diff --git a/Cargo.toml b/Cargo.toml
index 78a166f7..0552b3cc 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -12,6 +12,16 @@ authors = ["sam <samuv.eth@gmail.com>"]
 # since day one, enacted at the 0530 debt sweep). Per-crate feature additions stay in the crate.
 # `image` deliberately stays per-crate: its default-features/feature sets differ per consumer,
 # and a workspace default-features choice can't be subtracted from downstream.
+# **Lint policy** (decision 2266 §C4). `too_many_arguments` is a readability lint for plain
+# functions; on a Bevy system the parameter list IS the scheduler's dependency declaration, and
+# a system that reads eight resources has eight parameters by construction. The lint had fired
+# 364 times in this workspace and been allowed 364 times, 281 of them on systems — a lint whose
+# every verdict is overridden is not a gate, it is a tax on adding a system. Allowed once here;
+# the per-site attributes are gone. `type_complexity` stays on: it fires on shapes a type alias
+# or a `SystemParam` bundle genuinely fixes.
+[workspace.lints.clippy]
+too_many_arguments = "allow"
+
 [workspace.dependencies]
 anyhow = "1.0.102"
 # bevy's `default` is `["2d", "3d", "ui"]`, and every one of those three pulls `audio`
diff --git a/crates/benilla-adt/Cargo.toml b/crates/benilla-adt/Cargo.toml
index 698998c3..10ad7516 100644
--- a/crates/benilla-adt/Cargo.toml
+++ b/crates/benilla-adt/Cargo.toml
@@ -5,5 +5,8 @@ edition.workspace = true
 license.workspace = true
 description = "ADT terrain-tile reader for WoW 1.12.1 (build 5875) — in-repo, decision 0021"
 
+[lints]
+workspace = true
+
 [dependencies]
 benilla-bytes = { path = "../benilla-bytes" }
diff --git a/crates/benilla-app/Cargo.toml b/crates/benilla-app/Cargo.toml
index 26b841c3..18380dad 100644
--- a/crates/benilla-app/Cargo.toml
+++ b/crates/benilla-app/Cargo.toml
@@ -5,6 +5,9 @@ edition.workspace = true
 license.workspace = true
 description = "The Bevy app as a library: everything but the build-id stamp, which lives in the `benilla` launcher shim so a commit dirties ~30 lines instead of this crate (decision 0993)"
 
+[lints]
+workspace = true
+
 [features]
 # **The dev/player seam** (decisions 0026 + 1173). Default-ON, so every ordinary `cargo run`,
 # capture, probe and gate builds exactly what it built before. `--no-default-features` compiles
diff --git a/crates/benilla-app/src/area.rs b/crates/benilla-app/src/area.rs
index ed799f45..756e323b 100644
--- a/crates/benilla-app/src/area.rs
+++ b/crates/benilla-app/src/area.rs
@@ -145,7 +145,6 @@ fn elect_event(cache: &ZoneCache, next: &ZoneSignal) -> Option<&'static str> {
 /// indoor override), the PvP tuple, write the host globals, then fire the elected zone event
 /// and — independently, like the client's second site — `MINIMAP_ZONE_CHANGED` when the
 /// subzone-else-zone line changed.
-#[allow(clippy::too_many_arguments)]
 fn feed_zone_events(
     script: Option<NonSendMut<UiScript>>,
     world: benilla_world::world_point::WorldPoint,
diff --git a/crates/benilla-app/src/area_trigger.rs b/crates/benilla-app/src/area_trigger.rs
index e9e09a39..4e3f74f7 100644
--- a/crates/benilla-app/src/area_trigger.rs
+++ b/crates/benilla-app/src/area_trigger.rs
@@ -112,7 +112,7 @@ impl Plugin for AreaTriggerPlugin {
                 Update,
                 check_area_triggers
                     .in_set(WorldStage::Stream)
-                    .run_if(in_state(crate::char_select::ClientState::InWorld)),
+                    .in_set(crate::char_select::InWorldGated),
             );
     }
 }
diff --git a/crates/benilla-app/src/aura_visual.rs b/crates/benilla-app/src/aura_visual.rs
index f67a42cf..693fe426 100644
--- a/crates/benilla-app/src/aura_visual.rs
+++ b/crates/benilla-app/src/aura_visual.rs
@@ -742,7 +742,6 @@ type AuraParts<'w, 's> = Query<
 /// Note the swap keys on the *instance* alpha only: a batch whose own animated colour alpha dips is
 /// a per-batch quantity the reference combines separately, and forcing those onto a blend pass would
 /// change every existing unit's look.
-#[allow(clippy::too_many_arguments)] // one Bevy system's full input set
 pub(crate) fn apply_aura_alpha(
     time: Res<Time>,
     mut commands: Commands,
@@ -842,7 +841,6 @@ fn author_cards(
 /// property that its attached models render off (the same reason
 /// [`benilla_world::model_fade::apply_despawn_fade`] and the self feather both walk descendants, not
 /// children).
-#[allow(clippy::too_many_arguments)] // the author's full channel set, threaded down the walk
 fn author_descendants(
     entity: Entity,
     alpha: f32,
diff --git a/crates/benilla-app/src/bindings.rs b/crates/benilla-app/src/bindings.rs
index 61aec3d8..a517596d 100644
--- a/crates/benilla-app/src/bindings.rs
+++ b/crates/benilla-app/src/bindings.rs
@@ -49,7 +49,7 @@ use bevy::prelude::*;
 use benilla_ui::script::keybind::{AddonBindingBody, KeybindCommand, KeybindRequest};
 use benilla_ui::script::UiScript;
 
-use crate::char_select::ClientState;
+use crate::char_select::InWorldGated;
 use crate::ui_script::{PlayerUiHover, PointerOverUiPanel, UiKeyboardCapture};
 
 pub(crate) mod chord;
@@ -222,7 +222,7 @@ impl Plugin for BindingsPlugin {
                         .in_set(crate::ui_script::UiInput)
                         .in_set(BindingSet)
                         .before(benilla_world::schedule::WorldStage::Input)
-                        .run_if(in_state(ClientState::InWorld)),
+                        .in_set(InWorldGated),
                     drain_binding_requests,
                 ),
             );
@@ -435,7 +435,6 @@ fn sync_dispatch(script: Option<NonSendMut<UiScript>>, mut dispatch: ResMut<Bind
 
 /// The dispatch pass — see the module doc. Runs right after the UI key feed (same frame's
 /// capture gate), before `WorldStage::Input` (a bound key must act this frame, once).
-#[allow(clippy::too_many_arguments)]
 fn latch_and_dispatch(
     script: Option<NonSendMut<UiScript>>,
     mut keyboard: MessageReader<KeyboardInput>,
diff --git a/crates/benilla-app/src/bindings/commands.rs b/crates/benilla-app/src/bindings/commands.rs
index 4f3ddde4..68ba9173 100644
--- a/crates/benilla-app/src/bindings/commands.rs
+++ b/crates/benilla-app/src/bindings/commands.rs
@@ -2254,7 +2254,7 @@ mod tests {
 
     /// The install's own `Bindings.xml`, parsed — `None` (and a skipped test) without a client.
     fn install_bindings() -> Option<Vec<benilla_ui::bindings_xml::AddonBinding>> {
-        let data = benilla_formats::wow_data()?;
+        let data = benilla_formats::wow_data_or_skip!(None);
         let mut chain = benilla_formats::open_chain(&data).expect("open the 1.12 patch chain");
         let xml = String::from_utf8_lossy(
             &chain
diff --git a/crates/benilla-app/src/blob_shadow.rs b/crates/benilla-app/src/blob_shadow.rs
index 082fbccb..d9b01c8a 100644
--- a/crates/benilla-app/src/blob_shadow.rs
+++ b/crates/benilla-app/src/blob_shadow.rs
@@ -227,7 +227,7 @@ fn sync_shadows(
 
 /// Re-project each shadow whose inputs moved; clear it when the box degenerates, the fade
 /// reaches zero, or no receiving surface is in the box (the reference's no-ground gate).
-#[allow(clippy::too_many_arguments, clippy::type_complexity)]
+#[allow(clippy::type_complexity)]
 fn update_shadows(
     time: Res<Time>,
     catalog: Option<Res<AnimData>>,
diff --git a/crates/benilla-app/src/camera_shake.rs b/crates/benilla-app/src/camera_shake.rs
index 439f14cd..2394a9f3 100644
--- a/crates/benilla-app/src/camera_shake.rs
+++ b/crates/benilla-app/src/camera_shake.rs
@@ -284,7 +284,6 @@ fn load_shakes(mut commands: Commands, assets: Option<Res<WorldAssets>>) {
 struct Shakes(CameraShakeCatalog);
 
 /// Enqueue a shake for each qualifying footfall and death thud on the frame's event stream.
-#[allow(clippy::too_many_arguments)]
 fn fire_shakes(
     mut events: MessageReader<AnimSoundEvent>,
     time: Res<Time>,
diff --git a/crates/benilla-app/src/capture/fixtures.rs b/crates/benilla-app/src/capture/fixtures.rs
index 634a4d11..ab191c6c 100644
--- a/crates/benilla-app/src/capture/fixtures.rs
+++ b/crates/benilla-app/src/capture/fixtures.rs
@@ -33,7 +33,6 @@ const SUBJECT_YAW: f32 = 2.36;
 /// feeds then push it into the VM during the settle window exactly as live wire data would. Item
 /// icons resolve through the offline `ItemDisplayCatalog` (display ids chosen from entries that
 /// catalog is known to carry); names land directly in the caches (no server to ask).
-#[allow(clippy::too_many_arguments)]
 pub(super) fn seed_ui_fixture(
     mut ctx: ResMut<CaptureCtx>,
     mut commands: Commands,
diff --git a/crates/benilla-app/src/capture/fxview.rs b/crates/benilla-app/src/capture/fxview.rs
index e3e2e1e9..b23e661e 100644
--- a/crates/benilla-app/src/capture/fxview.rs
+++ b/crates/benilla-app/src/capture/fxview.rs
@@ -29,7 +29,6 @@ const FXVIEW_GO_GUID: u64 = (0xF110u64 << 48) | 0xFC0FEE;
 /// through the same [`attach_effect_visuals`] body the game uses, and (for missiles) fly the
 /// root along its facing so trails extend. Inert outside fxview captures (the request resource
 /// only exists then).
-#[allow(clippy::too_many_arguments)]
 pub(crate) fn drive_fx_view(
     req: Option<Res<FxViewRequest>>,
     state: Option<ResMut<FxViewState>>,
diff --git a/crates/benilla-app/src/capture/live_shot.rs b/crates/benilla-app/src/capture/live_shot.rs
index 066e1a0a..ea7a32a8 100644
--- a/crates/benilla-app/src/capture/live_shot.rs
+++ b/crates/benilla-app/src/capture/live_shot.rs
@@ -126,7 +126,7 @@ fn burst_path(out: &str, index: u32, count: u32) -> String {
 /// filter instead of the scene. That cost a whole B38 session: eight bursts and three retracted
 /// mechanisms measured on a corpse, because the images still looked like a plausible frame. A loud
 /// no-op is worth far more than a burst that has to be recognised as garbage after the fact.
-#[allow(clippy::too_many_arguments, clippy::type_complexity)] // one Bevy system's full input set
+#[allow(clippy::type_complexity)] // one Bevy system's full input set
 fn fire_live_shot(
     mut shot: ResMut<LiveShot>,
     time: ProbeClock,
diff --git a/crates/benilla-app/src/capture/mod.rs b/crates/benilla-app/src/capture/mod.rs
index cfd1a3cf..4f7e91b3 100644
--- a/crates/benilla-app/src/capture/mod.rs
+++ b/crates/benilla-app/src/capture/mod.rs
@@ -101,6 +101,7 @@ mod probe_charter;
 mod probe_chest;
 mod probe_clam;
 mod probe_crossing;
+pub(crate) mod probe_env;
 mod probe_gm_ticket;
 mod probe_goquest;
 mod probe_guard_poi;
@@ -912,7 +913,6 @@ impl Plugin for CapturePlugin {
 /// Each frame, force the deterministic capture conditions: pinned time-of-day, no perf HUD, and the
 /// fixed camera pose. Runs in `WorldStage::Present` (after `control` is gated off and after terrain
 /// streaming reads the camera), so the harness is the sole, stable author of the view.
-#[allow(clippy::too_many_arguments)]
 fn pin_scene(
     ctx: Res<CaptureCtx>,
     mut debug: ResMut<DebugState>,
@@ -1001,7 +1001,6 @@ pub(crate) struct ProbeCensus<'w, 's> {
 }
 
 /// Drive the capture lifecycle: wait for streaming, settle, screenshot, exit.
-#[allow(clippy::too_many_arguments)]
 fn drive_capture(
     mut ctx: ResMut<CaptureCtx>,
     mut watch: ResMut<FrameWatch>,
diff --git a/crates/benilla-app/src/capture/probe_auction.rs b/crates/benilla-app/src/capture/probe_auction.rs
index 351c7f14..b8955717 100644
--- a/crates/benilla-app/src/capture/probe_auction.rs
+++ b/crates/benilla-app/src/capture/probe_auction.rs
@@ -447,7 +447,7 @@ fn error_name(error: u32) -> &'static str {
     }
 }
 
-#[allow(clippy::too_many_arguments, clippy::too_many_lines)]
+#[allow(clippy::too_many_lines)]
 fn auction_probe(
     time: ProbeClock,
     mut probe: ResMut<AuctionProbe>,
diff --git a/crates/benilla-app/src/capture/probe_bank.rs b/crates/benilla-app/src/capture/probe_bank.rs
index 713977a0..690fa924 100644
--- a/crates/benilla-app/src/capture/probe_bank.rs
+++ b/crates/benilla-app/src/capture/probe_bank.rs
@@ -202,7 +202,6 @@ fn find_bank_slot(store: &ObjectStore, guid: u64) -> Option<u8> {
     (0..24u8).find(|&i| store.0.player_bank_slot(i) == Some(guid))
 }
 
