app/src/video.rs
@@ -476,16 +476,268 @@ pub(crate) fn present_mode(vsync: bool) -> PresentMode {
 
 pub(crate) struct VideoPlugin;
 
+/// **The Video Options block's change callbacks** (decision 2303) — the rows the reference
+/// registers from its one video-options registration block (`0x688470`, wow-re
+/// `cvar/scratch/graphics-cost-cvar-census.md` §2), landing on the resources they drive. Each
+/// arm writes only its own resource, so a `ViewDistance` change is `farclip` moving and nothing
+/// else; the clamps are each row's own, stated beside it.
+pub(crate) fn on_cvar(
+    ev: On<crate::cvars::CvarChanged>,
+    mut cfg: ResMut<VideoConfig>,
+    mut view: ResMut<benilla_world::view::ViewDistance>,
+    mut msaa: ResMut<benilla_world::view::MsaaSetting>,
+    msaa_formats: Res<benilla_world::view::MsaaFormats>,
+    mut tex_filter: ResMut<benilla_assets::TexFilterSetting>,
+    mut clutter: ResMut<benilla_world::clutter::ClutterConfig>,
+    mut weather: ResMut<benilla_world::weather::WeatherState>,
+    mut cvars: ResMut<crate::cvars::Cvars>,
+) {
+    use benilla_world::view::{FARCLIP_RANGE, MSAA_RANGE};
+    let v = ev.num();
+    match ev.key().as_str() {
+        // The one string row here (1627), composed in the reference's own `WxH` spelling. A
+        // value that is not a size is consumed with a warn and the window keeps its truth.
+        "gxresolution" => match parse_resolution(&ev.new) {
+            Some(size) => cfg.windowed = size,
+            None => warn!("cvar gxResolution: unparseable value '{}' ignored", ev.new),
+        },
+        // Vertical Sync — a flag like every other checkbox. `apply_present_mode` pushes it to
+        // the window when this resource moves; nothing else reads it.
+        "gxvsync" => cfg.vsync = ev.flag(),
+        // Display mode (1627) — the reference's own polarity: `1` is WINDOWED (the row is
+        // "Windowed Mode"). `apply_window_mode` pushes it to the window when this moves.
+        "gxwindow" => cfg.display = display_from_flag(v),
+        // ── MONKEY (lighting): the dynamic light + shadow system's 29 rows ────────────────────
+        // They live in THIS observer, and not in one of their own beside `shadow_core` /
+        // `dynamic_interior`, because of the law the arm above states: *each arm writes only its
+        // own resource*. Every one of these knobs IS a field of [`VideoConfig`] — the lanes read
+        // that resource per frame (`shadow_core::update_shadows`, `dynamic_interior::bridge`,
+        // `torch_shadow`), none of them owns a resource of its own — so a second observer beside
+        // them would be a second writer of this one resource for no gain, splitting one match
+        // over two files while dirtying exactly the same thing.
+        //
+        // What it DOES cost is the precision of `Res<VideoConfig>::is_changed()`: on upstream's
+        // struct that signal means "a Video Options row moved", and here it means "a video OR a
+        // lighting row moved". The one consumer that cares is `apply_present_mode`, which keeps
+        // 2303's retired value compare for exactly this reason — see its doc.
+        //
+        // Clamps are each row's own, stated beside it, exactly as for the reference rows above;
+        // the `ours(...)` entries in `cvars::REGISTERED` carry the matching defaults, and
+        // `cvars::tests::registered_defaults_mirror_the_code_truths` welds all 29 pairs.
+        "worldshadows" => cfg.world_shadows = ev.flag(),
+        "charactershadows" => cfg.character_shadows = ev.flag(),
+        "shadowdistance" => {
+            cfg.shadow_distance = v.clamp(
+                *crate::shadow_core::SHADOW_DISTANCE_RANGE.start(),
+                *crate::shadow_core::SHADOW_DISTANCE_RANGE.end(),
+            )
+        }
+        // MONKEY (sun shadow perf): the five cost dials, clamped at the edge like every numeric row
+        // here. `shadowMapSize` SNAPS onto the power-of-two ladder rather than clamping into a
+        // range — an off-ladder value is not a weaker setting, it is one Bevy silently rounds UP
+        // into a bigger and slower map than the one that was typed.
+        "shadowmapsize" => {
+            cfg.shadow_map_size = crate::shadow_core::clamp_shadow_map_size(v.max(0.0) as u32)
+        }
+        "shadowfilter" => {
+            cfg.shadow_filter = (v.max(0.0) as u32).min(crate::shadow_core::MAX_SHADOW_FILTER)
+        }
+        // `0` is MEANINGFUL on both rate rows (the pre-cvar every-frame rebuild), so they floor at
+        // 0 rather than at 1 — the shadow off-switches are `characterShadows` / `worldShadows`.
+        "charactershadowrate" => {
+            cfg.character_shadow_rate =
+                (v.max(0.0) as u32).min(crate::shadow_core::MAX_SHADOW_RATE)
+        }
+        "worldshadowrate" => {
+            cfg.world_shadow_rate = (v.max(0.0) as u32).min(crate::shadow_core::MAX_SHADOW_RATE)
+        }
+        "shadowcasterreach" => {
+            cfg.shadow_caster_reach = v.clamp(
+                *crate::shadow_core::CASTER_REACH_RANGE.start(),
+                *crate::shadow_core::CASTER_REACH_RANGE.end(),
+            )
+        }
+        // MONKEY (dynamic interiors): the interior lane's on/off + knobs, clamped at the edge like
+        // every other numeric row. `dynamic_interior::bridge` publishes them to benilla-world.
+        "interiorlight" => cfg.interior_light = ev.flag(),
+        "interiorambient" => cfg.interior_ambient = v.clamp(0.0, 1.0),
+        "interiorfill" => cfg.interior_fill = v.clamp(0.0, 2.0),
+        "interiorexposure" => cfg.interior_exposure = v.clamp(0.25, 8.0),
+        // MONKEY (interior attenuation): the authored-window scale. `0` is a MEANINGFUL value here
+        // (the window off), so the range floors at 0 rather than at a small positive.
+        "interiorattenscale" => cfg.interior_atten_scale = v.clamp(0.0, 8.0),
+        "interiorroomgate" => cfg.interior_room_gate = ev.flag(),
+        "interiorshadows" => cfg.interior_shadows = ev.flag(),
+        // MONKEY (outdoor torch shadows): a flag like every other checkbox here. Live — the lane
+        // reads `VideoConfig` every frame, so `0` fades the outdoor shadows out (the slots evict
+        // through the same cross-fade a walked-away fixture does) and `1` fades them back in.
+        "exteriorshadows" => cfg.exterior_shadows = ev.flag(),
+        // MONKEY (torch caster selection): the working-set size and the PCF radius, clamped at the
+        // edge like every other numeric row. `casters` floors at 1, not 0 — `interiorShadows 0` is
+        // already the off switch, and a 0 here would be a second, confusing one.
+        "interiorshadowcasters" => cfg.interior_shadow_casters = (v.max(1.0) as u32).clamp(1, 16),
+        // MONKEY (static torch cache): the live bank rank, 1..`MAX_TORCH_DYNAMIC`.
+        "interiorshadowdynamic" => {
+            cfg.interior_shadow_dynamic =
+                (v.max(1.0) as u32).clamp(1, crate::torch_shadow::MAX_TORCH_DYNAMIC as u32)
+        }
+        // MONKEY (torch lane perf): the moving-caster regather cadence in Hz. `0` is MEANINGFUL
+        // here (every frame -- the behaviour before the gate), so unlike `casters` this floors at
+        // 0 rather than at 1. Ceiling 240 so a typo cannot ask for a per-frame rebuild AND a
+        // divide by a huge number; anything at or above the frame rate is already "every frame".
+        "interiorshadowentityrate" => {
+            cfg.interior_shadow_entity_rate = (v.max(0.0) as u32).min(240)
+        }
+        "interiorshadowsoft" => cfg.interior_shadow_soft = v.clamp(0.5, 3.0),
+        // MONKEY (shadow floor): 0 IS meaningful (shadows off), so this floors at 0, not at a
+        // minimum-useful value; 1 is the pre-feature pitch black.
+        "torchshadowstrength" => cfg.torch_shadow_strength = v.clamp(0.0, 1.0),
+        "interiordebug" => cfg.interior_debug = (v.max(0.0) as u32).min(4),
+        // MONKEY (darkness gains): the two dim dials, clamped at the edge like every numeric row
+        // here. The floor is 0.2 rather than 0: a true 0 would be indistinguishable from a broken
+        // light pack (black world / black room), and the off switch people actually want is `1`.
+        "nightgain" => cfg.night_gain = v.clamp(0.2, 1.5),
+        "interiorgain" => cfg.interior_gain = v.clamp(0.2, 1.5),
+        // MONKEY (enclosed day floor): 0 IS meaningful here (it restores the pre-feature look
+        // exactly), unlike the two dim dials above whose 0 would be a broken-looking world.
+        "interiordaylight" => cfg.interior_daylight = v.clamp(0.0, 1.0),
+        // MONKEY (bake floor): 0 IS meaningful here too (it restores the pre-feature look exactly).
+        // The upper clamp matters more than usual: the packer multiplies this by `interiorGain`
+        // (up to 1.5) and rides the product in a lane fraction that must stay under 0.5 after
+        // scaling, so a value that escaped this clamp would reach the world-shadow flag it shares
+        // a lane with. `pack_bake_lane` clamps the product too — belt and braces, one at each end.
+        "interiorbakefloor" => cfg.interior_bake_floor = v.clamp(0.0, 1.0),
+        // MONKEY (fire GO lights): the synthesised-fire gain, clamped at the edge like the rest.
+        "firelightgain" => cfg.fire_light_gain = v.clamp(0.0, 4.0),
+        // MONKEY (spellLightGain): the spell lane's gain, same range and same edge clamp — and `0`
+        // is meaningful here (the lane off) exactly as it is for the fire gain above.
+        "spelllightgain" => cfg.spell_light_gain = v.clamp(0.0, 4.0),
+        // MONKEY (flame flicker): 0..2 — the amplitudes are authored at 1, and 2 is the deliberate
+        // over-drive for judging the shape. Clamped at the edge like every knob here.
+        "fireflicker" => cfg.fire_flicker = v.clamp(0.0, 2.0),
+        // ── end MONKEY (lighting) ─────────────────────────────────────────────────────────────
+        "farclip" => view.farclip = v.clamp(*FARCLIP_RANGE.start(), *FARCLIP_RANGE.end()),
+        // The reference REFUSES an out-of-range write here rather than clamping (`0x688d90`
+        // echoes "NearClip must be in range 0.01 - 0.33" and returns 0). We clamp, which is the
+        // table's standing posture for every range — the consumer clamps at its own edge.
+        "nearclip" => view.set_nearclip(v),
+        // Multisampling (1629) — the reference's own `atoi`-then-clamp `[1, 16]` at `0x63b250`,
+        // then the DEVICE's ceiling (1643): a count this GPU does not offer is not a setting
+        // that degrades, it is a wgpu validation error that kills the render thread on frame
+        // one. Clamping at the write covers every writer there is: the file, a Lua `SetCVar`,
+        // the dropdown, and the Defaults button. Latched: the camera reads this once, at spawn.
+        "gxmultisample" => {
+            let asked = (v as u32).clamp(*MSAA_RANGE.start(), *MSAA_RANGE.end());
+            let granted = msaa_formats.clamp(asked);
+            if granted != asked {
+                // At `warn`, the same posture as the seed clamp: the player asked for something
+                // and did not get it, and this is the only place that fact exists.
+                warn!("cvar gxMultisample: this GPU does not offer {asked}x multisampling — using {granted}x");
+            }
+            msaa.samples = granted;
+        }
+        // The filter policy's two halves (1642). Both write a value nothing reads until the
+        // next launch — the process policy is published once at the end of `CvarLoad` — which
+        // is benilla's limitation, not a latch: the reference registers both with `flags = 1`
+        // and applies them live. `anisotropic` takes the reference's own parse-then-clamp
+        // `[1, 16]` (`0x689110`); `trilinear` is a flag like every other.
+        "trilinear" => tex_filter.trilinear = ev.flag(),
+        "anisotropic" => {
+            tex_filter.aniso = (v as u32).clamp(
+                *benilla_assets::ANISO_RANGE.start(),
+                *benilla_assets::ANISO_RANGE.end(),
+            )
+        }
+        // The panel's 0/1/2 lands as the density multiplier ×1/×2/×3; the clamp is the 1.12
+        // slider's own range (an off-grid hand-edit rides between stops, like every slider).
+        // The SAME knob has a second registered spelling (2151), MIRRORED below — the knob is
+        // already written, so the sibling row follows without a callback — so `GetCVar` never
+        // answers two detail levels for one ground cover.
+        "worlddetail" => {
+            clutter.density = v.clamp(0.0, 2.0) + 1.0;
+            cvars.mirror(
+                benilla_ui::script::CVAR_FRILL_DENSITY,
+                &clutter.frill_density().to_string(),
+            );
+        }
+        // …and in the reference's own cells-per-chunk, with the reference's own `[1, 256]`
+        // clamp rather than the stop's — `ClutterConfig::set_frill_density` carries both, and
+        // `terrain_stream::rescatter_clutter` re-scatters the loaded tiles off the resulting
+        // density change exactly as it does for the row above (0992's setter law, which is the
+        // callback's own chunk rebuild).
+        "frilldensity" => {
+            clutter.set_frill_density(v);
+            cvars.mirror(
+                benilla_ui::script::CVAR_WORLD_DETAIL,
+                &(clutter.density - 1.0).to_string(),
+            );
+        }
+        // Weather Intensity, the panel's 0..3 step 1 (2181). The reference's callback is
+        // `0x67b870`, a jump table (`0x67b8e8`) mapping 0/1/2/3 onto the quality cells
+        // {0.1, 0.33, 0.66, 1.0} in `[0x8680ec]` (wow-re `graphics-cost-cvar-census.md` §4).
+        // What that table does with an off-grid int is NOT carved, so the clamp here is the
+        // table's own standing posture rather than a fidelity claim — and it costs nothing
+        // either way, because `WeatherState::density_gain` already `.min(3)`s its own index.
+        "weatherdensity" => weather.weather_density = v.trunc().clamp(0.0, 3.0) as u8,
+        _ => {}
+    }
+}
+
+/// `/console detailDoodadAlpha [0..255]` — the reference's own console command (`0x6739a0`;
+/// registrar `0x63f9e0`, a command table and not `CVar::Register`, so it never persists — 1804
+/// does not apply to it). It is the **ground-clutter cutout reference**, the dial that decides
+/// where grass first appears: the detail-doodad draw alpha-tests `texel.a x distance_ramp`
+/// against it, so at the default 128 nothing survives past ~61 yd of the 70 yd horizon, and
+/// lowering it walks that onset out toward the horizon. The reference rejects an out-of-range
+/// value rather than saturating (`0x6739b9: cmp eax,0xff; jbe`), so out-of-range and
+/// unparseable are the same here: a readout with the usage. Bare = the readout (the reference
+/// reads an uninitialised stack slot there; a readout is the useful reading of "no argument").
+fn detail_doodad_alpha(world: &mut World, args: &str) -> Vec<String> {
+    let Some(mut clutter) = world.get_resource_mut::<benilla_world::clutter::ClutterConfig>()
+    else {
+        return vec!["detailDoodadAlpha: this run has no ground clutter".to_string()];
+    };
+    match args
+        .split_whitespace()
+        .next()
+        .and_then(|v| v.parse::<u8>().ok())
+    {
+        Some(v) => {
+            clutter.alpha_ref = f32::from(v) / 255.0;
+            vec![format!("detailDoodadAlpha set to {v}")]
+        }
+        None => vec![format!(
+            "detailDoodadAlpha is {} (usage: /console detailDoodadAlpha 0-255)",
+            (clutter.alpha_ref * 255.0).round() as u32
+        )],
+    }
+}
+
 impl Plugin for VideoPlugin {
     fn build(&self, app: &mut App) {
+        use crate::console::ConsoleCommandApp;
+        app.add_observer(on_cvar);
+        app.console_command(
+            "detailDoodadAlpha",
+            "The ground-clutter cutout reference, 0-255 (128 = the default).",
+            detail_doodad_alpha,
+        );
         app.init_resource::<VideoConfig>()
             .init_resource::<GxRestarts>()
             .add_systems(Startup, (log_display_session, check_window_pinned).chain())
             .add_systems(
                 Update,
                 (
-                    (drain_restart_gx, (apply_present_mode, apply_window_mode)).chain(),
-                    publish_display_modes,
+                    // After the tick, and after the CVar sync: the stock video window's Okay is
+                    // `SetCVar` per changed row and then `RestartGx()`, in one handler, so the
+                    // staged rows have to be in the registry before the commit reads it
+                    // (decision 2304).
+                    (drain_restart_gx, (apply_present_mode, apply_window_mode))
+                        .chain()
+                        .after(crate::ui_script::UiInput)
+                        .after(crate::cvars::sync_cvars),
+                    // A push the tick may read (`GetScreenResolutions`): the feed phase.
+                    publish_display_modes.in_set(crate::ui_script::UiFeed),
                 ),
             );
     }
@@ -500,27 +752,40 @@ impl Plugin for VideoPlugin {
 #[derive(Resource, Default, Clone, Copy, PartialEq, Eq, Debug)]
 pub(crate) struct GxRestarts(u32);
 
-/// Move the interface's `RestartGx()` calls into [`GxRestarts`].
+/// Move the interface's `RestartGx()` calls into [`GxRestarts`] — and **commit the latch**.
 ///
-/// benilla applies its video settings live (this module's doc says so for `gxVSync` and the
-/// display mode), so what a restart means HERE is "re-assert them against the window now" rather
-/// than "tear the device down and rebuild it". The two systems below do the asserting; this one
-/// only carries the request across the VM boundary.
+/// The `gx*` rows are latched, as the reference registers them (flags `3`, decision 2303): a
+/// `SetCVar("gxVSync", 0)` or a `/console gxWindow 1` is staged, `GetCVar` keeps answering the
+/// applied value, and nothing moves until `RestartGx()` — which in the reference re-creates the
+/// device and calls `CVar::Update 0x63e060` on each row from inside it. Here the commit is
+/// [`crate::cvars::Cvars::commit_latched`], its observers run at the sync point before the two
+/// appliers below, and what a restart means beyond that is "re-assert the settings against the
+/// window now" rather than "tear the device down": wgpu reconfigures the surface on the next
+/// present. The two systems below do the asserting; this one carries the request across the VM
+/// boundary and fires the commit.
 fn drain_restart_gx(
     script: Option<NonSendMut<benilla_ui::script::UiScript>>,
     mut restarts: ResMut<GxRestarts>,
+    mut cvars: ResMut<crate::cvars::Cvars>,
+    mut commands: Commands,
 ) {
     let Some(mut script) = script else {
         return;
     };
     let asks = script.take_restart_gx_asks();
     if asks == 0 {
-        // Never touch the resource on a quiet frame: a `ResMut` deref-mut is a change signal, and
+        // Never touch the resources on a quiet frame: a `ResMut` deref-mut is a change signal, and
         // both consumers below are gated on the value moving.
         return;
     }
     restarts.0 = restarts.0.wrapping_add(asks);
-    info!("video: RestartGx — re-asserting the display mode and present mode");
+    let committed = cvars.commit_latched();
+    if cvars.has_events() {
+        for event in cvars.take_events() {
+            commands.trigger(event);
+        }
+    }
+    info!("video: RestartGx — {committed} staged setting(s) committed; re-asserting the display mode and present mode");
 }
 
 /// **The reference's own three filters on the resolution list** (wow-re
@@ -780,16 +1045,25 @@ fn display_session() -> String {
 
 /// Push the setting to the window **when the setting moves**, and only then.
 ///
-/// The value compare is the `rescatter_clutter` pattern (0992), and it is load-bearing for two
-/// separate reasons. `Res::is_changed()` over-fires: the cvar sync builds its `Knobs` bundle by
-/// deref-mutting *every* knob resource, so any CVar write anywhere flags this one. And re-asserting
-/// the setting every frame would fight the capture probes, which write `present_mode` on the window
-/// directly mid-run (`capture::mod`, `probes::live_fps`) to uncap a measurement — their override
-/// has to stick.
+/// `Res::is_changed()` is the honest signal since 2303: [`on_cvar`] writes this resource only
+/// when one of its own rows moved (before the registry, the CVar host's knob bundle deref-mutted
+/// every knob on every write, and this carried a value compare to work around it). The gate is
+/// load-bearing: re-asserting the setting every frame would fight the capture probes, which
+/// write `present_mode` on the window directly mid-run (`capture::mod`, `probes::live_fps`) to
+/// uncap a measurement — their override has to stick.
 ///
-/// First sight deliberately does **not** just arm: `load_config` applies the saved value at
-/// `Startup`, after the window already exists at its boot mode, so the first run is the one that
-/// reconciles them.
+/// First sight deliberately does **not** just arm: an inserted resource reads as changed on its
+/// first frame, and `load_config` applies the saved value at `Startup`, after the window already
+/// exists at its boot mode — so the first run is the one that reconciles them.
+///
+/// **MONKEY (lighting): the value compare 2303 retired is kept here, on top of `is_changed()`.**
+/// Upstream could drop it because on ITS `VideoConfig` every row is a Video Options row, so
+/// "the resource moved" and "a display row moved" are the same fact. This branch hangs 29
+/// lighting knobs off the same resource (`interiorGain`, `torchShadowStrength`, …), each written
+/// by its own arm of [`on_cvar`] — so `is_changed()` alone would let a `SetCVar("interiorGain")`
+/// re-assert the present mode, and the inner `!=` guard below would then happily undo exactly the
+/// probe override this gate exists to protect (a probe writes `AutoNoVsync` on the window while
+/// `cfg.vsync` still says on). `is_changed()` stays as the cheap pre-filter.
 fn apply_present_mode(
     cfg: Res<VideoConfig>,
     restarts: Res<GxRestarts>,
@@ -799,7 +1073,7 @@ fn apply_present_mode(
 ) {
     // A `RestartGx()` re-asserts even when nothing moved — that is what the caller asked for.
     let forced = std::mem::replace(&mut *last_restart, restarts.0) != restarts.0;
-    if last.replace(cfg.vsync) == Some(cfg.vsync) && !forced {
+    if (!cfg.is_changed() || last.replace(cfg.vsync) == Some(cfg.vsync)) && !forced {
         return;
     }
     let want = present_mode(cfg.vsync);
@@ -829,14 +1103,13 @@ fn apply_window_mode(
     cfg: Res<VideoConfig>,
     restarts: Res<GxRestarts>,
     mut windows: Query<&mut Window, With<PrimaryWindow>>,
-    mut last: Local<Option<DisplayMode>>,
     mut last_restart: Local<u32>,
 ) {
     // A `RestartGx()` re-asserts even when nothing moved, and that includes re-applying
     // `gxResolution` to a window already in windowed mode — the one video setting whose value can
     // have moved without the MODE moving, and therefore the one this verb is most useful for.
     let forced = std::mem::replace(&mut *last_restart, restarts.0) != restarts.0;
-    if last.replace(cfg.display) == Some(cfg.display) && !forced {
+    if !cfg.is_changed() && !forced {
         return;
     }
     let Ok(mut window) = windows.single_mut() else {
diff --git a/crates/benilla-app/src/vplates.rs b/crates/benilla-app/src/vplates.rs
index 7b514acd..da3f8e01 100644
--- a/crates/benilla-app/src/vplates.rs
+++ b/crates/benilla-app/src/vplates.rs
@@ -56,7 +56,7 @@
 //!   (The questgiver marker raises for a live plate too — a director-pinned DEVIATION: the
 //!   reference really does sit low under a plate (byte-verified, wow-re `questgiver-marker.md`
 //!   Q4a) and the director rejected that overlap; rationale on `quest_markers::pose_markers`,
-//!   0408/0409.)
+//!   2274/2275.)
 //!
 //! (The skull's trivial-gray leg is the shared grey check, [`benilla_ui::script::unit_is_grey`]
 //! — `0x5f0700`, §5-VERIFIED 2026-07-17, the same one the tooltip/quest-range APIs read; it is
@@ -372,7 +372,7 @@ fn feed_plate_globals(
 fn toggle_vplates(
     binds: Res<crate::bindings::BindingsState>,
     mut mode: ResMut<VPlateMode>,
-    script: Option<NonSendMut<benilla_ui::script::UiScript>>,
+    mut cvars: ResMut<crate::cvars::Cvars>,
 ) {
     use crate::bindings::cmd;
     let (was_enemies, was_friends) = (mode.enemies, mode.friends);
@@ -396,14 +396,12 @@ fn toggle_vplates(
         mode.friends = !both;
         info!("nameplates: all {}", if !both { "ON" } else { "OFF" });
     }
-    if let Some(mut script) = script {
-        let flag = |b: bool| if b { "1" } else { "0" };
-        if mode.enemies != was_enemies {
-            script.set_cvar_engine(CVAR_ENEMIES, flag(mode.enemies));
-        }
-        if mode.friends != was_friends {
-            script.set_cvar_engine(CVAR_FRIENDS, flag(mode.friends));
-        }
+    let flag = |b: bool| if b { "1" } else { "0" };
+    if mode.enemies != was_enemies {
+        cvars.set(CVAR_ENEMIES, flag(mode.enemies));
+    }
+    if mode.friends != was_friends {
+        cvars.set(CVAR_FRIENDS, flag(mode.friends));
     }
 }
 
@@ -441,7 +439,7 @@ struct PlateWorld<'w, 's> {
 /// name-exclusivity verdict), seat each one, and hand the result to the widget layer as
 /// [`PlateState`] — at constant screen size over the projected anchor + 2/3 yd. Runs after
 /// the script extract), after the targeting chain (it reads the frame's selection verdict).
-#[allow(clippy::too_many_arguments, clippy::type_complexity)] // one Bevy system's full input set
+#[allow(clippy::type_complexity)] // one Bevy system's full input set
 fn drive_vplates(
     mode: Res<VPlateMode>,
     mut plates: ResMut<VPlates>,
@@ -451,7 +449,7 @@ fn drive_vplates(
     // the pointer is driving the camera.
     rig: Res<crate::player::CameraControl>,
     world: PlateWorld,
-    mut names: ResMut<NameCache>,
+    names: Res<NameCache>,
     net_commands: Res<NetCommands>,
     // The widget layer this drives (decision 2148). `None` in a VM-less run (a capture with the
     // interface off, a bare test app) — the gate below then costs one early return.
@@ -884,8 +882,20 @@ pub(crate) struct VPlateSet;
 /// V-key nameplates: the toggles + the per-frame gate/draw.
 pub(crate) struct VPlatesPlugin;
 
+/// The two V-plate toggles' change callback (decision 2303) — the bitmask's two bits, flags
+/// like every other checkbox. Lowercased here like every arm; the consts carry the registered
+/// spelling.
+pub(crate) fn on_cvar(ev: On<crate::cvars::CvarChanged>, mut mode: ResMut<VPlateMode>) {
+    if ev.is(CVAR_ENEMIES) {
+        mode.enemies = ev.flag();
+    } else if ev.is(CVAR_FRIENDS) {
+        mode.friends = ev.flag();
+    }
+}
+
 impl Plugin for VPlatesPlugin {
     fn build(&self, app: &mut App) {
+        app.add_observer(on_cvar);
         app.init_resource::<VPlateMode>()
             .init_resource::<VPlates>()
             .init_resource::<PlateHover>()
@@ -918,7 +928,7 @@ impl Plugin for VPlatesPlugin {
             // system would rewire all of that. A V press can therefore reach the globals a frame late,
             // which costs nothing: their only readers are `UpdateNameplates` at the two world-entry
             // events and an addon that calls it, never a per-frame path.
-            .add_systems(Update, feed_plate_globals.before(crate::ui_script::UiInput));
+            .add_systems(Update, feed_plate_globals.in_set(crate::ui_script::UiFeed));
     }
 }
 
@@ -1005,34 +1015,40 @@ mod tests {
     #[test]
     fn the_v_key_mirrors_into_the_cvar_table() {
         use crate::bindings::{cmd, BindingsState};
+        use crate::cvars::Cvars;
         let mut app = App::new();
-        let script = benilla_ui::script::UiScript::new().unwrap();
-        script.register_cvars([(CVAR_ENEMIES, "0"), (CVAR_FRIENDS, "0")]);
         app.add_systems(Update, toggle_vplates)
             .init_resource::<VPlateMode>()
-            .insert_non_send_resource(script)
+            .init_resource::<Cvars>()
             .insert_resource(BindingsState::test_fired(&[cmd::NAMEPLATES]));
         app.update();
         assert!(app.world().resource::<VPlateMode>().enemies, "V turns on");
-        let mut script = app
-            .world_mut()
-            .non_send_resource_mut::<benilla_ui::script::UiScript>();
+        let moved = |app: &mut App| {
+            app.world_mut()
+                .resource_mut::<Cvars>()
+                .take_events()
+                .into_iter()
+                .map(|e| (e.name, e.new))
+                .collect::<Vec<_>>()
+        };
         assert_eq!(
-            script.take_cvar_changes(),
+            moved(&mut app),
             vec![(CVAR_ENEMIES.to_string(), "1".to_string())],
-            "the change queues, so the host dirties the config file"
+            "the write is an accepted move, so the config dirties and the mirror learns it"
+        );
+        assert_eq!(
+            app.world().resource::<Cvars>().get(CVAR_FRIENDS),
+            Some("0"),
+            "untouched"
         );
-        assert_eq!(script.cvar(CVAR_FRIENDS).as_deref(), Some("0"), "untouched");
 
-        // And back: the same key mirrors the OFF as an engine write too.
+        // And back: the same key mirrors the OFF as a host write too.
         app.world_mut()
             .insert_resource(BindingsState::test_fired(&[cmd::NAMEPLATES]));
         app.update();
         assert!(!app.world().resource::<VPlateMode>().enemies, "V turns off");
         assert_eq!(
-            app.world_mut()
-                .non_send_resource_mut::<benilla_ui::script::UiScript>()
-                .take_cvar_changes(),
+            moved(&mut app),
             vec![(CVAR_ENEMIES.to_string(), "0".to_string())]
         );
 
@@ -1042,20 +1058,14 @@ mod tests {
         app.update();
         assert!(app.world().resource::<VPlateMode>().friends);
         assert_eq!(
-            app.world_mut()
-                .non_send_resource_mut::<benilla_ui::script::UiScript>()
-                .take_cvar_changes(),
+            moved(&mut app),
             vec![(CVAR_FRIENDS.to_string(), "1".to_string())]
         );
 
         // A frame with nothing fired writes nothing at all.
         app.world_mut().insert_resource(BindingsState::default());
         app.update();
-        assert!(app
-            .world_mut()
-            .non_send_resource_mut::<benilla_ui::script::UiScript>()
-            .take_cvar_changes()
-            .is_empty());
+        assert!(moved(&mut app).is_empty());
     }
 
     /// **The FrameXML mirror is owed to every VM** (decision 2132) — the mode's two bits reach
diff --git a/crates/benilla-app/src/world_backdrop.rs b/crates/benilla-app/src/world_backdrop.rs
index 96ce7f43..c1382b61 100644
--- a/crates/benilla-app/src/world_backdrop.rs
+++ b/crates/benilla-app/src/world_backdrop.rs
@@ -428,8 +428,20 @@ fn claim_backdrop(
 /// See the module doc.
 pub(crate) struct WorldBackdropPlugin;
 
+/// Render scale's change callback (1639, 2303). Clamped at the knob's edge like every other
+/// numeric row; the backdrop re-sizes on the next frame and the world camera's target factor
+/// follows it in the same pass, which is what keeps the pick rays where they were.
+pub(crate) fn on_cvar(ev: On<crate::cvars::CvarChanged>, mut scale: ResMut<RenderScale>) {
+    if ev.is("renderScale") {
+        scale.0 = ev
+            .num()
+            .clamp(*RENDER_SCALE_RANGE.start(), *RENDER_SCALE_RANGE.end());
+    }
+}
+
 impl Plugin for WorldBackdropPlugin {
     fn build(&self, app: &mut App) {
+        app.add_observer(on_cvar);
         app.init_resource::<RenderScale>()
             .add_systems(Startup, setup_backdrop)
             .add_systems(
diff --git a/crates/benilla-app/src/world_state.rs b/crates/benilla-app/src/world_state.rs
index 31c7c5c2..d75c7f5d 100644
--- a/crates/benilla-app/src/world_state.rs
+++ b/crates/benilla-app/src/world_state.rs
@@ -62,6 +62,15 @@ impl WorldStates {
         self.values.get(&key).copied().unwrap_or(0) as i32
     }
 
+    /// Every `(key, value)` currently in the table, in no particular order — the instrument
+    /// read, and only that. No reference function enumerates this hash: the client's own readers
+    /// are the point getter above and the `WorldStateUI.dbc` walk, both of which ask for a key
+    /// they already know. A battleground's whole score lives here as raw dwords nobody has a name
+    /// for yet, so a probe that cannot dump it cannot say what arrived (`capture::ProbeBgPlugin`).
+    pub(crate) fn pairs(&self) -> impl Iterator<Item = (u32, i32)> + '_ {
+        self.values.iter().map(|(&k, &v)| (k, v as i32))
+    }
+
     /// The `(map, area)` the last `SMSG_INIT_WORLD_STATES` scoped the table to — the reference's
     /// `[0xb71e84]`/`[0xb71ea8]`, and the filter its world-state UI list is built against. `None`
     /// before any init has arrived, which is the reference's `-1` (its rebuild trigger refuses to
diff --git a/crates/benilla-app/tests/message_keys.rs b/crates/benilla-app/tests/message_keys.rs
index 7a75310b..25a673b3 100644
--- a/crates/benilla-app/tests/message_keys.rs
+++ b/crates/benilla-app/tests/message_keys.rs
@@ -111,10 +111,7 @@ fn every_error_key_in_the_source_resolves_to_real_text() {
         "ERR_PET_SPELL_NOPATH",
     ];
 
-    let data = match benilla_formats::wow_data() {
-        Some(d) => d,
-        None => return,
-    };
+    let data = benilla_formats::wow_data_or_skip!();
     let mut chain = benilla_formats::open_chain(&data).expect("open chain");
     let src = chain
         .read_file("Interface\\FrameXML\\GlobalStrings.lua")
@@ -179,10 +176,7 @@ fn every_voiced_key_the_source_raises_has_audio_for_every_playable_race() {
         (0x31, 2, 0), // ERR_MUST_EQUIP_ITEM, Orc male
     ];
 
-    let data = match benilla_formats::wow_data() {
-        Some(d) => d,
-        None => return,
-    };
+    let data = benilla_formats::wow_data_or_skip!();
     let mut chain = benilla_formats::open_chain(&data).expect("open chain");
     let vocal = benilla_formats::load_vocal_ui_sounds(&mut chain).expect("VocalUISounds.dbc");
     let kits = benilla_formats::load_sound_kit_catalog(&mut chain).expect("SoundEntries.dbc");
@@ -249,10 +243,7 @@ fn every_voiced_key_the_source_raises_has_audio_for_every_playable_race() {
 /// than alongside it. Skips without client data.
 #[test]
 fn every_sounding_catalog_row_also_has_text_to_show() {
-    let data = match benilla_formats::wow_data() {
-        Some(d) => d,
-        None => return,
-    };
+    let data = benilla_formats::wow_data_or_skip!();
     let mut chain = benilla_formats::open_chain(&data).expect("open chain");
     let src = chain
         .read_file("Interface\\FrameXML\\GlobalStrings.lua")
diff --git a/crates/benilla-app/tests/reference_strings.rs b/crates/benilla-app/tests/reference_strings.rs
index 1f81a914..70ec307c 100644
--- a/crates/benilla-app/tests/reference_strings.rs
+++ b/crates/benilla-app/tests/reference_strings.rs
@@ -201,10 +201,7 @@ fn resolves(body: &str) -> bool {
 
 #[test]
 fn no_user_facing_sentence_is_written_in_rust_when_the_reference_ships_one() {
-    let data = match benilla_formats::wow_data() {
-        Some(d) => d,
-        None => return,
-    };
+    let data = benilla_formats::wow_data_or_skip!();
     let mut chain = benilla_formats::open_chain(&data).expect("open chain");
     let mut shipped: HashMap<String, Vec<String>> = HashMap::new();
     // The base tables AND the locale patches laid over them (decision 2052): where `Localize()`
diff --git a/crates/benilla-app/tests/ui_script_wall.rs b/crates/benilla-app/tests/ui_script_wall.rs
new file mode 100644
index 00000000..9d65e37a
--- /dev/null
+++ b/crates/benilla-app/tests/ui_script_wall.rs
@@ -0,0 +1,131 @@
+//! **The reverse wall of decision 1177, measured** — how many files in `benilla-app` outside the
+//! VM's own module name `UiScript`.
+//!
+//! 1177 (2026-08-10) drew the line: the feed layer becomes one module, the only legitimate caller
+//! of the Lua VM, and everything else produces model values. Its instrument was 1160's — a wall
+//! test in `tests/` whose number is ratcheted down by the work — and it named the number: **141
+//! files**. The instrument was never built, and with nothing failing the count went the other
+//! way: 164 files by 2026-09-16 (decision 2265 §A3). This file is the instrument. It does not
+//! decide whether the crate move happens — that stays the director's — it only makes the number
+//! visible on every test run and refuses to let it grow unnoticed.
+//!
+//! "Outside the VM's module" means any `.rs` under `crates/benilla-app/src` whose path does not
+//! start with `ui_script/`; 1177's "feed module" does not exist yet, and when it does the
+//! exclusion moves there. A file counts if it contains the identifier `UiScript` at all — a type
+//! in a parameter list, a `use`, a doc comment naming the seam: each is a place that knows the
+//! FrameXML VM exists, which is the coupling 1177 measures.
+//!
+//! Same shape as `world_api_wall.rs`: `CEILING` is the standing count, `SLACK` keeps a single
+//! closure from failing the gate while making it impossible to bank a whole stage of work without
+//! writing the new number down. `WOW_UISCRIPT_DUMP=1` prints the files.
+
+use std::path::{Path, PathBuf};
+
+/// The standing count. **2026-09-16, 164** — measured the day the instrument was built, against
+/// 1177's 141 five weeks earlier. It moved twice on that one day, for two different files, and
+/// both reasons are kept because each is a different kind of legitimate:
+///
+/// - **165 (decision 2279)** — `game_plugins.rs`, the structural test for the VM's one-shot
+///   consumers, which has to name the identifier it scans for. A test *about* the wall, not a file
+///   that learned the VM exists.
+/// - **166 (decision 2283)** — `capture/probe_stone.rs`, the meeting-stone live probe, joining the
+///   fifteen sibling probes that read the VM *on purpose*. A probe's whole value is that it asks
+///   the **stock** binding (`IsInMeetingStoneQueue()`, `MiniMapMeetingStoneFrame:IsShown()`)
+///   rather than our own mirror of it, so feeding it a model value would make it prove nothing.
+////// - **167 (decision 2290)** — `capture/probe_bg.rs`, the inside-a-battleground live probe, the
+///   same class again and for the same reason, sharpened: it takes the port through the stock
+///   `AcceptBattlefieldPort(slot, 1)` and reads the battleground back through
+///   `GetNumWorldStateUI()`, `GetBattlefieldStatus()` and a Lua event tap. A probe that asked our
+///   own model instead could not have found what this one did — that the battleground's
+///   `CHAT_MSG_BG_SYSTEM_NEUTRAL` lines reach the interface, which no app-side reading shows.
+///
+/// The ratchet is for *production* feed code. Both numbers still went up, and both are written
+/// down — which is the whole point of it, and why two sessions raising it the same day collided
+/// here instead of quietly passing each other.
+const CEILING: usize = 167;
+
+/// How far under [`CEILING`] the count may sit before the test asks for the ceiling to follow it.
+const SLACK: usize = 8;
+
+#[test]
+fn the_vm_is_named_by_no_more_files_than_the_ceiling_says() {
+    let src = Path::new(env!("CARGO_MANIFEST_DIR")).join("src");
+    let mut files: Vec<String> = rs_files(&src)
+        .into_iter()
+        .filter_map(|p| {
+            let rel = p
+                .strip_prefix(&src)
+                .unwrap_or(&p)
+                .to_string_lossy()
+                .replace('\\', "/");
+            if rel.starts_with("ui_script/") || rel == "ui_script.rs" {
+                return None;
+            }
+            let text = std::fs::read_to_string(&p).ok()?;
+            names_ident(&text, "UiScript").then_some(rel)
+        })
+        .collect();
+    files.sort();
+    let n = files.len();
+    eprintln!("files outside ui_script/ naming UiScript: {n} (ceiling {CEILING}, slack {SLACK})");
+    if std::env::var("WOW_UISCRIPT_DUMP").is_ok() {
+        eprintln!("{}", files.join("\n"));
+    }
+    assert!(
+        n <= CEILING,
+        "{n} files outside ui_script/ name UiScript; the ceiling is {CEILING}.\n\
+         A new file learned that the FrameXML VM exists. Decision 1177's line is that only the \
+         feed layer may know; either feed a model value instead, or — if this file genuinely is \
+         feed code — raise CEILING here with the reason, the way world_api_wall.rs requires.\n\
+         WOW_UISCRIPT_DUMP=1 lists the files."
+    );
+    assert!(
+        n + SLACK >= CEILING,
+        "only {n} files name UiScript and the ceiling still says {CEILING}. Lower CEILING to {n} \
+         in this file so the next coupling has to earn its place — the ratchet only holds if the \
+         number follows the work down."
+    );
+}
+
+/// Does `text` contain `ident` as a whole identifier (not as part of a longer one)?
+fn names_ident(text: &str, ident: &str) -> bool {
+    let is_ident = |c: char| c.is_alphanumeric() || c == '_';
+    let mut from = 0;
+    while let Some(i) = text[from..].find(ident) {
+        let at = from + i;
+        let end = at + ident.len();
+        let before_ok = at == 0 || !text[..at].chars().next_back().is_some_and(is_ident);
+        let after_ok = !text[end..].chars().next().is_some_and(is_ident);
+        if before_ok && after_ok {
+            return true;
+        }
+        from = end;
+    }
+    false
+}
+
+fn rs_files(dir: &Path) -> Vec<PathBuf> {
+    let mut out = Vec::new();
+    let mut stack = vec![dir.to_path_buf()];
+    while let Some(d) = stack.pop() {
+        for e in std::fs::read_dir(&d).into_iter().flatten().flatten() {
+            let p = e.path();
+            if p.is_dir() {
+                stack.push(p);
+            } else if p.extension().is_some_and(|x| x == "rs") {
+                out.push(p);
+            }
+        }
+    }
+    out.sort();
+    out
+}
+
+#[test]
+fn the_identifier_match_is_whole_word() {
+    assert!(names_ident("fn f(s: NonSendMut<UiScript>)", "UiScript"));
+    assert!(names_ident("UiScript", "UiScript"));
+    assert!(!names_ident("UiScriptPlugin only", "UiScript"));
+    assert!(!names_ident("MyUiScript", "UiScript"));
+    assert!(names_ident("MyUiScript and UiScript", "UiScript"));
+}
diff --git a/crates/benilla-app/tests/world_api_wall.rs b/crates/benilla-app/tests/world_api_wall.rs
index 62ba79e9..1acd7a17 100644
--- a/crates/benilla-app/tests/world_api_wall.rs
+++ b/crates/benilla-app/tests/world_api_wall.rs
@@ -103,7 +103,14 @@ const INSTRUMENT_ROOTS: &[&str] = &["art_scope", "debug_panel", "perf", "pipe_wa
 /// So they are excluded from the gated number and **counted separately**, because a rule that
 /// hides a number is worse than no rule. `art_scope` is not here: it is registered by
 /// `WorldPlugins` and lives inside the engine, so it never crosses.
-const INSTRUMENT_CONSUMERS: &[&str] = &["debug_panel", "perf", "pipe_warm"];
+///
+/// `crash` (decision 2266 §B2) is the fourth: the panic hook that writes the crash report. It is
+/// `perf::stall`'s sibling — a diagnostic that writes into `Diagnostics/` and nothing gameplay
+/// reads — and the one engine item it names, `log_ring::recent`, is a diagnostic feed kept beside
+/// the engine's `LogPlugin` because that is where the layer has to be installed. An API shaped
+/// by what a crash report wanted to attach is 1163's failure exactly, so it is counted here, not
+/// in the doorway.
+const INSTRUMENT_CONSUMERS: &[&str] = &["crash", "debug_panel", "perf", "pipe_warm"];
 
 /// Is this file one of the app-side instruments?
 fn is_instrument_consumer(rel: &str) -> bool {
@@ -430,7 +437,66 @@ fn is_instrument_consumer(rel: &str) -> bool {
 /// full-window float image that one camera wrote and the next read back — the seam 1603 built
 /// and 2215 measured — and it could not go the other way for 2206's reason: the UI camera cannot
 /// move into the engine.
-const CEILING: usize = 182;
+/// And 182 → 183: `doodad_anim::register_fx_uv`, a PUBLISH — put one spell-effect material clone
+/// on the per-instance UV-scroll lane (decision 2282). The clone is the GAME's: `entities::spell_fx`
+/// makes it because one cast is one phase (the same reason 0271's animated tint clones it), and
+/// nothing engine-side knows an effect instance exists. Everything after that is the engine's —
+/// which registry, which delta-table row, which of 1408's two baked loop spellings, and the
+/// instance-clock law that separates this lane from the shared one. Published as ONE verb rather
+/// than as its three pieces (`UvLoop`'s effect variant, `register_uv`, the row) precisely because
+/// this lane's recurring bug is a caller that takes some of the pieces and not the rest: 2038's
+/// marked-but-unregistered parts froze every waterfall in the game for three days, and a
+/// registration without a row, or a row without a registration, is that same shape. One verb
+/// cannot be half-taken. It is also why the three pieces went back to `pub(crate)` in the same
+/// commit, which is the rare crossing that *lowers* the surface it replaces.
+/// And 183 → 184: `doodad_anim::UvLoops`, the argument of the verb above. A texture transform is
+/// ONE authored record with four baked channels — 1408's two translation spellings plus 2019's
+/// per-slot rotation and scaling — and which of them a batch fills is not a thing the caller gets
+/// to reason about: a scale-only transform (`Spells\GroundingTotem_Impact.mdx`) and a
+/// dead-slot-0 translation both answer `None` to the channel you would check first. So the struct
+/// carries the record whole, and `any()`/`open_offset()` on it are the two questions the game
+/// asks — which keeps the "does this batch animate" predicate and the "what does it open on" seed
+/// in the engine, where the bake's rules live, instead of copied into the effect attach where they
+/// would drift. Four positional `Option`s would have been the alternative, and swapping two of
+/// them is a silent wrong-channel bug the compiler cannot see.
+/// And 184 → 186, both for the ENTITY lane (decision 2295), which is the same crossing 2282 made
+/// for the effect lane and made for the same reason.
+/// `doodad_anim::register_entity_uv` is the second PUBLISH verb on this lane: put a unit /
+/// GameObject / held-item batch material on the UV lane, picking the shared clock or the
+/// instance's play head from the authored record rather than making the caller reason about it.
+/// It is a separate verb from `register_fx_uv` and not a flag on it because the two lanes differ
+/// in the one thing a caller cannot get right by accident — an effect's clocks are measured from
+/// its own attach (0856/0858) and a resident entity's are the scene's — and a boolean spelling of
+/// that would read as a preference.
+/// `model_render::EntityUvLane` is the argument `entity_variants` grew, and the crossing it buys
+/// is the point of the decision: building an entity batch's material and putting it on the lane
+/// are ONE act, so the engine takes the registry and the delta table *in the same call* instead of
+/// handing back six handles and trusting the game to register them. That is 2038's law spelled in
+/// the signature — a `play_uv` flip without a registration freezes every entity batch at its first
+/// key instead of its identity, which is a different wrong frame and not a fix — and it is why the
+/// lane is a bundle rather than three arguments a caller can pass two of.
+/// And 186 → 189, the second half of 2295 — the ONE entity population that needs a material of
+/// its own rather than the batch's, which the dressing path clones and registers because the
+/// clone has to exist before the part's interior and fade records are built from it.
+/// `doodad_anim::AnimMatPart` is the draw-scan marker, and it crosses for the reason 1375 put it
+/// at the spawn site in the first place: the marker and the registration are one predicate, and
+/// the game is where an entity part is spawned. The engine cannot insert it — it does not know
+/// an entity part exists — and a lane that let the two drift is 2038's three frozen days.
+/// `doodad_anim::register_tint` and `doodad_anim::TintLoop` are the tint channel's twins of the
+/// UV verbs above, for the same five batches on three GameObject models: `G_FreezingTrap`'s glow
+/// card, `OrgrimmarPentagram`, `ScholomanceCrystalBall01` — four of whose five batches bake
+/// **nothing** in file slot 0, so a shared material can only ever seed white however faithfully it
+/// is ticked. They were already `pub` for the world streamer; what crosses here is the game naming
+/// them, and it is the same crossing the UV half makes one line up.
+/// And 189 → 190: `terrain_stream::CurrentArea`, taken by `capture/probe_bg.rs` (decision 2290).
+/// It is the engine's own area authority — the `AreaTable.dbc` leaf under the player's feet, which
+/// the engine already publishes for its own audio and zone-text consumers — and the probe reports
+/// it for one reason: a battleground census has to be able to say *where the body actually is*,
+/// and a map id alone cannot. "Map 489" is true of the pen, the field and the graveyard alike; the
+/// area id is what told this instrument that the port lands at Silverwing Hold and that the
+/// release lands at the graveyard. The alternative was to re-derive the leaf in the probe from
+/// tiles the engine already resolved, which is the copy-the-rule drift this wall exists to stop.
+const CEILING: usize = 190;
 
 /// How far under [`CEILING`] the real count may sit before this test asks for the ceiling to be
 /// lowered. Slack, not tolerance: it keeps a single closure from failing the gate, while making it
diff --git a/crates/benilla-assets/Cargo.toml b/crates/benilla-assets/Cargo.toml
index 9107b56d..359e8062 100644
--- a/crates/benilla-assets/Cargo.toml
+++ b/crates/benilla-assets/Cargo.toml
@@ -5,6 +5,9 @@ edition.workspace = true
 license.workspace = true
 description = "Bevy AssetSource + AssetLoaders over the WoW 1.12.1 MPQ patch chain"
 
+[lints]
+workspace = true
+
 [features]
 # Forwarded dev/player seam (0026 · 1173/1174 · 1175). Default-on. `benilla-formats` must be taken
 # with `default-features = false` and its `dev` re-exported here: it is default-on there too, so
diff --git a/crates/benilla-assets/src/anim_rng.rs b/crates/benilla-assets/src/anim_rng.rs
new file mode 100644
index 00000000..66031179
--- /dev/null
+++ b/crates/benilla-assets/src/anim_rng.rs
@@ -0,0 +1,151 @@
+//! The client's **one** `rand()` stream — the MSVC-CRT LCG at `0x7400e5`.
+//!
+//! **It lives down here, below both sides of decision 1160's line, because both sides draw from
+//! it** — `trace`'s placement argument, verbatim, for the same reason. The engine's placed-doodad
+//! host and the game's creature, GameObject and portrait-booth arms all roll a variation off this
+//! sequence, and in the reference they roll it off the *same cell*: `rand` reads and rewrites
+//! `[ptd+0x14]`, one per thread, and every animation arm in the client runs on the primary thread
+//! (`_initterm` is pre-`WinMain`; the frame loop is inline, not spawned — wow-re
+//! `net/scratch/crt-rand-stream-seeding.md` §4). A leaf with no dependencies can be reached by
+//! everything; an owner at the top of the stack cannot be reached by the engine at all.
+//!
+//! **Why one stream and not one per consumer** (decision 0768, and 2301 which found the drift):
+//! a shared sequence is what de-syncs a stand of identical props. Not a per-placement seed — just
+//! consecutive draws. benilla had four independent streams for a while, three of them seeded 0
+//! against the fourth's 1, while all four docstrings claimed to be this one; interleaving is the
+//! whole mechanism, so splitting it is not a harmless refactor.
+//!
+//! **The seed is the reference's, and it is not 1.** `1` is real — the CRT's per-thread default at
+//! `_initptd 0x40aca8`, which is what [`AnimRng::default`] returns — but the client overwrites it
+//! during CRT static initialization, before `WinMain`: `_initterm` slot **3691** (`.data
+//! 0x82a9ac` → the `_dynamic_initializer_for_*` trampoline `0x5b7ff0` → `0x5b8000`) calls
+//! `0x5d1c70`, which calls `srand(GetTickCount())` at `0x5d1c8b`. So the reference's variation
+//! sequence differs on every run, and [`AnimRng::seed_for_session`] is where benilla says the same
+//! thing. Byte-VERIFIED by a wow-re §5 round; recorded in
+//! `net/scratch/crt-rand-stream-seeding.md`.
+//!
+//! **Sequence parity with the reference is not achievable and is not the goal.** Where the stream
+//! stands at any given arm depends on every intervening draw — the noise table `Model2::Initialize`
+//! builds, the sky LUT, every `CParticleEmitter2` constructor, and FrameXML's own `random()` (bound
+//! as a bare global by the embedded `compat.lua`, and called in ordinary play). What benilla
+//! reproduces is the *structure*: one stream, wall-clock seeded, shared, non-repeating across runs.
+
+use bevy::prelude::Resource;
+
+/// The shared `rand()` state — see the module note. Seeded by [`Self::seed_for_session`] at
+/// startup; [`Default`] is the CRT's own pre-`srand` value so a test or a headless build that
+/// never seeds still walks a defined sequence.
+#[derive(Resource)]
+pub struct AnimRng(u32);
+
+impl Default for AnimRng {
+    fn default() -> Self {
+        Self(1) // `_initptd 0x40aca8` — the CRT's per-thread default, before `srand` runs
+    }
+}
+
+impl AnimRng {
+    /// One `rand()` draw: `seed = seed·214013 + 2531011`, result `(seed >> 16) & 0x7fff` — the
+    /// closed range `[0, 32767]`, 32768 equiprobable outcomes, taken with no scale, mask, modulo
+    /// or divide (`0x7400ed`-`0x740101`).
+    pub fn draw(&mut self) -> u16 {
+        self.0 = self.0.wrapping_mul(214_013).wrapping_add(2_531_011);
+        ((self.0 >> 16) & 0x7fff) as u16
+    }
+
+    /// The play-window's **replay count** `R = max(1, min + ((rand()·(max−min)) >> 15))` — the
+    /// reference's `windowHi = now + span·R` (`0x712692`-`0x7126cd`). `replay = (0, 0)`, the
+    /// overwhelming majority, always yields `R = 1`: one loop per window, so the variation
+    /// re-rolls every single pass.
+    ///
+    /// The draw is taken **unconditionally**, even when it cannot change the answer: it is one
+    /// sub-expression of the reference's formula, so the shared stream has to advance the same way
+    /// whatever the span. A caller that skips it de-phases every later draw in the process.
+    pub fn replay_count(&mut self, replay: (u32, u32)) -> u32 {
+        let (lo, hi) = replay;
+        let r = lo + ((u64::from(self.draw()) * u64::from(hi.saturating_sub(lo))) >> 15) as u32;
+        r.max(1)
+    }
+
+    /// The reference's `srand(GetTickCount())` from CRT static init (module note) — a **wall-clock
+    /// seed, once per process**, so a fresh session does not replay the last one's variations.
+    ///
+    /// `deterministic` is the capture carve-out and the only place benilla differs: a golden frame
+    /// has to be reproducible, so a capture run keeps the CRT's own pre-`srand` value. That is the
+    /// same trade every other sim in the harness makes, at the one site that knows a capture is
+    /// running rather than smeared through the lanes that draw.
+    pub fn seed_for_session(&mut self, deterministic: bool) {
+        if deterministic {
+            return;
+        }
+        // `GetTickCount` is milliseconds since boot; the wall clock's sub-second span is the same
+        // kind of number and is what a non-Windows host can offer.
+        self.0 = std::time::SystemTime::now()
+            .duration_since(std::time::UNIX_EPOCH)
+            .map_or(1, |d| d.as_millis() as u32);
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    /// The LCG itself, against the bytes at `0x7400ed`-`0x740101` — and against the CRT's own
+    /// documented sequence from seed 1, which is the one value a reader can check anywhere.
+    #[test]
+    fn the_draw_is_the_crt_lcg() {
+        let mut rng = AnimRng::default();
+        let first: Vec<u16> = (0..6).map(|_| rng.draw()).collect();
+        assert_eq!(first, vec![41, 18_467, 6_334, 26_500, 19_169, 15_724]);
+        // Every draw is inside the closed range the `and eax,0x7fff` produces.
+        assert!(first.iter().all(|&r| r <= 0x7fff));
+    }
+
+    /// `(0, 0)` — the overwhelming majority of shipped sequences — is one pass, and it still costs
+    /// a draw. The second half is the part a "tidy" rewrite breaks: skipping the draw when it
+    /// cannot change the answer de-phases every later roll in the process.
+    #[test]
+    fn a_zero_replay_pair_is_one_pass_and_still_advances_the_stream() {
+        let mut rng = AnimRng::default();
+        assert_eq!(rng.replay_count((0, 0)), 1);
+        let mut bare = AnimRng::default();
+        bare.draw();
+        assert_eq!(
+            rng.draw(),
+            bare.draw(),
+            "the (0,0) window drew exactly once"
+        );
+    }
+
+    /// The window scales with the range, and never below one pass.
+    #[test]
+    fn a_replay_range_scales_the_window() {
+        let mut rng = AnimRng::default();
+        // roll 41 over a 0..8 range: 41·8 >> 15 = 0, so the floor still applies.
+        assert_eq!(rng.replay_count((0, 8)), 1);
+        // A `min` above zero is the floor, whatever the roll.
+        let mut rng = AnimRng::default();
+        assert!(rng.replay_count((3, 3)) == 3);
+        // An inverted pair cannot underflow the subtraction.
+        let mut rng = AnimRng::default();
+        assert_eq!(rng.replay_count((2, 1)), 2);
+    }
+
+    /// A seeded session does not replay the default sequence — the whole point of
+    /// `srand(GetTickCount())` — and a capture run does.
+    #[test]
+    fn a_capture_keeps_the_fixed_seed_and_a_session_does_not() {
+        let mut capture = AnimRng::default();
+        capture.seed_for_session(true);
+        let mut fixed = AnimRng::default();
+        assert_eq!(capture.draw(), fixed.draw());
+
+        let mut live = AnimRng::default();
+        live.seed_for_session(false);
+        assert_ne!(
+            live.0,
+            AnimRng::default().0,
+            "a live session seeds off the wall clock"
+        );
+    }
+}
diff --git a/crates/benilla-assets/src/lib.rs b/crates/benilla-assets/src/lib.rs
index b8d0d3c0..16c7d356 100644
--- a/crates/benilla-assets/src/lib.rs
+++ b/crates/benilla-assets/src/lib.rs
@@ -26,6 +26,9 @@ pub mod materials;
 pub mod minimap_grid;
 mod spatial_cache;
 pub mod trace;
+
+mod anim_rng;
+pub use anim_rng::AnimRng;
 pub use spatial_cache::SpatialCache;
 mod world_assets;
 pub use world_assets::*;
diff --git a/crates/benilla-assets/src/world_assets/mod.rs b/crates/benilla-assets/src/world_assets/mod.rs
index df9bad06..94bd6a98 100644
--- a/crates/benilla-assets/src/world_assets/mod.rs
+++ b/crates/benilla-assets/src/world_assets/mod.rs
@@ -662,8 +662,6 @@ impl WorldAssets {
     /// A `StandardMaterial` for a model submesh, deduped by (texture, blend) so submeshes/models
     /// sharing a texture share one material handle (enabling draw-call batching). A missing/failed
     /// texture falls back to a single shared untextured material.
-    #[allow(clippy::too_many_arguments)]
-    #[allow(clippy::too_many_arguments)]
     pub fn model_material(
         &mut self,
         texture: Option<&str>,
diff --git a/crates/benilla-blp/Cargo.toml b/crates/benilla-blp/Cargo.toml
index ef182020..c0c84dae 100644
--- a/crates/benilla-blp/Cargo.toml
+++ b/crates/benilla-blp/Cargo.toml
@@ -5,6 +5,9 @@ edition.workspace = true
 license.workspace = true
 description = "BLP2 texture decoder for WoW 1.12.1 (build 5875) — in-repo, decision 0021"
 
+[lints]
+workspace = true
+
 [dependencies]
 benilla-bytes = { path = "../benilla-bytes" }
 # S3TC/DXT block decompression — the same fixed-point codec wow-blp uses, so DXT output is
diff --git a/crates/benilla-blp/src/lib.rs b/crates/benilla-blp/src/lib.rs
index 8660c55c..ab6f740c 100644
--- a/crates/benilla-blp/src/lib.rs
+++ b/crates/benilla-blp/src/lib.rs
@@ -524,7 +524,6 @@ mod tests {
     use super::*;
 
     /// Build a minimal-but-complete BLP2 header (magic..=mip_sizes[16], `HEADER_SIZE` bytes).
-    #[allow(clippy::too_many_arguments)]
     fn header(
         compression: u8,
         alpha_bits: u8,
diff --git a/crates/benilla-buildstamp/Cargo.toml b/crates/benilla-buildstamp/Cargo.toml
index 04915de5..690ae057 100644
--- a/crates/benilla-buildstamp/Cargo.toml
+++ b/crates/benilla-buildstamp/Cargo.toml
@@ -5,6 +5,9 @@ edition.workspace = true
 license.workspace = true
 description = "The git build-id stamp emitter shared by the launcher shims' build scripts (decision 0993/1160)"
 
+[lints]
+workspace = true
+
 [lib]
 # A build-dependency only. No tests, no bevy, no app deps — it runs inside cargo's build-script
 # pass and must stay trivially cheap to compile.
diff --git a/crates/benilla-bytes/Cargo.toml b/crates/benilla-bytes/Cargo.toml
index 1f48c4bc..ba42e121 100644
--- a/crates/benilla-bytes/Cargo.toml
+++ b/crates/benilla-bytes/Cargo.toml
@@ -5,4 +5,7 @@ edition.workspace = true
 license.workspace = true
 description = "Bounds-checked byte readers + IFF chunk iteration shared by the format parsers — decision 0064"
 
+[lints]
+workspace = true
+
 [dependencies]
diff --git a/crates/benilla-dbc/Cargo.toml b/crates/benilla-dbc/Cargo.toml
index b5bd99f2..4bf84425 100644
--- a/crates/benilla-dbc/Cargo.toml
+++ b/crates/benilla-dbc/Cargo.toml
@@ -5,5 +5,8 @@ edition.workspace = true
 license.workspace = true
 description = "WDBC (client DBC) reader for WoW 1.12.1 (build 5875) — in-repo, decision 0021"
 
+[lints]
+workspace = true
+
 [dependencies]
 benilla-bytes = { path = "../benilla-bytes" }
diff --git a/crates/benilla-formats/Cargo.toml b/crates/benilla-formats/Cargo.toml
index 90d33937..d018a5ad 100644
--- a/crates/benilla-formats/Cargo.toml
+++ b/crates/benilla-formats/Cargo.toml
@@ -5,6 +5,9 @@ edition.workspace = true
 license.workspace = true
 description = "WoW 1.12.1 asset-format adapters (MPQ/BLP/DBC/ADT/WDT) and the benilla-extract CLI"
 
+[lints]
+workspace = true
+
 [features]
 # The dev/player seam (0026, built by 1173/1174). Default-on, so every normal build keeps the
 # instruments; `--no-default-features` is the player build. Here it gates exactly one thing:
diff --git a/crates/benilla-formats/examples/dump_bone_keys.rs b/crates/benilla-formats/examples/dump_bone_keys.rs
index 5cef3387..95ee8f3e 100644
--- a/crates/benilla-formats/examples/dump_bone_keys.rs
+++ b/crates/benilla-formats/examples/dump_bone_keys.rs
@@ -1,7 +1,7 @@
 //! Session probe: which bones carry keys in a given sequence — `cargo run -p benilla-formats
 //! --example dump_bone_keys <file.m2> <anim_id> [bone ...]`. With bone indices, prints their
 //! key counts + first rotation keys; without, lists every keyed bone. Extract the file first
-//! via `mpqx` (benilla-mpq). Built for the nocked-ammo RE round (decision 0406 follow-up).
+//! via `mpqx` (benilla-mpq). Built for the nocked-ammo RE round (decision 2273 follow-up).
 
 fn main() {
     let mut args = std::env::args().skip(1);
diff --git a/crates/benilla-formats/src/bin/benilla-extract/main.rs b/crates/benilla-formats/src/bin/benilla-extract/main.rs
index 57cacf97..7a550899 100644
--- a/crates/benilla-formats/src/bin/benilla-extract/main.rs
+++ b/crates/benilla-formats/src/bin/benilla-extract/main.rs
@@ -486,6 +486,120 @@ enum Command {
         /// Internal-path prefix filter (e.g. `world`), case-insensitive; all models if omitted.
         prefix: Option<String>,
     },
+    /// Sweep every model the **spell-visual chain** can reach — every `SpellVisualEffectName`
+    /// path a kit's ten effect slots, a `SpellVisual` row's missile model or its dest-anchored
+    /// model names — and census the batches whose **texture transform animates**, then classify
+    /// each by what a consumer that runs NONE of it renders.
+    ///
+    /// Decision 0271 deferred this channel on the claim that "no effect model in the current
+    /// corpus needs it"; this is that claim, made countable — it is what 2282 read to size the
+    /// missing scroll, and it is how the same question was re-asked of the unit / GameObject /
+    /// held-item corpus that 2295 then fixed (`entityuvscan`, its twin). It asks the **bake**,
+    /// not a transcription of it: a batch is in scope
+    /// exactly when `tex_anim` emitted a loop on any of the three channels, the same test the
+    /// lanes that DO run them use (`ui_models` 2019, `spell_fx` 2282).
+    ///
+    /// The classes are what a frozen batch draws, judged from the texture's own alpha through its
+    /// authored address mode — because a CLAMP-authored sheet's border is what a UV outside `0..1`
+    /// samples, and on this corpus that border is transparent:
+    ///
+    /// - **INVISIBLE** — frozen, every texel the batch reaches is transparent, while the scroll
+    ///   reaches painted ones: the batch renders **nothing at all**. `Spells\SwipeCaster.m2`
+    ///   (druid Swipe) is the class: two 51-vertex claw-trail strips whose UVs are authored at
+    ///   `u[+0.945..+1.944]` over a 16×16 CLAMP sheet, so frozen they sample column 15 alone —
+    ///   alpha 0 — and the whole of their visible existence is the `−0.97` U scroll.
+    /// - **FROZEN** — it draws, statically: the scroll is the motion it loses.
+    /// - **HELD** — keyed to a constant non-identity offset, so a lane that seeds none draws it
+    ///   mis-registered rather than still.
+    /// - **NEVER** / **UNKNOWN** — flagged, never counted as INVISIBLE: nothing painted at any
+    ///   point of the loop, or no alpha lane to judge from (`Mod`/`Mod2x`, an undecodable sheet).
+    ///
+    /// Each batch prints its per-axis reasoning (address mode, authored and frozen UV spans, the
+    /// texel indices those reach) so the call is checkable, and the report closes with the INVISIBLE
+    /// listing joined back through the chain: which spells reach it, and through which lifecycle
+    /// stage (`precast`/`cast`/`impact`/`state`/`channel`/`missile`/`area`).
+    Fxuvscan {
+        /// Internal-path prefix filter (e.g. `spells`), case-insensitive; all reachable effect
+        /// models if omitted.
+        prefix: Option<String>,
+    },
+    /// Sweep every model the **ENTITY lane** can render — every `CreatureDisplayInfo` →
+    /// `CreatureModelData` body (NPCs, critters, mounts, and every PLAYER, which resolves through
+    /// the same chain, decision 0041), every `GameObjectDisplayInfo` model, every
+    /// `ItemDisplayInfo` left/right model joined to the `Item\ObjectComponents\` folder the
+    /// archives actually hold it in, and the corpse lane's `<Race><Sex>DeathSkeleton` bone piles —
+    /// and census the batches whose **texture transform animates**, then classify each by what a
+    /// consumer that runs NONE of it renders.
+    ///
+    /// The twin of `Fxuvscan`, asked of the corpus that record's fix did NOT reach. Decision 2282
+    /// gave the spell-effect lane its texture transform and named this as its first deferral:
+    /// `model_render::batch::Materials::entity_variants` passed `play_uv = false`, and `build`
+    /// does `play_uv.then_some(sub.uv_anim.as_ref()).flatten()` — so every unit, player,
+    /// GameObject and held-item batch was handed no loop and drew its authored UVs, untransformed,
+    /// for ever. Nobody had measured how much content that is; this is that measurement, it is
+    /// what sized **decision 2295**, which closed it, and it shares `fxuvscan`'s whole per-batch
+    /// reader (`uv_batch`) so the two corpora cannot be judged by two different rules. It stays
+    /// because the census is how the claim "this lane needs no channel" is kept checkable — which
+    /// is the one thing 0271's deferral was missing.
+    ///
+    /// **Read the corpus from the tables, never from a path prefix.** "The path looks broken" and
+    /// "the path is reachable" are different questions and only the second one is worth a session
+    /// (2282's own closing note). A held item's directory is not even a column — the equipment lane
+    /// picks `Weapon`/`Shield`/`Shoulder`/`Head`/`Ammo`/`Quiver` from the slot the item is worn in
+    /// — so the sweep asks the archives which folder holds each display's basename, and expands a
+    /// helm stem into its sixteen per-race/sex files the way the attach does.
+    ///
+    /// The classes are `fxuvscan`'s, judged the same way — from the texture's own alpha through the
+    /// batch's authored address mode (INVISIBLE / NEVER / FROZEN / HELD / UNKNOWN; that command's
+    /// doc is where they are explained) — with one thing this corpus adds: a CREATURE batch's
+    /// `Monster1/2/3` sheet is **blank in the M2** and filled per display from
+    /// `CreatureDisplayInfo.textureVariation`, so one batch has as many sheets as the model has
+    /// skins and the verdict is asked once per skin. A character composite (body atlas, hair,
+    /// object skin) has no authored sheet at all and reads UNKNOWN, which is the honest answer
+    /// rather than a silent pass.
+    ///
+    /// **The load-bearing column is the CLOCK**, because it decides the SHAPE of the fix and not
+    /// merely its size:
+    ///
+    /// - **GSEQ** — every live loop rides a global sequence, a free-running per-scene clock the
+    ///   reference anchors once per instance at attach. One shared material uniform is faithful
+    ///   there; that is 0136 choice 1's lane, already built.
+    /// - **BAND** — every live loop rides its sequence band, i.e. the instance's own play head. Two
+    ///   units playing different animations, or the same one at different phases, are at different
+    ///   offsets, and no shared uniform can serve both: that is 2282's per-instance `UvLoop`.
+    /// - **MIXED** / **HOLD** — the batch's channels disagree, or it is keyed to a constant
+    ///   non-identity offset that needs a seed and no clock at all.
+    ///
+    /// Each affected batch prints its three channels (translation / rotation / scaling — a sweep
+    /// that looked only at translation would have missed `GroundingTotem_Impact` entirely, which is
+    /// scale-only), its per-axis texel reasoning, both frozen verdicts, its clock, which file
+    /// sequence slots carry the keys and what those sequences are *called*, and — where the bake
+    /// refused the shared lane — `uvslotscan`'s own `uniform()` verdict for the same set. The
+    /// report closes with every affected model sorted by POPULATION: how many table rows can put it
+    /// on screen, which is the difference between one gnome terminal and every murloc in the game.
+    ///
+    /// **And then the same corpus again for the M2COLOR TINT**, because the UV channel is not the
+    /// only one this lane drops. `build` passes `sub.rgb_anim.as_ref()` *unconditionally* — there
+    /// is no `play_rgb` to flip — so a tint-animating entity batch is seeded at the loop's first
+    /// key and then never re-sampled, because `doodad_anim::register_tint`'s only call sites (like
+    /// `register_uv`'s) are in the world streamer's `assemble.rs`. The hole is the missing
+    /// REGISTRATION, not a missing argument, which is why flipping `play_uv` alone would only
+    /// trade one frozen frame for another.
+    ///
+    /// A tint is a **multiply**, so its failure mode is the wrong colour rather than missing
+    /// geometry, and the classes say how wrong: BLACK (the frozen tint kills the batch), STRONG,
+    /// SLIGHT, NEGLIGIBLE — bands over one printed number, the worst per-channel distance between
+    /// the frozen value and anything the loop reaches. Two qualifications the raw count would
+    /// overstate without: a batch whose slot 0 bakes nothing seeds **white**, so it is the right
+    /// colour until a later slot's animation plays and wrong only *during* it (the `slots` line
+    /// names which); and the **ALPHA** channel is counted beside them precisely because this lane
+    /// DOES serve it — `attach::dress::spawn_part` gives every part a `MatAnim` that
+    /// `sample_mat_anim` ticks per instance. One of the three material-animation channels runs.
+    Entityuvscan {
+        /// Internal-path prefix filter (e.g. `creature`), case-insensitive; all reachable entity
+        /// models if omitted.
+        prefix: Option<String>,
+    },
     /// Sweep every `.m2` (optionally under a path prefix) and census the batches whose texture
     /// coordinates are **GENERATED, not authored** — the sphere-map environment stages
     /// (`texture_unit_lookup[texCoordSet] > 2`, the reference's gate at `0x70b8bd`). Such a batch
@@ -979,6 +1093,8 @@ fn main() -> Result<()> {
         Command::Uvslotscan { prefix } => scan::uvslotscan(&mut chain, prefix.as_deref())?,
         Command::Seqclockscan { prefix } => scan::seqclockscan(&mut chain, prefix.as_deref())?,
         Command::Uvwrapscan { prefix } => scan::uvwrapscan(&mut chain, prefix.as_deref())?,
+        Command::Fxuvscan { prefix } => scan::fxuvscan(&mut chain, prefix.as_deref())?,
+        Command::Entityuvscan { prefix } => scan::entityuvscan(&mut chain, prefix.as_deref())?,
         Command::Envmapscan { prefix } => scan::envmapscan(&mut chain, prefix.as_deref())?,
         Command::Texmodescan { prefix } => scan::texmodescan(&mut chain, prefix.as_deref())?,
         Command::Fxordercensus { prefix } => scan::fxordercensus(&mut chain, prefix.as_deref())?,
diff --git a/crates/benilla-formats/src/bin/benilla-extract/scan/material.rs b/crates/benilla-formats/src/bin/benilla-extract/scan/material.rs
index a63e6e6a..9c95a570 100644
--- a/crates/benilla-formats/src/bin/benilla-extract/scan/material.rs
+++ b/crates/benilla-formats/src/bin/benilla-extract/scan/material.rs
@@ -6,10 +6,19 @@
 //! generated-texcoord environment stages (`envmapscan`), and the batches whose animated
 //! texture-transform / tint loop is not the same in every sequence slot, which the bake routes to
 //! a per-placement material (`uvslotscan`).
+//!
+//! `fxuvscan` is the intersection of the first two, asked of one corpus: the spell-effect models,
+//! whose animated texture transform decides — through their CLAMP-authored UVs — whether a
+//! consumer that runs none of it loses the batch's motion or its whole existence. It sized
+//! decision 2282, which built the consumer; it stays the way that question is asked at all — and
+//! `entityuvscan` is that same question asked of the unit / GameObject / held-item corpus, which
+//! sized decision 2295. Both lanes run their transform today; what the two scans are for is
+//! keeping "this lane needs no channel" a countable claim rather than an assumed one. They share
+//! their whole per-batch reader.
 
 use std::collections::BTreeMap;
 
-use anyhow::Result;
+use anyhow::{Context, Result};
 use benilla_formats::{Chain, KeyAnim, SeqLoops};
 
 /// Sweep every `.m2` (under `prefix`, if given) and list the models whose MATERIAL table authors
@@ -728,7 +737,6 @@ pub fn uvslotscan(chain: &mut Chain, prefix: Option<&str>) -> Result<()> {
         };
         scanned += 1;
         batches += subs.len() as u64;
-
         let mut lines: Vec<String> = Vec::new();
         // This model's own contribution, folded into the corpus tally once per channel below:
         // (shared, shared-and-live) batch counts, per-bucket batch counts, and the file sequence
@@ -885,3 +893,2287 @@ pub fn uvslotscan(chain: &mut Chain, prefix: Option<&str>) -> Result<()> {
     }
     Ok(())
 }
+
+// ---------------------------------------------------------------------------
+// fxuvscan — what the SPELL-EFFECT corpus's animated texture transforms render
+// for a consumer that runs none of them.
+//
+// Everything down to `uv_batch` is shared with `entityuvscan` below, which asks
+// the identical question of the corpus 2282's fix did NOT reach. The sheet
+// decode, the two frozen states, the per-axis texel reasoning and the five
+// classes live here once on purpose: two sweeps that classified the same batch
+// by two slightly different rules would be worse than one sweep.
+// ---------------------------------------------------------------------------
+
+/// How many spells print per INVISIBLE model before the rest are counted.
+const FX_SPELL_ROWS: usize = 12;
+
+/// How many unreadable model paths print before the rest are counted.
+const FX_UNREAD_ROWS: usize = 20;
+
+/// How many time samples the animated sweep takes across each slot's loop — enough to bound a
+/// scroll that only crosses the sheet for part of its period (the reported box is the union, so
+/// it only ever over-states what the animation reaches, never under-states it).
+const FX_ANIM_SAMPLES: usize = 64;
+
+/// One texture's mip-0 channels, as the visibility question needs them.
+///
+/// Alpha decides it for the modes that read alpha — `Blend`/`AlphaTest`, and M2 mode 4 `Add`
+/// (`SRC_ALPHA/ONE`), which is most of the effect corpus. An `Opaque` batch paints whatever it
+/// covers and a `Mod`/`Mod2x` batch's equation reads no alpha at all (decision 0528), so neither
+/// is called from the sheet. The one mode that needs [`Self::rgb`] is **3, `NoAlphaAdd`**
+/// (`ONE/ONE`): it adds the texel's colour with the alpha channel untouched, so an alpha-0 border
+/// with non-zero RGB still puts light on the screen. `BloodSpurtSmall01`'s border column is
+/// exactly that shape — alpha 0, RGB up to 107 — so the distinction is not hypothetical.
+struct Sheet {
+    w: u32,
+    h: u32,
+    /// Row-major, one byte per texel.
+    alpha: Vec<u8>,
+    /// Row-major `max(r, g, b)` — what an `ONE/ONE` add would put on the screen.
+    rgb: Vec<u8>,
+}
+
+impl Sheet {
+    /// The inclusive texel index ranges one axis's UV span `[lo, hi]` reaches under the batch's own
+    /// address mode — clamped to the edge texel (`wrap == false`, the border-sampling case this
+    /// whole scan turns on) or folded back into `0..1`. A wrapping span of a full sheet or more
+    /// reaches every texel.
+    fn axis(lo: f32, hi: f32, n: u32, wrap: bool) -> Vec<(u32, u32)> {
+        let last = n.saturating_sub(1);
+        let texel = |t: f32| ((t * n as f32) as i64).clamp(0, i64::from(last)) as u32;
+        if !wrap {
+            return vec![(texel(lo.clamp(0.0, 1.0)), texel(hi.clamp(0.0, 1.0)))];
+        }
+        if hi - lo >= 1.0 {
+            return vec![(0, last)];
+        }
+        let a = lo - lo.floor();
+        let b = a + (hi - lo);
+        if b <= 1.0 {
+            vec![(texel(a), texel(b))]
+        } else {
+            vec![(texel(a), last), (0, texel(b - 1.0))]
+        }
+    }
+
+    /// The most this sheet can PAINT anywhere in the UV box `u × v` — the greatest alpha, or, when
+    /// `with_rgb` (a batch that may be `NoAlphaAdd`), the greater of alpha and `max(r, g, b)`.
+    /// `0` exactly when every texel the box reaches contributes nothing.
+    ///
+    /// The box is the batch's UV **bounding box**, which is a superset of the texels its triangles
+    /// actually cover, so a `0` here is conservative in the one direction that matters: it cannot
+    /// call a batch invisible that in fact paints.
+    fn paint(
+        &self,
+        u: (f32, f32),
+        v: (f32, f32),
+        wrap_x: bool,
+        wrap_y: bool,
+        with_rgb: bool,
+    ) -> u8 {
+        if self.w == 0 || self.h == 0 {
+            return 0;
+        }
+        let mut best = 0u8;
+        for &(x0, x1) in &Self::axis(u.0, u.1, self.w, wrap_x) {
+            for &(y0, y1) in &Self::axis(v.0, v.1, self.h, wrap_y) {
+                for y in y0..=y1 {
+                    let row = (y * self.w) as usize;
+                    for x in x0..=x1 {
+                        let i = row + x as usize;
+                        best = best.max(self.alpha[i]);
+                        if with_rgb {
+                            best = best.max(self.rgb[i]);
+                        }
+                    }
+                }
+            }
+        }
+        best
+    }
+}
+
+/// Decode one texture's mip-0 alpha channel, memoised by lowercased path. `None` for a path the
+/// chain has no BLP for, or one that will not decode — reported as `UNKNOWN`, never a silent pass.
+fn fx_sheet<'a>(
+    cache: &'a mut BTreeMap<String, Option<Sheet>>,
+    chain: &mut Chain,
+    path: &str,
+) -> Option<&'a Sheet> {
+    cache
+        .entry(path.to_ascii_lowercase())
+        .or_insert_with(|| {
+            benilla_formats::read_texture_rgba(chain, path)
+                .ok()
+                .map(|(w, h, rgba)| Sheet {
+                    w,
+                    h,
+                    alpha: rgba.as_chunks::<4>().0.iter().map(|p| p[3]).collect(),
+                    rgb: rgba
+                        .as_chunks::<4>()
+                        .0
+                        .iter()
+                        .map(|p| p[0].max(p[1]).max(p[2]))
+                        .collect(),
+                })
+        })
+        .as_ref()
+}
+
+/// One effect model's place in the spell-visual chain: the `SpellVisualEffectName` rows that name
+/// it, and every spell that reaches it with the lifecycle stages it arrives through.
+#[derive(Default)]
+struct FxReach {
+    /// The table's own spelling of the path (`.mdx`), for display.
+    path: String,
+    effects: std::collections::BTreeSet<u32>,
+    /// spell id → (name, the stages that reach this model).
+    spells: BTreeMap<u32, (String, std::collections::BTreeSet<&'static str>)>,
+}
+
+/// Fold one `SpellVisualEffectName` id's model into the corpus, and — when `spell` is given — note
+/// that that spell reaches it through that lifecycle stage. An id with no row or an empty path
+/// (the table's absent-model convention) folds to nothing, which is the client's own no-op.
+fn fx_record(
+    out: &mut BTreeMap<String, FxReach>,
+    visuals: &benilla_formats::SpellVisualCatalog,
+    effect: u32,
+    spell: Option<(u32, &str, &'static str)>,
+) {
+    let Some(path) = visuals.effect_path(effect) else {
+        return;
+    };
+    // One shipped row spells its path with a LEADING separator
+    // (`\\spells\\HellFire_FirePuff_Caster_Base.mdx`, `SpellVisualEffectName` 1180). The chain has
+    // the model under the same name without it, so the key drops leading separators while the
+    // DISPLAY path keeps the table's own spelling — the quirk stays visible instead of being
+    // silently smoothed away.
+    let e = out
+        .entry(crate::model_key(path.trim_start_matches(['\\', '/'])))
+        .or_default();
+    if e.path.is_empty() {
+        e.path = path.to_string();
+    }
+    e.effects.insert(effect);
+    if let Some((id, name, stage)) = spell {
+        e.spells
+            .entry(id)
+            .or_insert_with(|| (name.to_string(), std::collections::BTreeSet::new()))
+            .1
+            .insert(stage);
+    }
+}
+
+/// Every model the spell-visual chain can reach, keyed by [`crate::model_key`] — walked from the
+/// **tables**, not from the spells, so a kit no shipped spell names is still swept (it is still
+/// content the lane can be asked to play); the spell join is the second pass over the same map.
+///
+/// The reachable set is every kit's ten effect slots (`VisualKit::effects` — the nine bone-attach
+/// slots plus the world/state plant), every `SpellVisual` row's missile model (field 7) and its
+/// dest-anchored model (field 12, the DynamicObject's own `.mdx`). The stage labels are the five
+/// lifecycle kit columns plus `missile` and `area`, the latter covering both dest-anchored columns
+/// (field 12's model and field 13's area kit) — one lane, one name.
+fn fx_corpus(
+    visuals: &benilla_formats::SpellVisualCatalog,
+    spells: &benilla_formats::SpellCatalog,
+) -> BTreeMap<String, FxReach> {
+    let mut out: BTreeMap<String, FxReach> = BTreeMap::new();
+    for kit_id in visuals.kit_ids() {
+        let Some(kit) = visuals.kit(kit_id) else {
+            continue;
+        };
+        for (_, effect) in kit.effects() {
+            fx_record(&mut out, visuals, effect, None);
+        }
+    }
+    for (_, st) in visuals.visuals() {
+        fx_record(&mut out, visuals, st.missile_model, None);
+        fx_record(&mut out, visuals, st.area_effect, None);
+    }
+    for (id, sp) in spells.iter() {
+        let Some(st) = visuals.stages(sp.visual).copied() else {
+            continue;
+        };
+        for (stage, kit_id) in [
+            ("precast", st.precast),
+            ("cast", st.cast),
+            ("impact", st.impact),
+            ("state", st.state),
+            ("channel", st.channel),
+            ("area", st.area_kit),
+        ] {
+            let Some(kit) = visuals.kit(kit_id) else {
+                continue;
+            };
+            for (_, effect) in kit.effects() {
+                fx_record(&mut out, visuals, effect, Some((id, &sp.name, stage)));
+            }
+        }
+        fx_record(
+            &mut out,
+            visuals,
+            st.missile_model,
+            Some((id, &sp.name, "missile")),
+        );
+        fx_record(
+            &mut out,
+            visuals,
+            st.area_effect,
+            Some((id, &sp.name, "area")),
+        );
+    }
+    out
+}
+
+/// What a consumer that runs NO texture-transform animation renders for one batch whose transform
+/// the bake DID key.
+#[derive(Clone, Copy, PartialEq, Eq, PartialOrd, Ord)]
+enum FxClass {
+    /// The transform moves, and frozen the batch samples no painted texel while the animation does:
+    /// the batch renders **nothing at all**. The `SwipeCaster` class.
+    Invisible,
+    /// The transform moves, and the batch paints nothing at any point of the loop — so the missing
+    /// UV animation is not what is wrong with it. Flagged, never counted as INVISIBLE.
+    Never,
+    /// The transform moves and the batch draws — statically, where the scroll is the motion.
+    Frozen,
+    /// The transform is keyed but never moves within its band: a constant NON-identity offset the
+    /// bake carries as a `period == 0` hold. A lane that seeds no offset draws the batch at the
+    /// identity instead — a static mis-registration, not a missing scroll.
+    Held,
+    /// No call from the sheet: a `Mod`/`Mod2x` batch (its blend equation reads no alpha) or a
+    /// texture the chain will not hand over. Flagged.
+    Unknown,
+}
+
+impl FxClass {
+    const ALL: [Self; 5] = [
+        Self::Invisible,
+        Self::Never,
+        Self::Frozen,
+        Self::Held,
+        Self::Unknown,
+    ];
+
+    fn label(self) -> &'static str {
+        match self {
+            Self::Invisible => "INVISIBLE",
+            Self::Never => "NEVER",
+            Self::Frozen => "FROZEN",
+            Self::Held => "HELD",
+            Self::Unknown => "UNKNOWN",
+        }
+    }
+
+    fn blurb(self) -> &'static str {
+        match self {
+            Self::Invisible => {
+                "frozen, the batch samples only transparent texels while the scroll reaches painted \
+                 ones — it renders NOTHING"
+            }
+            Self::Never => {
+                "nothing painted at any point of the loop — the missing scroll is not this batch's \
+                 problem (investigate)"
+            }
+            Self::Frozen => "it draws, statically: the scroll is the motion it loses",
+            Self::Held => {
+                "keyed to a constant non-identity offset — a lane that seeds none draws it \
+                 mis-registered, not still"
+            }
+            Self::Unknown => {
+                "no alpha lane to judge from (Mod/Mod2x), or the texture would not decode"
+            }
+        }
+    }
+}
+
+/// The batch's texture-transform state at `(slot, t)` — the triple [`benilla_formats::uv_transform`]
+/// composes, read the way the one lane that RUNS it reads it (`ui_models::UvPart::write_rows`): the
+/// per-slot set when the bake built one, else the single shared loop.
+fn fx_state(
+    sub: &benilla_formats::RenderSubmesh,
+    slot: usize,
+    t: f32,
+) -> ([f32; 2], [f32; 4], [f32; 2]) {
+    let trans = match (&sub.uv_seq, &sub.uv_anim) {
+        (Some(s), _) => s.seq(Some(slot)).map_or([0.0, 0.0], |l| l.sample(t)),
+        (None, Some(a)) => a.sample(t),
+        (None, None) => [0.0, 0.0],
+    };
+    let rot = sub
+        .uv_rot_seq
+        .as_ref()
+        .and_then(|r| r.seq(Some(slot)))
+        .map_or([0.0, 0.0, 0.0, 1.0], |l| l.sample(t));
+    let scale = sub
+        .uv_scale_seq
+        .as_ref()
+        .and_then(|r| r.seq(Some(slot)))
+        .map_or([1.0, 1.0], |l| l.sample(t));
+    (trans, rot, scale)
+}
+
+/// How many file sequence slots this batch's transform was baked across (1 when only the shared
+/// single-slot loop exists), and the longest loop period in slot `slot`.
+fn fx_slots(sub: &benilla_formats::RenderSubmesh) -> usize {
+    let n = |v: Option<usize>| v.unwrap_or(0);
+    n(sub.uv_seq.as_ref().map(|s| s.slots().len()))
+        .max(n(sub.uv_rot_seq.as_ref().map(|s| s.slots().len())))
+        .max(n(sub.uv_scale_seq.as_ref().map(|s| s.slots().len())))
+        .max(1)
+}
+
+/// The longest period any of the batch's three transform channels loops on in slot `slot`;
+/// `0.0` when every one of them is a constant hold there.
+fn fx_period(sub: &benilla_formats::RenderSubmesh, slot: usize) -> f32 {
+    let t = match (&sub.uv_seq, &sub.uv_anim) {
+        (Some(s), _) => s.seq(Some(slot)).map_or(0.0, |l| l.period),
+        (None, Some(a)) => a.period,
+        (None, None) => 0.0,
+    };
+    let r = sub
+        .uv_rot_seq
+        .as_ref()
+        .and_then(|s| s.seq(Some(slot)))
+        .map_or(0.0, |l| l.period);
+    let s = sub
+        .uv_scale_seq
+        .as_ref()
+        .and_then(|s| s.seq(Some(slot)))
+        .map_or(0.0, |l| l.period);
+    t.max(r).max(s)
+}
+
+/// The batch's UV bounding box carried through [`benilla_formats::uv_transform`] — all four
+/// corners, so a rotation or scale is bounded rather than assumed away.
+fn fx_box(
+    u: (f32, f32),
+    v: (f32, f32),
+    t: [f32; 2],
+    q: [f32; 4],
+    s: [f32; 2],
+) -> ((f32, f32), (f32, f32)) {
+    let mut out = ((f32::MAX, f32::MIN), (f32::MAX, f32::MIN));
+    for uv in [[u.0, v.0], [u.1, v.0], [u.0, v.1], [u.1, v.1]] {
+        let p = benilla_formats::uv_transform(uv, t, q, s);
+        out.0 .0 = out.0 .0.min(p[0]);
+        out.0 .1 = out.0 .1.max(p[0]);
+        out.1 .0 = out.1 .0.min(p[1]);
+        out.1 .1 = out.1 .1.max(p[1]);
+    }
+    out
+}
+
+/// Does this batch's texture transform animate? The UI lane's own test, verbatim: any of the three
+/// channels baked to something ([`benilla_formats::RenderSubmesh::uv_anim`] and the three
+/// per-sequence sets). Shared, so the two sweeps cannot drift into asking it differently.
+fn uv_keyed(sub: &benilla_formats::RenderSubmesh) -> bool {
+    sub.uv_anim.is_some()
+        || sub.uv_seq.is_some()
+        || sub.uv_rot_seq.is_some()
+        || sub.uv_scale_seq.is_some()
+}
+
+/// Does this model author M2 blend mode **3** (`NoAlphaAdd`, `ONE/ONE`) anywhere?
+///
+/// The bake folds modes 3 and 4 into one `Blend` + `additive` pair, and no `RenderSubmesh` carries
+/// the source material back (the billboard split means batches are not even 1:1 with skin batches),
+/// so the question is asked of the model's MATERIAL TABLE — the same raw read `blendscan` does
+/// (count/ofs at `0x84`, 4-byte `{u16 flags, u16 blend}`). A model with no mode-3 material has
+/// alpha-gated additives and the alpha test is exact; one that has any gets the stricter
+/// alpha-or-RGB test on its additive batches, which can only make INVISIBLE harder to claim.
+fn authors_no_alpha_add(bytes: &[u8]) -> bool {
+    let at = |o: usize| -> Option<u32> {
+        Some(u32::from_le_bytes(bytes.get(o..o + 4)?.try_into().ok()?))
+    };
+    match (at(0x84), at(0x88)) {
+        (Some(n), Some(ofs)) => (0..n as usize).any(|i| {
+            let o = ofs as usize + i * 4;
+            bytes
+                .get(o + 2..o + 4)
+                .is_some_and(|b| u16::from_le_bytes([b[0], b[1]]) == 3)
+        }),
+        _ => false,
+    }
+}
+
+/// One animating batch's whole texture-transform read — the per-batch body [`fxuvscan`] and
+/// [`entityuvscan`] share, so the two sweeps cannot answer the same question differently.
+///
+/// The caller supplies the sheet path because the two corpora do not resolve it the same way: an
+/// effect model's batch names its own `.blp`, while a CREATURE batch's `Monster1/2/3` slot is blank
+/// in the M2 and filled per display from `CreatureDisplayInfo.textureVariation` — so the same batch
+/// has as many sheets as the model has skins, and the visibility question has to be asked of each.
+struct UvBatch {
+    /// The verdict under the seed a `play_uv = false` lane renders at (the identity).
+    class: FxClass,
+    /// The verdict under the track's first key — what the same batch becomes on a lane that hands
+    /// `model_material` the loop but never ticks it.
+    key_class: FxClass,
+    /// `uv_anim.sample(0.0)` — the translation seed, `[0, 0]` when the shared loop is absent.
+    seed: [f32; 2],
+    /// The report block, in print order.
+    lines: Vec<String>,
+}
+
+/// Read one batch's texture transform — see [`UvBatch`]. The caller has already established that
+/// the transform is keyed ([`uv_keyed`]) and that the batch has UVs to transform.
+fn uv_batch(
+    sheets: &mut BTreeMap<String, Option<Sheet>>,
+    chain: &mut Chain,
+    sub: &benilla_formats::RenderSubmesh,
+    bi: usize,
+    tex: Option<&str>,
+    no_alpha_add: bool,
+) -> UvBatch {
+    let ext = |axis: usize| {
+        sub.uvs.iter().fold((f32::MAX, f32::MIN), |(lo, hi), t| {
+            (lo.min(t[axis]), hi.max(t[axis]))
+        })
+    };
+    let (au, av) = (ext(0), ext(1));
+    let slots = fx_slots(sub);
+    let moves = (0..slots).any(|s| fx_period(sub, s) > 0.0);
+
+    // THE TWO FROZEN STATES, because our codebase has two seeding conventions and they
+    // are not the same picture:
+    //
+    // - **identity** — the offset an effect part actually renders at. Its material is
+    //   built by `model_render::batch::Materials::entity_variants`, whose `play_uv` is
+    //   `false`, so `model_material` is handed no loop and seeds `sun_scale.zw = (0, 0)`:
+    //   the batch draws its AUTHORED UVs, untransformed. This is the primary verdict.
+    // - **first key** — `uv_anim.sample(0.0)`, what the same builder seeds when a lane
+    //   DOES hand it the loop (the doodad and off-world lanes). Reported beside it,
+    //   because a fix that wires the loop in without ticking it lands the batch here.
+    //
+    // Rotation and scale are at the identity in both: the translation seed is the only
+    // transform channel a shared material carries at all (the affine pair is the UI
+    // lane's per-pane table row, decision 2019).
+    let seed = sub.uv_anim.as_ref().map_or([0.0, 0.0], |a| a.sample(0.0));
+    let (fu, fv) = fx_box(au, av, [0.0, 0.0], [0.0, 0.0, 0.0, 1.0], [1.0, 1.0]);
+    let (ku, kv) = fx_box(au, av, seed, [0.0, 0.0, 0.0, 1.0], [1.0, 1.0]);
+
+    // ANIMATED REACH. The union over every slot and a uniform sweep of its loop — an
+    // over-approximation by construction, so "nothing painted here either" is a claim the
+    // geometry cannot contradict.
+    let mut ru = (f32::MAX, f32::MIN);
+    let mut rv = (f32::MAX, f32::MIN);
+    for slot in 0..slots {
+        let period = fx_period(sub, slot);
+        for i in 0..FX_ANIM_SAMPLES {
+            let t = period * i as f32 / (FX_ANIM_SAMPLES - 1) as f32;
+            let (tr, q, sc) = fx_state(sub, slot, t);
+            let (bu, bv) = fx_box(au, av, tr, q, sc);
+            ru = (ru.0.min(bu.0), ru.1.max(bu.1));
+            rv = (rv.0.min(bv.0), rv.1.max(bv.1));
+        }
+    }
+
+    let sheet = tex.and_then(|p| fx_sheet(sheets, chain, p));
+    let reads_alpha = matches!(
+        sub.blend,
+        benilla_formats::ModelBlend::Blend | benilla_formats::ModelBlend::AlphaTest
+    );
+    let opaque = sub.blend == benilla_formats::ModelBlend::Opaque;
+    let with_rgb = sub.additive && no_alpha_add;
+    let (frozen_a, key_a, anim_a, dims) = match sheet {
+        Some(s) => (
+            s.paint(fu, fv, sub.wrap_x, sub.wrap_y, with_rgb),
+            s.paint(ku, kv, sub.wrap_x, sub.wrap_y, with_rgb),
+            s.paint(ru, rv, sub.wrap_x, sub.wrap_y, with_rgb),
+            format!("{}x{}", s.w, s.h),
+        ),
+        None => (0, 0, 0, "—".to_string()),
+    };
+    // One rule, run twice — once per frozen state, so the two verdicts cannot drift apart.
+    let verdict = |painted: u8| {
+        if !moves {
+            FxClass::Held
+        } else if opaque {
+            FxClass::Frozen
+        } else if !reads_alpha || sheet.is_none() {
+            FxClass::Unknown
+        } else if painted > 0 {
+            FxClass::Frozen
+        } else if anim_a > 0 {
+            FxClass::Invisible
+        } else {
+            FxClass::Never
+        }
+    };
+    let class = verdict(frozen_a);
+    let key_class = verdict(key_a);
+
+    let chans = |sub: &benilla_formats::RenderSubmesh| {
+        let n = |on: bool, s: &'static str| if on { s } else { "—" };
+        format!(
+            "{}{}{}",
+            n(sub.uv_anim.is_some() || sub.uv_seq.is_some(), "T"),
+            n(sub.uv_rot_seq.is_some(), "R"),
+            n(sub.uv_scale_seq.is_some(), "S"),
+        )
+    };
+    // The per-axis reasoning, read off the TEXELS rather than off the span: a CLAMP axis
+    // whose frozen span runs past an edge samples that edge's texel for every bit of it
+    // past the edge, so a span like `[+0.951..+1.950]` over a 16-texel sheet is not
+    // "mostly outside" — it is column 15, alone, for its whole length. That collapse is the
+    // whole mechanism, so the line names it.
+    let axis = |wrap: bool, a: (f32, f32), f: (f32, f32), n: u32| {
+        let (texels, verdict) = match n {
+            0 => ("—".to_string(), "no sheet"),
+            n => {
+                let r = Sheet::axis(f.0, f.1, n, wrap);
+                let edge_only = !wrap
+                    && r.len() == 1
+                    && r[0].0 == r[0].1
+                    && (r[0].0 == 0 || r[0].0 == n - 1)
+                    && (f.0 < 0.0 || f.1 > 1.0);
+                (
+                    r.iter()
+                        .map(|&(x, y)| format!("{x}..{y}"))
+                        .collect::<Vec<_>>()
+                        .join(","),
+                    if wrap {
+                        "wraps"
+                    } else if f.1 <= 0.0 || f.0 >= 1.0 {
+                        "WHOLLY OUTSIDE 0..1 — the border texel, alone"
+                    } else if edge_only {
+                        "CLAMPED TO ONE BORDER TEXEL for its whole length"
+                    } else {
+                        "reaches the sheet"
+                    },
+                )
+            }
+        };
+        format!(
+            "{:<6} authored [{:+.3}..{:+.3}]  frozen [{:+.3}..{:+.3}] -> texels {:<7} {}",
+            if wrap { "REPEAT" } else { "CLAMP" },
+            a.0,
+            a.1,
+            f.0,
+            f.1,
+            texels,
+            verdict,
+        )
+    };
+    let (tw, th) = sheet.map_or((0, 0), |s| (s.w, s.h));
+    let mut lines: Vec<String> = Vec::new();
+    lines.push(format!(
+        "  batch {bi:>3}  {:?}{}  {} verts  chans {}  {} slot(s)  tex {} {dims}{}",
+        sub.blend,
+        if sub.additive { " additive" } else { "" },
+        sub.positions.len(),
+        chans(sub),
+        slots,
+        tex.unwrap_or("NONE"),
+        if with_rgb {
+            "  [model authors NoAlphaAdd — judged on alpha OR rgb]"
+        } else {
+            ""
+        },
+    ));
+    lines.push(format!("      u  {}", axis(sub.wrap_x, au, fu, tw)));
+    lines.push(format!("      v  {}", axis(sub.wrap_y, av, fv, th)));
+    lines.push(format!(
+        "      frozen@identity   alpha max {frozen_a:>3}/255  => {}   \
+         [a lane built with `play_uv = false`: the AUTHORED UVs, untransformed]",
+        class.label(),
+    ));
+    lines.push(format!(
+        "      frozen@first-key  alpha max {key_a:>3}/255  => {}   \
+         seed [{:+.4},{:+.4}] u[{:+.3}..{:+.3}] v[{:+.3}..{:+.3}]",
+        key_class.label(),
+        seed[0],
+        seed[1],
+        ku.0,
+        ku.1,
+        kv.0,
+        kv.1,
+    ));
+    lines.push(format!(
+        "      animated          alpha max {anim_a:>3}/255        \
+         u[{:+.3}..{:+.3}] v[{:+.3}..{:+.3}] over {} sample(s) x {slots} slot(s)",
+        ru.0, ru.1, rv.0, rv.1, FX_ANIM_SAMPLES,
+    ));
+    UvBatch {
+        class,
+        key_class,
+        seed,
+        lines,
+    }
+}
+
+/// One classified batch — the row the class listings and the spell join are both built from.
+struct FxHit {
+    /// The corpus key (lowercased `.m2`), so the reach map joins straight onto it.
+    key: String,
+    batch: usize,
+    /// The verdict under the seed the effect lane actually renders at (the identity).
+    class: FxClass,
+    /// The verdict under the track's first key — what the same batch becomes on a lane that hands
+    /// `model_material` the loop but never ticks it.
+    key_class: FxClass,
+}
+
+/// Sweep every model the SPELL-VISUAL CHAIN can reach and census the batches whose **texture
+/// transform animates** — then classify each by what a consumer that runs none of it renders. See
+/// the `Fxuvscan` command doc for the why.
+pub fn fxuvscan(chain: &mut Chain, prefix: Option<&str>) -> Result<()> {
+    let visuals = benilla_formats::load_spell_visual_catalog(chain)?;
+    let spells = benilla_formats::load_spell_catalog(chain)?;
+    let corpus = fx_corpus(&visuals, &spells);
+    let pfx = prefix.map(|p| p.to_ascii_lowercase().replace('/', "\\"));
+
+    let mut sheets: BTreeMap<String, Option<Sheet>> = BTreeMap::new();
+    let (mut listed, mut read, mut missing, mut batches) = (0u32, 0u32, 0u32, 0u64);
+    let (mut anim_models, mut anim_batches) = (0u32, 0u32);
+    let mut per_class: BTreeMap<FxClass, u32> = BTreeMap::new();
+    let mut per_key_class: BTreeMap<FxClass, u32> = BTreeMap::new();
+    let mut hits: Vec<FxHit> = Vec::new();
+    // Every model the chain names that the archives do not carry, or will not parse — listed,
+    // never a silent hole in the sweep.
+    let mut unread: Vec<String> = Vec::new();
+    // How many batches the two frozen states disagree about (see the classification below): the
+    // number that says whether "what does a no-UV-animation consumer render" has one answer here
+    // or two.
+    let mut seed_disagrees = 0u32;
+    // Of the batches that DO draw frozen, how many draw at UVs the loop never opens at.
+    let mut misregistered = 0u32;
+
+    for (key, reach) in &corpus {
+        if pfx.as_deref().is_some_and(|p| !key.starts_with(p)) {
+            continue;
+        }
+        listed += 1;
+        let Ok(bytes) = chain.read_file(key) else {
+            missing += 1;
+            unread.push(format!("{} (not in the chain)", reach.path));
+            continue;
+        };
+        read += 1;
+        let dir = key.rsplit_once('\\').map(|(d, _)| d).unwrap_or("");
+        let Ok(subs) = benilla_formats::parse_m2_render_submeshes(&bytes, dir, &[]) else {
+            missing += 1;
+            unread.push(format!("{} (will not parse)", reach.path));
+            continue;
+        };
+        batches += subs.len() as u64;
+        let no_alpha_add = authors_no_alpha_add(&bytes);
+
+        let mut lines: Vec<String> = Vec::new();
+        for (bi, sub) in subs.iter().enumerate() {
+            if !uv_keyed(sub) || sub.uvs.is_empty() {
+                continue;
+            }
+            anim_batches += 1;
+            let read = uv_batch(
+                &mut sheets,
+                chain,
+                sub,
+                bi,
+                sub.texture.as_deref(),
+                no_alpha_add,
+            );
+            if read.class != read.key_class {
+                seed_disagrees += 1;
+            }
+            // A batch that draws today but at a picture the loop never opens at: the identity is
+            // not the seed, so what is on screen is neither the animation nor its first frame.
+            if read.class == FxClass::Frozen && (read.seed[0] != 0.0 || read.seed[1] != 0.0) {
+                misregistered += 1;
+            }
+            *per_class.entry(read.class).or_default() += 1;
+            *per_key_class.entry(read.key_class).or_default() += 1;
+            hits.push(FxHit {
+                key: key.clone(),
+                batch: bi,
+                class: read.class,
+                key_class: read.key_class,
+            });
+            lines.extend(read.lines);
+        }
+        if !lines.is_empty() {
+            anim_models += 1;
+            println!(
+                "{}  effect {}  ({} spell(s) reach it)",
+                reach.path,
+                reach
+                    .effects
+                    .iter()
+                    .map(u32::to_string)
+                    .collect::<Vec<_>>()
+                    .join("·"),
+                reach.spells.len(),
+            );
+            for l in &lines {
+                println!("{l}");
+            }
+        }
+    }
+
+    println!();
+    println!(
+        "=== summary ===  {listed} model(s) swept of the {} the spell-visual chain reaches, {read} \
+         read ({missing} unreadable), {batches} render batch(es)",
+        corpus.len()
+    );
+    println!(
+        "  {anim_models} model(s) / {anim_batches} batch(es) carry a keyed TEXTURE TRANSFORM — \
+         the channel the spell-effect lane has run since 2282 and the entity lane since 2295"
+    );
+    println!("    {:<10} {:>8} {:>9}", "", "identity", "first-key");
+    for c in FxClass::ALL {
+        println!(
+            "    {:<10} {:>8} {:>9}  — {}",
+            c.label(),
+            per_class.get(&c).copied().unwrap_or(0),
+            per_key_class.get(&c).copied().unwrap_or(0),
+            c.blurb(),
+        );
+    }
+    println!(
+        "  of the {} batch(es) FROZEN@identity, {misregistered} are frozen at UVs the loop never \
+         opens at (a non-zero first key), so what draws is neither the animation nor its opening \
+         frame — a static mis-registration on top of the missing motion",
+        per_class.get(&FxClass::Frozen).copied().unwrap_or(0),
+    );
+    println!(
+        "  the two columns are the two frozen states a non-running lane can be in: `identity` \
+         is a material built with `play_uv = false` (the AUTHORED UVs — what the spell-effect \
+         lane drew before 2282 and the entity lane before 2295), `first-key` what the same \
+         batch becomes on a lane that seeds `uv_anim.sample(0.0)` and never ticks it. \
+         {seed_disagrees} batch(es) are classified differently by the two — read the per-batch \
+         lines for which."
+    );
+    if !unread.is_empty() {
+        println!();
+        // Every one of these on the shipped 1.12 chain is a DEAD TABLE ROW, not a hole in the
+        // sweep: `SpellVisualEffectName` still carries the Warcraft-III-era `Particles\*.mdl`
+        // names the 1.12 archives never shipped. The extension split says so at a glance.
+        let mdl = unread
+            .iter()
+            .filter(|u| u.to_ascii_lowercase().contains(".mdl "))
+            .count();
+        println!(
+            "--- unreadable ---  {} model(s) the chain names but could not be swept ({mdl} `.mdl` \
+             + {} `.mdx`, every one absent from the archives — dead table rows, not a gap)",
+            unread.len(),
+            unread.len() - mdl,
+        );
+        for u in unread.iter().take(FX_UNREAD_ROWS) {
+            println!("  {u}");
+        }
+        if let Some(rest) = unread.len().checked_sub(FX_UNREAD_ROWS).filter(|n| *n > 0) {
+            println!("  … and {rest} more (top {FX_UNREAD_ROWS} shown)");
+        }
+    }
+
+    // Every model carrying a batch of class `c` under `pick`'s seed, with the spells that reach it.
+    let listing = |title: &str, note: &str, pick: fn(&FxHit) -> FxClass, c: FxClass| {
+        let rows: Vec<&FxHit> = hits.iter().filter(|h| pick(h) == c).collect();
+        if rows.is_empty() {
+            return;
+        }
+        println!();
+        println!("--- {title} ---  {} batch(es){note}", rows.len());
+        let mut models: BTreeMap<&str, Vec<usize>> = BTreeMap::new();
+        for h in &rows {
+            models.entry(h.key.as_str()).or_default().push(h.batch);
+        }
+        for (key, bs) in &models {
+            let Some(reach) = corpus.get(*key) else {
+                continue;
+            };
+            println!(
+                "  {}  batch(es) {}",
+                reach.path,
+                bs.iter()
+                    .map(usize::to_string)
+                    .collect::<Vec<_>>()
+                    .join(", "),
+            );
+            if reach.spells.is_empty() {
+                println!("      (no shipped spell reaches it — kit-table content only)");
+                continue;
+            }
+            for (id, (name, stages)) in reach.spells.iter().take(FX_SPELL_ROWS) {
+                println!(
+                    "      spell {id:<6} {name:<34} {}",
+                    stages.iter().copied().collect::<Vec<_>>().join(","),
+                );
+            }
+            if let Some(rest) = reach
+                .spells
+                .len()
+                .checked_sub(FX_SPELL_ROWS)
+                .filter(|n| *n > 0)
+            {
+                println!("      … and {rest} more spell(s) (top {FX_SPELL_ROWS} shown)");
+            }
+        }
+    };
+    for c in [FxClass::Invisible, FxClass::Never, FxClass::Unknown] {
+        listing(
+            c.label(),
+            "  (frozen@identity — what the effect lane renders today)",
+            |h| h.class,
+            c,
+        );
+    }
+    // The batches the first-key seed alone condemns: they draw today, and would stop drawing on a
+    // lane that seeds the loop's opening value without running it. Named, because that is exactly
+    // the shape of a half-finished fix.
+    let key_only: Vec<&FxHit> = hits
+        .iter()
+        .filter(|h| h.key_class == FxClass::Invisible && h.class != FxClass::Invisible)
+        .collect();
+    if !key_only.is_empty() {
+        println!();
+        println!(
+            "--- INVISIBLE under the FIRST-KEY seed only ---  {} batch(es)\n    (these draw today \
+             and would go dark on a lane that seeds `uv_anim.sample(0.0)` without ticking it)",
+            key_only.len()
+        );
+        let mut models: BTreeMap<&str, Vec<usize>> = BTreeMap::new();
+        for h in &key_only {
+            models.entry(h.key.as_str()).or_default().push(h.batch);
+        }
+        for (key, bs) in &models {
+            println!(
+                "  {}  batch(es) {}",
+                corpus.get(*key).map_or(*key, |r| r.path.as_str()),
+                bs.iter()
+                    .map(usize::to_string)
+                    .collect::<Vec<_>>()
+                    .join(", "),
+            );
+        }
+    }
+
+    // The deliverable: the distinct spells that reach an INVISIBLE batch at all, named in full —
+    // the set a player can cast and see nothing for. `+` marks a spell that is only reached under
+    // the first-key seed, never under the one the lane renders at today.
+    let mut reached: BTreeMap<u32, (String, std::collections::BTreeSet<&'static str>, bool)> =
+        BTreeMap::new();
+    for h in hits
+        .iter()
+        .filter(|h| h.class == FxClass::Invisible || h.key_class == FxClass::Invisible)
+    {
+        let Some(reach) = corpus.get(&h.key) else {
+            continue;
+        };
+        let today = h.class == FxClass::Invisible;
+        for (id, (name, stages)) in &reach.spells {
+            let e = reached
+                .entry(*id)
+                .or_insert_with(|| (name.clone(), std::collections::BTreeSet::new(), false));
+            e.1.extend(stages.iter().copied());
+            e.2 |= today;
+        }
+    }
+    let today = reached.values().filter(|v| v.2).count();
+    println!();
+    println!(
+        "=== spells reaching an INVISIBLE batch ===  {today} spell(s) today, {} counting the \
+         first-key seed's extra batches (marked `+`)",
+        reached.len()
+    );
+    for (id, (name, stages, today)) in &reached {
+        println!(
+            "  {} {id:<6} {name:<40} {}",
+            if *today { " " } else { "+" },
+            stages.iter().copied().collect::<Vec<_>>().join(","),
+        );
+    }
+    Ok(())
+}
+
+// ---------------------------------------------------------------------------
+// entityuvscan — what the UNIT / GAMEOBJECT / HELD-ITEM corpus's animated
+// texture transforms render on the lane that runs none of them.
+// ---------------------------------------------------------------------------
+
+/// How many display ids print per model before the rest are counted.
+const ENTITY_ID_ROWS: usize = 12;
+
+/// How many unreadable model paths print before the rest are counted.
+const ENTITY_UNREAD_ROWS: usize = 20;
+
+/// The `Item\ObjectComponents\<dir>\` folders an `ItemDisplayInfo` **left** model column can land
+/// in, and the kind label each one carries. The directory is NOT a column of the table: it is
+/// chosen by the slot the item is worn in (`entities::equipment::ensure_item_model`), which is a
+/// property of the *item*, not of the display — so a census asks the archives which of them
+/// actually holds the file.
+const ITEM_DIRS_L: [&str; 4] = ["Weapon", "Shield", "Shoulder", "Quiver"];
+
+/// …and of a **right** model column: the right pauldron, or an arrow/bullet.
+const ITEM_DIRS_R: [&str; 2] = ["Shoulder", "Ammo"];
+
+/// Helm files are per race and sex — `<stem>_<Ra><S>.m2`, prefix by race id, `M`/`F` by sex
+/// (`ensure_item_model`'s own table, pinned against the MPQ listing in decision 0074).
+const HELM_RACE_PREFIX: [&str; 8] = ["Hu", "Or", "Dw", "Ni", "Sc", "Ta", "Gn", "Tr"];
+
+/// One entity-lane model's place in the DBCs: every table row that can put it on screen, so a
+/// broken batch joins back to something a director can go and look at.
+#[derive(Default)]
+struct EntityReach {
+    /// The table's own spelling of the path (`.mdx`), for display.
+    path: String,
+    /// The `CreatureModelData` row ids naming it (normally one).
+    creature_models: std::collections::BTreeSet<u32>,
+    /// The `CreatureDisplayInfo` rows that reach it — the POPULATION number: one model reached by
+    /// 300 display rows is a different fix from one reached by 1.
+    creature_displays: Vec<u32>,
+    /// The playable `(race, sex)` bodies among those displays (`ChrRaces` cols 4/5 → the same
+    /// CreatureDisplayInfo chain a streamed unit takes, decision 0041), spelled as the glue does.
+    player_bodies: Vec<String>,
+    /// `GameObjectDisplayInfo` rows naming it.
+    go_displays: Vec<u32>,
+    /// `ItemDisplayInfo` rows naming it, and through which `Item\ObjectComponents\` join.
+    item_displays: BTreeMap<u32, std::collections::BTreeSet<&'static str>>,
+    /// The bone-pile skeletons (`<Race><Sex>DeathSkeleton`) — the corpse lane's own models, which
+    /// no display table names.
+    bones: Vec<String>,
+    /// Also named by the SPELL-VISUAL chain, i.e. already swept by `fxuvscan` and already running
+    /// its transform on the effect lane since 2282. Marked, never dropped: a model can be held in
+    /// a hand (this lane, frozen) and thrown as a missile (that lane, animated) on the same tick.
+    also_fx: bool,
+}
+
+impl EntityReach {
+    /// How many table rows can put this model on screen — the rough instance-population proxy.
+    fn rows(&self) -> usize {
+        self.creature_displays.len()
+            + self.go_displays.len()
+            + self.item_displays.len()
+            + self.bones.len()
+    }
+
+    /// The one-line join-back cell printed beside the model path.
+    fn cell(&self) -> String {
+        let ids = |v: &[u32]| {
+            let head: Vec<String> = v.iter().take(ENTITY_ID_ROWS).map(u32::to_string).collect();
+            match v.len().checked_sub(ENTITY_ID_ROWS).filter(|n| *n > 0) {
+                Some(rest) => format!("{} … +{rest}", head.join(",")),
+                None => head.join(","),
+            }
+        };
+        let mut parts: Vec<String> = Vec::new();
+        if !self.creature_displays.is_empty() {
+            parts.push(format!(
+                "creature model {} · {} display(s) {}",
+                self.creature_models
+                    .iter()
+                    .map(u32::to_string)
+                    .collect::<Vec<_>>()
+                    .join("·"),
+                self.creature_displays.len(),
+                ids(&self.creature_displays),
+            ));
+        }
+        if !self.player_bodies.is_empty() {
+            parts.push(format!("PLAYER body {}", self.player_bodies.join(",")));
+        }
+        if !self.go_displays.is_empty() {
+            parts.push(format!(
+                "gameobject {} display(s) {}",
+                self.go_displays.len(),
+                ids(&self.go_displays),
+            ));
+        }
+        if !self.item_displays.is_empty() {
+            let kinds: std::collections::BTreeSet<&str> = self
+                .item_displays
+                .values()
+                .flat_map(|k| k.iter().copied())
+                .collect();
+            parts.push(format!(
+                "item {} display(s) [{}] {}",
+                self.item_displays.len(),
+                kinds.into_iter().collect::<Vec<_>>().join("/"),
+                ids(&self.item_displays.keys().copied().collect::<Vec<_>>()),
+            ));
+        }
+        if !self.bones.is_empty() {
+            parts.push(format!("bone pile {}", self.bones.join(",")));
+        }
+        if self.also_fx {
+            parts.push("ALSO a spell-visual model (2282's lane runs its transform)".to_string());
+        }
+        parts.join("  ·  ")
+    }
+}
+
+/// The corpus, plus the counters that say what the sweep could not see.
+#[derive(Default)]
+struct EntityCorpus {
+    models: BTreeMap<String, EntityReach>,
+    /// `CreatureDisplayInfo` rows walked, and the `CreatureModelData` rows no display reaches
+    /// (unreachable content — counted, never swept).
+    creature_rows: usize,
+    creature_orphan_models: usize,
+    /// `GameObjectDisplayInfo` rows walked, and those naming a `.wmo` (no M2 batches to animate).
+    go_rows: usize,
+    go_wmo: usize,
+    /// `ItemDisplayInfo` model columns walked, and the two ways one can fail to reach a file: the
+    /// basename ships under an `Item\ObjectComponents\` folder this column is never joined to
+    /// (`item_other_dir` — every one of these is a thrown weapon named in BOTH columns, so the
+    /// model is already in the corpus through its left column and only the extra display-id join
+    /// is dropped), or nothing ships it at all (`item_absent` — a dead row, the shape `fxuvscan`
+    /// found in `SpellVisualEffectName`).
+    item_rows: usize,
+    item_other_dir: usize,
+    item_absent: usize,
+}
+
+/// Fold one model path into the corpus under [`crate::model_key`], keeping the table's own
+/// spelling for display.
+fn entity_record<'a>(
+    out: &'a mut BTreeMap<String, EntityReach>,
+    path: &str,
+) -> &'a mut EntityReach {
+    let e = out
+        .entry(crate::model_key(path.trim_start_matches(['\\', '/'])))
+        .or_default();
+    if e.path.is_empty() {
+        e.path = path.to_string();
+    }
+    e
+}
+
+/// Every model the ENTITY lane can render, walked from the tables that name one — never from a
+/// path prefix, because reachability is the whole question ("the path looks broken" and "the path
+/// is reachable" are different questions, 2282's own closing note).
+///
+/// Four sources, one per `build_parts` caller that is not the spell-effect lane:
+/// `CreatureDisplayInfo` → `CreatureModelData` (every NPC, critter, mount — and every PLAYER body,
+/// which resolves through the same chain, decision 0041), `GameObjectDisplayInfo`,
+/// `ItemDisplayInfo`'s two model columns joined to the `Item\ObjectComponents\` folder the archives
+/// actually hold them in, and the corpse lane's `<Race><Sex>DeathSkeleton` bone piles.
+fn entity_corpus(chain: &mut Chain) -> Result<EntityCorpus> {
+    let mut out = EntityCorpus::default();
+
+    // --- creatures, players, mounts, critters ---------------------------------------------
+    let creatures = benilla_formats::load_creature_catalog(chain).context("CreatureDisplayInfo")?;
+    let model_paths: BTreeMap<u32, String> = creatures
+        .sized_models()
+        .map(|(id, path, _)| (id, path.to_string()))
+        .collect();
+    let mut reached_models: std::collections::BTreeSet<u32> = std::collections::BTreeSet::new();
+    let mut display_model: BTreeMap<u32, u32> = BTreeMap::new();
+    for (display, model) in creatures.display_models() {
+        display_model.insert(display, model);
+        let Some(path) = model_paths.get(&model) else {
+            continue;
+        };
+        out.creature_rows += 1;
+        reached_models.insert(model);
+        let e = entity_record(&mut out.models, path);
+        e.creature_models.insert(model);
+        e.creature_displays.push(display);
+    }
+    out.creature_orphan_models = model_paths.len() - reached_models.len();
+
+    // --- the playable bodies, named as such, and the bone piles they leave ------------------
+    if let Ok(cc) = benilla_formats::CharCreateCatalog::load(chain) {
+        for race in 1..=u8::try_from(HELM_RACE_PREFIX.len()).unwrap_or(8) {
+            let Some(file) = cc.race_file(race).map(str::to_string) else {
+                continue;
+            };
+            for (sex, sex_name) in [(0u8, "Male"), (1, "Female")] {
+                if let Some(path) = cc
+                    .body_display(race, sex)
+                    .and_then(|d| display_model.get(&d))
+                    .and_then(|m| model_paths.get(m))
+                {
+                    entity_record(&mut out.models, &path.clone())
+                        .player_bodies
+                        .push(format!("{file}{sex_name}"));
+                }
+                // `0x5d673c`'s format string: the corpse lane's own model, named by no table.
+                let bones = format!(
+                    "World\\Generic\\PassiveDoodads\\DeathSkeletons\\{file}{sex_name}DeathSkeleton.mdx"
+                );
+                if chain.read_file(&crate::model_key(&bones)).is_ok() {
+                    entity_record(&mut out.models, &bones)
+                        .bones
+                        .push(format!("{file}{sex_name}"));
+                }
+            }
+        }
+    }
+
+    // --- GameObjects -----------------------------------------------------------------------
+    let gos = benilla_formats::load_gameobject_catalog(chain).context("GameObjectDisplayInfo")?;
+    let go_rows: Vec<(u32, String)> = gos.iter().map(|(id, p)| (id, p.to_string())).collect();
+    for (id, path) in go_rows {
+        out.go_rows += 1;
+        if !crate::model_key(&path).ends_with(".m2") {
+            out.go_wmo += 1;
+            continue;
+        }
+        entity_record(&mut out.models, &path).go_displays.push(id);
+    }
+
+    // --- held / worn item geometry ----------------------------------------------------------
+    // The archives decide which folder a display's basename lives in, because the table does not
+    // carry one: the equipment lane picks the directory from the slot the item is worn in.
+    let item_files: Vec<String> = super::m2_names(chain, Some("item\\objectcomponents"))?
+        .into_iter()
+        .map(|n| n.to_ascii_lowercase())
+        .collect();
+    let files: std::collections::HashSet<&str> = item_files.iter().map(String::as_str).collect();
+    // …and the same listing keyed by BASENAME, so an unjoinable column can say which of the two
+    // failures it is rather than being counted as one lump.
+    let by_base: std::collections::HashSet<&str> = item_files
+        .iter()
+        .filter_map(|f| f.rsplit_once('\\').map(|(_, b)| b))
+        .collect();
+    let items = benilla_formats::load_item_display_catalog(chain).context("ItemDisplayInfo")?;
+    let item_rows: Vec<(u32, [Option<String>; 2])> =
+        items.iter().map(|(id, d)| (id, d.model.clone())).collect();
+    for (id, model) in item_rows {
+        for (col, dirs) in [(0usize, &ITEM_DIRS_L[..]), (1, &ITEM_DIRS_R[..])] {
+            let Some(name) = model[col].as_deref() else {
+                continue;
+            };
+            out.item_rows += 1;
+            let mut placed = false;
+            let put = |out: &mut EntityCorpus, path: String, kind: &'static str| {
+                entity_record(&mut out.models, &path)
+                    .item_displays
+                    .entry(id)
+                    .or_default()
+                    .insert(kind);
+            };
+            for dir in dirs {
+                let path = format!("Item\\ObjectComponents\\{dir}\\{name}");
+                if files.contains(path.to_ascii_lowercase().as_str()) {
+                    put(&mut out, path, dir);
+                    placed = true;
+                }
+            }
+            // A HELM ships as sixteen per-race/sex files under one stem, and the display row names
+            // the stem alone — so the census expands it the way the attach does.
+            if col == 0 {
+                let stem = name.strip_suffix(".m2").unwrap_or(name);
+                for prefix in HELM_RACE_PREFIX {
+                    for letter in ['M', 'F'] {
+                        let path =
+                            format!("Item\\ObjectComponents\\Head\\{stem}_{prefix}{letter}.m2");
+                        if files.contains(path.to_ascii_lowercase().as_str()) {
+                            put(&mut out, path, "Head");
+                            placed = true;
+                        }
+                    }
+                }
+            }
+            if !placed {
+                if by_base.contains(name.to_ascii_lowercase().as_str()) {
+                    out.item_other_dir += 1;
+                } else {
+                    out.item_absent += 1;
+                }
+            }
+        }
+    }
+
+    // Every id list above is built by walking a HashMap, so it comes out in a different order
+    // every run. Sorted here, once, because an instrument whose report reshuffles cannot be
+    // diffed against its own previous output.
+    for e in out.models.values_mut() {
+        e.creature_displays.sort_unstable();
+        e.go_displays.sort_unstable();
+        e.player_bodies.sort();
+        e.bones.sort();
+    }
+
+    // --- the mark: which of these the spell-effect lane already runs -------------------------
+    if let (Ok(visuals), Ok(spells)) = (
+        benilla_formats::load_spell_visual_catalog(chain),
+        benilla_formats::load_spell_catalog(chain),
+    ) {
+        for key in fx_corpus(&visuals, &spells).keys() {
+            if let Some(e) = out.models.get_mut(key) {
+                e.also_fx = true;
+            }
+        }
+    }
+    Ok(out)
+}
+
+/// Which clock one batch's keyed transform runs on — the question that decides the SHAPE of the
+/// fix, not just its size (0136 choice 1 versus 2282's per-instance lane).
+#[derive(Clone, Copy, PartialEq, Eq, PartialOrd, Ord)]
+enum UvClock {
+    /// Every live loop is clocked on a **global sequence**: a free-running per-scene ms clock the
+    /// reference anchors once per instance at attach (`gseq-anchor.md`, `CM2Model+0x68`). One
+    /// shared uniform on a free-running clock is faithful here — 0136's lane, unchanged.
+    Gseq,
+    /// Every live loop is clocked on its **sequence band**: the host's own playing-clip time, so
+    /// two instances playing different animations — or the same one at different phases — are at
+    /// different offsets. A shared uniform cannot be right for both.
+    Band,
+    /// The batch's three channels disagree: some global, some band.
+    Mixed,
+    /// Keyed but never moving — a constant non-identity hold (`period == 0`), which needs a seed
+    /// and no clock at all.
+    Hold,
+}
+
+impl UvClock {
+    const ALL: [Self; 4] = [Self::Gseq, Self::Band, Self::Mixed, Self::Hold];
+
+    fn label(self) -> &'static str {
+        match self {
+            Self::Gseq => "GSEQ",
+            Self::Band => "BAND",
+            Self::Mixed => "MIXED",
+            Self::Hold => "HOLD",
+        }
+    }
+
+    fn blurb(self) -> &'static str {
+        match self {
+            Self::Gseq => {
+                "every live loop rides a GLOBAL SEQUENCE — a free-running clock, so one shared \
+                 material uniform is faithful (0136 choice 1)"
+            }
+            Self::Band => {
+                "every live loop rides its SEQUENCE BAND — the instance's own play head, which a \
+                 shared uniform cannot serve (2282's per-instance lane)"
+            }
+            Self::Mixed => "the batch's channels disagree: some global-sequence, some band",
+            Self::Hold => {
+                "keyed but never moving — a constant offset that needs a seed, not a clock"
+            }
+        }
+    }
+}
+
+/// One transform channel's read of the clock question.
+#[derive(Default)]
+struct ChannelClock {
+    /// `[L.L]` per file sequence slot — `None` when the channel carries no per-slot set.
+    cell: Option<String>,
+    /// File slots whose loop is LIVE (`period > 0`).
+    live: Vec<usize>,
+    /// `true` for each live loop clocked on a global sequence.
+    gseq: Vec<bool>,
+    /// The leading live loop as the report prints it: `(period, wrap, gseq)`.
+    lead: Option<(f32, bool, bool)>,
+    /// The channel's one loop is the SHARED slot-0 bake — every sequence plays the same one.
+    uniform: bool,
+}
+
+impl ChannelClock {
+    /// `gseq 2.000s wrap` / `band 1.500s clamp` / `—`.
+    fn cell_text(&self) -> String {
+        match self.lead {
+            None if self.cell.is_none() => "—".to_string(),
+            None => "held".to_string(),
+            Some((period, wrap, gseq)) => format!(
+                "{} {period:.3}s {}",
+                if gseq { "gseq" } else { "band" },
+                if wrap { "wrap" } else { "clamp" },
+            ),
+        }
+    }
+}
+
+/// Read one channel's per-slot set (or its shared slot-0 twin, for the translation channel which is
+/// the only one that has one) the way the runtime reads it.
+fn channel_clock<V: AsRef<[f32]> + PartialEq>(
+    set: Option<&SeqLoops<V>>,
+    shared: Option<&KeyAnim<V>>,
+) -> ChannelClock {
+    let mut out = ChannelClock::default();
+    match set {
+        Some(s) => {
+            out.cell = Some(slot_cell(s.slots()));
+            for (i, l) in s.slots().iter().enumerate() {
+                let Some(l) = l.as_ref().filter(|l| l.period > 0.0) else {
+                    continue;
+                };
+                out.live.push(i);
+                out.gseq.push(l.gseq);
+                out.lead.get_or_insert((l.period, l.wrap, l.gseq));
+            }
+        }
+        None => {
+            if let Some(l) = shared {
+                out.uniform = true;
+                if l.period > 0.0 {
+                    out.gseq.push(l.gseq);
+                    out.lead = Some((l.period, l.wrap, l.gseq));
+                }
+            }
+        }
+    }
+    out
+}
+
+/// One classified entity batch — the row every listing and the population tail are built from.
+struct EntityHit {
+    key: String,
+    batch: usize,
+    class: FxClass,
+    key_class: FxClass,
+    clock: UvClock,
+    /// `T`/`R`/`S`, in that order, for the channels the bake keyed.
+    chans: [bool; 3],
+    /// The batch's translation lane: `true` when it carries a per-sequence set (`uv_seq`), which is
+    /// `uvslotscan`'s PER-PLACEMENT population; `false` when it keeps the shared slot-0 loop.
+    per_seq_trans: bool,
+    /// …and whether that shared loop is LIVE — `uvslotscan`'s "carry a LIVE loop there" count, the
+    /// number this sweep's corpus must be a subset of.
+    live_shared_trans: bool,
+}
+
+/// Sweep every model the UNIT / GAMEOBJECT / HELD-ITEM tables reach and census the batches whose
+/// texture transform animates — see the `Entityuvscan` command doc for the why.
+pub fn entityuvscan(chain: &mut Chain, prefix: Option<&str>) -> Result<()> {
+    let corpus = entity_corpus(chain)?;
+    let pfx = prefix.map(|p| p.to_ascii_lowercase().replace('/', "\\"));
+    let anim_names = benilla_formats::load_anim_data_catalog(chain).ok();
+    // Loaded once, beside the corpus, because the per-batch sheet question asks it per MODEL: a
+    // creature batch's `Monster1/2/3` slot is filled from the display's own texture variations.
+    let creatures = benilla_formats::load_creature_catalog(chain).unwrap_or_default();
+
+    let mut sheets: BTreeMap<String, Option<Sheet>> = BTreeMap::new();
+    let (mut listed, mut read, mut missing, mut batches) = (0u32, 0u32, 0u32, 0u64);
+    let (mut anim_models, mut anim_batches) = (0u32, 0u32);
+    let mut no_uvs = 0u32;
+    let mut per_class: BTreeMap<FxClass, u32> = BTreeMap::new();
+    let mut per_key_class: BTreeMap<FxClass, u32> = BTreeMap::new();
+    let mut per_clock: BTreeMap<UvClock, u32> = BTreeMap::new();
+    let mut per_chans: BTreeMap<String, u32> = BTreeMap::new();
+    let mut hits: Vec<EntityHit> = Vec::new();
+    let mut unread: Vec<String> = Vec::new();
+    let mut seed_disagrees = 0u32;
+    let mut misregistered = 0u32;
+    // The `uvslotscan` cross-check: this corpus's share of the two whole-corpus translation counts.
+    let (mut live_shared, mut per_seq) = (0u32, 0u32);
+    // Batches whose sheet is filled at RUNTIME (a creature skin variation, a character composite),
+    // and those where two of a model's skins disagree about what a frozen batch paints.
+    let (mut skin_filled, mut skin_disagrees) = (0u32, 0u32);
+
+    // --- the TINT half of the same sweep (the second dead channel on this lane) ---
+    let (mut tint_models, mut tint_batches) = (0u32, 0u32);
+    let mut tint_class: BTreeMap<TintClass, u32> = BTreeMap::new();
+    let mut tint_clock: BTreeMap<UvClock, u32> = BTreeMap::new();
+    let mut tint_hits: Vec<TintHit> = Vec::new();
+    let mut tint_blocks: Vec<(String, Vec<String>)> = Vec::new();
+    let (mut tint_live_shared, mut tint_per_seq) = (0u32, 0u32);
+    // …and the ALPHA channel beside them, which this lane DOES serve — counted so the report can
+    // say which of the three material-animation channels is a hole and which is not, rather than
+    // leaving the reader to assume all three are the same.
+    let (mut alpha_models, mut alpha_batches, mut alpha_live) = (0u32, 0u32, 0u32);
+
+    let keys: Vec<String> = corpus.models.keys().cloned().collect();
+    for key in keys {
+        if pfx.as_deref().is_some_and(|p| !key.starts_with(p)) {
+            continue;
+        }
+        let path = corpus.models[&key].path.clone();
+        listed += 1;
+        let Ok(bytes) = chain.read_file(&key) else {
+            missing += 1;
+            unread.push(format!("{path} (not in the chain)"));
+            continue;
+        };
+        read += 1;
+        let dir = key
+            .rsplit_once('\\')
+            .map(|(d, _)| d)
+            .unwrap_or("")
+            .to_string();
+        let Ok(subs) = benilla_formats::parse_m2_render_submeshes(&bytes, &dir, &[]) else {
+            missing += 1;
+            unread.push(format!("{path} (will not parse)"));
+            continue;
+        };
+        batches += subs.len() as u64;
+        // Any of the three channels keeps the model: a batch can animate its tint and not its UVs
+        // (four do), and gating on `uv_keyed` alone is exactly the shape of predicate this sweep
+        // exists to catch.
+        if !subs
+            .iter()
+            .any(|sub| uv_keyed(sub) || tint_keyed(sub) || sub.alpha_anim.is_some())
+        {
+            continue;
+        }
+        let no_alpha_add = authors_no_alpha_add(&bytes);
+        // File sequence slot -> its `AnimationData.dbc` id, so a BAND loop can be named by the
+        // animations that carry it rather than by an opaque slot number. A slot with no entry is a
+        // zero-duration sequence (`parse_m2_animations` drops those; the bake does not).
+        let slot_anim: BTreeMap<usize, u16> = benilla_formats::parse_m2_animations(&bytes)
+            .iter()
+            .map(|a| (a.seq_index, a.anim_id))
+            .collect();
+        // The creature skins this model is rendered with — `Monster1/2/3` is blank in the M2 and
+        // filled per display from `CreatureDisplayInfo.textureVariation`, so a batch on one of
+        // those slots has as many sheets as the model has skins.
+        let mut skins: [std::collections::BTreeSet<String>; 3] = Default::default();
+        for d in &corpus.models[&key].creature_displays {
+            let Some(m) = creatures.model(*d) else {
+                continue;
+            };
+            for (i, t) in m.textures.iter().enumerate() {
+                if let Some(name) = t {
+                    skins[i].insert(format!("{dir}\\{name}.blp"));
+                }
+            }
+        }
+
+        // WHICH BANDS carry the keys — the load-bearing half for a band loop, because it says
+        // whether the loop is one animation's or every animation's. Shared by both channels.
+        let slot_line = |c: &ChannelClock| -> String {
+            match (&c.cell, c.uniform) {
+                (Some(cell), _) => {
+                    let ids: Vec<String> = c
+                        .live
+                        .iter()
+                        .take(ENTITY_ID_ROWS)
+                        .map(|s| match slot_anim.get(s) {
+                            Some(id) => match anim_names.as_ref().and_then(|a| a.name(*id)) {
+                                Some(n) => format!("{s}:{id} {n}"),
+                                None => format!("{s}:{id}"),
+                            },
+                            None => format!("{s}:—"),
+                        })
+                        .collect();
+                    format!("{cell} live {}", ids.join(" "))
+                }
+                (None, true) => "SHARED (one loop, every sequence)".to_string(),
+                (None, false) => "—".to_string(),
+            }
+        };
+
+        // --- the TINT + ALPHA pass over the same batches -----------------------------------
+        let mut tlines: Vec<String> = Vec::new();
+        let mut model_has_alpha = false;
+        for (bi, sub) in subs.iter().enumerate() {
+            if let Some(a) = sub.alpha_anim.as_ref() {
+                alpha_batches += 1;
+                model_has_alpha = true;
+                if a.slots().iter().any(|q| {
+                    [q.color.as_ref(), q.weight.as_ref()]
+                        .into_iter()
+                        .flatten()
+                        .any(|l| l.period > 0.0)
+                }) {
+                    alpha_live += 1;
+                }
+            }
+            if !tint_keyed(sub) {
+                continue;
+            }
+            tint_batches += 1;
+            let read = tint_batch(sub, bi);
+            let c = channel_clock(sub.rgb_seq.as_ref(), sub.rgb_anim.as_ref());
+            let clock = if c.gseq.is_empty() {
+                UvClock::Hold
+            } else if c.gseq.iter().all(|g| *g) {
+                UvClock::Gseq
+            } else if c.gseq.iter().all(|g| !*g) {
+                UvClock::Band
+            } else {
+                UvClock::Mixed
+            };
+            tint_live_shared += u32::from(read.live_shared);
+            tint_per_seq += u32::from(read.per_seq);
+            *tint_class.entry(read.class).or_default() += 1;
+            *tint_clock.entry(clock).or_default() += 1;
+            tint_hits.push(TintHit {
+                key: key.clone(),
+                batch: bi,
+                class: read.class,
+                clock,
+                seed: read.seed,
+                rest_wrong: c.live.contains(&0) || (c.uniform && c.lead.is_some()),
+                seed_is_white: read.seed_is_white,
+                delta: read.delta,
+                per_seq: read.per_seq,
+                live_shared: read.live_shared,
+            });
+            tlines.extend(read.lines);
+            tlines.push(format!(
+                "      clock  {:<5}      {}",
+                clock.label(),
+                c.cell_text(),
+            ));
+            tlines.push(format!("      slots  {}", slot_line(&c)));
+            if let Some(set) = sub.rgb_seq.as_ref() {
+                let v = classify(set, Channel::Rgb);
+                tlines.push(format!("      rgb_seq {:<12} {}", v.why.label(), v.detail));
+            }
+        }
+        if model_has_alpha {
+            alpha_models += 1;
+        }
+        if !tlines.is_empty() {
+            tint_models += 1;
+            tint_blocks.push((path.clone(), tlines));
+        }
+
+        let mut lines: Vec<String> = Vec::new();
+        for (bi, sub) in subs.iter().enumerate() {
+            if !uv_keyed(sub) {
+                continue;
+            }
+            if sub.uvs.is_empty() {
+                no_uvs += 1;
+                continue;
+            }
+            anim_batches += 1;
+
+            // WHICH SHEET. An authored path where the batch carries one; otherwise the display's
+            // own skin variations, each asked separately — the frozen verdict is a property of the
+            // texture, and two skins of one model can answer differently.
+            let candidates: Vec<String> = match (&sub.texture, sub.skin_slot, sub.char_slot) {
+                (Some(t), _, _) => vec![t.clone()],
+                (None, Some(slot), _) => {
+                    skin_filled += 1;
+                    skins
+                        .get(slot as usize)
+                        .map(|s| s.iter().cloned().collect())
+                        .unwrap_or_default()
+                }
+                (None, None, Some(_)) => {
+                    // A runtime character composite (body atlas, object skin, hair): there is no
+                    // authored sheet to judge, and UNKNOWN is what that has to read as.
+                    skin_filled += 1;
+                    Vec::new()
+                }
+                (None, None, None) => Vec::new(),
+            };
+            let mut reads: Vec<(Option<String>, UvBatch)> = Vec::new();
+            if candidates.is_empty() {
+                let r = uv_batch(&mut sheets, chain, sub, bi, None, no_alpha_add);
+                reads.push((None, r));
+            } else {
+                for c in &candidates {
+                    let r = uv_batch(&mut sheets, chain, sub, bi, Some(c), no_alpha_add);
+                    reads.push((Some(c.clone()), r));
+                }
+            }
+            if reads.iter().any(|(_, r)| r.class != reads[0].1.class) {
+                skin_disagrees += 1;
+            }
+            let read = &reads[0].1;
+
+            // THE CLOCK, per channel, exactly as the runtime resolves it.
+            let t = channel_clock(sub.uv_seq.as_ref(), sub.uv_anim.as_ref());
+            let r = channel_clock::<[f32; 4]>(sub.uv_rot_seq.as_ref(), None);
+            let s = channel_clock::<[f32; 2]>(sub.uv_scale_seq.as_ref(), None);
+            let flags: Vec<bool> = [&t, &r, &s].iter().flat_map(|c| c.gseq.clone()).collect();
+            let clock = if flags.is_empty() {
+                UvClock::Hold
+            } else if flags.iter().all(|g| *g) {
+                UvClock::Gseq
+            } else if flags.iter().all(|g| !*g) {
+                UvClock::Band
+            } else {
+                UvClock::Mixed
+            };
+            let chans = [
+                sub.uv_anim.is_some() || sub.uv_seq.is_some(),
+                sub.uv_rot_seq.is_some(),
+                sub.uv_scale_seq.is_some(),
+            ];
+            let per_seq_trans = sub.uv_seq.is_some();
+            let live_shared_trans =
+                !per_seq_trans && sub.uv_anim.as_ref().is_some_and(|a| a.period > 0.0);
+            live_shared += u32::from(live_shared_trans);
+            per_seq += u32::from(per_seq_trans);
+
+            if read.class != read.key_class {
+                seed_disagrees += 1;
+            }
+            if read.class == FxClass::Frozen && (read.seed[0] != 0.0 || read.seed[1] != 0.0) {
+                misregistered += 1;
+            }
+            *per_class.entry(read.class).or_default() += 1;
+            *per_key_class.entry(read.key_class).or_default() += 1;
+            *per_clock.entry(clock).or_default() += 1;
+            let chan_key: String = ["T", "R", "S"]
+                .iter()
+                .zip(chans)
+                .filter_map(|(n, on)| on.then_some(*n))
+                .collect();
+            *per_chans.entry(chan_key).or_default() += 1;
+            hits.push(EntityHit {
+                key: key.clone(),
+                batch: bi,
+                class: read.class,
+                key_class: read.key_class,
+                clock,
+                chans,
+                per_seq_trans,
+                live_shared_trans,
+            });
+
+            lines.extend(reads[0].1.lines.clone());
+            for (sheet, r) in reads.iter().skip(1) {
+                lines.push(format!(
+                    "      skin variant      {} => {} / {}",
+                    sheet.as_deref().unwrap_or("NONE"),
+                    r.class.label(),
+                    r.key_class.label(),
+                ));
+            }
+            lines.push(format!(
+                "      clock  {:<5}      T {:<22} R {:<22} S {}",
+                clock.label(),
+                t.cell_text(),
+                r.cell_text(),
+                s.cell_text(),
+            ));
+            lines.push(format!("      slots  T {}", slot_line(&t)));
+            if r.cell.is_some() {
+                lines.push(format!("      slots  R {}", slot_line(&r)));
+            }
+            if s.cell.is_some() {
+                lines.push(format!("      slots  S {}", slot_line(&s)));
+            }
+            // …and, when the translation set exists, WHY the bake refused the shared lane — the
+            // `uniform()` question `uvslotscan` asks, asked here of the same set.
+            if let Some(set) = sub.uv_seq.as_ref() {
+                let v = classify(set, Channel::Uv);
+                lines.push(format!("      uv_seq {:<12} {}", v.why.label(), v.detail));
+            }
+        }
+        if !lines.is_empty() {
+            anim_models += 1;
+            println!("{path}  [{}]", corpus.models[&key].cell());
+            for l in &lines {
+                println!("{l}");
+            }
+        }
+    }
+
+    println!();
+    println!(
+        "=== summary ===  {listed} model(s) swept of the {} the entity tables reach, {read} read \
+         ({missing} unreadable), {batches} render batch(es)",
+        corpus.models.len()
+    );
+    println!(
+        "  sources: {} CreatureDisplayInfo row(s) ({} CreatureModelData row(s) no display reaches, \
+         unswept) · {} GameObjectDisplayInfo row(s) ({} name a .wmo) · {} ItemDisplayInfo model \
+         column(s) ({} name a file that ships under a folder this column is never joined to — \
+         thrown weapons named in both columns, already swept through the left one — and {} name a \
+         file nothing ships) · the bone piles",
+        corpus.creature_rows,
+        corpus.creature_orphan_models,
+        corpus.go_rows,
+        corpus.go_wmo,
+        corpus.item_rows,
+        corpus.item_other_dir,
+        corpus.item_absent,
+    );
+    println!(
+        "  {anim_models} model(s) / {anim_batches} batch(es) carry a keyed TEXTURE TRANSFORM — the \
+         channel `entity_variants` seeds and registers since 2295 ({no_uvs} more are keyed but \
+         carry no UVs to transform)"
+    );
+    println!(
+        "    channels  {}   (T translation · R rotation · S scaling — a sweep that read only T \
+         would miss a scale-only or rotate-only batch entirely)",
+        per_chans
+            .iter()
+            .map(|(k, n)| format!("{k} {n}"))
+            .collect::<Vec<_>>()
+            .join(" · "),
+    );
+    println!("    {:<10} {:>8} {:>9}", "", "identity", "first-key");
+    for c in FxClass::ALL {
+        println!(
+            "    {:<10} {:>8} {:>9}  — {}",
+            c.label(),
+            per_class.get(&c).copied().unwrap_or(0),
+            per_key_class.get(&c).copied().unwrap_or(0),
+            c.blurb(),
+        );
+    }
+    println!(
+        "  of the {} batch(es) FROZEN@identity, {misregistered} are frozen at UVs the loop never \
+         opens at (a non-zero first key); {seed_disagrees} batch(es) are classified differently by \
+         the two seeds",
+        per_class.get(&FxClass::Frozen).copied().unwrap_or(0),
+    );
+    println!();
+    println!("  --- the CLOCK the fix has to serve ---");
+    for c in UvClock::ALL {
+        println!(
+            "    {:<6} {:>5} batch(es)  — {}",
+            c.label(),
+            per_clock.get(&c).copied().unwrap_or(0),
+            c.blurb(),
+        );
+    }
+    println!();
+    println!(
+        "  --- cross-check against `uvslotscan` (whole corpus) ---\n    {live_shared} of this \
+         corpus's batch(es) carry a LIVE SHARED translation loop and {per_seq} carry a \
+         per-sequence translation set (`uv_seq`). Both must be <= `uvslotscan`'s whole-corpus \
+         counts for the same two lanes (its `of those … carry a LIVE loop there` and \
+         `PER-PLACEMENT` lines) — this corpus is a subset of that one by construction."
+    );
+    // The two translation lanes NAMED, not just counted: `uvslotscan` prints the same two
+    // populations over the whole corpus, so listing the models here makes the subset claim
+    // checkable by eye instead of on trust.
+    let mut shared_models: std::collections::BTreeSet<&str> = std::collections::BTreeSet::new();
+    let mut per_seq_models: BTreeMap<&str, u32> = BTreeMap::new();
+    for h in &hits {
+        if h.live_shared_trans {
+            shared_models.insert(h.key.as_str());
+        }
+        if h.per_seq_trans {
+            *per_seq_models.entry(h.key.as_str()).or_default() += 1;
+        }
+    }
+    println!(
+        "    the LIVE SHARED loop lands on {} model(s); the per-sequence set on these, which must \
+         each appear in `uvslotscan`'s PER-PLACEMENT listing:",
+        shared_models.len()
+    );
+    for (key, n) in &per_seq_models {
+        println!(
+            "      {n} batch(es)  {}",
+            corpus.models.get(*key).map_or(*key, |r| r.path.as_str())
+        );
+    }
+
+    println!(
+        "    {skin_filled} affected batch(es) take their sheet at RUNTIME (a creature skin \
+         variation or a character composite), so the visibility verdict is asked once per skin; \
+         {skin_disagrees} of them are classified differently by two skins of the same model."
+    );
+    if !unread.is_empty() {
+        println!();
+        println!(
+            "--- unreadable ---  {} model(s) the tables name but could not be swept",
+            unread.len()
+        );
+        for u in unread.iter().take(ENTITY_UNREAD_ROWS) {
+            println!("  {u}");
+        }
+        if let Some(rest) = unread
+            .len()
+            .checked_sub(ENTITY_UNREAD_ROWS)
+            .filter(|n| *n > 0)
+        {
+            println!("  … and {rest} more (top {ENTITY_UNREAD_ROWS} shown)");
+        }
+    }
+
+    // Every model carrying a batch of class `c`, with the rows that reach it — the join back from
+    // a verdict to something a director can go and stand in front of.
+    let listing = |title: &str, note: &str, pick: fn(&EntityHit) -> FxClass, c: FxClass| {
+        let rows: Vec<&EntityHit> = hits.iter().filter(|h| pick(h) == c).collect();
+        if rows.is_empty() {
+            return;
+        }
+        println!();
+        println!("--- {title} ---  {} batch(es){note}", rows.len());
+        let mut models: BTreeMap<&str, Vec<usize>> = BTreeMap::new();
+        for h in &rows {
+            models.entry(h.key.as_str()).or_default().push(h.batch);
+        }
+        for (key, bs) in &models {
+            let Some(reach) = corpus.models.get(*key) else {
+                continue;
+            };
+            println!(
+                "  {}  batch(es) {}",
+                reach.path,
+                bs.iter()
+                    .map(usize::to_string)
+                    .collect::<Vec<_>>()
+                    .join(", "),
+            );
+            println!("      {}", reach.cell());
+        }
+    };
+    for c in [
+        FxClass::Invisible,
+        FxClass::Never,
+        FxClass::Unknown,
+        FxClass::Held,
+    ] {
+        listing(
+            c.label(),
+            "  (frozen@identity — what the entity lane renders today)",
+            |h| h.class,
+            c,
+        );
+    }
+    // The batches the first-key seed alone condemns: they draw today, and would stop drawing on a
+    // lane that seeds the loop's opening value without running it. Named, because that is exactly
+    // the shape of a half-finished fix.
+    let key_only: Vec<&EntityHit> = hits
+        .iter()
+        .filter(|h| h.key_class == FxClass::Invisible && h.class != FxClass::Invisible)
+        .collect();
+    if !key_only.is_empty() {
+        println!();
+        println!(
+            "--- INVISIBLE under the FIRST-KEY seed only ---  {} batch(es)\n    (these draw today \
+             and would go dark on a lane that seeds `uv_anim.sample(0.0)` without ticking it)",
+            key_only.len()
+        );
+        let mut models: BTreeMap<&str, Vec<usize>> = BTreeMap::new();
+        for h in &key_only {
+            models.entry(h.key.as_str()).or_default().push(h.batch);
+        }
+        for (key, bs) in &models {
+            println!(
+                "  {}  batch(es) {}",
+                corpus.models.get(*key).map_or(*key, |r| r.path.as_str()),
+                bs.iter()
+                    .map(usize::to_string)
+                    .collect::<Vec<_>>()
+                    .join(", "),
+            );
+        }
+    }
+
+    // The deliverable: every affected model, what it renders today, and how much of the world
+    // reaches it — sorted by POPULATION, because that is what sizes the fix.
+    let mut models: BTreeMap<&str, (Vec<&EntityHit>, usize)> = BTreeMap::new();
+    for h in &hits {
+        let e = models.entry(h.key.as_str()).or_default();
+        e.0.push(h);
+        e.1 = corpus.models.get(&h.key).map_or(0, EntityReach::rows);
+    }
+    let mut tail: Vec<(&str, (Vec<&EntityHit>, usize))> = models.into_iter().collect();
+    tail.sort_by(|a, b| b.1 .1.cmp(&a.1 .1).then_with(|| a.0.cmp(b.0)));
+    println!();
+    println!(
+        "=== affected models, by population ===  {} model(s), {} batch(es)",
+        tail.len(),
+        hits.len()
+    );
+    for (key, (hs, rows)) in &tail {
+        let Some(reach) = corpus.models.get(*key) else {
+            continue;
+        };
+        let classes: Vec<String> = hs
+            .iter()
+            .map(|h| {
+                format!(
+                    "{}:{}{}{}/{}/{}",
+                    h.batch,
+                    if h.chans[0] { "T" } else { "" },
+                    if h.chans[1] { "R" } else { "" },
+                    if h.chans[2] { "S" } else { "" },
+                    h.class.label(),
+                    h.clock.label(),
+                )
+            })
+            .collect();
+        println!(
+            "  {rows:>5} row(s)  {}\n           batches {}\n           {}",
+            reach.path,
+            classes.join("  "),
+            reach.cell(),
+        );
+    }
+
+    // =====================================================================================
+    // The M2COLOR TINT half. Same corpus, same walk, a different dead channel — and a
+    // different failure mode, because a tint is a multiply and a UV offset is a lookup.
+    // =====================================================================================
+    println!();
+    println!(
+        "============================== M2COLOR TINT ==============================\n\
+         The same corpus asked about the OTHER channel `entity_variants` leaves unserved.\n\
+         `build` passes `sub.rgb_anim.as_ref()` unconditionally, so a tint-animating entity\n\
+         batch is SEEDED at the loop's first key (`model_material`'s `tint.xyz`) — and then\n\
+         nothing re-samples it, because `doodad_anim::register_tint`'s only call sites are in\n\
+         `terrain_stream/spawn/assemble.rs`. There is no `play_rgb` flag to flip: the hole is\n\
+         the missing registration, not a missing argument."
+    );
+    for (path, block) in &tint_blocks {
+        println!(
+            "{path}  [{}]",
+            corpus
+                .models
+                .get(&crate::model_key(path))
+                .map_or(String::new(), EntityReach::cell)
+        );
+        for l in block {
+            println!("{l}");
+        }
+    }
+    println!();
+    println!(
+        "=== tint summary ===  {tint_models} model(s) / {tint_batches} batch(es) of the same \
+         {read} read model(s) carry a keyed M2Color TINT"
+    );
+    for c in TintClass::ALL {
+        println!(
+            "    {:<11} {:>5} batch(es)  — {}",
+            c.label(),
+            tint_class.get(&c).copied().unwrap_or(0),
+            c.blurb(),
+        );
+    }
+    println!();
+    println!("  --- the CLOCK the tint fix has to serve ---");
+    for c in UvClock::ALL {
+        println!(
+            "    {:<6} {:>5} batch(es)  — {}",
+            c.label(),
+            tint_clock.get(&c).copied().unwrap_or(0),
+            c.blurb(),
+        );
+    }
+    let white = tint_hits.iter().filter(|h| h.seed_is_white).count();
+    let rest = tint_hits.iter().filter(|h| h.rest_wrong).count();
+    println!();
+    println!(
+        "  {rest} of {} batch(es) are wrong AT REST — slot 0, the band a resting instance plays, \
+         carries a live loop. The other {} key their tint only in a later slot, so the seed is the \
+         right colour until that animation plays and the error is confined to it (the per-batch \
+         `slots` line names which). Reporting those as flatly broken would overstate the hole.",
+        tint_hits.len(),
+        tint_hits.len() - rest,
+    );
+    println!(
+        "  {white} batch(es) seed WHITE — no slot-0 bake, so the shared material carries the \
+         IDENTITY tint while a later sequence slot colours the batch. The tint twin of the UV \
+         lane's DEAD-0, and the one shape a slot-0 shared loop could never fix."
+    );
+    println!();
+    println!(
+        "  --- cross-check against `uvslotscan`'s RGB section (whole corpus) ---\n    \
+         {tint_live_shared} of this corpus's batch(es) carry a LIVE SHARED tint loop and \
+         {tint_per_seq} carry a per-sequence set (`rgb_seq`). Both must be <= that report's \
+         `of those … carry a LIVE loop there` and `PER-PLACEMENT` counts for the RGB channel."
+    );
+    let mut tint_shared_models: std::collections::BTreeSet<&str> =
+        std::collections::BTreeSet::new();
+    let mut tint_seq_models: BTreeMap<&str, u32> = BTreeMap::new();
+    for h in &tint_hits {
+        if h.live_shared {
+            tint_shared_models.insert(h.key.as_str());
+        }
+        if h.per_seq {
+            *tint_seq_models.entry(h.key.as_str()).or_default() += 1;
+        }
+    }
+    println!(
+        "    the LIVE SHARED tint lands on {} model(s); the per-sequence set on these, which must \
+         each appear in `uvslotscan`'s RGB PER-PLACEMENT listing:",
+        tint_shared_models.len()
+    );
+    for (key, n) in &tint_seq_models {
+        println!(
+            "      {n} batch(es)  {}",
+            corpus.models.get(*key).map_or(*key, |r| r.path.as_str())
+        );
+    }
+    println!();
+    println!(
+        "  --- the ALPHA channel, for contrast: this lane DOES serve it ---\n    \
+         {alpha_models} model(s) / {alpha_batches} batch(es) carry a baked `alpha_anim`, \
+         {alpha_live} of them with a live loop — and every one of them is sampled per instance: \
+         `entities::attach::dress::spawn_part` inserts `MatAnim::following(anim, unit)` on each \
+         part and card (and `equipment::spawn` on each held item), which \
+         `doodad_anim::sample_mat_anim` ticks every frame off the instance's own AnimationPlayer. \
+         Counted here so the report cannot be read as `the entity lane runs no material \
+         animation`: it runs exactly one of the three channels, and that one is per-instance \
+         already."
+    );
+
+    // The join-back for the tint, by class — same shape as the UV listings.
+    let tlisting = |title: &str, c: TintClass| {
+        let rows: Vec<&TintHit> = tint_hits.iter().filter(|h| h.class == c).collect();
+        if rows.is_empty() {
+            return;
+        }
+        println!();
+        println!("--- {title} ---  {} batch(es)", rows.len());
+        let mut models: BTreeMap<&str, Vec<&TintHit>> = BTreeMap::new();
+        for h in &rows {
+            models.entry(h.key.as_str()).or_default().push(h);
+        }
+        for (key, bs) in &models {
+            let Some(reach) = corpus.models.get(*key) else {
+                continue;
+            };
+            println!(
+                "  {}  batch(es) {}",
+                reach.path,
+                bs.iter()
+                    .map(|h| {
+                        format!(
+                            "{} frozen [{:.2},{:.2},{:.2}] Δ{:.2}{}",
+                            h.batch,
+                            h.seed[0],
+                            h.seed[1],
+                            h.seed[2],
+                            h.delta,
+                            if h.seed_is_white { " (WHITE seed)" } else { "" },
+                        )
+                    })
+                    .collect::<Vec<_>>()
+                    .join(" · "),
+            );
+            println!("      {}", reach.cell());
+        }
+    };
+    for c in [TintClass::Black, TintClass::Strong, TintClass::Slight] {
+        tlisting(c.label(), c);
+    }
+
+    // …and the population tail, sorted the same way the UV one is.
+    let mut tmodels: BTreeMap<&str, (Vec<&TintHit>, usize)> = BTreeMap::new();
+    for h in &tint_hits {
+        let e = tmodels.entry(h.key.as_str()).or_default();
+        e.0.push(h);
+        e.1 = corpus.models.get(&h.key).map_or(0, EntityReach::rows);
+    }
+    let mut ttail: Vec<(&str, (Vec<&TintHit>, usize))> = tmodels.into_iter().collect();
+    ttail.sort_by(|a, b| b.1 .1.cmp(&a.1 .1).then_with(|| a.0.cmp(b.0)));
+    println!();
+    println!(
+        "=== tint-affected models, by population ===  {} model(s), {} batch(es)",
+        ttail.len(),
+        tint_hits.len()
+    );
+    for (key, (hs, rows)) in &ttail {
+        let Some(reach) = corpus.models.get(*key) else {
+            continue;
+        };
+        println!(
+            "  {rows:>5} row(s)  {}\n           batches {}\n           {}",
+            reach.path,
+            hs.iter()
+                .map(|h| format!("{}:{}/{}", h.batch, h.class.label(), h.clock.label()))
+                .collect::<Vec<_>>()
+                .join("  "),
+            reach.cell(),
+        );
+    }
+    Ok(())
+}
+
+// ---------------------------------------------------------------------------
+// The M2COLOR TINT half of the same census — the second dead channel on the
+// same lane, found by asking where `register_tint` is called from.
+// ---------------------------------------------------------------------------
+
+/// Does this batch's M2Color tint animate? The runtime's own test: the shared slot-0 bake, or the
+/// per-sequence set the bake keeps when the slots disagree. The twin of [`uv_keyed`], and written
+/// as a union for the same reason — a predicate spelled `rgb_anim.is_some()` silently skips a batch
+/// whose slot 0 is a dead hold beside a live later slot (the tint corpus has four of those).
+fn tint_keyed(sub: &benilla_formats::RenderSubmesh) -> bool {
+    sub.rgb_anim.is_some() || sub.rgb_seq.is_some()
+}
+
+/// How many file sequence slots this batch's tint was baked across (1 when only the shared
+/// single-slot loop exists) — [`fx_slots`]'s tint twin.
+fn tint_slots(sub: &benilla_formats::RenderSubmesh) -> usize {
+    sub.rgb_seq.as_ref().map_or(1, |s| s.slots().len()).max(1)
+}
+
+/// The tint loop's period in slot `slot`; `0.0` where it is a constant hold.
+fn tint_period(sub: &benilla_formats::RenderSubmesh, slot: usize) -> f32 {
+    match (&sub.rgb_seq, &sub.rgb_anim) {
+        (Some(s), _) => s.seq(Some(slot)).map_or(0.0, |l| l.period),
+        (None, Some(a)) => a.period,
+        (None, None) => 0.0,
+    }
+}
+
+/// The tint at `(slot, t)`, read the way a consumer that RAN this channel would read it — the
+/// per-slot set when the bake built one, else the single shared loop ([`fx_state`]'s shape).
+/// White where neither exists, which is the tint identity.
+fn tint_state(sub: &benilla_formats::RenderSubmesh, slot: usize, t: f32) -> [f32; 3] {
+    match (&sub.rgb_seq, &sub.rgb_anim) {
+        (Some(s), _) => s.seq(Some(slot)).map_or([1.0; 3], |l| l.sample(t)),
+        (None, Some(a)) => a.sample(t),
+        (None, None) => [1.0; 3],
+    }
+}
+
+/// Rec.709 relative luminance — a reading aid for "how far apart are these two tints", not a
+/// perceptual model. The per-channel deltas beside it are the evidence; this is the single number
+/// that sorts a hue swap from a brightness swing.
+fn luma(c: [f32; 3]) -> f32 {
+    0.2126 * c[0] + 0.7152 * c[1] + 0.0722 * c[2]
+}
+
+/// What a consumer that seeds the tint and never re-samples it renders.
+///
+/// A tint is a **multiply**, so the failure mode is never "invisible geometry" the way a UV freeze
+/// can be — it is the wrong colour, and how wrong is the only question worth asking. The bands are
+/// a reading aid over one measured number (the worst per-channel distance between the frozen value
+/// and anything the loop reaches, in 0..1 tint units); every batch prints that number, so the call
+/// is checkable and the thresholds are not load-bearing.
+#[derive(Clone, Copy, PartialEq, Eq, PartialOrd, Ord)]
+enum TintClass {
+    /// The frozen tint is (near) BLACK while the loop reaches lit values: the multiply kills the
+    /// batch's colour outright, so it draws black — or, on an additive batch, not at all. The one
+    /// band where "wrong colour" becomes "wrong existence".
+    Black,
+    /// The frozen value is a quarter of the tint range or more away from what the loop reaches —
+    /// a colour difference nobody has to look for.
+    Strong,
+    /// Between 0.05 and 0.25 away: visible side by side, easy to miss alone.
+    Slight,
+    /// Under 0.05 away — the loop barely moves, or it moves and comes back. Frozen is
+    /// unobjectionable, and counting it as a bug would overstate the hole.
+    Negligible,
+}
+
+impl TintClass {
+    const ALL: [Self; 4] = [Self::Black, Self::Strong, Self::Slight, Self::Negligible];
+
+    fn label(self) -> &'static str {
+        match self {
+            Self::Black => "BLACK",
+            Self::Strong => "STRONG",
+            Self::Slight => "SLIGHT",
+            Self::Negligible => "NEGLIGIBLE",
+        }
+    }
+
+    fn blurb(self) -> &'static str {
+        match self {
+            Self::Black => {
+                "the frozen tint is ~black while the loop lights up — the multiply kills the batch \
+                 (an additive one disappears entirely)"
+            }
+            Self::Strong => {
+                "frozen >= 0.25 away from what the loop reaches — an obvious wrong colour"
+            }
+            Self::Slight => {
+                "frozen 0.05..0.25 away — visible against the real thing, easy to miss alone"
+            }
+            Self::Negligible => "frozen < 0.05 away — the loop barely moves; this is not a bug",
+        }
+    }
+}
+
+/// One batch's whole tint read.
+struct TintBatch {
+    class: TintClass,
+    /// What `model_material` actually bakes into `tint.xyz`: `rgb_anim.sample(0.0)` — the SHARED
+    /// slot-0 loop's first key — or identity white when there is no slot-0 bake at all.
+    seed: [f32; 3],
+    /// …and which of those two it was. A white seed is the tint twin of the UV lane's DEAD-0: the
+    /// batch's live tint lives in a later sequence slot the shared material cannot see.
+    seed_is_white: bool,
+    /// The worst per-channel distance between the seed and anything the loop reaches.
+    delta: f32,
+    /// This batch carries a per-sequence set (`rgb_seq`) — `uvslotscan`'s PER-PLACEMENT population.
+    per_seq: bool,
+    /// …and the shared slot-0 loop is live (`period > 0`) — its SHARED-live population.
+    live_shared: bool,
+    lines: Vec<String>,
+}
+
+/// Read one batch's animated tint — see [`TintBatch`]. The caller has established [`tint_keyed`].
+fn tint_batch(sub: &benilla_formats::RenderSubmesh, bi: usize) -> TintBatch {
+    let slots = tint_slots(sub);
+    // THE SEED, read off the builder rather than assumed: `model_render::model_material` does
+    // `rgb_anim.map_or([1,1,1], |a| a.sample(0.0))` and writes it to `tint.xyz`, and
+    // `batch::Materials::build` hands it `sub.rgb_anim.as_ref()` UNCONDITIONALLY — there is no
+    // `play_rgb` gate to flip. So unlike the UV channel, which freezes at the identity, the tint
+    // freezes at the loop's OPENING COLOUR… except where slot 0 baked nothing, and then it freezes
+    // at white while every live slot tints.
+    let seed = sub.rgb_anim.as_ref().map_or([1.0; 3], |a| a.sample(0.0));
+    let seed_is_white = sub.rgb_anim.is_none();
+
+    // Everything the loop reaches, over every slot and a uniform sweep of each — the same
+    // over-approximating union `uv_batch` takes, for the same reason.
+    let (mut lo, mut hi) = ([f32::MAX; 3], [f32::MIN; 3]);
+    let mut delta = 0.0f32;
+    for slot in 0..slots {
+        let period = tint_period(sub, slot);
+        for i in 0..FX_ANIM_SAMPLES {
+            let t = period * i as f32 / (FX_ANIM_SAMPLES - 1) as f32;
+            let c = tint_state(sub, slot, t);
+            for k in 0..3 {
+                lo[k] = lo[k].min(c[k]);
+                hi[k] = hi[k].max(c[k]);
+                delta = delta.max((c[k] - seed[k]).abs());
+            }
+        }
+    }
+    let (ls, llo, lhi) = (luma(seed), luma(lo), luma(hi));
+    let class = if ls < 0.02 && lhi >= 0.05 {
+        TintClass::Black
+    } else if delta >= 0.25 {
+        TintClass::Strong
+    } else if delta >= 0.05 {
+        TintClass::Slight
+    } else {
+        TintClass::Negligible
+    };
+    let live_shared =
+        !sub.rgb_seq.is_some() && sub.rgb_anim.as_ref().is_some_and(|a| a.period > 0.0);
+    let mut lines = Vec::new();
+    lines.push(format!(
+        "  batch {bi:>3}  {:?}{}  {} verts  {slots} slot(s)",
+        sub.blend,
+        if sub.additive { " additive" } else { "" },
+        sub.positions.len(),
+    ));
+    lines.push(format!(
+        "      seed   [{:.3},{:.3},{:.3}] luma {ls:.3}   {}",
+        seed[0],
+        seed[1],
+        seed[2],
+        if seed_is_white {
+            "WHITE — no slot-0 bake, so the shared material seeds the IDENTITY while a later slot tints"
+        } else {
+            "the shared loop's first key (`model_material`'s `tint.xyz`)"
+        },
+    ));
+    lines.push(format!(
+        "      loop   r[{:+.3}..{:+.3}] g[{:+.3}..{:+.3}] b[{:+.3}..{:+.3}]  luma [{llo:.3}..{lhi:.3}]  \
+         over {} sample(s) x {slots} slot(s)",
+        lo[0], hi[0], lo[1], hi[1], lo[2], hi[2], FX_ANIM_SAMPLES,
+    ));
+    lines.push(format!(
+        "      frozen worst per-channel delta {delta:.3}  => {}",
+        class.label(),
+    ));
+    TintBatch {
+        class,
+        seed,
+        seed_is_white,
+        delta,
+        per_seq: sub.rgb_seq.is_some(),
+        live_shared,
+        lines,
+    }
+}
+
+/// One classified entity tint batch — the row the listings and the population tail are built from.
+struct TintHit {
+    key: String,
+    batch: usize,
+    class: TintClass,
+    clock: UvClock,
+    /// The colour the material is frozen at — printed in the listings, because "which wrong
+    /// colour" is the whole content of a tint bug.
+    seed: [f32; 3],
+    /// **Is the freeze visible at REST?** True when file sequence slot 0 — the band a resting
+    /// instance plays — carries a live loop. False means the seed is the right colour in every
+    /// state but the ones a later slot keys, so the batch is wrong only *while that animation
+    /// plays*. Four of this corpus's five are that second shape, and reporting them as flatly
+    /// broken would overstate the hole.
+    rest_wrong: bool,
+    seed_is_white: bool,
+    delta: f32,
+    per_seq: bool,
+    live_shared: bool,
+}
diff --git a/crates/benilla-formats/src/bin/benilla-extract/scan/mod.rs b/crates/benilla-formats/src/bin/benilla-extract/scan/mod.rs
index 7de3672e..8b284b47 100644
--- a/crates/benilla-formats/src/bin/benilla-extract/scan/mod.rs
+++ b/crates/benilla-formats/src/bin/benilla-extract/scan/mod.rs
@@ -8,7 +8,9 @@
 //! - [`lighting`] — what lights a model: the WMO prop lanes, M2 light blocks, terrain shadow.
 //! - [`geometry`] — what geometry a model draws: billboards, geosets, flat ground quads.
 //! - [`material`] — how a batch is textured and blended: blend modes, UV wrap, env stages,
-//!   the batches whose UV/tint loop differs between sequence slots.
+//!   the batches whose UV/tint loop differs between sequence slots, and what the spell-effect
+//!   (`fxuvscan`) and unit/GameObject/held-item (`entityuvscan`) corpora's animated texture
+//!   transforms render for a consumer that runs none of them.
 //! - [`particles`] — particle and ribbon emitters, and the features the corpus authors.
 //! - [`skeleton`] — the bone tree and the attachment table that addresses it.
 //! - [`sequence`] — which sequence an arm plays, what breaks when it is the wrong one, and
@@ -31,7 +33,9 @@ mod world;
 