-#[allow(clippy::too_many_arguments)]
 fn bank_probe(
     time: ProbeClock,
     mut probe: ResMut<BankProbe>,
diff --git a/crates/benilla-app/src/capture/probe_bg_queue.rs b/crates/benilla-app/src/capture/probe_bg_queue.rs
index b1da1fdd..88633915 100644
--- a/crates/benilla-app/src/capture/probe_bg_queue.rs
+++ b/crates/benilla-app/src/capture/probe_bg_queue.rs
@@ -95,7 +95,6 @@ enum Phase {
 }
 
 // One Bevy system's full input set (the guard-poi probe's shape).
-#[allow(clippy::too_many_arguments)]
 fn bg_queue_probe(
     time: ProbeClock,
     mut probe: ResMut<BgQueueProbe>,
diff --git a/crates/benilla-app/src/capture/probe_binder.rs b/crates/benilla-app/src/capture/probe_binder.rs
index d19b7de1..4d0af702 100644
--- a/crates/benilla-app/src/capture/probe_binder.rs
+++ b/crates/benilla-app/src/capture/probe_binder.rs
@@ -267,7 +267,6 @@ fn vm_bind_location(script: &UiScript) -> String {
         .unwrap_or_default()
 }
 
-#[allow(clippy::too_many_arguments)]
 fn binder_probe(
     time: ProbeClock,
     mut probe: ResMut<BinderProbe>,
diff --git a/crates/benilla-app/src/capture/probe_book.rs b/crates/benilla-app/src/capture/probe_book.rs
index c216d8a0..3100747d 100644
--- a/crates/benilla-app/src/capture/probe_book.rs
+++ b/crates/benilla-app/src/capture/probe_book.rs
@@ -234,7 +234,6 @@ fn report(label: &str, s: &[Sample]) {
     );
 }
 
-#[allow(clippy::too_many_arguments)]
 fn book_probe(
     time: ProbeClock,
     mut probe: ResMut<BookProbe>,
diff --git a/crates/benilla-app/src/capture/probe_cam.rs b/crates/benilla-app/src/capture/probe_cam.rs
index b9db33e2..350f9fd8 100644
--- a/crates/benilla-app/src/capture/probe_cam.rs
+++ b/crates/benilla-app/src/capture/probe_cam.rs
@@ -141,7 +141,7 @@ impl Plugin for ProbeCamPlugin {
             drive_probe_cam
                 .in_set(WorldStage::Input)
                 .before(crate::player::PlayerControlSet)
-                .run_if(in_state(crate::char_select::ClientState::InWorld)),
+                .in_set(crate::char_select::InWorldGated),
         );
     }
 }
diff --git a/crates/benilla-app/src/capture/probe_charter.rs b/crates/benilla-app/src/capture/probe_charter.rs
index 73c5520b..fbf6db4a 100644
--- a/crates/benilla-app/src/capture/probe_charter.rs
+++ b/crates/benilla-app/src/capture/probe_charter.rs
@@ -453,7 +453,6 @@ fn probe_guild_name(prefix: &str) -> String {
     format!("{prefix} {secs:08}")
 }
 
-#[allow(clippy::too_many_arguments)]
 fn charter_probe(
     time: ProbeClock,
     mut probe: ResMut<CharterProbe>,
diff --git a/crates/benilla-app/src/capture/probe_chest.rs b/crates/benilla-app/src/capture/probe_chest.rs
index 18012eff..275a1d2e 100644
--- a/crates/benilla-app/src/capture/probe_chest.rs
+++ b/crates/benilla-app/src/capture/probe_chest.rs
@@ -211,7 +211,6 @@ fn report(label: &str, expect: u16, seen: &[Option<u16>]) -> u32 {
     }
 }
 
-#[allow(clippy::too_many_arguments)]
 fn chest_probe(
     time: ProbeClock,
     mut probe: ResMut<ChestProbe>,
diff --git a/crates/benilla-app/src/capture/probe_clam.rs b/crates/benilla-app/src/capture/probe_clam.rs
index bf7af8df..788c0345 100644
--- a/crates/benilla-app/src/capture/probe_clam.rs
+++ b/crates/benilla-app/src/capture/probe_clam.rs
@@ -204,7 +204,6 @@ fn find_in_backpack(
         .map(|_| (guid, u32::from(i) + 1))
 }
 