 pub use geometry::{animboundscan, bbfacescan, bbscan, geosetscan, groundscan, normalscan};
 pub use lighting::{darkpropscan, m2firescan, m2lightscan, shadeat, wmolamps, wmolights};
-pub use material::{alphascan, blendscan, envmapscan, texmodescan, uvslotscan, uvwrapscan};
+pub use material::{
+    alphascan, blendscan, entityuvscan, envmapscan, fxuvscan, texmodescan, uvslotscan, uvwrapscan,
+};
 pub use particles::{
     cellscan, fxordercensus, partcensus, partscan, partslotscan, ribbonscan, shardcensus,
 };
diff --git a/crates/benilla-formats/src/characters/customization.rs b/crates/benilla-formats/src/characters/customization.rs
index e09e9056..8a067c64 100644
--- a/crates/benilla-formats/src/characters/customization.rs
+++ b/crates/benilla-formats/src/characters/customization.rs
@@ -563,7 +563,6 @@ mod tests {
     /// vmangos's `Player::ValidateAppearance`, transcribed verbatim (`Player.cpp:326`): the exact
     /// predicate the server runs on `CMSG_CHAR_CREATE`. `GetCharSectionEntry` is an available-row
     /// lookup (`avail` already excludes the `0x1`-flagged rows), and face is keyed by *skinColor*.
-    #[allow(clippy::too_many_arguments)] // mirrors vmangos's 7-param signature + the two data tables
     fn validate_appearance(
         avail: &HashSet<SectionKey>,
         facial: &HashMap<(u8, u8), HashSet<u8>>,
diff --git a/crates/benilla-formats/src/characters/sections.rs b/crates/benilla-formats/src/characters/sections.rs
index d8eaf0a7..ad251850 100644
--- a/crates/benilla-formats/src/characters/sections.rs
+++ b/crates/benilla-formats/src/characters/sections.rs
@@ -244,7 +244,6 @@ impl CharSections {
     ///
     /// `emblem` is the wearer's guild tabard (decision 1704), which paints the torso layers' cells
     /// 2/3/4 over the garment's own — see [`equip_blits`] for when it installs and when it does not.
-    #[allow(clippy::too_many_arguments)]
     pub fn composite_body(
         &self,
         chain: &mut Chain,
diff --git a/crates/benilla-formats/src/chr_classes.rs b/crates/benilla-formats/src/chr_classes.rs
index 90efa899..a9f738b2 100644
--- a/crates/benilla-formats/src/chr_classes.rs
+++ b/crates/benilla-formats/src/chr_classes.rs
@@ -1,8 +1,10 @@
-//! `ChrClasses.dbc` — the per-class client table, and the two columns anything here reads off it.
+//! `ChrClasses.dbc` — the per-class client table, and the three columns anything here reads off
+//! it.
 //!
-//! One file, one parse. Both columns are answers the *engine* gives Lua about a class, and both
-//! are read by address off the same class-indexed record table at `ds:0xc0def4`, bounded by the
-//! max id at `ds:0xc0def8` (store `0xc0deec`, loader `0x542360`, filename `0x85838c`).
+//! One file, one parse. Two of the three are answers the *engine* gives Lua about a class and the
+//! third is the talent spell-modifier gate's right-hand side; all three are read by address off
+//! the same class-indexed record table at `ds:0xc0def4`, bounded by the max id at `ds:0xc0def8`
+//! (store `0xc0deec`, loader `0x542360`, filename `0x85838c`).
 //!
 //! ## Field 4 — the pet name token
 //!
@@ -56,6 +58,22 @@
 //! requires `(InventoryType == 28 RELIC) == hasRelicSlot`, so **INVSLOT 17 takes a relic for those
 //! three classes and a ranged weapon for everyone else** — one slot, two meanings. 1.12 has no
 //! *separate* relic slot, which is the one true fragment inside the old belief.
+//!
+//! ## Field 15 — the class's spell family
+//!
+//! `GetSpellModifiers 0x6e6b30`'s second gate: a talent modifier applies to a spell only when that
+//! spell's own `SpellFamilyName` (`Spell.dbc` column 160) equals the LOCAL PLAYER's class family,
+//! which the client caches in the global `[0xcecaac]`. That global has exactly one
+//! non-zeroing writer, `0x6e6ca0` (sole caller `0x5debcc`, the local-player create-finalise): it
+//! takes `UNIT_FIELD_BYTES_0` byte 1 — the class, the same walk both sections above make — and
+//! stores `ChrClasses[class] + 0x3c`, i.e. **field 15** (wow-re
+//! `system/spell/scratch/spellmod-table-law.md` §8).
+//!
+//! Anchored on the shipped 5875 file, which is also a could-have-failed control on the column: the
+//! nine rows read Warrior 4, Paladin 10, Hunter 9, Rogue 8, Priest 6, Shaman 11, Mage 3, Warlock 5,
+//! Druid 7 — the vmangos `SpellFamilyNames` values exactly, in an order no neighbouring column
+//! could reproduce (field 14 is a name-flags word reading 8323199 on every row, field 16 is the
+//! relic flag above).
 
 use std::collections::HashMap;
 
@@ -79,6 +97,10 @@ const PET_NAME_TOKEN_FIELD: usize = 0x10 / 4;
 /// The relic-slot column — byte `0x40` in `UnitHasRelicSlot`'s read, i.e. field 16.
 const RELIC_SLOT_FIELD: usize = 0x40 / 4;
 
+/// The class spell-family column — byte `0x3c` in `0x6e6ca0`'s read, i.e. field 15. See the module
+/// header for the walk and the shipped-file anchor.
+const SPELL_FAMILY_FIELD: usize = 0x3c / 4;
+
 /// The literal the client pushes when the player object does not resolve (`0x846a40`). Also the
 /// value nine of the ten class rows carry, which is why an unloaded table degrades invisibly.
 pub const PET_NAME_TOKEN_FALLBACK: &str = "PET";
@@ -88,6 +110,7 @@ pub const PET_NAME_TOKEN_FALLBACK: &str = "PET";
 struct ChrClass {
     pet_name_token: Option<String>,
     has_relic_slot: bool,
+    spell_family: u32,
 }
 
 /// `ChrClasses.dbc` → class id ⇒ the columns we read.
@@ -114,6 +137,17 @@ impl ChrClasses {
         self.0.get(&class).is_some_and(|c| c.has_relic_slot)
     }
 
+    /// The class's spell family — the value the reference caches in `[0xcecaac]` and compares
+    /// every spell's `SpellFamilyName` against before any talent modifier may apply.
+    ///
+    /// A class with no row answers `0`, which is the reference's own degraded state: `0x6e7150`
+    /// zeroes the global at world-enter (`6e7317`, `esi = 0`) and it stays 0 until the local
+    /// player resolves — and `GetSpellModifiers`' first conjunct (`SpellFamilyName != 0`) exists
+    /// precisely so nothing matches during that window.
+    pub fn spell_family(&self, class: u32) -> u32 {
+        self.0.get(&class).map_or(0, |c| c.spell_family)
+    }
+
     pub fn is_empty(&self) -> bool {
         self.0.is_empty()
     }
@@ -148,6 +182,7 @@ pub fn load_chr_classes(chain: &mut Chain) -> Result<ChrClasses> {
             ChrClass {
                 pet_name_token: str_at(&rs, r, PET_NAME_TOKEN_FIELD),
                 has_relic_slot: u32_at(r, RELIC_SLOT_FIELD).is_some_and(|v| v != 0),
+                spell_family: u32_at(r, SPELL_FAMILY_FIELD).unwrap_or(0),
             },
         );
     }
@@ -205,4 +240,30 @@ mod tests {
         assert!(!t.has_relic_slot(6));
         assert!(!t.has_relic_slot(0));
     }
+
+    /// Field 15, the spell-family gate's right-hand side. The whole column is asserted because
+    /// that is what makes it a column pin rather than a coincidence: nine distinct values in nine
+    /// rows, each matching the vmangos `SpellFamilyNames` enum, is a shape no neighbour has
+    /// (field 14 is 8323199 on every row, field 16 is the three-row relic flag).
+    #[test]
+    fn every_class_row_carries_its_vmangos_spell_family() {
+        let Some(mut chain) = chain() else { return };
+        let t = load_chr_classes(&mut chain).expect("load ChrClasses.dbc");
+        for (class, family, who) in [
+            (1u32, 4u32, "Warrior"),
+            (2, 10, "Paladin"),
+            (3, 9, "Hunter"),
+            (4, 8, "Rogue"),
+            (5, 6, "Priest"),
+            (7, 11, "Shaman"),
+            (8, 3, "Mage"),
+            (9, 5, "Warlock"),
+            (11, 7, "Druid"),
+        ] {
+            assert_eq!(t.spell_family(class), family, "{who}");
+        }
+        // No row: the reference's zeroed global, which conjunct 1 of the gate refuses.
+        assert_eq!(t.spell_family(6), 0);
+        assert_eq!(t.spell_family(0), 0);
+    }
 }
diff --git a/crates/benilla-formats/src/item_sounds.rs b/crates/benilla-formats/src/item_sounds.rs
index 72232a4a..65a2cd15 100644
--- a/crates/benilla-formats/src/item_sounds.rs
+++ b/crates/benilla-formats/src/item_sounds.rs
@@ -113,7 +113,7 @@ mod tests {
         let displays = crate::load_item_display_catalog(&mut chain).expect("load ItemDisplayInfo");
         let mut nonzero = 0usize;
         let mut valid = 0usize;
-        for d in displays.iter() {
+        for (_, d) in displays.iter() {
             if d.group_sounds != 0 {
                 nonzero += 1;
                 if sounds.groups.contains_key(&d.group_sounds) {
diff --git a/crates/benilla-formats/src/item_visuals.rs b/crates/benilla-formats/src/item_visuals.rs
index b936e79b..2fa803e8 100644
--- a/crates/benilla-formats/src/item_visuals.rs
+++ b/crates/benilla-formats/src/item_visuals.rs
@@ -387,7 +387,7 @@ mod tests {
         let displays = crate::load_item_display_catalog(&mut chain).expect("load ItemDisplayInfo");
 
         let (mut carried, mut minus_one, mut resolved, mut models) = (0, 0, 0, 0);
-        for d in displays.iter() {
+        for (_, d) in displays.iter() {
             if d.item_visual == 0 {
                 continue;
             }
diff --git a/crates/benilla-formats/src/items.rs b/crates/benilla-formats/src/items.rs
index 8276d784..8762a1a1 100644
--- a/crates/benilla-formats/src/items.rs
+++ b/crates/benilla-formats/src/items.rs
@@ -164,9 +164,12 @@ impl ItemDisplayCatalog {
         self.displays.is_empty()
     }
 
-    /// Iterate the rows (order unspecified) — the cross-DBC join checks use it.
-    pub fn iter(&self) -> impl Iterator<Item = &ItemDisplay> {
-        self.displays.values()
+    /// Iterate `(displayId, row)` (order unspecified) — the cross-DBC join checks use it, and so
+    /// does the corpus sweep that has to name *which* display reaches a model
+    /// (`benilla-extract entityuvscan`). The id is carried because a census that cannot join back
+    /// to a row id answers "how many" and never "which one".
+    pub fn iter(&self) -> impl Iterator<Item = (u32, &ItemDisplay)> {
+        self.displays.iter().map(|(&id, d)| (id, d))
     }
 }
 
diff --git a/crates/benilla-formats/src/itemsubclass.rs b/crates/benilla-formats/src/itemsubclass.rs
index 88fef633..fbb32b4b 100644
--- a/crates/benilla-formats/src/itemsubclass.rs
+++ b/crates/benilla-formats/src/itemsubclass.rs
@@ -385,6 +385,28 @@ mod tests {
             Some("Fist Weapon")
         );
 
+        // Class 6 PROJECTILE — the lookup the cast-fail `0x31` NEED_EXOTIC_AMMO arm makes
+        // (`0x6e1e5e: mov ecx,0x6`, mask `1 << arg`), so "Requires exotic ammo: %s" names the
+        // ammo type. Only two of the five shipped rows are live in 1.12; the other three carry
+        // an `(OBSOLETE)` suffix in the data itself, and one is pinned below so a schema slip
+        // that silently shifted the class would be visible rather than merely returning `None`.
+        assert_eq!(
+            cat.requirement_display_name(6, 1 << 2).as_deref(),
+            Some("Arrow")
+        );
+        assert_eq!(
+            cat.requirement_display_name(6, 1 << 3).as_deref(),
+            Some("Bullet")
+        );
+        assert_eq!(
+            cat.requirement_display_name(6, 1 << 4).as_deref(),
+            Some("Thrown(OBSOLETE)")
+        );
+        // Past the shipped rows — the arm's own decline (`0x6e1e6a: je 0x6e21d8`, the shared
+        // default), which is where an absent or wild wire word lands.
+        assert_eq!(cat.requirement_display_name(6, 1 << 5), None);
+        assert_eq!(cat.requirement_display_name(6, 1 << 31), None);
+
         // Nothing to name.
         assert_eq!(cat.requirement_name(2, 0), None);
         assert_eq!(cat.requirement_name(99, 1), None);
diff --git a/crates/benilla-formats/src/lib.rs b/crates/benilla-formats/src/lib.rs
index bddae89d..153c527f 100644
--- a/crates/benilla-formats/src/lib.rs
+++ b/crates/benilla-formats/src/lib.rs
@@ -203,7 +203,8 @@ pub use spells::{
     ATTR_ONLY_STEALTHED, COMBAT_REACH_ADD, MELEE_RANGE_FLOOR, ON_NEXT_SWING_RANGE,
     SPELL_ATTR_IS_TRADESKILL, SPELL_EFFECT_CREATE_ITEM, SPELL_EFFECT_ENCHANT_ITEM,
     SPELL_EFFECT_ENCHANT_ITEM_TEMPORARY, SPELL_EFFECT_LEARN_PET_SPELL, SPELL_EFFECT_LEARN_SPELL,
-    SPELL_EFFECT_SKILL_STEP, SPELL_EFFECT_SKINNING, SPELL_EFFECT_TRADE_SKILL,
+    SPELL_EFFECT_PROSPECTING, SPELL_EFFECT_SKILL_STEP, SPELL_EFFECT_SKINNING,
+    SPELL_EFFECT_TRADE_SKILL,
 };
 mod skill_lines;
 pub use skill_lines::{
@@ -861,7 +862,6 @@ mod tests {
 
     /// A minimal, complete BLP2 header (magic..=mip_sizes[16], 148 bytes) — mirrors the private
     /// builder in `benilla_blp`'s own tests (that crate's helper isn't exported).
-    #[allow(clippy::too_many_arguments)]
     fn blp2_header(
         compression: u8,
         alpha_bits: u8,
diff --git a/crates/benilla-formats/src/light.rs b/crates/benilla-formats/src/light.rs
index bd9b4c89..abc5df50 100644
--- a/crates/benilla-formats/src/light.rs
+++ b/crates/benilla-formats/src/light.rs
@@ -584,7 +584,6 @@ impl LightCatalog {
     /// (`1` inside `falloffStart`, ramping to `0` at `falloffEnd`). Contrast with [`pick_light`], which
     /// picks just the single most-local sphere — this tells us whether a faithful blend resolves a
     /// **different** (e.g. redder) light at our spot than the single-sample approximation.
-    #[allow(clippy::too_many_arguments)]
     pub fn sample_blended(
         &self,
         map: u32,
diff --git a/crates/benilla-formats/src/models/mat_anim.rs b/crates/benilla-formats/src/models/mat_anim.rs
index 739d911e..de14e816 100644
--- a/crates/benilla-formats/src/models/mat_anim.rs
+++ b/crates/benilla-formats/src/models/mat_anim.rs
@@ -115,6 +115,15 @@ impl AlphaAnim {
         self.seq(seq).sample(elapsed, shared_now)
     }
 
+    /// Every file sequence slot's pair, file order — the census instrument's read
+    /// (`benilla-extract entityuvscan`), the twin of [`SeqLoops::slots`] and there for the same
+    /// reason: an instrument that re-implements the per-slot walk can drift from the one the
+    /// runtime takes. Without it a sweep cannot even tell how many slots a batch was baked across,
+    /// because [`Self::seq`] degrades an out-of-range slot to slot 0 rather than refusing it.
+    pub fn slots(&self) -> &[AlphaSeq] {
+        &self.per_seq
+    }
+
     /// Whether ANY sequence can drive this batch's alpha to zero — i.e. whether the batch is ever
     /// culled. The spawn-side gate for "does this part need a live sampler at all".
     pub fn ever_hides(&self) -> bool {
diff --git a/crates/benilla-formats/src/sound_entries.rs b/crates/benilla-formats/src/sound_entries.rs
index 1c0dc6b8..2a4f704d 100644
--- a/crates/benilla-formats/src/sound_entries.rs
+++ b/crates/benilla-formats/src/sound_entries.rs
@@ -122,6 +122,37 @@ fn sound_entries_schema() -> Schema {
     s
 }
 
+/// Join one variation's `DirectoryBase` and `File[i]` into the path the archive is asked for —
+/// **the reference's own rule, byte-for-byte** (`0x45be10`, the sole caller `0x45c167` inside the
+/// `SOUNDDEFINITION` loader; wow-re `sound/scratch/soundentries-path-join.md`).
+///
+/// The client formats `"%s%s%s"` over `(dir, sep, file)` and chooses `sep` with exactly two tests:
+/// it is the empty string when `DirectoryBase` is **NULL/empty**, and when `SStrChrR(dir, '\')`
+/// says the directory **already ends in a separator**; otherwise it is `"\"`. That is the whole
+/// normalization in the client, at this layer or any other — and it has to be spelled here,
+/// because the archive layer below rescues nothing: `HashString` folds ASCII `a`–`z` to upper and
+/// maps `/` → `\` per character into the hash, and does **not** strip a leading separator, collapse
+/// a doubled one, or touch a trailing one (wow-re `mpq.md`, an evidenced absence — the hash loop
+/// read end to end). There is no loose-file fallback either: `SFileOpenFileEx`'s disk diversion
+/// takes `\\`, `X:` and a flag WoW's own startup clears, never a single leading `\`.
+///
+/// **27 of the 5875 data's 8961 variations do not resolve, and the reference cannot play them
+/// either** — 17 are simply absent from the archives (`GhostMusic01/02`, `mOgreFidget3`, and ids
+/// 195/196, where `mHumanFemaleWoundVoxA.wav` was authored across two `File` cells as
+/// `mHumanFemaleWoundVoxA` and `wav`), and the other 10 are kit **8940 `Ashbringer`**, whose
+/// `DirectoryBase` is `\Sound\Creature\Ashbringer\`: the client suppresses the *trailing*
+/// separator and then emits the *leading* one verbatim, so the path it opens
+/// (`\Sound\Creature\Ashbringer\ASH_SPEAK_01.wav`) misses in every archive although the asset is
+/// there. The Ashbringer's speak lines are dead data in the real client, and are meant to stay
+/// dead here: a leading-separator strip would be a deviation, not a fix.
+fn join_variation(dir: &str, file: &str) -> String {
+    if dir.is_empty() || dir.ends_with('\\') {
+        format!("{dir}{file}")
+    } else {
+        format!("{dir}\\{file}")
+    }
+}
+
 /// Read SoundEntries.dbc off the patch chain into a [`SoundKitCatalog`].
 pub fn load_sound_kit_catalog(chain: &mut Chain) -> Result<SoundKitCatalog> {
     let bytes = chain
@@ -140,11 +171,7 @@ pub fn load_sound_kit_catalog(chain: &mut Chain) -> Result<SoundKitCatalog> {
                 continue;
             };
             let weight = u32_at(r, 13 + i).unwrap_or(0);
-            let path = if dir.is_empty() {
-                file
-            } else {
-                format!("{dir}\\{file}")
-            };
+            let path = join_variation(&dir, &file);
             files.push((path, weight));
         }
         if !name.is_empty() {
@@ -253,4 +280,93 @@ mod tests {
             "creature barks split wet/dry"
         );
     }
+
+    /// The join's three legs, in the reference's own order (`0x45be10`): an empty directory emits
+    /// the file verbatim (26 shipped rows, e.g. 1103 `WyvernWingFlap`, whose variations are
+    /// themselves full paths), a directory that already ends in a separator gets none added, and
+    /// everything else gets exactly one. A **leading** separator is carried through untouched —
+    /// the client normalizes nothing there, and neither do we.
+    #[test]
+    fn the_variation_join_is_the_reference_s_separator_rule() {
+        assert_eq!(
+            join_variation("Sound\\Spells", "Dispel_Low_Base.wav"),
+            "Sound\\Spells\\Dispel_Low_Base.wav"
+        );
+        assert_eq!(
+            join_variation("Sound\\interface\\", "igNewTaxiNodeDiscovered.wav"),
+            "Sound\\interface\\igNewTaxiNodeDiscovered.wav"
+        );
+        assert_eq!(
+            join_variation("", "Sound\\Creature\\Wyvern\\WyvernWingFlap1.wav"),
+            "Sound\\Creature\\Wyvern\\WyvernWingFlap1.wav"
+        );
+        assert_eq!(
+            join_variation("\\Sound\\Creature\\Ashbringer\\", "ASH_SPEAK_01.wav"),
+            "\\Sound\\Creature\\Ashbringer\\ASH_SPEAK_01.wav",
+            "the leading separator survives — the reference emits it and misses too"
+        );
+    }
+
+    /// **Every kit path this loader builds, asked of the real chain.** The numbers are the
+    /// reference's own: the binary's join resolves 8934 of 8961 variations, and the 27 it does not
+    /// are authentic dead data. An unconditional `format!("{dir}\\{file}")` — what this loader did
+    /// before the join was derived — resolves exactly three fewer, and those three are whole kits:
+    /// 1519 `TaxiNodeDiscovered`, 2988 `Unarmed Small`, 3412 `Pirate Agro` each carry one variation
+    /// and a `DirectoryBase` that already ends in a separator, so every one of them was silent.
+    ///
+    /// The test pins both sides — what resolves and what is *meant* not to — so neither a
+    /// regression nor an over-eager "fix" of the Ashbringer can land quietly. Skips without client
+    /// data.
+    #[test]
+    fn real_sound_entries_paths_resolve_exactly_as_the_reference_s_do() {
+        let data = crate::wow_data_or_skip!();
+        let mut chain = crate::open_chain(&data).expect("open chain");
+        let cat = load_sound_kit_catalog(&mut chain).expect("load sound kits");
+
+        let mut total = 0usize;
+        let mut dead: Vec<(u32, &str, &str)> = Vec::new();
+        for kit in cat.kits.values() {
+            for (path, _) in &kit.files {
+                total += 1;
+                if !chain.contains(path) {
+                    dead.push((kit.id, &kit.name, path));
+                }
+            }
+        }
+        dead.sort_unstable();
+        assert_eq!(total, 8961, "non-empty variation cells in the 5875 table");
+        assert_eq!(
+            total - dead.len(),
+            8934,
+            "variations that resolve — the binary's own count; {dead:?}"
+        );
+
+        // The ten that are one kit, and the one kit that is therefore silent — in the reference
+        // too (its `DirectoryBase` opens with a separator the client passes straight through).
+        let ashbringer: Vec<_> = dead.iter().filter(|(id, ..)| *id == 8940).collect();
+        assert_eq!(ashbringer.len(), 10, "every ASH_SPEAK line misses");
+        assert!(
+            chain.contains("Sound\\Creature\\Ashbringer\\ASH_SPEAK_01.wav"),
+            "the asset ships — it is the authored path that cannot reach it"
+        );
+
+        // …and the other 17 are ordinary absent assets, spread across kits that mostly still play.
+        assert_eq!(dead.len() - ashbringer.len(), 17, "absent assets: {dead:?}");
+
+        // No OTHER kit is fully silent through a path benilla built. 8588 is, and is meant to be:
+        // its single variation is simply not in the archives.
+        let silent: Vec<u32> = cat
+            .kits
+            .values()
+            .filter(|k| !k.files.is_empty() && !k.files.iter().any(|(p, _)| chain.contains(p)))
+            .map(|k| k.id)
+            .collect();
+        let mut silent = silent;
+        silent.sort_unstable();
+        assert_eq!(
+            silent,
+            vec![8588, 8940],
+            "the only kits with no playable variation at all"
+        );
+    }
 }
diff --git a/crates/benilla-formats/src/spell_visual/tests.rs b/crates/benilla-formats/src/spell_visual/tests.rs
index b2042096..ddd377ef 100644
--- a/crates/benilla-formats/src/spell_visual/tests.rs
+++ b/crates/benilla-formats/src/spell_visual/tests.rs
@@ -27,7 +27,6 @@ fn u32le(v: u32) -> [u8; 4] {
 
 /// One `SpellVisual` row: id, the five stage kits, then the missile block — field 7 (model
 /// effect id) and field 9 (dest-attach ordinal) live, the rest zeroed to fill 16 fields.
-#[allow(clippy::too_many_arguments)]
 fn spell_visual_row(
     id: u32,
     precast: u32,
diff --git a/crates/benilla-formats/src/spells/catalog_tests.rs b/crates/benilla-formats/src/spells/catalog_tests.rs
index c9ada524..3b6fed88 100644
--- a/crates/benilla-formats/src/spells/catalog_tests.rs
+++ b/crates/benilla-formats/src/spells/catalog_tests.rs
@@ -1038,6 +1038,47 @@ fn real_main_hand_autopick_family() {
     assert_eq!(wf_totem.targets, 0, "a totem summon binds nothing");
 }
 
+/// **The prospecting leg of `0x495d60` is dead on 5875 data** — the fact two cast-failure
+/// argument arms rest on not being written (decision 2292). That validator's effect loop has a
+/// third leg past the two enchant ones: `0x495df1 jne 0x495f36` falls into
+/// `0x495f39 cmp DWORD PTR [eax],0x7f`, and inside it sit the only image-wide raises of
+/// `SPELL_FAILED_PROSPECT_NEED_MORE` (`0x49614e`) and `SPELL_FAILED_MIN_SKILL` (`0x496128`).
+/// vmangos sends neither reason from anywhere, so if no shipped spell carries
+/// [`SPELL_EFFECT_PROSPECTING`] there is no route to either message at all — and none does.
+///
+/// This lives in the formats crate rather than beside the arms because it is a claim about the
+/// **data**: if a data set ever ships a prospecting spell, this fails and names the two arms that
+/// just came alive. Skips without client data.
+#[test]
+fn real_prospecting_effect_is_absent_from_5875() {
+    let data = crate::wow_data_or_skip!();
+    let mut chain = crate::open_chain(&data).expect("open chain");
+    let raw = chain.read_file(SPELL).expect("Spell.dbc");
+    let set = parse(&raw, spell_schema(), "Spell.dbc").expect("parse Spell.dbc");
+
+    let mut slots = 0usize;
+    for r in set.records() {
+        for i in 0..3 {
+            slots += 1;
+            assert_ne!(
+                u32_at(r, COL_EFFECT_1 + i).unwrap_or(0),
+                crate::SPELL_EFFECT_PROSPECTING,
+                "spell {} carries SPELL_EFFECT_PROSPECTING in effect slot {i} — `0x495d60`'s \
+                 third leg is reachable now, so cast-fail reasons 0x84 PROSPECT_NEED_MORE and \
+                 0x90 MIN_SKILL can raise and `ui_action::cast_fail` owes them argument arms \
+                 (decision 2292)",
+                u32_at(r, 0).unwrap_or(0)
+            );
+        }
+    }
+    // The scan covering nothing would pass just as quietly, so pin the shape of the file too.
+    assert_eq!(
+        slots,
+        22357 * 3,
+        "every effect slot of every 5875 row was read"
+    );
+}
+
 /// The item-target family and its gate columns (decision 0923), against the real 5875 file. The
 /// reference's `TargetingWantsItem 0x6e6330` is `flag_word & 0x4010`, and on shipped data those
 /// two bits are **never** mixed with a unit bit — the whole family is `Targets` exactly `0x10`
@@ -1437,3 +1478,149 @@ fn real_is_harmful_pins() {
         );
     }
 }
+
+/// **The channel bar's naming law on the real build-5875 `Spell.dbc`** (decision 2284) — the two
+/// bits `SpellChannelStart 0x6e7550` tests, and the population that makes the default the
+/// interesting half.
+///
+/// The cast bar names its spell unless a bit forbids it; the channel bar says "Channeling" unless
+/// a bit permits it. Exactly **9** of the 323 channeled rows permit it and **2** suppress the bar
+/// outright, so "Channeling" is what a player sees for essentially every channel in the game.
+/// A column slip, or a bit read off the wrong `AttributesEx*`, fails here. Skips without client
+/// data.
+#[test]
+fn real_channel_bar_name_law() {
+    let data = crate::wow_data_or_skip!();
+    let mut chain = crate::open_chain(&data).expect("open chain");
+    let cat = load_spell_catalog(&mut chain).expect("load Spell/SpellIcon");
+
+    // The generic leg — every rank of Blizzard, plus the other channels a player meets daily.
+    // These are the rows that read the literal word, and Blizzard is the one that prompted 2284.
+    for id in [
+        10u32, 6141, 8427, 10185, 10186, 10187, // Blizzard, all six ranks
+        5143,  // Arcane Missiles
+        15407, // Mind Flay
+        689,   // Drain Life
+        5740,  // Rain of Fire
+    ] {
+        let d = cat.get(id).unwrap_or_else(|| panic!("spell {id}"));
+        assert!(
+            !d.channel_bar_own_name(),
+            "{id} {:?} reads \"Channeling\", not its own name (AttributesEx {:#010x})",
+            d.name,
+            d.attributes_ex
+        );
+        assert!(!d.no_channel_bar(), "{id} {:?} still shows a bar", d.name);
+    }
+
+    // The named leg — the sharpest control wow-re names: Fishing and Mind Flay take opposite
+    // legs of the same `0x6e75a1`, and vanilla really does print one name and one generic word.
+    for (id, name) in [
+        (7620u32, "Fishing"),
+        (18248, "Fishing"),
+        (20578, "Cannibalize"),
+    ] {
+        let d = cat.get(id).unwrap_or_else(|| panic!("spell {id}"));
+        assert!(d.channel_bar_own_name(), "{id} names itself on the bar");
+        assert_eq!(d.name, name);
+    }
+
+    // The suppressor — a total one, and the only two rows that carry it.
+    for id in [24322u32, 24323] {
+        assert!(
+            cat.get(id).expect("Blood Siphon").no_channel_bar(),
+            "{id} Blood Siphon shows no channel bar at all"
+        );
+    }
+
+    // The population, which is the law's real shape: the opt-ins are a rounding error.
+    let channeled: Vec<_> = cat.iter().filter(|(_, d)| d.tooltip_channeled()).collect();
+    assert_eq!(channeled.len(), 323, "channeled rows in the shipped file");
+    assert_eq!(
+        channeled
+            .iter()
+            .filter(|(_, d)| d.channel_bar_own_name())
+            .count(),
+        9,
+        "only nine channeled rows print their own name"
+    );
+    assert_eq!(
+        channeled.iter().filter(|(_, d)| d.no_channel_bar()).count(),
+        2,
+        "only the two Blood Siphons suppress the bar"
+    );
+}
+
+/// The talent spell-modifier gate's two columns — `SpellFamilyName` 160 and the `SpellFamilyFlags`
+/// pair 161/162 — against the shipped 5875 `Spell.dbc`.
+///
+/// Three things are asserted, and each would catch a different slip. The **family histogram** is
+/// the column pin: the eleven nonzero values are exactly the vmangos `SpellFamilyNames` set, and
+/// their counts are the shipped file's own (a one-column slip lands on 159/163, neither of which
+/// looks like this). The **popcount census** is what makes the reader's 64-iteration walk
+/// load-bearing rather than defensive — 322 rows set more than one bit, and the highest index in
+/// the whole table is 35, so the HIGH dword is live. The **three worked spells** pin the join
+/// direction: 4987 sets 12 and 33, which a low-dword-only read or a swapped pair both get wrong.
+///
+/// Numbers from wow-re `system/spell/scratch/spellmod-table-law.md` (Provenance), re-measured here
+/// off the file this catalog actually loads. Skips without client data.
+#[test]
+fn real_spell_family_columns_carry_the_modifier_gate() {
+    let data = crate::wow_data_or_skip!();
+    let mut chain = crate::open_chain(&data).expect("open chain");
+    let cat = load_spell_catalog(&mut chain).expect("load Spell/SpellIcon");
+
+    let mut families: std::collections::BTreeMap<u32, usize> = std::collections::BTreeMap::new();
+    let mut popcounts: std::collections::BTreeMap<u32, usize> = std::collections::BTreeMap::new();
+    let mut max_bit = 0u32;
+    for (_, d) in cat.iter() {
+        *families.entry(d.spell_family).or_default() += 1;
+        *popcounts
+            .entry(d.spell_family_flags.count_ones())
+            .or_default() += 1;
+        if d.spell_family_flags != 0 {
+            max_bit = max_bit.max(63 - d.spell_family_flags.leading_zeros());
+        }
+    }
+    assert_eq!(
+        families,
+        [
+            (0, 18243),
+            (1, 47),
+            (3, 563),
+            (4, 350),
+            (5, 466),
+            (6, 493),
+            (7, 450),
+            (8, 316),
+            (9, 393),
+            (10, 362),
+            (11, 500),
+            (13, 174),
+        ]
+        .into_iter()
+        .collect::<std::collections::BTreeMap<u32, usize>>(),
+        "SpellFamilyName histogram — the vmangos SpellFamilyNames set, and only it"
+    );
+    assert_eq!(
+        popcounts.values().skip(1).sum::<usize>() - popcounts[&1],
+        322,
+        "rows setting MORE than one family bit — the reader's sum is live"
+    );
+    assert_eq!(max_bit, 35, "the highest family bit index in the file");
+
+    // The three worked examples. Frostbolt spans one dword, Cleanse spans BOTH, Cure Poison lives
+    // entirely in the high one.
+    for (id, family, bits) in [
+        (116u32, 3u32, &[5u32, 19, 20, 30][..]),
+        (4987, 10, &[12, 33]),
+        (526, 11, &[35]),
+    ] {
+        let d = cat.get(id).unwrap_or_else(|| panic!("spell {id}"));
+        assert_eq!(d.spell_family, family, "{id} {:?} family", d.name);
+        let set: Vec<u32> = (0..64)
+            .filter(|b| d.spell_family_flags >> b & 1 == 1)
+            .collect();
+        assert_eq!(set, bits, "{id} {:?} family bits", d.name);
+    }
+}
diff --git a/crates/benilla-formats/src/spells/display.rs b/crates/benilla-formats/src/spells/display.rs
index 9760ab6e..4e534b93 100644
--- a/crates/benilla-formats/src/spells/display.rs
+++ b/crates/benilla-formats/src/spells/display.rs
@@ -61,6 +61,26 @@ pub struct SpellDisplay {
     /// search's **hand restriction** (main-hand-only / off-hand-only), which is where
     /// `0x5f0c50`'s slot mask comes from (decision 1903).
     pub attributes_ex3: u32,
+    /// **`SpellFamilyName`** (column 160, `SpellRec+0x280`) — which class's talent tree may modify
+    /// this spell. `0` on 18243 of the 22357 shipped rows (creature and world spells); the rest
+    /// carry a `SpellFamilyNames` value, which for a player spell is its own class's.
+    ///
+    /// The first two of `GetSpellModifiers 0x6e6b30`'s three conjunct gates read it and nothing
+    /// else: `!= 0` (`6e6b38`), then `== [0xcecaac]`, the local player's own class family
+    /// (`6e6b46` — [`crate::ChrClasses::spell_family`]). A spell that fails either takes no
+    /// modifier at all, which is how a mage's talent stays off a warrior's ability and off every
+    /// item/creature spell in the file. wow-re `system/spell/scratch/spellmod-table-law.md` §5.1.
+    pub spell_family: u32,
+    /// **`SpellFamilyFlags`** (columns 161/162, `SpellRec+0x284`/`+0x288`) — the 64-bit bit-set
+    /// naming which of its family's modifier rows this spell subscribes to, low dword first.
+    ///
+    /// `GetSpellModifiers` walks **all 64 bits** with no early break and SUMS one cell per set bit
+    /// out of each table (`6e6b72`–`6e6ba6`), so a multi-bit spell accumulates several — and the
+    /// high dword is genuinely live rather than unused width: measured on the shipped 5875 file,
+    /// 1794 rows set exactly one bit, **322 set more than one**, and the highest bit index in the
+    /// whole table is **35**. Frostbolt 116 sets 5/19/20/30, Cleanse 4987 sets 12 **and 33** (it
+    /// needs both dwords), Cure Poison 526 sets 35 alone.
+    pub spell_family_flags: u64,
     /// **`PreventionType`** (column 165, `SpellRec+0x294`) — which crowd-control flag refuses this
     /// spell **locally**, before any packet: `1` = silence, `2` = pacify, `0` = neither. The
     /// client's CC validator `0x6094f0` (called from `TryCast 0x6e4b60`, bailing at `0x6e4f42`)
@@ -337,6 +357,8 @@ impl Default for SpellDisplay {
             attributes_ex2: 0,
             modal_next_spell: 0,
             attributes_ex3: 0,
+            spell_family: 0,
+            spell_family_flags: 0,
             prevention_type: 0,
             passive: false,
             cast_ui: 0,
@@ -567,6 +589,37 @@ impl SpellDisplay {
         self.attributes_ex3 & ATTR_EX3_NO_CASTING_BAR_TEXT != 0
     }
 
+    /// `AttributesEx3 & 0x2000` — **this spell shows no channel bar at all**
+    /// ([`ATTR_EX3_NO_CHANNEL_BAR`]). The channel handler `0x6e7550` tests it before it composes
+    /// anything (`0x6e7595 test ch,0x20` → `jne` the return), so `SPELLCAST_CHANNEL_START` never
+    /// fires and the frame is never shown.
+    ///
+    /// A **different** suppression from [`Self::no_casting_bar_text`]'s and a total one: that bit
+    /// blanks the cast bar's *label* and still draws the bar; this one removes the event. The two
+    /// live one nibble apart in the same column and are easy to conflate — the channel path never
+    /// reads bit 2 at all (`0x6e7a2d` is the only bit-2 test on `SpellRec+0x24` image-wide, wow-re
+    /// `wave-cast.md`'s twice-run census).
+    ///
+    /// Both shipped rows are 24322/24323 "Blood Siphon", the Hakkar encounter's drain.
+    pub fn no_channel_bar(&self) -> bool {
+        self.attributes_ex3 & ATTR_EX3_NO_CHANNEL_BAR != 0
+    }
+
+    /// `AttributesEx & 0x2000_0000` — **the channel bar prints this spell's own name**
+    /// ([`ATTR_EX_CHANNEL_BAR_OWN_NAME`]); cleared, it prints the GlobalStrings word `CHANNELING`.
+    /// `0x6e759a test DWORD PTR [SpellRec+0x1c],0x20000000` — set takes `Name[locale]`
+    /// (`0x6e75a9`), clear takes `FrameScript_GetText(0x870dd0 = "CHANNELING")` (`0x6e75bc`).
+    ///
+    /// This is the whole of the channel bar's naming law, and it is the reverse default of the
+    /// cast bar's: a cast bar names its spell unless told not to, a channel bar says "Channeling"
+    /// unless told to name it. Nine of the 323 channeled rows in the shipped 5875 file opt in —
+    /// the four Fishing ranks, Cannibalize, Dream Vision, Using Control Console and the two
+    /// (suppressed) Blood Siphons. Blizzard, Arcane Missiles, Mind Flay, Drain Life/Soul/Mana,
+    /// Rain of Fire, Hurricane, Tranquility, Evocation and First Aid all read the generic word.
+    pub fn channel_bar_own_name(&self) -> bool {
+        self.attributes_ex & ATTR_EX_CHANNEL_BAR_OWN_NAME != 0
+    }
+
     /// The ranged-shot cooldown pad's gate (`0x6e2b60` at `0x6e2c2c`–`0x6e2c47`, byte-verified —
     /// wow-re `ranged-cooldown-sweep.md`): on the caster's own SPELL_GO self-insert, a
     /// `Attributes & 0x2` spell WITHOUT `AttributesEx2 & 0x20000`
diff --git a/crates/benilla-formats/src/spells/mod.rs b/crates/benilla-formats/src/spells/mod.rs
index 9e9ea791..fe8055c3 100644
--- a/crates/benilla-formats/src/spells/mod.rs
+++ b/crates/benilla-formats/src/spells/mod.rs
@@ -210,6 +210,14 @@ const COL_START_RECOVERY_TIME: usize = 158;
 /// `PreventionType` (`SpellRec+0x294`, `0x294/4 == 165`) — see [`SpellDisplay::prevention_type`]
 /// for the two-way pin that separates it from its `DmgClass` neighbour at 164.
 const COL_PREVENTION_TYPE: usize = 165;
+/// `SpellFamilyName` (`SpellRec+0x280`, `0x280/4 == 160`) / `SpellFamilyFlags` low+high
+/// (`+0x284`/`+0x288`, 161/162) — the talent spell-modifier gate and its row selector, read by
+/// `GetSpellModifiers 0x6e6b30` at `6e6b38`/`6e6b46` and `6e6b83` (wow-re
+/// `system/spell/scratch/spellmod-table-law.md` §5). See [`SpellDisplay::spell_family`] and
+/// [`SpellDisplay::spell_family_flags`]; the shipped-file anchors are in
+/// [`catalog_tests`].
+const COL_SPELL_FAMILY_NAME: usize = 160;
+const COL_SPELL_FAMILY_FLAGS_LOW: usize = 161;
 /// `Targets` (`SpellRec+0x34`, `0x34/4 == 13`) — the wire `TARGET_FLAG_*` seed mask the cast-arm
 /// loads into its targeting flag_word (`0x6e525a`, wow-re `wave-cast.md`, VERIFIED). Empirical
 /// pin against the binder's bit semantics: Resurrection 2006 = `0x8000` (corpse-ally bit 15),
@@ -402,6 +410,20 @@ const ATTR_EX3_NORMAL_RANGED_ATTACK: u32 = 0x8000;
 /// to themselves about what this attribute does to the spell, and it reached a player's screen
 /// because we printed the name unconditionally.
 const ATTR_EX3_NO_CASTING_BAR_TEXT: u32 = 0x4;
+/// `AttributesEx3` bit 13 (`0x2000`) — **this spell shows no CHANNEL bar at all**. The channel
+/// handler's own suppressor, and a *total* one: `0x6e7595 test ch,0x20` on `[SpellRec+0x24]`
+/// (`ch` = bits 8-15, so bit 13 — not [`ATTR_EX3_NO_CASTING_BAR_TEXT`]'s bit 2) jumps straight to
+/// the return, so `SPELLCAST_CHANNEL_START` never fires. Exactly two rows in the shipped 5875 file
+/// carry it, both 24322/24323 "Blood Siphon".
+const ATTR_EX3_NO_CHANNEL_BAR: u32 = 0x2000;
+/// `AttributesEx` bit 29 (`0x2000_0000`) — **the channel bar prints this spell's own name**
+/// instead of the generic word. `0x6e759a test DWORD PTR [SpellRec+0x1c],0x20000000`: set ⇒
+/// `Name[locale]`, clear ⇒ the GlobalStrings value of `CHANNELING`. Nine of the 323 channeled rows
+/// in the shipped file set it — the four Fishing ranks (7620/7731/7732/18248), 20578 Cannibalize,
+/// 11403 Dream Vision, 24937 Using Control Console and the two Blood Siphons (which the suppressor
+/// above hides anyway). Every other channel — Blizzard, Arcane Missiles, Mind Flay, Drain Life,
+/// Rain of Fire, Hurricane, Tranquility, Evocation, First Aid — reads "Channeling".
+const ATTR_EX_CHANNEL_BAR_OWN_NAME: u32 = 0x2000_0000;
 /// `Attributes` bit `0x2` — the "uses the ranged slot" attribute (mangos `SPELL_ATTR_RANGED`).
 /// One half of the client's ranged-stance gate (module docs).
 const ATTR_RANGED: u32 = 0x2;
@@ -546,17 +568,39 @@ pub const SPELL_EFFECT_CREATE_ITEM: u32 = 24;
 /// (`0x4b2623: cmp [esi+0xf4], 0x5f` — `0x5f == 95`), and the cursor's skin leg requires that latch
 /// (decision 0752).
 pub const SPELL_EFFECT_SKINNING: u32 = 95;
-/// `SpellEffects` values `53`/`54` — `SPELL_EFFECT_ENCHANT_ITEM` (permanent) /
-/// `SPELL_EFFECT_ENCHANT_ITEM_TEMPORARY` (vmangos `SharedDefines.h`): the item-targeted craft
-/// casts the CraftFrame sends with `TARGET_FLAG_ITEM` (0437 phase 3).
 /// `SpellEffects` value `39` — `SPELL_EFFECT_LANGUAGE`: the effect that makes a spell *be* a
 /// language. Its `EffectMiscValue_1` is the `Languages.dbc` id, which is how a language reaches a
 /// skill line at all — see [`SpellCatalog::language_spell`].
 pub const SPELL_EFFECT_LANGUAGE: u32 = 39;
 
+/// `SpellEffects` values `53`/`54` — `SPELL_EFFECT_ENCHANT_ITEM` (permanent) /
+/// `SPELL_EFFECT_ENCHANT_ITEM_TEMPORARY` (vmangos `SharedDefines.h`): the item-targeted craft
+/// casts the CraftFrame sends with `TARGET_FLAG_ITEM` (0437 phase 3).
 pub const SPELL_EFFECT_ENCHANT_ITEM: u32 = 53;
 pub const SPELL_EFFECT_ENCHANT_ITEM_TEMPORARY: u32 = 54;
 
+/// `SpellEffects` value `127` — `SPELL_EFFECT_PROSPECTING`, and **no 5875 spell carries it**
+/// (pinned by `real_prospecting_effect_is_absent_from_5875`). It is named here because the
+/// absence is load-bearing rather than incidental: the item-target validator `0x495d60` has a
+/// third leg past its two enchant ones, gated on exactly this value (`0x495f39: cmp [eax],0x7f`),
+/// and that leg holds the only raise sites image-wide for the cast-failure reasons `0x84`
+/// PROSPECT_NEED_MORE (`0x49614e`) and `0x90` MIN_SKILL (`0x496128`). The server sends neither
+/// reason either, so on this build both messages are unreachable — which is why
+/// `ui_action::cast_fail` models neither arm (decision 2292).
+///
+/// **The number is the binary's own, not a later build's enum ported backwards.** `TryCast
+/// 0x6e4b60` carries a matched pair of `Effect[0]` gates two instructions apart:
+/// `0x6e4ca2 cmp eax,0x63` (99) raises `SPELL_FAILED_DISENCHANT_WHILE_LOOTING` (`0x6e4cbb`), and
+/// `0x6e4cd4 cmp [edx+0xf4],0x7f` raises `SPELL_FAILED_PROSPECT_WHILE_LOOTING` (`0x6e4cee`). That
+/// pairing names 99 ↔ disenchant and 127 ↔ prospect in 5875's own hand — and makes `0x83` dead
+/// on the same grounds as `0x84`/`0x90`, while its sibling `0x82` stays live (effect 99 ships).
+///
+/// The **code** is live and only the **data** is absent: 127 is handled in three reachable places
+/// (`0x495f39`, `0x6e4cd4`, and the effect classifier `0x6e3b80`'s 128-entry case table at
+/// `0x6e3bdc`, which maps it to the default arm). Nothing here is dead-stripped — 5875 ships
+/// prospecting with no prospecting spell to reach it.
+pub const SPELL_EFFECT_PROSPECTING: u32 = 127;
+
 /// `Spell.dbc` × `SpellIcon.dbc`, joined: spell id → name + icon path, plus the **learn-spell map**
 /// (a `SPELL_EFFECT_LEARN_SPELL` spell → the spell it teaches). Vanilla trainers offer a *learn*
 /// spell — a thin wrapper whose only effect is "teach spell X" — not the ability itself; the ability
@@ -781,6 +825,11 @@ pub fn load_spell_catalog(chain: &mut Chain) -> Result<SpellCatalog> {
                     u32_at(r, COL_EFFECT_MECHANIC_1 + i).unwrap_or(0)
                 }),
                 prevention_type: u32_at(r, COL_PREVENTION_TYPE).unwrap_or(0),
+                spell_family: u32_at(r, COL_SPELL_FAMILY_NAME).unwrap_or(0),
+                // Low dword first: bit `i >= 32` lives in column 162, which the reference reads as
+                // `[edi + 4*(i>>5) + 0x284]` — the same little-endian pair this join makes.
+                spell_family_flags: u64::from(u32_at(r, COL_SPELL_FAMILY_FLAGS_LOW).unwrap_or(0))
+                    | u64::from(u32_at(r, COL_SPELL_FAMILY_FLAGS_LOW + 1).unwrap_or(0)) << 32,
                 passive: attributes & ATTR_PASSIVE != 0,
                 cast_ui: u32_at(r, COL_CAST_UI).unwrap_or(0),
                 effects: [0, 1, 2].map(|i| u32_at(r, COL_EFFECT_1 + i).unwrap_or(0)),
diff --git a/crates/benilla-formats/tests/helm_vis_wants_a_helm.rs b/crates/benilla-formats/tests/helm_vis_wants_a_helm.rs
index e41c43fe..492e61c2 100644
--- a/crates/benilla-formats/tests/helm_vis_wants_a_helm.rs
+++ b/crates/benilla-formats/tests/helm_vis_wants_a_helm.rs
@@ -44,9 +44,9 @@ fn a_modelless_head_display_is_not_a_worn_helm() {
     );
 
     // 3. A real helm still hides what it should — the change must not disarm the mechanism.
-    let helm = items
+    let (_, helm) = items
         .iter()
-        .find(|d| d.model[0].is_some() && d.helmet_vis != [0, 0])
+        .find(|(_, d)| d.model[0].is_some() && d.helmet_vis != [0, 0])
         .expect("some display is a modelled helm with a vis row");
     assert_eq!(
         helm.worn_helm_vis(),
@@ -57,10 +57,10 @@ fn a_modelless_head_display_is_not_a_worn_helm() {
     // 4. The blast radius, pinned: of the 1314 rows that author a vis pair, exactly 12 leave the
     //    LEFT model slot empty. If the shipped data ever changes, this test says so rather than the
     //    change silently growing.
-    let masked = items.iter().filter(|d| d.helmet_vis != [0, 0]).count();
+    let masked = items.iter().filter(|(_, d)| d.helmet_vis != [0, 0]).count();
     let masked_modelless = items
         .iter()
-        .filter(|d| d.helmet_vis != [0, 0] && d.model[0].is_none())
+        .filter(|(_, d)| d.helmet_vis != [0, 0] && d.model[0].is_none())
         .count();
     assert_eq!((masked, masked_modelless), (1314, 12));
 
@@ -70,11 +70,11 @@ fn a_modelless_head_display_is_not_a_worn_helm() {
     //    reference's answer is the left slot's.
     let right_only = items
         .iter()
-        .filter(|d| d.model[0].is_none() && d.model[1].is_some())
+        .filter(|(_, d)| d.model[0].is_none() && d.model[1].is_some())
         .count();
     let right_only_masked = items
         .iter()
-        .filter(|d| d.model[0].is_none() && d.model[1].is_some() && d.helmet_vis != [0, 0])
+        .filter(|(_, d)| d.model[0].is_none() && d.model[1].is_some() && d.helmet_vis != [0, 0])
         .count();
     assert_eq!((right_only, right_only_masked), (41, 0));
 }
diff --git a/crates/benilla-formats/tests/m2_entity_mat_anim.rs b/crates/benilla-formats/tests/m2_entity_mat_anim.rs
new file mode 100644
index 00000000..70017487
--- /dev/null
+++ b/crates/benilla-formats/tests/m2_entity_mat_anim.rs
@@ -0,0 +1,222 @@
+//! The **entity** corpus's material animation (decision 2295) — the four shapes the unit /
+//! GameObject / held-item lane has to serve, each pinned on the asset that makes it unavoidable.
+//!
+//! Decision 0130 phase 3 built the texture transform for placed doodads and left every other lane
+//! off it; 2282 put the spell effects on; this file is the entity lane's turn, and it exists for
+//! the same reason 2282's does — *the premise that a lane needs no channel is a measurement, and an
+//! unmeasured one is how a channel gets quietly dropped.* `benilla-extract entityuvscan` is the
+//! census; these are the four rows of it a reader has to be able to check by hand.
+//!
+//! Skips (passes) when the client isn't present at `<repo>/WoW/Data`.
+
+use benilla_formats::{open_chain, parse_m2_render_submeshes};
+
+/// The whole entity corpus's widest case: **a creature, on a global sequence.** Every wind
+/// elemental in the game is this model, and 26 of its 32 batches slide a full sheet across
+/// themselves on a free-running clock — which is the one case where a shared material uniform is
+/// not a compromise but exactly what the reference does (0136 choice 1: the reference clocks a
+/// global-sequence loop on one per-scene ms cursor).
+#[test]
+fn a_creature_scrolls_on_a_global_sequence() {
+    let data = benilla_formats::wow_data_or_skip!();
+    let mut chain = open_chain(&data).expect("open vanilla patch chain");
+    let bytes = chain
+        .read_file("Creature\\AirElemental\\AirElemental.m2")
+        .expect("AirElemental is in the chain");
+    let subs = parse_m2_render_submeshes(&bytes, "Creature\\AirElemental", &[]).expect("parse");
+
+    let live: Vec<_> = subs
+        .iter()
+        .filter_map(|s| s.uv_anim.as_ref())
+        .filter(|a| a.period > 0.0)
+        .collect();
+    assert_eq!(live.len(), 26, "the banded shell's animating batches");
+    assert!(
+        live.iter().all(|a| a.gseq),
+        "every one rides a GLOBAL sequence — no host, no play head, a shared clock is faithful"
+    );
+    // A full sheet per loop: the batches slide u by 1.0 over their period, which is what makes the
+    // shell read as moving air rather than as a painted band.
+    for a in &live {
+        let (lo, hi) = a
+            .keys
+            .iter()
+            .fold((f32::MAX, f32::MIN), |(lo, hi), (_, v)| {
+                (lo.min(v[0]), hi.max(v[0]))
+            });
+        // A whole sheet, to the key quantization the exporter left behind (one batch ends at
+        // 1.0017): what matters is that a full repeat passes under the geometry each loop.
+        assert!(
+            (hi - lo - 1.0).abs() < 5e-3,
+            "a whole sheet of U per loop: [{lo}, {hi}]"
+        );
+    }
+    // Nothing here is per-sequence, so these batches keep the shared, deduped material.
+    assert!(subs.iter().all(|s| s.uv_seq.is_none()));
+}
+
+/// **A batch that rotates and never translates.** Both of the corpus's two live on GameObjects,
+/// and both answer `None` on the channel a reader checks first — so a lane whose predicate is
+/// `uv_anim.is_some()`, or whose row carries only a translation, drops them without a trace. This
+/// is `UvLoops::animates`' whole reason for existing, and 2019's affine row's.
+#[test]
+fn a_gameobject_batch_rotates_with_no_translation_at_all() {
+    let data = benilla_formats::wow_data_or_skip!();
+    let mut chain = open_chain(&data).expect("open vanilla patch chain");
+    for (path, batches) in [
+        ("World\\Goober\\G_ScryingBowl.m2", 1usize),
+        ("World\\Goober\\G_ScourgeRuneCircleCrystal.m2", 1),
+    ] {
+        let bytes = chain.read_file(path).expect("in the chain");
+        let dir = path.rsplit_once('\\').expect("a directory").0;
+        let subs = parse_m2_render_submeshes(&bytes, dir, &[]).expect("parse");
+        let turning: Vec<_> = subs.iter().filter(|s| s.uv_rot_seq.is_some()).collect();
+        assert_eq!(turning.len(), batches, "{path}: the rotating batches");
+        for s in &turning {
+            assert!(
+                s.uv_anim.is_none() && s.uv_seq.is_none(),
+                "{path}: no translation channel at all — the obvious test answers None"
+            );
+            assert!(s.uv_scale_seq.is_none(), "{path}: and no scaling either");
+            let rot = s.uv_rot_seq.as_ref().expect("checked");
+            let l = rot.seq(None).expect("slot 0 animates");
+            assert!(l.period > 0.0 && l.keys.len() > 1, "{path}: a live turn");
+        }
+    }
+}
+
+/// **The slots disagree, so no shared material can be right.** `BloodOfHeroes` authors its five
+/// bubble sheets twice over one animation id — file slot 0 holds them still, slot 1 sweeps them —
+/// at `freq` 16384/16383, so its 114 placements bubble independently of each other. That is
+/// 1408's population reached from the entity side: the instance needs a material of its own, and
+/// the row has to read whichever slot the instance is playing.
+#[test]
+fn a_gameobjects_slots_bake_different_loops() {
+    let data = benilla_formats::wow_data_or_skip!();
+    let mut chain = open_chain(&data).expect("open vanilla patch chain");
+    let path = "World\\Lordaeron\\Plagueland\\PassiveDoodads\\BloodOfHeroes\\BloodOfHeroes.m2";
+    let bytes = chain.read_file(path).expect("in the chain");
+    let dir = path.rsplit_once('\\').expect("a directory").0;
+    let subs = parse_m2_render_submeshes(&bytes, dir, &[]).expect("parse");
+
+    let split: Vec<_> = subs.iter().filter(|s| s.uv_seq.is_some()).collect();
+    assert_eq!(split.len(), 5, "the bubble sheets");
+    for s in &split {
+        assert!(
+            s.uv_anim.is_none(),
+            "no single loop serves both slots — which is why the shared lane registers nothing \
+             here and the bubbles never moved"
+        );
+        let seqs = s.uv_seq.as_ref().expect("checked");
+        let slots = seqs.slots();
+        assert_eq!(slots.len(), 2, "two file sequence slots");
+        assert!(slots[0].is_none(), "slot 0 holds the sheet still");
+        let live = slots[1].as_ref().expect("slot 1 sweeps it");
+        let hi = live.keys.iter().fold(f32::MIN, |hi, (_, v)| hi.max(v[1]));
+        assert!(
+            (live.period - 3.334).abs() < 1e-2 && (hi - 0.605).abs() < 1e-2,
+            "slot 1 sweeps v to {hi} over {}s",
+            live.period
+        );
+    }
+    // The pool itself is a sixth batch with no transform at all — so what was missing was never
+    // "the blood pool", it was the bubbling.
+    assert_eq!(
+        subs.iter().filter(|s| s.uv_seq.is_none()).count(),
+        1,
+        "the pool draws with no transform, and always did"
+    );
+}
+
+/// **And slot 1 is REACHABLE — the other half of the same asset's story.** A per-sequence UV loop
+/// only ever runs if the arm picks that sequence, so "slot 1 sweeps the sheet" is half a fact: the
+/// bubbling is live exactly as often as the weighted variation walk lands on take 1.
+///
+/// The pool's two takes are one `Stand` (`AnimationData.dbc` id 0) chain — and a GameObject whose
+/// model owns *none* of the door-family ids collapses its substate to Stand and re-arms it every
+/// window, with a fresh `variationIdx = -1` roll each time (wow-re `gameobject-anim-arm.md`
+/// §6c/§6d; `crate::go_anim`'s rest arm). So these two frequencies are the duty cycle of every
+/// blood pool in the Plaguelands: `roll < 16384` takes the still sheet, `16384..=32766` takes the
+/// bubbling one, and the single leftover draw (`32767`) exhausts the chain back to the head — the
+/// authored convention, frequencies summing to 32767 against 32768 outcomes.
+///
+/// It is pinned here rather than left to arithmetic because the failure it guards is silent: an
+/// asset re-read that dropped `frequency` to 0, or a walk that took the head, would leave this
+/// file's neighbour above passing unchanged while every pool in the game went still.
+#[test]
+fn the_bubbling_take_is_half_the_pools_duty_cycle() {
+    let data = benilla_formats::wow_data_or_skip!();
+    let mut chain = open_chain(&data).expect("open vanilla patch chain");
+    let bytes = chain
+        .read_file("World\\Lordaeron\\Plagueland\\PassiveDoodads\\BloodOfHeroes\\BloodOfHeroes.m2")
+        .expect("in the chain");
+    let seqs = benilla_formats::parse_m2_animations(&bytes);
+
+    assert_eq!(
+        seqs.len(),
+        2,
+        "one two-take variation chain and nothing else"
+    );
+    assert!(
+        seqs.iter().all(|s| s.anim_id == 0),
+        "both takes are Stand — which is what the §2c collapse-to-0 leg arms"
+    );
+    let freqs: Vec<u16> = seqs.iter().map(|s| s.frequency).collect();
+    assert_eq!(
+        freqs,
+        vec![16_384, 16_383],
+        "the still sheet and the bubbling one, at even odds"
+    );
+    // The walk is `roll < freq` (strict, unsigned) node by node, else `roll -= freq` — so the
+    // counts below ARE the duty cycle, not an approximation of it.
+    let bubbling = (0u32..32_768)
+        .filter(|&roll| {
+            let mut roll = roll;
+            freqs.iter().position(|&f| {
+                let win = roll < u32::from(f);
+                roll = roll.saturating_sub(u32::from(f));
+                win
+            }) == Some(1)
+        })
+        .count();
+    assert_eq!(
+        bubbling, 16_383,
+        "the bubbling take wins 16383 of 32768 draws — 49.997 %, re-rolled every 3.3 s window"
+    );
+}
+
+/// **The same shape on the TINT channel**, and worse: four of the corpus's five animated entity
+/// tints bake *nothing* in file slot 0, so `rgb_anim` is `None` for them and a shared material can
+/// only ever seed white however faithfully it is ticked. `G_FreezingTrap` is the one with play
+/// frequency — the hunter's trap, whose glow card is meant to pulse blue-white as it arms, on the
+/// `Custom0` clip the server rings.
+#[test]
+fn a_gameobjects_tint_is_keyed_in_a_later_slot_alone() {
+    let data = benilla_formats::wow_data_or_skip!();
+    let mut chain = open_chain(&data).expect("open vanilla patch chain");
+    let bytes = chain
+        .read_file("World\\Goober\\G_FreezingTrap.m2")
+        .expect("in the chain");
+    let subs = parse_m2_render_submeshes(&bytes, "World\\Goober", &[]).expect("parse");
+
+    let tinted: Vec<_> = subs.iter().filter(|s| s.rgb_seq.is_some()).collect();
+    assert!(!tinted.is_empty(), "the glow card's tint is per-sequence");
+    for s in &tinted {
+        assert!(
+            s.rgb_anim.is_none(),
+            "slot 0 bakes nothing — the shared lane's seed is white, for ever"
+        );
+        let seqs = s.rgb_seq.as_ref().expect("checked");
+        let slots = seqs.slots();
+        assert!(slots[0].is_none(), "…which is exactly what slot 0 holds");
+        let live = slots
+            .iter()
+            .enumerate()
+            .find_map(|(i, l)| l.as_ref().map(|l| (i, l)));
+        let (slot, l) = live.expect("some later slot keys the pulse");
+        assert!(
+            slot > 0 && l.period > 0.0 && l.keys.len() > 1,
+            "slot {slot}"
+        );
+    }
+}
diff --git a/crates/benilla-formats/tests/m2_swipe_claw_trail.rs b/crates/benilla-formats/tests/m2_swipe_claw_trail.rs
new file mode 100644
index 00000000..2c89832e
--- /dev/null
+++ b/crates/benilla-formats/tests/m2_swipe_claw_trail.rs
@@ -0,0 +1,105 @@
+//! The druid's Swipe leaves no claw trail (decision 2282) — and, like the lava bubbles next door,
+//! the asset says why in one number: **this model's whole visible existence is its texture
+//! transform.**
+//!
+//! `Spells\SwipeCaster.m2` — Swipe's `cast` kit (`SpellVisual` 189 → kit 182 →
+//! `SpellVisualEffectName` 215) — is two 51-vertex strips, three per batch, each rigidly skinned to
+//! one bone that sweeps it through the arc. Their UVs are authored `u ∈ [0.945, 1.944]` against a
+//! sheet the file addresses **CLAMP**, whose border texels are fully transparent. At the
+//! translation track's first key the strips therefore sample the sheet's transparent right edge
+//! along their whole length and draw *nothing at all*; the 1.5 s U-scroll is what drags the claw
+//! across them.
+//!
+//! So a consumer that renders this model's geometry, rig, alpha loops and particles but not its
+//! texture transform renders a correct-looking blood spray and no trail — which is exactly what
+//! benilla's spell-effect lane did, on 0271's recorded premise that "no effect model in the
+//! current corpus needs it". This file pins the three facts that make that premise false, so the
+//! effect lane's UV channel can never be quietly dropped again.
+//!
+//! Skips (passes) when the client isn't present at `<repo>/WoW/Data`.
+
+use benilla_formats::{open_chain, parse_m2_render_submeshes, uv_transform};
+
+const SWIPE: &str = "Spells\\SwipeCaster.m2";
+
+/// The u extent the batch's authored UVs cover once the loop's offset at `t` is folded in, by the
+/// verified law (wow-re `m2-texanim-uv` §1: `uv' = R·S·((uv + t) − p) + p`, and with no rotation
+/// or scaling authored here that is a pure `uv + t`).
+fn u_span_at(uvs: &[[f32; 2]], offset: [f32; 2]) -> (f32, f32) {
+    uvs.iter()
+        .map(|&uv| uv_transform(uv, offset, [0.0, 0.0, 0.0, 1.0], [1.0, 1.0])[0])
+        .fold((f32::MAX, f32::MIN), |(lo, hi), u| (lo.min(u), hi.max(u)))
+}
+
+#[test]
+fn the_swipe_claw_trail_is_nothing_but_its_uv_scroll() {
+    let data = benilla_formats::wow_data_or_skip!();
+    let mut chain = open_chain(&data).expect("open vanilla patch chain");
+    let bytes = chain.read_file(SWIPE).expect("SwipeCaster is in the chain");
+    let subs = parse_m2_render_submeshes(&bytes, "Spells", &[]).expect("parse");
+
+    assert_eq!(subs.len(), 2, "the two claw-strip batches");
+    for (i, s) in subs.iter().enumerate() {
+        // 1. Every batch animates its texture transform, on the SHARED spelling (one sequence, so
+        //    the slots cannot disagree and 1408's per-slot set is rightly absent).
+        let uv = s
+            .uv_anim
+            .as_ref()
+            .unwrap_or_else(|| panic!("batch {i} carries a UV loop"));
+        assert!(
+            s.uv_seq.is_none(),
+            "batch {i}: one sequence, so no per-slot set"
+        );
+
+        // 2. The scroll is a near-whole-sheet sweep along U, and it runs the length of the clip.
+        let (first, last) = (
+            uv.keys.first().expect("keys").1,
+            uv.keys.last().expect("keys").1,
+        );
+        assert!(
+            first[0].abs() < 0.05 && (last[0] + 0.97).abs() < 0.05,
+            "batch {i}: U sweeps ~0 → ~−0.97 ({first:?} → {last:?})"
+        );
+        assert!(
+            (uv.period - 1.5).abs() < 0.01,
+            "batch {i}: over the 1.5 s clip (period {})",
+            uv.period
+        );
+
+        // 3. The sheet is CLAMP-addressed on U — which is what turns the scroll from a nicety into
+        //    the whole visual. A repeat-addressed strip would show *something* at every offset.
+        assert!(!s.wrap_x, "batch {i}: U is authored CLAMP");
+
+        // 4. …and so, frozen at the first key, the strip sits entirely at or past the sheet's right
+        //    edge: clamped, every one of its texels is the border. Scrolled to the last key it
+        //    covers the sheet instead. This pair IS the bug and its fix, in the asset's own numbers.
+        let frozen = u_span_at(&s.uvs, first);
+        assert!(
+            frozen.0 > 0.94,
+            "batch {i}: at t=0 the whole strip is at/past the right edge (u {frozen:?})"
+        );
+        let scrolled = u_span_at(&s.uvs, last);
+        assert!(
+            scrolled.0 < 0.01 && scrolled.1 > 0.95,
+            "batch {i}: at the last key it covers the sheet (u {scrolled:?})"
+        );
+    }
+
+    // 5. The border really is empty, so "clamped to the edge" means "invisible" and not "a stripe
+    //    of colour". `BloodSpurtSmall01` is a 16×16 blob with a fully transparent frame.
+    let blp = chain
+        .read_file("Spells\\BloodSpurtSmall01.blp")
+        .expect("the claw sheet is in the chain");
+    let tex = benilla_formats::blp_bytes_to_mip_chain(&blp).expect("decode");
+    let (w, h) = (tex.width as usize, tex.height as usize);
+    let px = &tex.mips[0];
+    let alpha = |x: usize, y: usize| px[(y * w + x) * 4 + 3];
+    assert!(
+        (0..h).all(|y| alpha(w - 1, y) == 0 && alpha(0, y) == 0),
+        "both U border columns are fully transparent"
+    );
+    assert!(
+        (0..h).any(|y| (0..w).any(|x| alpha(x, y) > 128)),
+        "…while the middle of the sheet is the claw itself"
+    );
+}
diff --git a/crates/benilla-m2/Cargo.toml b/crates/benilla-m2/Cargo.toml
index a6923e78..3840f2f3 100644
--- a/crates/benilla-m2/Cargo.toml
+++ b/crates/benilla-m2/Cargo.toml
@@ -5,5 +5,8 @@ edition.workspace = true
 license.workspace = true
 description = "M2 (MD20) model reader for WoW 1.12.1 (build 5875) — in-repo, decision 0021"
 
+[lints]
+workspace = true
+
 [dependencies]
 benilla-bytes = { path = "../benilla-bytes" }
diff --git a/crates/benilla-m2/examples/dump_attach.rs b/crates/benilla-m2/examples/dump_attach.rs
index d7e56d37..5685233e 100644
--- a/crates/benilla-m2/examples/dump_attach.rs
+++ b/crates/benilla-m2/examples/dump_attach.rs
@@ -1,6 +1,6 @@
 //! Session probe: dump an M2's attachment table (+ each attach bone's parent/pivot) —
 //! `cargo run -p benilla-m2 --example dump_attach <file.m2>`. Extract the file first via
-//! `mpqx` (benilla-mpq). Built for the nocked-ammo RE round (decision 0406 follow-up), kept
+//! `mpqx` (benilla-mpq). Built for the nocked-ammo RE round (decision 2273 follow-up), kept
 //! because "which attach ids does this model actually have" keeps coming up.
 
 use std::io::Cursor;
diff --git a/crates/benilla-m2/examples/dump_skin.rs b/crates/benilla-m2/examples/dump_skin.rs
index ed94bcdb..1ed6e927 100644
--- a/crates/benilla-m2/examples/dump_skin.rs
+++ b/crates/benilla-m2/examples/dump_skin.rs
@@ -1,6 +1,6 @@
 //! Session probe: dump an M2's skin-0 sections/batches with material + texture resolution —
 //! `cargo run -p benilla-m2 --example dump_skin <file.m2>`. Extract the file first via `mpqx`
-//! (benilla-mpq). Built for the bowstring round (decision 0406 follow-up), kept because "why is
+//! (benilla-mpq). Built for the bowstring round (decision 2273 follow-up), kept because "why is
 //! this submesh (not) rendering" keeps coming up.
 
 use std::io::Cursor;
diff --git a/crates/benilla-mpq/Cargo.toml b/crates/benilla-mpq/Cargo.toml
index ea4d5ebf..1f9dd5c5 100644
--- a/crates/benilla-mpq/Cargo.toml
+++ b/crates/benilla-mpq/Cargo.toml
@@ -5,6 +5,9 @@ edition.workspace = true
 license.workspace = true
 description = "Read-only MPQ archive reader for WoW 1.12.1 (build 5875) — in-repo, decision 0021"
 
+[lints]
+workspace = true
+
 [dependencies]
 # Bounds-checked byte readers + the allocation-cap guard (decision 0064). MPQ migrates minimally: the
 # hand-rolled rd_u16/rd_u32 move to ByteExt and the header/block-table/sector allocations get capped;
diff --git a/crates/benilla-protocol/Cargo.toml b/crates/benilla-protocol/Cargo.toml
index 7bada359..93046597 100644
--- a/crates/benilla-protocol/Cargo.toml
+++ b/crates/benilla-protocol/Cargo.toml
@@ -5,12 +5,18 @@ edition.workspace = true
 license.workspace = true
 description = "WoW 1.12.1 auth (SRP6) + world wire protocol and the benilla-auth CLI"
 
+[lints]
+workspace = true
+
 [dependencies]
 anyhow.workspace = true
 clap.workspace = true
 benilla-srp = { path = "../benilla-srp" }
 flate2 = "1.0"
 sha1.workspace = true
+# `SessionEventKind` — the fieldless twin of `SessionEvent`, the key the app's packet-handler
+# table dispatches on (decision 2305). A derive, so the two can never drift apart.
+strum = { version = "0.26", features = ["derive"] }
 
 [dev-dependencies]
 # The SRP probes re-derive the handshake by hand (to vary what `benilla-srp` fixes) — examples only.
diff --git a/crates/benilla-protocol/src/events.rs b/crates/benilla-protocol/src/events.rs
index 645e3f9b..96504d2c 100644
--- a/crates/benilla-protocol/src/events.rs
+++ b/crates/benilla-protocol/src/events.rs
@@ -146,7 +146,14 @@ impl LoginRefusal {
 
 /// One decoded event from the world stream. Carries only primitives + the coarse [`EntityKind`]
 /// classification — no wire types leak to the app, and no running state lives here.
-#[derive(Debug, Clone)]
+///
+/// [`SessionEventKind`] is its fieldless twin (one variant per variant, derived): the key the
+/// app's packet-handler table dispatches on, as the reference's table is keyed by opcode.
+#[derive(Debug, Clone, strum::EnumDiscriminants)]
+#[strum_discriminants(
+    name(SessionEventKind),
+    derive(Hash, PartialOrd, Ord, strum::EnumIter, strum::IntoStaticStr)
+)]
 pub enum SessionEvent {
     /// A login attempt progressed to `stage` (decision 0539) — IO-thread-emitted, like
     /// [`Self::CharacterList`], never wire-decoded.
@@ -854,7 +861,7 @@ pub enum SessionEvent {
         misses: Vec<(u64, u8)>,
         target: Option<u64>,
         /// The GameObject an open-lock cast launched at (`TARGET_FLAG_GAMEOBJECT`) — opens a chest lid /
-        /// locked door (decision 0250). `None` for a unit spell.
+        /// locked door (decision 2271). `None` for a unit spell.
         go_target: Option<u64>,
         /// The ground point a dest-targeted cast launched at (`TARGET_FLAG_DEST_LOCATION`), raw
         /// WoW coords — where a ground AOE's launch-side visual belongs (the B132 follow-up;
@@ -915,6 +922,19 @@ pub enum SessionEvent {
         slot: u32,
         seconds: u32,
     },
+    /// One cell of a talent spell-modifier table, absolutely (`SMSG_SET_FLAT_SPELL_MODIFIER` /
+    /// `SMSG_SET_PCT_SPELL_MODIFIER`): `flat` picks the table, `mask_bit` is the spell's
+    /// `SpellFamilyFlags` **bit index** (the row) and `op` the SpellModOp (the column). Neither
+    /// byte is bounded on the wire — the consumer (`benilla::spell_mods`) refuses an out-of-range
+    /// pair rather than reproducing the reference's own overrun. `value` is **absolute**, not a
+    /// delta; the wire shape and the `bit * 29 + op` index law are on
+    /// [`crate::messages::ServerPacket::SpellModifier`].
+    SpellModifier {
+        flat: bool,
+        mask_bit: u8,
+        op: u8,
+        value: i32,
+    },
     /// Start an on-hold (`SPELL_ATTR_COOLDOWN_ON_EVENT`) cooldown's parked timers now
     /// (`SMSG_COOLDOWN_EVENT`).
     CooldownEvent { spell_id: u32, caster: u64 },
@@ -1596,6 +1616,13 @@ pub enum SessionEvent {
     },
 }
 
+impl SessionEventKind {
+    /// Every kind, in declaration order — for a census that asks "who handles each?".
+    pub fn all() -> impl Iterator<Item = Self> {
+        <Self as strum::IntoEnumIterator>::iter()
+    }
+}
+
 /// The result of polling the reader for the next packet's events.
 pub enum Poll {
     /// A packet decoded into these events. `events` is **empty** for an opcode we parse but do not
@@ -1604,9 +1631,16 @@ pub enum Poll {
     /// census counted it like any other packet. A relayed move landing in an unmodelled opcode was
     /// therefore indistinguishable from one that never arrived. `opcode` rides along so the net
     /// thread can name what actually came off the wire.
+    ///
+    /// `tail` is how many body bytes the decoder left unconsumed
+    /// ([`crate::messages::parse_server_with_tail`]): a length-framed body lets a decoder shorter
+    /// than the server's layout succeed silently, and this is the one number that shows it. An
+    /// instrument, not a verdict — the packet decoded, its events are real, and the tail is
+    /// announced (once per opcode) rather than turned into a [`Poll::Skipped`].
     Events {
         opcode: u16,
         events: Vec<SessionEvent>,
+        tail: usize,
     },
     /// An unparseable packet was skipped — kept the stream aligned, not an error. Carries the
     /// opcode (for the app's dropped-packet tally) and a short description (opcode + error + a hex
diff --git a/crates/benilla-protocol/src/events/decode.rs b/crates/benilla-protocol/src/events/decode.rs
index 14aa6edc..df2fa473 100644
--- a/crates/benilla-protocol/src/events/decode.rs
+++ b/crates/benilla-protocol/src/events/decode.rs
@@ -287,6 +287,17 @@ pub fn decode(packet: ServerPacket) -> Vec<SessionEvent> {
             slot,
             seconds,
         }],
+        ServerPacket::SpellModifier {
+            flat,
+            mask_bit,
+            op,
+            value,
+        } => vec![SessionEvent::SpellModifier {
+            flat,
+            mask_bit,
+            op,
+            value,
+        }],
         ServerPacket::CooldownEvent { spell_id, caster } => {
             vec![SessionEvent::CooldownEvent { spell_id, caster }]
         }
diff --git a/crates/benilla-protocol/src/lib.rs b/crates/benilla-protocol/src/lib.rs
index b7966698..2ee97c18 100644
--- a/crates/benilla-protocol/src/lib.rs
+++ b/crates/benilla-protocol/src/lib.rs
@@ -15,8 +15,9 @@ pub mod world;
 pub use auth::AuthReject;
 pub use events::{
     decode, CharAction, EntityKind, LoginRefusal, LoginStage, MoveSpeeds, Poll, SessionEnd,
-    SessionEvent,
+    SessionEvent, SessionEventKind,
 };
+pub use messages::field;
 pub use messages::{
     AttackSwingError, CharCreateReq, CharEnumItem, Character, CorpseLook, CreateSpline, ItemInfo,
     JumpInfo, MonsterMoveFacing, MoveMode, MoverState, ObjectFields, OwnerFallback, RelayVerb,
diff --git a/crates/benilla-protocol/src/messages/auction.rs b/crates/benilla-protocol/src/messages/auction.rs
index 42a2a228..00a29db4 100644
--- a/crates/benilla-protocol/src/messages/auction.rs
+++ b/crates/benilla-protocol/src/messages/auction.rs
@@ -20,7 +20,7 @@
 
 use std::io;
 
-use crate::wire::{read_i32_le, read_u32_le, read_u64_le};
+use crate::wire::{capacity_hint, read_i32_le, read_u32_le, read_u64_le};
 
 /// `SMSG_AUCTION_COMMAND_RESULT`'s `action` field — which verb the verdict answers (VERIFIED
 /// vmangos `AuctionHouseMgr.h:53-58`, `AuctionAction`).
@@ -276,7 +276,6 @@ pub fn auction_remove_item(auctioneer: u64, auction_id: u32) -> Vec<u8> {
 /// `level_min`/`level_max` gate `RequiredLevel`, not item level. The name match is a
 /// case-insensitive substring against the localized name *with the random-property suffix
 /// appended*. `list_from` pages by [`AUCTION_PAGE_SIZE`].
-#[allow(clippy::too_many_arguments)]
 pub fn auction_list_items(
     auctioneer: u64,
     list_from: u32,
@@ -398,7 +397,7 @@ pub(super) fn read_auction_list_result(r: &mut &[u8]) -> io::Result<(Vec<Auction
     let count = read_u32_le(r)?;
     // Bound the allocation by what the buffer could actually hold, not by a `count` we do not
     // trust (see the loop guard below).
-    let mut auctions = Vec::with_capacity((count as usize).min(r.len() / AUCTION_RECORD_BYTES));
+    let mut auctions = Vec::with_capacity(capacity_hint(count, r.len() / AUCTION_RECORD_BYTES));
     for _ in 0..count {
         // `count` is an UPPER BOUND, not a record count. vmangos's *browse fast
         // path* (the no-filter branch of `BuildListAuctionItems`, `AuctionHouseMgr.cpp:716-735`)
diff --git a/crates/benilla-protocol/src/messages/battlefield.rs b/crates/benilla-protocol/src/messages/battlefield.rs
index 03f76f3c..dfceb428 100644
--- a/crates/benilla-protocol/src/messages/battlefield.rs
+++ b/crates/benilla-protocol/src/messages/battlefield.rs
@@ -4,7 +4,7 @@
 
 use std::io::{self, Read};
 
-use crate::wire::{read_u32_le, read_u8};
+use crate::wire::{capacity_hint, read_u32_le, read_u8};
 
 /// `SMSG_BATTLEFIELD_STATUS`, one slot's update (VERIFIED at the bytes, handler `0x4aa850`).
 #[derive(Clone, Debug, PartialEq, Eq)]
@@ -111,7 +111,7 @@ pub(super) fn read_pvp_log_data(r: &mut impl Read) -> io::Result<PvpLogData> {
     let ended = read_u8(r)? != 0;
     let winner = if ended { Some(read_u8(r)?) } else { None };
     let count = read_u32_le(r)?;
-    let mut rows = Vec::with_capacity(count.min(80) as usize);
+    let mut rows = Vec::with_capacity(capacity_hint(count, 80));
     for _ in 0..count {
         let guid = crate::wire::read_u64_le(r)?;
         let rank = read_u32_le(r)?;
@@ -120,7 +120,7 @@ pub(super) fn read_pvp_log_data(r: &mut impl Read) -> io::Result<PvpLogData> {
         let deaths = read_u32_le(r)?;
         let honor_gained = read_u32_le(r)?;
         let stat_count = read_u32_le(r)?;
-        let mut stats = Vec::with_capacity(stat_count.min(8) as usize);
+        let mut stats = Vec::with_capacity(capacity_hint(stat_count, 8));
         for i in 0..stat_count {
             let v = read_u32_le(r)?;
             if i < 8 {
@@ -173,7 +173,7 @@ pub(super) fn read_battlefield_list(r: &mut impl Read) -> io::Result<Battlefield
     let map_id = read_u32_le(r)?;
     let bracket = read_u8(r)?;
     let count = read_u32_le(r)?;
-    let mut instances = Vec::with_capacity(count.min(64) as usize);
+    let mut instances = Vec::with_capacity(capacity_hint(count, 64));
     for _ in 0..count {
         instances.push(read_u32_le(r)?);
     }
@@ -212,7 +212,7 @@ pub const BATTLEFIELD_POSITIONS_MAX: usize = 40;
 /// triple only when that byte is non-zero.
 pub(super) fn read_battlefield_positions(r: &mut impl Read) -> io::Result<BattlefieldPositions> {
     let count = read_u32_le(r)?;
-    let mut players = Vec::with_capacity((count as usize).min(BATTLEFIELD_POSITIONS_MAX));
+    let mut players = Vec::with_capacity(capacity_hint(count, BATTLEFIELD_POSITIONS_MAX));
     for i in 0..count {
         let guid = crate::wire::read_u64_le(r)?;
         let x = crate::wire::read_f32_le(r)?;
diff --git a/crates/benilla-protocol/src/messages/channel.rs b/crates/benilla-protocol/src/messages/channel.rs
index c7b36596..65b9c764 100644
--- a/crates/benilla-protocol/src/messages/channel.rs
+++ b/crates/benilla-protocol/src/messages/channel.rs
@@ -10,7 +10,7 @@
 
 use std::io;
 
-use crate::wire::{read_cstring, read_u32_le, read_u64_le, read_u8};
+use crate::wire::{capacity_hint, read_cstring, read_u32_le, read_u64_le, read_u8};
 
 /// `SMSG_CHANNEL_NOTIFY`'s notice byte (`ChatNotify`, VERIFIED vmangos `Chat/Channel.h:35-71`) —
 /// selects which tail follows the channel name (see [`ChannelNoticeTail`]/[`read_channel_notify`]).
@@ -173,7 +173,7 @@ pub(super) fn read_channel_list(r: &mut &[u8]) -> io::Result<(String, u8, Vec<(u
     // The count is wire-controlled — never let it drive allocation (a corrupt 0xFFFFFFFF must fail
     // at the bounds-checked reads below, not abort in the allocator). Legit rosters exceed 256
     // rarely; push simply grows past the hint.
-    let mut members = Vec::with_capacity((count as usize).min(256));
+    let mut members = Vec::with_capacity(capacity_hint(count, 256));
     for _ in 0..count {
         let guid = read_u64_le(r)?;
         let member_flags = read_u8(r)?;
diff --git a/crates/benilla-protocol/src/messages/combat_log.rs b/crates/benilla-protocol/src/messages/combat_log.rs
index 2a381d35..a3c26f16 100644
--- a/crates/benilla-protocol/src/messages/combat_log.rs
+++ b/crates/benilla-protocol/src/messages/combat_log.rs
@@ -14,7 +14,9 @@
 
 use std::io::{self, Read};
 
-use crate::wire::{read_f32_le, read_i32_le, read_packed_guid, read_u32_le, read_u64_le, read_u8};
+use crate::wire::{
+    capacity_hint, read_f32_le, read_i32_le, read_packed_guid, read_u32_le, read_u64_le, read_u8,
+};
 
 /// One decoded `SMSG_SPELLNONMELEEDAMAGELOG` — non-melee (spell) damage dealt (vmangos
 /// `WorldPackets::Spell::SpellNonMeleeDamageLog::AppendBodyTo`, `Server/Packets/Spell.cpp:124-140` +
@@ -117,7 +119,8 @@ pub(super) fn read_periodic_aura_log(r: &mut impl Read) -> io::Result<PeriodicAu
     let caster = read_packed_guid(r)?;
     let spell_id = read_u32_le(r)?;
     let count = read_u32_le(r)?;
-    let mut ticks = Vec::with_capacity(count as usize);
+    // vmangos writes `count = 1` unconditionally (`Objects/Unit.cpp:4410`); 64 is far past it.
+    let mut ticks = Vec::with_capacity(capacity_hint(count, 64));
     for _ in 0..count {
         let aura_type = read_u32_le(r)?;
         let tick = match aura_type {
@@ -281,7 +284,9 @@ pub(super) fn read_spell_log_miss(r: &mut impl Read) -> io::Result<SpellLogMiss>
     let caster = read_u64_le(r)?;
     let use_extended = read_u8(r)?;
     let count = read_u32_le(r)?;
-    let mut misses = Vec::with_capacity(count as usize);
+    // No server bound: vmangos never sends this opcode at all (its miss list rides
+    // `SMSG_SPELL_GO`), so 64 is a generous sane one.
+    let mut misses = Vec::with_capacity(capacity_hint(count, 64));
     for _ in 0..count {
         let target = read_u64_le(r)?;
         let miss_info = read_u8(r)?;
@@ -375,7 +380,7 @@ pub(super) fn read_spell_dispel_log(r: &mut impl Read) -> io::Result<SpellDispel
     let victim = read_packed_guid(r)?;
     let caster = read_packed_guid(r)?;
     let count = read_u32_le(r)?;
-    let mut spell_ids = Vec::with_capacity(count.min(64) as usize);
+    let mut spell_ids = Vec::with_capacity(capacity_hint(count, 64));
     for _ in 0..count {
         spell_ids.push(read_u32_le(r)?);
     }
@@ -536,11 +541,11 @@ pub(super) fn read_spell_log_execute(r: &mut impl Read) -> io::Result<SpellLogEx
     let caster = read_packed_guid(r)?;
     let spell_id = read_u32_le(r)?;
     let group_count = read_u32_le(r)?;
-    let mut effects = Vec::with_capacity(group_count.min(8) as usize);
+    let mut effects = Vec::with_capacity(capacity_hint(group_count, 8));
     for _ in 0..group_count {
         let effect = read_u32_le(r)?;
         let rows = read_u32_le(r)?;
-        let mut out = Vec::with_capacity(rows.min(64) as usize);
+        let mut out = Vec::with_capacity(capacity_hint(rows, 64));
         for _ in 0..rows {
             out.push(match effect {
                 EFFECT_POWER_DRAIN => ExecuteLog::PowerDrain {
diff --git a/crates/benilla-protocol/src/messages/gossip.rs b/crates/benilla-protocol/src/messages/gossip.rs
index c85032eb..aac5d1ca 100644
--- a/crates/benilla-protocol/src/messages/gossip.rs
+++ b/crates/benilla-protocol/src/messages/gossip.rs
@@ -7,7 +7,7 @@
 
 use std::io;
 
-use crate::wire::{read_cstring, read_f32_le, read_u32_le, read_u64_le, read_u8};
+use crate::wire::{capacity_hint, read_cstring, read_f32_le, read_u32_le, read_u64_le, read_u8};
 
 /// One gossip menu entry (`SMSG_GOSSIP_MESSAGE`'s option list, 1.12 shape — no box-money field,
 /// that's TBC+). `index` is the value the client echoes back as `gossipListId` on select; `icon` is
@@ -76,7 +76,8 @@ pub(super) fn read_gossip_message(
     let npc_guid = read_u64_le(r)?;
     let text_id = read_u32_le(r)?;
     let option_count = read_u32_le(r)?;
-    let mut options = Vec::with_capacity(option_count as usize);
+    // vmangos `GOSSIP_MAX_MENU_ITEMS` 32 (`GossipDef.h:32`, "client supports showing max 32").
+    let mut options = Vec::with_capacity(capacity_hint(option_count, 32));
     for _ in 0..option_count {
         options.push(GossipOption {
             index: read_u32_le(r)?,
@@ -86,7 +87,9 @@ pub(super) fn read_gossip_message(
         });
     }
     let quest_count = read_u32_le(r)?;
-    let mut quests = Vec::with_capacity(quest_count as usize);
+    // The quest menu is an unbounded vector server-side (`GossipDef.h:184`); the same 32-item
+    // client display limit bounds the hint.
+    let mut quests = Vec::with_capacity(capacity_hint(quest_count, 32));
     for _ in 0..quest_count {
         quests.push(QuestOption {
             quest_id: read_u32_le(r)?,
diff --git a/crates/benilla-protocol/src/messages/group.rs b/crates/benilla-protocol/src/messages/group.rs
index 1d16e7af..97d53e5b 100644
--- a/crates/benilla-protocol/src/messages/group.rs
+++ b/crates/benilla-protocol/src/messages/group.rs
@@ -12,7 +12,8 @@ use std::io::{self, Read};
 
 use crate::messages::update_object::power_display_scale;
 use crate::wire::{
-    read_cstring, read_f32_le, read_packed_guid, read_u16_le, read_u32_le, read_u64_le, read_u8,
+    capacity_hint, read_cstring, read_f32_le, read_packed_guid, read_u16_le, read_u32_le,
+    read_u64_le, read_u8,
 };
 
 /// The raid-assistant bit in [`GroupMemberEntry::flags`] / `SMSG_GROUP_LIST`'s own-flags byte —
@@ -95,7 +96,8 @@ pub(super) fn read_group_list(
     let group_type = read_u8(r)?;
     let own_flags = read_u8(r)?;
     let count = read_u32_le(r)?;
-    let mut members = Vec::with_capacity(count as usize);
+    // A raid is the widest list this carries: vmangos `MAX_RAID_SIZE` 40 (`Group/Group.h:50`).
+    let mut members = Vec::with_capacity(capacity_hint(count, 40));
     for _ in 0..count {
         members.push(GroupMemberEntry {
             name: read_cstring(r)?,
@@ -633,7 +635,7 @@ pub(super) fn read_raid_instance_info(r: &mut &[u8]) -> io::Result<Vec<RaidInsta
     // A cap before the allocation: `count` is attacker-controlled in the general case, and the
     // real client's own list is `MAX_RAID_INFOS`-bounded at the UI. 1024 is far above anything a
     // server can legitimately send and far below a memory problem.
-    let mut out = Vec::with_capacity((count as usize).min(1024));
+    let mut out = Vec::with_capacity(capacity_hint(count, 1024));
     for _ in 0..count {
         out.push(RaidInstanceEntry {
             map: read_u32_le(r)?,
diff --git a/crates/benilla-protocol/src/messages/guild.rs b/crates/benilla-protocol/src/messages/guild.rs
index 7c79898e..3e054f19 100644
--- a/crates/benilla-protocol/src/messages/guild.rs
+++ b/crates/benilla-protocol/src/messages/guild.rs
@@ -39,7 +39,7 @@
 
 use std::io::{self, Read};
 
-use crate::wire::{read_cstring, read_f32_le, read_u32_le, read_u64_le, read_u8};
+use crate::wire::{capacity_hint, read_cstring, read_f32_le, read_u32_le, read_u64_le, read_u8};
 
 /// A guild always has at least this many ranks — vmangos `GUILD_RANKS_MIN_COUNT` (`Guild/Guild.h:31`);
 /// the five defaults are GM / Officer / Veteran / Member / Initiate ([`guild_default_rank`]).
@@ -493,12 +493,12 @@ pub(super) fn read_guild_roster(r: &mut impl Read) -> io::Result<GuildRoster> {
     let info = read_cstring(r)?;
 
     let rank_count = read_u32_le(r)?;
-    let mut rank_rights = Vec::with_capacity((rank_count as usize).min(GUILD_RANKS_MAX_COUNT));
+    let mut rank_rights = Vec::with_capacity(capacity_hint(rank_count, GUILD_RANKS_MAX_COUNT));
     for _ in 0..rank_count {
         rank_rights.push(read_u32_le(r)?);
     }
 
-    let mut members = Vec::with_capacity((member_count as usize).min(ROSTER_CAPACITY_HINT_CAP));
+    let mut members = Vec::with_capacity(capacity_hint(member_count, ROSTER_CAPACITY_HINT_CAP));
     for _ in 0..member_count {
         let mut member = GuildRosterMember {
             guid: read_u64_le(r)?,
@@ -566,7 +566,9 @@ pub struct GuildEventNotice {
 pub(super) fn read_guild_event(r: &mut impl Read) -> io::Result<GuildEventNotice> {
     let event = read_u8(r)?;
     let param_count = read_u8(r)?;
-    let mut params = Vec::with_capacity(param_count as usize);
+    // No protocol bound (`Server/Packets/Guild.h:222`, a vector); the events carry one to three
+    // strings, so 16 is generous.
+    let mut params = Vec::with_capacity(capacity_hint(param_count, 16));
     for _ in 0..param_count {
         params.push(read_cstring(r)?);
     }
diff --git a/crates/benilla-protocol/src/messages/loot.rs b/crates/benilla-protocol/src/messages/loot.rs
index 5868b25c..7f5e23ad 100644
--- a/crates/benilla-protocol/src/messages/loot.rs
+++ b/crates/benilla-protocol/src/messages/loot.rs
@@ -10,7 +10,7 @@
 
 use std::io;
 
-use crate::wire::{read_u32_le, read_u64_le, read_u8};
+use crate::wire::{capacity_hint, read_u32_le, read_u64_le, read_u8};
 
 /// One item row on the normal shape of `SMSG_LOOT_RESPONSE` (vmangos `LootMgr.cpp:837-845` the
 /// `LootItem` write, wrapped by the slot index + trailing slot-type byte the caller appends around
@@ -377,7 +377,9 @@ pub(super) fn read_loot_all_passed(r: &mut &[u8]) -> io::Result<LootAllPassed> {
 /// and filters the list by loot-XP distance and `IsAllowedLooter` (`Group.cpp:914-940`).
 pub(super) fn read_loot_master_list(r: &mut &[u8]) -> io::Result<Vec<u64>> {
     let count = read_u8(r)?;
-    let mut candidates = Vec::with_capacity(count as usize);
+    // The candidates are group members (`Group.cpp:914-940`): vmangos `MAX_RAID_SIZE` 40
+    // (`Group/Group.h:50`).
+    let mut candidates = Vec::with_capacity(capacity_hint(count, 40));
     for _ in 0..count {
         candidates.push(read_u64_le(r)?);
     }
@@ -398,7 +400,9 @@ pub(super) fn read_loot_response(r: &mut &[u8]) -> io::Result<(u64, LootResponse
     }
     let gold = read_u32_le(r)?;
     let count = read_u8(r)?;
-    let mut items = Vec::with_capacity(count as usize);
+    // The loot view indexes both lists by one `u8`: `MAX_NR_LOOT_ITEMS` 16 + `MAX_NR_QUEST_ITEMS`
+    // 32 (vmangos `LootMgr.h:34,36`).
+    let mut items = Vec::with_capacity(capacity_hint(count, 16 + 32));
     for _ in 0..count {
         let slot = read_u8(r)?;
         let item_id = read_u32_le(r)?;
diff --git a/crates/benilla-protocol/src/messages/mail.rs b/crates/benilla-protocol/src/messages/mail.rs
index 1ecbb337..8335bdd5 100644
--- a/crates/benilla-protocol/src/messages/mail.rs
+++ b/crates/benilla-protocol/src/messages/mail.rs
@@ -7,7 +7,7 @@
 
 use std::io;
 
-use crate::wire::{read_cstring, read_f32_le, read_u32_le, read_u64_le, read_u8};
+use crate::wire::{capacity_hint, read_cstring, read_f32_le, read_u32_le, read_u64_le, read_u8};
 
 /// `MAIL_ITEM (5)` on [`MailListEntry::message_type`] carries no sender bytes at all — the only
 /// branch of the four that reads nothing before the subject cstring (VERIFIED vmangos
@@ -106,7 +106,6 @@ pub fn get_mail_list(mailbox: u64) -> Vec<u8> {
 /// a `u8 0`) — the 1.12.1 tail vmangos read-skips without interpreting. vmangos *discards* the
 /// client's `stationery`/`package` choice: player mail is always stored `MAIL_STATIONERY_DEFAULT`
 /// (41), so both fields exist only to keep the reader aligned.
-#[allow(clippy::too_many_arguments)]
 pub fn send_mail(
     mailbox: u64,
     receiver: &str,
@@ -210,7 +209,8 @@ pub fn item_text_query(text_id: u32, mail_id: u32) -> Vec<u8> {
 /// expireDays, u32 mailTemplateId`.
 pub(super) fn read_mail_list_result(r: &mut &[u8]) -> io::Result<Vec<MailListEntry>> {
     let count = read_u8(r)?;
-    let mut mails = Vec::with_capacity(count as usize);
+    // vmangos stops the list at 254 (`MailHandler.cpp:761`, `mailsCount >= 254`).
+    let mut mails = Vec::with_capacity(capacity_hint(count, 254));
     for _ in 0..count {
         let message_id = read_u32_le(r)?;
         let message_type = read_u8(r)?;
diff --git a/crates/benilla-protocol/src/messages/meeting_stone.rs b/crates/benilla-protocol/src/messages/meeting_stone.rs
index 9b772b68..3200d6ab 100644
--- a/crates/benilla-protocol/src/messages/meeting_stone.rs
+++ b/crates/benilla-protocol/src/messages/meeting_stone.rs
@@ -1,5 +1,6 @@
-//! The meeting-stone queue's wire (decision 1963; wow-re `staticpopup-dialog-bindings.md` §8):
-//! the server's queue state and the leave request `CancelMeetingStoneRequest` sends.
+//! The meeting-stone queue's wire (decisions 1963/1974/2283; wow-re `staticpopup-dialog-bindings.md`
+//! §8 and `meeting-stone-status.md` §8/§9/§10): the server's queue state, the JOIN a right-click on
+//! the stone sends, and the leave request `CancelMeetingStoneRequest` sends.
 
 use std::io::{self, Read};
 
@@ -21,6 +22,15 @@ pub(super) fn read_meeting_stone_set_queue(r: &mut impl Read) -> io::Result<Meet
     })
 }
 
+/// Body of `CMSG 0x292` (VERIFIED, builder `0x4c9ff0`): one full little-endian `u64` — the guid of
+/// the `GAMEOBJECT_TYPE_MEETINGSTONE` (23) the player right-clicked, written by the 8-byte guid
+/// writer `0x418370` straight after `PutUInt32(0x292)`. Nothing else is in the packet: the area is
+/// the SERVER's to resolve from the stone's `gameobject_template.data[2]`, which is why the join
+/// names an object and the reply names an area.
+pub fn meeting_stone_join(go_guid: u64) -> Vec<u8> {
+    go_guid.to_le_bytes().to_vec()
+}
+
 /// Body of `CMSG 0x293` (VERIFIED, `0x4ca120`): empty.
 pub fn meeting_stone_leave() -> Vec<u8> {
     Vec::new()
@@ -51,3 +61,25 @@ pub(super) fn read_meeting_stone_member_added(r: &mut impl Read) -> io::Result<M
 pub(super) fn read_meeting_stone_join_failed(r: &mut impl Read) -> io::Result<MeetingStoneNotice> {
     Ok(MeetingStoneNotice::JoinFailed { code: read_u8(r)? })
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    /// The join body is the bare guid, little-endian, eight bytes and no more — `0x4c9ff0` writes
+    /// `PutUInt32(0x292)` into the header and then exactly one `0x418370` (the 8-byte guid writer).
+    #[test]
+    fn cmsg_meetingstone_join_body_golden() {
+        assert_eq!(
+            meeting_stone_join(0x1234_5678_9abc_def0),
+            vec![0xf0, 0xde, 0xbc, 0x9a, 0x78, 0x56, 0x34, 0x12],
+            "CMSG_MEETINGSTONE_JOIN body"
+        );
+    }
+
+    /// Both of the other two sends in this family are empty bodies.
+    #[test]
+    fn the_leave_body_is_empty() {
+        assert!(meeting_stone_leave().is_empty());
+    }
+}
diff --git a/crates/benilla-protocol/src/messages/mod.rs b/crates/benilla-protocol/src/messages/mod.rs
index 8f00e15d..5465d11d 100644
--- a/crates/benilla-protocol/src/messages/mod.rs
+++ b/crates/benilla-protocol/src/messages/mod.rs
@@ -173,7 +173,9 @@ pub use mail::{
     mail_mark_as_read, mail_message_type, mail_return_to_sender, mail_take_item, mail_take_money,
     send_mail, MailAttachment, MailListEntry,
 };
-pub use meeting_stone::{meeting_stone_leave, MeetingStoneNotice, MeetingStoneSetQueue};
+pub use meeting_stone::{
+    meeting_stone_join, meeting_stone_leave, MeetingStoneNotice, MeetingStoneSetQueue,
+};
 pub use mirror_timer::{
     read_pause_mirror_timer, read_start_mirror_timer, read_stop_mirror_timer, MirrorTimerKind,
     MirrorTimerStart,
@@ -184,7 +186,7 @@ pub use movement::{
 pub use opcode_names::opcode_name;
 pub use packet::{CreatureQueryInfo, MonsterMoveFacing, ServerPacket};
 pub use page_text::page_text_query;
-pub use parse::parse_server;
+pub use parse::{parse_server, parse_server_with_tail};
 pub use pet::{
     pet_abandon, pet_action, pet_cancel_aura, pet_rename, pet_set_action, pet_spell_autocast,
     pet_stop_attack, pet_tame_failure_key, pet_unlearn, PetActionEntry, PetMode, PetSpellCooldown,
@@ -217,7 +219,8 @@ pub use quest::{
     QUEST_EMOTE_COUNT, QUEST_OBJECTIVES_COUNT, QUEST_REWARDS_COUNT, QUEST_REWARD_CHOICES_COUNT,
 };
 pub use reputation::{
-    set_faction_at_war, set_faction_inactive, set_watched_faction, WATCHED_FACTION_NONE,
+    set_faction_at_war, set_faction_inactive, set_watched_faction, FACTION_LIST_LEN,
+    WATCHED_FACTION_NONE,
 };
 pub use roster::{
     CharCreateReq, CharEnumItem, Character, CHARACTER_FLAG_GHOST, CHARACTER_FLAG_HIDE_CLOAK,
@@ -256,6 +259,7 @@ pub use trade::{
 };
 pub use trainer::{train_fail, trainer_buy_spell, trainer_list, trainer_spell_state, TrainerSpell};
 pub use tutorial::{tutorial_flag, TutorialFlags};
+pub use update_object::field;
 pub use update_object::{
     power_display_scale, quest_slot_state, CorpseLook, CreateSpline, MovementBlock, MoverState,
     Object, ObjectFields, ObjectType, OwnerFallback, PlayerSkillSlot, QuestLogSlot, UnitAuraSlot,
diff --git a/crates/benilla-protocol/src/messages/monster_move.rs b/crates/benilla-protocol/src/messages/monster_move.rs
index 76e0b27f..8cb9b20f 100644
--- a/crates/benilla-protocol/src/messages/monster_move.rs
+++ b/crates/benilla-protocol/src/messages/monster_move.rs
@@ -19,8 +19,8 @@ use std::io;
 
 use crate::messages::{MonsterMoveFacing, ServerPacket};
 use crate::wire::{
-    packed_to_vector3d, read_f32_le, read_i32_le, read_packed_guid, read_u32_le, read_u64_le,
-    read_u8, Vector3d,
+    capacity_hint, packed_to_vector3d, read_f32_le, read_i32_le, read_packed_guid, read_u32_le,
+    read_u64_le, read_u8, Vector3d,
 };
 
 /// `MonsterMoveType::Stop` (`SMSG_MONSTER_MOVE`).
@@ -148,10 +148,9 @@ fn read_monster_move_spline(r: &mut &[u8], catmull_rom: bool) -> io::Result<Vec<
     let count = read_u32_le(r)?;
     // Cap the *pre-allocation* (not the read) at a sane bound — a corrupt `count` must not reserve GBs;
     // the read itself still errors the instant the (bounded) body underruns.
-    let cap = count.min(0xFFFF) as usize;
     if catmull_rom {
         // Absolute control points, verbatim.
-        let mut points = Vec::with_capacity(cap);
+        let mut points = Vec::with_capacity(capacity_hint(count, 0xFFFF));
         for _ in 0..count {
             points.push(Vector3d::read(r)?);
         }
@@ -162,7 +161,7 @@ fn read_monster_move_spline(r: &mut &[u8], catmull_rom: bool) -> io::Result<Vec<
         return Ok(Vec::new());
     }
     let endpoint = Vector3d::read(r)?;
-    let mut points = Vec::with_capacity(cap);
+    let mut points = Vec::with_capacity(capacity_hint(count, 0xFFFF));
     // `count == 2` ⇒ the producer skipped its offset loop entirely (`last_idx > 1`); the destination is
     // the whole payload, and the caller pairs it with the packet's exact `start`.
     let offsets = if count > 2 { count - 1 } else { 0 };
diff --git a/crates/benilla-protocol/src/messages/opcode.rs b/crates/benilla-protocol/src/messages/opcode.rs
index 2729344a..a82486b9 100644
--- a/crates/benilla-protocol/src/messages/opcode.rs
+++ b/crates/benilla-protocol/src/messages/opcode.rs
@@ -362,6 +362,23 @@ pub const SMSG_SPELL_FAILED_OTHER: u16 = 0x02A6; // 678
 /// chain `CharProc` consumes once and zeroes (decision 0955). Body in [`super::spells`].
 pub const SMSG_SPELL_UPDATE_CHAIN_TARGETS: u16 = 0x0330; // 816
 
+/// The **talent spell-modifier** pair (VERIFIED vmangos `Opcodes_1_12_1.h`: 614/615) — the only
+/// feed for every talent that cheapens a spell, shortens its cast or cooldown, extends its range
+/// or radius, or lengthens its duration. Body in [`super::spells::read_set_spell_modifier`];
+/// decision-level law in wow-re `system/spell/scratch/spellmod-table-law.md`.
+///
+/// **One handler, two tables.** Both opcodes register to `Spell_C::HandleSetSpellModifier
+/// 0x6e9950` (`0x6e7245`/`0x6e7255`), which reads the same 6-byte body either way and forks on the
+/// opcode alone (`6e9989: cmp edi,0x267`): `0x266` stores into the FLAT table `0xcead60`, `0x267`
+/// into the PCT table `0xcecb30`, each `i32[64][29]`. The store is a plain `mov`, so the server
+/// sends the **absolute** value of one cell, never a delta (vmangos `Player::SendSpellMod` sends
+/// one packet per set mask bit carrying that pair's total).
+///
+/// That is why the two share a variant here rather than taking one each: the wire shape is
+/// identical and the opcode IS the discriminant, exactly as the reference treats it.
+pub const SMSG_SET_FLAT_SPELL_MODIFIER: u16 = 0x0266; // 614
+pub const SMSG_SET_PCT_SPELL_MODIFIER: u16 = 0x0267; // 615
+
 // The cooldown wire (VERIFIED vmangos `Opcodes_1_12_1.h`: 308/176/309/478/481; the client
 // handlers are byte-verified in wow-re `wave-handlers.md` — 0x6e9460/0x6e95d0/0x6e9670/0x6e9730;
 // decision 0137 phase 4). Bodies in [`super::spells`].
@@ -1161,6 +1178,16 @@ pub const CMSG_AREA_SPIRIT_HEALER_QUEUE: u16 = 0x02E3; // 739
 /// healer with a positive time arms the deadline and fires `AREA_SPIRIT_HEALER_IN_RANGE`
 /// (decision 1963).
 pub const SMSG_AREA_SPIRIT_HEALER_TIME: u16 = 0x02E4; // 740
+/// The meeting stone's JOIN — the packet a right-click on a `GAMEOBJECT_TYPE_MEETINGSTONE` (23)
+/// sends: `u64 gameObjectGuid`, built and sent by `0x4c9ff0` from the tail (`0x5f6af6`) of that
+/// type's own use-slot validator `0x5f69d0` = `[0x80bf40+0x1c]` (decision 2283, VERIFIED by
+/// wow-re's §5 round on that function). Twelve bytes on the wire, body exactly eight, no padding.
+///
+/// A meeting stone **cannot** send [`CMSG_GAMEOBJ_USE`]: the shared sender `0x5f33e0` has zero
+/// direct callers and is reachable only as some vtable's `+0x1c`, which type 23's is not. And
+/// vmangos would drop it anyway — `GameObject::Use` has an explicit do-nothing type-23 arm
+/// (`GameObject.cpp:1836`, "Should never be called for this type of object").
+pub const CMSG_MEETINGSTONE_JOIN: u16 = 0x0292; // 658
 /// `CancelMeetingStoneRequest()`'s packet (§8): EMPTY. Gated client-side on party leadership
 /// only; clears nothing — the server's `0x295` reply does (decision 1963). The emulators' name
 /// for this number does not line up with the client's block; the number is what is verified.
diff --git a/crates/benilla-protocol/src/messages/packet.rs b/crates/benilla-protocol/src/messages/packet.rs
index cbf12a9f..fb23212e 100644
--- a/crates/benilla-protocol/src/messages/packet.rs
+++ b/crates/benilla-protocol/src/messages/packet.rs
@@ -731,7 +731,7 @@ pub enum ServerPacket {
     },
     /// `SMSG_CANCEL_AUTO_REPEAT` — stop our own ranged auto-repeat visual; self-only, empty body
     /// (vmangos `WorldPackets::Misc::CancelAutoRepeat`). Consumed by the local cancel funnel
-    /// (`net/apply/spells.rs::cancel_auto_repeat`, decision 0406). vmangos DOES send it —
+    /// (`net/apply/spells.rs::cancel_auto_repeat`, decision 2273). vmangos DOES send it —
     /// `SpellCaster::InterruptSpell` → `Player::SendAutoRepeatCancel`, on every player autorepeat
     /// interrupt, target death included (corrected 2026-08-05; the earlier "zero send sites" note
     /// here was wrong).
@@ -764,6 +764,26 @@ pub enum ServerPacket {
         slot: u32,
         seconds: u32,
     },
+    /// `SMSG_SET_FLAT_SPELL_MODIFIER` / `SMSG_SET_PCT_SPELL_MODIFIER` — one cell of one of the two
+    /// talent spell-modifier tables, absolutely (layout + the index law in
+    /// [`super::spells::read_set_spell_modifier`]).
+    ///
+    /// One variant for both opcodes because the reference has one handler for both
+    /// (`0x6e9950`), reading the identical body and forking on the opcode alone to pick the table
+    /// — so `flat` IS the opcode, and nothing else differs.
+    SpellModifier {
+        /// `true` = `0x266`, the FLAT table (summed and added); `false` = `0x267`, the PCT table
+        /// (summed, then `+100`, clamped at 0, then used as a raw multiplier).
+        flat: bool,
+        /// The spell's `SpellFamilyFlags` **bit index**, 0..=63 — the table's row. The wire does
+        /// not bound it (the reference's own store overruns into the neighbouring global on a
+        /// 64); the consumer refuses it.
+        mask_bit: u8,
+        /// The SpellModOp, 0..=28 — the table's column. Likewise unbounded on the wire.
+        op: u8,
+        /// The cell's new value, **signed** and **absolute** — never a delta.
+        value: i32,
+    },
     /// `SMSG_COOLDOWN_EVENT` — start an on-hold (`SPELL_ATTR_COOLDOWN_ON_EVENT`) cooldown's
     /// parked timers now (layout in [`super::spellbook::read_cooldown_event`]).
     CooldownEvent {
@@ -964,8 +984,8 @@ pub enum ServerPacket {
         blocks: Vec<super::gossip::NpcTextBlock>,
     },
     /// `SMSG_LIST_INVENTORY` — a vendor's stock, answering `CMSG_LIST_INVENTORY` (vmangos
-    /// `ItemHandler.cpp:741-810`). Empty stock sends `count = 0` plus a trailing error byte the
-    /// parser leaves unconsumed.
+    /// `ItemHandler.cpp:741-810`). Empty stock sends `count = 0` plus one error byte (always 0,
+    /// "Vendor has no inventory") that the parser consumes and drops.
     VendorList {
         vendor: u64,
         items: Vec<VendorItem>,
@@ -1752,6 +1772,14 @@ impl ServerPacket {
             ServerPacket::ItemCooldown { .. } => "SMSG_ITEM_COOLDOWN".into(),
             ServerPacket::ItemTime { .. } => "SMSG_ITEM_TIME_UPDATE".into(),
             ServerPacket::ItemEnchantTime { .. } => "SMSG_ITEM_ENCHANT_TIME_UPDATE".into(),
+            // The opcode IS the table, so the name recovers it — unlike the collapsed
+            // `AttackSwingError` arm above, nothing here is lost.
+            ServerPacket::SpellModifier { flat, .. } => if *flat {
+                "SMSG_SET_FLAT_SPELL_MODIFIER"
+            } else {
+                "SMSG_SET_PCT_SPELL_MODIFIER"
+            }
+            .into(),
             ServerPacket::CooldownEvent { .. } => "SMSG_COOLDOWN_EVENT".into(),
             ServerPacket::ClearCooldown { .. } => "SMSG_CLEAR_COOLDOWN".into(),
             ServerPacket::CooldownCheat { .. } => "SMSG_COOLDOWN_CHEAT".into(),
diff --git a/crates/benilla-protocol/src/messages/parse.rs b/crates/benilla-protocol/src/messages/parse.rs
index 78da65f1..877b27d1 100644
--- a/crates/benilla-protocol/src/messages/parse.rs
+++ b/crates/benilla-protocol/src/messages/parse.rs
@@ -6,8 +6,8 @@
 use std::io::{self, Read};
 
 use crate::wire::{
-    read_cstring, read_f32_le, read_packed_guid, read_u16_le, read_u32_le, read_u64_le, read_u8,
-    Vector3d,
+    capacity_hint, read_cstring, read_f32_le, read_packed_guid, read_u16_le, read_u32_le,
+    read_u64_le, read_u8, Vector3d,
 };
 
 use super::{
@@ -233,9 +233,45 @@ fn skip(r: &mut &[u8], n: usize) -> Option<()> {
     (r.len() >= n).then(|| *r = &r[n..])
 }
 