-#[allow(clippy::too_many_arguments)]
 fn clam_probe(
     time: ProbeClock,
     mut probe: ResMut<ClamProbe>,
diff --git a/crates/benilla-app/src/capture/probe_env.rs b/crates/benilla-app/src/capture/probe_env.rs
new file mode 100644
index 00000000..9d9e459f
--- /dev/null
+++ b/crates/benilla-app/src/capture/probe_env.rs
@@ -0,0 +1,552 @@
+//! The probe fleet's **environment registry** — every `WOW_PROBE*` variable the app reads, in one
+//! table the code is checked against in both directions (decision 2265 §A5).
+//!
+//! The set used to live in three places that could not see each other: the read sites (one per
+//! variable, spread over the fleet), a hand-kept arming list in `dev.rs` for the un-occludable
+//! window ([`super::ProbeFocusPlugin`], decision 0906), and nothing at all that said what the
+//! fleet accepts. The arming list is the one that bit: 0906's rule is that *every* scripted
+//! probe defends itself against the macOS occlusion throttle, and the list had drifted to ten of
+//! the twenty-five variables that schedule on the wall clock — a mail or auction probe launched
+//! exactly as the method prescribes ran covered, at ~1 fps, measuring garbage.
+//!
+//! So the list is now a **column** here ([`ProbeVar::wall_clock`]), the arming reads the column,
+//! and two structural tests below keep the table honest: every `"WOW_PROBE…"` string literal in
+//! the crate is a row, every row is a literal somewhere other than this file, and every value
+//! `WOW_PROBE` itself dispatches on is in [`PROBE_NAMES`]. `WOW_PROBE=list` prints it.
+//!
+//! What this is **not**: a dispatcher. The variables keep their own read sites and their own
+//! shapes — several carry free-form values (Lua chunks, chat lines with spaces and `=`, `A>B`
+//! drag specs) and several combine in one run — so folding them into one variable would need an
+//! escaping mini-language and would change the launch line every session uses. The defect was
+//! the drift, and a registry is the whole cure for drift.
+
+/// One probe-fleet environment variable.
+pub(crate) struct ProbeVar {
+    /// The variable, exactly as the read site spells it.
+    pub name: &'static str,
+    /// One line: the value shape and what setting it does, from the comment at the read site.
+    pub purpose: &'static str,
+    /// Whether the variable **schedules on elapsed real time** — its script fires at `<secs>`
+    /// marks, integrates a rate per frame, or steps a phase machine on `Time<Real>` — so the run
+    /// is only right while frames keep arriving at full rate.
+    ///
+    /// Why it matters (decision 0906): macOS drops a fully covered window to ~1 fps drawables,
+    /// and on such a window a wall-clock probe does not measure slowly, it **runs the wrong
+    /// script** — one leg fired `W@16` and `Space@19` in the same frame and jumped from a
+    /// standstill; another integrated its camera at 125 yd/s for 500 and never crossed the
+    /// radius it was testing (0794). Every `true` row therefore arms
+    /// [`super::ProbeFocusPlugin`] from `dev.rs`, which keeps the probe window un-occludable
+    /// (and, for a run that draws no pixels, parks it small in a corner — decision 1148).
+    ///
+    /// A `false` row is a flag or a modifier: a `_AT`/`_STEP`/`_KEEP` rides its parent's
+    /// arming, a pricing lever changes *what* a run draws rather than *when*, and a state
+    /// machine that advances on wire replies (the char-create probe) has no clock to be robbed of.
+    pub wall_clock: bool,
+}
+
+/// Every `WOW_PROBE*` variable the app reads. Grouped by the probe that owns each; the order is
+/// the order `WOW_PROBE=list` prints.
+pub(crate) const PROBE_VARS: &[ProbeVar] = &[
+    // ── The variable itself, and the run shell every scripted probe rides ────────────────────
+    ProbeVar {
+        name: "WOW_PROBE",
+        purpose: "<name> — a value-dispatched live probe (see the names below); `list` prints this table",
+        // Five of the six values step a phase machine on `time.elapsed_secs` (melee's 3 s swing
+        // cadence, crossing/taxi/guardpoi's phases, castcancel's press-at-t); `partner` answers
+        // invites the frame they land, but rides the same variable.
+        wall_clock: true,
+    },
+    ProbeVar {
+        name: "WOW_PROBE_EXIT_AT",
+        purpose: "<secs> — exit the app after N wall seconds; bounds any scripted live probe's lifetime",
+        // Fires on `ProbeClock` at `<secs>`, and it is the one probe variable a trace-only run
+        // sets on its own (`WOW_MOVE_TRACE`/`WOW_STREAM_TRACE` legs, method.md) — 0794's
+        // throttled camera leg was exactly such a run.
+        wall_clock: true,
+    },
+    ProbeVar {
+        name: "WOW_PROBE_PARK",
+        purpose: "corner|edge|off — where the un-occludable probe window sits, and whether it is pinned on top",
+        // A dial ON the occlusion defence itself, not a schedule.
+        wall_clock: false,
+    },
+    ProbeVar {
+        name: "WOW_PROBE_RESIZE",
+        purpose: "\"<secs>:<W>x<H>\" — resize the primary window mid-run (the headless fullscreen-toggle stand-in)",
+        // Fires on `ProbeClock` at `<secs>`.
+        wall_clock: true,
+    },
+    // ── The actuation channels: chat, keys, Lua, pointer ─────────────────────────────────────
+    ProbeVar {
+        name: "WOW_PROBE_CHAT",
+        purpose: "\"<line>[;<line>…]\" — send each line as chat once in-world; the park-the-probe-anywhere instrument (`.go xyz …`)",
+        // Line `n` is due at `at + every * n` on `ProbeClock`.
+        wall_clock: true,
+    },
+    ProbeVar {
+        name: "WOW_PROBE_CHAT_AT",
+        purpose: "<secs> — when the first chat line goes out (default 8)",
+        wall_clock: false,
+    },
+    ProbeVar {
+        name: "WOW_PROBE_CHAT_EVERY",
+        purpose: "<secs> — space the chat lines apart instead of one burst (do X, wait, then do Y)",
+        wall_clock: false,
+    },
+    ProbeVar {
+        name: "WOW_PROBE_KEY",
+        purpose: "\"<key>@<secs>[:<hold>][;…]\" — synthesize key presses once in-world (a jump, a mount flourish, a held W)",
+        // Each tap fires at its `@<secs>` and releases `<hold>` later, on `ProbeClock`.
+        wall_clock: true,
+    },
+    ProbeVar {
+        name: "WOW_PROBE_LUA",
+        purpose: "\"<chunk>\" — run a Lua chunk in the live UI VM once per world entry (the press-the-button-headlessly instrument)",
+        // First fire at `_AT` seconds, re-armed `_AGAIN` seconds into every later world entry.
+        wall_clock: true,
+    },
+    ProbeVar {
+        name: "WOW_PROBE_LUA_AT",
+        purpose: "<secs> — when the chunk runs after the first world entry (default 10)",
+        wall_clock: false,
+    },
+    ProbeVar {
+        name: "WOW_PROBE_LUA_AGAIN",
+        purpose: "<secs> — how long after every LATER world entry (a relog) the chunk runs again (default 4)",
+        wall_clock: false,
+    },
+    ProbeVar {
+        name: "WOW_PROBE_HOVER",
+        purpose: "\"<frame>[;<frame>…]\" — sweep the real pointer across the named frames' centres, pressing nothing",
+        // Starts at `_AT`, one move per `_STEP` seconds, alternating on `_DUTY` — all wall seconds.
+        wall_clock: true,
+    },
+    ProbeVar {
+        name: "WOW_PROBE_HOVER_AT",
+        purpose: "<secs> — when the sweep starts (default 14)",
+        wall_clock: false,
+    },
+    ProbeVar {
+        name: "WOW_PROBE_HOVER_STEP",
+        purpose: "<secs> — seconds per pointer move (default 0.25; ~0.016 sweeps at frame rate, the director's gesture)",
+        wall_clock: false,
+    },
+    ProbeVar {
+        name: "WOW_PROBE_HOVER_JITTER",
+        purpose: "<px> — walk the pointer inside a px box each step so it moves while the hovered frame stays put",
+        wall_clock: false,
+    },
+    ProbeVar {
+        name: "WOW_PROBE_HOVER_DUTY",
+        purpose: "<on>:<off> — sweep for `on` seconds, park over nothing for `off`, repeat (a leg that alternates can be read)",
+        wall_clock: false,
+    },
+    ProbeVar {
+        name: "WOW_PROBE_DRAG",
+        purpose: "\"<From>><To>[;…]\" — drag one named frame onto another through the real pointer path, one gesture step per frame",
+        // Starts at `_AT`, advances one step per `_STEP` seconds, on `ProbeClock`.
+        wall_clock: true,
+    },
+    ProbeVar {
+        name: "WOW_PROBE_DRAG_AT",
+        purpose: "<secs> — when the first drag starts (default 14)",
+        wall_clock: false,
+    },
+    ProbeVar {
+        name: "WOW_PROBE_DRAG_STEP",
+        purpose: "<secs> — seconds per gesture step (default 0.1); a press and release in one frame is a click, not a drag",
+        wall_clock: false,
+    },
+    ProbeVar {
+        name: "WOW_PROBE_DRAG_LUA",
+        purpose: "\"<chunk>\" — a Lua chunk evaluated after each drag whose string result is logged as the report",
+        wall_clock: false,
+    },
+    // ── The scripted controller inputs (decisions 0621/0653) ────────────────────────────────
+    ProbeVar {
+        name: "WOW_PROBE_LOOK",
+        purpose: "\"<deg_per_sec>@<start_s>:<duration_s>[;…]\" — the scripted mouse-turn: turn the avatar's aim at a rate for a while",
+        // `90°/s for 6 s` has to produce 540° whatever the frame rate did; integrates rate × dt
+        // between `at` and `until` on `ProbeClock`.
+        wall_clock: true,
+    },
+    ProbeVar {
+        name: "WOW_PROBE_PITCH",
+        purpose: "\"<deg>@<start_s>[:<deg_per_sec>][;…]\" — the scripted dive: aim a swimming avatar's nose up or down (+up)",
+        // A dive scripted to reach 30° by second 25 has to reach it at second 25, and it is the
+        // one script that can be a run's only actuator (a drifting swimmer needs no keys).
+        wall_clock: true,
+    },
+    ProbeVar {
+        name: "WOW_PROBE_CAM",
+        purpose: "\"<yaw_deg>,<pitch_deg>[,<dist_yd>]@<start_s>[:<pan_deg_per_s>][;…]\" — park the third-person camera at absolute poses",
+        // Each pose takes over at its `@<start>` and pans at its rate from then, on `ProbeClock`.
+        wall_clock: true,
+    },
+    // ── The FPS probe's dials (`WOW_LIVE_FPS`, the capture harness) ─────────────────────────
+    ProbeVar {
+        name: "WOW_PROBE_UNCAP",
+        purpose: "immediate|vsync — the FPS probe's present mode instead of the measured-best AutoNoVsync",
+        wall_clock: false,
+    },
+    ProbeVar {
+        name: "WOW_PROBE_VSYNC",
+        purpose: "1 — keep vsync ON in the FPS probe: it then measures the present ceiling the display grants this window",
+        wall_clock: false,
+    },
+    // ── The pricing levers and traces: change what a run draws or logs, never when ───────────
+    ProbeVar {
+        name: "WOW_PROBE_UI_ONE_TEX",
+        purpose: "1 — pricing lever: split UI runs on state flags alone, ignoring texture identity (the draw-count ceiling an atlas would reach)",
+        wall_clock: false,
+    },
+    ProbeVar {
+        name: "WOW_PROBE_SHARED_SKIN",
+        purpose: "1 — pricing lever: share character-skin materials across bodies (see `char_skin::build_char_skin_materials`)",
+        wall_clock: false,
+    },
+    ProbeVar {
+        name: "WOW_PROBE_NAME_TRACE",
+        purpose: "1 — per-frame NAME_TRACE lines for the self player's plate seat (a smoothness question is measured, never eyeballed)",
+        wall_clock: false,
+    },
+    // ── The `=1` live probes: each parks the body somewhere real and steps a phase machine ───
+    // Every one below reads `time.elapsed_secs_f64()` into a `since`/`now` phase machine —
+    // waits, settles and timeouts in wall seconds — so each arms the occlusion defence.
+    ProbeVar {
+        name: "WOW_PROBE_BGQUEUE",
+        purpose: "1 — level past the bracket floor, greet Stormwind's Warsong Gulch battlemaster and queue through his list",
+        wall_clock: true,
+    },
+    ProbeVar {
+        name: "WOW_PROBE_MAIL",
+        purpose: "1 — GM-mail the probe's own character, open the Goldshire mailbox and drive inbox/take/send/delete through the VM",
+        wall_clock: true,
+    },
+    ProbeVar {
+        name: "WOW_PROBE_AUCTION",
+        purpose: "1 — GM-hop to a Stormwind auctioneer and drive browse/throttle/sell/owner-list/cancel through the VM",
+        wall_clock: true,
+    },
+    ProbeVar {
+        name: "WOW_PROBE_BANK",
+        purpose: "1 — GM-hop to a pure banker and drive the six-opcode bank wire (activate/deposit/withdraw/buy-slot/refusal)",
+        wall_clock: true,
+    },
+    ProbeVar {
+        name: "WOW_PROBE_BINDER",
+        purpose: "1 — GM-hop to an innkeeper, select the bind row and answer the confirm through the VM's own ConfirmBinder()",
+        wall_clock: true,
+    },
+    ProbeVar {
+        name: "WOW_PROBE_SERVICE",
+        purpose: "1 — right-click four real NPCs, one per UNIT_NPC_FLAGS shape, and report the service-ladder arm and the window that opened",
+        wall_clock: true,
+    },
+    ProbeVar {
+        name: "WOW_PROBE_VENDOR_SWAP",
+        purpose: "1 — open one Goldshire vendor over the other's window and read the `npc` token, title and portrait at MERCHANT_SHOW",
+        wall_clock: true,
+    },
+    ProbeVar {
+        name: "WOW_PROBE_MODEL_CAMERA",
+        purpose: "1 — build a plain <Model> pane on a camera-bearing file and read the renderer's camera and root back",
+        wall_clock: true,
+    },
+    ProbeVar {
+        name: "WOW_PROBE_GMTICKET",
+        purpose: "1 — drive the five-opcode GM ticket wire through the VM (status, clean slate, file, edit, abandon)",
+        wall_clock: true,
+    },
+    ProbeVar {
+        name: "WOW_PROBE_CHARTER",
+        purpose: "1 — buy a guild charter at the Stormwind registrar, open it with a real bag right-click and rename it",
+        wall_clock: true,
+    },
+    ProbeVar {
+        name: "WOW_PROBE_BOOK",
+        purpose: "1 — teleport to the Old Town plaque and measure what the item-text reader costs per frame, closed vs open (B240)",
+        wall_clock: true,
+    },
+    ProbeVar {
+        name: "WOW_PROBE_CHEST",
+        purpose: "1 or <x>,<y>,<z>[,<map>] — open a real chest on the click's own route and report the self anim id before/during/after",
+        wall_clock: true,
+    },
+    ProbeVar {
+        name: "WOW_PROBE_GOQUEST",
+        purpose: "1 or <x>,<y>,<z>[,<map>] — park at a GameObject questgiver and report the dialog status below and above MinLevel",
+        wall_clock: true,
+    },
+    ProbeVar {
+        name: "WOW_PROBE_CLAM",
+        purpose: "1 or <entry> — stock an openable item, right-click it through UseContainerItem and report whether a loot window opens",
+        wall_clock: true,
+    },
+    // ── Modifiers of the value-dispatched probes ────────────────────────────────────────────
+    ProbeVar {
+        name: "WOW_PROBE_DOCK",
+        purpose: "x,y,z[,map] — the dock `WOW_PROBE=crossing` boards from (map defaults to 0 and must be sent)",
+        wall_clock: false,
+    },
+    // ── The character-select probe: advances on wire replies, not on a clock ───────────────
+    ProbeVar {
+        name: "WOW_PROBE_CHARCREATE",
+        purpose: "\"<name>[,race,class,gender[,skin,face,hair,haircolor,facial]]\" — create (and delete) a character at select over the wire",
+        // A roster/result state machine: `AwaitingRoster` → create → result byte → delete →
+        // result byte, each step on the reply that arrives. No clock read anywhere in it.
+        wall_clock: false,
+    },
+    ProbeVar {
+        name: "WOW_PROBE_CHARCREATE_KEEP",
+        purpose: "1 — keep the character the probe created instead of deleting it",
+        wall_clock: false,
+    },
+];
+
+/// The named values of `WOW_PROBE` itself, `(value, purpose)` — the one place they are listed.
+/// `dev.rs` dispatches on the literals (one plugin per value) and `lib.rs` answers `list`
+/// before any window opens; the test below keeps both in step with this table.
+pub(crate) const PROBE_NAMES: &[(&str, &str)] = &[
+    ("list", "print this table and exit, before any window opens"),
+    (
+        "melee",
+        "auto-fight the nearest enemy so the dbg-trace sink can record the combat-text timeline",
+    ),
+    (
+        "partner",
+        "the second client that says yes: auto-accept every group invite and duel challenge (0434/0637)",
+    ),
+    (
+        "crossing",
+        "board a cross-continent boat and report the map seam surviving (0455)",
+    ),
+    (
+        "taxi",
+        "open the flight-master menu on the wire and ride Stormwind → Sentinel Hill to a verdict (0484)",
+    ),
+    (
+        "guardpoi",
+        "ask a Stormwind guard for the weapons trainer and check the SMSG_GOSSIP_POI marker field by field",
+    ),
+    (
+        "castcancel",
+        "hearth and press W mid-cast — the local self-cancel's end-to-end timing instrument",
+    ),
+];
+
+/// The variables whose presence arms the un-occludable probe window — the `wall_clock` column.
+pub(crate) fn wall_clock_vars() -> impl Iterator<Item = &'static str> {
+    PROBE_VARS.iter().filter(|v| v.wall_clock).map(|v| v.name)
+}
+
+/// `WOW_PROBE=list` — print the registry, one variable per line, then the named values.
+pub(crate) fn print() {
+    println!("The probe fleet's environment (capture::probe_env, decision 2265 §A5).");
+    println!(
+        "wall-clock: the variable schedules on elapsed real time and arms the un-occludable probe"
+    );
+    println!("window (ProbeFocusPlugin, decision 0906) — covered, such a run drops to ~1 fps and");
+    println!("executes the wrong script.");
+    println!();
+    println!("{:<26} {:<10} PURPOSE", "VARIABLE", "WALL-CLOCK");
+    for v in PROBE_VARS {
+        let wc = if v.wall_clock { "yes" } else { "-" };
+        println!("{:<26} {:<10} {}", v.name, wc, v.purpose);
+    }
+    println!();
+    println!("WOW_PROBE=<name>:");
+    for (name, purpose) in PROBE_NAMES {
+        println!("  {name:<12} {purpose}");
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    /// This file's own path under `src/` — excluded from both scans, since its table and its
+    /// tests are the one place the literals are *supposed* to appear without being read.
+    const SELF: &str = "capture/probe_env.rs";
+
+    /// **The table cannot drift from the code, in either direction** (decision 2265 §A5).
+    ///
+    /// Every `"WOW_PROBE…"` string literal in the crate must be a row here — a variable the
+    /// fleet reads that the registry does not know is exactly the hand-maintained gap this
+    /// module replaced — and every row must be a literal somewhere other than this file, or the
+    /// registry is describing a variable nothing reads. String literals only: doc comments
+    /// write the backticked form and are skipped by line.
+    #[test]
+    fn every_probe_variable_is_registered_and_every_registered_variable_is_read() {
+        let registered: Vec<&str> = PROBE_VARS.iter().map(|v| v.name).collect();
+        for (i, name) in registered.iter().enumerate() {
+            assert!(
+                !registered[..i].contains(name),
+                "`{name}` is registered twice"
+            );
+            assert!(
+                name.starts_with("WOW_PROBE"),
+                "`{name}` is not a probe variable — the registry is `WOW_PROBE*` only"
+            );
+        }
+
+        let mut read: Vec<(String, String)> = Vec::new(); // (literal, file)
+        for (rel, text) in crate_sources() {
+            if rel == SELF {
+                continue;
+            }
+            for lit in probe_literals(&text) {
+                read.push((lit, rel.clone()));
+            }
+        }
+
+        let unregistered: Vec<String> = read
+            .iter()
+            .filter(|(lit, _)| !registered.contains(&lit.as_str()))
+            .map(|(lit, file)| format!("{file}: \"{lit}\""))
+            .collect();
+        assert!(
+            unregistered.is_empty(),
+            "these `WOW_PROBE…` literals are read but not in `PROBE_VARS` — add a row (name, \
+             purpose from the read site's comment, and whether it schedules on the wall clock):\n  {}",
+            unregistered.join("\n  ")
+        );
+
+        let unread: Vec<&str> = registered
+            .iter()
+            .copied()
+            .filter(|name| !read.iter().any(|(lit, _)| lit == name))
+            .collect();
+        assert!(
+            unread.is_empty(),
+            "these `PROBE_VARS` rows are not a string literal anywhere else in the crate — \
+             nothing reads them; drop the row or restore the read site:\n  {}",
+            unread.join("\n  ")
+        );
+    }
+
+    /// **`WOW_PROBE`'s named values are listed once.** Every `Ok("<name>")` the code compares
+    /// `WOW_PROBE`'s value against (the `dev.rs` plugin dispatch, the `lib.rs` `list` exit) must
+    /// be a `PROBE_NAMES` row, and every row must be dispatched on — so `WOW_PROBE=list` prints
+    /// the values that exist, not the ones someone remembered.
+    #[test]
+    fn every_dispatched_probe_name_is_listed_and_every_listed_name_is_dispatched() {
+        let listed: Vec<&str> = PROBE_NAMES.iter().map(|(n, _)| *n).collect();
+        for (i, name) in listed.iter().enumerate() {
+            assert!(!listed[..i].contains(name), "`{name}` is listed twice");
+        }
+
+        let mut dispatched: Vec<(String, String)> = Vec::new(); // (value, file)
+        for (rel, text) in crate_sources() {
+            if rel == SELF {
+                continue;
+            }
+            for value in dispatched_probe_values(&text) {
+                dispatched.push((value, rel.clone()));
+            }
+        }
+        assert!(
+            !dispatched.is_empty(),
+            "no `WOW_PROBE` value dispatch found anywhere — the scanner has lost its needle"
+        );
+
+        let unlisted: Vec<String> = dispatched
+            .iter()
+            .filter(|(v, _)| !listed.contains(&v.as_str()))
+            .map(|(v, file)| format!("{file}: WOW_PROBE={v}"))
+            .collect();
+        assert!(
+            unlisted.is_empty(),
+            "these `WOW_PROBE` values are dispatched on but not in `PROBE_NAMES`:\n  {}",
+            unlisted.join("\n  ")
+        );
+
+        let undispatched: Vec<&str> = listed
+            .iter()
+            .copied()
+            .filter(|name| !dispatched.iter().any(|(v, _)| v == name))
+            .collect();
+        assert!(
+            undispatched.is_empty(),
+            "these `PROBE_NAMES` rows are not dispatched on anywhere (`var(\"WOW_PROBE\")… == \
+             Ok(\"<name>\")`):\n  {}",
+            undispatched.join("\n  ")
+        );
+    }
+
+    /// Every `.rs` under this crate's `src/`, as `(path under src/, text)`.
+    fn crate_sources() -> Vec<(String, String)> {
+        let src = std::path::Path::new(env!("CARGO_MANIFEST_DIR")).join("src");
+        let mut out = Vec::new();
+        let mut stack = vec![src.clone()];
+        while let Some(dir) = stack.pop() {
+            for entry in std::fs::read_dir(&dir).expect("crate source dir is readable") {
+                let path = entry.expect("dir entry").path();
+                if path.is_dir() {
+                    stack.push(path);
+                } else if path.extension().is_some_and(|e| e == "rs") {
+                    let rel = path
+                        .strip_prefix(&src)
+                        .expect("under src")
+                        .to_string_lossy()
+                        .replace('\\', "/");
+                    let text = std::fs::read_to_string(&path).expect("source is readable");
+                    out.push((rel, text));
+                }
+            }
+        }
+        out.sort();
+        out
+    }
+
+    /// The source with every comment line (`//`, `///`, `//!`) dropped — the scans below want
+    /// code, and a doc comment quoting a variable is not a read of it.
+    fn code_lines(text: &str) -> String {
+        text.lines()
+            .filter(|l| !l.trim_start().starts_with("//"))
+            .collect::<Vec<_>>()
+            .join("\n")
+    }
+
+    /// Every `"WOW_PROBE[A-Z0-9_]*"` string literal in the code — the whole literal, quote to
+    /// quote, so a variable named inside a longer message is not a match.
+    fn probe_literals(text: &str) -> Vec<String> {
+        let code = code_lines(text);
+        let mut out = Vec::new();
+        let mut rest = code.as_str();
+        while let Some(i) = rest.find("\"WOW_PROBE") {
+            let after = &rest[i + 1..];
+            let end = after
+                .find(|c: char| !(c.is_ascii_uppercase() || c.is_ascii_digit() || c == '_'))
+                .unwrap_or(after.len());
+            if after[end..].starts_with('"') {
+                out.push(after[..end].to_string());
+            }
+            rest = &rest[i + 1..];
+        }
+        out
+    }
+
+    /// Every value the code compares `WOW_PROBE` against: `var("WOW_PROBE")` followed, within the
+    /// same expression, by `Ok("<value>")`.
+    fn dispatched_probe_values(text: &str) -> Vec<String> {
+        let code = code_lines(text);
+        let needle = "var(\"WOW_PROBE\")";
+        let mut out = Vec::new();
+        let mut rest = code.as_str();
+        while let Some(i) = rest.find(needle) {
+            let after = &rest[i + needle.len()..];
+            // The comparison sits right after the read: `.as_deref() == Ok("…")`. Bound the
+            // look-ahead so a bare `is_ok()` gate is not paired with some later `Ok("…")`.
+            let window = &after[..after.len().min(48)];
+            if let Some(j) = window.find("Ok(\"") {
+                let value = &after[j + 4..];
+                if let Some(k) = value.find('"') {
+                    out.push(value[..k].to_string());
+                }
+            }
+            rest = after;
+        }
+        out
+    }
+}
diff --git a/crates/benilla-app/src/capture/probe_goquest.rs b/crates/benilla-app/src/capture/probe_goquest.rs
index 9a8cd6c8..60d3c61a 100644
--- a/crates/benilla-app/src/capture/probe_goquest.rs
+++ b/crates/benilla-app/src/capture/probe_goquest.rs
@@ -211,7 +211,6 @@ fn report(label: &str, expect: u32, seen: Option<u32>) -> u32 {
     }
 }
 