+/// Decode one server packet body into its [`ServerPacket`]. The body is the whole length-framed
+/// packet, so a decoder that reads fewer bytes than the server wrote succeeds all the same; that
+/// gap is what [`parse_server_with_tail`] reports, and this is its `(packet, _)` projection.
 pub fn parse_server(opcode: u16, body: &[u8]) -> io::Result<ServerPacket> {
+    parse_server_with_tail(opcode, body).map(|(packet, _)| packet)
+}
+
+/// [`parse_server`], also reporting the **tail**: how many of `body`'s bytes the decoder left
+/// unconsumed. A body is length-framed, so a decoder shorter than the server's layout does not
+/// fail — it silently reads a prefix, and the next field the server added is invisible from
+/// outside. A non-zero tail is the instrument for that drift (decision 2265 §B1): the reader
+/// surfaces it on [`crate::Poll::Events`], the app announces it once per opcode. It is a count,
+/// never a failure — a working decoder with a trailing field it has no use for stays working.
+/// An unknown opcode ([`ServerPacket::Other`]) consumes nothing by definition and reports `0`,
+/// so the tally does not double-count what the dropped-packet tally already names.
+pub fn parse_server_with_tail(opcode: u16, body: &[u8]) -> io::Result<(ServerPacket, usize)> {
     let mut r = body;
-    Ok(match opcode {
+    // `inner_tail` is the one arm that decodes through a second stream (the compressed update
+    // object): the outer cursor ends at the zlib stream's end, and what the INFLATED bytes left
+    // unread is that packet's tail.
+    let mut inner_tail = 0;
+    let packet = parse_server_body(opcode, &mut r, &mut inner_tail)?;
+    let tail = match packet {
+        ServerPacket::Other { .. } => 0,
+        _ => r.len() + inner_tail,
+    };
+    Ok((packet, tail))
+}
+
+/// The opcode → variant dispatch over a slice cursor. `cursor` is advanced past what the arm read
+/// **only on success** (an error's partial read is nobody's business); the arms themselves keep
+/// the plain `&[u8]` local every helper is typed over.
+fn parse_server_body(
+    opcode: u16,
+    cursor: &mut &[u8],
+    inner_tail: &mut usize,
+) -> io::Result<ServerPacket> {
+    let mut r: &[u8] = cursor;
+    let packet = match opcode {
         opcode::SMSG_AUTH_CHALLENGE => ServerPacket::AuthChallenge {
             server_seed: read_u32_le(&mut r)?,
         },
@@ -284,7 +320,9 @@ pub fn parse_server(opcode: u16, body: &[u8]) -> io::Result<ServerPacket> {
         }
         opcode::SMSG_CHAR_ENUM => {
             let count = read_u8(&mut r)?;
-            let mut characters = Vec::with_capacity(count as usize);
+            // Hint bounded by the realm's character cap: vmangos clamps `CharactersPerRealm` to
+            // 10 (`World.cpp:629`, `setConfigMinMax(…, 10, 1, 10)`).
+            let mut characters = Vec::with_capacity(capacity_hint(count, 10));
             for _ in 0..count {
                 characters.push(Character::read(&mut r)?);
             }
@@ -310,13 +348,19 @@ pub fn parse_server(opcode: u16, body: &[u8]) -> io::Result<ServerPacket> {
         },
         opcode::SMSG_COMPRESSED_UPDATE_OBJECT => {
             let _decompressed_size = read_u32_le(&mut r)?;
-            let mut decoder = flate2::read::ZlibDecoder::new(r);
+            // Through `&mut r`, so the cursor advances over the compressed bytes. Handed `r` by
+            // value the decoder reads a COPY of the slice, and the whole zlib body then reads
+            // as unconsumed — 803 bytes on the decode-length instrument's first live login
+            // (2266 §B1). The tail that means drift here is the inflated stream's, reported
+            // through `inner_tail`.
+            let mut decoder = flate2::read::ZlibDecoder::new(&mut r);
             let mut decompressed = Vec::new();
             decoder.read_to_end(&mut decompressed)?;
+            drop(decoder);
             let mut dr = decompressed.as_slice();
-            ServerPacket::UpdateObject {
-                objects: update_object::read_update_object(&mut dr)?,
-            }
+            let objects = update_object::read_update_object(&mut dr)?;
+            *inner_tail = dr.len();
+            ServerPacket::UpdateObject { objects }
         }
         opcode::SMSG_COMPRESSED_MOVES => ServerPacket::CompressedMoves {
             packets: read_compressed_moves(&mut r)?,
@@ -572,7 +616,7 @@ pub fn parse_server(opcode: u16, body: &[u8]) -> io::Result<ServerPacket> {
             // untargeted emote arrives as the empty string — which is precisely the "untargeted"
             // bit of the sentence-form selector, not a missing value.
             let namelen = read_u32_le(&mut r)? as usize;
-            let mut name = Vec::with_capacity(namelen.min(64));
+            let mut name = Vec::with_capacity(capacity_hint(namelen, 64));
             for _ in 0..namelen {
                 name.push(read_u8(&mut r)?);
             }
@@ -771,6 +815,16 @@ pub fn parse_server(opcode: u16, body: &[u8]) -> io::Result<ServerPacket> {
                 seconds,
             }
         }
+        // One body, two tables — the opcode picks, exactly as `0x6e9950`'s `cmp edi,0x267` does.
+        opcode::SMSG_SET_FLAT_SPELL_MODIFIER | opcode::SMSG_SET_PCT_SPELL_MODIFIER => {
+            let (mask_bit, op, value) = spells::read_set_spell_modifier(&mut r)?;
+            ServerPacket::SpellModifier {
+                flat: opcode == opcode::SMSG_SET_FLAT_SPELL_MODIFIER,
+                mask_bit,
+                op,
+                value,
+            }
+        }
         opcode::SMSG_COOLDOWN_EVENT => {
             let (spell_id, caster) = spellbook::read_cooldown_event(&mut r)?;
             ServerPacket::CooldownEvent { spell_id, caster }
@@ -1152,7 +1206,9 @@ pub fn parse_server(opcode: u16, body: &[u8]) -> io::Result<ServerPacket> {
         }
         opcode::SMSG_INITIALIZE_FACTIONS => {
             let count = read_u32_le(&mut r)?;
-            let mut standings = Vec::with_capacity(count as usize);
+            // The array is exactly `MAX_FACTION_COUNT` 64 entries long (`FACTION_LIST_LEN`).
+            let mut standings =
+                Vec::with_capacity(capacity_hint(count, super::reputation::FACTION_LIST_LEN));
             for _ in 0..count {
                 let flags = read_u8(&mut r)?;
                 let standing = read_u32_le(&mut r)? as i32;
@@ -1162,7 +1218,9 @@ pub fn parse_server(opcode: u16, body: &[u8]) -> io::Result<ServerPacket> {
         }
         opcode::SMSG_SET_FACTION_STANDING => {
             let count = read_u32_le(&mut r)?;
-            let mut standings = Vec::with_capacity(count as usize);
+            // At most one row per reputation-list slot (`FACTION_LIST_LEN`).
+            let mut standings =
+                Vec::with_capacity(capacity_hint(count, super::reputation::FACTION_LIST_LEN));
             for _ in 0..count {
                 let list_id = read_u32_le(&mut r)?;
                 let standing = read_u32_le(&mut r)? as i32;
@@ -1653,5 +1711,100 @@ pub fn parse_server(opcode: u16, body: &[u8]) -> io::Result<ServerPacket> {
             statuses: read_addon_info(&mut r),
         },
         other => ServerPacket::Other { opcode: other },
-    })
+    };
+    *cursor = r;
+    Ok(packet)
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    /// The tail is the decoder's unconsumed remainder: a known-good body reports 0, the same body
+    /// with one byte appended reports 1, and neither is an error.
+    #[test]
+    fn a_trailing_byte_is_reported_as_tail_one_and_never_as_a_failure() {
+        // `SMSG_SET_FACTION_VISIBLE`: exactly one `u32 repListId`.
+        let body = 21u32.to_le_bytes().to_vec();
+        let (packet, tail) = parse_server_with_tail(opcode::SMSG_SET_FACTION_VISIBLE, &body)
+            .expect("a well-formed body decodes");
+        assert!(matches!(
+            packet,
+            ServerPacket::SetFactionVisible { list_id: 21 }
+        ));
+        assert_eq!(tail, 0);
+
+        let mut longer = body.clone();
+        longer.push(0xEE);
+        let (packet, tail) = parse_server_with_tail(opcode::SMSG_SET_FACTION_VISIBLE, &longer)
+            .expect("a trailing byte is not a parse failure");
+        assert!(matches!(
+            packet,
+            ServerPacket::SetFactionVisible { list_id: 21 }
+        ));
+        assert_eq!(tail, 1);
+        // …and the projection every existing caller uses is unchanged by it.
+        assert!(parse_server(opcode::SMSG_SET_FACTION_VISIBLE, &longer).is_ok());
+    }
+
+    /// The compressed update object decodes through a second stream. Its zlib bytes are consumed
+    /// through the cursor (a copy of the slice read the whole body as a tail — 803 bytes on the
+    /// instrument's first live login), and the tail it reports is what the INFLATED stream left
+    /// unread — the one leftover that means the inner layout drifted.
+    #[test]
+    fn the_compressed_update_object_reports_the_inflated_streams_tail_not_its_zlib_bytes() {
+        use std::io::Write;
+        fn body(inflated: &[u8]) -> Vec<u8> {
+            let mut out = (inflated.len() as u32).to_le_bytes().to_vec();
+            let mut z = flate2::write::ZlibEncoder::new(Vec::new(), flate2::Compression::default());
+            z.write_all(inflated).unwrap();
+            out.extend(z.finish().unwrap());
+            out
+        }
+        // `u32 count = 0, u8 has_transport = 0`: a well-formed, empty object list.
+        let empty = [0u8, 0, 0, 0, 0];
+        let (packet, tail) =
+            parse_server_with_tail(opcode::SMSG_COMPRESSED_UPDATE_OBJECT, &body(&empty))
+                .expect("an empty update object decodes");
+        assert!(matches!(packet, ServerPacket::UpdateObject { ref objects } if objects.is_empty()));
+        assert_eq!(tail, 0, "the zlib bytes are consumed, not reported");
+
+        let mut longer = empty.to_vec();
+        longer.push(0xEE);
+        let (_, tail) =
+            parse_server_with_tail(opcode::SMSG_COMPRESSED_UPDATE_OBJECT, &body(&longer))
+                .expect("a trailing inflated byte is not a failure");
+        assert_eq!(tail, 1, "the inflated stream's leftover is the tail");
+    }
+
+    /// An unknown opcode consumes nothing by definition; reporting its whole body as a tail would
+    /// double-count what the dropped-packet tally already names.
+    #[test]
+    fn an_unknown_opcode_reports_no_tail() {
+        let (packet, tail) =
+            parse_server_with_tail(0xFFFF, &[1, 2, 3]).expect("unknown opcodes never fail");
+        assert!(matches!(packet, ServerPacket::Other { opcode: 0xFFFF }));
+        assert_eq!(tail, 0);
+    }
+
+    /// **The falsifier for decision 2265 §B1**: a wire count of `0xFFFF_FFFF` followed by one
+    /// valid row must come back as a short-read `Err` — never reserve the count, never abort.
+    #[test]
+    fn a_lying_faction_count_is_a_short_read_not_an_allocation() {
+        let mut body = 0xFFFF_FFFFu32.to_le_bytes().to_vec();
+        body.push(0x01); // flags
+        body.extend_from_slice(&3000i32.to_le_bytes()); // standing
+        let err = parse_server(opcode::SMSG_INITIALIZE_FACTIONS, &body)
+            .err()
+            .expect("the second row is missing, so the read is short");
+        assert_eq!(err.kind(), io::ErrorKind::UnexpectedEof);
+
+        let mut body = 0xFFFF_FFFFu32.to_le_bytes().to_vec();
+        body.extend_from_slice(&5u32.to_le_bytes());
+        body.extend_from_slice(&(-100i32).to_le_bytes());
+        let err = parse_server(opcode::SMSG_SET_FACTION_STANDING, &body)
+            .err()
+            .expect("the second row is missing, so the read is short");
+        assert_eq!(err.kind(), io::ErrorKind::UnexpectedEof);
+    }
 }
diff --git a/crates/benilla-protocol/src/messages/pet.rs b/crates/benilla-protocol/src/messages/pet.rs
index 5b58449f..9bfcb92d 100644
--- a/crates/benilla-protocol/src/messages/pet.rs
+++ b/crates/benilla-protocol/src/messages/pet.rs
@@ -22,7 +22,7 @@
 
 use std::io::{self, Read};
 
-use crate::wire::{read_u16_le, read_u32_le, read_u64_le, read_u8, Vector3d};
+use crate::wire::{capacity_hint, read_u16_le, read_u32_le, read_u64_le, read_u8, Vector3d};
 
 /// Pet action-bar slots (vmangos `MAX_UNIT_ACTION_BAR_INDEX` = `ACTION_BAR_INDEX_END(10) -
 /// ACTION_BAR_INDEX_START(0)`, `Objects/UnitDefines.h:781-787`); the client's own
@@ -286,7 +286,8 @@ pub(super) fn read_pet_spells(r: &mut &[u8]) -> io::Result<PetSpells> {
     }
 
     let spell_count = read_u8(r)?;
-    let mut spells = Vec::with_capacity(spell_count as usize);
+    // A `u8` count with no tighter server bound (`Player.cpp:17471`, `uint8 addlist`).
+    let mut spells = Vec::with_capacity(capacity_hint(spell_count, usize::from(u8::MAX)));
     for _ in 0..spell_count {
         spells.push(read_u32_le(r)?.into());
     }
@@ -321,16 +322,19 @@ pub(super) fn read_pet_spells(r: &mut &[u8]) -> io::Result<PetSpells> {
 /// discriminator is exact, not a heuristic — and the day vmangos is fixed, this keeps working.
 fn read_cooldown_block(r: &mut &[u8]) -> io::Result<Vec<PetSpellCooldown>> {
     let count = usize::from(read_u8(r)?);
-    if count == 0 {
-        // vmangos leaves its count's high byte behind; the client's form leaves nothing. Either
-        // way there is nothing to read, and trailing slack is not an error.
-        return Ok(Vec::new());
-    }
+    // The discriminator holds at `count == 0` too: vmangos's lone leftover is its `u16` count's
+    // high byte, the client's form leaves nothing. The byte is consumed rather than left behind
+    // so an empty block is not a tail for the decode-length check to announce (decision 2265
+    // §B1); either way nothing else is read and no entry is invented.
     let vmangos = r.len() == 1 + 14 * count;
     if vmangos {
         let _high_byte = read_u8(r)?;
     }
-    let mut cooldowns = Vec::with_capacity(count);
+    if count == 0 {
+        return Ok(Vec::new());
+    }
+    // `count` came off a `u8` (above); no tighter bound exists on either producer.
+    let mut cooldowns = Vec::with_capacity(capacity_hint(count, usize::from(u8::MAX)));
     for _ in 0..count {
         let spell_id = if vmangos {
             read_u32_le(r)?
@@ -697,11 +701,19 @@ mod tests {
     }
 
     /// A pet with no cooldowns at all: the client's form ends the packet, vmangos's leaves its
-    /// count's high byte behind. Neither is an error and neither invents an entry.
+    /// count's high byte behind. Neither is an error and neither invents an entry — and the
+    /// high byte is consumed, so neither leaves a tail.
     #[test]
     fn an_empty_cooldown_block_reads_either_way() {
-        assert!(read_cooldown_block(&mut &[0u8][..]).unwrap().is_empty());
-        assert!(read_cooldown_block(&mut &[0u8, 0][..]).unwrap().is_empty());
+        let mut client = &[0u8][..];
+        assert!(read_cooldown_block(&mut client).unwrap().is_empty());
+        assert!(client.is_empty());
+        let mut vmangos = &[0u8, 0][..];
+        assert!(read_cooldown_block(&mut vmangos).unwrap().is_empty());
+        assert!(
+            vmangos.is_empty(),
+            "vmangos's count high byte is consumed, not left as a tail"
+        );
     }
 
     /// The teardown: an 8-byte body of zero guid ⇒ a default value whose `pet_guid` is 0. This is
diff --git a/crates/benilla-protocol/src/messages/petition.rs b/crates/benilla-protocol/src/messages/petition.rs
index 5f45a7e8..595b94d7 100644
--- a/crates/benilla-protocol/src/messages/petition.rs
+++ b/crates/benilla-protocol/src/messages/petition.rs
@@ -42,7 +42,9 @@
 
 use std::io::{self, Read};
 
-use crate::wire::{read_cstring, read_i32_le, read_u16_le, read_u32_le, read_u64_le, read_u8};
+use crate::wire::{
+    capacity_hint, read_cstring, read_i32_le, read_u16_le, read_u32_le, read_u64_le, read_u8,
+};
 
 /// The one item that is a guild charter — vmangos `GUILD_CHARTER` (`PetitionsHandler.cpp:37`),
 /// also `Item::IsCharter`'s literal (`Item.h:158`, `GetEntry() == 5863u`). Confirmed against this
@@ -147,7 +149,9 @@ pub struct PetitionShowList {
 pub(super) fn read_petition_show_list(r: &mut impl Read) -> io::Result<PetitionShowList> {
     let npc = read_u64_le(r)?;
     let count = read_u8(r)?;
-    let mut entries = Vec::with_capacity(count as usize);
+    // vmangos sends exactly one charter (`PetitionsHandler.cpp:503`, `entries = { entry }`);
+    // 8 is generous.
+    let mut entries = Vec::with_capacity(capacity_hint(count, 8));
     for _ in 0..count {
         entries.push(PetitionShowListEntry {
             index: read_u32_le(r)?,
@@ -209,7 +213,8 @@ pub(super) fn read_petition_show_signatures(
     let owner = read_u64_le(r)?;
     let petition_id = read_u32_le(r)?;
     let count = read_u8(r)?;
-    let mut signatures = Vec::with_capacity(count as usize);
+    // "Client hard limit at 9 signatures" (vmangos `PetitionsHandler.cpp:269-270`).
+    let mut signatures = Vec::with_capacity(capacity_hint(count, 9));
     for _ in 0..count {
         signatures.push(PetitionSignature {
             signer: read_u64_le(r)?,
@@ -325,7 +330,7 @@ pub(super) fn read_petition_query_response(r: &mut impl Read) -> io::Result<Peti
     let allowed_min_level = read_u32_le(r)?;
     let allowed_max_level = read_u32_le(r)?;
     let choice_count = read_u32_le(r)?;
-    let mut choices = Vec::with_capacity(choice_count.min(64) as usize);
+    let mut choices = Vec::with_capacity(capacity_hint(choice_count, 64));
     for _ in 0..choice_count {
         choices.push(read_cstring(r)?);
     }
diff --git a/crates/benilla-protocol/src/messages/quest/giver.rs b/crates/benilla-protocol/src/messages/quest/giver.rs
index 1c6aad2d..08ece1aa 100644
--- a/crates/benilla-protocol/src/messages/quest/giver.rs
+++ b/crates/benilla-protocol/src/messages/quest/giver.rs
@@ -18,7 +18,7 @@
 
 use std::io;
 
-use crate::wire::{read_cstring, read_i32_le, read_u32_le, read_u64_le, read_u8};
+use crate::wire::{capacity_hint, read_cstring, read_i32_le, read_u32_le, read_u64_le, read_u8};
 
 /// `QUEST_EMOTE_COUNT` (vmangos `QuestDef.h:43`) — DETAILS always writes exactly this many emote
 /// pairs; OFFER_REWARD writes a variable count (0..=4), so only DETAILS relies on the constant.
@@ -215,7 +215,9 @@ fn read_item_triple(r: &mut &[u8]) -> io::Result<QuestRewardItem> {
 /// Read a count-prefixed run of item triples (`u32 count` then that many triples).
 fn read_item_block(r: &mut &[u8]) -> io::Result<Vec<QuestRewardItem>> {
     let count = read_u32_le(r)?;
-    let mut items = Vec::with_capacity(count as usize);
+    // The wider of the two lists this reads: `QUEST_REWARD_CHOICES_COUNT` 6 (vmangos
+    // `QuestDef.h:39`; the fixed rewards are `QUEST_REWARDS_COUNT` 4).
+    let mut items = Vec::with_capacity(capacity_hint(count, 6));
     for _ in 0..count {
         items.push(read_item_triple(r)?);
     }
@@ -237,7 +239,9 @@ pub(in crate::messages) fn read_questgiver_quest_list(r: &mut &[u8]) -> io::Resu
     let emote_delay = read_u32_le(r)?;
     let emote = read_u32_le(r)?;
     let count = read_u8(r)?;
-    let mut quests = Vec::with_capacity(count as usize);
+    // No server cap (the quest menu is a vector, `GossipDef.h:184`); `GOSSIP_MAX_MENU_ITEMS` 32
+    // (`GossipDef.h:32`) is the client's display limit.
+    let mut quests = Vec::with_capacity(capacity_hint(count, 32));
     for _ in 0..count {
         quests.push(QuestListEntry {
             quest_id: read_u32_le(r)?,
@@ -375,7 +379,8 @@ pub(in crate::messages) fn read_questgiver_quest_complete(
     let xp = read_u32_le(r)?;
     let money = read_u32_le(r)?;
     let count = read_u32_le(r)?;
-    let mut items = Vec::with_capacity(count as usize);
+    // `QUEST_REWARDS_COUNT` 4 (vmangos `QuestDef.h:40`).
+    let mut items = Vec::with_capacity(capacity_hint(count, 4));
     for _ in 0..count {
         items.push((read_u32_le(r)?, read_u32_le(r)?));
     }
diff --git a/crates/benilla-protocol/src/messages/reputation.rs b/crates/benilla-protocol/src/messages/reputation.rs
index 62f0f852..673e0961 100644
--- a/crates/benilla-protocol/src/messages/reputation.rs
+++ b/crates/benilla-protocol/src/messages/reputation.rs
@@ -25,6 +25,14 @@
 //! its own optimistic flag copy, exactly as it owns the collapse state. The watched index comes back
 //! as a `PLAYER_FIELD_WATCHED_FACTION_INDEX` descriptor update.
 
+/// The length of the reputation-list array `SMSG_INITIALIZE_FACTIONS` is positional in — vmangos
+/// `WorldPackets::Misc::InitializeFactions::MAX_FACTION_COUNT` (`Server/Packets/Misc.h:607`), the
+/// `std::array<FactionInitEntry, 64>` the packet is built over. Every `repListId` on this wire —
+/// the `SMSG_SET_FACTION_STANDING` / `SMSG_SET_FACTION_VISIBLE` slot, and the three send verbs' —
+/// is an index into that array, so one past it is not a faction and a store sized from it is a
+/// store sized from a lie (decision 2265 §B1).
+pub const FACTION_LIST_LEN: usize = 64;
+
 /// The `PLAYER_FIELD_WATCHED_FACTION_INDEX` / `CMSG_SET_WATCHED_FACTION` sentinel for "watch no
 /// faction" — see the module header on why it cannot be `0`.
 pub const WATCHED_FACTION_NONE: i32 = -1;
diff --git a/crates/benilla-protocol/src/messages/social.rs b/crates/benilla-protocol/src/messages/social.rs
index 2f074ae2..7058a1a4 100644
--- a/crates/benilla-protocol/src/messages/social.rs
+++ b/crates/benilla-protocol/src/messages/social.rs
@@ -30,7 +30,7 @@
 
 use std::io::{self, Read};
 
-use crate::wire::{read_cstring, read_u32_le, read_u64_le, read_u8};
+use crate::wire::{capacity_hint, read_cstring, read_u32_le, read_u64_le, read_u8};
 
 /// `SMSG_FRIEND_STATUS`'s result byte — vmangos's `FriendsResult` (`SocialMgr.h:81-110`), which is
 /// the client's own enum: `FriendList::HandleResult 0x5acab0` switches on it and displays
@@ -130,7 +130,8 @@ impl FriendEntry {
 /// an online one 21.
 pub fn read_friend_list(r: &mut impl Read) -> io::Result<Vec<FriendEntry>> {
     let count = read_u8(r)?;
-    let mut friends = Vec::with_capacity(count as usize);
+    // vmangos `SOCIALMGR_FRIEND_LIMIT` 50 (`SocialMgr.h:114`).
+    let mut friends = Vec::with_capacity(capacity_hint(count, 50));
     for _ in 0..count {
         let mut entry = FriendEntry {
             guid: read_u64_le(r)?,
@@ -254,7 +255,7 @@ pub struct WhoResults {
 pub fn read_who(r: &mut impl Read) -> io::Result<WhoResults> {
     let displayed = read_u32_le(r)?;
     let total = read_u32_le(r)?;
-    let mut entries = Vec::with_capacity(displayed.min(64) as usize);
+    let mut entries = Vec::with_capacity(capacity_hint(displayed, 64));
     for _ in 0..displayed {
         entries.push(WhoEntry {
             name: read_cstring(r)?,
diff --git a/crates/benilla-protocol/src/messages/spellbook.rs b/crates/benilla-protocol/src/messages/spellbook.rs
index 1956a83d..e28126ad 100644
--- a/crates/benilla-protocol/src/messages/spellbook.rs
+++ b/crates/benilla-protocol/src/messages/spellbook.rs
@@ -17,7 +17,7 @@
 
 use std::io::{self, Read};
 
-use crate::wire::{read_u16_le, read_u32_le, read_u64_le, read_u8};
+use crate::wire::{capacity_hint, read_u16_le, read_u32_le, read_u64_le, read_u8};
 
 /// One active cooldown from `SMSG_INITIAL_SPELLS`' second list (vmangos `SendInitialSpells`):
 /// `u16 spell, u16 castItem, u16 category, u32 spellCdMs, u32 categoryCdMs`. A *permanent*
@@ -38,13 +38,15 @@ pub struct SpellCooldown {
 pub(super) fn read_initial_spells(r: &mut impl Read) -> io::Result<(Vec<u16>, Vec<SpellCooldown>)> {
     let _ = read_u8(r)?;
     let n = read_u16_le(r)?;
-    let mut spells = Vec::with_capacity(n as usize);
+    // No protocol bound on either list (`Player::SendInitialSpells` walks the spell map); a
+    // 1.12 spellbook is a few hundred entries, so 1024 is generous.
+    let mut spells = Vec::with_capacity(capacity_hint(n, 1024));
     for _ in 0..n {
         spells.push(read_u16_le(r)?);
         let _ = read_u16_le(r)?;
     }
     let m = read_u16_le(r)?;
-    let mut cooldowns = Vec::with_capacity(m as usize);
+    let mut cooldowns = Vec::with_capacity(capacity_hint(m, 1024));
     for _ in 0..m {
         cooldowns.push(SpellCooldown {
             spell_id: read_u16_le(r)?,
diff --git a/crates/benilla-protocol/src/messages/spells.rs b/crates/benilla-protocol/src/messages/spells.rs
index eef7f96b..3f5339c6 100644
--- a/crates/benilla-protocol/src/messages/spells.rs
+++ b/crates/benilla-protocol/src/messages/spells.rs
@@ -24,7 +24,8 @@
 use std::io::{self, Read};
 
 use crate::wire::{
-    read_cstring, read_packed_guid, read_u16_le, read_u32_le, read_u64_le, read_u8, Vector3d,
+    capacity_hint, read_cstring, read_i32_le, read_packed_guid, read_u16_le, read_u32_le,
+    read_u64_le, read_u8, Vector3d,
 };
 
 /// `SMSG_CAST_RESULT`'s verdict: `u32 spellId, u8 status` — status `0` (`SPELL_RESULT_STATUS_OKAY`)
@@ -106,7 +107,7 @@ pub struct SpellCastTargets {
     pub mask: u16,
     pub unit_target: Option<u64>,
     /// The GameObject this cast targets (`TARGET_FLAG_GAMEOBJECT`) — an open-lock cast on a chest / locked
-    /// door rides here. Surfaced for the GO lid/door open animation (decision 0250); a unit spell leaves
+    /// door rides here. Surfaced for the GO lid/door open animation (decision 2271); a unit spell leaves
     /// it `None`. Mutually exclusive with `unit_target` in practice (the writer emits one guid).
     pub go_target: Option<u64>,
     pub dest: Option<Vector3d>,
@@ -242,13 +243,15 @@ pub(super) fn read_spell_go(r: &mut impl Read) -> io::Result<SpellGo> {
     let spell_id = read_u32_le(r)?;
     let cast_flags = read_u16_le(r)?;
 
+    // Both counts are `u8` placeholders the server writes back over (`Spell.cpp:4607-4609`);
+    // no tighter bound exists.
     let hit_count = read_u8(r)?;
-    let mut hits = Vec::with_capacity(hit_count as usize);
+    let mut hits = Vec::with_capacity(capacity_hint(hit_count, usize::from(u8::MAX)));
     for _ in 0..hit_count {
         hits.push(read_u64_le(r)?); // raw guid (Spell.cpp:4627,4635) — the hit list is never packed
     }
     let miss_count = read_u8(r)?;
-    let mut misses = Vec::with_capacity(miss_count as usize);
+    let mut misses = Vec::with_capacity(capacity_hint(miss_count, usize::from(u8::MAX)));
     for _ in 0..miss_count {
         let guid = read_u64_le(r)?;
         let reason = read_u8(r)?;
@@ -312,6 +315,39 @@ pub(super) fn read_channel_update(r: &mut impl Read) -> io::Result<u32> {
     read_u32_le(r)
 }
 
+/// Read `SMSG_SET_FLAT_SPELL_MODIFIER` / `SMSG_SET_PCT_SPELL_MODIFIER` → `(mask_bit, op, value)`.
+///
+/// **Exactly 6 bytes, and the first byte is the one that is easy to get backwards.** The single
+/// handler `Spell_C::HandleSetSpellModifier 0x6e9950` reads `u8` (`6e9963`), `u8` (`6e996e`), `i32`
+/// (`6e9979`) — the widths are the stream accessors' own (`0x418cb0` advances the cursor by 1,
+/// `0x418e30` by 4) — and then stores at `imul eax,eax,0x1d; add eax,ecx`, i.e.
+/// **`index = field1 * 29 + field2`**. The reader `GetSpellModifiers 0x6e6b30` strength-reduces
+/// the same index to `4*op + 0x74*i` over a loop counter `i` bounded by `cmp eax,0x40`, which
+/// forces `field1 = i` (the `SpellFamilyFlags` **bit index**, 0..63) and `field2 = op` (the
+/// SpellModOp, 0..28) uniquely — and only that assignment fills the 64×29 table exactly
+/// (`29*63 + 28 == 1855`). The transposed reading addresses 47% of the array and would make the
+/// writer and the reader touch systematically disjoint cells, dropping every modifier silently.
+/// wow-re `system/spell/scratch/spellmod-table-law.md` §1/§3 — which was written to correct
+/// exactly that inversion in a note that had carried it, `verified`, for months.
+///
+/// **vmangos's writer says the same thing from the other end**, which is worth having because the
+/// client-side roles were published inverted once already: `Player::SendSpellMod`
+/// (`Objects/Player.cpp:17815`) loops `for (int eff = 0; eff < 64; ++eff)` over the modifier's
+/// 64-bit `mask` and, for each set bit, writes `uint8(eff)`, `uint8(mod->op)`, `int32(val)` — one
+/// packet per set bit, `val` the SUM of every matching modifier, i.e. absolute. `MAX_SPELLMOD`
+/// there is **29** (`Spells/SpellDefines.h`), the stride.
+///
+/// Both bytes are `movzx`-ed (unsigned); the value's signedness is fixed three independent ways by
+/// the reader (`sets dl` on the pct sum, `fild dword`, and a signed magic-divide). Neither byte is
+/// bounds-checked by the reference — that is the consumer's job, and
+/// `benilla::spell_mods::SpellModifiers` does it; this decode owns the shape only.
+pub(super) fn read_set_spell_modifier(r: &mut impl Read) -> io::Result<(u8, u8, i32)> {
+    let mask_bit = read_u8(r)?;
+    let op = read_u8(r)?;
+    let value = read_i32_le(r)?;
+    Ok((mask_bit, op, value))
+}
+
 /// Read `SMSG_UPDATE_AURA_DURATION` → `(slot, remaining_ms)` (vmangos
 /// `SpellAuraHolder::UpdateAuraDuration`, `SpellAuras.cpp:7511-7523`): a `u8` `UNIT_FIELD_AURA` slot
 /// index and a `u32` of milliseconds left. **Self-only** — it goes to the aura's target, never to
@@ -514,6 +550,37 @@ mod tests {
             "the body is exactly 5 bytes — slot is a byte, not a dword"
         );
     }
+
+    /// The spell-modifier body, byte for byte — and the field ORDER, which is the whole trap.
+    #[test]
+    fn set_spell_modifier_body_golden() {
+        // mask_bit 35 (0x23) · op 14 (0x0e, SPELLMOD_COST) · value -30 (0xFFFF_FFE2 LE).
+        let body = [0x23, 0x0E, 0xE2, 0xFF, 0xFF, 0xFF];
+        let mut r = &body[..];
+        assert_eq!(read_set_spell_modifier(&mut r).unwrap(), (35, 14, -30));
+        assert!(
+            r.is_empty(),
+            "the body is exactly 6 bytes — two bytes and a dword, never three dwords"
+        );
+
+        // The two bytes are NOT interchangeable, and this body is chosen so that a swap is
+        // detectable rather than plausible: 35 is a legal mask bit (0..=63) and an ILLEGAL op
+        // (0..=28), so a decode that read them the other way round would hand the consumer an op
+        // of 35 — off the end of the table's 29-wide axis.
+        let (mask_bit, op, _) = read_set_spell_modifier(&mut &body[..]).unwrap();
+        assert!(
+            mask_bit >= 29,
+            "field 1 would be an out-of-range op if swapped"
+        );
+        assert!(op < 29, "field 2 is a legal op as read");
+
+        // Both bytes are unsigned (`movzx`) and the value is signed: 0xFF in field 1 is bit 255,
+        // not -1, and it is the consumer that must refuse it.
+        assert_eq!(
+            read_set_spell_modifier(&mut &[0xFF, 0xFF, 0x01, 0x00, 0x00, 0x00][..]).unwrap(),
+            (255, 255, 1)
+        );
+    }
 }
 
 /// One decoded `SMSG_SPELL_UPDATE_CHAIN_TARGETS` — the **beam's hop list** (decision 0955).
diff --git a/crates/benilla-protocol/src/messages/stable.rs b/crates/benilla-protocol/src/messages/stable.rs
index f31f23ed..df2491b7 100644
--- a/crates/benilla-protocol/src/messages/stable.rs
+++ b/crates/benilla-protocol/src/messages/stable.rs
@@ -21,7 +21,7 @@
 
 use std::io;
 
-use crate::wire::{read_cstring, read_u32_le, read_u64_le, read_u8};
+use crate::wire::{capacity_hint, read_cstring, read_u32_le, read_u64_le, read_u8};
 
 /// One row of `MSG_LIST_STABLED_PETS` (vmangos `WorldSession::SendStablePet`,
 /// `NPCHandler.cpp:522-575`) — a pet the stable master can show, whether it is the one currently at
@@ -173,7 +173,8 @@ pub(super) fn read_list_stabled_pets(r: &mut &[u8]) -> io::Result<(u64, u8, Vec<
     let npc = read_u64_le(r)?;
     let num_pets = read_u8(r)?;
     let num_stable_slots = read_u8(r)?;
-    let mut pets = Vec::with_capacity(num_pets as usize);
+    // The current pet plus the stable slots: 1 + vmangos `MAX_PET_STABLES` 2 (`Objects/Pet.h:37`).
+    let mut pets = Vec::with_capacity(capacity_hint(num_pets, 1 + 2));
     for _ in 0..num_pets {
         // Struct-literal fields evaluate top-to-bottom, so this reads in wire order.
         pets.push(StabledPet {
diff --git a/crates/benilla-protocol/src/messages/trainer.rs b/crates/benilla-protocol/src/messages/trainer.rs
index 39cde4ed..844a815d 100644
--- a/crates/benilla-protocol/src/messages/trainer.rs
+++ b/crates/benilla-protocol/src/messages/trainer.rs
@@ -8,7 +8,7 @@
 
 use std::io;
 
-use crate::wire::{read_cstring, read_u32_le, read_u64_le, read_u8};
+use crate::wire::{capacity_hint, read_cstring, read_u32_le, read_u64_le, read_u8};
 
 /// One trainer service (`SMSG_TRAINER_LIST`, vmangos `SendTrainerSpellHelper`,
 /// `NPCHandler.cpp:97-139`) — a spell or tradeskill step the trainer can teach. The 38-byte wire
@@ -96,7 +96,9 @@ pub(super) fn read_trainer_list(
     let trainer = read_u64_le(r)?;
     let trainer_type = read_u32_le(r)?;
     let count = read_u32_le(r)?;
-    let mut services = Vec::with_capacity(count as usize);
+    // No protocol bound: the list is every spell the trainer's template carries (vmangos
+    // `NPCHandler.cpp:170` sums its two lists). 1024 is far past any real trainer.
+    let mut services = Vec::with_capacity(capacity_hint(count, 1024));
     for _ in 0..count {
         // Struct-literal fields evaluate top-to-bottom, so this reads in wire order.
         services.push(TrainerSpell {
diff --git a/crates/benilla-protocol/src/messages/update_object/fields/mod.rs b/crates/benilla-protocol/src/messages/update_object/fields/mod.rs
index b144b807..34ee4af4 100644
--- a/crates/benilla-protocol/src/messages/update_object/fields/mod.rs
+++ b/crates/benilla-protocol/src/messages/update_object/fields/mod.rs
@@ -1,6 +1,6 @@
 use std::io::{self, Read};
 
-use crate::wire::{read_u32_le, read_u8, Vector3d};
+use crate::wire::{capacity_hint, read_u32_le, read_u8, Vector3d};
 
 use super::movement::ObjectType;
 
@@ -17,7 +17,7 @@ const FIELD_GAMEOBJECT_FLAGS: u16 = 9;
 // spawn's local-rotation quaternion (x, y, z, w), 4 floats. The type-11 transport evaluator
 // rotates its keyframe offsets by this (decision 0438 phase 3's second consumer).
 const FIELD_GAMEOBJECT_ROTATION: u16 = 10;
-const FIELD_GAMEOBJECT_STATE: u16 = 14;
+pub const FIELD_GAMEOBJECT_STATE: u16 = 14;
 const FIELD_GAMEOBJECT_POS_X: u16 = 15;
 const FIELD_GAMEOBJECT_POS_Y: u16 = 16;
 const FIELD_GAMEOBJECT_POS_Z: u16 = 17;
@@ -32,6 +32,11 @@ const FIELD_GAMEOBJECT_FACTION: u16 = 20;
 const FIELD_GAMEOBJECT_TYPE_ID: u16 = 21;
 // GAMEOBJECT_LEVEL = OBJECT_END(6) + 0x10 (vmangos UpdateFields_1_12_1.h:317).
 const FIELD_GAMEOBJECT_LEVEL: u16 = 22;
+/// `CORPSE_FIELD_DYNAMIC_FLAGS` = `OBJECT_END(6) + 0x1E` (vmangos `UpdateFields_1_12_1.h`) — bit 0
+/// is the lootable-insignia flag [`ObjectFields::corpse_lootable`] reads and the loot-art arm
+/// watches. Named because a watch keys on the raw index, and `36` is `UNIT_FIELD_BYTES_0` on a
+/// unit: the same number means two things, which is why a field edge carries its object class.
+pub const FIELD_CORPSE_DYNAMIC_FLAGS: u16 = 36;
 // UNIT descriptor fields (verified against wow-5875-re object-layer node, build 5875; FLAGS /
 // COMBATREACH / DYNAMIC_FLAGS / NPC_FLAGS additionally cross-checked against the cursor RE's client
 // offsets `+0xa0`/`+0x1f0`/`+0x224`/`+0x234` and vmangos `UpdateFields_1_12_1.h`).
@@ -64,31 +69,31 @@ const FIELD_UNIT_CREATEDBY: u16 = 14;
 /// caster itself). Public, so an **observer** renders another unit's channel loop from this field
 /// pair, not from the self-only `MSG_CHANNEL_START`/`UPDATE` UI packets (decision 0099 phase 1).
 const FIELD_UNIT_CHANNEL_OBJECT: u16 = 20;
-const FIELD_UNIT_HEALTH: u16 = 22;
+pub const FIELD_UNIT_HEALTH: u16 = 22;
 /// `UNIT_FIELD_POWER1` — first of 5 consecutive power slots (mana, rage, focus, energy, happiness);
 /// `MAXPOWER1..5` sit symmetrically after `MAXHEALTH` (vmangos `UpdateFields_1_12_1.h`).
 const FIELD_UNIT_POWER1: u16 = 23;
-const FIELD_UNIT_MAXHEALTH: u16 = 28;
+pub const FIELD_UNIT_MAXHEALTH: u16 = 28;
 const FIELD_UNIT_MAXPOWER1: u16 = 29;
-const FIELD_UNIT_LEVEL: u16 = 34;
-const FIELD_UNIT_FACTIONTEMPLATE: u16 = 35;
+pub const FIELD_UNIT_LEVEL: u16 = 34;
+pub const FIELD_UNIT_FACTIONTEMPLATE: u16 = 35;
 const FIELD_UNIT_BYTES_0: u16 = 36;
-const FIELD_UNIT_BYTES_1: u16 = 138;
-const FIELD_UNIT_FLAGS: u16 = 46;
+pub const FIELD_UNIT_BYTES_1: u16 = 138;
+pub const FIELD_UNIT_FLAGS: u16 = 46;
 // The aura block — four parallel arrays, all PUBLIC, so every unit we can see streams its full set
 // (vmangos `UpdateFields_1_12_1.h:67-70`, `OBJECT_END(6) + 0x29/0x59/0x5F/0x6B`). wow-re places the
 // same arrays in the client at `descriptor + 0xa4` / `+0x164` (= `0x29`/`0x59` × 4 — the same field
 // indices, derived independently from the binary: `object-layer/scratch/w2d1.md`, VERIFIED).
 // Duration and caster are NOT here and are not in any other field: duration reaches only the aura's
 // own target, over `SMSG_UPDATE_AURA_DURATION`; a caster guid never reaches anyone (decision 0255).
-const FIELD_UNIT_AURA: u16 = 47;
+pub const FIELD_UNIT_AURA: u16 = 47;
 /// Nibble-packed, 8 slots per `u32` (`SpellAuraHolder::SetAuraFlag`, `SpellAuras.cpp:7456-7462`).
-const FIELD_UNIT_AURAFLAGS: u16 = 95;
+pub const FIELD_UNIT_AURAFLAGS: u16 = 95;
 /// Byte-packed, 4 slots per `u32` — the *caster's level* (`SetAuraLevel`, `SpellAuras.cpp:7484`).
 const FIELD_UNIT_AURALEVELS: u16 = 101;
 /// Byte-packed, 4 slots per `u32`, holding `stack - 1` ("field expect count-1 for proper amount
 /// show" — `UpdateAuraApplication`, `SpellAuras.cpp:7500-7507`).
-const FIELD_UNIT_AURAAPPLICATIONS: u16 = 113;
+pub const FIELD_UNIT_AURAAPPLICATIONS: u16 = 113;
 /// `UNIT_FIELD_AURASTATE` (`OBJECT_END(6) + 0x77` = 125 — vmangos `UpdateFields_1_12_1.h`) — the
 /// aura-state bit set the usable walk's CasterAuraState/TargetAuraState legs test with
 /// `1 << (state-1)` (wow-re §2a; the client reads its parsed-descriptor copy at
@@ -119,7 +124,7 @@ const FIELD_UNIT_NATIVEDISPLAYID: u16 = 132;
 /// unit is riding, `0`/absent = not mounted. The server writes it on aura-78 apply and zeroes it
 /// on every dismount path (`Unit::Mount`/`Unmount`) — this field, not the aura, IS the mounted
 /// state (`Unit::IsMounted` reads it back; no flag or bytes field accompanies it). Decision 0441.
-const FIELD_UNIT_MOUNTDISPLAYID: u16 = 133;
+pub const FIELD_UNIT_MOUNTDISPLAYID: u16 = 133;
 /// `UNIT_FIELD_PETNUMBER` (`OBJECT_END(6) + 0x85` = 139, PUBLIC — vmangos
 /// `UpdateFields_1_12_1.h:84`; byte-verified client-side as `[unit+0x110]+0x214` = relative index
 /// `0x85`, the second gate inside the rank getter `0x605620` — decision 0782). Non-zero ⇒ this
@@ -146,10 +151,10 @@ const FIELD_UNIT_PETNEXTLEVELEXP: u16 = 142;
 /// `[unit+0x110]+0x23c` / `+0x23e`: `GetPetTrainingPoints 0x4be790` pushes the **high** word first
 /// and the low word second, which `PetPaperDollFrame.lua` names `totalPoints, spent`.
 const FIELD_UNIT_TRAINING_POINTS: u16 = 149;
-const FIELD_UNIT_DYNAMIC_FLAGS: u16 = 143;
+pub const FIELD_UNIT_DYNAMIC_FLAGS: u16 = 143;
 /// `UNIT_CHANNEL_SPELL` (idx 144, `OBJECT_END(6) + 0x8A`, PUBLIC — VERIFIED vmangos
 /// `UpdateFields_1_12_1.h:89`) — the spell id a unit is channeling (`0` = not channeling).
-const FIELD_UNIT_CHANNEL_SPELL: u16 = 144;
+pub const FIELD_UNIT_CHANNEL_SPELL: u16 = 144;
 /// `UNIT_CREATED_BY_SPELL` (idx 146, `OBJECT_END(6) + 0x8C`, PUBLIC — vmangos
 /// `UpdateFields_1_12_1.h`) — the spell that summoned this unit (`0` = not summoned by one). The
 /// **first** of the three gates on the reference's feed-pet path `0x6ea1e0`: a unit with no
@@ -159,7 +164,7 @@ const FIELD_UNIT_CHANNEL_SPELL: u16 = 144;
 /// already pins both ends of a contiguous run — `PETEXPERIENCE` 141, `PETNEXTLEVELEXP` 142,
 /// `DYNAMIC_FLAGS` 143, `CHANNEL_SPELL` 144, `MOD_CAST_SPEED` 145, then this, then `NPC_FLAGS` 147.
 const FIELD_UNIT_CREATED_BY_SPELL: u16 = 146;
-const FIELD_UNIT_NPC_FLAGS: u16 = 147;
+pub const FIELD_UNIT_NPC_FLAGS: u16 = 147;
 /// `UNIT_NPC_EMOTESTATE` (`OBJECT_END + 0x8E`; PUBLIC — VERIFIED vmangos `UpdateFields_1_12_1.h:93`)
 /// — the unit's looping **state emote** as an `Emotes.dbc` id (dance, NPC cooking/working flavor).
 /// For a player it's the server echo of a state-class text emote (`HandleEmote`,
@@ -288,7 +293,23 @@ const FIELD_PLAYER_BYTES_3: u16 = 195;
 // (MAX_QUEST_LOG_SIZE, vmangos `QuestDef.h:34`) × 3 fields (MAX_QUEST_OFFSET, `Player.h:439-444`):
 // +0 quest id, +1 packed objective counters + state byte, +2 timer. The `_1` id field is GROUP_ONLY
 // and the `_2` pair PRIVATE — both always stream for our own player, the exact consumer (the log).
-const FIELD_PLAYER_QUEST_LOG_1_1: u16 = 198;
+pub const FIELD_PLAYER_QUEST_LOG_1_1: u16 = 198;
+
+/// The descriptor indices a field watch names (decision 2297) — the very constants the accessors
+/// above read through, re-exported under one roof so a watch and the accessor it mirrors cannot
+/// disagree on a number. Anything watched lives here; anything only read stays private.
+pub mod field {
+    /// The one bit a watcher tests on a raw `UNIT_DYNAMIC_FLAGS` edge (the feign-death set edge).
+    pub use super::unit::UNIT_DYNFLAG_DEAD;
+    pub use super::{
+        FIELD_CORPSE_DYNAMIC_FLAGS, FIELD_GAMEOBJECT_STATE, FIELD_PLAYER_FIELD_COINAGE,
+        FIELD_PLAYER_FLAGS, FIELD_PLAYER_INV_SLOT_HEAD, FIELD_PLAYER_QUEST_LOG_1_1,
+        FIELD_PLAYER_SKILL_INFO_1_1, FIELD_UNIT_AURA, FIELD_UNIT_AURAAPPLICATIONS,
+        FIELD_UNIT_AURAFLAGS, FIELD_UNIT_BYTES_1, FIELD_UNIT_CHANNEL_SPELL,
+        FIELD_UNIT_DYNAMIC_FLAGS, FIELD_UNIT_FACTIONTEMPLATE, FIELD_UNIT_FLAGS, FIELD_UNIT_HEALTH,
+        FIELD_UNIT_LEVEL, FIELD_UNIT_MAXHEALTH, FIELD_UNIT_MOUNTDISPLAYID, FIELD_UNIT_NPC_FLAGS,
+    };
+}
 
 /// The number of `PLAYER_QUEST_LOG` slots (vmangos `MAX_QUEST_LOG_SIZE`, `QuestDef.h:34`).
 pub const PLAYER_QUEST_LOG_SLOTS: u8 = 20;
@@ -330,7 +351,7 @@ const FIELD_CONTAINER_SLOT_1: u16 = 50; // ITEM_END + 0x2; 36 slots × 2
 // descriptor dump: with these bases One's shirt/legs/feet/mainhand/offhand/bags land on exactly
 // the slots the character visibly wears (visible-item cross-check below).
 const FIELD_PLAYER_VISIBLE_ITEM_1_CREATOR: u16 = 258; // UNIT_END + 0x46; 12 fields per slot
-const FIELD_PLAYER_INV_SLOT_HEAD: u16 = 486; // 23 slots × 2 (equipment 0–18, bag bags 19–22)
+pub const FIELD_PLAYER_INV_SLOT_HEAD: u16 = 486; // 23 slots × 2 (equipment 0–18, bag bags 19–22)
 const FIELD_PLAYER_PACK_SLOT_1: u16 = 532; // 16 slots × 2 (the backpack)
 const FIELD_PLAYER_BANK_SLOT_1: u16 = 564; // 24 slots × 2
 const FIELD_PLAYER_BANK_BAG_SLOT_1: u16 = 612; // 564 + 24×2; 6 bag slots × 2 (item guids)
@@ -360,7 +381,7 @@ const FIELD_PLAYER_BUYBACK_TIMESTAMP_1: u16 = 1238; // 12 × u32 — the client'
                                                     // stale hex comment reads 0x492 = 1170 (decision 0081 quoted "field 1170" from it — 6 low).
                                                     // Cross-checked against the corrected neighbours: 486 (INV_SLOT_HEAD) + (0x3DC − 0x12A = 690) = 1176;
                                                     // 564 (BANK_SLOT_1) + (0x3DC − 0x178 = 612) = 1176. Both agree.
-const FIELD_PLAYER_FIELD_COINAGE: u16 = 1176;
+pub const FIELD_PLAYER_FIELD_COINAGE: u16 = 1176;
 // PLAYER_XP / PLAYER_NEXT_LEVEL_XP (INT, PRIVATE — sent only for our own player, the exact consumer:
 // the MainMenuBar XP bar). Derived by the same server enum arithmetic as COINAGE above:
 // PLAYER_XP = UNIT_END(0xBC = 188) + 0x210(528) = 716; PLAYER_NEXT_LEVEL_XP = 717. Cross-checked
@@ -472,7 +493,7 @@ const FIELD_PLAYER_SELF_RES_SPELL: u16 = 1224;
 // PLAYER_FLAGS = UNIT_END(188) + 0x2 (VERIFIED vmangos `UpdateFields_1_12_1.h:120`; the duel
 // arbiter guid takes +0x0/+0x1). Bit 0x10 = PLAYER_FLAGS_GHOST (`Player.h:319`), set/cleared by
 // the ghost aura 8326's HandleAuraGhost at release/resurrect (decision 0308 §1).
-const FIELD_PLAYER_FLAGS: u16 = 190;
+pub const FIELD_PLAYER_FLAGS: u16 = 190;
 // PLAYER_DUEL_ARBITER = UNIT_END(188) + 0x0 (GUID, PUBLIC), PLAYER_DUEL_TEAM = UNIT_END + 0x8
 // (INT, PUBLIC) — VERIFIED vmangos `UpdateFields_1_12_1.h:119,126`. The arbiter opens the player
 // block, which is why the real client caches a pointer to that base (`[player+0xe68]`) and indexes
@@ -656,10 +677,14 @@ fn descriptor_len(object_type: ObjectType) -> u16 {
     }
 }
 
+/// The widest descriptor's mask-word count: `PLAYER_END` 1282 fields (the [`descriptor_len`]
+/// table) is 41 words of 32 bits. A block count past it describes no 1.12 object.
+const MAX_MASK_WORDS: usize = 1282usize.div_ceil(32);
+
 impl ObjectFields {
     pub(super) fn read(r: &mut impl Read) -> io::Result<Self> {
         let amount_of_blocks = read_u8(r)?;
-        let mut present = Vec::with_capacity(amount_of_blocks as usize);
+        let mut present = Vec::with_capacity(capacity_hint(amount_of_blocks, MAX_MASK_WORDS));
         for _ in 0..amount_of_blocks {
             present.push(read_u32_le(r)?);
         }
@@ -821,7 +846,7 @@ impl ObjectFields {
     /// handler) and the `CMSG_LOOT` route off the corpse's interact slot (wow-re
     /// `loot-anim-leg.md`).
     pub fn corpse_lootable(&self) -> bool {
-        self.get_u32(36).unwrap_or(0) & 0x01 != 0
+        self.get_u32(FIELD_CORPSE_DYNAMIC_FLAGS).unwrap_or(0) & 0x01 != 0
     }
 
     /// `CORPSE_FLAG_LOOTABLE` (`0x20`, [`Self::corpse_flags`] bit 5) — the flag that makes a body's
@@ -893,6 +918,9 @@ impl ObjectFields {
     }
 
     fn insert(&mut self, index: u16, value: u32) {
+        // `index` is a `u16`, so `word` is at most 2047 and the store at most 64 Ki values —
+        // bounded by the type, not by anything the wire says (the wire's block count above is
+        // a `u8`, 255 words at the very most).
         let word = usize::from(index / 32);
         if word >= self.present.len() {
             self.present.resize(word + 1, 0);
@@ -951,15 +979,82 @@ impl ObjectFields {
     /// dropped to zero since the last stream (an aura that expired out of view, durability that
     /// broke) — exactly the absent-vs-zero bug the `created` flag exists to kill.
     pub fn merge(&mut self, delta: ObjectFields) {
+        self.merge_diff(delta, |_, _, _| {});
+    }
+
+    /// [`Self::merge`] that also reports every dword the fold MOVED — the reference's
+    /// `CMirrorHandler` notify pass (`0x465330`: memcmp live-vs-shadow over each registered span,
+    /// fire only on a difference, the callback handed the OLD value — wow-re `object-layer.md`),
+    /// done in the one write that already holds both sides (decision 2297).
+    ///
+    /// `changed(index, old, new)` runs once per moved index, ascending, and only for a real
+    /// difference: a field re-sent with the value it already had reports nothing, exactly as the
+    /// reference's memcmp fires nothing. `old` reads an absent field as `0`, the reference's
+    /// zero-initialised array. A re-CREATE snapshot reports every index the replace moved, on
+    /// either side's mask — the reference's in-place refresh of an already-live guid goes down
+    /// its values-only path and notifies too — while a FIRST create is never merged at all (the
+    /// caller seeds the store with it), which is where the reference's create-time
+    /// notify-suppress flag lives here.
+    pub fn merge_diff(&mut self, delta: ObjectFields, mut changed: impl FnMut(u16, u32, u32)) {
         if delta.descriptor_end != 0 {
+            let words = self.present.len().max(delta.present.len());
+            for word in 0..words {
+                let mask = self.present.get(word).copied().unwrap_or(0)
+                    | delta.present.get(word).copied().unwrap_or(0);
+                if mask == 0 {
+                    continue;
+                }
+                for bit in 0..32u16 {
+                    if mask & (1u32 << bit) == 0 {
+                        continue;
+                    }
+                    let index = word as u16 * 32 + bit;
+                    let (old, new) = (
+                        self.get_raw(index).unwrap_or(0),
+                        delta.get_raw(index).unwrap_or(0),
+                    );
+                    if old != new {
+                        changed(index, old, new);
+                    }
+                }
+            }
             *self = delta;
         } else {
             for (index, value) in delta.raw_fields() {
+                let old = self.get_raw(index).unwrap_or(0);
+                if old != value {
+                    changed(index, old, value);
+                }
                 self.insert(index, value);
             }
         }
     }
 
+    /// The object class this descriptor was CREATED as, read back off its own length ([`descriptor_len`]
+    /// is injective over the eight classes) — `None` for a bare `Values` delta or a hand-built
+    /// fixture that never went through [`Self::into_created`]. Distinct from
+    /// [`Self::object_type`], the typemask read, which cannot tell a corpse from an item: a field
+    /// edge carries THIS because a raw index means different things per class (`36`: a unit's
+    /// `BYTES_0`, a corpse's `DYNAMIC_FLAGS`).
+    pub fn created_as(&self) -> Option<ObjectType> {
+        const ALL: [ObjectType; 8] = [
+            ObjectType::Object,
+            ObjectType::Item,
+            ObjectType::Container,
+            ObjectType::Unit,
+            ObjectType::Player,
+            ObjectType::GameObject,
+            ObjectType::DynamicObject,
+            ObjectType::Corpse,
+        ];
+        (self.descriptor_end != 0)
+            .then(|| {
+                ALL.into_iter()
+                    .find(|&t| descriptor_len(t) == self.descriptor_end)
+            })
+            .flatten()
+    }
+
     /// Whether this carried no fields — the codec skips emitting an empty `Values` delta.
     pub fn is_empty(&self) -> bool {
         self.present.iter().all(|&w| w == 0)
diff --git a/crates/benilla-protocol/src/messages/update_object/fields/tests.rs b/crates/benilla-protocol/src/messages/update_object/fields/tests.rs
index 3568db04..8b5f8037 100644
--- a/crates/benilla-protocol/src/messages/update_object/fields/tests.rs
+++ b/crates/benilla-protocol/src/messages/update_object/fields/tests.rs
@@ -735,6 +735,72 @@ fn merge_overlays_deltas_and_replaces_on_recreate() {
     );
 }
 
+/// The field edges a merge reports (decision 2297) — the reference's per-field notifier, whose
+/// callback fires on a memcmp DIFFERENCE and receives the old value: only the dwords that moved,
+/// ascending, absent reading as `0` on either side, and a value re-sent unchanged reporting
+/// nothing at all.
+#[test]
+fn merge_diff_reports_each_moved_dword_once_with_its_old_value() {
+    let mut store =
+        ObjectFields::from_pairs(&[(22, 100), (28, 100), (34, 9)]).into_created(ObjectType::Unit);
+    let mut edges = Vec::new();
+    // Health drops, level rises, max-health re-sent as it was, a never-seen field appears.
+    store.merge_diff(
+        ObjectFields::from_pairs(&[(34, 10), (22, 40), (28, 100), (46, 8)]),
+        |i, old, new| edges.push((i, old, new)),
+    );
+    assert_eq!(
+        edges,
+        vec![(22, 100, 40), (34, 9, 10), (46, 0, 8)],
+        "moved dwords only, ascending; absent-before reads 0; an unchanged resend is silent"
+    );
+    assert_eq!(store.unit_health(), Some(40), "the delta still lands");
+    assert_eq!(store.unit_flags(), 8);
+}
+
+/// A re-CREATE is the reference's in-place refresh of a live guid — it notifies too, and here it
+/// notifies over BOTH masks: a field the fresh snapshot omits dropped to zero, and that is an edge
+/// the store's replace makes visible (`merge_overlays_deltas_and_replaces_on_recreate` above).
+#[test]
+fn merge_diff_on_a_recreate_reports_the_replace_on_both_masks() {
+    let mut store =
+        ObjectFields::from_pairs(&[(3, 2264), (46, 30), (47, 40)]).into_created(ObjectType::Item);
+    let mut edges = Vec::new();
+    store.merge_diff(
+        ObjectFields::from_pairs(&[(3, 2264), (47, 40), (12, 7)]).into_created(ObjectType::Item),
+        |i, old, new| edges.push((i, old, new)),
+    );
+    assert_eq!(
+        edges,
+        vec![(12, 0, 7), (46, 30, 0)],
+        "the omitted durability is a 30 → 0 edge; the identical entry and max are silent"
+    );
+    assert_eq!(store.item_durability(), Some(0));
+}
+
+/// The class a store was created as reads back off its length — every class round-trips, and a
+/// bare delta (no create seen) answers nothing, which is what keeps a field edge honest about
+/// which block its index belongs to.
+#[test]
+fn created_as_reads_back_off_the_created_length() {
+    for t in [
+        ObjectType::Object,
+        ObjectType::Item,
+        ObjectType::Container,
+        ObjectType::Unit,
+        ObjectType::Player,
+        ObjectType::GameObject,
+        ObjectType::DynamicObject,
+        ObjectType::Corpse,
+    ] {
+        assert_eq!(
+            ObjectFields::default().into_created(t).created_as(),
+            Some(t)
+        );
+    }
+    assert_eq!(ObjectFields::from_pairs(&[(22, 1)]).created_as(), None);
+}
+
 /// The `DYNAMICOBJECT_*` accessors against the exact live capture (vmangos, 2026-07-30, the
 /// B132 follow-up's `--groundfx 10` run): Blizzard's dynobj create — caster guid 26, BYTES 1
 /// (area spell), SPELLID 10, RADIUS 8.0, the cast point in POS, FACING never sent.
diff --git a/crates/benilla-protocol/src/messages/update_object/fields/unit.rs b/crates/benilla-protocol/src/messages/update_object/fields/unit.rs
index df1ca392..b41f2084 100644
--- a/crates/benilla-protocol/src/messages/update_object/fields/unit.rs
+++ b/crates/benilla-protocol/src/messages/update_object/fields/unit.rs
@@ -8,7 +8,7 @@ use super::*;
 /// reads it as "this body is a corpse" wherever it reads health for display; the server sets it for
 /// **feign death** and for `CREATURE_FLAG_EXTRA_APPEAR_DEAD` spawns, in both cases with health left
 /// intact. Every consumer goes through [`ObjectFields::unit_reads_dead`] (decision 1022).
-const UNIT_DYNFLAG_DEAD: u32 = 0x20;
+pub const UNIT_DYNFLAG_DEAD: u32 = 0x20;
 
 /// `UNIT_STAND_STATE_DEAD` (vmangos `UnitDefines.h:109`) — the third leg of the client's
 /// reads-dead predicate `0x605f90`. vmangos never writes it, so it is inert against our server.
diff --git a/crates/benilla-protocol/src/messages/update_object/mod.rs b/crates/benilla-protocol/src/messages/update_object/mod.rs
index 46c7b531..3e09adc1 100644
--- a/crates/benilla-protocol/src/messages/update_object/mod.rs
+++ b/crates/benilla-protocol/src/messages/update_object/mod.rs
@@ -7,11 +7,12 @@
 
 use std::io::{self, Read};
 
-use crate::wire::{read_packed_guid, read_u32_le, read_u8};
+use crate::wire::{capacity_hint, read_packed_guid, read_u32_le, read_u8};
 
 mod fields;
 mod movement;
 
+pub use fields::field;
 pub use fields::{
     power_display_scale, quest_slot_state, CorpseLook, ObjectFields, OwnerFallback,
     PlayerSkillSlot, QuestLogSlot, UnitAuraSlot, AURA_FLAG_CANCELABLE, AURA_FLAG_EFF_INDEX_MASK,
@@ -92,7 +93,7 @@ impl Object {
 
 fn read_guid_list(r: &mut impl Read) -> io::Result<Vec<u64>> {
     let count = read_u32_le(r)?;
-    let mut guids = Vec::with_capacity(count.min(0xFFFF) as usize);
+    let mut guids = Vec::with_capacity(capacity_hint(count, 0xFFFF));
     for _ in 0..count {
         guids.push(read_packed_guid(r)?);
     }
@@ -103,7 +104,7 @@ fn read_guid_list(r: &mut impl Read) -> io::Result<Vec<u64>> {
 pub(super) fn read_update_object(r: &mut impl Read) -> io::Result<Vec<Object>> {
     let amount_of_objects = read_u32_le(r)?;
     let _has_transport = read_u8(r)?;
-    let mut objects = Vec::with_capacity(amount_of_objects.min(0xFFFF) as usize);
+    let mut objects = Vec::with_capacity(capacity_hint(amount_of_objects, 0xFFFF));
     for _ in 0..amount_of_objects {
         objects.push(Object::read(r)?);
     }
diff --git a/crates/benilla-protocol/src/messages/update_object/movement.rs b/crates/benilla-protocol/src/messages/update_object/movement.rs
index d901fe62..6e770110 100644
--- a/crates/benilla-protocol/src/messages/update_object/movement.rs
+++ b/crates/benilla-protocol/src/messages/update_object/movement.rs
@@ -4,7 +4,9 @@ use crate::messages::movement::{
     TransportPose, MOVEMENT_FLAG_JUMPING, MOVEMENT_FLAG_ON_TRANSPORT,
     MOVEMENT_FLAG_SPLINE_ELEVATION, MOVEMENT_FLAG_SPLINE_ENABLED, MOVEMENT_FLAG_SWIMMING,
 };
-use crate::wire::{read_f32_le, read_packed_guid, read_u32_le, read_u64_le, read_u8, Vector3d};
+use crate::wire::{
+    capacity_hint, read_f32_le, read_packed_guid, read_u32_le, read_u64_le, read_u8, Vector3d,
+};
 
 /// Object class (the `TypeId` on a create packet).
 #[derive(Debug, Clone, Copy, PartialEq, Eq)]
@@ -227,7 +229,7 @@ impl MovementBlock {
                 let duration_ms = read_u32_le(r)?;
                 let id = read_u32_le(r)?;
                 let amount_of_nodes = read_u32_le(r)?;
-                let mut nodes = Vec::with_capacity(amount_of_nodes.min(0xFFFF) as usize);
+                let mut nodes = Vec::with_capacity(capacity_hint(amount_of_nodes, 0xFFFF));
                 for _ in 0..amount_of_nodes {
                     let v = Vector3d::read(r)?;
                     nodes.push([v.x, v.y, v.z]);
diff --git a/crates/benilla-protocol/src/messages/vendor.rs b/crates/benilla-protocol/src/messages/vendor.rs
index 3369cd24..80012a8c 100644
--- a/crates/benilla-protocol/src/messages/vendor.rs
+++ b/crates/benilla-protocol/src/messages/vendor.rs
@@ -6,7 +6,7 @@
 
 use std::io;
 
-use crate::wire::{read_u32_le, read_u64_le, read_u8};
+use crate::wire::{capacity_hint, read_u32_le, read_u64_le, read_u8};
 
 /// One vendor row (`SMSG_LIST_INVENTORY`, vmangos `ItemHandler.cpp:741-810`). `slot` (the wire's
 /// `muid`) is the row's 1-based position in the vendor's list — **not** what buying uses; buying
@@ -130,14 +130,21 @@ pub fn repair_item(vendor_guid: u64, item_guid: u64) -> Vec<u8> {
 }
 
 /// Read `SMSG_LIST_INVENTORY` (vmangos `ItemHandler.cpp:741-810`): `u64 vendorGuid, u8 count`
-/// (≤ `MAX_VENDOR_ITEMS` 128) then `count` rows of [`VendorItem`]. The empty-vendor case sends
-/// `count = 0` followed by a trailing `u8` error byte (`ItemHandler.cpp:728-733,806-809`); this
-/// parser tolerates it by construction — the row loop simply doesn't run, so the byte is left
-/// harmlessly unconsumed rather than misread as a row.
+/// (≤ `MAX_VENDOR_ITEMS` 128) then `count` rows of [`VendorItem`]. The empty-vendor case is
+/// `count = 0` followed by one trailing `u8` — both producers write a literal `uint8(0)`
+/// ("Vendor has no inventory": `ItemHandler.cpp:728-733` for a creature with no item lists,
+/// `:806-809` for one whose every item is hidden from this player). It carries no other value
+/// on this wire, so it is consumed and dropped — consumed *explicitly*, so an empty list leaves
+/// no tail for the decode-length check to report (decision 2265 §B1).
 pub(super) fn read_list_inventory(r: &mut &[u8]) -> io::Result<(u64, Vec<VendorItem>)> {
     let vendor_guid = read_u64_le(r)?;
     let count = read_u8(r)?;
-    let mut items = Vec::with_capacity(count as usize);
+    if count == 0 {
+        let _no_inventory = read_u8(r)?;
+        return Ok((vendor_guid, Vec::new()));
+    }
+    // vmangos `MAX_VENDOR_ITEMS` 128 (`Objects/CreatureDefines.h:624`).
+    let mut items = Vec::with_capacity(capacity_hint(count, 128));
     for _ in 0..count {
         items.push(VendorItem {
             slot: read_u32_le(r)?,
diff --git a/crates/benilla-protocol/src/wire.rs b/crates/benilla-protocol/src/wire.rs
index 38c6e0e4..9023af02 100644
--- a/crates/benilla-protocol/src/wire.rs
+++ b/crates/benilla-protocol/src/wire.rs
@@ -92,6 +92,27 @@ pub fn read_cstring(r: &mut impl Read) -> io::Result<String> {
     Ok(String::from_utf8_lossy(&bytes).into_owned())
 }
 
+/// Bound a wire-derived element count before it becomes a `Vec::with_capacity` hint.
+///
+/// A count read off the wire is server- (and so bug- and attacker-) controlled, and
+/// `Vec::with_capacity(count as usize)` on a raw `u32` is the one failure the decoders' `io::Result`
+/// totality does not cover: an allocation that cannot be satisfied is `handle_alloc_error` →
+/// `abort()` — no unwind, no [`crate::Poll::Skipped`], no tally (decision 2265 §B1). The returned
+/// hint bounds only the **up-front** allocation: the `Vec` still grows past it when the body really
+/// carries more rows, and a lying count still fails on the short read of the body, which is
+/// `u16`-bounded and read whole before parse. `cap` is the protocol's own bound where one exists
+/// (cited at the call site), or a generous sane one where none does.
+///
+/// Every `with_capacity` under `messages/` whose argument is a wire count goes through this; the
+/// source-scan test beside it (`wire_count_capacity_hints_are_capped`) keeps that true.
+pub fn capacity_hint(count: impl TryInto<u64>, cap: usize) -> usize {
+    count
+        .try_into()
+        .ok()
+        .and_then(|n| usize::try_from(n).ok())
+        .map_or(cap, |n| n.min(cap))
+}
+
 /// A 3-float position/vector in raw WoW coordinates.
 #[derive(Debug, Clone, Copy, PartialEq)]
 pub struct Vector3d {
@@ -160,4 +181,173 @@ mod tests {
             assert_eq!((v.x, v.y, v.z), (x, y, z));
         }
     }
+    #[test]
+    fn capacity_hint_is_the_smaller_of_count_and_cap() {
+        assert_eq!(capacity_hint(3u8, 64), 3);
+        assert_eq!(capacity_hint(0xFFFF_FFFFu32, 64), 64);
+        assert_eq!(capacity_hint(0u32, 64), 0);
+        assert_eq!(capacity_hint(usize::MAX, 8), 8);
+        assert_eq!(capacity_hint(u64::MAX, 1024), 1024);
+    }
+
+    /// **The rule, enforced instead of remembered** (decision 2265 §B1).
+    ///
+    /// A `Vec::with_capacity` whose argument is a raw wire count aborts the process — not the
+    /// packet — the day a server (or a decoder bug) puts a huge number there: an allocation
+    /// failure never unwinds, so it never becomes `Poll::Skipped`. There is no runtime signal to
+    /// test for, which is exactly why the check is structural: every `with_capacity(` under
+    /// `messages/` whose argument is a bare variable (cast or not) must go through
+    /// [`capacity_hint`] or carry a `.min(`, or be named in [`EXEMPT`] with the reason.
+    #[test]
+    fn wire_count_capacity_hints_are_capped() {
+        let root = std::path::Path::new(env!("CARGO_MANIFEST_DIR")).join("src/messages");
+        let mut offenders = Vec::new();
+        for file in rust_files(&root) {
+            let text = std::fs::read_to_string(&file).expect("readable source");
+            let rel = file
+                .strip_prefix(&root)
+                .unwrap_or(&file)
+                .to_string_lossy()
+                .replace('\\', "/");
+            for (line_no, arg) in capacity_arguments(&text) {
+                if uncapped_wire_count(&arg) && !EXEMPT.contains(&(rel.as_str(), arg.as_str())) {
+                    offenders.push(format!("{rel}:{line_no}: `with_capacity({arg})`"));
+                }
+            }
+        }
+        assert!(
+            offenders.is_empty(),
+            "these capacity hints are raw wire counts — an unsatisfiable allocation aborts the \
+             process instead of skipping the packet. Bound each with \
+             `crate::wire::capacity_hint(count, CAP)` (CAP = the protocol's own bound, cited at \
+             the site, or a generous sane one), or add it to `EXEMPT` in `wire.rs` with the reason \
+             it is not a wire count (decision 2265 §B1):\n  {}",
+            offenders.join("\n  ")
+        );
+    }
+
+    /// `with_capacity` arguments under `messages/` that look like bare variables but are **not**
+    /// wire counts, each with the reason. Keyed `(path under src/messages/, argument text)`.
+    const EXEMPT: &[(&str, &str)] = &[];
+
+    /// The classifier, pinned on synthetic arguments so a regression in it cannot pass silently
+    /// as "nothing to flag".
+    #[test]
+    fn the_scan_flags_a_bare_wire_count_and_passes_a_bounded_one() {
+        // Flagged: a bare variable, with or without the cast, however it is wrapped.
+        for arg in [
+            "count as usize",
+            "count",
+            "(count as usize)",
+            "usize::from(count)",
+            "option_count as usize",
+            "n as usize",
+        ] {
+            assert!(uncapped_wire_count(arg), "should flag `{arg}`");
+        }
+        // Passes: literals, length arithmetic, a constant, and the two bounded forms.
+        for arg in [
+            "12",
+            "name.len() + 1",
+            "NPC_TEXT_BLOCKS",
+            "QUEST_OBJECTIVES_COUNT as usize",
+            "capacity_hint(count, 64)",
+            "(count as usize).min(64)",
+            "count.min(0xFFFF) as usize",
+            "8 + 8 * entries.len()",
+            "addons.iter().map(|a| a.name.len() + 10).sum()",
+        ] {
+            assert!(!uncapped_wire_count(arg), "should pass `{arg}`");
+        }
+        // The extractor: the balanced argument of every call on the line, with its line number.
+        let src = "let a = Vec::with_capacity(count as usize);\nlet b = Vec::with_capacity((n as usize).min(4));\n";
+        assert_eq!(
+            capacity_arguments(src),
+            vec![
+                (1, "count as usize".to_string()),
+                (2, "(n as usize).min(4)".to_string())
+            ]
+        );
+    }
+
+    /// Is this `with_capacity` argument a raw wire count? A bare identifier (optionally cast
+    /// `as usize`, optionally parenthesised, optionally `usize::from(...)`-wrapped) that is not a
+    /// `const` (all caps) and carries neither `.min(` nor `capacity_hint(`.
+    fn uncapped_wire_count(arg: &str) -> bool {
+        if arg.contains(".min(") || arg.contains("capacity_hint(") {
+            return false;
+        }
+        let mut inner = arg.trim();
+        loop {
+            let t = inner.trim();
+            if let Some(rest) = t
+                .strip_prefix("usize::from(")
+                .and_then(|r| r.strip_suffix(')'))
+            {
+                inner = rest;
+            } else if let Some(rest) = t.strip_prefix('(').and_then(|r| r.strip_suffix(')')) {
+                inner = rest;
+            } else if let Some(rest) = t.strip_suffix("as usize") {
+                inner = rest;
+            } else {
+                inner = t;
+                break;
+            }
+        }
+        let is_ident = !inner.is_empty()
+            && inner.chars().all(|c| c.is_ascii_alphanumeric() || c == '_')
+            && !inner.starts_with(|c: char| c.is_ascii_digit());
+        // A `const` is SCREAMING_CASE; a wire count is a local.
+        is_ident && inner.chars().any(|c| c.is_ascii_lowercase())
+    }
+
+    /// Every `with_capacity(` call's balanced argument text in `text`, with its 1-based line.
+    fn capacity_arguments(text: &str) -> Vec<(usize, String)> {
+        let mut out = Vec::new();
+        let needle = "with_capacity(";
+        let mut from = 0;
+        while let Some(at) = text[from..].find(needle) {
+            let open = from + at + needle.len();
+            let mut depth = 1usize;
+            let mut end = open;
+            for (i, c) in text[open..].char_indices() {
+                match c {
+                    '(' => depth += 1,
+                    ')' => {
+                        depth -= 1;
+                        if depth == 0 {
+                            end = open + i;
+                            break;
+                        }
+                    }
+                    _ => {}
+                }
+            }
+            let line = text[..open].matches('\n').count() + 1;
+            out.push((line, text[open..end].trim().to_string()));
+            from = end.max(open);
+        }
+        out
+    }
+
+    /// Every `.rs` file under `root`, recursively.
+    fn rust_files(root: &std::path::Path) -> Vec<std::path::PathBuf> {
+        let mut out = Vec::new();
+        let mut stack = vec![root.to_path_buf()];
+        while let Some(dir) = stack.pop() {
+            let Ok(entries) = std::fs::read_dir(&dir) else {
+                continue;
+            };
+            for entry in entries.flatten() {
+                let path = entry.path();
+                if path.is_dir() {
+                    stack.push(path);
+                } else if path.extension().is_some_and(|e| e == "rs") {
+                    out.push(path);
+                }
+            }
+        }
+        out.sort();
+        out
+    }
 }
diff --git a/crates/benilla-protocol/src/world/reader.rs b/crates/benilla-protocol/src/world/reader.rs
index 5b194f3f..480f574f 100644
--- a/crates/benilla-protocol/src/world/reader.rs
+++ b/crates/benilla-protocol/src/world/reader.rs
@@ -41,10 +41,11 @@ impl WorldReader {
         if let Err(e) = self.stream.read_exact(&mut body) {
             return Err(anyhow!("world stream closed: {e}"));
         }
-        match messages::parse_server(opcode, &body) {
-            Ok(packet) => Ok(crate::Poll::Events {
+        match messages::parse_server_with_tail(opcode, &body) {
+            Ok((packet, tail)) => Ok(crate::Poll::Events {
                 opcode,
                 events: crate::decode(packet),
+                tail,
             }),
             // Include the raw body (capped) so an unparseable packet can be decoded by hand — a parse
             // bug is otherwise invisible past "failed to fill whole buffer". The opcode rides
diff --git a/crates/benilla-protocol/src/world/writer/auction.rs b/crates/benilla-protocol/src/world/writer/auction.rs
index 6b4a6781..ddbaf276 100644
--- a/crates/benilla-protocol/src/world/writer/auction.rs
+++ b/crates/benilla-protocol/src/world/writer/auction.rs
@@ -36,7 +36,6 @@ impl WorldWriter {
     /// [`messages::auction_filter`]'s sentinels for the ones left unset. **No sort rides the
     /// wire**: sorting the returned page is entirely ours. `list_from` pages by
     /// [`messages::AUCTION_PAGE_SIZE`]. Answered by `SMSG_AUCTION_LIST_RESULT`.
-    #[allow(clippy::too_many_arguments)]
     pub fn auction_list_items(
         &mut self,
         auctioneer: u64,
diff --git a/crates/benilla-protocol/src/world/writer/mail.rs b/crates/benilla-protocol/src/world/writer/mail.rs
index f9a632f6..3d10954e 100644
--- a/crates/benilla-protocol/src/world/writer/mail.rs
+++ b/crates/benilla-protocol/src/world/writer/mail.rs
@@ -26,7 +26,6 @@ impl WorldWriter {
     /// COD. `stationery`/`package` ride the wire but are discarded server-side (player mail is
     /// always stored `MAIL_STATIONERY_DEFAULT`). Answered by `SMSG_SEND_MAIL_RESULT` (a
     /// `SendMailResult` event).
-    #[allow(clippy::too_many_arguments)]
     pub fn send_mail(
         &mut self,
         mailbox: u64,
diff --git a/crates/benilla-protocol/src/world/writer/meeting_stone.rs b/crates/benilla-protocol/src/world/writer/meeting_stone.rs
index 9e59dbd5..3728686e 100644
--- a/crates/benilla-protocol/src/world/writer/meeting_stone.rs
+++ b/crates/benilla-protocol/src/world/writer/meeting_stone.rs
@@ -1,4 +1,4 @@
-//! The meeting-stone queue's sends (decision 1963).
+//! The meeting-stone queue's sends (decisions 1963/2283).
 
 use anyhow::Result;
 
@@ -7,6 +7,17 @@ use crate::messages::{self, opcode};
 use super::WorldWriter;
 
 impl WorldWriter {
+    /// Join the meeting-stone queue (`CMSG 0x292`, `u64 goGuid`) — what a right-click on a
+    /// `GAMEOBJECT_TYPE_MEETINGSTONE` sends once that type's own use-slot validator has passed
+    /// its four client-side refusals (decision 2283). Never `CMSG_GAMEOBJ_USE`: the server has no
+    /// type-23 case for the shared opener.
+    pub fn meeting_stone_join(&mut self, go_guid: u64) -> Result<()> {
+        self.send(
+            opcode::CMSG_MEETINGSTONE_JOIN,
+            &messages::meeting_stone_join(go_guid),
+        )
+    }
+
     /// Leave the meeting-stone queue (`CMSG 0x293`, empty) — `CancelMeetingStoneRequest()`'s
     /// packet, sent by the party leader (or a player in no party).
     pub fn meeting_stone_leave(&mut self) -> Result<()> {
diff --git a/crates/benilla-protocol/src/world/writer/self_movement.rs b/crates/benilla-protocol/src/world/writer/self_movement.rs
index 938362dd..887dfe6c 100644
--- a/crates/benilla-protocol/src/world/writer/self_movement.rs
+++ b/crates/benilla-protocol/src/world/writer/self_movement.rs
@@ -25,7 +25,6 @@ impl WorldWriter {
     /// nearby players. `flags` must only set bits whose `MovementInfo` tail we serialize — the base
     /// directional/turn/walk bits, `JUMPING` (with its `jump` tail), `SWIMMING` (with its `pitch`
     /// tail), and `ON_TRANSPORT` (with its `transport` local-frame tail — decision 0438 phase 2).
-    #[allow(clippy::too_many_arguments)]
     pub fn send_movement(
         &mut self,
         opcode: u16,
@@ -133,7 +132,6 @@ impl WorldWriter {
     /// echo the mover `guid` + `counter` + the exact `speed` the server sent, carrying our live
     /// `MovementInfo` (same field set as [`Self::send_movement`] — the server relocates us to it).
     /// Mandatory: unacked, the server force-resolves the change after ~4 s and flags its anticheat.
-    #[allow(clippy::too_many_arguments)]
     pub fn force_speed_change_ack(
         &mut self,
         kind: messages::SpeedKind,
diff --git a/crates/benilla-protocol/tests/char_enum.rs b/crates/benilla-protocol/tests/char_enum.rs
index 76e8e42f..101754d8 100644
--- a/crates/benilla-protocol/tests/char_enum.rs
+++ b/crates/benilla-protocol/tests/char_enum.rs
@@ -12,7 +12,6 @@ use benilla_protocol::ServerPacket;
 
 /// One serialized enum entry, vmangos field order. Non-roster fields get distinct junk values so a
 /// misaligned parse can't accidentally pass.
-#[allow(clippy::too_many_arguments)]
 fn enum_entry(
     guid: u64,
     name: &str,
diff --git a/crates/benilla-protocol/tests/gossip_vendor.rs b/crates/benilla-protocol/tests/gossip_vendor.rs
index 4f0eb103..246dfd28 100644
--- a/crates/benilla-protocol/tests/gossip_vendor.rs
+++ b/crates/benilla-protocol/tests/gossip_vendor.rs
@@ -378,17 +378,42 @@ fn vendor_list_inventory_wire() {
     }
 
     // Empty stock: count = 0 followed by the trailing error byte (ItemHandler.cpp:728-733,
-    // 806-809) — the parser must tolerate it (the row loop simply never runs).
+    // 806-809) — consumed explicitly, so the decode leaves no tail to report.
     let mut empty_body = 0xDDu64.to_le_bytes().to_vec();
     empty_body.push(0); // count
     empty_body.push(0); // trailing errorByte(0)
-    match messages::parse_server(messages::opcode::SMSG_LIST_INVENTORY, &empty_body).unwrap() {
+    let (packet, tail) =
+        messages::parse_server_with_tail(messages::opcode::SMSG_LIST_INVENTORY, &empty_body)
+            .unwrap();
+    assert_eq!(tail, 0, "the error byte is part of the layout, not a tail");
+    match packet {
         ServerPacket::VendorList { vendor, items } => {
             assert_eq!(vendor, 0xDD);
             assert!(items.is_empty());
         }
         other => panic!("empty vendor list, got {}", other.name()),
     }
+    // …and the byte is REQUIRED: a count of 0 with nothing after it is the short read it is.
+    let truncated = &empty_body[..empty_body.len() - 1];
+    assert!(messages::parse_server(messages::opcode::SMSG_LIST_INVENTORY, truncated).is_err());
+}
+
+/// **The falsifier for decision 2265 §B1** on a `u32`-counted list: an option count of
+/// `0xFFFF_FFFF` followed by one valid option must come back as a short-read `Err` — the decoder
+/// must neither reserve the count nor abort.
+#[test]
+fn a_lying_gossip_option_count_is_a_short_read_not_an_allocation() {
+    let mut body = 0x77u64.to_le_bytes().to_vec(); // npc guid
+    body.extend_from_slice(&1u32.to_le_bytes()); // text id
+    body.extend_from_slice(&0xFFFF_FFFFu32.to_le_bytes()); // option count
+    body.extend_from_slice(&0u32.to_le_bytes()); // one valid option: index
+    body.push(0); // icon
+    body.push(0); // coded
+    body.extend_from_slice(b"Hello.\0"); // message
+    let err = messages::parse_server(messages::opcode::SMSG_GOSSIP_MESSAGE, &body)
+        .err()
+        .expect("the second option is missing, so the read is short");
+    assert_eq!(err.kind(), std::io::ErrorKind::UnexpectedEof);
 }
 
 #[test]
diff --git a/crates/benilla-protocol/tests/guild.rs b/crates/benilla-protocol/tests/guild.rs
index ecd2d060..ac312881 100644
--- a/crates/benilla-protocol/tests/guild.rs
+++ b/crates/benilla-protocol/tests/guild.rs
@@ -261,7 +261,6 @@ fn guild_query_response_reports_no_such_guild_as_an_empty_name() {
 /// `last_online` is passed explicitly rather than derived from `presence`, so the *fixture* states
 /// the wire rule independently of the parser under test: an offline member carries the float, an
 /// online one does not.
-#[allow(clippy::too_many_arguments)]
 fn push_member(
     body: &mut Vec<u8>,
     guid: u64,
diff --git a/crates/benilla-protocol/tests/mail.rs b/crates/benilla-protocol/tests/mail.rs
index 244772a2..b8af7981 100644
--- a/crates/benilla-protocol/tests/mail.rs
+++ b/crates/benilla-protocol/tests/mail.rs
@@ -87,7 +87,6 @@ fn mail_send_bodies_golden() {
 /// Append one 8-byte-fixed item block (the tail every `SMSG_MAIL_LIST_RESULT` row always carries,
 /// zeroed when the mail has no attachment): entry, permEnchant, randomPropId, suffixFactor u32 ×4,
 /// stackCount u8, spellCharges/durabilityMax/durabilityCur u32 ×3.
-#[allow(clippy::too_many_arguments)]
 fn push_item_block(
     body: &mut Vec<u8>,
     entry: u32,
diff --git a/crates/benilla-protocol/tests/spells.rs b/crates/benilla-protocol/tests/spells.rs
index 9f1240c6..d1782449 100644
--- a/crates/benilla-protocol/tests/spells.rs
+++ b/crates/benilla-protocol/tests/spells.rs
@@ -741,7 +741,7 @@ fn spell_visual_wire_golden() {
 
 /// An open-lock cast on a chest / locked door: `SMSG_SPELL_GO` whose `SpellCastTargets` names a
 /// GameObject (`TARGET_FLAG_GAMEOBJECT`, no unit target). The decoder must surface the GO guid so the
-/// lid/door animation can open it (decision 0250) — the guid the older decode read for alignment and
+/// lid/door animation can open it (decision 2271) — the guid the older decode read for alignment and
 /// dropped.
 #[test]
 fn spell_go_surfaces_the_gameobject_target() {
@@ -1384,3 +1384,55 @@ fn combat_log_completeness_wire() {
     ));
     assert!(messages::parse_server(messages::opcode::SMSG_SPELLLOGEXECUTE, &body).is_err());
 }
+
+/// The talent spell-modifier pair, end to end: both opcodes through `parse_server` and on into a
+/// [`SessionEvent`]. One handler, one body, and the opcode as the only discriminant — so the two
+/// bodies here are byte-identical and only the `flat` flag differs.
+#[test]
+fn spell_modifier_wire() {
+    // mask_bit 35 · op 14 (SPELLMOD_COST) · value -30. Bit 35 is deliberately past the low dword:
+    // it is a real shipped value (Cure Poison 526's only bit) and it is the half a 32-bit mask
+    // would quietly drop.
+    let body = hx("230ee2ffffff");
+    for (wire_op, is_flat) in [
+        (messages::opcode::SMSG_SET_FLAT_SPELL_MODIFIER, true),
+        (messages::opcode::SMSG_SET_PCT_SPELL_MODIFIER, false),
+    ] {
+        let packet = messages::parse_server(wire_op, &body).unwrap();
+        // The name recovers the opcode, which the collapsed-arm families cannot.
+        assert_eq!(
+            packet.name(),
+            if is_flat {
+                "SMSG_SET_FLAT_SPELL_MODIFIER"
+            } else {
+                "SMSG_SET_PCT_SPELL_MODIFIER"
+            }
+        );
+        match &packet {
+            ServerPacket::SpellModifier {
+                flat,
+                mask_bit,
+                op,
+                value,
+            } => assert_eq!((*flat, *mask_bit, *op, *value), (is_flat, 35, 14, -30)),
+            other => panic!("spell modifier, got {}", other.name()),
+        }
+        match decode(packet).pop().unwrap() {
+            SessionEvent::SpellModifier {
+                flat,
+                mask_bit,
+                op,
+                value,
+            } => assert_eq!((flat, mask_bit, op, value), (is_flat, 35, 14, -30)),
+            _ => panic!("spell modifier event"),
+        }
+    }
+
+    // Five bytes is not a body: the value is a dword, not the three bytes a "u8 u8 u8 i16" misread
+    // would take.
+    assert!(messages::parse_server(
+        messages::opcode::SMSG_SET_FLAT_SPELL_MODIFIER,
+        &hx("230ee2ffff")
+    )
+    .is_err());
+}
diff --git a/crates/benilla-protocol/tests/trainer.rs b/crates/benilla-protocol/tests/trainer.rs
index 81b78190..904e1bae 100644
--- a/crates/benilla-protocol/tests/trainer.rs
+++ b/crates/benilla-protocol/tests/trainer.rs
@@ -38,7 +38,6 @@ fn trainer_send_bodies_golden() {
 /// Append one 38-byte service record (vmangos SendTrainerSpellHelper, NPCHandler.cpp:97-139) to a
 /// SMSG_TRAINER_LIST body: spell u32, state u8, cost u32, canLearnPrimaryProf u32, isPrimaryProfFirstRank
 /// u32, reqLevel u8, reqSkill u32, reqSkillValue u32, then three prerequisite-spell u32s.
-#[allow(clippy::too_many_arguments)]
 fn push_service(
     body: &mut Vec<u8>,
     spell: u32,
diff --git a/crates/benilla-srp/Cargo.toml b/crates/benilla-srp/Cargo.toml
index 15111bc8..c9e9c663 100644
--- a/crates/benilla-srp/Cargo.toml
+++ b/crates/benilla-srp/Cargo.toml
@@ -5,6 +5,9 @@ edition.workspace = true
 license.workspace = true
 description = "WoW 1.12.1 (build 5875) SRP6 client + vanilla world-header crypto — in-repo, decision 0021"
 
+[lints]
+workspace = true
+
 [dependencies]
 num-bigint = "0.4.6"
 sha1.workspace = true
diff --git a/crates/benilla-ui/Cargo.toml b/crates/benilla-ui/Cargo.toml
index af1f704e..96f2f778 100644
--- a/crates/benilla-ui/Cargo.toml
+++ b/crates/benilla-ui/Cargo.toml
@@ -5,6 +5,9 @@ edition.workspace = true
 license.workspace = true
 description = "Engine-free WoW UI engine core: TOC/FrameXML parsing, templates, anchors, z-order — decision 0068"
 
+[lints]
+workspace = true
+
 [dependencies]
 roxmltree = "0.20"
 # The embedded Lua runtime for the script host (decision 0068). `lua51` = Classic Era's Lua
diff --git a/crates/benilla-ui/src/order.rs b/crates/benilla-ui/src/order.rs
index c05b0e43..dfc60077 100644
--- a/crates/benilla-ui/src/order.rs
+++ b/crates/benilla-ui/src/order.rs
@@ -269,7 +269,6 @@ impl ZKey {
     /// The key for one **region** of a frame. `strata`/`level`/`insertion` are the *owner frame's*
     /// (so the region stays grouped behind its frame); `is_fontstring` places textures before
     /// fontstrings at equal (layer, sub-level).
-    #[allow(clippy::too_many_arguments)]
     pub fn region(
         strata: Strata,
         level: u16,
diff --git a/crates/benilla-ui/src/script/chat_misc.rs b/crates/benilla-ui/src/script/chat_misc.rs
index 6310b89a..5952d866 100644
--- a/crates/benilla-ui/src/script/chat_misc.rs
+++ b/crates/benilla-ui/src/script/chat_misc.rs
@@ -138,9 +138,12 @@ pub(super) fn install(lua: &Lua) -> mlua::Result<()> {
         })?,
     )?;
 
-    // ConsoleExec("name value") — the console line `/console` hands over. A registered CVar is
-    // written the way `SetCVar` writes it (same store, same change queue, no CVAR_UPDATE token);
-    // anything else is a console command the app owns.
+    // ConsoleExec("name value") — the console line `/console` hands over. A registered CVar
+    // WITH a value is written the way `SetCVar` writes it (same store, same change queue, no
+    // CVAR_UPDATE token), synchronously, so a script reading it back on the next line sees the
+    // write. Everything else — a command name, or a bare CVar name, which the reference's
+    // per-CVar console command answers with `CVar "%s" is "%s"` (`0x63dde0`) — is a line for
+    // the host's command registry (decision 2303).
     g.set(
         "ConsoleExec",
         lua.create_function(|lua, line: Option<String>| {
@@ -152,10 +155,8 @@ pub(super) fn install(lua: &Lua) -> mlua::Result<()> {
                 .map_or((line.as_str(), ""), |(n, v)| (n, v.trim()));
             let mut model = lua.app_data_mut::<Model>().expect("model app_data");
             let is_cvar = model.cvars.contains_key(&name.to_ascii_lowercase());
-            if is_cvar {
-                if !value.is_empty() {
-                    super::cvars::write_cvar(&mut model, name, value.to_string(), None);
-                }
+            if is_cvar && !value.is_empty() {
+                super::cvars::write_cvar(&mut model, name, value.to_string(), None);
             } else {
                 model.console_lines.push(line.clone());
             }
@@ -251,7 +252,12 @@ mod tests {
             "0.8",
             "the CVar store is the same one SetCVar writes, matched case-insensitively"
         );
-        assert_eq!(s.take_console_lines(), vec!["reloadui".to_string()]);
+        // A bare CVar name is the host's to answer (2303: the reference prints its value from
+        // the per-CVar console command), so it rides the command lane like `reloadui`.
+        assert_eq!(
+            s.take_console_lines(),
+            vec!["reloadui".to_string(), "uiScale".to_string()]
+        );
         assert_eq!(
             s.take_cvar_changes(),
             vec![("uiScale".to_string(), "0.8".to_string())],
diff --git a/crates/benilla-ui/src/script/client.rs b/crates/benilla-ui/src/script/client.rs
index 7312f2b4..bf31c492 100644
--- a/crates/benilla-ui/src/script/client.rs
+++ b/crates/benilla-ui/src/script/client.rs
@@ -267,6 +267,31 @@ impl super::UiScript {
     ///
     /// Set at world entry from the realm the session actually connected to. Idempotent, and the
     /// empty string is a legitimate value (no realm yet), not a "clear".
+    /// Seed the **local player record** — the reference's `0xc27d80`, copied from the char-enum
+    /// row at the character-select Enter World commit (decisions 2261/2263, and see
+    /// [`super::PlayerRecord`] for the bytes and the four verbs that read it).
+    ///
+    /// Called from the world-entry UI load beside [`Self::set_realm_name`], and for the same
+    /// reason 1195 put the realm there: the values have to be in the VM before a single addon file
+    /// runs, because `local currentPlayer = UnitName("player")` at file scope is the corpus idiom.
+    /// The reference has them a whole login earlier still.
+    ///
+    /// **A record with no name is refused, not stored.** The only unset state is "no Enter World
+    /// has been committed in this process"; once the record holds a character, nothing in the
+    /// reference's image ever empties it again, so a caller with nothing to say must leave the
+    /// last answer standing rather than blank it. The write is whole-record because the
+    /// reference's is one `rep movsd`: these four fields describe one character and can never
+    /// legitimately be seeded from two.
+    pub fn set_player_record(&mut self, record: super::PlayerRecord) {
+        if record.name.is_empty() {
+            return;
+        }
+        let mut model = self.model_mut();
+        if model.player_record != record {
+            model.player_record = record;
+        }
+    }
+
     pub fn set_realm_name(&mut self, realm: &str) {
         {
             let mut model = self.model_mut();
diff --git a/crates/benilla-ui/src/script/cvars.rs b/crates/benilla-ui/src/script/cvars.rs
index 9d7207ce..bc030772 100644
--- a/crates/benilla-ui/src/script/cvars.rs
+++ b/crates/benilla-ui/src/script/cvars.rs
@@ -36,6 +36,26 @@ pub(crate) struct CvarSlot {
     pub name: String,
     pub value: String,
     pub default: String,
+    /// The reference's flag bit1 (`rec+0x1c & 0x2`, decision 2303): a write lands in
+    /// [`Self::pending`] instead of [`Self::value`], so `GetCVar` keeps answering the applied
+    /// value until the host commits the latch (`CVar::Update 0x63e060` — for the `gx*` rows,
+    /// inside `RestartGx`). Seeded by the host ([`super::UiScript::seed_cvars`]); a row the VM
+    /// registers on its own is never latched, exactly like the console `set` command's create
+    /// path in the reference.
+    pub latched: bool,
+    /// The staged value of a latched row — what the host will commit at the boundary, and what
+    /// it is told about through the change queue the moment it is written.
+    pub pending: Option<String>,
+}
+
+/// One row of the host's registry, as the VM's mirror is seeded from it (decision 2303): the
+/// registered spelling, the **applied** value, the registered default, and the latch flag.
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub struct SeededCvar {
+    pub name: String,
+    pub value: String,
+    pub default: String,
+    pub latched: bool,
 }
 
 /// One device-supported multisample format, as the Video options dropdown shows it.
@@ -173,6 +193,8 @@ impl super::UiScript {
                             name: name.to_string(),
                             value,
                             default: default.to_string(),
+                            latched: false,
+                            pending: None,
                         },
                     );
                 }
@@ -180,14 +202,44 @@ impl super::UiScript {
         }
     }
 
-    /// Host-side write (loaded config, env override): sets the value WITHOUT queueing a change
-    /// event — the host is the caller, an echo would re-dirty the file it just read. Unknown
-    /// names warn once, same posture as the Lua side.
+    /// Seed the mirror from the host's registry (decision 2303): every row's spelling, applied
+    /// value, default and latch flag, creating or overwriting the slot. This is what a fresh VM
+    /// gets at claim time and at the world-entry edge — the host's table is the store that
+    /// outlives the VM, so the mirror starts wherever it stands, and a re-seed of a live table
+    /// is the host re-asserting its truth (a staged value is dropped with it: the host holds
+    /// the pending copy and pushes it back through the outbox if it still stands).
+    ///
+    /// `&self` for [`Self::register_cvars`]'s reason — the interface loader seeds from a
+    /// `&UiScript` before the stock files read their first CVar (decision 2115).
+    pub fn seed_cvars(&self, rows: impl IntoIterator<Item = SeededCvar>) {
+        let mut model = self.model_mut();
+        for row in rows {
+            let key = row.name.to_ascii_lowercase();
+            model.cvars.insert(
+                key,
+                CvarSlot {
+                    name: row.name,
+                    value: row.value,
+                    default: row.default,
+                    latched: row.latched,
+                    pending: None,
+                },
+            );
+        }
+    }
+
+    /// Host-side write (a loaded value, a committed latch, the host registry's outbox): sets
+    /// the value WITHOUT queueing a change event — the host is the caller, an echo would
+    /// re-dirty the file it just read — and clears a staged value, because a host write IS the
+    /// commit. Unknown names warn once, same posture as the Lua side.
     pub fn set_cvar_host(&mut self, name: &str, value: &str) {
         let mut model = self.model_mut();
         let key = name.to_ascii_lowercase();
         match model.cvars.get_mut(&key) {
-            Some(slot) => slot.value = value.to_string(),
+            Some(slot) => {
+                slot.value = value.to_string();
+                slot.pending = None;
+            }
             None => warn_unknown(&mut model, name),
         }
     }
@@ -217,6 +269,14 @@ impl super::UiScript {
         std::mem::take(&mut self.model_mut().cvar_changes)
     }
 
+    /// Drain the `(name, default)` rows an addon's `RegisterCVar` created since the last call
+    /// (decision 2303) — the host's cue to give each one a row in its own registry, which is the
+    /// store that survives this VM. In the reference an addon's registration lands in the same
+    /// engine-side table as the client's own; this is how ours does.
+    pub fn take_cvar_registrations(&mut self) -> Vec<(String, String)> {
+        std::mem::take(&mut self.model_mut().cvar_registrations)
+    }
+
     /// A native surface's write — [`set_from_engine`]'s public face: sets the value AND queues
     /// the change like a Lua `SetCVar`, so the host's sync dirties the config file. The glue
     /// AddOns screen's *Load out of date AddOns* checkbox is the caller (decision 1293): a
@@ -297,15 +357,38 @@ impl super::UiScript {
 /// code, not UI content, so a miss means this build's host doesn't back the var (a bare test VM) —
 /// and the registered set is welded to the code truths by `crate::cvars`'s own test.
 pub(super) fn set_from_engine(model: &mut Model, name: &str, value: String) {
-    let Some(slot) = model.cvars.get_mut(&name.to_ascii_lowercase()) else {
-        return;
-    };
-    if slot.value == value {
-        return;
+    store(model, &name.to_ascii_lowercase(), value);
+}
+
+/// **The one store every write goes through** — Lua's `SetCVar`, `ConsoleExec`, and the engine
+/// writes above. Returns the registered spelling when the write moved something (and queued it
+/// for the host), `None` for an unknown key or a write that changed nothing.
+///
+/// A **latched** slot (decision 2303) takes the write as its staged value and leaves `value`
+/// alone, which is the reference's `Set 0x63df50`: `latchedValue` gets the string, `InternalSet`
+/// does not run, and `GetCVar` keeps answering what is applied. Writing a latched slot back to
+/// its applied value clears the stage instead of staging a no-op. Either way the host hears it
+/// through the change queue — it holds the pending copy and commits it at the boundary.
+fn store(model: &mut Model, key: &str, value: String) -> Option<String> {
+    let slot = model.cvars.get_mut(key)?;
+    if slot.latched {
+        let staged = (value != slot.value).then_some(value.clone());
+        if slot.pending == staged && staged.is_some() {
+            return None;
+        }
+        if staged.is_none() && slot.pending.is_none() {
+            return None;
+        }
+        slot.pending = staged;
+    } else {
+        if slot.value == value {
+            return None;
+        }
+        slot.value = value.clone();
     }
-    slot.value = value.clone();
     let registered = slot.name.clone();
-    model.cvar_changes.push((registered, value));
+    model.cvar_changes.push((registered.clone(), value));
+    Some(registered)
 }
 
 /// Push the warn-once for an unknown CVar name into the model's warning stream.
@@ -319,26 +402,19 @@ pub(super) fn write_cvar(
     token: Option<String>,
 ) -> bool {
     let key = name.to_ascii_lowercase();
-    match model.cvars.get_mut(&key) {
-        Some(slot) => {
-            if slot.value != value {
-                slot.value = value.clone();
-                let reg_name = slot.name.clone();
-                model.cvar_changes.push((reg_name, value.clone()));
-                if let Some(token) = token {
-                    model.pending_events.push((
-                        "CVAR_UPDATE".to_string(),
-                        vec![ScriptValue::Str(token), ScriptValue::Str(value)],
-                    ));
-                }
-            }
-            true
-        }
-        None => {
-            warn_unknown(model, name);
-            false
+    if !model.cvars.contains_key(&key) {
+        warn_unknown(model, name);
+        return false;
+    }
+    if store(model, &key, value.clone()).is_some() {
+        if let Some(token) = token {
+            model.pending_events.push((
+                "CVAR_UPDATE".to_string(),
+                vec![ScriptValue::Str(token), ScriptValue::Str(value)],
+            ));
         }
     }
+    true
 }
 
 fn warn_unknown(model: &mut Model, name: &str) {
@@ -395,11 +471,22 @@ pub(super) fn install(lua: &Lua) -> mlua::Result<()> {
             // saved value survives the VM being replaced — the declared value stays the DEFAULT,
             // so the saver still knows what "moved off default" means for this key.
             let saved = model.cvars_saved_base.get(&key).cloned();
-            model.cvars.entry(key).or_insert(CvarSlot {
-                name,
-                value: saved.unwrap_or_else(|| value.clone()),
-                default: value,
-            });
+            if model.cvars.contains_key(&key) {
+                return Ok(());
+            }
+            // The host learns the row through its own queue (decision 2303): an addon-declared
+            // CVar gets a row in the host's registry, which is the store that survives this VM.
+            model.cvar_registrations.push((name.clone(), value.clone()));
+            model.cvars.insert(
+                key,
+                CvarSlot {
+                    name,
+                    value: saved.unwrap_or_else(|| value.clone()),
+                    default: value,
+                    latched: false,
+                    pending: None,
+                },
+            );
             Ok(())
         })?,
     )?;
@@ -1133,7 +1220,7 @@ fn install_nameplate_verbs(lua: &Lua) -> mlua::Result<()> {
 
 #[cfg(test)]
 mod tests {
-    use super::MultisampleFormat;
+    use super::{MultisampleFormat, SeededCvar};
     use crate::script::UiScript;
 
     fn script_with_volume() -> UiScript {
@@ -1170,6 +1257,113 @@ mod tests {
         assert!(s.take_cvar_changes().is_empty());
     }
 
+    /// **A latched row stages the write and keeps answering the applied value** (decision 2303)
+    /// — the reference's `Set 0x63df50` on flag bit1: `latchedValue` takes the string, `InternalSet`
+    /// never runs, so `GetCVar` (which reads `rec+0x20`) answers the old value until
+    /// `CVar::Update 0x63e060` commits it. The host still hears every staged write through the
+    /// change queue (it holds the pending copy), and its commit arrives as a host write, which
+    /// clears the stage. Writing the applied value back over a stage clears the stage too.
+    #[test]
+    fn a_latched_row_stages_the_write_until_the_host_commits_it() {
+        let mut s = UiScript::new().unwrap();
+        s.seed_cvars([
+            SeededCvar {
+                name: "gxVSync".into(),
+                value: "1".into(),
+                default: "1".into(),
+                latched: true,
+            },
+            SeededCvar {
+                name: "MusicVolume".into(),
+                value: "0.4".into(),
+                default: "0.4".into(),
+                latched: false,
+            },
+        ]);
+        s.run(r#"SetCVar("gxVSync", 0)"#).unwrap();
+        assert_eq!(
+            s.eval::<String>(r#"return GetCVar("gxVSync")"#).unwrap(),
+            "1",
+            "the applied value stands until the boundary"
+        );
+        assert_eq!(
+            s.take_cvar_changes(),
+            vec![("gxVSync".to_string(), "0".to_string())],
+            "the host hears the staged write"
+        );
+        // Staging the same value again is quiet; staging the applied value back clears the stage
+        // and is reported, so the host can drop its pending copy too.
+        s.run(r#"SetCVar("gxVSync", "0")"#).unwrap();
+        assert!(s.take_cvar_changes().is_empty());
+        s.run(r#"SetCVar("gxVSync", "1")"#).unwrap();
+        assert_eq!(
+            s.take_cvar_changes(),
+            vec![("gxVSync".to_string(), "1".to_string())]
+        );
+        assert!(
+            s.take_cvar_changes().is_empty(),
+            "nothing staged, nothing to say"
+        );
+        // The commit is a host write: the value moves, the stage clears, no echo.
+        s.run(r#"SetCVar("gxVSync", 0)"#).unwrap();
+        s.take_cvar_changes();
+        s.set_cvar_host("gxVSync", "0");
+        assert_eq!(
+            s.eval::<String>(r#"return GetCVar("gxVSync")"#).unwrap(),
+            "0"
+        );
+        assert!(s.take_cvar_changes().is_empty());
+        // An unlatched sibling is untouched by any of this.
+        s.run(r#"SetCVar("MusicVolume", 0.7)"#).unwrap();
+        assert_eq!(
+            s.eval::<String>(r#"return GetCVar("MusicVolume")"#)
+                .unwrap(),
+            "0.7"
+        );
+    }
+
+    /// **An addon's `RegisterCVar` reaches the host** (decision 2303): the row it creates is
+    /// reported once, with the declared default, so the host's registry — the store that
+    /// outlives this VM — can carry it. A re-declaration of a live name is the no-op it always
+    /// was, and reports nothing.
+    #[test]
+    fn an_addon_registration_is_reported_to_the_host_once() {
+        let mut s = UiScript::new().unwrap();
+        s.run(r#"RegisterCVar("myAddonKnob", "7")"#).unwrap();
+        s.run(r#"RegisterCVar("myAddonKnob", "9")"#).unwrap();
+        assert_eq!(
+            s.take_cvar_registrations(),
+            vec![("myAddonKnob".to_string(), "7".to_string())]
+        );
+        assert!(s.take_cvar_registrations().is_empty(), "drained");
+        assert_eq!(
+            s.eval::<String>(r#"return GetCVar("myAddonKnob")"#)
+                .unwrap(),
+            "7"
+        );
+    }
+
+    /// **A bare CVar name through `ConsoleExec` is the host's to answer** (decision 2303): the
+    /// reference's per-CVar console command prints `CVar "%s" is "%s"` on an empty argument
+    /// (`0x63dde0`), and that printing lives host-side with the rest of the command registry.
+    /// A name WITH a value is still written synchronously, so the next Lua line reads it back.
+    #[test]
+    fn console_exec_writes_a_valued_cvar_and_hands_a_bare_name_to_the_host() {
+        let mut s = script_with_volume();
+        s.run(r#"ConsoleExec("MusicVolume 0.2")"#).unwrap();
+        assert_eq!(
+            s.eval::<String>(r#"return GetCVar("MusicVolume")"#)
+                .unwrap(),
+            "0.2"
+        );
+        assert!(
+            s.take_console_lines().is_empty(),
+            "a valued write is consumed here"
+        );
+        s.run(r#"ConsoleExec("MusicVolume")"#).unwrap();
+        assert_eq!(s.take_console_lines(), vec!["MusicVolume".to_string()]);
+    }
+
     /// **`SetCVar`'s third argument is the `CVAR_UPDATE` token** (decision 1140) — the whole
     /// mechanism behind that event. 1.12's options panels pass their CheckButtons table KEY
     /// (`SetCVar(value.cvar, value.value, index)`), an uppercase display name, and the engine
diff --git a/crates/benilla-ui/src/script/mod.rs b/crates/benilla-ui/src/script/mod.rs
index ba84ceec..438f6aa3 100644
--- a/crates/benilla-ui/src/script/mod.rs
+++ b/crates/benilla-ui/src/script/mod.rs
@@ -201,7 +201,7 @@ pub use cursor::{
     CursorPetAction, CursorSpell, CursorStablePet, EnchantConfirm, WorldPick, EQUIPMENT_BAG,
 };
 pub use cvars::{
-    MultisampleFormat, ScreenResolution, VideoCaps, CVAR_FRILL_DENSITY, CVAR_GAMMA,
+    MultisampleFormat, ScreenResolution, SeededCvar, VideoCaps, CVAR_FRILL_DENSITY, CVAR_GAMMA,
     CVAR_NAMEPLATE_ENEMIES, CVAR_NAMEPLATE_FRIENDS, CVAR_WORLD_DETAIL, VIDEO_DEFAULT_CVARS,
     WORLD_DETAIL_STOPS,
 };
@@ -279,7 +279,8 @@ pub use types::{
 };
 pub(crate) use types::{FontExplicit, MeasuredText, RegionData};
 pub use unit::{
-    grey_band, level_reads_unknown, power_token, unit_is_grey, SelectionRequest, UnitState,
+    grey_band, level_reads_unknown, power_token, unit_is_grey, PlayerRecord, SelectionRequest,
+    UnitState,
 };
 pub use weapon_enchant::WeaponEnchant;
 pub use who_sort::{WhoSortChain, WhoSortKey};
diff --git a/crates/benilla-ui/src/script/model.rs b/crates/benilla-ui/src/script/model.rs
index 23932f11..5995ef85 100644
--- a/crates/benilla-ui/src/script/model.rs
+++ b/crates/benilla-ui/src/script/model.rs
@@ -789,6 +789,9 @@ pub(crate) struct Model {
     /// `(registered name, new value)` per Lua `SetCVar` since the app's last
     /// [`super::UiScript::take_cvar_changes`] drain — the knob-sync + config-dirty cue.
     pub(crate) cvar_changes: Vec<(String, String)>,
+    /// `(name, default)` per addon `RegisterCVar` that created a slot, since the host's last
+    /// [`super::UiScript::take_cvar_registrations`] drain (decision 2303).
+    pub(crate) cvar_registrations: Vec<(String, String)>,
     /// Unknown CVar names already warned about (warn-once, the era-atlas-miss posture).
     pub(crate) cvars_warned: HashSet<String>,
 
@@ -1726,6 +1729,26 @@ pub(crate) struct Model {
     /// payload, so two calls in a frame are two captures.
     pub(crate) screenshot_asks: u32,
     pub(crate) realm_name: String,
+    /// **The local player record — `0xc27d80`, ours** (decisions 2261 and 2263).
+    ///
+    /// The bytes, the four verbs that read it and why `UnitLevel` is not among them are on
+    /// [`super::PlayerRecord`] itself; what belongs here is the *lifetime*, because that is what
+    /// this field's position in the `Model` decides.
+    ///
+    /// **Two writers, and the asymmetry between them is the mechanism.** The world-entry UI load
+    /// seeds it from the roster row of the pick in flight — our copy of the same char-enum record
+    /// — beside [`Self::realm_name`] and before the addon walk (1195's slot, 1230's source); and
+    /// [`super::UiScript::set_unit`] keeps it in step for any `"player"` push that **carries** the
+    /// field. A push that does not carry it leaves it standing. So the record can be corrected but
+    /// never blanked, which is the reference's never-cleared property expressed where it can be
+    /// relied on — and decision 2260 is why that matters: a name-cache miss for our own guid
+    /// reached Lua as a nameless player snapshot and took KLHThreatMeter down with it.
+    ///
+    /// Our VM is rebuilt per login (1290) where the reference's record simply persists, so each new
+    /// VM is told once. That is the whole of the difference, and it is unobservable: the four verbs
+    /// do not exist between logins either — they live only in the in-game table `0x850438`, which
+    /// `UI_Init` installs and the teardown nils, and `GlueScript_RegisterBindings 0x46abb0` skips.
+    pub(crate) player_record: super::PlayerRecord,
     /// The hearthstone bind location's NAME, behind `GetBindLocation()` — the app resolves the
     /// `SMSG_BINDPOINTUPDATE` area id through the same AreaTable catalog the hearthstone's `$z`
     /// token already uses, and pushes the resolved string here.
@@ -2000,6 +2023,7 @@ impl Model {
             cvars: HashMap::new(),
             cvars_saved_base: HashMap::new(),
             cvar_changes: Vec::new(),
+            cvar_registrations: Vec::new(),
             cvars_warned: HashSet::new(),
             multisample_formats: Vec::new(),
             screen_resolutions: Vec::new(),
@@ -2224,6 +2248,7 @@ impl Model {
             played_time_asks: 0,
             screenshot_asks: 0,
             realm_name: String::new(),
+            player_record: super::PlayerRecord::default(),
             bind_location: String::new(),
             gm_ticket_categories: Vec::new(),
             gm_ticket_intents: Vec::new(),
diff --git a/crates/benilla-ui/src/script/skills.rs b/crates/benilla-ui/src/script/skills.rs
index 6fdcb6b6..6e081251 100644
--- a/crates/benilla-ui/src/script/skills.rs
+++ b/crates/benilla-ui/src/script/skills.rs
@@ -556,7 +556,6 @@ mod tests {
     use super::*;
     use crate::script::UiScript;
 
-    #[allow(clippy::too_many_arguments)]
     fn entry(
         skill_id: u32,
         name: &str,
diff --git a/crates/benilla-ui/src/script/tests/worldmap.rs b/crates/benilla-ui/src/script/tests/worldmap.rs
index e0ddd05a..cb5bb869 100644
--- a/crates/benilla-ui/src/script/tests/worldmap.rs
+++ b/crates/benilla-ui/src/script/tests/worldmap.rs
@@ -108,6 +108,176 @@ fn push_catalog(s: &mut UiScript) {
     ]);
 }
 
+/// The **orphan list** — `0x4a5d00`'s third array, and in 5875 its entire population: the three
+/// battlegrounds, with the real row ids, map ids, area ids and art folders, in `WorldMapArea.dbc`
+/// **file order** (the fill pass appends with no sort). Alterac Valley carries one of its three
+/// real `WorldMapOverlay` rows over its real AreaBit 954 — the only battleground art the
+/// explored-bit gate has anything to say about (WSG and AB key zero overlay rows).
+fn push_direct_areas(s: &mut UiScript) {
+    let row = |name: &str, area_id: u32, folder: &str, overlays: Vec<WorldMapOverlayView>| {
+        WorldMapZoneView {
+            name: name.into(),
+            area_id,
+            map_file: folder.into(),
+            // A synthetic rect: nothing engine-side projects through it (the app owns every
+            // projection), it is carried because the row is the row.
+            loc_rect: (1500.0, 500.0, 1600.0, 600.0),
+            overlays,
+        }
+    };
+    s.set_world_map_direct_areas(vec![
+        (
+            401,
+            row(
+                "Alterac Valley",
+                2597,
+                "AlteracValley",
+                vec![WorldMapOverlayView {
+                    texture: "Interface\\WorldMap\\AlteracValley\\DUNBALDAR".into(),
+                    width: 128,
+                    height: 128,
+                    offset_x: 300,
+                    offset_y: 200,
+                    explore_bits: vec![954],
+                    hit_rect: (200, 300, 328, 428),
+                    area_name: Some("Dun Baldar".into()),
+                }],
+            ),
+        ),
+        (443, row("Warsong Gulch", 3277, "WarsongGulch", Vec::new())),
+        (461, row("Arathi Basin", 3358, "ArathiBasin", Vec::new())),
+    ]);
+}
+
+/// **The direct-area selection** — the third state, and the whole of what a battleground map is
+/// (wow-re `system/ui/scratch/worldmap-direct-area-selection.md`). Inside Warsong Gulch the
+/// reference selects `(continent = -2, direct = WorldMapArea 443)`, and `GetMapInfo()` answers the
+/// art folder that `Blizzard_BattlefieldMinimap.lua:83-86` needs before it will draw anything at
+/// all; a client that models the selection as `(continent, zone)` answers nil there and draws an
+/// empty battle map.
+#[test]
+fn a_direct_area_is_the_third_selection_state() {
+    let mut s = script();
+    push_catalog(&mut s);
+    push_direct_areas(&mut s);
+
+    // The player is in Warsong Gulch: `0x4a6650`'s continent loop misses (map 489 is no
+    // continent's) and only then does the orphan loop match, selecting the row's own id.
+    s.set_world_map_feed(None, Some((0.5, 0.5)), 0.0, None, Vec::new(), Vec::new());
+    s.set_world_map_player_direct_area(Some(443));
+    s.run("SetMapToCurrentZone()").unwrap();
+
+    assert_eq!(
+        s.eval::<(String, i64, i64)>(
+            "return GetMapInfo(), GetCurrentMapContinent(), GetCurrentMapZone()"
+        )
+        .unwrap(),
+        ("WarsongGulch".into(), -1, 0),
+        "the ART FOLDER (not the localized \"Warsong Gulch\"), continent -2 + 1, zone -1 + 1"
+    );
+    assert_eq!(
+        s.eval::<(i64, i64)>("local n, h, hpot = GetMapInfo() return h, hpot")
+            .unwrap(),
+        (0, 0),
+        "slots 2/3 are 0 on every instance map: WorldMapContinent.dbc ships only mapIDs 0 and 1"
+    );
+    assert!(
+        s.eval::<bool>("local t = { GetMapZones(GetCurrentMapContinent()) } return t[1] == nil")
+            .unwrap(),
+        "GetMapZones(-1) takes the unsigned-bound exit — the dropdown that could write a bogus \
+         row id has no entries to fire from"
+    );
+
+    // Hover and click are refused. Both matter: there is no `.zmp` bitmap for a battleground
+    // (`0x4a6ec0`/`0x4a7620`/`0x4a7540` each test `-2` explicitly), and the world sheet's
+    // continent walk must not run just because the direct state shares its `continent == 0` cell.
+    assert!(s
+        .eval::<Option<String>>("return UpdateMapHighlight(0.5, 0.5)")
+        .unwrap()
+        .is_none());
+    s.run("ProcessMapClick(0.72, 0.63)").unwrap(); // EK land, were this the world sheet
+    assert_eq!(
+        s.eval::<(String, i64)>("return GetMapInfo(), GetCurrentMapContinent()")
+            .unwrap(),
+        ("WarsongGulch".into(), -1),
+        "a click cannot drill off an instance map"
+    );
+
+    // ── THE REFRESH TRAP. All five of the reference's in-place refresh sites re-pass
+    // `direct != -1 ? direct : zone` (`0x48f9f6`, `0x4a6460`, `0x6d93d8`, `0x6d9a17`, `0x6dac72`);
+    // one that re-passed the zone alone would drop the instance map back to the world view on the
+    // next world-state push or exploration update — silently, and only inside a battleground.
+    s.set_world_map_explored(vec![u32::MAX; 64]);
+    s.set_world_map_landmarks(Vec::new());
+    s.run("SetMapToCurrentZone()").unwrap();
+    s.sync_world_map_to_player_zone(0, 0, Some(443));
+    assert_eq!(
+        s.eval::<(String, i64)>("return GetMapInfo(), GetCurrentMapContinent()")
+            .unwrap(),
+        ("WarsongGulch".into(), -1),
+        "a refresh re-selects the DIRECT cell, never the (0, 0) pair beside it"
+    );
+
+    // Selecting a continent or a zone CLEARS the direct cell: `0x4a67a0`'s other legs all fall
+    // into `0x4a67ea mov [0x845074],-1`, and only `ecx == -2` jumps past it.
+    s.run("SetMapZoom(2, 1)").unwrap();
+    assert_eq!(
+        s.eval::<(String, i64, i64)>(
+            "return GetMapInfo(), GetCurrentMapContinent(), GetCurrentMapZone()"
+        )
+        .unwrap(),
+        ("Elwynn".into(), 2, 1),
+        "the instance map does not shadow later navigation"
+    );
+
+    // And the stock zoom-out button's own path off a battleground map: its `else` arm fires
+    // because `GetCurrentMapZone()` is 0 there, and `SetMapZoom(0)` is the world view.
+    s.run("SetMapToCurrentZone()").unwrap();
+    s.run("SetMapZoom(0)").unwrap();
+    assert_eq!(
+        s.eval::<(Option<String>, i64)>("return GetMapInfo(), GetCurrentMapContinent()")
+            .unwrap(),
+        (None, 0),
+        "zooming out of an instance map lands on the world sheet"
+    );
+}
+
+/// An instance map's overlays are **admitted**, keyed by the direct area, under exactly the zone's
+/// explored-bit gate (`0x4a67a0`'s overlay half, `0x4a6b10 jl 0x4a6b3d`; wow-re
+/// `worldmap-overlay-reveal-gate.md` §2) — no free reveal for a battleground. On 5875 data that
+/// means Alterac Valley's three rows and nothing at all for the other two.
+#[test]
+fn an_instance_map_reveals_its_overlays_under_the_zone_gate() {
+    let mut s = script();
+    push_catalog(&mut s);
+    push_direct_areas(&mut s);
+
+    s.set_world_map_player_direct_area(Some(401));
+    s.run("SetMapToCurrentZone()").unwrap();
+    assert_eq!(
+        s.eval::<i64>("return GetNumMapOverlays()").unwrap(),
+        0,
+        "nothing explored — the gate applies exactly as on a zone map"
+    );
+
+    // AreaBit 954 = word 29, bit 26.
+    let mut explored = vec![0u32; 64];
+    explored[29] = 1 << 26;
+    s.set_world_map_explored(explored);
+    assert_eq!(s.eval::<i64>("return GetNumMapOverlays()").unwrap(), 1);
+    assert_eq!(
+        s.eval::<String>("return GetMapOverlayInfo(1)").unwrap(),
+        "Interface\\WorldMap\\AlteracValley\\DUNBALDAR"
+    );
+
+    // Warsong Gulch keys zero `WorldMapOverlay` rows — a fully explored character still sees bare
+    // detail tiles there.
+    s.set_world_map_player_direct_area(Some(443));
+    s.run("SetMapToCurrentZone()").unwrap();
+    s.set_world_map_explored(vec![u32::MAX; 64]);
+    assert_eq!(s.eval::<i64>("return GetNumMapOverlays()").unwrap(), 0);
+}
+
 /// The navigation surface: lists come from the catalog, SetMapZoom's selection reads back
 /// synchronously in the same Lua breath (the reference's dropdown-click contract), zone/continent
 /// arguments clamp, and GetMapInfo names the displayed art folder (nil at the world level — the
@@ -240,7 +410,7 @@ fn the_engine_can_select_a_zone_with_no_lua_call() {
         (0, 0)
     );
 
-    s.sync_world_map_to_player_zone(1, 2);
+    s.sync_world_map_to_player_zone(1, 2, None);
 
     assert_eq!(
         s.eval::<(i64, i64)>("return GetCurrentMapContinent(), GetCurrentMapZone()")
@@ -259,7 +429,7 @@ fn the_engine_can_select_a_zone_with_no_lua_call() {
 
     // It clamps through the same tail as the Lua verbs — an out-of-range pair cannot corrupt
     // the selection (`0x4a67a0` range-checks the zone against the continent's child count).
-    s.sync_world_map_to_player_zone(99, 99);
+    s.sync_world_map_to_player_zone(99, 99, None);
     let (c, _) = s
         .eval::<(i64, i64)>("return GetCurrentMapContinent(), GetCurrentMapZone()")
         .unwrap();
diff --git a/crates/benilla-ui/src/script/tradeskill/tests.rs b/crates/benilla-ui/src/script/tradeskill/tests.rs
index 933d709d..a8def0fa 100644
--- a/crates/benilla-ui/src/script/tradeskill/tests.rs
+++ b/crates/benilla-ui/src/script/tradeskill/tests.rs
@@ -2,7 +2,6 @@ use super::*;
 use crate::script::UiScript;
 
 /// One recipe fixture — a single-reagent, single-tool row, distinct spell/product ids per name.
-#[allow(clippy::too_many_arguments)]
 fn recipe(
     spell_id: u32,
     name: &str,
diff --git a/crates/benilla-ui/src/script/unit/bindings.rs b/crates/benilla-ui/src/script/unit/bindings.rs
index e0d80769..a8795fd7 100644
--- a/crates/benilla-ui/src/script/unit/bindings.rs
+++ b/crates/benilla-ui/src/script/unit/bindings.rs
@@ -21,9 +21,36 @@ use super::super::binding_abi::flag;
 use super::super::Model;
 use super::{
     check_unit_token, classification_word, grey_band, level_reads_unknown, pick_unit_token,
-    unit_predicate, unknownobject, with_unit, SelectionRequest,
+    unit_predicate, unknownobject, with_unit, PlayerRecord, SelectionRequest,
 };
 
+/// **The `"player"` fast path, shared by the four verbs that take it** (decision 2263).
+///
+/// `Some(x)` = this token is `"player"` and `x` is the record's answer; `None` = it is any other
+/// token and the caller falls through to the unit resolver. That is the reference's own shape —
+/// a full-string, case-insensitive compare of the token against `0x847894` (`b"player\0"`) whose
+/// **match is the fall-through** — and it is one function rather than four copies for the reason
+/// [`super::super::names::gated_rank`](crate)'s sibling comment gives about rank: four readers of
+/// one record, each testing the token itself, is how they drift apart. `UnitName`, `UnitRace`,
+/// `UnitClass` and `UnitSex` are the whole set; `UnitLevel` is **not** one of them.
+///
+/// The compare is a full string, not a prefix: `"playerfoo"` is a recognised-but-unresolvable
+/// token ([`super::token_recognised`]) and goes to the resolver, not here.
+fn player_record_arm<T>(
+    lua: &Lua,
+    token: &Option<String>,
+    f: impl FnOnce(&PlayerRecord) -> T,
+) -> Option<T> {
+    if !token
+        .as_deref()
+        .is_some_and(|t| t.eq_ignore_ascii_case("player"))
+    {
+        return None;
+    }
+    let model = lua.app_data_ref::<Model>().expect("model app_data");
+    Some(f(&model.player_record))
+}
+
 /// The two class ids `GetComboPoints 0x51a190` accepts — the literals `4` and `0xb` it compares
 /// the class byte `[[player+0x110]+0x79]` against. That byte is `UNIT_FIELD_BYTES_0` byte 1, the
 /// same value [`PlayerReqState::class_id`](super::super::PlayerReqState) carries; `UnitClass`'s own
@@ -180,8 +207,11 @@ pub(in crate::script) fn install(lua: &Lua) -> mlua::Result<()> {
             //
             // Value 1 — and the ONLY two nils a recognised token can produce (`0x517020`, wow-re
             // `ui/scratch/binding-shape-arity-law.md` §2.1): the `"player"` fast path reads the
-            // local name buffer and pushes nil when it is empty (`0x517083` → `0x5abdc0`), and a
-            // token that resolves to GUID 0 pushes nil (`0x5170c0`). EVERY other path ends in a
+            // local name buffer and pushes nil when it is empty (`0x51708c` → `0x5abdc0`; the
+            // `0x517083` this used to cite is the token's string *compare*, `call 0x64a4c0` —
+            // corrected 2261), and a token that resolves to GUID 0 pushes nil (`0x5170c0`).
+            // The empty-buffer nil is not an explicit push either: `0x517095` is
+            // `lua_pushstring`, which falls through on NULL at `0x6f3895` into `lua_pushnil`. EVERY other path ends in a
             // string — the cached name, or `FrameScript_GetText("UNKNOWNOBJECT")`: `0x517220` for
             // a GUID with no object and no cache row, `0x609324` inside `CGUnit_C::GetUnitName`
             // for a unit whose name cache has not answered or is stale (a pet's is
@@ -195,17 +225,30 @@ pub(in crate::script) fn install(lua: &Lua) -> mlua::Result<()> {
             // named gap), so a not-selectable unit reads its name there with `UnitExists` nil; the
             // name resolver's own nil is GUID 0 and nothing else, and a feed that seats a token
             // has resolved it. Decision 2002.
+            //
+            // **The `"player"` arm is the BUFFER, not the snapshot** (decision 2261). `0x51708c`
+            // reads `0x5abdc0` — the local name buffer at `0xc27d88` — and returns; it never
+            // reaches the resolver, so no object, no descriptor and no name-query answer is
+            // involved on this path at all. Modelling it off the snapshot (as this did until
+            // 2261) put the one name the client always knows behind the one cache that can miss:
+            // decision 2260's realm-cache load dropped our own guid, the feed pushed a nameless
+            // player over the roster seat, and `UnitName("player")` read nil in the world.
+            //
+            // The buffer's emptiness is still the reference's own nil — it just means something
+            // a snapshot cannot say, and something a client that is in the world never is:
+            // "no Enter World has been committed in this process".
+            if let Some(seeded) = player_record_arm(lua, &token, |r| r.name.clone()) {
+                let name = if seeded.is_empty() {
+                    Value::Nil
+                } else {
+                    Value::String(lua.create_string(&seeded)?)
+                };
+                return Ok((name, Value::Nil));
+            }
             let name = with_unit(lua, &token, None, |u| Some(u.name.clone()))?;
             let name = match name {
                 None => Value::Nil,
                 Some(Some(n)) => Value::String(lua.create_string(&n)?),
-                Some(None)
-                    if token
-                        .as_deref()
-                        .is_some_and(|t| t.eq_ignore_ascii_case("player")) =>
-                {
-                    Value::Nil
-                }
                 Some(None) => Value::String(unknownobject(lua)?),
             };
             Ok((name, Value::Nil))
@@ -862,6 +905,18 @@ pub(in crate::script) fn install(lua: &Lua) -> mlua::Result<()> {
                 token,
                 r#"Usage: UnitRace("unit")"#,
             )?);
+            // The `"player"` arm is the RECORD, not the snapshot (decision 2263): `0x518269`
+            // reads `0x5abdd0` — `0xc27e80`, the char-enum row's race byte — and resolves it
+            // through `ChrRaces`, never reaching the unit resolver. See [`PlayerRecord`].
+            if let Some(pair) = player_record_arm(lua, &token, |r| r.race.clone()) {
+                return match pair {
+                    Some((loc, file)) => Ok((
+                        Value::String(lua.create_string(&loc)?),
+                        Value::String(lua.create_string(&file)?),
+                    )),
+                    None => Ok((Value::Nil, Value::Nil)),
+                };
+            }
             let pair = with_unit(lua, &token, None, |u| {
                 u.race.clone().zip(u.race_file.clone())
             })?;
@@ -882,6 +937,17 @@ pub(in crate::script) fn install(lua: &Lua) -> mlua::Result<()> {
                 token,
                 r#"Usage: UnitClass("unit")"#,
             )?);
+            // The `"player"` arm is the RECORD (decision 2263): `0x5183b9` → `0x5abde0`,
+            // `0xc27e81` through `ChrClasses`. Second return is the UPPERCASE token.
+            if let Some(pair) = player_record_arm(lua, &token, |r| r.class.clone()) {
+                return match pair {
+                    Some((loc, file)) => Ok((
+                        Value::String(lua.create_string(&loc)?),
+                        Value::String(lua.create_string(&file)?),
+                    )),
+                    None => Ok((Value::Nil, Value::Nil)),
+                };
+            }
             let pair = with_unit(lua, &token, None, |u| {
                 u.class.clone().zip(u.class_file.clone())
             })?;
@@ -945,7 +1011,14 @@ pub(in crate::script) fn install(lua: &Lua) -> mlua::Result<()> {
                 token,
                 r#"Usage: UnitSex("unit")"#,
             )?);
-            let sex = with_unit(lua, &token, 0u8, |u| u.sex)?;
+            // The `"player"` arm is the RECORD (decision 2263): `0x517ef9` → `0x5abdf0`,
+            // `0xc27e82`. **No bounds check anywhere on that path** — the byte indexes
+            // `fild [4*eax+0x808be4]` over `{2,3,1,6}` directly — so an unset record answers `2`
+            // ("male") in the reference too, which is what our `0` maps to below.
+            let sex = match player_record_arm(lua, &token, |r| r.sex) {
+                Some(sex) => sex,
+                None => with_unit(lua, &token, 0u8, |u| u.sex)?,
+            };
             Ok(Value::Integer(i64::from(if sex == 0 { 2 } else { sex })))
         })?,
     )?;
diff --git a/crates/benilla-ui/src/script/unit/mod.rs b/crates/benilla-ui/src/script/unit/mod.rs
index 22796bfe..322ee4fd 100644
--- a/crates/benilla-ui/src/script/unit/mod.rs
+++ b/crates/benilla-ui/src/script/unit/mod.rs
@@ -53,6 +53,59 @@ pub enum SelectionRequest {
     LastEnemy,
 }
 
+/// **The local player record — `0xc27d80`, ours** (decision 2263).
+///
+/// A copy of ONE `SMSG_CHAR_ENUM` `CHARACTER_INFO` row, and the source the reference answers four
+/// `"player"` verbs from. Each opens with the identical full-string, case-insensitive compare of
+/// the token against `0x847894` (`b"player\0"`) whose **match is the fall-through**, and each is
+/// unconditional — there is no arm that re-routes `"player"` to the unit resolver, so the
+/// descriptor never supersedes this record even once the object exists:
+///
+/// | verb | fast path | accessor | byte |
+/// |---|---|---|---|
+/// | `UnitName` `0x517020` | `0x51708c` | `0x5abdc0` | `+0x08` name |
+/// | `UnitRace` `0x518200` | `0x518269` | `0x5abdd0` | `+0x100` → `ChrRaces` |
+/// | `UnitClass` `0x518350` | `0x5183b9` | `0x5abde0` | `+0x101` → `ChrClasses` |
+/// | `UnitSex` `0x517e90` | `0x517ef9` | `0x5abdf0` | `+0x102` gender |
+///
+/// One writer image-wide — `0x5abd9e` (`rep movsd`, 0x44 dwords) inside `CGlueMgr::EnterWorld`,
+/// at the character-select commit — and **no instruction anywhere clears it**. It is filled before
+/// FrameXML loads and before `CMSG_PLAYER_LOGIN` is sent, which is why the reference can run addon
+/// `OnUpdate` for many frames with no local player object and still answer all four (wow-re
+/// `ui/scratch/unitname-player-seed-window.md` §6).
+///
+/// **`UnitLevel` is deliberately NOT here.** The record carries the level at `+0x108` and the
+/// client ships an accessor for it, `0x5abe00`, that **nothing calls** — so `UnitLevel("player")`
+/// reads the descriptor and answers `0` in exactly the window the four answer in.
+///
+/// **Resolved strings, not the raw bytes**, because this crate has no DBC: the reference resolves
+/// `+0x100`/`+0x101` through `ChrRaces`/`ChrClasses` at call time, and the app does that same
+/// resolution once when it seeds the record (it is the identical lookup
+/// `ui_unit::race_names`/`class_names` already does for the unit snapshot, so the two cannot
+/// disagree about what a race byte means).
+#[derive(Clone, Debug, Default, PartialEq)]
+pub struct PlayerRecord {
+    /// `+0x08` — the NUL-terminated name buffer at `0xc27d88`. Empty is the record's only unset
+    /// state, and the reference's only `UnitName("player")` nil: `lua_pushstring(NULL)` at
+    /// `0x517095` tail-jumps into `lua_pushnil`. Unreachable from Lua in the real client, because
+    /// the verb is not registered until `UI_Init` and only an Enter World commit gets there.
+    pub name: String,
+    /// `+0x100` resolved — `UnitRace`'s `(localized, file token)` pair, e.g.
+    /// `("Night Elf", "NightElf")`. `None` is the all-zero record: race 0 has no `ChrRaces` row,
+    /// and the reference's bound/NULL-row arms push `nil, nil` rather than reaching the resolver.
+    pub race: Option<(String, String)>,
+    /// `+0x101` resolved — `UnitClass`'s `(localized, UPPERCASE token)` pair, e.g.
+    /// `("Warrior", "WARRIOR")`. `None` for the all-zero record, same shape as [`Self::race`].
+    pub class: Option<(String, String)>,
+    /// `+0x102` on `UnitSex`'s scale (2 male, 3 female) — **not** the wire's 0/1.
+    ///
+    /// `0` is our unset marker and reads as `2`, which is not a fudge: `0x517ef9`'s accessor feeds
+    /// `fild [4*eax+0x808be4]` over `{2,3,1,6}` with **no bounds check at all**, so an all-zero
+    /// record answers `2` ("male") in the reference too. It is the one of the four with no
+    /// validity guard.
+    pub sex: u8,
+}
+
 /// One unit-token's game-state snapshot, pushed by the app each frame and read by the `Unit*`
 /// bindings. Plain data (no mlua handles, no ECS types) — the engine-free seam decision 0068 §3
 /// draws between the app's net/ECS feed and the Lua API.
@@ -539,6 +592,33 @@ impl super::UiScript {
                 // canonical lowercase token, so a feed that ever pushed `"Target"` could not create
                 // a second, shadowing entry.
                 Some(s) => {
+                    // **A `"player"` push keeps the record in step, field by field** (2261,
+                    // widened by 2263). The reference writes `0xc27d80` once per Enter World
+                    // commit and never clears it; our VM is rebuilt per login, so the entry load
+                    // seeds it — and this keeps it true for any later push that KNOWS a field,
+                    // without ever letting one that doesn't blank it.
+                    //
+                    // That asymmetry is the whole mechanism: 2260's nameless player snapshot is
+                    // exactly the push that must not be able to reach these four verbs. It is also
+                    // what keeps every fixture in the workspace correct without touching them — a
+                    // test that seats a full player is, by this rule, also seating the record.
+                    if token.eq_ignore_ascii_case("player") {
+                        let rec = &mut model.player_record;
+                        if let Some(name) = s.name.as_deref().filter(|n| !n.is_empty()) {
+                            if rec.name != name {
+                                rec.name = name.to_string();
+                            }
+                        }
+                        if let Some(race) = s.race.clone().zip(s.race_file.clone()) {
+                            rec.race = Some(race);
+                        }
+                        if let Some(class) = s.class.clone().zip(s.class_file.clone()) {
+                            rec.class = Some(class);
+                        }
+                        if s.sex != 0 {
+                            rec.sex = s.sex;
+                        }
+                    }
                     model.units_by_lower.insert(token.to_ascii_lowercase(), s);
                 }
                 None => {
diff --git a/crates/benilla-ui/src/script/unit/tests.rs b/crates/benilla-ui/src/script/unit/tests.rs
index 6eb985d0..740d4803 100644
--- a/crates/benilla-ui/src/script/unit/tests.rs
+++ b/crates/benilla-ui/src/script/unit/tests.rs
@@ -1,6 +1,6 @@
 //! The `Unit*` binding tests (the parent module is the unit under test).
 
-use crate::script::{PartyState, UiScript, UnitState};
+use crate::script::{PartyState, PlayerRecord, UiScript, UnitState};
 
 fn player() -> UnitState {
     UnitState {
@@ -1995,3 +1995,170 @@ fn unit_on_taxi_is_one_or_nil_and_raises_the_reference_usage() {
         "the gate's own message, not mlua's type error: {err}"
     );
 }
+
+/// **The four `"player"` verbs read the seeded record, and nothing can blank it** (2261/2263).
+///
+/// The reference's `"player"` arm never reaches the resolver: `0x51708c` reads `0xc27d88`, a copy
+/// of the char-enum row written once at the Enter World commit and never cleared anywhere in the
+/// image. So the name survives everything that can happen to the *snapshot* — which is the whole
+/// of decision 2260's bug: a name-cache miss for our own guid produced a nameless player push, it
+/// replaced the roster seat, and the verb went nil in the world. That push is modelled here
+/// exactly, and it must now be invisible to this verb.
+#[test]
+fn the_player_record_outlives_every_snapshot() {
+    let mut s = UiScript::new().unwrap();
+
+    // Before any Enter World commit — the buffer's one empty state, and the reference's nil.
+    assert!(s
+        .eval::<bool>(r#"return UnitName("player") == nil"#)
+        .unwrap());
+
+    // The world-entry load seeds it from the roster row, before a single addon file runs.
+    s.set_player_record(PlayerRecord {
+        name: "Nelprifour".into(),
+        race: Some(("Night Elf".into(), "NightElf".into())),
+        class: Some(("Priest".into(), "PRIEST".into())),
+        sex: 2,
+    });
+    assert_eq!(
+        s.eval::<String>(r#"return UnitName("player")"#).unwrap(),
+        "Nelprifour",
+        "the buffer answers with no player snapshot at all — the reference runs addon OnUpdate \
+         for many frames with no local player object and this verb still answers"
+    );
+
+    // 2260's push, verbatim: the descriptor landed, the name cache missed for our own guid.
+    let nameless = UnitState {
+        exists: true,
+        has_object: true,
+        name: None,
+        level: 5,
+        ..Default::default()
+    };
+    s.set_unit("player", Some(nameless));
+    assert_eq!(
+        s.eval::<String>(r#"return UnitName("player")"#).unwrap(),
+        "Nelprifour",
+        "a nameless snapshot must not reach this verb — that push is the reported bug"
+    );
+    assert_eq!(
+        s.eval::<String>(r#"return UnitRace("player")"#).unwrap(),
+        "Night Elf",
+        "the same holds for the other three fields of the record (2263)"
+    );
+    assert_eq!(
+        s.eval::<String>(r#"local _, t = UnitClass("player"); return t"#)
+            .unwrap(),
+        "PRIEST",
+        "UnitClass's second return is the UPPERCASE token"
+    );
+    assert_eq!(s.eval::<i64>(r#"return UnitSex("player")"#).unwrap(), 2);
+    // …and the snapshot is still the snapshot for everything else. `UnitLevel` is the boundary:
+    // the record carries a level byte and the client's accessor for it (`0x5abe00`) is DEAD, so
+    // this one reads the descriptor even for `"player"`.
+    assert_eq!(s.eval::<i64>(r#"return UnitLevel("player")"#).unwrap(), 5);
+
+    // The token going away entirely (the logout despawn frames) does not empty the buffer either.
+    s.set_unit("player", None);
+    assert_eq!(
+        s.eval::<String>(r#"return UnitName("player")"#).unwrap(),
+        "Nelprifour"
+    );
+    assert!(
+        s.eval::<bool>(r#"return UnitExists("player") == nil"#)
+            .unwrap(),
+        "the name and the unit are different questions — which is exactly what the buffer buys"
+    );
+
+    // An empty seed is refused, not stored: nothing in the reference ever empties this record.
+    s.set_player_record(PlayerRecord::default());
+    assert_eq!(
+        s.eval::<String>(r#"return UnitName("player")"#).unwrap(),
+        "Nelprifour"
+    );
+    assert_eq!(
+        s.eval::<String>(r#"return UnitRace("player")"#).unwrap(),
+        "Night Elf"
+    );
+
+    // A NAMED push does keep it in step — a second login as somebody else (1290's per-login VM
+    // is the usual route, but a push must never leave the two disagreeing).
+    let mut other = player();
+    other.name = Some("Onewarrior".into());
+    s.set_unit("player", Some(other));
+    assert_eq!(
+        s.eval::<String>(r#"return UnitName("player")"#).unwrap(),
+        "Onewarrior"
+    );
+    assert_eq!(
+        s.eval::<String>(r#"local _, t = UnitClass("player"); return t"#)
+            .unwrap(),
+        "WARRIOR",
+        "a push that carries the field updates it; one that does not leaves it standing"
+    );
+    assert_eq!(
+        s.eval::<i64>(r#"return UnitSex("player")"#).unwrap(),
+        3,
+        "player() is female — the record follows the push"
+    );
+
+    // Still the family's two returns, the second nil (1840).
+    assert_eq!(
+        s.eval::<i64>(r#"local t = {UnitName("player")}; return table.getn(t)"#)
+            .unwrap(),
+        1
+    );
+    // …and the case fold on the token holds on the fast path too.
+    assert_eq!(
+        s.eval::<String>(r#"return UnitName("PLAYER")"#).unwrap(),
+        "Onewarrior"
+    );
+}
+
+/// **The unset record's four answers, which are not uniform** (decision 2263).
+///
+/// The state is "no Enter World has been committed in this process" — unreachable from Lua in the
+/// reference, because the four verbs only exist inside `UI_Init`'s table and only an Enter World
+/// commit gets there. It is reachable *here* (a bare VM, a capture, a test world with no pick), so
+/// it is pinned to what the bytes do rather than left to whatever falls out:
+///
+/// - `UnitName` → nil, via `lua_pushstring(NULL)` at `0x517095` tail-jumping into `lua_pushnil`;
+/// - `UnitRace`/`UnitClass` → `nil, nil`, via the DBC bound and NULL-row arms — race 0 and class 0
+///   have no row, and those arms reach `pushnil` **without** falling back to the unit resolver;
+/// - `UnitSex` → the number **2**, because `0x517ef9`'s accessor feeds `fild [4*eax+0x808be4]`
+///   over `{2,3,1,6}` with **no bounds check at all**. It is the one of the four with no validity
+///   guard, and "male" is what an all-zero record means to it.
+#[test]
+fn an_unseeded_player_record_answers_the_references_four_ways() {
+    let s = UiScript::new().unwrap();
+    assert!(s
+        .eval::<bool>(r#"return UnitName("player") == nil"#)
+        .unwrap());
+    assert!(s
+        .eval::<bool>(r#"return UnitRace("player") == nil"#)
+        .unwrap());
+    assert!(s
+        .eval::<bool>(r#"local _, t = UnitRace("player"); return t == nil"#)
+        .unwrap());
+    assert!(s
+        .eval::<bool>(r#"return UnitClass("player") == nil"#)
+        .unwrap());
+    assert!(s
+        .eval::<bool>(r#"local _, t = UnitClass("player"); return t == nil"#)
+        .unwrap());
+    assert_eq!(
+        s.eval::<i64>(r#"return UnitSex("player")"#).unwrap(),
+        2,
+        "the one of the four with no bounds check — an all-zero record reads male, not nil"
+    );
+    // And the fast path is the TOKEN, not a prefix: `"playerfoo"` is recognised but resolves to
+    // nothing, so it goes to the resolver and answers the resolver's nil.
+    assert!(s
+        .eval::<bool>(r#"return UnitName("playerfoo") == nil"#)
+        .unwrap());
+    assert_eq!(
+        s.eval::<i64>(r#"return UnitSex("playerfoo")"#).unwrap(),
+        2,
+        "…which for UnitSex is the same 2, by the binding's own unresolved-token default"
+    );
+}
diff --git a/crates/benilla-ui/src/script/worldmap.rs b/crates/benilla-ui/src/script/worldmap.rs
index e3631ee7..36a0542a 100644
--- a/crates/benilla-ui/src/script/worldmap.rs
+++ b/crates/benilla-ui/src/script/worldmap.rs
@@ -17,6 +17,15 @@
 //! verified rules (WorldMapArea file order for continents, case-insensitive display-name sort
 //! for zones; wow-re Q1(d)/Q3(b) verdicts, 2026-07-07).
 //!
+//! …and a **third** selection state beside that pair: the **direct area**, the map of an
+//! instance — a battleground, a dungeon — which is no continent's child and so falls out of both
+//! lists (wow-re `system/ui/scratch/worldmap-direct-area-selection.md`). The reference does not
+//! encode it inside `(continent, zone)`: it carries THREE `.data` cells, and `continent == -2`
+//! with a `WorldMapArea` row **ID** in the third one IS that state ([`WorldMapState::direct_area`]).
+//! Inside Warsong Gulch a client without it answers `GetMapInfo() == nil`, and the stock
+//! `Blizzard_BattlefieldMinimap.lua:83-86` returns on the fourth line of its update — an empty
+//! battle map and an empty world map, which is the bug this models away.
+//!
 //! Continent-level hover/click resolve through the pushed **zone grid** — the 128×128 area
 //! bitmap (`Interface\WorldMap\<Continent>.zmp`, remapped app-side to 1-based zone indices; the
 //! source + cell law are wow-re-verified, `0x4a6ec0` / the Q1 §5 verdict 2026-07-07). The cell
@@ -178,6 +187,14 @@ fn area_grid_cell(loc: (f32, f32, f32, f32), u: f32, v: f32) -> Option<usize> {
 /// bitmap, a zone/city is just a different rect window (wow-re 15b2a8ea, FUN_004a6ec0 §1c). This
 /// is what lets a click on a city's footprint from its neighbouring zone map drill into the city.
 fn grid_area(state: &WorldMapState, u: f32, v: f32) -> Option<u16> {
+    // The direct-area state has no bitmap and is refused before the cell law runs: `0x4a6ec0`
+    // opens `cmp esi,-2; je 0x4a70ed` (wow-re `worldmap-direct-area-selection.md` §6) — the chain
+    // ships exactly three `.zmp` files and none of them is a battleground's. Explicit rather than
+    // left to `c == 0` below, because "the world sheet" and "an instance map" are different
+    // states that happen to share that cell.
+    if state.direct_area.is_some() {
+        return None;
+    }
     let (c, z) = state.selection;
     if c == 0 {
         return None;
@@ -215,12 +232,37 @@ pub struct WorldMapState {
     /// the world level, where `GetMapInfo` returns nil and the reference Lua falls back to
     /// `"World"`).
     pub continents: Vec<WorldMapContinentView>,
-    /// The displayed map: `(continent, zone)`, `(0, 0)` = the world sheet.
+    /// The **orphan list** — the third array the reference's catalog builder fills (`0x4a5d00`'s
+    /// count/fill passes `0x4a6130`/`0x4a61c9`): every `WorldMapArea` row with `areaID != 0`
+    /// whose mapID matches **no** continent record, as `(row ID, the row)`, in DBC **file order,
+    /// unsorted** — the three battlegrounds in 5875. Keyed by id, never indexed: nothing outside
+    /// [`direct_row`]'s lookup reads a position here, because the selection stores the row's own
+    /// ID rather than a place in this list.
+    pub direct_areas: Vec<(u32, WorldMapZoneView)>,
+    /// The displayed map: `(continent, zone)`, `(0, 0)` = the world sheet. **Not the whole
+    /// selection on its own** — [`Self::direct_area`] overrides it.
     pub selection: (u32, u32),
+    /// The **direct-area selection**: the `WorldMapArea` row **ID** of an instance map, or `None`
+    /// at every continent/zone/world selection.
+    ///
+    /// The reference's selection is THREE `.data` cells, not two (wow-re
+    /// `worldmap-direct-area-selection.md` §1): `[0x84506c]` continent, `[0x845070]` zone,
+    /// `[0x845074]` direct. `continent == -2` IS this state, and the third cell then holds the
+    /// row's own id — **not** an index into [`Self::direct_areas`], which is only ever a lookup
+    /// table. The setter `0x4a67a0` keeps the two exclusive (`0x4a67c1` stores the id only on the
+    /// `ecx == -2` leg and jumps past `0x4a67ea`'s `= -1`; every other leg reaches it), so
+    /// `direct_area.is_some()` ⇒ `selection == (0, 0)` — enforced in [`store_selection`], the one
+    /// writer.
+    pub direct_area: Option<u32>,
     /// Where `SetMapToCurrentZone` lands — the player's current `(continent, zone)` resolved by
-    /// the app (AreaTable parent walk × the catalog). `None` = unresolvable (instance, loading) →
-    /// the world sheet.
+    /// the app (AreaTable parent walk × the catalog). `None` = no continent matched → either the
+    /// orphan leg below, or the world sheet.
     pub player_zone: Option<(u32, u32)>,
+    /// The orphan half of that same answer: the `WorldMapArea` row ID whose mapID is the player's
+    /// own map, or `None`. `0x4a6650` runs its continent loop FIRST and reaches the orphan loop
+    /// only on a miss (`0x4a66c3`), so at most one of the two is ever set — and inside a
+    /// battleground it is this one.
+    pub player_direct_area: Option<u32>,
     /// `GetPlayerMapPosition("player")` for the CURRENT selection — projected app-side each frame
     /// (`map_proj`), `None`/(0,0) = off this map (the reference hides the blip).
     pub player_uv: Option<(f32, f32)>,
@@ -355,6 +397,11 @@ fn continent_hover(cont: &WorldMapContinentView, zone: &WorldMapZoneView) -> Opt
 /// name-only tail is reachable from there (`0x4a812e`). World level: the continent highlight is
 /// not built, so the tail.
 fn hover(wm: &WorldMapState, x: f32, y: f32) -> Hover {
+    // An instance map resolves no area under the cursor: the lookup INSIDE `UpdateMapHighlight`
+    // (`0x4a7620`) opens `cmp esi,-2; je 0x4a76d7` → `xor eax,eax`, so no highlight and no name.
+    if wm.direct_area.is_some() {
+        return Hover::Miss;
+    }
     let (c, z) = wm.selection;
     let Some(cont) = c.checked_sub(1).and_then(|i| wm.continents.get(i as usize)) else {
         return Hover::Miss;
@@ -377,8 +424,28 @@ fn hover(wm: &WorldMapState, x: f32, y: f32) -> Hover {
         .unwrap_or(Hover::Miss)
 }
 