-#[allow(clippy::too_many_arguments)]
 fn goquest_probe(
     time: ProbeClock,
     mut probe: ResMut<GoQuestProbe>,
diff --git a/crates/benilla-app/src/capture/probe_guard_poi.rs b/crates/benilla-app/src/capture/probe_guard_poi.rs
index 983b16d1..c734517f 100644
--- a/crates/benilla-app/src/capture/probe_guard_poi.rs
+++ b/crates/benilla-app/src/capture/probe_guard_poi.rs
@@ -73,7 +73,6 @@ enum Phase {
 }
 
 // One Bevy system's full input set (the taxi-probe shape).
-#[allow(clippy::too_many_arguments)]
 fn guard_poi_probe(
     time: ProbeClock,
     mut probe: ResMut<GuardPoiProbe>,
diff --git a/crates/benilla-app/src/capture/probe_look.rs b/crates/benilla-app/src/capture/probe_look.rs
index e4895ac9..0a74d92f 100644
--- a/crates/benilla-app/src/capture/probe_look.rs
+++ b/crates/benilla-app/src/capture/probe_look.rs
@@ -110,7 +110,7 @@ impl Plugin for ProbeLookPlugin {
             drive_probe_look
                 .in_set(WorldStage::Input)
                 .before(crate::player::PlayerControlSet)
-                .run_if(in_state(crate::char_select::ClientState::InWorld)),
+                .in_set(crate::char_select::InWorldGated),
         );
     }
 }
diff --git a/crates/benilla-app/src/capture/probe_mail.rs b/crates/benilla-app/src/capture/probe_mail.rs
index 80a1e585..1e816c87 100644
--- a/crates/benilla-app/src/capture/probe_mail.rs
+++ b/crates/benilla-app/src/capture/probe_mail.rs
@@ -222,7 +222,6 @@ fn last_event(script: &UiScript) -> String {
         .unwrap_or_default()
 }
 
-#[allow(clippy::too_many_arguments)]
 fn mail_probe(
     time: ProbeClock,
     mut probe: ResMut<MailProbe>,
diff --git a/crates/benilla-app/src/capture/probe_model_camera.rs b/crates/benilla-app/src/capture/probe_model_camera.rs
index 03a73f14..ce8f6c22 100644
--- a/crates/benilla-app/src/capture/probe_model_camera.rs
+++ b/crates/benilla-app/src/capture/probe_model_camera.rs
@@ -203,7 +203,6 @@ fn shoot(commands: &mut Commands, name: &str) {
         .observe(save_to_disk(path));
 }
 
-#[allow(clippy::too_many_arguments)]
 fn model_camera_probe(
     mut commands: Commands,
     time: ProbeClock,
diff --git a/crates/benilla-app/src/capture/probe_pitch.rs b/crates/benilla-app/src/capture/probe_pitch.rs
index d985c461..8957be1a 100644
--- a/crates/benilla-app/src/capture/probe_pitch.rs
+++ b/crates/benilla-app/src/capture/probe_pitch.rs
@@ -126,7 +126,7 @@ impl Plugin for ProbePitchPlugin {
             drive_probe_pitch
                 .in_set(WorldStage::Input)
                 .before(crate::player::PlayerControlSet)
-                .run_if(in_state(crate::char_select::ClientState::InWorld)),
+                .in_set(crate::char_select::InWorldGated),
         );
     }
 }
diff --git a/crates/benilla-app/src/capture/probe_rig.rs b/crates/benilla-app/src/capture/probe_rig.rs
index 31765f71..d3323213 100644
--- a/crates/benilla-app/src/capture/probe_rig.rs
+++ b/crates/benilla-app/src/capture/probe_rig.rs
@@ -295,7 +295,6 @@ struct Rig {
 }
 
 /// The whole rig: find-or-create the body at select, enter as it, then apply the state batch.
-#[allow(clippy::too_many_arguments)]
 fn drive_rig(
     mut rig: ResMut<Rig>,
     mut roster: ResMut<Roster>,
diff --git a/crates/benilla-app/src/capture/probe_service.rs b/crates/benilla-app/src/capture/probe_service.rs
index 9cb26d7e..a31e13ef 100644
--- a/crates/benilla-app/src/capture/probe_service.rs
+++ b/crates/benilla-app/src/capture/probe_service.rs
@@ -340,7 +340,6 @@ fn open_window(
     None
 }
 
-#[allow(clippy::too_many_arguments)]
 fn service_probe(
     time: ProbeClock,
     mut probe: ResMut<ServiceProbe>,
diff --git a/crates/benilla-app/src/capture/probe_taxi.rs b/crates/benilla-app/src/capture/probe_taxi.rs
index 2a59965e..ca7d2139 100644
--- a/crates/benilla-app/src/capture/probe_taxi.rs
+++ b/crates/benilla-app/src/capture/probe_taxi.rs
@@ -145,7 +145,7 @@ fn load_expectations(mut probe: ResMut<TaxiProbe>, world_assets: Option<Res<Worl
 }
 
 // One Bevy system's full input set (the crossing-probe shape) + its self query tuple.
-#[allow(clippy::too_many_arguments, clippy::type_complexity)]
+#[allow(clippy::type_complexity)]
 fn taxi_probe(
     time: ProbeClock,
     mut probe: ResMut<TaxiProbe>,
diff --git a/crates/benilla-app/src/capture/probe_vendor_swap.rs b/crates/benilla-app/src/capture/probe_vendor_swap.rs
index 36f759b7..2291f89f 100644
--- a/crates/benilla-app/src/capture/probe_vendor_swap.rs
+++ b/crates/benilla-app/src/capture/probe_vendor_swap.rs
@@ -163,7 +163,6 @@ fn clear_log(script: &UiScript) {
     }
 }
 
-#[allow(clippy::too_many_arguments)]
 fn vendor_swap_probe(
     time: ProbeClock,
     mut probe: ResMut<VendorSwapProbe>,
diff --git a/crates/benilla-app/src/capture/probes/dress_census.rs b/crates/benilla-app/src/capture/probes/dress_census.rs
index 1c369ae1..72e192ff 100644
--- a/crates/benilla-app/src/capture/probes/dress_census.rs
+++ b/crates/benilla-app/src/capture/probes/dress_census.rs
@@ -82,7 +82,6 @@ type DressQuery = (
 );
 
 /// One line per streamed player within [`DEFAULT_RADIUS`], contradictions first.
-#[allow(clippy::too_many_arguments)]
 fn fire_dress_census(
     mut probe: ResMut<DressCensus>,
     time: ProbeClock,
diff --git a/crates/benilla-app/src/capture/probes/ground_census.rs b/crates/benilla-app/src/capture/probes/ground_census.rs
index b48b749b..22d6ebe2 100644
--- a/crates/benilla-app/src/capture/probes/ground_census.rs
+++ b/crates/benilla-app/src/capture/probes/ground_census.rs
@@ -114,7 +114,6 @@ type CensusQuery = (
 
 /// One census line per [`ground_derived`] body within [`GroundCensus::radius`] of ours, worst drop
 /// first, under a summary line naming the count that matters.
-#[allow(clippy::too_many_arguments)] // one Bevy system's full input set
 fn fire_ground_census(
     mut probe: ResMut<GroundCensus>,
     time: ProbeClock,
diff --git a/crates/benilla-app/src/capture/probes/jitter.rs b/crates/benilla-app/src/capture/probes/jitter.rs
index 25e72d07..7ab7967b 100644
--- a/crates/benilla-app/src/capture/probes/jitter.rs
+++ b/crates/benilla-app/src/capture/probes/jitter.rs
@@ -242,7 +242,6 @@ fn palette_probes(rows: &[Mat4], binds: &[Vec3], radii: &[f32]) -> Vec<Vec3> {
 }
 
 /// One `JIT` line per frame for the subject: the three terms' Δ and Δ², in mm and in pixels.
-#[allow(clippy::too_many_arguments)] // one param per term the reading has to separate
 fn sample_jitter(
     mut meter: ResMut<JitterMeter>,
     time: ProbeClock,
diff --git a/crates/benilla-app/src/capture/probes/live_fps.rs b/crates/benilla-app/src/capture/probes/live_fps.rs
index ae892e24..55031b94 100644
--- a/crates/benilla-app/src/capture/probes/live_fps.rs
+++ b/crates/benilla-app/src/capture/probes/live_fps.rs
@@ -204,7 +204,6 @@ struct SamplePin<'w, 's> {
 
 /// Wait for in-world + the delay, uncap, warm, sample, print, exit — the live twin of the
 /// harness probe's `Phase::ProbeWarmup`/`Probing` arms.
-#[allow(clippy::too_many_arguments)]
 fn drive_live_fps(
     mut probe: ResMut<LiveFps>,
     time: Res<Time<bevy::time::Real>>,
diff --git a/crates/benilla-app/src/capture/probes/reveal.rs b/crates/benilla-app/src/capture/probes/reveal.rs
index abab995b..46eed249 100644
--- a/crates/benilla-app/src/capture/probes/reveal.rs
+++ b/crates/benilla-app/src/capture/probes/reveal.rs
@@ -72,7 +72,6 @@ impl Plugin for RevealAuditPlugin {
     }
 }
 
-#[allow(clippy::too_many_arguments)]
 fn drive_reveal_audit(
     mut audit: ResMut<RevealAudit>,
     progress: Res<WorldLoadProgress>,
diff --git a/crates/benilla-app/src/capture/probes/visual_census.rs b/crates/benilla-app/src/capture/probes/visual_census.rs
index fee14f3c..2b91ae03 100644
--- a/crates/benilla-app/src/capture/probes/visual_census.rs
+++ b/crates/benilla-app/src/capture/probes/visual_census.rs
@@ -120,7 +120,6 @@ type VisualQuery = (
 