-/// The current selection's zone view, if a zone map is displayed.
+/// The selected direct area's row, resolved by **id** through the orphan list — the reference's
+/// `[0xc0d5bc]` id-index lookup (`0x4a6cf0`'s `0x4a6d24` leg), which bound-checks on every read
+/// rather than trusting the stored cell. An id no row carries reads back as `None`, which is the
+/// binary's own NULL → `lua_pushnil`.
+fn direct_row(state: &WorldMapState) -> Option<&WorldMapZoneView> {
+    let id = state.direct_area?;
+    state
+        .direct_areas
+        .iter()
+        .find(|(row_id, _)| *row_id == id)
+        .map(|(_, row)| row)
+}
+
+/// The displayed map's `WorldMapArea` row, if one is displayed: the selected zone, or — in the
+/// direct-area state — the instance map's own row. `0x4a6cf0` resolves both through the same id
+/// lookup, and `0x4a67a0`'s overlay half admits the `-2` state with the displayed key
+/// `= [0x845074]` (wow-re `worldmap-overlay-reveal-gate.md` §2), so a battleground's overlays
+/// reveal under the explored-bit gate exactly as a zone's do — no free reveal.
 fn current_zone(state: &WorldMapState) -> Option<&WorldMapZoneView> {
+    if state.direct_area.is_some() {
+        return direct_row(state);
+    }
     let (c, z) = state.selection;
     if c == 0 || z == 0 {
         return None;
@@ -417,6 +484,25 @@ impl super::UiScript {
             .push(("WORLD_MAP_UPDATE".to_string(), Vec::new()));
     }
 
+    /// Push the **orphan list** — the instance maps, keyed by `WorldMapArea` row id (see
+    /// [`WorldMapState::direct_areas`]). Pushed beside the continent catalog at the same edge and
+    /// for the same reason; the reference fills both containers in one walk (`0x4a5d00`).
+    pub fn set_world_map_direct_areas(&mut self, direct_areas: Vec<(u32, WorldMapZoneView)>) {
+        let mut model = self.model_mut();
+        model.worldmap.direct_areas = direct_areas;
+        model
+            .pending_events
+            .push(("WORLD_MAP_UPDATE".to_string(), Vec::new()));
+    }
+
+    /// Push the resolver's **orphan leg** for the player — the `WorldMapArea` row id whose map is
+    /// the player's own, or `None` (see [`WorldMapState::player_direct_area`]). The continent/zone
+    /// leg rides [`Self::set_world_map_feed`]'s `player_zone`; `0x4a6650` computes both in one
+    /// pass and reaches this one only when that one missed.
+    pub fn set_world_map_player_direct_area(&mut self, direct_area: Option<u32>) {
+        self.model_mut().worldmap.player_direct_area = direct_area;
+    }
+
     /// Push the discovery bitset (the app calls this when `PLAYER_EXPLORED_ZONES` changes —
     /// including the first stream-in). Queues `WORLD_MAP_UPDATE` so an open zone map fills in
     /// newly explored art immediately.
@@ -463,10 +549,15 @@ impl super::UiScript {
         model.worldmap.raid_uv = raid_uv;
     }
 
-    /// The engine-owned selection `(continent, zone)` — the app reads it each frame to project
-    /// the feed for the displayed map.
-    pub fn world_map_selection(&self) -> (u32, u32) {
-        self.model_ref().worldmap.selection
+    /// The engine-owned selection — the app reads it each frame to project the feed for the
+    /// displayed map. **All three of the reference's cells**, in its own order: the continent and
+    /// zone pair (`0` = whole), then the direct-area row id
+    /// ([`WorldMapState::direct_area`]) which overrides both when it is `Some`. A consumer that
+    /// reads only the pair sees an instance map as the world sheet — which is precisely the bug
+    /// that left the battle map empty — so the third cell travels with them.
+    pub fn world_map_selection(&self) -> (u32, u32, Option<u32>) {
+        let wm = &self.model_ref().worldmap;
+        (wm.selection.0, wm.selection.1, wm.direct_area)
     }
 
     /// Move the selection **from the engine**, with no Lua in the loop — the reference's
@@ -479,9 +570,19 @@ impl super::UiScript {
     /// level `GetPlayerMapPosition` answers a world-SHEET uv (`0x4a7360` step 2), which every
     /// addon that assumes a zone uv silently mis-scales. See [`crate::script::worldmap`]'s caller
     /// in `ui_world_map::feed_world_map` for the gate.
-    pub fn sync_world_map_to_player_zone(&mut self, continent: u32, zone: u32) {
+    ///
+    /// It takes the resolver's whole answer — including the orphan leg — because `0x4947ac` calls
+    /// `0x4a6650`, the same resolver `SetMapToCurrentZone` does: a player logging straight into a
+    /// battleground is on the battleground's own map before any Lua runs, exactly as one logging
+    /// into Elwynn is on Elwynn's.
+    pub fn sync_world_map_to_player_zone(
+        &mut self,
+        continent: u32,
+        zone: u32,
+        direct_area: Option<u32>,
+    ) {
         let mut model = self.model_mut();
-        select(&mut model, i64::from(continent), i64::from(zone));
+        select_resolved(&mut model, continent, zone, direct_area);
     }
 
     /// The **normalized position within the map art** at UI-space `(x, y)`, or `None` when the
@@ -515,8 +616,22 @@ impl super::UiScript {
     }
 }
 
-/// Clamp + store a selection and queue the repaint event. The shared tail of
-/// `SetMapZoom`/`SetMapToCurrentZone`/`ProcessMapClick`.
+/// **The one writer of the three selection cells** — `0x4a67a0`, whose whole job is that the
+/// continent/zone pair and the direct-area id can never both be live: the setter's valid-continent
+/// leg and its `-1` leg both fall into `0x4a67ea mov [0x845074],eax` (`= -1`), and only `ecx == -2`
+/// jumps past it after storing the id (`0x4a67c1`), having already forced the zone cell to `-1`.
+/// Every selection verb in this module goes through here, so neither half can be moved alone.
+fn store_selection(model: &mut Model, selection: (u32, u32), direct_area: Option<u32>) {
+    model.worldmap.selection = selection;
+    model.worldmap.direct_area = direct_area;
+    model
+        .pending_events
+        .push(("WORLD_MAP_UPDATE".to_string(), Vec::new()));
+}
+
+/// Clamp + store a continent/zone selection and queue the repaint event. The shared tail of
+/// `SetMapZoom`/`SetMapToCurrentZone`/`ProcessMapClick` — and it **clears the direct area**, which
+/// is the setter invariant above.
 fn select(model: &mut Model, continent: i64, zone: i64) {
     let c = continent.clamp(0, model.worldmap.continents.len() as i64) as u32;
     let z = if c == 0 {
@@ -525,10 +640,30 @@ fn select(model: &mut Model, continent: i64, zone: i64) {
         let n = model.worldmap.continents[c as usize - 1].zones.len() as i64;
         zone.clamp(0, n) as u32
     };
-    model.worldmap.selection = (c, z);
-    model
-        .pending_events
-        .push(("WORLD_MAP_UPDATE".to_string(), Vec::new()));
+    store_selection(model, (c, z), None);
+}
+
+/// Select an instance map directly — `0x4a67a0` reached with `ecx == -2`: the zone cell goes to
+/// `-1` (our `0`) and the raw `WorldMapArea` row id lands in `[0x845074]` **verbatim and
+/// unchecked**. We keep it unchecked for the same reason the reference can: every consumer
+/// bound-checks on read ([`direct_row`]), so an id no row carries degrades to the nil map name
+/// instead of corrupting the selection.
+fn select_direct(model: &mut Model, wma_id: u32) {
+    store_selection(model, (0, 0), Some(wma_id));
+}
+
+/// Apply the resolver `0x4a6650`'s answer — the shared tail of `SetMapToCurrentZone` (`0x4a7e20`
+/// is literally `call 0x4a6650`) and of the engine's own first-world-enter sync (`0x4947ac`, the
+/// same function: there is no second resolver).
+///
+/// The orphan leg wins when it is set, and it is set only when no continent matched — the
+/// reference reaches `0x4a66c3` exclusively through the continent loop's miss, so the two answers
+/// are mutually exclusive by construction upstream and the order here is belt-and-braces.
+fn select_resolved(model: &mut Model, continent: u32, zone: u32, direct_area: Option<u32>) {
+    match direct_area {
+        Some(id) => select_direct(model, id),
+        None => select(model, i64::from(continent), i64::from(zone)),
+    }
 }
 
 /// Register the world-map globals.
@@ -551,6 +686,11 @@ pub(super) fn install(lua: &Lua) -> mlua::Result<()> {
     )?;
 
     // GetMapZones(continent) → name1, name2, … (that continent's zone list; index = zone number).
+    // A NEGATIVE continent answers empty — `0x4a7d10`'s `dec edi; cmp edi,[0xb6e664]; jae` is an
+    // unsigned bound, so `GetCurrentMapContinent()`'s `-1` on an instance map takes the empty
+    // exit. That emptiness is load-bearing: it is what leaves `WorldMapZoneButton_OnClick` with
+    // no button to fire, and so what stops a `SetMapZoom(-1, id)` from writing a bogus row id
+    // into the direct cell (wow-re §5.4).
     g.set(
         "GetMapZones",
         lua.create_function(|lua, c: i64| {
@@ -570,12 +710,20 @@ pub(super) fn install(lua: &Lua) -> mlua::Result<()> {
     )?;
 
     // GetCurrentMapContinent() / GetCurrentMapZone() — the selection halves (0 = world / whole
-    // continent). The reference reads them right after SetMapZoom in the same click.
+    // continent). The reference reads them right after SetMapZoom in the same click. Each is its
+    // cell `+ 1` and nothing else (`0x4a7ed0`, `0x4a7f00`: a straight-line fild/pushnumber), so
+    // the direct-area state answers **-1** (from the `-2` sentinel) and **0** (the zone cell it
+    // forces to `-1`). The `-1` is a value no stock path tests for, and benignly: it leaves
+    // `WorldMapFrame.lua:59`'s zoom-out button enabled, and the zone dropdown it would feed is
+    // empty because `GetMapZones(-1)` takes the unsigned-bound exit below.
     g.set(
         "GetCurrentMapContinent",
         lua.create_function(|lua, ()| {
             let model = lua.app_data_ref::<Model>().expect("model app_data");
-            Ok(i64::from(model.worldmap.selection.0))
+            Ok(match model.worldmap.direct_area {
+                Some(_) => -1i64,
+                None => i64::from(model.worldmap.selection.0),
+            })
         })?,
     )?;
     g.set(
@@ -596,28 +744,41 @@ pub(super) fn install(lua: &Lua) -> mlua::Result<()> {
         })?,
     )?;
 
-    // SetMapToCurrentZone() — the OnShow verb: jump to the player's zone (app-resolved feed).
+    // SetMapToCurrentZone() — the OnShow verb: jump to the player's own map (app-resolved feed).
+    // `0x4a7e20` is `call 0x4a6650; xor eax,eax; ret`, so this is the resolver's whole answer,
+    // orphan leg included — which is what puts a player standing in Warsong Gulch on the Warsong
+    // Gulch map. The stock battlefield minimap calls it itself on PLAYER_ENTERING_WORLD.
     g.set(
         "SetMapToCurrentZone",
         lua.create_function(|lua, ()| {
             let mut model = lua.app_data_mut::<Model>().expect("model app_data");
             let (c, z) = model.worldmap.player_zone.unwrap_or((0, 0));
-            select(&mut model, i64::from(c), i64::from(z));
+            let direct = model.worldmap.player_direct_area;
+            select_resolved(&mut model, c, z, direct);
             Ok(())
         })?,
     )?;
 
     // GetMapInfo() → mapFileName (the Interface\WorldMap\<name>\ folder). World level → nil —
     // the reference Lua's own `"World"` fallback exists because the client returned nil there
-    // (INFERRED, wow-re Q3 pending).
+    // (wow-re `worldmap-direct-area-selection.md` §5.1/§5.3).
+    //
+    // The name is `WorldMapArea` field[3], the **art-folder identifier** — "WarsongGulch", never
+    // the localized "Warsong Gulch": `0x4a6cf0` reads `[row+0xc]` with no locale multiplier, in
+    // deliberate contrast to `0x4a8740`'s `[rec + 4*[0xc0e080] + 0x2c]` AreaTable read. That is
+    // why FrameXML interpolates it straight into `Interface\WorldMap\<name>\<name>1..12`.
     g.set(
         "GetMapInfo",
         lua.create_function(|lua, ()| {
             let model = lua.app_data_ref::<Model>().expect("model app_data");
             let wm = &model.worldmap;
-            let file = match wm.selection {
-                (0, _) => None,
-                (c, z) => wm.continents.get(c as usize - 1).map(|cont| match z {
+            let file = match (wm.direct_area, wm.selection) {
+                // The direct-area state — an instance map, resolved by id through the orphan
+                // list. `0x4a6cf0`'s `jl 0x4a6d24` sends BOTH negative continents here and the
+                // `-1` world level answers nil only because its third cell is `-1` too.
+                (Some(_), _) => direct_row(wm).map(|row| row.map_file.clone()),
+                (None, (0, _)) => None,
+                (None, (c, z)) => wm.continents.get(c as usize - 1).map(|cont| match z {
                     0 => cont.map_file.clone(),
                     z => cont
                         .zones
@@ -626,11 +787,18 @@ pub(super) fn install(lua: &Lua) -> mlua::Result<()> {
                         .unwrap_or_else(|| cont.map_file.clone()),
                 }),
             };
-            // THREE values, always. `0x4a7e30` has one `ret` and not a single conditional jump —
-            // there is no miss branch at all, the emptiness lives in two helpers — so the
-            // world-level answer is `nil, 0, 0` rather than one nil. (`arity_conf = exact`;
-            // decision 1845.) The two zeros are the map's texture dimensions, which no caller
-            // reads on the world level.
+            // THREE values, always: `0x4a7e30` pushes all three unconditionally and returns
+            // `mov eax,3` from its single `ret`, so the world-level answer is `nil, 0, 0` rather
+            // than one nil. (Its four conditional jumps all sit inside slot 3's power-of-two
+            // round and none gates a push — wow-re §10 corrects the "no conditional jump at all"
+            // absolute this comment used to carry, without touching the conclusion.
+            // `arity_conf = exact`; decision 1845.)
+            //
+            // The two zeros are the map art's texture dimensions, which no caller reads: both
+            // consumers bind slot 2 to a `textureHeight` local they never read again. They are
+            // **0 on every instance map** in the reference too — `0x4a6d50` scans
+            // `WorldMapContinent.dbc` for the row's mapID and that table ships only mapIDs
+            // {0, 1}, so the scan exhausts (§5.2).
             let file = match file {
                 Some(f) => Value::String(lua.create_string(&f)?),
                 None => Value::Nil,
@@ -696,6 +864,13 @@ pub(super) fn install(lua: &Lua) -> mlua::Result<()> {
         "ProcessMapClick",
         lua.create_function(|lua, (x, y): (f32, f32)| {
             let mut model = lua.app_data_mut::<Model>().expect("model app_data");
+            // An instance map swallows the click: the drill INSIDE `ProcessMapClick`
+            // (`0x4a7540`) opens `cmp esi,-2; je 0x4a760d`, a bare epilogue. Ahead of the world
+            // arm below, because the direct state shares its `continent == 0` cell and must not
+            // fall into the world sheet's continent walk.
+            if model.worldmap.direct_area.is_some() {
+                return Ok(());
+            }
             if model.worldmap.selection.0 == 0 {
                 let hit = model.worldmap.continents.iter().position(|cont| {
                     let (u0, v0, u1, v1) = cont.world_rect;
@@ -793,9 +968,11 @@ pub(super) fn install(lua: &Lua) -> mlua::Result<()> {
         })?,
     )?;
 
-    // GetNumMapOverlays() — how many of the displayed zone's overlays are REVEALED by the
+    // GetNumMapOverlays() — how many of the displayed map's overlays are REVEALED by the
     // explored bitset (the client's C side filters the same way; the reference Lua draws every
-    // returned overlay). 0 at world/continent level.
+    // returned overlay). 0 at world/continent level; an instance map is admitted under the same
+    // gate as a zone (see [`current_zone`]) — which on 5875 data means Alterac Valley's three
+    // rows and nothing for the other two battlegrounds.
     g.set(
         "GetNumMapOverlays",
         lua.create_function(|lua, ()| {
diff --git a/crates/benilla-visual/Cargo.toml b/crates/benilla-visual/Cargo.toml
index adb63d9c..266d5ea7 100644
--- a/crates/benilla-visual/Cargo.toml
+++ b/crates/benilla-visual/Cargo.toml
@@ -5,6 +5,9 @@ edition.workspace = true
 license.workspace = true
 description = "Perceptual image diff for the Phase-5 visual A/B render harness (decision 0008)"
 
+[lints]
+workspace = true
+
 [dependencies]
 anyhow.workspace = true
 # PNG-only image IO + the RgbImage buffer the metrics run over. No Bevy — this is the pure-math half of
diff --git a/crates/benilla-wdt/Cargo.toml b/crates/benilla-wdt/Cargo.toml
index 80b811bf..e69add2d 100644
--- a/crates/benilla-wdt/Cargo.toml
+++ b/crates/benilla-wdt/Cargo.toml
@@ -4,3 +4,6 @@ version.workspace = true
 edition.workspace = true
 license.workspace = true
 description = "WDT map tile-table reader + tile/world coords for WoW 1.12.1 (build 5875) — in-repo, decision 0021"
+
+[lints]
+workspace = true
diff --git a/crates/benilla-wmo/Cargo.toml b/crates/benilla-wmo/Cargo.toml
index c45bd335..b043efd7 100644
--- a/crates/benilla-wmo/Cargo.toml
+++ b/crates/benilla-wmo/Cargo.toml
@@ -5,5 +5,8 @@ edition.workspace = true
 license.workspace = true
 description = "WMO (root + group) reader for WoW 1.12.1 (build 5875) — in-repo, decision 0021"
 
+[lints]
+workspace = true
+
 [dependencies]
 benilla-bytes = { path = "../benilla-bytes" }
diff --git a/crates/benilla-world/Cargo.toml b/crates/benilla-world/Cargo.toml
index 062aa4a7..eadf82f7 100644
--- a/crates/benilla-world/Cargo.toml
+++ b/crates/benilla-world/Cargo.toml
@@ -5,6 +5,9 @@ edition.workspace = true
 license.workspace = true
 description = "The world renderer: terrain, water, sky, weather, models, lighting, collision and the frame ladder — everything needed to put something in a world and ask the world about itself, with no game attached (decision 1160)"
 
+[lints]
+workspace = true
+
 [features]
 # Forwarded dev/player seam (0026 · 1173/1174 · 1175). Default-on. `benilla-formats` must be taken
 # with `default-features = false` and its `dev` re-exported here: it is default-on there too, so
diff --git a/crates/benilla-world/src/boot.rs b/crates/benilla-world/src/boot.rs
index e1d04c8d..e7ee1843 100644
--- a/crates/benilla-world/src/boot.rs
+++ b/crates/benilla-world/src/boot.rs
@@ -32,9 +32,11 @@ pub fn tuned_default_plugins(primary_window: Window) -> PluginGroupBuilder {
         // (`crate::shaders`, `benilla_app::shaders`, `benilla_assets::materials`) and addressed
         // `embedded://<crate>/shaders/…`, so nothing reaches for a file root at all and 1171's
         // engine/game line survives as the crate each shader is embedded from.
-        // Quiet wgpu/naga; our own crates stay at info.
+        // Quiet wgpu/naga; our own crates stay at info. The ring keeps the last lines of what
+        // stderr shows for the crash report (`log_ring`; decision 2266 §B2).
         .set(bevy::log::LogPlugin {
             filter: "wgpu=error,naga=warn".into(),
+            custom_layer: |_| Some(Box::new(crate::log_ring::LogRing)),
             ..default()
         })
         // Asset streaming is this client's load bottleneck: every M2/WMO/BLP read decompresses from
diff --git a/crates/benilla-world/src/clouds/mod.rs b/crates/benilla-world/src/clouds/mod.rs
index 89a6d8f3..3996dbc7 100644
--- a/crates/benilla-world/src/clouds/mod.rs
+++ b/crates/benilla-world/src/clouds/mod.rs
@@ -105,7 +105,6 @@ impl Plugin for CloudsPlugin {
 /// incremental 32-row band scroll (or the frozen capture clock) — and re-upload the colored
 /// RGBA texels when they changed (the reference's per-regen `0x58ac70` upload of the `0x6cfb00`
 /// color buffer, Addendum A §3).
-#[allow(clippy::too_many_arguments)] // one Bevy system's full input set
 fn tick_clouds(
     mut cov: ResMut<CloudCoverage>,
     light: Res<WowLighting>,
diff --git a/crates/benilla-world/src/clutter.rs b/crates/benilla-world/src/clutter.rs
index d49b1c8d..922e0d4f 100644
--- a/crates/benilla-world/src/clutter.rs
+++ b/crates/benilla-world/src/clutter.rs
@@ -58,9 +58,9 @@ impl Plugin for ClutterPlugin {
 /// global is read at draw time and needs no rebuild; ours costs a re-mesh of the ~30 chunks in the
 /// bubble, which the per-frame cap spreads over a few frames.
 ///
-/// Watches the **value**, not `is_changed()`, for the reason `terrain_stream::rescatter_clutter`
-/// spells out: the cvar sync deref-muts every knob resource whenever any cvar moves, so the flag
-/// over-fires. First sight only arms.
+/// Watches the **value**, not `is_changed()`, because the predicate is "the cutout moved" and
+/// not "the resource moved": `ClutterConfig` also carries the density, whose own writer would
+/// otherwise cost a re-mesh of the bubble on every detail-slider notch. First sight only arms.
 fn remesh_on_cutout_change(
     mut commands: Commands,
     cfg: Res<ClutterConfig>,
@@ -399,7 +399,6 @@ pub(crate) fn scatter_tile_clutter(
 /// and spawn them as children of `chunk_entity` (so a tile unload cascades to them). Returns the spawned
 /// entities (tracked on the `ClutterChunk` for distance teardown). Same merge as the old per-tile path,
 /// now per-chunk so only the ~70 yd bubble is ever built/drawn.
-#[allow(clippy::too_many_arguments)]
 fn build_chunk_clutter(
     chunk_entity: Entity,
     models: &[(String, Vec<ShadedPlacement>)],
@@ -547,7 +546,6 @@ fn frustum_corner_reach(fov_y: f32, aspect: f32) -> f32 {
 /// the player instead of every loaded tile and, with the per-frame build cap, spreads the cost so a
 /// tile-load no longer builds 256 chunks at once. Build/teardown happen where the fade ramp is
 /// already alpha 0, so they are invisible.
-#[allow(clippy::too_many_arguments)]
 pub(crate) fn stream_chunk_clutter(
     mut commands: Commands,
     cam: Query<(&GlobalTransform, Option<&Projection>), With<WorldCamera>>,
@@ -640,17 +638,29 @@ pub(crate) fn stream_chunk_clutter(
         );
         cc.built = built;
     }
+    // Two cases, and only one is a defect — the message always said so, but BOTH were warnings, so
+    // the benign one cried wolf. A login/teleport burst has a BACKLOG: the per-frame cap is why the
+    // near chunks are late, and the whole burst runs behind the loading cover. The director's
+    // 2026-09-15 log has three of these at t+1.7 s under a cover that did not lift until t+4.3 s —
+    // including one announcing grass at 4.4 yd that nobody could possibly have seen. With NO
+    // backlog the cap is not the cause: the distance gate let a near chunk through late on an
+    // ordinary frame, the player can see that one, and that one still warns.
     if late > 0 {
-        warn!(
-            "clutter: {late} chunk(s) built INSIDE the {:.0} yd horizon (nearest {late_nearest:.1} yd) \
-             — grass appeared where it could already be seen; {}",
-            cfg.fade_far,
-            if backlog > 0 {
-                format!("{backlog} more still queued behind the {CLUTTER_BUILDS_PER_FRAME}/frame cap (expected in a login/teleport burst)")
-            } else {
-                "no build backlog, so the DISTANCE GATE let it through late".to_string()
-            }
-        );
+        if backlog > 0 {
+            debug!(
+                "clutter: {late} chunk(s) built inside the {:.0} yd horizon (nearest \
+                 {late_nearest:.1} yd) — {backlog} more queued behind the \
+                 {CLUTTER_BUILDS_PER_FRAME}/frame cap (the expected login/teleport burst)",
+                cfg.fade_far,
+            );
+        } else {
+            warn!(
+                "clutter: {late} chunk(s) built INSIDE the {:.0} yd horizon (nearest \
+                 {late_nearest:.1} yd) — grass appeared where it could already be seen, and with \
+                 no build backlog, so the DISTANCE GATE let it through late",
+                cfg.fade_far,
+            );
+        }
     }
 }
 
diff --git a/crates/benilla-world/src/collision.rs b/crates/benilla-world/src/collision.rs
index 1081e646..48e68a76 100644
--- a/crates/benilla-world/src/collision.rs
+++ b/crates/benilla-world/src/collision.rs
@@ -346,7 +346,6 @@ impl WorldCollision<'_, '_> {
     }
 
     /// Move `shape` by `velocity` for `delta_time`, sliding along what it hits.
-    #[allow(clippy::too_many_arguments)] // the mover's full step, minus the two the facade owns
     pub fn slide_body(
         &self,
         shape: &Collider,
@@ -369,7 +368,6 @@ impl WorldCollision<'_, '_> {
 
     /// [`slide_body`](Self::slide_body) against a caller-supplied filter — the ghost's door
     /// exclusion, for the reason spelled out on [`cast_body_with`](Self::cast_body_with).
-    #[allow(clippy::too_many_arguments)] // `slide_body`'s list, plus the filter it defaults
     fn slide_body_with(
         &self,
         shape: &Collider,
diff --git a/crates/benilla-world/src/collision/one_sided.rs b/crates/benilla-world/src/collision/one_sided.rs
index 208d3fcb..cad3913d 100644
--- a/crates/benilla-world/src/collision/one_sided.rs
+++ b/crates/benilla-world/src/collision/one_sided.rs
@@ -292,7 +292,6 @@ pub(crate) fn cast_ray(
 /// is what displaced a seated body out of its chair). The `on_hit` callback contract is avian's
 /// ([`MoveAndSlideHitData`] / [`MoveAndSlideHitResponse`]), so the mover's ride/steep-wall handlers
 /// move over unchanged.
-#[allow(clippy::too_many_arguments)]
 pub(crate) fn move_and_slide(
     ms: &MoveAndSlide<'_, '_>,
     shape: &Collider,
diff --git a/crates/benilla-world/src/doodad_anim/lazy.rs b/crates/benilla-world/src/doodad_anim/lazy.rs
index d6b6d38d..58848afb 100644
--- a/crates/benilla-world/src/doodad_anim/lazy.rs
+++ b/crates/benilla-world/src/doodad_anim/lazy.rs
@@ -88,7 +88,6 @@ pub(super) type TwinParts<'w, 's> = Query<
 /// first skinned frame shows the parked pose the static mesh was already showing, and the world
 /// pass takes over the same frame (the wake re-arms the player, whose evaluation re-raises
 /// `pose_dirty`).
-#[allow(clippy::too_many_arguments)] // the gate's full promote handoff
 pub(super) fn promote_lazy_rig(
     commands: &mut Commands,
     palettes: &mut RigPalettes,
diff --git a/crates/benilla-world/src/doodad_anim/mat_anim.rs b/crates/benilla-world/src/doodad_anim/mat_anim.rs
index 297ec129..8049dec7 100644
--- a/crates/benilla-world/src/doodad_anim/mat_anim.rs
+++ b/crates/benilla-world/src/doodad_anim/mat_anim.rs
@@ -258,13 +258,48 @@ pub struct AnimMatPart;
 /// decision 0785). Revisit if the population ever grows.
 pub enum UvLoop {
     /// Every sequence bakes the same loop: the shared material, on the free-running shared clock.
-    Shared(std::sync::Arc<benilla_formats::UvAnim>),
+    ///
+    /// `None` when the batch's transform carries **no translation at all** — a rotate-only or
+    /// scale-only transform, whose whole motion is the [`UvAnimEntry::affine`] row beside this
+    /// one. Two entity batches in the shipped corpus are exactly that
+    /// (`World\Goober\G_ScryingBowl`'s water and `G_ScourgeRuneCircleCrystal`'s rune ring, both
+    /// `chans —R—`), so a lane that made the translation mandatory would have to invent a
+    /// zero loop for them or drop them silently. The entry still holds its translation row; it
+    /// stays at zero, which is what that row means.
+    Shared(Option<std::sync::Arc<benilla_formats::UvAnim>>),
     /// The slots disagree: this material belongs to ONE placement, and the loop is whichever slot
     /// `host` is playing right now.
     PerSeq {
         seqs: std::sync::Arc<benilla_formats::SeqLoops<[f32; 2]>>,
         host: Entity,
     },
+    /// The **spell-effect** lane (decision 2282): this material is one effect instance's own
+    /// clone, and the scroll rides that instance's clip — `host`'s live `AnimationPlayer`, the
+    /// same source [`MatAnim::following_host`] reads, so the two material channels of one cast
+    /// stay in step through `Stand` → `Hold` → `Decay`.
+    ///
+    /// **Per instance, not shared, because on an effect the scroll is not ambience — it IS the
+    /// animation.** A waterfall's loop is seamless, so one uniform for every placement on a
+    /// free-running clock is indistinguishable from the truth. The druid's claw trail is a
+    /// one-shot reveal: `Spells\SwipeCaster.m2` is two strips whose UVs are authored wholly
+    /// outside `0..1` against a CLAMP-addressed sheet, and the 1.5 s U-scroll is what drags the
+    /// claw along them. On a shared clock every bear in the raid would sweep in one phase none of
+    /// their casts chose; frozen at the track's first key — which is what the effect lane did
+    /// until 2282 — the strips sample only the sheet's transparent border and the trail does not
+    /// exist at all.
+    ///
+    /// `seqs` (1408's per-slot set) when the batch's slots disagree, `single` otherwise; a batch
+    /// whose slot 0 is dead beside a live later slot carries only the first, so both are optional
+    /// and at least one is always present.
+    Instance {
+        seqs: Option<std::sync::Arc<benilla_formats::SeqLoops<[f32; 2]>>>,
+        single: Option<std::sync::Arc<benilla_formats::UvAnim>>,
+        host: Entity,
+        /// `Time::elapsed_secs` at attach — this instance's clock origin. It is the band clock
+        /// for an instance whose model arms no player, and the global-sequence anchor
+        /// (`sceneNow − attach`, decisions 0856/0858: one fresh instance per play) for every one.
+        attached_at: f32,
+    },
 }
 
 /// One registered UV-scroll material: its sampler, its table slot, and the built seed the delta
@@ -274,6 +309,26 @@ pub struct UvAnimEntry {
     pub anim: UvLoop,
     pub slot: u16,
     pub seed: [f32; 2],
+    /// The effect lane's **affine half** ([`UvAffine`], decision 2282) — `None` on every other
+    /// lane, and on an effect batch whose transform only translates (the common case).
+    affine: Option<UvAffine>,
+}
+
+/// A texture transform's ROTATION and SCALING, on the effect lane: the two channels the
+/// translation row cannot carry, and the second table row that does ([`affine_row`]'s encoding,
+/// decision 2019).
+///
+/// They ride the same instance clock as the translation beside them, and they exist here for the
+/// same reason that one does — `Spells\ShieldWall_Impact_Base.mdx`'s halo turns AND scales, and
+/// `Spells\GroundingTotem_Impact.mdx` is a **scale-only** transform, so a lane that ran only the
+/// scroll would still render both wrong. `benilla-extract fxuvscan` is where that population is
+/// read; it is three models today, which is exactly why nobody would have found them by eye.
+struct UvAffine {
+    rot: Option<std::sync::Arc<benilla_formats::SeqLoops<[f32; 4]>>>,
+    scale: Option<std::sync::Arc<benilla_formats::SeqLoops<[f32; 2]>>>,
+    /// The affine row's slot (`anim_slots.z`). Its encoding is a delta from the IDENTITY, not
+    /// from a material seed — row 0 is the identity, so there is nothing to measure from.
+    slot: u16,
 }
 
 impl UvAnimEntry {
@@ -288,13 +343,30 @@ impl UvAnimEntry {
     /// table gives.
     pub(crate) fn delta(&self, now: f32, gseq_now: f64, playing: Option<(usize, f32)>) -> [f32; 4] {
         let uv = match &self.anim {
-            UvLoop::Shared(anim) => anim.sample(now),
+            UvLoop::Shared(anim) => anim.as_ref().map_or([0.0, 0.0], |a| a.sample(now)),
             UvLoop::PerSeq { seqs, .. } => playing
                 .and_then(|(seq, band_t)| {
                     seqs.seq(Some(seq))
                         .map(|l| l.sample(l.clock(band_t, gseq_now)))
                 })
                 .unwrap_or([0.0, 0.0]),
+            // The effect lane's clocks are the INSTANCE's, never the scene's (2282): the band
+            // clock is the clip this instance is playing — the spawn age while its rig has no
+            // player yet, which is `MatAnim`'s own degrade — and the gseq cursor is measured from
+            // its attach rather than from process start.
+            UvLoop::Instance {
+                seqs,
+                single,
+                attached_at,
+                ..
+            } => {
+                let age = now - attached_at;
+                let band_t = playing.map_or(age, |(_, t)| t);
+                seqs.as_ref()
+                    .and_then(|s| s.seq(playing.map(|(seq, _)| seq)))
+                    .or(single.as_deref())
+                    .map_or([0.0, 0.0], |l| l.sample(l.clock(band_t, f64::from(age))))
+            }
         };
         [
             benilla_assets::quantize(uv[0], 4096.0) - self.seed[0],
@@ -303,6 +375,43 @@ impl UvAnimEntry {
             0.0,
         ]
     }
+
+    /// This entry's **affine** row and the slot it goes in, or `None` when the transform only
+    /// translates. Sampled on **the same clocks [`Self::delta`] uses for this entry's own lane**,
+    /// so the three channels of one transform are always read at one instant — a rotation read on
+    /// the scene clock beside a translation read on an instance's play head would be two different
+    /// moments of the same matrix.
+    pub(crate) fn affine(
+        &self,
+        now: f32,
+        gseq_now: f64,
+        playing: Option<(usize, f32)>,
+    ) -> Option<(u16, [f32; 4])> {
+        let a = self.affine.as_ref()?;
+        // Per lane, exactly as `delta` does it: the shared lane reads the free-running scene clock
+        // on both, the per-placement lane its host's playing clip, and the effect lane its own
+        // age-anchored pair (decisions 0856/0858).
+        let (band_t, gseq) = match &self.anim {
+            UvLoop::Shared(_) => (now, gseq_now),
+            UvLoop::PerSeq { .. } => (playing.map_or(now, |(_, t)| t), gseq_now),
+            UvLoop::Instance { attached_at, .. } => {
+                let age = now - attached_at;
+                (playing.map_or(age, |(_, t)| t), f64::from(age))
+            }
+        };
+        let seq = playing.map(|(seq, _)| seq);
+        let q = a
+            .rot
+            .as_ref()
+            .and_then(|r| r.seq(seq))
+            .map_or([0.0, 0.0, 0.0, 1.0], |l| l.sample(l.clock(band_t, gseq)));
+        let s = a
+            .scale
+            .as_ref()
+            .and_then(|r| r.seq(seq))
+            .map_or([1.0, 1.0], |l| l.sample(l.clock(band_t, gseq)));
+        Some((a.slot, crate::mat_anim_table::affine_row(q, s)))
+    }
 }
 
 impl UvAnimEntry {
@@ -310,7 +419,40 @@ impl UvAnimEntry {
     fn host(&self) -> Option<Entity> {
         match &self.anim {
             UvLoop::Shared(_) => None,
-            UvLoop::PerSeq { host, .. } => Some(*host),
+            UvLoop::PerSeq { host, .. } | UvLoop::Instance { host, .. } => Some(*host),
+        }
+    }
+
+    /// Is this the **spell-effect** lane ([`UvLoop::Instance`])? The one entry kind
+    /// [`tick_anim_materials`] keeps sampling inside a deterministic capture, on exactly
+    /// [`MatAnim`]'s and `spell_fx::FxTintAnims`' own argument: an effect's clock is its
+    /// instance's frame-stepped `AnimationPlayer`, not wall time, so `fxview` can age one without
+    /// any golden scenario — which spawns no effects at all — moving a pixel.
+    fn instance_lane(&self) -> bool {
+        matches!(self.anim, UvLoop::Instance { .. })
+    }
+
+    /// The loop this entry samples right now — the instrument's read
+    /// ([`crate::doodad_anim::matanim_probe`]), so the probe's period and phase sweep come from
+    /// the same resolution [`Self::delta`] makes rather than a hand-rolled twin of it.
+    fn resolved(&self, playing: Option<(usize, f32)>) -> Option<&benilla_formats::UvAnim> {
+        match &self.anim {
+            UvLoop::Shared(a) => a.as_deref(),
+            UvLoop::PerSeq { seqs, .. } => seqs.seq(playing.map(|(seq, _)| seq)),
+            UvLoop::Instance { seqs, single, .. } => seqs
+                .as_ref()
+                .and_then(|s| s.seq(playing.map(|(seq, _)| seq)))
+                .or(single.as_deref()),
+        }
+    }
+
+    /// The `now` a phase-sweep sample passes for this entry. The effect lane measures its clocks
+    /// from ATTACH, so handing it a raw phase `t` would read as a negative age; every other lane
+    /// is already on the scene clock. (The sweep moves the play head too — see the caller.)
+    fn phase_now(&self, t: f32) -> f32 {
+        match &self.anim {
+            UvLoop::Instance { attached_at, .. } => attached_at + t,
+            UvLoop::Shared(_) | UvLoop::PerSeq { .. } => t,
         }
     }
 }
@@ -349,7 +491,7 @@ pub struct UvAnimMaterials(
 /// write this lane ever makes (spawn-frame, where the asset is Modified anyway). A full table
 /// (never seen below ~500 resident animated materials) skips registration: the batch stays
 /// frozen at its built seed — a degraded look, never a wrong pixel.
-pub fn register_uv(
+pub(crate) fn register_uv(
     reg: &mut UvAnimMaterials,
     table: &mut crate::mat_anim_table::MatAnimTable,
     materials: &mut bevy::asset::Assets<benilla_assets::materials::WowModelMaterial>,
@@ -381,20 +523,239 @@ pub fn register_uv(
         table.free(slot);
         return;
     };
-    if let UvLoop::PerSeq { host, .. } = &anim {
-        // The breadcrumb for the lane that has no other tell: a per-placement material is invisible
-        // in every count (it is one more material, one more row), so "did the bubbles take the new
-        // lane at all" would otherwise be a question only the eye could answer. One line per
-        // registration, at debug (decision 1408).
-        bevy::log::debug!("mat-anim: per-placement UV lane armed for host {host} (slot {slot})");
+    match &anim {
+        // The breadcrumb for the lanes that have no other tell: a per-placement or per-instance
+        // material is invisible in every count (it is one more material, one more row), so "did
+        // the bubbles / the claw trail take the new lane at all" would otherwise be a question
+        // only the eye could answer. One line per registration, at debug (decisions 1408, 2282).
+        UvLoop::PerSeq { host, .. } => {
+            bevy::log::debug!("mat-anim: per-placement UV lane armed for host {host} (slot {slot})")
+        }
+        UvLoop::Instance { host, .. } => {
+            bevy::log::debug!(
+                "mat-anim: per-instance UV lane armed for effect {host} (slot {slot})"
+            )
+        }
+        UvLoop::Shared(_) => {}
+    }
+    reg.0.insert(
+        id,
+        UvAnimEntry {
+            anim,
+            slot,
+            seed,
+            affine: None,
+        },
+    );
+}
+
+/// Attach the ROTATION/SCALING half to an entry [`register_uv`] has just made, if the batch has
+/// one — the second table row, `anim_slots.z`, and 2019's `[cos − 1, sin, sx − 1, sy − 1]`
+/// encoding whose zero row IS the identity.
+///
+/// The translation half decides whether there is an entry at all (a full table, a dead handle);
+/// the affine half attaches to it or not at all. A transform that ONLY rotates or scales still
+/// takes a translation row that stays at zero — one row, on a population of five models corpus-
+/// wide, for a registration path with one shape instead of two.
+fn attach_affine(
+    reg: &mut UvAnimMaterials,
+    table: &mut crate::mat_anim_table::MatAnimTable,
+    materials: &mut bevy::asset::Assets<benilla_assets::materials::WowModelMaterial>,
+    id: bevy::asset::AssetId<benilla_assets::materials::WowModelMaterial>,
+    rot: Option<std::sync::Arc<benilla_formats::SeqLoops<[f32; 4]>>>,
+    scale: Option<std::sync::Arc<benilla_formats::SeqLoops<[f32; 2]>>>,
+) {
+    if rot.is_none() && scale.is_none() {
+        return;
+    }
+    let Some(entry) = reg.0.get_mut(&id) else {
+        return;
+    };
+    match table.alloc() {
+        Some(slot) => {
+            crate::model_render::lazy::with_material_mut(materials, id, |mat| {
+                mat.extension.anim_slots.z = f32::from(slot);
+            });
+            entry.affine = Some(UvAffine { rot, scale, slot });
+        }
+        None => {
+            bevy::log::warn_once!("mat-anim table full — a UV rotation/scale stays at the identity")
+        }
+    }
+}
+
+/// Put one **spell-effect material clone** on the per-instance UV lane (decision 2282): the
+/// engine's whole door for `entities::spell_fx`, which owns the clone and nothing else about how
+/// the scroll is delivered.
+///
+/// One door rather than the three pieces behind it ([`UvLoop`]'s effect variant, [`register_uv`],
+/// the table row), because they are one fact — *this clone scrolls, on that instance's clip* —
+/// and the class of bug this lane keeps producing is a caller that took some of the pieces and
+/// not the rest (decision 2038's registry of marked-but-unregistered parts is the same shape).
+///
+/// `seqs` / `single` are the batch's baked loops in 1408's two spellings, at least one present;
+/// `host` is the effect instance root whose `AnimationPlayer` names the playing clip, and
+/// `attached_at` its `Time::elapsed_secs` origin. The clone's `sun_scale.zw` is read as the seed
+/// the delta rows are measured from, exactly as on the shared lane, so a caller that seeds it at
+/// the loop's own `t = 0` gets a correct FIRST frame before this lane has written a row.
+pub fn register_fx_uv(
+    reg: &mut UvAnimMaterials,
+    table: &mut crate::mat_anim_table::MatAnimTable,
+    materials: &mut bevy::asset::Assets<benilla_assets::materials::WowModelMaterial>,
+    id: bevy::asset::AssetId<benilla_assets::materials::WowModelMaterial>,
+    loops: UvLoops,
+    host: Entity,
+    attached_at: f32,
+) {
+    let UvLoops {
+        seqs,
+        single,
+        rot,
+        scale,
+    } = loops;
+    let turns = rot.is_some() || scale.is_some();
+    register_uv(
+        reg,
+        table,
+        materials,
+        id,
+        UvLoop::Instance {
+            seqs,
+            single,
+            host,
+            attached_at,
+        },
+    );
+    attach_affine(reg, table, materials, id, rot, scale);
+    let Some(entry) = reg.0.get(&id) else {
+        return;
+    };
+    let _ = turns;
+    // **Both rows, written now.** `tick_anim_materials` runs once per frame in `Update` and this
+    // registration happens in the same schedule, so an instance that attaches after the tick would
+    // otherwise draw its first frame at row 0 — the identity, which on this population is the
+    // authored-UV frame the whole decision is about (a Swipe strip renders NOTHING there). One
+    // write at spawn costs nothing and removes the class.
+    let (slot, row) = (entry.slot, entry.delta(attached_at, 0.0, None));
+    let affine = entry.affine(attached_at, 0.0, None);
+    table.set(slot, row);
+    if let Some((slot, row)) = affine {
+        table.set(slot, row);
+    }
+}
+
+/// Put one **unit / GameObject / held-item** batch material on the UV lane (decision 2295) — the
+/// engine's whole door for the entity lane, and the twin of [`register_fx_uv`] for a population
+/// that is resident rather than pooled.
+///
+/// It picks the lane from the authored record rather than making the caller reason about it,
+/// which is the same argument [`UvLoops`] itself rests on:
+///
+/// - **`host` is `Some` and the slots disagree** ⇒ [`UvLoop::PerSeq`]. This material belongs to
+///   that one instance (the caller owns the clone), and the loop is whichever file-sequence slot
+///   the instance is playing — 1408's lane, reached from the entity side for the first time.
+///   `World\Lordaeron\Plagueland\PassiveDoodads\BloodOfHeroes` is the class: slot 0 holds its
+///   bubble sheets still while slot 1 sweeps them, at freq 16384/16383, so its placements bubble
+///   independently and one shared row cannot serve two of them.
+/// - **otherwise** ⇒ [`UvLoop::Shared`], the free-running scene clock on the batch's shared,
+///   deduped material — 0136 choice 1. Exactly faithful for a global-sequence loop (the
+///   reference clocks those on one per-scene ms cursor), and 0136's recorded, still-invisible
+///   divergence for a seamless band loop.
+///
+/// A period-0 translation is not a loop — its seed IS its forever value, so registering it would
+/// buy a per-frame re-write of the same number (1375) — but a batch that only rotates or scales
+/// still registers, because its motion is the affine row and its translation row is the zero it
+/// is meant to be.
+pub fn register_entity_uv(
+    reg: &mut UvAnimMaterials,
+    table: &mut crate::mat_anim_table::MatAnimTable,
+    materials: &mut bevy::asset::Assets<benilla_assets::materials::WowModelMaterial>,
+    id: bevy::asset::AssetId<benilla_assets::materials::WowModelMaterial>,
+    loops: &UvLoops,
+    host: Option<Entity>,
+) {
+    if !loops.animates() {
+        return;
+    }
+    let lane = match (loops.seqs.clone(), host) {
+        (Some(seqs), Some(host)) => UvLoop::PerSeq { seqs, host },
+        _ => UvLoop::Shared(loops.single.clone().filter(|l| l.period > 0.0)),
+    };
+    register_uv(reg, table, materials, id, lane);
+    attach_affine(
+        reg,
+        table,
+        materials,
+        id,
+        loops.rot.clone(),
+        loops.scale.clone(),
+    );
+}
+
+/// The four baked channels of one batch's texture transform, as [`register_fx_uv`] takes them —
+/// 1408's two translation spellings plus 2019's per-slot rotation and scaling sets. A struct
+/// because they are one authored record, and a caller passing four `Option`s positionally is a
+/// caller that will eventually swap two of them.
+#[derive(Default)]
+pub struct UvLoops {
+    pub seqs: Option<std::sync::Arc<benilla_formats::SeqLoops<[f32; 2]>>>,
+    pub single: Option<std::sync::Arc<benilla_formats::UvAnim>>,
+    pub rot: Option<std::sync::Arc<benilla_formats::SeqLoops<[f32; 4]>>>,
+    pub scale: Option<std::sync::Arc<benilla_formats::SeqLoops<[f32; 2]>>>,
+}
+
+impl UvLoops {
+    /// The record as one authored batch carries it — **the one place the four channels are read
+    /// off a submesh**, so a lane that registers and a spawner that marks can never disagree about
+    /// which batches animate (decision 2038's law, whose violation froze every waterfall in the
+    /// game for three days).
+    pub fn of(sub: &benilla_assets::ModelSubmesh) -> Self {
+        Self {
+            seqs: sub.uv_seq.clone(),
+            single: sub.uv_anim.clone(),
+            rot: sub.uv_rot_seq.clone(),
+            scale: sub.uv_scale_seq.clone(),
+        }
+    }
+
+    /// Does this batch animate its texture transform at all? The test the effect attach makes
+    /// before cloning a material: any of the four channels, because a scale-only transform
+    /// (`Spells\GroundingTotem_Impact.mdx`) and a dead-slot-0 translation (1408) each answer
+    /// `None` to the obvious one.
+    pub fn any(&self) -> bool {
+        self.seqs.is_some() || self.single.is_some() || self.rot.is_some() || self.scale.is_some()
+    }
+
+    /// Does it need a per-frame SAMPLE — i.e. does it move? [`Self::any`] minus the constants: a
+    /// translation keyed to one value for the whole clip is its material's seed and nothing more
+    /// (1375), while a rotate-only or scale-only batch answers `None` on the translation channel
+    /// and still moves. The **one predicate** the entity lane's registration and its
+    /// [`AnimMatPart`] marker both ask.
+    pub fn animates(&self) -> bool {
+        self.seqs.is_some()
+            || self.rot.is_some()
+            || self.scale.is_some()
+            || self.single.as_ref().is_some_and(|l| l.period > 0.0)
+    }
+
+    /// The offset the batch opens on — what a caller seeds the clone's `sun_scale.zw` with so its
+    /// first frame is the loop's own `t = 0` and not the authored, unscrolled UV.
+    pub fn open_offset(&self) -> [f32; 2] {
+        self.seqs
+            .as_ref()
+            .and_then(|s| s.seq(None))
+            .or(self.single.as_deref())
+            .map_or([0.0, 0.0], |l| l.sample(0.0))
     }
-    reg.0.insert(id, UvAnimEntry { anim, slot, seed });
 }
 
 /// Re-sample the **drawn** animated materials on the shared clock — the UV scroll
 /// ([`UvAnimMaterials`]) and the RGB tint ([`TintAnimMaterials`]) together, because they share the
-/// draw scan below. Skipped entirely in captures (materials keep their t = 0 seed — constants still
-/// show, frames stay deterministic).
+/// draw scan below. Skipped in captures (materials keep their t = 0 seed — constants still show,
+/// frames stay deterministic), **except the spell-effect lane**
+/// ([`UvAnimEntry::instance_lane`]), whose clock is an effect instance's own frame-stepped
+/// player: `fxview` exists to age an effect inside a capture, and no golden scenario spawns one,
+/// so a scene with no effect in it takes the identical early return it always did.
 ///
 /// **The draw gate, and why it is the fix for B131.** Mutating a material asset marks it Modified,
 /// which on the Metal non-bindless path re-creates its uniform buffers *and its bind group* that
@@ -420,7 +781,6 @@ pub fn register_uv(
 /// It over-includes (a part left `Inherited` under a hidden ancestor counts as drawn), which is the
 /// safe direction: an extra write costs a frame's uniform upload, a missed one would freeze a
 /// visible scroll.
-#[allow(clippy::too_many_arguments)]
 pub(super) fn tick_anim_materials(
     time: Res<Time>,
     real: Res<Time<bevy::time::Real>>,
@@ -458,11 +818,22 @@ pub(super) fn tick_anim_materials(
         }
         return;
     }
-    if crate::dev_state::deterministic_run() || matanim_off(&real) {
+    if matanim_off(&real) {
+        return;
+    }
+    // A deterministic run freezes the SHARED-clock lanes at their seed (the whole reason a golden
+    // frame is reproducible) but keeps the effect lane running, because that lane's clock is one
+    // instance's frame-stepped `AnimationPlayer` — the `fxview` carve-out `MatAnim` and
+    // `spell_fx::FxTintAnims` already take (decision 2282). A capture with no effect in it — every
+    // golden scenario — holds no such entry, so it returns here exactly as it always has.
+    let frozen = crate::dev_state::deterministic_run() && !matanim_live();
+    if frozen && !uv_reg.0.values().any(UvAnimEntry::instance_lane) {
         return;
     }
     drawn.clear();
-    for (mat, vis) in &parts {
+    // Skipped when frozen: the only entries still sampling there are the effect lane's, and they
+    // are exempt from the draw gate below — so a capture pays nothing for a scan it cannot read.
+    for (mat, vis) in parts.iter().filter(|_| !frozen) {
         if *vis != Visibility::Hidden {
             let id = mat.id();
             // A far-classified instance carries the far TWIN's id — never a registry key. Count
@@ -490,13 +861,27 @@ pub(super) fn tick_anim_materials(
         // happens once, at spawn.
         if !crate::model_render::lazy::holds(&materials, *id) {
             table.free(entry.slot);
+            if let Some(a) = &entry.affine {
+                table.free(a.slot);
+            }
             return false;
         }
-        if drawn.contains(id) {
-            table.set(
-                entry.slot,
-                entry.delta(now, gseq_now, host_seq(&hosts, entry.host())),
-            );
+        // **The effect lane skips the draw gate.** That gate's argument is a material nothing
+        // draws costing a per-frame rebuild for ever, on a population that grows monotonically
+        // across a map session (B131). An effect instance is one of a handful and lives about a
+        // second, so there is nothing to ratchet — while making it obey the gate would mean
+        // threading [`AnimMatPart`] onto every fx part, card and decal, and a part that missed the
+        // marker would silently freeze mid-scroll. It is also what keeps the lane running inside a
+        // deterministic capture (`fxview`).
+        let fx = entry.instance_lane();
+        if (fx || drawn.contains(id)) && (!frozen || fx) {
+            let playing = host_seq(&hosts, entry.host());
+            table.set(entry.slot, entry.delta(now, gseq_now, playing));
+            // …and the rotation/scale row beside it, for the effect models that turn or scale
+            // their UVs rather than only sliding them (2282).
+            if let Some((slot, row)) = entry.affine(now, gseq_now, playing) {
+                table.set(slot, row);
+            }
         }
         true
     });
@@ -505,7 +890,7 @@ pub(super) fn tick_anim_materials(
             table.free(entry.slot);
             return false;
         }
-        if drawn.contains(id) {
+        if drawn.contains(id) && !frozen {
             table.set(
                 entry.slot,
                 entry.delta(now, gseq_now, host_seq(&hosts, entry.host())),
@@ -544,6 +929,22 @@ fn matanim_off(time: &Time<bevy::time::Real>) -> bool {
     })
 }
 
+/// **`WOW_MATANIM_LIVE=1` — run the shared lanes inside a deterministic capture too.**
+///
+/// The freeze above is what makes a golden frame reproducible, and it is right for every scenario
+/// in the sweep. It also means `fxview` — the fixture whose whole job is to age a subject — cannot
+/// show a **unit's or GameObject's** texture transform at all, because those are shared-clock
+/// entries (decision 2295); the effect lane is exempt only because its clock is one instance's
+/// frame-stepped player. Without this knob the A/B for "does this creature's skin scroll" does not
+/// exist, and the answer would have to come from the director's screen, which is not what §7 means
+/// by leaving the look to them.
+///
+/// Off by default, read once, and no golden scenario sets it — so the sweep is untouched.
+fn matanim_live() -> bool {
+    static ON: std::sync::OnceLock<bool> = std::sync::OnceLock::new();
+    *ON.get_or_init(|| std::env::var("WOW_MATANIM_LIVE").is_ok_and(|v| v != "0"))
+}
+
 /// The **tint-animated materials** registry — the M2Color-RGB twin of [`UvAnimMaterials`]: each
 /// batch material whose colour track animates (the vertex bake is skipped for those —
 /// `benilla-formats` `m2_batches`), keyed by material asset id. [`tick_anim_materials`]
@@ -656,10 +1057,14 @@ pub fn register_tint(
 /// gate's own input).
 ///
 /// It samples the loop itself rather than watching the row over time, so it is a **one-shot that
-/// works in a deterministic capture** — where [`tick_anim_materials`] is skipped entirely and the
-/// rows stay zero by design. In a live run the `row` column is the tick's real output and the two
-/// halves can be compared directly.
-#[allow(clippy::too_many_arguments)]
+/// works in a deterministic capture** — where [`tick_anim_materials`]'s shared lanes are skipped
+/// and their rows stay zero by design (the effect lane keeps running there; decision 2282). In a
+/// live run the `row` column is the tick's real output and the two halves can be compared
+/// directly.
+///
+/// A trailing block of `(unmarked)` rows names every registry entry no [`AnimMatPart`] accounts
+/// for: the spell-effect lane, which is off the draw gate and therefore off the marker, plus any
+/// entry whose part has gone — the readout that says a registered clone exists at all.
 pub(super) fn matanim_probe(
     time: Res<Time>,
     uv_reg: Res<UvAnimMaterials>,
@@ -675,13 +1080,79 @@ pub(super) fn matanim_probe(
     // Not latched while the world is still empty: a capture holds the game clock at 0 while the
     // scene builds, so "elapsed >= at" alone would fire the probe on frame one, before a single
     // doodad had spawned, and report nothing.
-    if *fired || time.elapsed_secs() < at || parts.iter().next().is_none() {
+    if *fired
+        || time.elapsed_secs() < at
+        || (parts.iter().next().is_none() && uv_reg.0.is_empty() && tint_reg.0.is_empty())
+    {
         return;
     }
     *fired = true;
     let now = time.elapsed_secs();
     let gseq_now = f64::from(now);
     let mut rows: Vec<String> = Vec::new();
+    // One UV entry as a row — hoisted out of the part loop so the unvisited pass below prints
+    // exactly the same columns for an entry NO marked part accounts for.
+    let uv_row = |e: &UvAnimEntry| {
+        let playing = host_seq(&hosts, e.host());
+        // The per-placement lane has one loop per sequence, so its phase sweep is meaningless
+        // without a play head — it prints the head instead, and samples on the shared clock.
+        let (lane, period) = match &e.anim {
+            UvLoop::Shared(a) => {
+                // `None` = a rotate-/scale-only transform: the translation row is real and stays
+                // at zero, and the period the sweep needs is the AFFINE channel's, not this one's.
+                let p = a.as_ref().map_or(0.0, |a| a.period);
+                (format!("shared period {p:.3}s"), p)
+            }
+            UvLoop::PerSeq { .. } => (format!("per-seq playing {playing:?}"), 0.0),
+            // The effect lane HAS a resolved loop (the clip it opened on), so unlike the
+            // per-placement lane its sweep is meaningful — read across the instance's own
+            // clip, from attach, beside the age that says where in it this frame sits.
+            UvLoop::Instance { attached_at, .. } => (
+                format!(
+                    "per-instance age {:.3}s playing {playing:?}",
+                    now - attached_at
+                ),
+                e.resolved(playing).map_or(0.0, |l| l.period),
+            ),
+        };
+        // Four quarter-phase samples of the loop itself: a flat set is an asset that scrolls
+        // nowhere, whatever the row says. The phase has to move the clock the entry actually
+        // reads — for the shared lane that is `now`, for a hosted one the PLAY HEAD, which is why
+        // the sweep substitutes the phase into `playing` rather than only into `now` (an entry
+        // whose host supplies a band clock ignores `now` entirely, and the sweep read flat).
+        let phases: Vec<String> = (0u8..4)
+            .map(|i| {
+                let t = period * f32::from(i) / 4.0;
+                let head = playing.map(|(seq, _)| (seq, t));
+                let d = e.delta(e.phase_now(t), f64::from(t), head);
+                format!("({:+.4},{:+.4})", d[0], d[1])
+            })
+            .collect();
+        let live = e.delta(now, gseq_now, playing);
+        // The affine half, when the transform has one: `[cos − 1, sin, sx − 1, sy − 1]`, so all
+        // zeros IS the identity and a flat row there says the turn/scale never reached the shader.
+        let affine = e.affine(now, gseq_now, playing).map_or(String::new(), |(slot, want)| {
+            let row = table.row(slot);
+            format!(
+                " · affine slot {slot} row ({:+.4},{:+.4},{:+.4},{:+.4}) live ({:+.4},{:+.4},{:+.4},{:+.4})",
+                row[0], row[1], row[2], row[3], want[0], want[1], want[2], want[3],
+            )
+        });
+        format!(
+            "uv slot {} seed ({:+.4},{:+.4}) row ({:+.4},{:+.4}) live ({:+.4},{:+.4}){affine} {lane} loop {}",
+            e.slot,
+            e.seed[0],
+            e.seed[1],
+            table.row(e.slot)[0],
+            table.row(e.slot)[1],
+            live[0],
+            live[1],
+            phases.join(" "),
+        )
+    };
+    let mut visited: std::collections::HashSet<
+        AssetId<benilla_assets::materials::WowModelMaterial>,
+    > = std::collections::HashSet::new();
     for (mat, vis, vv, obj) in &parts {
         // A far-classified part carries the TWIN's id; the registry is always keyed by the near
         // one — the same fold `tick_anim_materials`' draw scan makes (1375).
@@ -695,36 +1166,8 @@ pub(super) fn matanim_probe(
         let slots =
             crate::model_render::lazy::with_material(&materials, id, |m| m.extension.anim_slots)
                 .unwrap_or_default();
-        let uv = uv_reg.0.get(&id).map(|e| {
-            let playing = host_seq(&hosts, e.host());
-            // The per-placement lane has one loop per sequence, so its phase sweep is meaningless
-            // without a play head — it prints the head instead, and samples on the shared clock.
-            let (lane, period) = match &e.anim {
-                UvLoop::Shared(a) => (format!("shared period {:.3}s", a.period), a.period),
-                UvLoop::PerSeq { .. } => (format!("per-seq playing {playing:?}"), 0.0),
-            };
-            // Four quarter-phase samples of the loop itself: a flat set is an asset that scrolls
-            // nowhere, whatever the row says.
-            let phases: Vec<String> = (0u8..4)
-                .map(|i| {
-                    let t = period * f32::from(i) / 4.0;
-                    let d = e.delta(t, f64::from(t), playing);
-                    format!("({:+.4},{:+.4})", d[0], d[1])
-                })
-                .collect();
-            let live = e.delta(now, gseq_now, playing);
-            format!(
-                "uv slot {} seed ({:+.4},{:+.4}) row ({:+.4},{:+.4}) live ({:+.4},{:+.4}) {lane} loop {}",
-                e.slot,
-                e.seed[0],
-                e.seed[1],
-                table.row(e.slot)[0],
-                table.row(e.slot)[1],
-                live[0],
-                live[1],
-                phases.join(" "),
-            )
-        });
+        visited.insert(id);
+        let uv = uv_reg.0.get(&id).map(&uv_row);
         let tint = tint_reg.0.get(&id).map(|e| {
             format!(
                 "tint slot {} row ({:+.4},{:+.4},{:+.4})",
@@ -748,6 +1191,17 @@ pub(super) fn matanim_probe(
             u8::from(vv.is_some_and(|v| v.get())),
         ));
     }
+    // **The entries no marked part accounts for.** The spell-effect lane is exactly this
+    // population by design — its parts carry no [`AnimMatPart`] because they skip the draw gate
+    // (`tick_anim_materials`) — and so is every genuine leak: a registered material whose part is
+    // gone, or whose marker was never inserted. Without this pass the probe could not see the
+    // claw trail at all, which is the one thing decision 2282 built it to read.
+    for (id, e) in &uv_reg.0 {
+        if visited.contains(id) {
+            continue;
+        }
+        rows.push(format!("matanim  (unmarked)  mat {id}  {}", uv_row(e)));
+    }
     rows.sort();
     bevy::log::info!(
         "matanim probe at {now:.2}s — {} animated part(s), {} uv / {} tint registry entries",
@@ -785,6 +1239,187 @@ fn probe_at() -> Option<f32> {
 mod delta_tests {
     use super::*;
 
+    /// An effect-lane entry over one shared translation loop, attached at `attached_at`.
+    fn fx_entry(attached_at: f32) -> UvAnimEntry {
+        UvAnimEntry {
+            anim: UvLoop::Instance {
+                seqs: None,
+                single: Some(uv_loop()),
+                host: Entity::from_raw_u32(11).expect("a valid test entity"),
+                attached_at,
+            },
+            slot: 9,
+            seed: [0.0, 0.0],
+            affine: None,
+        }
+    }
+
+    /// A rotation-only loop, as `G_ScryingBowl`'s water and `G_ScourgeRuneCircleCrystal`'s rune
+    /// ring author one: a quarter turn about Z over two seconds, keyed in file slot 0 only.
+    fn quarter_turn() -> std::sync::Arc<benilla_formats::SeqLoops<[f32; 4]>> {
+        const Q: f32 = std::f32::consts::FRAC_1_SQRT_2;
+        const QUARTER: [f32; 4] = [0.0, 0.0, Q, Q];
+        std::sync::Arc::new(
+            benilla_formats::SeqLoops::new(vec![Some(benilla_formats::KeyAnim {
+                period: 2.0,
+                step: false,
+                wrap: true,
+                gseq: false,
+                // 90° about Z = (0, 0, sin 45°, cos 45°).
+                keys: vec![(0.0, [0.0, 0.0, 0.0, 1.0]), (2.0, QUARTER)],
+            })])
+            .expect("one animating slot"),
+        )
+    }
+
+    /// **`animates()` is the one predicate, and it is not `uv_anim.is_some()`** (decision 2295).
+    /// Two entity batches in the shipped corpus rotate and never translate, so the channel a
+    /// reader would check first answers `None` for them; and a translation keyed to one constant
+    /// value is the material's seed, not a loop to sample (1375).
+    #[test]
+    fn the_animates_predicate_sees_a_rotation_only_batch() {
+        let rot_only = UvLoops {
+            rot: Some(quarter_turn()),
+            ..Default::default()
+        };
+        assert!(rot_only.single.is_none(), "the obvious channel is empty");
+        assert!(rot_only.animates(), "and it still moves");
+
+        let constant = UvLoops {
+            single: Some(std::sync::Arc::new(benilla_formats::UvAnim {
+                period: 0.0,
+                step: false,
+                wrap: false,
+                gseq: false,
+                keys: vec![(0.0, [0.25, 0.0])],
+            })),
+            ..Default::default()
+        };
+        assert!(constant.any(), "it has a channel");
+        assert!(
+            !constant.animates(),
+            "…but a period-0 translation is a seed, never a per-frame sample"
+        );
+        assert!(!UvLoops::default().animates());
+    }
+
+    /// **The affine half runs on whichever clock its own lane runs on** (decision 2295 widening
+    /// 2282's). A shared entity entry has no host and no attach time, so its rotation reads the
+    /// free-running scene clock — which is what makes a rune ring on a shared, deduped material
+    /// turn at all.
+    #[test]
+    fn a_shared_entry_turns_on_the_scene_clock() {
+        let e = UvAnimEntry {
+            anim: UvLoop::Shared(None),
+            slot: 4,
+            seed: [0.0, 0.0],
+            affine: Some(UvAffine {
+                rot: Some(quarter_turn()),
+                scale: None,
+                slot: 5,
+            }),
+        };
+        // No translation channel at all: the row it still owns stays at the zero it means.
+        assert_eq!(e.delta(1.0, 1.0, None), [0.0, 0.0, 0.0, 0.0]);
+        // Half-way through the turn, and the row is `[cos − 1, sin, sx − 1, sy − 1]` of the
+        // **raw, unnormalised** lerped quaternion — which is the reference's own arithmetic, not
+        // an oversight: `0x713ea0` lerps each component and `0x7bddb0` consumes the result as is,
+        // so between two keys `|q| < 1` and the 2×2 is a rotation with a slight shrink (wow-re
+        // `modelframe-texanim-and-sequence-law.md` §3.4: *"a re-implementation that slerps, or
+        // normalises before building the matrix, diverges from the reference between keys"*).
+        // Here `q = (0, 0, 0.35355, 0.85355)`, so `c = 1 − 2z² = 0.75` and `s = 2zw = 0.60355` —
+        // NOT the 0.7071/0.7071 a normalised 45° would give. Asserted exactly so a future
+        // "obvious fix" to normalise fails here.
+        let (slot, row) = e.affine(1.0, 1.0, None).expect("the affine row");
+        assert_eq!(slot, 5);
+        assert!(
+            (row[0] + 0.25).abs() < 1e-4 && (row[1] - 0.603_553).abs() < 1e-4,
+            "the unnormalised lerp at t = 1 s of a 2 s turn: {row:?}"
+        );
+        assert!(
+            row[2].abs() < 1e-6 && row[3].abs() < 1e-6,
+            "no scaling authored, so the scale half is the identity: {row:?}"
+        );
+        // …and the clock really is `now`: a different scene time gives a different angle.
+        let later = e.affine(1.5, 1.5, None).expect("the affine row").1;
+        assert!(
+            (later[1] - row[1]).abs() > 1e-2,
+            "the shared lane's affine must move with the scene clock: {row:?} vs {later:?}"
+        );
+    }
+
+    /// **The effect lane reads its INSTANCE's play head, not the scene clock** (decision 2282).
+    /// The band clock is the clip time the host's `AnimationPlayer` reports, so two casts a minute
+    /// apart are at the same point of their own scroll — the property a shared-material lane
+    /// structurally cannot have, and the one Swipe's one-shot reveal rests on.
+    #[test]
+    fn the_effect_lane_reads_its_own_play_head() {
+        let anim = uv_loop();
+        let want = anim.sample(0.75);
+        for (attached_at, now) in [(0.0_f32, 0.75_f32), (600.0, 600.75), (600.0, 12.0)] {
+            let d = fx_entry(attached_at).delta(now, f64::from(now), Some((0, 0.75)));
+            assert!(
+                (d[0] - benilla_assets::quantize(want[0], 4096.0)).abs() < 1e-4
+                    && (d[1] - benilla_assets::quantize(want[1], 4096.0)).abs() < 1e-4,
+                "attach {attached_at}, scene {now}: the play head decides, {d:?}"
+            );
+        }
+    }
+
+    /// With no player to ask — the frame before an effect's rig arms, or a model that never arms
+    /// one — the band clock degrades to the instance's own AGE, which is `MatAnim`'s degrade next
+    /// door and not the free-running scene clock a shared entry would read.
+    #[test]
+    fn a_player_less_effect_falls_back_to_its_age() {
+        let anim = uv_loop();
+        let want = anim.sample(0.5);
+        let d = fx_entry(600.0).delta(600.5, 600.5, None);
+        assert!(
+            (d[0] - benilla_assets::quantize(want[0], 4096.0)).abs() < 1e-4,
+            "age 0.5 s at scene 600.5 s: {d:?}"
+        );
+    }
+
+    /// The **affine** half (2019's encoding, zero = identity): sampled on the same clocks as the
+    /// translation beside it, and absent — never a zeroed row — when the transform only slides.
+    /// `Spells\GroundingTotem_Impact.m2` is the scale-only case this stands for.
+    #[test]
+    fn the_effect_lane_samples_rotation_and_scale_on_the_same_clock() {
+        let mut e = fx_entry(100.0);
+        assert!(
+            e.affine(100.5, 0.0, Some((0, 0.5))).is_none(),
+            "a translation-only transform takes no affine row"
+        );
+        e.affine = Some(UvAffine {
+            rot: None,
+            scale: Some(std::sync::Arc::new(
+                benilla_formats::SeqLoops::new(vec![Some(benilla_formats::UvAnim {
+                    period: 2.0,
+                    step: false,
+                    wrap: false,
+                    gseq: false,
+                    keys: vec![(0.0, [1.0, 1.0]), (2.0, [0.25, 0.25])],
+                })])
+                .expect("one animating slot"),
+            )),
+            slot: 12,
+        });
+        let (slot, row) = e
+            .affine(100.0, 0.0, Some((0, 1.0)))
+            .expect("the affine row");
+        assert_eq!(slot, 12);
+        // Half-way: scale 0.625, encoded as `sx − 1`; rotation untouched, so `cos − 1` and `sin`
+        // are the identity's zeros.
+        assert!(
+            row[0].abs() < 1e-6 && row[1].abs() < 1e-6,
+            "no rotation authored: {row:?}"
+        );
+        assert!(
+            (row[2] + 0.375).abs() < 1e-3 && (row[3] + 0.375).abs() < 1e-3,
+            "scale 0.625 as a delta from the identity: {row:?}"
+        );
+    }
+
     fn uv_loop() -> std::sync::Arc<benilla_formats::UvAnim> {
         std::sync::Arc::new(benilla_formats::UvAnim {
             period: 2.0,
@@ -803,9 +1438,10 @@ mod delta_tests {
         let anim = uv_loop();
         let seed = anim.sample(0.0);
         let entry = UvAnimEntry {
-            anim: UvLoop::Shared(anim.clone()),
+            anim: UvLoop::Shared(Some(anim.clone())),
             slot: 3,
             seed,
+            affine: None,
         };
         for t in [0.0_f32, 0.35, 1.0, 1.7] {
             let d = entry.delta(t, f64::from(t), None);
@@ -858,6 +1494,7 @@ mod delta_tests {
             },
             slot: 5,
             seed: [0.0, 0.0],
+            affine: None,
         };
         // On slot 1, past its step key: the whole V flip shows.
         let d = entry.delta(0.0, 0.0, Some((1, 3.0)));
diff --git a/crates/benilla-world/src/doodad_anim/mod.rs b/crates/benilla-world/src/doodad_anim/mod.rs
index 27978875..c4bb20d4 100644
--- a/crates/benilla-world/src/doodad_anim/mod.rs
+++ b/crates/benilla-world/src/doodad_anim/mod.rs
@@ -41,47 +41,10 @@ mod mat_anim;
 pub(crate) use lazy::{LazyRig, SkinnedTwin};
 use mat_anim::tick_anim_materials;
 pub use mat_anim::{
-    playing_seq, register_tint, register_uv, sample_mat_anim, AnimMatPart, MatAnim,
-    TintAnimMaterials, TintLoop, UvAnimMaterials, UvLoop,
+    playing_seq, register_entity_uv, register_fx_uv, register_tint, sample_mat_anim, AnimMatPart,
+    MatAnim, TintAnimMaterials, TintLoop, UvAnimMaterials, UvLoops,
 };
-
-/// The client's single global `rand()` stream — the MSVC LCG at `0x7400e5`, returning `[0, 32767]`
-/// (wow-re `doodad-anim-host.md` §5, decision 0768). Every doodad's variation roll draws from **one**
-/// shared stream, which is what de-syncs a stand of identical props: not a per-placement seed, just
-/// consecutive draws off one sequence.
-///
-/// This replaced a position-derived hash. The hash de-synced instances correctly but was *permanent* —
-/// the same placement rolled the same variation on every re-stream and every run — which is exactly
-/// how the Blasted Lands lightning ended up striking from one fixed spot for ever instead of wandering
-/// the Tainted Scar (bug B63's residual). Captures are unaffected: [`spawn_anim_host`] returns `None`
-/// under a capture scenario, so no doodad animates in a golden frame and determinism is untouched.
-#[derive(Resource)]
-pub(crate) struct AnimRng(u32);
-
-impl Default for AnimRng {
-    fn default() -> Self {
-        Self(1) // the CRT's own initial seed
-    }
-}
-
-impl AnimRng {
-    /// One `rand()` draw: `seed = seed·214013 + 2531011`, result `(seed >> 16) & 0x7fff`.
-    fn draw(&mut self) -> u16 {
-        self.0 = self.0.wrapping_mul(214_013).wrapping_add(2_531_011);
-        ((self.0 >> 16) & 0x7fff) as u16
-    }
-
-    /// The play-window's replay count `R = max(1, min + ((rand()·(max−min)) >> 15))` — the reference's
-    /// `windowHi = now + span·R` (wow-re §5). `replay = (0, 0)`, the overwhelming majority and the
-    /// lightning's own value, always yields `R = 1`: one loop per window, so the variation re-rolls
-    /// every single pass. The draw is taken unconditionally — it is one sub-expression of the
-    /// reference's formula, so the shared stream advances the same way whatever the span.
-    fn replay_count(&mut self, replay: (u32, u32)) -> u32 {
-        let (lo, hi) = replay;
-        let r = lo + ((u32::from(self.draw()) * hi.saturating_sub(lo)) >> 15);
-        r.max(1)
-    }
-}
+pub(crate) use mat_anim::{register_uv, UvLoop};
 