 /// One line per streamed entity within [`UnitVisuals::radius`] of the body — cubes first, then
 /// everything else — under a summary line naming the count that matters.
-#[allow(clippy::too_many_arguments)] // one Bevy system's full input set
 fn fire_unit_visuals(
     mut probe: ResMut<UnitVisuals>,
     time: ProbeClock,
diff --git a/crates/benilla-app/src/char_create/mod.rs b/crates/benilla-app/src/char_create/mod.rs
index b2a22bab..820dc3fd 100644
--- a/crates/benilla-app/src/char_create/mod.rs
+++ b/crates/benilla-app/src/char_create/mod.rs
@@ -379,7 +379,6 @@ fn class_file(class: u8) -> &'static str {
 /// Its own resource rather than a [`CreateSelection`] field on purpose: ticking it there would trip
 /// that resource's change detection every frame and defeat `refresh_dynamic`'s `is_changed` gate,
 /// re-running the whole dial/panel/icon refresh 60× a second.
-#[allow(clippy::too_many_arguments)]
 fn create_input(
     buttons: Query<(Entity, &CreateAction)>,
     clicks: Res<crate::glue::GlueClicks>,
diff --git a/crates/benilla-app/src/char_create/refresh.rs b/crates/benilla-app/src/char_create/refresh.rs
index ca301ca9..508d0f19 100644
--- a/crates/benilla-app/src/char_create/refresh.rs
+++ b/crates/benilla-app/src/char_create/refresh.rs
@@ -23,7 +23,7 @@ use crate::glue::widgets::{FallbackFace, GlueDisabled, Hilight, HoverLabel, Lock
 
 /// Refill everything that follows the selection — icon rects, dial labels, info texts, faction
 /// tints, class-slot mapping — on selection change or a fresh spawn.
-#[allow(clippy::too_many_arguments, clippy::type_complexity)]
+#[allow(clippy::type_complexity)]
 pub(super) fn refresh_dynamic(
     sel: Res<CreateSelection>,
     catalog: Option<Res<CharCreate>>,
@@ -224,7 +224,7 @@ pub(super) fn refresh_dynamic(
 /// latch while a create is in flight. The screen-agnostic passes — up/down art swaps, the glue
 /// buttons' art + caption color, outline mirroring — are [`crate::glue`]'s, registered beside
 /// this in the plugin chain.
-#[allow(clippy::type_complexity, clippy::too_many_arguments)]
+#[allow(clippy::type_complexity)]
 pub(super) fn refresh_hover(
     sel: Res<CreateSelection>,
     catalog: Option<Res<CharCreate>>,
diff --git a/crates/benilla-app/src/char_create/screen.rs b/crates/benilla-app/src/char_create/screen.rs
index d0c52211..720d20e6 100644
--- a/crates/benilla-app/src/char_create/screen.rs
+++ b/crates/benilla-app/src/char_create/screen.rs
@@ -37,7 +37,6 @@ const SCREEN_Z: i32 = 1100;
 
 // ── Spawn ────────────────────────────────────────────────────────────────────────────────────────
 
-#[allow(clippy::too_many_arguments)]
 pub(super) fn enter_create(
     mut commands: Commands,
     assets: Res<AssetServer>,
diff --git a/crates/benilla-app/src/char_select/addons.rs b/crates/benilla-app/src/char_select/addons.rs
index fb3dccf1..74f8c561 100644
--- a/crates/benilla-app/src/char_select/addons.rs
+++ b/crates/benilla-app/src/char_select/addons.rs
@@ -572,7 +572,6 @@ pub(super) struct ScrollBand;
 ///
 /// Ordered before the select screen's own click handling so a click that lands on the panel is
 /// never also read as a click on the screen behind it.
-#[allow(clippy::too_many_arguments)]
 pub(super) fn drive_addons_panel(
     mut commands: Commands,
     mut panel: ResMut<AddonsPanel>,
@@ -1599,7 +1598,6 @@ fn spawn_panel(
 /// the row's TOPLEFT at (−14, 0), spawned as the row strip's child so the anchor is structural.
 /// `## URL` rides as an extra line (1197: information, not a launch button). A MIXED checkbox
 /// hover shows `ENABLED_FOR_SOME` alone — the reference's GlueTooltip split, on the same box.
-#[allow(clippy::too_many_arguments)]
 fn spawn_tooltip(
     parent: &mut ChildSpawnerCommands,
     art: &GlueArt,
diff --git a/crates/benilla-app/src/char_select/dialog.rs b/crates/benilla-app/src/char_select/dialog.rs
index 57f49258..132c6c81 100644
--- a/crates/benilla-app/src/char_select/dialog.rs
+++ b/crates/benilla-app/src/char_select/dialog.rs
@@ -88,7 +88,7 @@ struct DialogUi;
 /// Okay (enabled only while the typed text matches) sends the delete; Cancel/Esc close; Enter
 /// confirms when armed. Runs before the list refresh so a successful delete's roster update
 /// repaints the same frame it lands.
-#[allow(clippy::too_many_arguments, clippy::type_complexity)]
+#[allow(clippy::type_complexity)]
 pub(super) fn drive_delete_dialog(
     mut commands: Commands,
     mut dialog: ResMut<DeleteDialog>,
diff --git a/crates/benilla-app/src/char_select/input.rs b/crates/benilla-app/src/char_select/input.rs
index 97224ae7..3e92c724 100644
--- a/crates/benilla-app/src/char_select/input.rs
+++ b/crates/benilla-app/src/char_select/input.rs
@@ -24,7 +24,7 @@ const DOUBLE_CLICK_SECS: f32 = 0.4;
 /// back/escape (return to the login screen — decision 0539, retiring 0465 §6's exit-the-client
 /// collapse), arrow-key cycling. Inert while the delete dialog is up (it owns the keyboard and
 /// sits over the buttons).
-#[allow(clippy::too_many_arguments, clippy::type_complexity)]
+#[allow(clippy::type_complexity)]
 pub(super) fn select_input(
     buttons: Query<(Entity, &SelectAction)>,
     clicks: Res<crate::glue::GlueClicks>,
diff --git a/crates/benilla-app/src/char_select/mod.rs b/crates/benilla-app/src/char_select/mod.rs
index 767218d1..81d70b91 100644
--- a/crates/benilla-app/src/char_select/mod.rs
+++ b/crates/benilla-app/src/char_select/mod.rs
@@ -65,6 +65,20 @@ pub(crate) enum ClientState {
     InWorld,
 }
 
+/// **The one "only while in the world" gate** (decision 2265 §C3). A system that has no business
+/// at a glue screen — an input reader, a world-packet feed, a per-character file watcher — joins
+/// this set instead of carrying its own `run_if(in_state(ClientState::InWorld))`: twenty-odd
+/// copies of that condition said one thing in twenty-odd places, and the condition a set carries
+/// ANDs with a member's own, so a member keeps whatever else it needs (the controller's
+/// capture-mode gate, say) and the conversion is exact.
+///
+/// Configured once, in [`CharSelectPlugin`] — the state's home — for `Update`, the only schedule
+/// a member lives in. A member in another schedule means configuring the set *there* as well
+/// (a set's conditions are per schedule; an unconfigured set gates nothing), never a fresh
+/// `run_if` at the site.
+#[derive(SystemSet, Debug, Clone, Copy, PartialEq, Eq, Hash)]
+pub(crate) struct InWorldGated;
+
 /// The character-select subsystem: the state machine + the select screen.
 pub(crate) struct CharSelectPlugin {
     /// The screen this session opens on.
@@ -94,6 +108,8 @@ fn publish_world_live(
 impl Plugin for CharSelectPlugin {
     fn build(&self, app: &mut App) {
         app.insert_state(self.start)
+            // The in-world gate, configured beside the state it reads (see [`InWorldGated`]).
+            .configure_sets(Update, InWorldGated.run_if(in_state(ClientState::InWorld)))
             .init_resource::<Roster>()
             // **The engine's world-existence bit** (1160's wire (b)): the session owner is this
             // module, so this module tells the world whether there is one. Ordered ahead of every
@@ -105,8 +121,14 @@ impl Plugin for CharSelectPlugin {
             )
             .init_resource::<dialog::DeleteDialog>()
             .init_resource::<addons::AddonsPanel>()
-            .add_systems(OnEnter(ClientState::CharSelect), screen::enter_select)
-            .add_systems(OnExit(ClientState::CharSelect), screen::exit_select)
+            .add_systems(
+                OnEnter(ClientState::CharSelect),
+                (screen::enter_select, stamp_select_entry),
+            )
+            .add_systems(
+                OnExit(ClientState::CharSelect),
+                (screen::exit_select, clear_select_entry),
+            )
             .add_systems(Update, (debug_glue_roundtrip, debug_logout_smoke))
             .add_systems(
                 Update,
@@ -783,7 +805,6 @@ fn debug_glue_roundtrip(
 /// hand-written `AppExit` from `Update` skipped that question for this smoke's whole life, and the
 /// bug it would have caught — every saved variable, every addon file and the camera pose lost on
 /// every window close — shipped underneath it.
-#[allow(clippy::too_many_arguments)] // a smoke test that drives the whole round trip
 fn debug_logout_smoke(
     state: Res<State<ClientState>>,
     player: Res<crate::player::Player>,
@@ -822,7 +843,7 @@ fn debug_logout_smoke(
         // world-live falling edge, not the state edge), so the probe was reading the count before
         // the thing it is checking had happened, and reporting the world it had just left.
         //
-        // It cost more than a wrong line: 1291 wrote the reading up as a live contradiction of
+        // It cost more than a wrong line: 2277 wrote the reading up as a live contradiction of
         // 0777's release-world claim, on the strength of it reproducing identically on an older
         // commit — which it did, because an instrument that measures too early does that reliably.
         // A number that is always wrong teaches everyone to skip the line (0777's own lesson about
@@ -844,7 +865,7 @@ fn debug_logout_smoke(
         },
         4 if *state.get() == ClientState::InWorld && player.active && now - *mark > 3.0 => {
             // **The suppressor reading is the point of the second entry, not a decoration on it**
-            // (B306, decision 1542). This leg has crossed the boundary on every run since 1291 and
+            // (B306, decision 1542). This leg has crossed the boundary on every run since 2277 and
             // could only ever report that it *happened* — tiles, UI rebuilds, error counts — none
             // of which a character who re-entered unable to move would disturb. `scripts/smoke.sh`
             // fails on anything but `none`, and separately reports whether the run's logout was
@@ -954,6 +975,31 @@ fn debug_select_walk(
     }
 }
 
+/// When the select screen came up: `Time::elapsed_secs()` at `OnEnter(CharSelect)`, gone again
+/// at `OnExit`. The one clock the screen's "a few seconds after the screen is up" instruments
+/// ([`debug_select_dialog`], [`debug_select_addons`], [`debug_select_shot`]) measure from, in
+/// place of a `Local` each stamped on its own first run (decision 2265 §C3). Those three run
+/// under `in_state(CharSelect)` in `Update`, so the resource is always there when they read it.
+#[derive(Resource, Clone, Copy)]
+struct CharSelectEnteredAt(f32);
+
+impl CharSelectEnteredAt {
+    /// Seconds the screen has been up.
+    fn elapsed(&self, time: &Time) -> f32 {
+        time.elapsed_secs() - self.0
+    }
+}
+
+/// `OnEnter(CharSelect)`: stamp the screen's entry.
+fn stamp_select_entry(mut commands: Commands, time: Res<Time>) {
+    commands.insert_resource(CharSelectEnteredAt(time.elapsed_secs()));
+}
+
+/// `OnExit(CharSelect)`: the screen is down, so is its clock.
+fn clear_select_entry(mut commands: Commands) {
+    commands.remove_resource::<CharSelectEnteredAt>();
+}
+
 /// The shot instrument's delete-dialog dial (`WOW_CHARSELECT_DIALOG=<typed>`): open the
 /// typed-confirm dialog for the selected character a few seconds after the screen is up, with
 /// `<typed>` pre-typed (may be empty) — so the dialog's geometry (the ChatInputBorder edit box,
@@ -963,7 +1009,7 @@ fn debug_select_dialog(
     roster: Res<Roster>,
     mut dialog: ResMut<dialog::DeleteDialog>,
     time: Res<Time>,
-    mut entered_at: Local<Option<f32>>,
+    entered_at: Res<CharSelectEnteredAt>,
     mut done: Local<bool>,
 ) {
     if *done {
@@ -973,8 +1019,7 @@ fn debug_select_dialog(
         *done = true;
         return;
     };
-    let start = *entered_at.get_or_insert(time.elapsed_secs());
-    if time.elapsed_secs() - start < 4.0 {
+    if entered_at.elapsed(&time) < 4.0 {
         return;
     }
     let Some(c) = roster.selected_char() else {
@@ -995,7 +1040,7 @@ fn debug_select_addons(
     roster: Res<Roster>,
     mut panel: ResMut<addons::AddonsPanel>,
     time: Res<Time>,
-    mut entered_at: Local<Option<f32>>,
+    entered_at: Res<CharSelectEnteredAt>,
     mut done: Local<bool>,
 ) {
     if *done {
@@ -1005,8 +1050,7 @@ fn debug_select_addons(
         *done = true;
         return;
     }
-    let start = *entered_at.get_or_insert(time.elapsed_secs());
-    if time.elapsed_secs() - start < 4.0 {
+    if entered_at.elapsed(&time) < 4.0 {
         return;
     }
     if roster.chars.is_empty() {
@@ -1041,7 +1085,7 @@ const SELECT_SHOT_AT: f32 = 8.0;
 fn debug_select_shot(
     mut commands: Commands,
     time: Res<Time>,
-    mut entered_at: Local<Option<f32>>,
+    entered_at: Res<CharSelectEnteredAt>,
     mut done: Local<bool>,
 ) {
     if *done {
@@ -1055,8 +1099,7 @@ fn debug_select_shot(
         .ok()
         .and_then(|v| v.parse::<f32>().ok())
         .unwrap_or(SELECT_SHOT_AT);
-    let start = *entered_at.get_or_insert(time.elapsed_secs());
-    if time.elapsed_secs() - start < at {
+    if entered_at.elapsed(&time) < at {
         return;
     }
     use bevy::render::view::screenshot::{save_to_disk, Screenshot};
diff --git a/crates/benilla-app/src/char_select/refresh.rs b/crates/benilla-app/src/char_select/refresh.rs
index a540dc2d..3d60f2d4 100644
--- a/crates/benilla-app/src/char_select/refresh.rs
+++ b/crates/benilla-app/src/char_select/refresh.rs
@@ -18,7 +18,7 @@ use super::{class_name, Roster};
 /// Refill the row texts + visibility, the selected name, and the realm banner whenever the roster
 /// changes (a fresh enum, a selection move) — or when the screen was just (re)spawned (returning
 /// from the create screen finds an unchanged roster; the fresh, empty tree must still fill).
-#[allow(clippy::type_complexity, clippy::too_many_arguments)]
+#[allow(clippy::type_complexity)]
 pub(super) fn refresh_list(
     roster: Res<Roster>,
     areas: Option<Res<AreaTableRes>>,
diff --git a/crates/benilla-app/src/char_select/screen.rs b/crates/benilla-app/src/char_select/screen.rs
index 337ea530..7a8f64c7 100644
--- a/crates/benilla-app/src/char_select/screen.rs
+++ b/crates/benilla-app/src/char_select/screen.rs
@@ -98,7 +98,6 @@ pub(super) fn enter_select(mut preview: ResMut<GluePreview>) {
 /// Spawn the screen tree once its prerequisites exist — and upgrade an artless early spawn the
 /// moment the client art lands (despawn + respawn; the tree is cheap and static). With no client
 /// data at all the artless tree still spawns after a short grace (the graceful-absence posture).
-#[allow(clippy::too_many_arguments)]
 pub(super) fn materialize_screen(
     mut commands: Commands,
     existing: Query<(Entity, &CharSelectUi)>,
@@ -148,7 +147,6 @@ pub(super) fn materialize_screen(
     }
 }
 
-#[allow(clippy::too_many_arguments)]
 fn spawn_screen(
     commands: &mut Commands,
     assets: &AssetServer,
diff --git a/crates/benilla-app/src/chat_bubble.rs b/crates/benilla-app/src/chat_bubble.rs
index db334cd5..eb49da76 100644
--- a/crates/benilla-app/src/chat_bubble.rs
+++ b/crates/benilla-app/src/chat_bubble.rs
@@ -376,7 +376,7 @@ fn load_bubble_art(
 /// pieces, tail, wrapped chatType-colored text — bottom-seated on the projected anchor.
 /// Runs after [`VPlateSet`] (the spawn gate reads this frame's plate verdict), inside the
 /// [`UiQuadAppend`] window.
-#[allow(clippy::too_many_arguments, clippy::type_complexity)] // one Bevy system's full input set
+#[allow(clippy::type_complexity)] // one Bevy system's full input set
 fn drive_bubbles(
     mut queue: ResMut<BubbleQueue>,
     mut bubbles: ResMut<Bubbles>,
@@ -609,7 +609,6 @@ struct Pending {
 
 /// Append one bubble's draw list: the Backdrop pieces (bg fill inset by the border-unit +
 /// the 8-piece edge), the tail square, and the wrapped, centered, chatType-colored text.
-#[allow(clippy::too_many_arguments)] // the draw inputs + the jitter trace's decomposition
 fn draw_bubble(
     atlas: &mut UiFontAtlas,
     quads: &mut UiQuads,
diff --git a/crates/benilla-app/src/combat_text/mod.rs b/crates/benilla-app/src/combat_text/mod.rs
index 7a3f2c59..2abb0512 100644
--- a/crates/benilla-app/src/combat_text/mod.rs
+++ b/crates/benilla-app/src/combat_text/mod.rs
@@ -233,7 +233,6 @@ fn free_slot(texts: &[WorldText], anchor: Entity) -> Option<u8> {
 /// living into glyph quads appended to [`UiQuads`] after the script extract. Ordering (the
 /// [`UiQuadAppend`] set, after [`UiInput`]) guarantees the mesh rebuild never lands between the
 /// script's replace and our append — see `ui_pass`.
-#[allow(clippy::too_many_arguments)] // one Bevy system's full input set
 pub(crate) fn float_combat_text(
     mut spawns: MessageReader<CombatTextSpawn>,
     mut texts: ResMut<WorldTexts>,
diff --git a/crates/benilla-app/src/cooldowns.rs b/crates/benilla-app/src/cooldowns.rs
index 54f294a4..0400e5d7 100644
--- a/crates/benilla-app/src/cooldowns.rs
+++ b/crates/benilla-app/src/cooldowns.rs
@@ -175,7 +175,6 @@ impl Cooldowns {
     /// used to do made the GO insert of any cooldown-carrying spell (Frost Nova) overwrite its
     /// own running GCD node — the whole bar's pie flashed and died ~100 ms after the press,
     /// while cooldown-less spells (Arcane Explosion) kept theirs (decision 0947).
-    #[allow(clippy::too_many_arguments)] // the SPELLHISTORY node's own field list
     fn add(
         &mut self,
         spell_id: u32,
diff --git a/crates/benilla-app/src/crash.rs b/crates/benilla-app/src/crash.rs
new file mode 100644
index 00000000..96a5644e
--- /dev/null
+++ b/crates/benilla-app/src/crash.rs
@@ -0,0 +1,236 @@
+//! **A crash leaves an artefact** (decision 2266 §B2).
+//!
+//! Until this module, a panic printed to stderr and the process was gone — and with it everything
+//! a reporter could have attached. The only log sink was the terminal; a packaged Windows build
+//! has no console; of bug B390's four reporters one attached a backtrace, because he had set
+//! `RUST_BACKTRACE=1` on his own. `shutdown.rs` says the other half out loud: *"A crash, a
+//! `SIGKILL`, a wedged teardown. Nothing survives those."*
+//!
+//! [`install`] chains a panic hook in front of Rust's default one. The default still prints to
+//! stderr exactly as before (so every log a session already greps keeps reading the same); then
+//! the report goes to **`benilla-config/Diagnostics/crash-<unix-seconds>.txt`**, resolved through
+//! [`crate::local_state`] like every other file benilla writes (the one-folder rule, 0954/1175 —
+//! never a platform log dir, never beside the install). The file carries: the build id (the sha
+//! is the version, `build_id`), the time and the uptime, the thread, the panic's location and
+//! payload, a backtrace captured **regardless of `RUST_BACKTRACE`**, and the last
+//! [`benilla_world::log_ring::CAPACITY`] log lines — the minute before, which is what turns a
+//! symptom into a story. The path is printed to stderr as the last line, so "attach the file it
+//! names" is the whole instruction to a reporter.
+//!
+//! **What it does not cover, said out loud.** A non-unwinding panic — an allocation failure's
+//! abort, a `panic` inside a `Drop` during unwinding, a foreign frame — never reaches any hook;
+//! B390's own was one (`thread caused non-unwinding panic. aborting.`). The hook covers the
+//! unwinding class (B88, B130, B260, B383's shape: four of the six panics the ledger holds).
+//! Flushing saved variables and the CVar diff from inside a panic is a second, riskier item —
+//! the world is half-torn by then — and is deliberately not bundled here (2265 §B2).
+//!
+//! A hermetic capture run (`local_state::home()` answers `None`) writes no file and loses
+//! nothing: the harness already has stderr.
+
+use std::fmt::Write as _;
+use std::panic::PanicHookInfo;
+use std::path::{Path, PathBuf};
+use std::sync::atomic::{AtomicBool, Ordering};
+use std::time::{Duration, Instant, SystemTime, UNIX_EPOCH};
+
+use crate::BuildId;
+
+/// Chain the crash-report hook in front of the current panic hook. Called once, from
+/// [`crate::run`], before the `App` exists — a panic while plugins build is still a crash.
+pub(crate) fn install(build: BuildId) {
+    let started = Instant::now();
+    let previous = std::panic::take_hook();
+    std::panic::set_hook(Box::new(move |info| {
+        previous(info);
+        report(info, build, started.elapsed());
+    }));
+}
+
+/// `WOW_CRASH_INJECT=<at_secs>` — one deliberate main-thread panic, mid-run: the standing test
+/// affordance for this module, in the shape of `perf::stall`'s injectors and armed beside them.
+/// The end-to-end falsifier is a run with it set: the process must die with a
+/// `crash-<unix>.txt` whose log tail ends in the `crash-inject` line below.
+pub(crate) fn arm_injector(app: &mut bevy::prelude::App) {
+    use bevy::prelude::*;
+    if let Some(at) = std::env::var("WOW_CRASH_INJECT")
+        .ok()
+        .and_then(|v| v.parse::<f32>().ok())
+    {
+        app.insert_resource(CrashInject { at });
+        app.add_systems(Update, crash_inject);
+    }
+}
+
+#[derive(bevy::prelude::Resource)]
+struct CrashInject {
+    at: f32,
+}
+
+fn crash_inject(
+    inject: bevy::prelude::Res<CrashInject>,
+    time: bevy::prelude::Res<bevy::prelude::Time<bevy::time::Real>>,
+) {
+    if time.elapsed_secs() >= inject.at {
+        bevy::log::warn!(
+            "crash-inject: panicking the main thread at {:.1} s",
+            inject.at
+        );
+        panic!("crash-inject: deliberate panic (WOW_CRASH_INJECT)");
+    }
+}
+
+/// Re-entrancy latch: a panic *inside* the hook (a poisoned lock, a failed write) must not
+/// recurse into it. Never cleared on purpose — after one report the process is on its way out,
+/// and a second panic's report would only overwrite the useful one with a worse one.
+static REPORTING: AtomicBool = AtomicBool::new(false);
+
+fn report(info: &PanicHookInfo<'_>, build: BuildId, uptime: Duration) {
+    if REPORTING.swap(true, Ordering::SeqCst) {
+        return;
+    }
+    let Some(dir) = crate::local_state::diagnostics_dir() else {
+        return;
+    };
+    let payload = if let Some(s) = info.payload().downcast_ref::<&str>() {
+        (*s).to_owned()
+    } else if let Some(s) = info.payload().downcast_ref::<String>() {
+        s.clone()
+    } else {
+        "<non-string panic payload>".to_owned()
+    };
+    let location = info
+        .location()
+        .map(|l| format!("{}:{}:{}", l.file(), l.line(), l.column()))
+        .unwrap_or_else(|| "<unknown>".to_owned());
+    let thread = std::thread::current();
+    let text = render(&Report {
+        build,
+        unix: SystemTime::now()
+            .duration_since(UNIX_EPOCH)
+            .map(|d| d.as_secs())
+            .unwrap_or(0),
+        uptime,
+        thread: thread.name().unwrap_or("<unnamed>"),
+        location: &location,
+        payload: &payload,
+        backtrace: &std::backtrace::Backtrace::force_capture().to_string(),
+        log: &benilla_world::log_ring::recent(),
+    });
+    if let Some(path) = write(&dir, &text) {
+        eprintln!("crash report written to {}", path.display());
+    }
+}
+
+/// Everything the report says, gathered before rendering so the renderer is a pure function the
+/// test can drive without panicking.
+struct Report<'a> {
+    build: BuildId,
+    unix: u64,
+    uptime: Duration,
+    thread: &'a str,
+    location: &'a str,
+    payload: &'a str,
+    backtrace: &'a str,
+    log: &'a [String],
+}
+
+fn render(r: &Report<'_>) -> String {
+    let mut out = String::new();
+    let _ = writeln!(out, "benilla crash report");
+    let _ = writeln!(
+        out,
+        "build:     {} (sha {})",
+        r.build.summary(),
+        r.build.sha
+    );
+    let _ = writeln!(
+        out,
+        "time:      {} unix, {:.1} s after launch",
+        r.unix,
+        r.uptime.as_secs_f64()
+    );
+    let _ = writeln!(
+        out,
+        "platform:  {} {}",
+        std::env::consts::OS,
+        std::env::consts::ARCH
+    );
+    let _ = writeln!(out, "thread:    {}", r.thread);
+    let _ = writeln!(out, "at:        {}", r.location);
+    let _ = writeln!(out, "panic:     {}", r.payload);
+    let _ = writeln!(out, "\nbacktrace:\n{}", r.backtrace);
+    let _ = writeln!(out, "last {} log lines (oldest first):", r.log.len());
+    for line in r.log {
+        let _ = writeln!(out, "{line}");
+    }
+    out
+}
+
+/// Write the report under `dir` as `crash-<unix>.txt`, creating the folder on demand (an empty
+/// `Diagnostics/` on every run would be this instrument advertising itself, `perf::stall`'s
+/// reason). Plain `fs::write`, not `local_state::write_atomic`: the process is dying, and a
+/// half-written report beats none.
+fn write(dir: &Path, text: &str) -> Option<PathBuf> {
+    let unix = SystemTime::now()
+        .duration_since(UNIX_EPOCH)
+        .map(|d| d.as_secs())
+        .unwrap_or(0);
+    let path = dir.join(format!("crash-{unix}.txt"));
+    std::fs::create_dir_all(dir).ok()?;
+    std::fs::write(&path, text).ok()?;
+    Some(path)
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    const BUILD: BuildId = BuildId {
+        sha: "0123456789abcdef0123456789abcdef01234567",
+        short: "0123456",
+        date: "2026-09-16",
+        profile: "debug",
+    };
+
+    /// The report names the build, the place, the payload and the log — the four things a
+    /// reporter cannot reconstruct after the fact — and lands in the folder it was given.
+    #[test]
+    fn a_report_carries_the_build_the_place_the_payload_and_the_log() {
+        let log = vec!["+  1.000s  INFO benilla_app::net: entered world".to_owned()];
+        let text = render(&Report {
+            build: BUILD,
+            unix: 1_800_000_000,
+            uptime: Duration::from_millis(12_345),
+            thread: "main",
+            location: "crates/benilla-app/src/net/apply.rs:100:5",
+            payload: "index out of bounds: the len is 3 but the index is 7",
+            backtrace: "   0: benilla_app::net::apply::apply_net_updates",
+            log: &log,
+        });
+        for needle in [
+            "sha 0123456789abcdef0123456789abcdef01234567",
+            "0123456 · 2026-09-16 · debug",
+            "12.3 s after launch",
+            "thread:    main",
+            "at:        crates/benilla-app/src/net/apply.rs:100:5",
+            "panic:     index out of bounds: the len is 3 but the index is 7",
+            "apply_net_updates",
+            "last 1 log lines",
+            "entered world",
+        ] {
+            assert!(text.contains(needle), "missing {needle:?} in:\n{text}");
+        }
+
+        let dir = std::env::temp_dir().join(format!("benilla-crash-test-{}", std::process::id()));
+        let _ = std::fs::remove_dir_all(&dir);
+        let path = write(&dir, &text).expect("report written");
+        assert!(path.starts_with(&dir), "{}", path.display());
+        assert!(path
+            .file_name()
+            .unwrap()
+            .to_string_lossy()
+            .starts_with("crash-"));
+        assert_eq!(std::fs::read_to_string(&path).unwrap(), text);
+        let _ = std::fs::remove_dir_all(&dir);
+    }
+}
diff --git a/crates/benilla-app/src/creature_anim.rs b/crates/benilla-app/src/creature_anim.rs
index 44e741a7..c617eee4 100644
--- a/crates/benilla-app/src/creature_anim.rs
+++ b/crates/benilla-app/src/creature_anim.rs
@@ -390,7 +390,6 @@ pub(crate) fn stop_attack_local(
 /// `0x6131d9`). `0x5ecb70`'s own validator legs — the target's alive-or-feign + `CanAttack
 /// 0x606980` walk, and the `[0xb4b3e4]` world gate — stay with the callers that already compute
 /// them (`target::scan`'s `new_attackable`, the drain's `attack_actor_refusal`).
-#[allow(clippy::too_many_arguments)] // the tail writes four sinks; the alternative is a bundle
 pub(crate) fn start_attack_local(
     entity: Entity,
     target: u64,
@@ -444,7 +443,6 @@ pub(crate) fn start_attack_local(
 /// `[0xb4b3e4]` — the reference's second condition on the stop arm, a world/session global also
 /// tested at `0x5ecbc0` — is unmodelled; nothing in benilla can be false there while a press is
 /// being drained.
-#[allow(clippy::too_many_arguments)] // the seams' write set, minus the bundle a caller can't hold
 pub(crate) fn toggle_attack_local(
     entity: Entity,
     target: u64,
diff --git a/crates/benilla-app/src/creature_anim/blood.rs b/crates/benilla-app/src/creature_anim/blood.rs
index 2d6a6cba..3c647eb8 100644
--- a/crates/benilla-app/src/creature_anim/blood.rs