 /// What a placed doodad model animates — decision 0130's content gate, decided per model at spawn.
 pub enum DoodadAnimTier<'a> {
@@ -438,7 +401,7 @@ impl DoodadAnimHost {
 /// window rolled.
 fn reroll_doodad_variation(
     time: Res<Time>,
-    mut rng: ResMut<AnimRng>,
+    mut rng: ResMut<benilla_assets::AnimRng>,
     mut hosts: Query<(
         &mut DoodadAnimHost,
         &ModelAnimations,
@@ -478,7 +441,7 @@ fn reroll_doodad_variation(
 /// both clocks to the shared-clock position — when one is again. Runs before [`AnimationSystems`] so
 /// a resume's seek lands the same frame. Steady state (nothing flipped) is one `Visibility` read per
 /// mesh, no writes.
-#[allow(clippy::too_many_arguments, clippy::type_complexity)] // one Bevy system's full input set
+#[allow(clippy::type_complexity)] // one Bevy system's full input set
 fn gate_doodad_anim(
     time: Res<Time>,
     mut hosts: Query<(
@@ -653,7 +616,16 @@ impl Plugin for DoodadAnimPlugin {
     fn build(&self, app: &mut App) {
         app.init_resource::<UvAnimMaterials>();
         app.init_resource::<TintAnimMaterials>();
-        app.init_resource::<AnimRng>();
+        // The client's ONE `rand()` stream (`benilla_assets::AnimRng`), seeded here because this
+        // is where the engine boots and where `deterministic_run` is knowable — the reference's
+        // own `srand(GetTickCount())` runs once per process from CRT static init, pre-`WinMain`
+        // (wow-re `net/scratch/crt-rand-stream-seeding.md`; decision 2301). A capture keeps the
+        // CRT's pre-`srand` value, so golden frames stay reproducible.
+        app.init_resource::<benilla_assets::AnimRng>();
+        let deterministic = crate::dev_state::deterministic_run();
+        app.world_mut()
+            .resource_mut::<benilla_assets::AnimRng>()
+            .seed_for_session(deterministic);
         // The re-roll runs BEFORE the draw gate: a window that expires this frame must arm its new
         // clip before the gate decides what to resume, or a host re-appearing on the same frame
         // resumes the previous window's variation for one frame.
@@ -909,33 +881,6 @@ mod tests {
         ));
     }
 
-    /// The client's `rand()` is the MSVC LCG, and its seed-1 stream is the textbook one. Pinning the
-    /// first draws keeps the weighted roll on the reference's actual sequence rather than on "some
-    /// uniform generator" (wow-re `_rand 0x7400e5`, decision 0768).
-    #[test]
-    fn the_anim_rng_is_the_reference_msvc_stream() {
-        let mut rng = AnimRng::default();
-        let first: Vec<u16> = (0..6).map(|_| rng.draw()).collect();
-        assert_eq!(first, vec![41, 18467, 6334, 26500, 19169, 15724]);
-        assert!(first.iter().all(|&v| v <= 0x7fff), "range is [0, 32767]");
-    }
-
-    /// `R = max(1, min + ((rand()·(max−min)) >> 15))`. `(0, 0)` — the overwhelming majority, and the
-    /// lightning's own value — pins to 1, so the window is exactly one loop and the variation
-    /// re-rolls every pass.
-    #[test]
-    fn the_replay_window_is_one_loop_for_the_common_case() {
-        let mut rng = AnimRng::default();
-        for _ in 0..32 {
-            assert_eq!(rng.replay_count((0, 0)), 1);
-        }
-        // A real range stays inside it, and never degenerates to 0 windows.
-        for _ in 0..64 {
-            let r = rng.replay_count((2, 5));
-            assert!((2..=5).contains(&r), "R = {r} outside [2, 5]");
-        }
-    }
-
     /// The lightning's own chain, read off the bytes (`benilla-extract m2seq` on
     /// `World\Generic\PassiveDoodads\ParticleEmitters\BlastedLandsLightningbolt01.M2`): two
     /// variations of animation id 0, weights 31129 / 1638 — so slot 1, which is where all four
@@ -954,7 +899,7 @@ mod tests {
         // would clobber the manual advance these tests need to step whole play-windows.
         let mut app = App::new();
         app.init_resource::<Time>();
-        app.init_resource::<AnimRng>();
+        app.init_resource::<benilla_assets::AnimRng>();
         app.add_systems(Update, reroll_doodad_variation);
         app
     }
diff --git a/crates/benilla-world/src/entity_shade.rs b/crates/benilla-world/src/entity_shade.rs
index d624dac5..440993e8 100644
--- a/crates/benilla-world/src/entity_shade.rs
+++ b/crates/benilla-world/src/entity_shade.rs
@@ -349,7 +349,6 @@ impl Plugin for EntityShadePlugin {
 // A Bevy system's params are not an argument list to shorten — each is a distinct world access the
 // scheduler needs by name, and the card pass below deliberately takes its own disjoint `MeshTag`
 // query rather than smuggling one through a shared `ParamSet`.
-#[allow(clippy::too_many_arguments)]
 pub(crate) fn update_ground_shade(
     time: Res<Time>,
     streamer: Option<Res<TerrainStreamer>>,
diff --git a/crates/benilla-world/src/exterior_cull.rs b/crates/benilla-world/src/exterior_cull.rs
index 75a439fa..5e09ba85 100644
--- a/crates/benilla-world/src/exterior_cull.rs
+++ b/crates/benilla-world/src/exterior_cull.rs
@@ -427,7 +427,6 @@ type ElectedBody = (
 /// it is the sole authority for: terrain cells, the WDL far band, and — in the second query below,
 /// a different audience under the same law rather than a second system — the elected net bodies
 /// ([`ElectedBody`], decision 1270), whose roots nothing else writes.
-#[allow(clippy::too_many_arguments)]
 // A Bevy system's params are not an argument list to shorten — each is a distinct world access
 // the scheduler needs by name (the `update_ground_shade` precedent).
 fn apply_exterior_cull(
diff --git a/crates/benilla-world/src/ffx_glow.rs b/crates/benilla-world/src/ffx_glow.rs
index eda089f3..d0f37e99 100644
--- a/crates/benilla-world/src/ffx_glow.rs
+++ b/crates/benilla-world/src/ffx_glow.rs
@@ -838,11 +838,22 @@ fn prepare_textures(
         let Some(vp) = camera.physical_viewport_size else {
             continue;
         };
-        // A claimed view (some [`FfxBackdrop`] names it) has no combine of its own — the UI
-        // camera's ground pass is it, keyed on THAT camera's target — so it carries none rather
-        // than a pair keyed on a target nothing writes.
-        let combine_format = (!claims.0.contains(&entity))
-            .then(|| FinalPassTarget::format(&camera.output_mode, target));
+        // The view's OWN combine pair, specialised **whether or not this view is claimed**
+        // (decision 2262). A claimed view (some [`FfxBackdrop`] names it) has no combine of its
+        // own — the UI camera's ground pass is it, keyed on THAT camera's target — so it carries
+        // none rather than a pair keyed on a target nothing writes. But the claim is not a
+        // property of the world, it is a property of *this frame*: it drops the moment the UI
+        // camera loses its `ViewTarget`, which is what `prepare_view_targets` does as soon as the
+        // window's surface goes away. At app exit that is harmless (bevy runs one to three more
+        // updates after the last presented frame — see `benilla_app::shutdown`) and it is exactly
+        // what the director's 2026-09-15 log caught: two `pipeline compiled LIVE` lines in the
+        // same millisecond as "No windows are open, exiting". A minimize to zero size or a surface
+        // reconfigure reaches the same branch **while the player is looking at the frame**, and
+        // there the pair would be two synchronous Metal compiles on the render thread. Specialising
+        // is a cached lookup on a four-field key, so holding the pair warm from the first covered
+        // frame costs that lookup and nothing else.
+        let own = specializer.pair(FinalPassTarget::format(&camera.output_mode, target));
+        let combine = (!claims.0.contains(&entity)).then_some(own);
         // The reference's RT-dim chain: ½ and ¼, floored (clamp ≥8 — `ffx_compute_rt_dims`).
         let mut tex = |label: &'static str, w: u32, h: u32| {
             texture_cache.get(
@@ -871,11 +882,10 @@ fn prepare_textures(
         if existing.is_some_and(|t| {
             t.quarter_a.texture.id() == quarter_a.texture.id()
                 && t.quarter_b.texture.id() == quarter_b.texture.id()
-                && t.combine.as_ref().map(|c| c.format) == combine_format
+                && t.combine.as_ref().map(|c| c.format) == combine.as_ref().map(|c| c.format)
         }) {
             continue;
         }
-        let combine = combine_format.map(|format| specializer.pair(format));
         let pipelines = &specializer.pipelines;
         let layout_filter = specializer
             .pipeline_cache
diff --git a/crates/benilla-world/src/ground_fx.rs b/crates/benilla-world/src/ground_fx.rs
index 479473b6..ae9d9ee0 100644
--- a/crates/benilla-world/src/ground_fx.rs
+++ b/crates/benilla-world/src/ground_fx.rs
@@ -82,7 +82,6 @@ pub(crate) struct GroundFxDecal {
 /// projection rides the effect stream). The caller resolves the part's texture/blend/fog/tint
 /// identity from its shared material; the caller also inserts the part's `MatAnim` rider (its
 /// `current` is the push-time alpha).
-#[allow(clippy::too_many_arguments)] // the part's full draw identity, one call site
 pub fn spawn_ground_fx_decal(
     commands: &mut Commands,
     texture: Handle<Image>,
diff --git a/crates/benilla-world/src/interior.rs b/crates/benilla-world/src/interior.rs
index 71e6448c..f4aba86f 100644
--- a/crates/benilla-world/src/interior.rs
+++ b/crates/benilla-world/src/interior.rs
@@ -575,7 +575,7 @@ pub struct BakeState {
 /// The walk is over ANCHORS, not parts (0734): a settled anchor is one distance compare, whatever
 /// its part count, and parts are written only when their anchor's law changes (or through the
 /// [`InteriorReauthor`] drain — a fresh part, a fade latch, the zoom feather's release).
-#[allow(clippy::type_complexity, clippy::too_many_arguments)]
+#[allow(clippy::type_complexity)]
 pub fn classify_entity_interior(
     mut commands: Commands,
     time: Res<Time>,
@@ -1134,7 +1134,6 @@ fn attach_anchor(
 /// stuck-black-unit bug; the fade-latch reauthor is the other half). The slot component lives on
 /// the ANCHOR — its on-remove hook frees the slot on despawn; law transitions remove/insert it
 /// here.
-#[allow(clippy::too_many_arguments)]
 fn resolve_anchor_law(
     commands: &mut Commands,
     probes: &mut PropProbes,
diff --git a/crates/benilla-world/src/lib.rs b/crates/benilla-world/src/lib.rs
index e2e6b40a..c3cdc684 100644
--- a/crates/benilla-world/src/lib.rs
+++ b/crates/benilla-world/src/lib.rs
@@ -147,6 +147,7 @@ pub mod interact;
 pub mod interior;
 pub mod lighting;
 pub mod liquid;
+pub mod log_ring;
 
 /// macOS `Cmd+Q`, re-pointed at the window close so the gesture goes through an exit the client
 /// can actually observe (decision 1528).
diff --git a/crates/benilla-world/src/lighting/global_light.rs b/crates/benilla-world/src/lighting/global_light.rs
index 6e473a53..b7419fb0 100644
--- a/crates/benilla-world/src/lighting/global_light.rs
+++ b/crates/benilla-world/src/lighting/global_light.rs
@@ -708,11 +708,15 @@ pub(super) fn register(app: &mut App) {
         )
         // After the spawners (PostUpdate): publish the probe table for extraction on change.
         .add_systems(PostUpdate, super::prop_probes::publish_prop_probes);
-    app.sub_app_mut(RenderApp).add_systems(
-        Render,
-        (upload_light, super::prop_probes::upload_prop_probes)
-            .in_set(RenderSystems::PrepareResources),
-    );
+    // Guarded like every other render-side registration in the tree: a headless build (no GPU,
+    // `backends: None`) has no render app, and the schedule tests build the engine that way.
+    if let Some(render_app) = app.get_sub_app_mut(RenderApp) {
+        render_app.add_systems(
+            Render,
+            (upload_light, super::prop_probes::upload_prop_probes)
+                .in_set(RenderSystems::PrepareResources),
+        );
+    }
 }
 
 /// Create the single persistent storage buffer. `RenderDevice` is a main-world resource (inserted in
@@ -1128,7 +1132,7 @@ impl std::fmt::Display for RoomClaim {
     }
 }
 
-#[allow(clippy::type_complexity, clippy::too_many_arguments)]
+#[allow(clippy::type_complexity)]
 fn build_light_data(
     light: Res<WowLighting>,
     debug: Res<DebugState>,
diff --git a/crates/benilla-world/src/lighting/resolve.rs b/crates/benilla-world/src/lighting/resolve.rs
index 5072fbb5..7050f0bd 100644
--- a/crates/benilla-world/src/lighting/resolve.rs
+++ b/crates/benilla-world/src/lighting/resolve.rs
@@ -211,7 +211,6 @@ fn hsv_value_scale(c: [f32; 3], f: f32) -> [f32; 3] {
     [c[0] * f, c[1] * f, c[2] * f]
 }
 
-#[allow(clippy::too_many_arguments)]
 pub(super) fn update_time_lighting(
     world_time: Res<super::WorldTime>,
     sampler: Option<Res<LightSampler>>,
diff --git a/crates/benilla-world/src/liquid/query.rs b/crates/benilla-world/src/liquid/query.rs
index 2a2f5916..a957dfd4 100644
--- a/crates/benilla-world/src/liquid/query.rs
+++ b/crates/benilla-world/src/liquid/query.rs
@@ -965,7 +965,6 @@ pub(super) fn lowest_near_corner_drop(rotation: Quat, fov: f32, aspect: f32, nea
 
 // Eight parameters: the probe reads a camera, the loaded surfaces, two scoping resources and a
 // clock, then writes the verdict and its two scalars. They are the inputs the rule has.
-#[allow(clippy::too_many_arguments)]
 pub(super) fn detect_submersion(
     mut underwater: ResMut<Underwater>,
     camera: Query<(&Transform, &Projection), With<WorldCamera>>,
diff --git a/crates/benilla-world/src/liquid/surface.rs b/crates/benilla-world/src/liquid/surface.rs
index 8bf6b52c..45faf5f2 100644
--- a/crates/benilla-world/src/liquid/surface.rs
+++ b/crates/benilla-world/src/liquid/surface.rs
@@ -390,7 +390,6 @@ fn liquid_bevy_mesh(lq: &LiquidMesh, body_color: Option<[f32; 3]>) -> Mesh {
 /// floor. A liquid footprint has no floor of its own, so an unscoped pool claims every position
 /// under its XY forever — the Uldaman entrance read as submerged under a mushroom cave's water
 /// 186 yd overhead (0696), and Undercity's upper slime submerged the rooms 115 yd below it (0701).
-#[allow(clippy::too_many_arguments)] // one param per concern: assets, placement, fog block, scope
 pub(crate) fn spawn_wmo_liquids<'a>(
     commands: &mut Commands,
     liquids: impl Iterator<Item = &'a LiquidMesh>,
diff --git a/crates/benilla-world/src/log_ring.rs b/crates/benilla-world/src/log_ring.rs
new file mode 100644
index 00000000..253337a0
--- /dev/null
+++ b/crates/benilla-world/src/log_ring.rs
@@ -0,0 +1,122 @@
+//! **The last few hundred log lines, kept in memory** — so a crash report can carry what the
+//! client was doing when it died (decision 2266 §B2).
+//!
+//! The only log sink is stderr, and a player's terminal (or a packaged Windows build with no
+//! console at all) is gone with the process. Of bug B390's four reporters one attached anything,
+//! and only because he had set `RUST_BACKTRACE=1` himself. A panic hook can write a file, but a
+//! payload and a backtrace without the minute of log before them is a symptom without a story:
+//! which zone, which opcode, which asset was loading. This ring is that story.
+//!
+//! Installed as [`bevy::log::LogPlugin::custom_layer`] by [`crate::boot::tuned_default_plugins`],
+//! so it sits under the same `EnvFilter` as the stderr formatter — the ring holds exactly the lines
+//! stderr showed, no more (a `wgpu=trace` firehose the filter drops never reaches it either).
+//! Bounded at [`CAPACITY`] lines; the cost is one string clone per emitted line, on the thread that
+//! logged it, behind a mutex that is never held across anything else.
+//!
+//! Read with [`recent`]. Nothing else in the engine reads it: it is an artefact feed, not a log.
+
+use std::collections::VecDeque;
+use std::fmt::Write as _;
+use std::sync::{Mutex, OnceLock};
+use std::time::Instant;
+
+use bevy::log::tracing::field::{Field, Visit};
+use bevy::log::tracing::{Event, Subscriber};
+use bevy::log::tracing_subscriber::layer::Context;
+use bevy::log::tracing_subscriber::Layer;
+
+/// How many lines the ring keeps. Two hundred is about a minute of an ordinary session's `info`
+/// stream and a few seconds of a bad one, which is the window a crash needs.
+pub const CAPACITY: usize = 200;
+
+static RING: Mutex<VecDeque<String>> = Mutex::new(VecDeque::new());
+static START: OnceLock<Instant> = OnceLock::new();
+
+/// The layer. Zero-sized; the state is the module's static so the panic hook — which has no
+/// handle to the subscriber — can read it.
+pub struct LogRing;
+
+impl<S: Subscriber> Layer<S> for LogRing {
+    fn on_event(&self, event: &Event<'_>, _ctx: Context<'_, S>) {
+        let start = START.get_or_init(Instant::now);
+        let meta = event.metadata();
+        let mut line = format!(
+            "+{:9.3}s {:5} {}: ",
+            start.elapsed().as_secs_f64(),
+            meta.level(),
+            meta.target()
+        );
+        event.record(&mut MessageVisitor(&mut line));
+        let mut ring = RING.lock().unwrap_or_else(|p| p.into_inner());
+        if ring.len() >= CAPACITY {
+            ring.pop_front();
+        }
+        ring.push_back(line);
+    }
+}
+
+/// Renders an event's fields the way the stderr formatter does: the `message` field bare, every
+/// other field as ` name=value` after it.
+struct MessageVisitor<'a>(&'a mut String);
+
+impl Visit for MessageVisitor<'_> {
+    fn record_debug(&mut self, field: &Field, value: &dyn std::fmt::Debug) {
+        if field.name() == "message" {
+            let _ = write!(self.0, "{value:?}");
+        } else {
+            let _ = write!(self.0, " {}={:?}", field.name(), value);
+        }
+    }
+
+    fn record_str(&mut self, field: &Field, value: &str) {
+        if field.name() == "message" {
+            self.0.push_str(value);
+        } else {
+            let _ = write!(self.0, " {}={value:?}", field.name());
+        }
+    }
+}
+
+/// The ring's contents, oldest first. A snapshot: the ring keeps filling behind it.
+pub fn recent() -> Vec<String> {
+    RING.lock()
+        .unwrap_or_else(|p| p.into_inner())
+        .iter()
+        .cloned()
+        .collect()
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use bevy::log::tracing_subscriber::layer::SubscriberExt;
+
+    /// The ring is a process-wide static, so this test owns the whole contract in one go: lines
+    /// land in emission order, the message field renders bare and the others as `k=v`, and the
+    /// ring drops its oldest line rather than growing past [`CAPACITY`].
+    #[test]
+    fn the_ring_keeps_the_last_lines_in_order() {
+        let subscriber = bevy::log::tracing_subscriber::registry().with(LogRing);
+        bevy::log::tracing::subscriber::with_default(subscriber, || {
+            for i in 0..(CAPACITY + 5) {
+                bevy::log::tracing::info!(n = i, "ring line");
+            }
+        });
+        let lines = recent();
+        assert_eq!(lines.len(), CAPACITY, "bounded at CAPACITY");
+        let first = &lines[0];
+        assert!(
+            first.contains("ring line n=5"),
+            "oldest surviving line: {first}"
+        );
+        assert!(first.contains(" INFO "), "level rendered: {first}");
+        assert!(
+            lines
+                .last()
+                .unwrap()
+                .contains(&format!("n={}", CAPACITY + 4)),
+            "newest last: {}",
+            lines.last().unwrap()
+        );
+    }
+}
diff --git a/crates/benilla-world/src/model_fade.rs b/crates/benilla-world/src/model_fade.rs
index ea21a77b..f5231566 100644
--- a/crates/benilla-world/src/model_fade.rs
+++ b/crates/benilla-world/src/model_fade.rs
@@ -1153,7 +1153,6 @@ fn start_alpha(tag: Option<&MeshTag>) -> f32 {
 /// itself but has fadeable meshes beneath it). Every entity visited — parts, joints, attach roots,
 /// billboard anchors alike — is recorded in `walked`, which the caller uses to recognise the
 /// world-root billboard cards that follow this model.
-#[allow(clippy::too_many_arguments)]
 fn arm_despawn_descendants(
     entity: Entity,
     now: f32,
diff --git a/crates/benilla-world/src/model_forms.rs b/crates/benilla-world/src/model_forms.rs
index 7aa7df36..d33ac40b 100644
--- a/crates/benilla-world/src/model_forms.rs
+++ b/crates/benilla-world/src/model_forms.rs
@@ -242,7 +242,6 @@ fn build_entry(
 /// urgent requester first — uncapped behind the loading cover (entry/teleport/world-stale), which
 /// exists to absorb exactly that burst. At least one submesh always builds, so progress is
 /// guaranteed. Frees an entry when its model asset leaves the store.
-#[allow(clippy::too_many_arguments)] // a Bevy system: each param is one resource, the app's convention
 pub(crate) fn furnish_model_forms(
     mut forms: ResMut<ModelForms>,
     m2s: Res<Assets<M2Model>>,
diff --git a/crates/benilla-world/src/model_render.rs b/crates/benilla-world/src/model_render.rs
index 13518ff4..08beb794 100644
--- a/crates/benilla-world/src/model_render.rs
+++ b/crates/benilla-world/src/model_render.rs
@@ -17,7 +17,7 @@ pub mod lazy;
 pub mod park;
 mod visibility;
 
-pub use batch::{BatchVariants, M2BatchMaterials, ModelMaterials, SkyboxBatch};
+pub use batch::{BatchVariants, EntityUvLane, M2BatchMaterials, ModelMaterials, SkyboxBatch};
 
 /// Yards of transparent-pass sort bias per authored batch-order step (`MatKey::batch_order` ×
 /// this, on `StandardMaterial::depth_bias` — bevy adds that field to the phase item's sort
@@ -220,7 +220,6 @@ pub type MaterialCache = benilla_assets::SpatialCache<MatKey, Handle<WowModelMat
 /// test at all. The source blend is what sets [`TWIN_CUTOUT_MARKER`] right (decision 0842: a twin
 /// built as `Blend` cut every texel under 224/255 out of a stealthed Opaque batch, which erased
 /// Gressil's blade body and left only its high-alpha rune pattern).
-#[allow(clippy::too_many_arguments)]
 pub fn model_material(
     cache: &mut MaterialCache,
     materials: &mut Assets<WowModelMaterial>,
@@ -840,7 +839,7 @@ pub struct FarSideOfWater;
 /// walking regime's continuous despawn stream costs ~0.5 full walks/s instead of 12–22.
 const GC_DEADLINE_SECS: f32 = 2.0;
 
-#[allow(clippy::type_complexity, clippy::too_many_arguments)]
+#[allow(clippy::type_complexity)]
 pub(crate) fn classify_water_side(
     interleave: crate::particles::WaterInterleave,
     mut twins: ResMut<FarSideTwins>,
diff --git a/crates/benilla-world/src/model_render/batch.rs b/crates/benilla-world/src/model_render/batch.rs
index 9574899e..817bc060 100644
--- a/crates/benilla-world/src/model_render/batch.rs
+++ b/crates/benilla-world/src/model_render/batch.rs
@@ -59,6 +59,23 @@ pub struct BatchVariants {
     pub zfill: Option<Handle<WowModelMaterial>>,
 }
 
+/// The **UV lane** an [`M2BatchMaterials::entity_variants`] call registers into (decision 2295) —
+/// the animated-material registry, the delta table (decision 1381) and, for the one measured class
+/// that needs it, the instance the materials belong to.
+///
+/// A bundle rather than three arguments because they are one thing — *where this batch's texture
+/// transform is delivered* — and because the shape that keeps failing on this lane is a caller who
+/// takes some of the pieces and not the rest.
+pub struct EntityUvLane<'a> {
+    pub reg: &'a mut crate::doodad_anim::UvAnimMaterials,
+    pub table: &'a mut crate::mat_anim_table::MatAnimTable,
+    /// `Some` when these materials belong to ONE instance rather than to the batch — the clone a
+    /// spawner makes for a GameObject whose file-sequence slots bake different loops (1408's
+    /// population, reached from the entity side by 2295). `None` — the overwhelming majority — is
+    /// the shared, deduped material every instance of the batch draws through.
+    pub instance: Option<Entity>,
+}
+
 /// The pair one skybox batch draws with ([`M2BatchMaterials::skybox`]): the authored blend at full
 /// weight, and the promoted SRC_ALPHA twin the 4-second crossfade rides (equal to `steady` when the
 /// authored blend already blends).
@@ -259,11 +276,27 @@ impl M2BatchMaterials<'_> {
     /// The full variant set an **entity** part needs: every M2 entity — unit, player, GameObject,
     /// held item, spell effect — is built LIT and carries the same indoor pair, because the
     /// reference hands every entity M2 the same entity-node fill (wow-re `unit-m2-shader-light`).
+    ///
+    /// **It also puts the batch on the UV lane** (decision 2295), and takes `uv` for exactly that
+    /// reason rather than leaving it to the caller: seeding a material's `sun_scale.zw` and
+    /// registering it for the per-frame sample are one fact — *this batch's texture transform
+    /// runs* — and the recurring bug on this lane is a caller that does one and not the other
+    /// (2038 marked without registering and froze every waterfall; a `play_uv` flip without a
+    /// registration would freeze every entity batch at its first key instead of its identity,
+    /// which is a different wrong frame, not a fix). Every variant that carries the loop is
+    /// registered here, because a unit walking indoors or feathering in swaps material and would
+    /// otherwise stop scrolling mid-stride.
+    ///
+    /// The **depth-prime twin is deliberately not registered**, matching the placed-doodad lane
+    /// (`terrain_stream::spawn::assemble` registers the cutout and blend materials and no other):
+    /// it draws only while a batch feathers, and its alpha test reading unscrolled UVs for those
+    /// frames is the behaviour the streamer has always had.
     pub fn entity_variants(
         &mut self,
         sub: &ModelSubmesh,
         texture: Option<Handle<Image>>,
         order: u16,
+        uv: &mut EntityUvLane<'_>,
     ) -> Option<BatchVariants> {
         let light = self.light.as_ref()?.0.clone();
         let torch = self.torch.binds()?;
@@ -274,7 +307,7 @@ impl M2BatchMaterials<'_> {
             ShadeSel::Lit,
             false,
             false,
-            false,
+            true,
             &light,
             &torch,
         );
@@ -285,7 +318,7 @@ impl M2BatchMaterials<'_> {
             ShadeSel::Matte,
             false,
             false,
-            false,
+            true,
             &light,
             &torch,
         );
@@ -296,7 +329,7 @@ impl M2BatchMaterials<'_> {
             ShadeSel::Matte,
             true,
             false,
-            false,
+            true,
             &light,
             &torch,
         );
@@ -320,7 +353,7 @@ impl M2BatchMaterials<'_> {
                 ShadeSel::Lit,
                 false,
                 true,
-                false,
+                true,
                 &light,
                 &torch,
             )
@@ -335,11 +368,32 @@ impl M2BatchMaterials<'_> {
                 ShadeSel::Matte,
                 true,
                 true,
-                false,
+                true,
                 &light,
                 &torch,
             )
         };
+        // On the lane, now, in the same call that built and seeded them. `register_entity_uv` is
+        // idempotent per material, so the variants that collapsed onto each other cost nothing.
+        let loops = crate::doodad_anim::UvLoops::of(sub);
+        if loops.animates() {
+            for id in [
+                &steady,
+                &interior,
+                &interior_bake,
+                &interior_bake_blend,
+                &fade_blend,
+            ] {
+                crate::doodad_anim::register_entity_uv(
+                    uv.reg,
+                    uv.table,
+                    &mut self.materials,
+                    id.id(),
+                    &loops,
+                    uv.instance,
+                );
+            }
+        }
         Some(BatchVariants {
             steady,
             interior,
@@ -471,7 +525,6 @@ impl M2BatchMaterials<'_> {
 
     /// The one call into the twenty-argument builder: every argument but the four this facade's
     /// entry points choose is read straight off the authored batch.
-    #[allow(clippy::too_many_arguments)]
     fn build(
         &mut self,
         sub: &ModelSubmesh,
diff --git a/crates/benilla-world/src/model_render/visibility.rs b/crates/benilla-world/src/model_render/visibility.rs
index c067cc89..46b2f346 100644
--- a/crates/benilla-world/src/model_render/visibility.rs
+++ b/crates/benilla-world/src/model_render/visibility.rs
@@ -26,7 +26,7 @@ use benilla_assets::materials::WowModelMaterial;
 /// Runs every frame (the camera moves, so this can't be snapshot-gated like a pure toggle), but only
 /// **writes** `Visibility` when a submesh's decision actually flips — so the steady-state cost is one
 /// squared-distance compare per submesh and no change-detection churn.
-#[allow(clippy::type_complexity, clippy::too_many_arguments)]
+#[allow(clippy::type_complexity)]
 pub(super) fn apply_model_visibility(
     debug: Res<DebugState>,
     view: Res<ViewDistance>,
diff --git a/crates/benilla-world/src/particles.rs b/crates/benilla-world/src/particles.rs
index 01dbe8e5..c6a2b3d3 100644
--- a/crates/benilla-world/src/particles.rs
+++ b/crates/benilla-world/src/particles.rs
@@ -35,7 +35,7 @@ mod emitdump;
 mod model;
 mod quads;
 pub mod render;
-pub(crate) mod sim; // `SceneGates` is the ribbon sim's draw-set input too (decision 1291)
+pub(crate) mod sim; // `SceneGates` is the ribbon sim's draw-set input too (decision 1294)
 
 use emit::{emit_local, next_u32, rand01, rand_s11};
 use sim::simulate_particles;
@@ -458,6 +458,17 @@ impl ParticleEmitter {
         self.anchor
     }
 
+    /// The **emission clock's host** ([`EmitClock::Host`]) — the model instance whose live
+    /// `AnimationPlayer` names the sequence this emitter samples its rate/gate tracks against;
+    /// `None` for a pinned or effect clock. The read an instrument or a wiring test needs, because
+    /// the difference is invisible in every other observable: a hosted and a pinned emitter build,
+    /// pool, tick and draw identically, and differ only in *which* sequence's tracks they read —
+    /// which is the whole difference between a firearm's muzzle blast firing and never firing
+    /// (decision 2281).
+    pub fn emit_host(&self) -> Option<Entity> {
+        self.host
+    }
+
     /// Switch this emitter to [`OwnerLoss::Drain`] — **the effect is ending, so its already-emitted
     /// particles must finish rather than pop** (wow-re `ceffect-particle-drain.md` §4a).
     ///
diff --git a/crates/benilla-world/src/particles/depthdump.rs b/crates/benilla-world/src/particles/depthdump.rs
index 2963ba10..bad17920 100644
--- a/crates/benilla-world/src/particles/depthdump.rs
+++ b/crates/benilla-world/src/particles/depthdump.rs
@@ -66,7 +66,6 @@ pub(super) fn frame(elapsed: f32, count: &mut u32) -> Option<u32> {
 
 /// Dump one emitter's live pool against the camera it billboards toward.
 #[cold]
-#[allow(clippy::too_many_arguments)] // the sim loop's full draw context, verbatim
 pub(super) fn dump_emitter(
     fidx: u32,
     def: &ParticleEmitterDef,
diff --git a/crates/benilla-world/src/particles/model.rs b/crates/benilla-world/src/particles/model.rs
index 67c3b360..162c9045 100644
--- a/crates/benilla-world/src/particles/model.rs
+++ b/crates/benilla-world/src/particles/model.rs
@@ -41,7 +41,6 @@ pub(super) struct ModelInstance {
 /// Grow + position each model-particle emitter's instance pool from its freshly-simulated
 /// pool. Runs after [`super::sim::simulate_particles`] in the same set, so instances land on
 /// this frame's positions (the anchored-exactness rule).
-#[allow(clippy::too_many_arguments)] // a Bevy system: each param is one resource, the app's convention
 pub(super) fn update_model_particles(
     mut commands: Commands,
     models: Res<Assets<M2Model>>,
diff --git a/crates/benilla-world/src/particles/render.rs b/crates/benilla-world/src/particles/render.rs
index 7b31db4d..aa602b98 100644
--- a/crates/benilla-world/src/particles/render.rs
+++ b/crates/benilla-world/src/particles/render.rs
@@ -560,7 +560,6 @@ pub static EFFECT_DRAW_STATS: [std::sync::atomic::AtomicU32; 2] = [
 /// (0733 §2; decal draws are exempt — 0781), upload them, build the frame's index stream in
 /// sorted-item order while merging sort-adjacent compatible items into single draws, and write
 /// the canonical fog-params rows once.
-#[allow(clippy::too_many_arguments)] // one render system's full input set
 fn prepare_effects(
     device: Res<RenderDevice>,
     queue: Res<RenderQueue>,
@@ -761,7 +760,6 @@ fn prepare_effects(
 }
 
 /// Build the view bind group and any missing per-texture groups for this frame's draws.
-#[allow(clippy::too_many_arguments)] // one render system's full input set
 fn prepare_effect_bind_groups(
     device: Res<RenderDevice>,
     pipeline_cache: Res<PipelineCache>,
diff --git a/crates/benilla-world/src/particles/sim.rs b/crates/benilla-world/src/particles/sim.rs
index 4dbd10be..d00df264 100644
--- a/crates/benilla-world/src/particles/sim.rs
+++ b/crates/benilla-world/src/particles/sim.rs
@@ -139,7 +139,6 @@ fn inherit_trigger(accum: &mut f32, held: &mut Vec3, dt: f32, delta: Vec3, live:
 /// PARTICLE's velocity into the child's inherit add (`(1+S11·var)·v` — for children the
 /// inherit vector IS the particle velocity, copied per call at `0x7b5b5e`). A burst child
 /// latches on its first call of the rising-edge frame. A child never self-emits ambiently.
-#[allow(clippy::too_many_arguments)] // the birth fold's full frame, same as the parent path
 fn drive_child(
     child: &mut ChildEmitter,
     now: &benilla_formats::ParamsNow,
@@ -489,7 +488,7 @@ fn scene_frozen(booth: Option<(bool, bool)>, owner_frozen: bool, draining: bool)
 
 /// Per-frame: emit, integrate, and expand each emitter's pool into the shared effect-quad
 /// stream ([`super::buffer::EffectQuads`]).
-#[allow(clippy::too_many_arguments, clippy::type_complexity)] // one Bevy system's full input set
+#[allow(clippy::type_complexity)] // one Bevy system's full input set
 pub(super) fn simulate_particles(
     time: Res<Time>,
     tuning: Res<ParticleTuning>,
diff --git a/crates/benilla-world/src/ribbons.rs b/crates/benilla-world/src/ribbons.rs
index 0292036a..dd8bcde2 100644
--- a/crates/benilla-world/src/ribbons.rs
+++ b/crates/benilla-world/src/ribbons.rs
@@ -221,7 +221,6 @@ pub enum RibbonSeq {
 /// sequence that answers it changes while the instance lives. Refusing at spawn was correct only
 /// for the fixed-sequence lanes it was written for (a held item, a missile) and silently wrong for
 /// everything with a state machine — see [`simulate_ribbons`].
-#[allow(clippy::too_many_arguments)] // the spawn's full wiring, `alpha_src` included
 pub fn spawn_ribbon(
     commands: &mut Commands,
     ribbon: &ModelRibbon,
@@ -286,7 +285,6 @@ pub fn spawn_ribbon(
 
 /// Per-frame: place the node from the owner's live transform, commit/expire edges, sag by
 /// gravity, and write the strip into the shared effect-quad stream.
-#[allow(clippy::too_many_arguments)] // one Bevy system's full input set
 pub(crate) fn simulate_ribbons(
     time: Res<Time>,
     mut commands: Commands,
diff --git a/crates/benilla-world/src/rig_anim/compose.rs b/crates/benilla-world/src/rig_anim/compose.rs
index 6e4e62a3..749bc59e 100644
--- a/crates/benilla-world/src/rig_anim/compose.rs
+++ b/crates/benilla-world/src/rig_anim/compose.rs
@@ -167,7 +167,7 @@ pub(crate) fn seed_rig_rows(
 /// Post-propagation (inside `BillboardPlace`, chained after the entity lane's
 /// `billboard_joint_palette` and before `face_billboards`): finalize every rig that needs it —
 /// palette rows + replaced-subtree anchor re-seats, with the seat-frame cascade.
-#[allow(clippy::type_complexity, clippy::too_many_arguments)] // billboard_joint_palette's shape
+#[allow(clippy::type_complexity)] // billboard_joint_palette's shape
 pub fn finalize_rig_worlds(
     cam: Query<&GlobalTransform, With<WorldCamera>>,
     // `Option<&RigSkin>`, not `&RigSkin` (decision 1365): the doodad lane's rigs hold their
@@ -175,7 +175,19 @@ pub fn finalize_rig_worlds(
     // still needs this pass for two things — clearing `pose_dirty` (or the model pass re-composes
     // it every frame for ever) and, when it authors billboard/arm bones, the camera-dependent
     // anchor re-seat its cards and emitters ride. The palette write alone is skipped.
-    mut rigs: Query<(Entity, &mut RigPose, Option<&RigSkin>, Has<AnimParked>)>,
+    // `Has<RigRider>`: a rider owns its slot's rows from the OTHER end (decision 1609 — the
+    // placement is composed in the HOST's rig frame, never from this absolute one), and decision
+    // 2281 gave that lane a posed arm, so an animated ranged prop arrives here with both a pose
+    // and a skin and must still not have its rows written twice from two different frames.
+    // Everything else this pass does for it — clearing `pose_dirty`, re-seating the anchors its
+    // emitters ride — is exactly what it needs.
+    mut rigs: Query<(
+        Entity,
+        &mut RigPose,
+        Option<&RigSkin>,
+        Has<AnimParked>,
+        Has<crate::rig_rider::RigRider>,
+    )>,
     // B0001: the `Changed` filter reads `GlobalTransform` ticks, which conflicts with the
     // mutable frame query — a `ParamSet` sequences them (the refresh set is collected first).
     mut worlds_params: ParamSet<(
@@ -202,7 +214,7 @@ pub fn finalize_rig_worlds(
     let refresh: Vec<Entity> = {
         let roots_changed = worlds_params.p0();
         rigs.iter()
-            .filter(|(_, rig, _, parked)| {
+            .filter(|(_, rig, _, parked, _)| {
                 !parked
                     && (rig.pose_dirty
                         || roots_changed.contains(rig.joints_root)
@@ -308,10 +320,13 @@ pub fn finalize_rig_worlds(
             }
         };
     for &holder in &refresh {
-        let Ok((_, rig, skin, _)) = rigs.get_mut(holder) else {
+        let Ok((_, rig, skin, _, rider)) = rigs.get_mut(holder) else {
             continue;
         };
         let rig = rig.into_inner();
+        // A rider's rows are the rider lane's (see the query's note): hand `finalize` no skin so
+        // it does the anchors and nothing else.
+        let skin = skin.filter(|_| !rider);
         finalize(rig, skin, &mut globals, &mut cascade, false);
         rig.pose_dirty = false;
     }
@@ -319,12 +334,13 @@ pub fn finalize_rig_worlds(
     // re-finalize against the fresh seat. One level deep by construction (a seat anchor's
     // subtree holds no further seat anchors).
     if !cascade.is_empty() {
-        for (holder, rig, skin, _) in &mut rigs {
+        for (holder, rig, skin, _, rider) in &mut rigs {
             if !cascade.contains(&holder) {
                 continue;
             }
             let rig = rig.into_inner();
             let mut ignore = Vec::new();
+            let skin = skin.filter(|_| !rider);
             finalize(rig, skin, &mut globals, &mut ignore, true);
             rig.pose_dirty = false;
         }
diff --git a/crates/benilla-world/src/rig_palette.rs b/crates/benilla-world/src/rig_palette.rs
index 5a723b45..8e8e9132 100644
--- a/crates/benilla-world/src/rig_palette.rs
+++ b/crates/benilla-world/src/rig_palette.rs
@@ -146,6 +146,10 @@ pub struct RigPalettes {
     /// Allocations refused since the last census line (`WOW_RIG_CENSUS`) — the exhaustion
     /// diagnosis's live denial rate (decision 0863). Read-and-reset by [`census_rig_palettes`].
     denied: u32,
+    /// Has the exhaustion warn already been logged this session? A latch, not a counter, and
+    /// deliberately never reset: [`Self::denied`] is `mem::take`n by the census, so gating the
+    /// warn on it would re-fire once per census window instead of once per session (2264).
+    denied_warned: bool,
     /// `WOW_RIG_COST` meters (decision 0736 premise check): whole-vec deep copies this frame
     /// (`Arc::make_mut` clones when the extract still holds last publish's reference), the µs
     /// they took, and the rows (bones) written. Printed + reset by [`publish_rig_palettes`].
@@ -174,6 +178,7 @@ impl Default for RigPalettes {
             peak_bones: 0,
             live_bones: 0,
             denied: 0,
+            denied_warned: false,
             cost_copies: 0,
             cost_copy_us: 0.0,
             cost_rows: 0,
@@ -603,11 +608,19 @@ impl RigPalettes {
     /// why this returns the pair and [`Self::world_palette`] (a picker read, not a precision one)
     /// does not.
     pub fn rider_placement(&self, slot: u16) -> Option<(Vec3, Vec3)> {
+        self.row_placement(slot, 0)
+    }
+
+    /// The same pair for an arbitrary bone of a slot. A bind-pose rider repeats one frame across
+    /// every row, so row 0 answers for the model; a **posed** one (decision 2281 — the flexing
+    /// ranged prop) does not, and asking which bone is the only way to see that its rows differ at
+    /// all. `None` for an unallocated slot or a bone past its length.
+    pub fn row_placement(&self, slot: u16, bone: u32) -> Option<(Vec3, Vec3)> {
         let s = slot as usize;
-        if *self.slot_len.get(s)? == 0 {
+        if bone >= *self.slot_len.get(s)? {
             return None;
         }
-        let r = 3 * *self.table.get(s)? as usize;
+        let r = 3 * (*self.table.get(s)? + bone) as usize;
         let o = self.origins.get(s)?;
         Some((
             Vec3::new(o[0], o[1], o[2]),
@@ -697,7 +710,8 @@ impl RigSkin {
 
     /// Allocate a palette rig over live joint entities (the effect/booth/equipment lane — the
     /// change sweep computes its rows; doodads moved to [`Self::allocate_bones`], decision 1365).
-    /// `None` (with one loud warn per session) when the table is full — the caller renders the
+    /// `None` (with one loud warn per session — a promise this doc made for a long time before
+    /// the code kept it, 2264) when the table is full — the caller renders the
     /// static bind-pose mesh instead.
     pub fn allocate(
         palettes: &mut RigPalettes,
@@ -724,11 +738,22 @@ impl RigSkin {
             }),
             None => {
                 palettes.denied += 1;
-                let (s, b, ps, pb) = palettes.occupancy();
-                warn!(
-                    "rig palette exhausted ({bones} bones wanted; live {s} slots / {b} bones, \
-                     peak {ps}/{pb}) — rig renders at bind pose"
-                );
+                // **Once per session, as this function's doc has always promised.** It did not
+                // keep that promise: the denial path warned on every call, and the lazy-doodad
+                // caller retries *every frame while the host is drawn*
+                // (`doodad_anim::lazy` — "table full — the warn fired; the gate retries while
+                // drawn"), so a crowded scene turned one fact into a per-frame flood that buries
+                // every other warning in the log. The repeats were never the signal anyway:
+                // `denied` is already counted here and already reported by the palette census.
+                if !palettes.denied_warned {
+                    palettes.denied_warned = true;
+                    let (s, b, ps, pb) = palettes.occupancy();
+                    warn!(
+                        "rig palette exhausted ({bones} bones wanted; live {s} slots / {b} bones, \
+                         peak {ps}/{pb}) — rig renders at bind pose. Further denials are counted \
+                         in `denied`, not logged; run with WOW_RIG_CENSUS for the running tally."
+                    );
+                }
                 None
             }
         }
diff --git a/crates/benilla-world/src/rig_rider.rs b/crates/benilla-world/src/rig_rider.rs
index 670b971a..6217ad76 100644
--- a/crates/benilla-world/src/rig_rider.rs
+++ b/crates/benilla-world/src/rig_rider.rs
@@ -49,10 +49,11 @@
 //! `welds_billboard` displays whose 0841/0854 joint rig is camera-replaced per frame and so is not
 //! a bind-pose rigid frame.
 
+use bevy::mesh::skinning::SkinnedMeshInverseBindposes;
 use bevy::prelude::*;
 
 use crate::rig_anim::RigPose;
-use crate::rig_palette::{rebase_origin, RigPalettes};
+use crate::rig_palette::{rebase_origin, RigPalettes, RigSkin};
 
 /// An attached model whose palette slot is placed from a bone of `host`'s rig, in `host`'s own rig
 /// frame (decision 1609). Lives on the attached model's root, beside the [`crate::rig_palette::RigSkin`]
@@ -79,13 +80,28 @@ pub struct RigRider {
 /// alone — they hold the last frame written, which is what a torn-down joint gets in the entity
 /// lane too. [`RigPalettes::write_rider`] is idempotent, so a standing unit's riders cost one
 /// compare each and never reach the upload.
+///
+/// **A rider that carries a pose of its OWN is posed, not repeated** (decision 2281). 1609's
+/// "every row is the placement" collapse is a consequence of bind pose, and the ranged weapon prop
+/// does not rest at bind pose: the reference re-arms `[CGUnit+0xd24]`'s own M2 instance to
+/// BowPull(160) at `$BWP` and to BowRelease(161) / Stand(0) at `$BWR`, so its bones move. Such a
+/// rider's row `b` is `F × own.model[b] × ibp[b]` — the same placement `F`, composed with the
+/// prop's own model-space pose, every factor still rig-sized, so the precision property this whole
+/// lane exists for is untouched. The population is one prop per unit holding a DRAWN animated
+/// ranged weapon (46 of the 571 shipped weapon models author 160/161), which is why the posed arm
+/// re-writes unconditionally where the rigid arm compares first.
 pub(crate) fn write_rig_riders(
-    riders: Query<&RigRider>,
+    riders: Query<(Entity, &RigRider)>,
     poses: Query<&RigPose>,
+    skins: Query<&RigSkin>,
     frames: Query<&GlobalTransform>,
+    ibps: Res<Assets<SkinnedMeshInverseBindposes>>,
+    // The posed arm's row scratch, reused across frames and riders — a posed prop is re-derived
+    // every frame and a fresh `Vec` per rider per frame is pure churn.
+    mut scratch: Local<Vec<GlobalTransform>>,
     mut palettes: ResMut<RigPalettes>,
 ) {
-    for rider in &riders {
+    for (entity, rider) in &riders {
         let Ok(pose) = poses.get(rider.host) else {
             continue;
         };
@@ -106,11 +122,24 @@ pub(crate) fn write_rig_riders(
         let origin = rebase_origin(root_g.translation());
         let mut basis = root_g.affine();
         basis.translation -= bevy::math::Vec3A::from(origin);
-        palettes.write_rider(
-            rider.slot,
-            basis * *bone * bevy::math::Affine3A::from_translation(rider.local),
-            origin,
-        );
+        let frame = basis * *bone * bevy::math::Affine3A::from_translation(rider.local);
+        // The prop's OWN pose, when it has one: compose each of its model-space bone frames onto
+        // the placement and let the ordinary world write lay the rows down. `write_rig_worlds`
+        // takes it from there — same `frame × ibp` row math, same origin word, same dirty push.
+        let posed = poses
+            .get(entity)
+            .ok()
+            .filter(|own| !own.model.is_empty())
+            .zip(skins.get(entity).ok())
+            .and_then(|(own, skin)| Some((own, skin, ibps.get(&skin.ibp)?)));
+        match posed {
+            Some((own, skin, ibp)) => {
+                scratch.clear();
+                scratch.extend(own.model.iter().map(|m| GlobalTransform::from(frame * *m)));
+                palettes.write_rig_worlds(skin, &scratch, ibp, origin);
+            }
+            None => palettes.write_rider(rider.slot, frame, origin),
+        }
     }
 }
 
@@ -118,7 +147,7 @@ pub(crate) fn write_rig_riders(
 mod tests {
     use super::*;
     use crate::rig_palette::RigSkin;
-    use bevy::math::{Affine3A, DVec3};
+    use bevy::math::{Affine3A, DVec3, Mat4};
 
     /// **The rig's frame is `joints_root`'s, not the host entity's** — the one distinction that
     /// separates a helm sitting on a head from one sitting a saddle's height below it.
@@ -133,6 +162,8 @@ mod tests {
     fn a_rider_composes_through_the_rigs_own_frame_not_the_units() {
         let mut app = App::new();
         app.init_resource::<RigPalettes>();
+        // The posed arm's asset lookup (decision 2281); `AssetPlugin` provides it in the app.
+        app.init_resource::<Assets<SkinnedMeshInverseBindposes>>();
         // The seat: a yard and a half up and turned 90° — a mount's saddle, exaggerated so a
         // composition through the wrong frame cannot land near the right answer by luck.
         const SEAT: Vec3 = Vec3::new(1.0, 1.5, -2.0);
@@ -200,6 +231,86 @@ mod tests {
         );
     }
 
+    /// **A rider that poses writes DIFFERENT rows** (decision 2281) — the property that makes the
+    /// gun's bolt recoil and the bow's limbs bend without giving either the absolute-frame ULP
+    /// staircase 1609 removed.
+    ///
+    /// The subject is the flexing prop's shape: two bones, the second displaced by its own pose,
+    /// hanging off a host bone. Bind-pose riders repeat one frame into every row, so the test that
+    /// this lane has really changed is that row 1 is **not** row 0 — and that row 1 lands where the
+    /// composition `F × model[1]` says, in the host's frame with the host's origin word.
+    #[test]
+    fn a_posed_rider_composes_each_bone_instead_of_repeating_the_placement() {
+        let mut app = App::new();
+        app.init_resource::<RigPalettes>();
+        app.init_resource::<Assets<SkinnedMeshInverseBindposes>>();
+        // The host: a unit standing off the origin, its own rig frame at its feet.
+        const AT: Vec3 = Vec3::new(-9451.0, 42.0, 61.0);
+        let unit = app
+            .world_mut()
+            .spawn(GlobalTransform::from(Transform::from_translation(AT)))
+            .id();
+        let mut host_pose =
+            crate::testing::test_rig_pose(unit, &[Vec3::ZERO, Vec3::new(0.0, 1.4, 0.0)]);
+        host_pose.compose();
+        app.world_mut().entity_mut(unit).insert(host_pose);
+
+        // Identity inverse bindposes, so a row reduces to `F × model[b]` and the arithmetic in the
+        // assertion is the mechanism rather than a second implementation of it.
+        let ibp = app
+            .world_mut()
+            .resource_mut::<Assets<SkinnedMeshInverseBindposes>>()
+            .add(SkinnedMeshInverseBindposes::from(vec![Mat4::IDENTITY; 2]));
+        let skin = {
+            let mut palettes = app.world_mut().resource_mut::<RigPalettes>();
+            RigSkin::allocate_bones(&mut palettes, 2, ibp).unwrap()
+        };
+        let slot = skin.slot;
+        // The prop's OWN pose: bone 1 a third of a yard down its length — stand-in for the muzzle
+        // bone a firearm's BowRelease swings.
+        const MUZZLE: Vec3 = Vec3::new(0.33, 0.0, 0.0);
+        let prop = app.world_mut().spawn_empty().id();
+        let mut prop_pose = crate::testing::test_rig_pose(prop, &[Vec3::ZERO, MUZZLE]);
+        prop_pose.compose();
+        app.world_mut().entity_mut(prop).insert((
+            skin,
+            prop_pose,
+            RigRider {
+                host: unit,
+                bone: 1,
+                local: Vec3::ZERO,
+                slot,
+            },
+        ));
+        app.add_systems(Update, write_rig_riders);
+        app.update();
+
+        let (origin, row0) = app
+            .world()
+            .resource::<RigPalettes>()
+            .row_placement(slot, 0)
+            .expect("written");
+        let (_, row1) = app
+            .world()
+            .resource::<RigPalettes>()
+            .row_placement(slot, 1)
+            .expect("written");
+        assert_eq!(origin, AT, "still measured from the HOST's frame (1609)");
+        assert!(
+            row1.distance(row0) > 0.3,
+            "row 1 must carry the prop's own pose, not a copy of row 0 ({row0:?} vs {row1:?})"
+        );
+        // Row 0 is the placement itself: the host bone 1.4 yd up, rig-relative.
+        assert!(
+            row0.abs_diff_eq(Vec3::new(0.0, 1.4, 0.0), 1.0e-4),
+            "row 0 is the attach frame: {row0:?}"
+        );
+        assert!(
+            row1.abs_diff_eq(Vec3::new(0.0, 1.4, 0.0) + MUZZLE, 1.0e-4),
+            "row 1 is that frame composed with the prop's bone: {row1:?}"
+        );
+    }
+
     /// **The pin** (decision 1609), in the shape decision 0974 set for the body: score both
     /// routes' *rendered motion* against an f64 oracle of the identical chain, at Goldshire, with
     /// real glam f32 arithmetic — not a model of it.
diff --git a/crates/benilla-world/src/skybox.rs b/crates/benilla-world/src/skybox.rs
index ca3d5414..e6410da6 100644
--- a/crates/benilla-world/src/skybox.rs
+++ b/crates/benilla-world/src/skybox.rs
@@ -246,7 +246,6 @@ impl Plugin for SkyboxPlugin {
 /// the reported spot it seeds the street group g08 (`0x42805`, a true interior; pin-probed
 /// 2026-09-01, decision 1827) — which is what lets the crossfade weight engage in the square while
 /// the skybox *name* comes from the flood predicate above.
-#[allow(clippy::too_many_arguments)]
 fn resolve_camera_skybox(
     instances: Query<&crate::wmo_portal::WmoPortalInstance>,
     wmos: Res<Assets<WmoModel>>,
diff --git a/crates/benilla-world/src/static_gx/cull.rs b/crates/benilla-world/src/static_gx/cull.rs
index 8b83bb7a..70c64321 100644
--- a/crates/benilla-world/src/static_gx/cull.rs
+++ b/crates/benilla-world/src/static_gx/cull.rs
@@ -171,7 +171,6 @@ fn spawn_exile(commands: &mut Commands, f: &GxFader, alpha: f32, admitted: bool)
 /// on that same next frame — the retained item dies in the rendered frame the entity
 /// appears (the overlap protocol; see [`FaderState`]). A re-admit reverses both in ONE
 /// frame: the despawn lands before extract and the cleared bit rides the same publish.
-#[allow(clippy::too_many_arguments)]
 pub(super) fn cull_cells(
     mut commands: Commands,
     mut gx: ResMut<StaticGx>,
diff --git a/crates/benilla-world/src/static_gx/render.rs b/crates/benilla-world/src/static_gx/render.rs
index e2c7632a..d71860b6 100644
--- a/crates/benilla-world/src/static_gx/render.rs
+++ b/crates/benilla-world/src/static_gx/render.rs
@@ -454,7 +454,6 @@ fn vertex_layout() -> VertexBufferLayout {
 
 /// (Re-)specialize the four pipelines for the world view's (samples, format), and assemble
 /// visible cells' GPU state: classes, arrays, layer table, bind groups, runs.
-#[allow(clippy::too_many_arguments)]
 fn prepare_static_gx(
     gx: Res<GxWorld>,
     mut cache: ResMut<GxGpuCache>,
diff --git a/crates/benilla-world/src/straddle.rs b/crates/benilla-world/src/straddle.rs
index 82c28da7..208cc7b2 100644
--- a/crates/benilla-world/src/straddle.rs
+++ b/crates/benilla-world/src/straddle.rs
@@ -283,7 +283,6 @@ type BandRoot<'a> = (
 /// Update, after the submersion verdict and before `classify_water_side` — the auto-inserted
 /// sync point between them lands a first-time `ModelWaterBand` before the classifier looks, so
 /// the clip and the twin set flip on the same frame.
-#[allow(clippy::too_many_arguments)]
 pub(crate) fn band_instances(
     interleave: WaterInterleave,
     mut clips: ResMut<WaterClips>,
diff --git a/crates/benilla-world/src/terrain_stream.rs b/crates/benilla-world/src/terrain_stream.rs
index 664c513f..e507f16b 100644
--- a/crates/benilla-world/src/terrain_stream.rs
+++ b/crates/benilla-world/src/terrain_stream.rs
@@ -622,7 +622,7 @@ impl Plugin for TerrainPlugin {
 /// register its doodad/WMO placements. The desired square is gated on the map's WDT `MAIN` grid
 /// (decision 0476): a tile the map doesn't author is never requested — no NotFound error spam on
 /// open-ocean crossings, and the loading screen's ready/total counts only tiles that can exist.
-#[allow(clippy::too_many_arguments, clippy::type_complexity)] // the bundled asset_stores tuple
+#[allow(clippy::type_complexity)] // the bundled asset_stores tuple
 fn stream_terrain(
     mut commands: Commands,
     mut state: ResMut<TerrainStreamer>,
@@ -1430,9 +1430,9 @@ fn despawn_tile_owned(commands: &mut Commands, t: &TileState) {
 /// tail-calls the chunk-rebuild walk (`0x6725a0` → `0x6b1d20`, wow-re terrain.md), so a change
 /// re-scatters the LOADED tiles too, not just future streams. The fresh `ClutterChunk`s spawn
 /// unbuilt and the lazy builder re-meshes the ~70 yd bubble over the next frames. Watches the
-/// VALUE, not `is_changed()`: the cvar sync's `Knobs` construction deref-muts every knob
-/// resource whenever any cvar moves, so the flag over-fires (cvars.rs notes the same trap).
-/// First sight only arms.
+/// VALUE, not `is_changed()`, because the predicate is "the density moved" and not "the resource
+/// moved": `ClutterConfig` also carries the detail-doodad cutout, whose console command would
+/// otherwise re-scatter every loaded tile. First sight only arms.
 fn rescatter_clutter(
     mut commands: Commands,
     mut streamer: ResMut<TerrainStreamer>,
diff --git a/crates/benilla-world/src/terrain_stream/merge.rs b/crates/benilla-world/src/terrain_stream/merge.rs
index e87f44f3..425e133c 100644
--- a/crates/benilla-world/src/terrain_stream/merge.rs
+++ b/crates/benilla-world/src/terrain_stream/merge.rs
@@ -281,7 +281,6 @@ impl StaticMerge {
     /// and the shader's `> 7` arm pins it opaque). `false` = this site never merges (WMO group
     /// geometry and props — 1418's verdict / the referrer-set key) — the caller spawns the
     /// batch individually, the fail-open arm.
-    #[allow(clippy::too_many_arguments)]
     pub(super) fn divert(
         &mut self,
         site: &MergeSite<'_>,
diff --git a/crates/benilla-world/src/terrain_stream/spawn/assemble.rs b/crates/benilla-world/src/terrain_stream/spawn/assemble.rs
index 54abac43..898e5b7f 100644
--- a/crates/benilla-world/src/terrain_stream/spawn/assemble.rs
+++ b/crates/benilla-world/src/terrain_stream/spawn/assemble.rs
@@ -82,7 +82,6 @@ pub struct SpawnedModel {
 /// WMO-display GameObject's doodad props ([`crate::entities`]'s `wmo_props`, the ship's sails), which
 /// pass a doodad-LOCAL `transform` + `card_owner` and parent the returned entities under the moving
 /// gameobject (every downstream system reads propagated `GlobalTransform`s, so the composition holds).
-#[allow(clippy::too_many_arguments)]
 pub fn spawn_model_entities(
     commands: &mut Commands,
     mat_cache: &mut MaterialCache,
@@ -646,7 +645,7 @@ pub fn spawn_model_entities(
                     anim_table,
                     materials,
                     id,
-                    crate::doodad_anim::UvLoop::Shared(anim.clone()),
+                    crate::doodad_anim::UvLoop::Shared(Some(anim.clone())),
                 );
             }
         }
diff --git a/crates/benilla-world/src/terrain_stream/spawn/mod.rs b/crates/benilla-world/src/terrain_stream/spawn/mod.rs
index 4e6a41f1..16c38d00 100644
--- a/crates/benilla-world/src/terrain_stream/spawn/mod.rs
+++ b/crates/benilla-world/src/terrain_stream/spawn/mod.rs
@@ -76,7 +76,6 @@ type SpawnTables<'w> = (
     crate::static_gx::TorchShared<'w>,
 );
 
-#[allow(clippy::too_many_arguments)]
 pub(super) fn spawn_loaded_placements(
     mut commands: Commands,
     placements: ResMut<Placements>,
diff --git a/crates/benilla-world/src/water_fx/mod.rs b/crates/benilla-world/src/water_fx/mod.rs
index 73978607..d2b4c105 100644
--- a/crates/benilla-world/src/water_fx/mod.rs
+++ b/crates/benilla-world/src/water_fx/mod.rs
@@ -318,7 +318,6 @@ fn build_patch(
 
 /// Classify + gate + emit for one unit this frame (the driver `0x5fa760`, once per unit per
 /// frame; emission paced by the unit's shared cooldown cell).
-#[allow(clippy::too_many_arguments)]
 fn drive_unit(
     foam_state: &mut UnitFoam,
     alloc: &mut dyn FnMut(FoamRecord),
@@ -413,7 +412,6 @@ fn drive_unit(
 
 /// Per frame: run the driver for the avatar (its real movement flags — the reference's own
 /// selection bits) and for every streamed unit (the velocity/yaw proxy), emitting pool records.
-#[allow(clippy::too_many_arguments)] // the emitter's real input set; the index ride-along tipped it
 fn emit_water_foam(
     time: Res<Time>,
     materials: Option<Res<FoamAssets>>,
diff --git a/crates/benilla-world/src/wdl.rs b/crates/benilla-world/src/wdl.rs
index 319ede87..dec57ba8 100644
--- a/crates/benilla-world/src/wdl.rs
+++ b/crates/benilla-world/src/wdl.rs
@@ -131,7 +131,6 @@ fn setup_wdl(
     });
 }
 
-#[allow(clippy::too_many_arguments)]
 fn stream_wdl(
     mut commands: Commands,
     streamer: Option<ResMut<WdlStreamer>>,
diff --git a/crates/benilla-world/src/weather/precip/mist.rs b/crates/benilla-world/src/weather/precip/mist.rs
index d351068d..92bd4d31 100644
--- a/crates/benilla-world/src/weather/precip/mist.rs
+++ b/crates/benilla-world/src/weather/precip/mist.rs
@@ -179,7 +179,6 @@ fn accrue(budget: f32, rate: f32, dt: f32) -> f32 {
 /// (the arg is the RAMPED effect density — the same `effect+0xd0` value the drop kinematics
 /// read, so the knee sits on the density, not the raw wire grade), one node per unit, cap 128;
 /// then every node streams along its motion basis and retires at end-of-life.
-#[allow(clippy::too_many_arguments)]
 pub(super) fn run_mist(
     mist: &mut Mist,
     weather: &WeatherState,
diff --git a/crates/benilla-world/src/weather/precip/mod.rs b/crates/benilla-world/src/weather/precip/mod.rs
index 3304841f..059fdf29 100644
--- a/crates/benilla-world/src/weather/precip/mod.rs
+++ b/crates/benilla-world/src/weather/precip/mod.rs
@@ -98,7 +98,7 @@ pub(crate) use wind::{wow_azimuth_to_bevy, WeatherWind};
 
 /// Which weather **leg** we run — the reference picks per the `useWeatherShaders` CVar
 /// (default "1", registered `0x67b81d`) AND a rain.bls/patter.bls ARB validation (`0x58b360`);
-/// the verdict lands in `effect+0`. **SHADER — settled in round 3** (0333, retracting 0332's
+/// the verdict lands in `effect+0`. **SHADER — settled in round 3** (2272, retracting 0332's
 /// fixed-func inference): the shader leg's ~10 s onset is real — close-only packet visibility
 /// (`0x6752b0` bakes at flush alone), the packet-1 forecast orphan, and the RNE parity stick
 /// (`0x6754cc`) stack into a stochastic onset (~75% in the 8.5–14 s band, ~25% at ~5 s), and
@@ -453,7 +453,6 @@ fn setup_precip(
 
 /// Per frame: wind, spawn budgets, integrate, land. (The geometry push is [`push_precip`]'s,
 /// in `PostUpdate` after the stream clear.)
-#[allow(clippy::too_many_arguments)]
 fn simulate_precip(
     time: Res<Time>,
     weather: Res<WeatherState>,
@@ -611,7 +610,6 @@ fn simulate_precip(
 /// anchor at the camera — view-z ≈ 0 sorts them after every world transparent, before the
 /// biased glare/nameplate rungs, exactly where the old camera-anchored layer entities landed.
 /// Indoors nothing is pushed — the frozen drops hang, unrendered (`[0xca80c4]`'s draw kill).
-#[allow(clippy::too_many_arguments)] // one push system's full input set
 fn push_precip(
     precip: Option<Res<Precip>>,
     assets: Option<Res<PrecipAssets>>,
diff --git a/crates/benilla-world/src/weather/precip/pool.rs b/crates/benilla-world/src/weather/precip/pool.rs
index c783a066..3a04b45d 100644
--- a/crates/benilla-world/src/weather/precip/pool.rs
+++ b/crates/benilla-world/src/weather/precip/pool.rs
@@ -294,7 +294,6 @@ pub(super) fn spawn_particle(
 
 /// One kind's frame: record (RNE-counted, packet-stamped), activate sealed cohorts,
 /// integrate, land into the ground layer.
-#[allow(clippy::too_many_arguments)]
 pub(super) fn run_kind(
     pool: &mut Pool,
     kind: WeatherKind,
diff --git a/crates/benilla-world/src/wmo_portal/interior.rs b/crates/benilla-world/src/wmo_portal/interior.rs
index cb8116a9..b1bdfefa 100644
--- a/crates/benilla-world/src/wmo_portal/interior.rs
+++ b/crates/benilla-world/src/wmo_portal/interior.rs
@@ -212,7 +212,6 @@ pub(super) fn track_area_interior(
 /// flicker, 2026-07-03). The camera is the fallback before login / detached free-fly.
 /// Independent of the PVS compute (which early-outs on portal-less models — a portal-less hut
 /// still has a floor to stand on; the *render* seed stays the camera, as the client's does).
-#[allow(clippy::too_many_arguments)] // a Bevy system: each arg is a distinct resource/query
 pub(super) fn track_current_interior(
     wmos: Res<Assets<WmoModel>>,
     viewer: Res<crate::view::Viewer>,
diff --git a/crates/benilla-world/src/wmo_portal/mod.rs b/crates/benilla-world/src/wmo_portal/mod.rs
index fd4cc27f..d3afd34d 100644
--- a/crates/benilla-world/src/wmo_portal/mod.rs
+++ b/crates/benilla-world/src/wmo_portal/mod.rs
@@ -382,7 +382,6 @@ const MAX_FLOOR_DROP: f32 = 1760.0;
 
 /// Recompute each resident WMO's per-group visible set from the camera. Cheap: a handful of buildings,
 /// each a small portal flood; a portal-less prop just stays all-visible.
-#[allow(clippy::too_many_arguments)] // a Bevy system: each arg is a distinct resource/query
 fn compute_wmo_pvs(
     wmos: Res<Assets<WmoModel>>,
     cam: Query<(&GlobalTransform, &Projection), With<WorldCamera>>,
diff --git a/crates/benilla-world/src/wmo_portal/seed.rs b/crates/benilla-world/src/wmo_portal/seed.rs
index e05779f0..6373b658 100644
--- a/crates/benilla-world/src/wmo_portal/seed.rs
+++ b/crates/benilla-world/src/wmo_portal/seed.rs
@@ -82,7 +82,6 @@ pub fn down_ray_seeds(model: &WmoModel, eye: [f32; 3], terrain_z: Option<f32>) -
 /// space** (the down-ray's own frame), or `None` where there is no terrain surface to hit — off the
 /// streamed tiles, or a hole cut through the ground into this very interior. It is the client's second
 /// probe, and it wins the column whenever it is *strictly* nearer to the eye than the WMO's hit.
-#[allow(clippy::too_many_arguments)] // the model's stored pieces, passed as parallel slices
 pub(crate) fn down_ray_pick(
     tris: &[Vec<[[f32; 3]; 3]>],
     grids: &[Option<ColumnGrid>],
@@ -354,7 +353,6 @@ pub(crate) fn up_ray_claim(
 
 /// The shared body: `up` flips which side of the probe a face must lie on and which candidate
 /// wins — the nearest one in the cast's own direction, exactly as `footprint_scan` does it.
-#[allow(clippy::too_many_arguments)]
 fn ray_claim(
     tris: &[Vec<[[f32; 3]; 3]>],
     bounds: &[Option<([f32; 3], [f32; 3])>],
diff --git a/crates/benilla-worldview/Cargo.toml b/crates/benilla-worldview/Cargo.toml
index baff5ca6..a7a7d236 100644
--- a/crates/benilla-worldview/Cargo.toml
+++ b/crates/benilla-worldview/Cargo.toml
@@ -5,6 +5,9 @@ edition.workspace = true
 license.workspace = true
 description = "The world viewer: the engine with no game attached — and the wall that keeps the split honest (decision 1160)"
 
+[lints]
+workspace = true
+
 [dependencies]
 # **Only the engine.** This is the edge the binary exists to hold: if a world concept
 # ever needs the game, this line is what refuses to let it.
diff --git a/crates/benilla/Cargo.toml b/crates/benilla/Cargo.toml
index 6d7350b9..4505c87c 100644
--- a/crates/benilla/Cargo.toml
+++ b/crates/benilla/Cargo.toml
@@ -5,6 +5,9 @@ edition.workspace = true
 license.workspace = true
 description = "The launcher: build.rs stamps the git build id, main() hands it to benilla-app. A shim, so the stamp's every-commit rebuild dirties this package and not the app crate (decision 0993)"
 
+[lints]
+workspace = true
+
 [features]
 # The dev/player seam, forwarded (decisions 0026 + 1173): this shim is the binary a player would
 # run, so `cargo build -p benilla --no-default-features` is the player build — and the gate.