+++ b/crates/benilla-app/src/creature_anim/blood.rs
@@ -68,7 +68,6 @@ pub(super) fn load_blood_tables(mut commands: Commands, assets: Option<Res<World
 /// `info` and every fired spurt at `debug`, so "I never see blood" localizes to a link in one
 /// fight instead of a code audit (no drop lines at all ⇒ the break is upstream, in the
 /// [`SwingImpact`] feed itself).
-#[allow(clippy::too_many_arguments)] // one Bevy system's full input set
 pub(super) fn blood_spurts(
     mut swings: MessageReader<SwingImpact>,
     transforms: Query<&Transform>,
diff --git a/crates/benilla-app/src/creature_anim/breath.rs b/crates/benilla-app/src/creature_anim/breath.rs
index 602196e5..41884c36 100644
--- a/crates/benilla-app/src/creature_anim/breath.rs
+++ b/crates/benilla-app/src/creature_anim/breath.rs
@@ -141,7 +141,6 @@ pub(super) struct LastPuff(EntityHashMap<f32>);
 ///
 /// A unit seen for the first time has no [`BreathEnv`] and is classified at once, so a unit that
 /// streams in inside a cold zone breathes on its next idle loop rather than up to 10 s later.
-#[allow(clippy::too_many_arguments)] // one system's full input set
 pub(super) fn classify_breath(
     mut commands: Commands,
     time: Res<Time>,
@@ -184,7 +183,6 @@ pub(super) fn classify_breath(
 /// off the mount — so the **puff goes on the event's own entity** (its mouth), while the unit
 /// state the ladder reads (drunk, the environment) comes from the composite's **root**, exactly
 /// as the footfall visuals split them.
-#[allow(clippy::too_many_arguments)] // one system's full input set
 pub(super) fn fire_breath(
     mut events: MessageReader<AnimSoundEvent>,
     time: Res<Time>,
diff --git a/crates/benilla-app/src/creature_anim/driver.rs b/crates/benilla-app/src/creature_anim/driver.rs
index 605be562..68f2519c 100644
--- a/crates/benilla-app/src/creature_anim/driver.rs
+++ b/crates/benilla-app/src/creature_anim/driver.rs
@@ -263,7 +263,7 @@ fn transplant_up(
 /// enter/loop/exit the Special states (jump, sit/sleep/kneel) as one-shot-bracketed loops, play the
 /// per-packet melee swings as preemptible one-shots, and cross-fade the gaits (the engaged Ready
 /// idle among them).
-#[allow(clippy::type_complexity, clippy::too_many_arguments)]
+#[allow(clippy::type_complexity)]
 pub(super) fn drive_animations(
     mut commands: Commands,
     mut units: Query<(
diff --git a/crates/benilla-app/src/creature_anim/driver/mode.rs b/crates/benilla-app/src/creature_anim/driver/mode.rs
index 824874e3..e8bc7103 100644
--- a/crates/benilla-app/src/creature_anim/driver/mode.rs
+++ b/crates/benilla-app/src/creature_anim/driver/mode.rs
@@ -579,7 +579,7 @@ pub(super) fn run(
                         // gait it WRAPPED to its head at completion — the frames + cross-fade
                         // against the restarted reach-to-quiver were the director's "jumps
                         // back to the start the moment it gets fully pulled", in every build
-                        // that replayed a pull (trace-caught, decision 0412). The clamp IS the
+                        // that replayed a pull (trace-caught, decision 2276). The clamp IS the
                         // drawn pose; nothing follows it (0994).
                         // Loot 50 is likewise authored clamp — one 0.5 s kneel-down that must
                         // FREEZE in the rummage pose; as Forever it would wrap back to standing
diff --git a/crates/benilla-app/src/creature_anim/driver/play.rs b/crates/benilla-app/src/creature_anim/driver/play.rs
index 52a7c81f..c314fd61 100644
--- a/crates/benilla-app/src/creature_anim/driver/play.rs
+++ b/crates/benilla-app/src/creature_anim/driver/play.rs
@@ -237,7 +237,6 @@ pub(super) fn roll_loop<'a>(
 /// decision 0123) **and its budget** ([`roll_loop`] — decision 0516), publishing the armed
 /// `(node, R)` into `window` for the watchdog's advance; a one-shot arm clears it (its budget is
 /// the `Count` repeat — no window outlives the arm).
-#[allow(clippy::too_many_arguments)] // the resolve+roll+play primitive's full input set
 pub(super) fn play(
     lock: &mut BaseAnimLock,
     tr: &mut AnimationTransitions,
@@ -382,7 +381,6 @@ pub(super) fn holds_own_clip(
 /// and settles through [`Mode::Entering`]; **Fall has no enter** — the client plays the Fall(40)
 /// loop directly the tick FALLINGFAR latches (`0x602c40`) — so it goes straight to
 /// [`Mode::Looping`] with a looping play.
-#[allow(clippy::too_many_arguments)]
 pub(super) fn enter_special(
     lock: &mut BaseAnimLock,
     sp: Special,
@@ -434,7 +432,6 @@ pub(super) fn enter_special(
 /// started moving drops straight to the gait, letting the cross-fade carry the half-pose into the
 /// walk; an airborne state landing plays its [`jump_land_pick`]; otherwise `sp` plays its graceful
 /// exit one-shot, which [`super::drive_animations`] then waits out. Returns the mode to adopt.
-#[allow(clippy::too_many_arguments)]
 pub(super) fn leave_special(
     lock: &mut BaseAnimLock,
     sp: Special,
diff --git a/crates/benilla-app/src/creature_anim/driver/wound.rs b/crates/benilla-app/src/creature_anim/driver/wound.rs
index eab2530f..cdcac44b 100644
--- a/crates/benilla-app/src/creature_anim/driver/wound.rs
+++ b/crates/benilla-app/src/creature_anim/driver/wound.rs
@@ -115,7 +115,6 @@ pub(super) fn wound_evict(
 /// sheath reconcile and the event scan. `id` is the wound anim to lay (8–10), already resolved
 /// by the caller — melee by severity/engagement ([`select::wound_anim`]), a spell impact by its
 /// kit's own column ([`WoundEdge`]).
-#[allow(clippy::too_many_arguments)] // the trigger's full live-state + rng input set
 pub(super) fn wound_trigger(
     entity: Entity,
     drv: &mut AnimDriver,
diff --git a/crates/benilla-app/src/creature_anim/impact.rs b/crates/benilla-app/src/creature_anim/impact.rs
index 318f7208..7f4c2735 100644
--- a/crates/benilla-app/src/creature_anim/impact.rs
+++ b/crates/benilla-app/src/creature_anim/impact.rs
@@ -144,7 +144,6 @@ fn is_whiff(victim_state: u32) -> bool {
 /// Cache swings, consume impact tags, dispatch `$CPP` defenses, flush on supersede/attack-stop,
 /// silently drop records whose attacker despawned (the client's dtor clears without flushing).
 /// Ordered after [`super::events::fire_anim_events`] so a tag fires the same frame it's crossed.
-#[allow(clippy::too_many_arguments)]
 pub(super) fn route_swing_impacts(
     mut swings: MessageReader<SwingMessage>,
     mut events: MessageReader<AnimSoundEvent>,
diff --git a/crates/benilla-app/src/creature_anim/lod.rs b/crates/benilla-app/src/creature_anim/lod.rs
index eb637c41..856fe94f 100644
--- a/crates/benilla-app/src/creature_anim/lod.rs
+++ b/crates/benilla-app/src/creature_anim/lod.rs
@@ -90,7 +90,7 @@ const FALLBACK_RADIUS: f32 = 6.0;
 /// frame. Exempt: the body we drive (the camera rides its attachment-17 pivot, and it must keep
 /// animating faded-out in first person) and its mount child. `WOW_NO_ANIM_LOD=1` disables
 /// parking — the live-probe A/B lever; `WOW_NO_ROOM_LOD=1` disables only the room leg.
-#[allow(clippy::type_complexity, clippy::too_many_arguments)] // one Bevy system's full input set
+#[allow(clippy::type_complexity)] // one Bevy system's full input set
 pub(super) fn gate_rig_animation(
     time: Res<Time>,
     cam: Query<&Frustum, With<WorldCamera>>,
diff --git a/crates/benilla-app/src/creature_anim/sheath.rs b/crates/benilla-app/src/creature_anim/sheath.rs
index 79275c10..1161911f 100644
--- a/crates/benilla-app/src/creature_anim/sheath.rs
+++ b/crates/benilla-app/src/creature_anim/sheath.rs
@@ -341,7 +341,6 @@ fn arm_leg(
 /// gets at most one masked overlay, and [`VisualSheath`] holds that arm's pre-swap placement until
 /// its clip reaches the authored `$SHL`/`$SHR` moment. An arm whose leg has no playable clip
 /// snaps; no arm playing anything at all → no ceremony, and the whole transition snaps.
-#[allow(clippy::too_many_arguments)]
 pub(super) fn start_sheath_ceremony(
     commands: &mut Commands,
     entity: Entity,
@@ -380,7 +379,6 @@ pub(super) fn start_sheath_ceremony(
 /// [`sheath_phase2`] so it can reach for the new weapon. The ceremony ends when every arm has run
 /// out of legs, at which point [`VisualSheath`] is dropped and the resolver falls back to the
 /// committed state.
-#[allow(clippy::too_many_arguments)]
 pub(super) fn advance_sheath_ceremony(
     commands: &mut Commands,
     entity: Entity,
diff --git a/crates/benilla-app/src/creature_anim/spell_visual.rs b/crates/benilla-app/src/creature_anim/spell_visual.rs
index 7ca516ae..1b43e49b 100644
--- a/crates/benilla-app/src/creature_anim/spell_visual.rs
+++ b/crates/benilla-app/src/creature_anim/spell_visual.rs
@@ -765,7 +765,6 @@ fn play_impact(
 ///   have no packet, decision 0099): field set → the **channel** kit's anim as the hold + its
 ///   sound once at start; field cleared → hold drops. The per-entity edge cache is the dedup the
 ///   client gets from its per-tick armed-id guard — a held channel never restarts its clip.
-#[allow(clippy::too_many_arguments)]
 pub(super) fn route_cast_visuals(
     mut commands: Commands,
     mut events: MessageReader<CastEvent>,
@@ -1323,7 +1322,6 @@ pub(super) fn route_cast_visuals(
 /// exactly that bug: Stealth's kit 312 carries no models, no anim and no attach at all (its whole
 /// visual is one proc-14 CharProc), so an effects-only test dropped it and the character showed
 /// nothing.
-#[allow(clippy::too_many_arguments)] // one Bevy system's full input set
 pub(crate) fn arm_aura_state_fx(
     // The slot diff below is a pure function of the store's aura fields, so it re-runs only when
     // the store was written — `arm_level_up_fx`'s idiom (decision 1357's sibling gate): at the
@@ -1748,7 +1746,6 @@ pub(super) fn arm_morph_latch(
 /// cold-cache shift-in — whose SPELL_GO impact instance was still PENDING at the drain and thus
 /// survived — briefly runs that instance and the replay's twin together (one denser cloud, once
 /// per session per model; the warm-cache GO instance dies in the drain like the reference's).
-#[allow(clippy::too_many_arguments)] // one Bevy system's full input set
 pub(super) fn replay_morph_kit(
     mut swaps: MessageReader<crate::entities::DisplaySwapped>,
     visuals: Option<Res<SpellVisuals>>,
diff --git a/crates/benilla-app/src/cursor.rs b/crates/benilla-app/src/cursor.rs
index 805ca1ae..9ee680ff 100644
--- a/crates/benilla-app/src/cursor.rs
+++ b/crates/benilla-app/src/cursor.rs
@@ -388,7 +388,6 @@ mod other {
     /// Each frame: while a cursor payload with a resolved icon is held, show ITS 32×32 hardware
     /// cursor (decoded/downsampled on first use, then cached by path); otherwise swap to the
     /// classified mode (base-stem fallback, then Point, then OS) — unchanged from before 0216 §5.
-    #[allow(clippy::too_many_arguments)]
     pub(super) fn drive(
         mut commands: Commands,
         cursor: Res<super::DisplayedCursor>,
@@ -543,7 +542,6 @@ mod macos {
     /// §5, decoded/downsampled to 32×32 on first use and cached by path) if one is held and
     /// resolved, else the classified mode (base-stem fallback, then Point); on entering/leaving
     /// mouselook, hide/show it via the app-global hide counter.
-    #[allow(clippy::too_many_arguments)]
     pub(super) fn drive(
         cursors: Option<NonSend<NativeCursors>>,
         mut payload_cursors: NonSendMut<PayloadCursors>,
diff --git a/crates/benilla-app/src/death.rs b/crates/benilla-app/src/death.rs
index a60c4ad3..ec6a1e5c 100644
--- a/crates/benilla-app/src/death.rs
+++ b/crates/benilla-app/src/death.rs
@@ -177,7 +177,6 @@ const SPIRIT_HEALER_RANGE_SQ: f32 = 5.5556 * 5.5556;
 /// Per-frame: derive the death state from the self descriptor, push the countdown/offer snapshot,
 /// and fire the reference's death events on the edges (before `UiInput`, so a frame's `OnEvent`
 /// sees current values — the [`crate::ui_unit`] feed convention).
-#[allow(clippy::too_many_arguments)]
 fn feed_death(
     script: Option<NonSendMut<UiScript>>,
     self_q: Query<(&ObjectStore, &Transform), With<SelfPlayer>>,
diff --git a/crates/benilla-app/src/debug_panel/inspect.rs b/crates/benilla-app/src/debug_panel/inspect.rs
index 34db476b..40b6dcc7 100644
--- a/crates/benilla-app/src/debug_panel/inspect.rs
+++ b/crates/benilla-app/src/debug_panel/inspect.rs
@@ -192,7 +192,6 @@ pub(super) struct InspectStores<'w, 's> {
 /// The inspector overlay, drawn only while armed: a weak top-centre "armed" pill (so it's obvious the
 /// mode is on and how to leave it) and, whenever the cursor is over an identified object, a compact
 /// identity card pinned to the cursor. No chrome, no panel — its own lightweight surface.
-#[allow(clippy::too_many_arguments)]
 pub(super) fn inspect_ui(
     mut contexts: EguiContexts,
     inspect: Res<InspectMode>,
diff --git a/crates/benilla-app/src/debug_panel/journal.rs b/crates/benilla-app/src/debug_panel/journal.rs
index 1fe87952..06a7041f 100644
--- a/crates/benilla-app/src/debug_panel/journal.rs
+++ b/crates/benilla-app/src/debug_panel/journal.rs
@@ -156,7 +156,6 @@ fn age(now: f64, at: f64) -> String {
 /// The journal overlay: while inspect is armed, the recent casts as a top-left column, newest
 /// first — click a row to copy its one-line identity block. Shares the inspector card's style
 /// (decision 0025's one overlay look).
-#[allow(clippy::too_many_arguments)]
 pub(super) fn journal_ui(
     mut contexts: EguiContexts,
     inspect: Res<InspectMode>,
diff --git a/crates/benilla-app/src/debug_panel/mod.rs b/crates/benilla-app/src/debug_panel/mod.rs
index 512506a0..aaa43d89 100644
--- a/crates/benilla-app/src/debug_panel/mod.rs
+++ b/crates/benilla-app/src/debug_panel/mod.rs
@@ -37,6 +37,7 @@ use bevy_egui::{
     PrimaryEguiContext,
 };
 
+use benilla_assets::LockRecover;
 use benilla_world::lighting::{ClockSource, GameClock, WowLighting};
 use benilla_world::model_render::{ModelKind, ModelPart};
 use benilla_world::modkeys::{dev_chord, DEV_CHORD};
@@ -380,7 +381,6 @@ fn toggle_panel(keys: Res<ButtonInput<KeyCode>>, mut debug: ResMut<DebugState>)
 /// Draw the panel as a translucent **overlay** on the right — the world renders full-screen
 /// underneath (no viewport inset). `ui_script::PointerOverUi` keeps the cursor's panel
 /// interactions from leaking into gameplay mouse-look.
-#[allow(clippy::too_many_arguments)]
 fn debug_panel_ui(
     mut contexts: EguiContexts,
     stamp: Res<benilla_world::build_id::BuildId>,
@@ -671,7 +671,7 @@ fn debug_panel_ui(
                             // The LAST sample, not the ring average the meter shows: the panel
                             // is the instrument, and "what did the most recent pong measure" is
                             // the question a stuck or spiking meter needs answered.
-                            let last_rtt = ping.0.lock().expect("ping clock").last_rtt_ms;
+                            let last_rtt = ping.0.lock_recover().last_rtt_ms;
                             ui.label(if net_status.connected {
                                 match last_rtt {
                                     Some(ms) => format!("connected · {ms} ms ping"),
diff --git a/crates/benilla-app/src/dev.rs b/crates/benilla-app/src/dev.rs
index f06dc6e9..3e3c6d57 100644
--- a/crates/benilla-app/src/dev.rs
+++ b/crates/benilla-app/src/dev.rs
@@ -34,6 +34,15 @@ pub(crate) fn print_scenario_names() {
     crate::capture::print_scenario_names();
 }
 
+/// `WOW_PROBE=list` — the probe fleet's environment registry (`capture::probe_env`): every
+/// `WOW_PROBE*` variable, whether it arms the un-occludable window, and `WOW_PROBE`'s own named
+/// values — printed before any window or asset setup. Answers nothing in a player build, which
+/// has no probes.
+pub(crate) fn print_probe_vars() {
+    #[cfg(feature = "dev")]
+    crate::capture::probe_env::print();
+}
+
 /// `WOW_HOVER_LOG_REPORT=<csv>` — re-read a recorded run and print its report, no window, no game.
 /// New analysis lands on runs already captured (see `hover_log`).
 pub(crate) fn report_recorded_hover_log(_path: &str) {
@@ -105,34 +114,26 @@ impl Plugin for DevProbesPlugin {
             // Any scripted probe keeps its window un-occludable: a fully covered macOS window drops to
             // ~1 fps drawables, and every probe schedule is wall-clock — a throttled run doesn't measure
             // slowly, it runs the wrong script (see `capture::ProbeFocusPlugin`, decision 0906).
+            // Which probe variables count is the registry's `wall_clock` column
+            // (`capture::probe_env::PROBE_VARS`), not a list kept here: this list was hand-kept
+            // and had drifted to ten of the twenty-five wall-clock variables when 2265 §A5 read
+            // it against the code, so a mail or auction probe ran covered. The four below are the
+            // non-probe instruments that schedule on the wall clock too.
             // (`WOW_LIVE_FPS` is in the list because an occluded SETTLE phase streams the world at ~1 fps
             // and under-warms the scene before sampling even starts — the assertion has to be live from
             // the first tick, not at the uncap.)
-            if [
-                "WOW_PROBE",
-                "WOW_PROBE_CHAT",
-                "WOW_PROBE_HOVER",
-                "WOW_PROBE_KEY",
-                "WOW_PROBE_LUA",
-                // The swim-pitch aim is a wall-clock timeline like every other probe schedule, and
-                // it is the one script that can be a run's *only* actuator (a drifting swimmer
-                // needs no keys) — so it arms the occlusion defence on its own.
-                "WOW_PROBE_PITCH",
-                "WOW_PROBE_CHEST",
-                "WOW_PROBE_CLAM",
-                "WOW_PROBE_VENDOR_SWAP",
-                "WOW_PROBE_MODEL_CAMERA",
-                "WOW_RIG",
-                "WOW_LIVE_FPS",
-                // A screenshot burst and a pick burst are wall-clock schedules too, and on an
-                // occluded window they capture the same stale drawable over and over: a whole
-                // day of lamppost A/Bs on the Air read identical to the decimal because every
-                // frame in every burst was one frame (the halo record).
-                "WOW_LIVE_SHOT",
-                "WOW_PICK",
-            ]
-            .iter()
-            .any(|k| std::env::var(k).is_ok())
+            if crate::capture::probe_env::wall_clock_vars()
+                .chain([
+                    "WOW_RIG",
+                    "WOW_LIVE_FPS",
+                    // A screenshot burst and a pick burst are wall-clock schedules too, and on an
+                    // occluded window they capture the same stale drawable over and over: a whole
+                    // day of lamppost A/Bs on the Air read identical to the decimal because every
+                    // frame in every burst was one frame (the halo record).
+                    "WOW_LIVE_SHOT",
+                    "WOW_PICK",
+                ])
+                .any(|k| std::env::var(k).is_ok())
             {
                 app.add_plugins(crate::capture::ProbeFocusPlugin);
             }
diff --git a/crates/benilla-app/src/entities.rs b/crates/benilla-app/src/entities.rs
index 0d21f28f..6cd1abe5 100644
--- a/crates/benilla-app/src/entities.rs
+++ b/crates/benilla-app/src/entities.rs
@@ -592,7 +592,6 @@ pub(crate) struct DisplayBuildSet;
 /// doc for why a clear is always safe mid-session). These caches are get-or-insert at every use
 /// site, so a cleared entry rebuilds on the next spawn that wants it; without this, every display
 /// id, material key, and composited skin ever seen stayed resident for the life of the process.
-#[allow(clippy::too_many_arguments)]
 fn evict_display_caches(
     mut changes: MessageReader<benilla_world::world_map::MapChange>,
     mut composites: ResMut<SkinComposites>,
@@ -1191,7 +1190,6 @@ fn setup_entities(
 /// For every display id active among the net entities: ensure its [`DisplayModel`] exists (resolve the
 /// catalog + request the model handle), and once the handle has loaded, build its spawn parts (the
 /// per-submesh material, with creature skin slots filled from the display's variations).
-#[allow(clippy::too_many_arguments)]
 fn update_display_models(
     // `ObjectStore` rides along for the corpses: which cache holds a corpse's model is a
     // descriptor question (`CORPSE_FLAG_BONES`), not a display-id one — decision 1706.
diff --git a/crates/benilla-app/src/entities/attach/char_skin.rs b/crates/benilla-app/src/entities/attach/char_skin.rs
index 3c9d5803..7f88c80d 100644
--- a/crates/benilla-app/src/entities/attach/char_skin.rs
+++ b/crates/benilla-app/src/entities/attach/char_skin.rs
@@ -281,7 +281,7 @@ fn shared_skin_probe() -> bool {
 /// available (those parts then keep their built, untextured material). A composited atlas is uploaded once per look ([`super::super::SkinComposites`] cache); a baked or hair
 /// BLP loads through the async `mpq://` pipeline (which dedups by path). `parts` supplies the hair
 /// batches' blend (hair is alpha-cut, so it can't be forced opaque like the body).
-#[allow(clippy::too_many_arguments, clippy::type_complexity)]
+#[allow(clippy::type_complexity)]
 pub(super) fn build_char_skin_materials(
     look: &CharLook,
     // The worn armor display ids (bodyslot 2–9) + the cloak's, and the ItemDisplayInfo catalog to
diff --git a/crates/benilla-app/src/entities/attach/mod.rs b/crates/benilla-app/src/entities/attach/mod.rs
index 7889715d..8b7bcda6 100644
--- a/crates/benilla-app/src/entities/attach/mod.rs
+++ b/crates/benilla-app/src/entities/attach/mod.rs
@@ -294,7 +294,7 @@ struct RigBuild {
 /// / player body) as submesh children, or a colored cube fallback. The entity's pose is owned by the
 /// net bridge — or, for our own avatar, the player controller — we only add the geometry (and bake
 /// per-display scale onto the root). Our own avatar is the same streamed entity and renders here too.
-#[allow(clippy::type_complexity, clippy::too_many_arguments)]
+#[allow(clippy::type_complexity)]
 pub(super) fn attach_entity_visuals(
     mut commands: Commands,
     pending: Query<
diff --git a/crates/benilla-app/src/entities/attach/preview.rs b/crates/benilla-app/src/entities/attach/preview.rs
index b8b60702..f7f1e4fe 100644
--- a/crates/benilla-app/src/entities/attach/preview.rs
+++ b/crates/benilla-app/src/entities/attach/preview.rs
@@ -159,7 +159,6 @@ pub(in crate::entities) struct PreviewCtx<'a, 'w> {
 /// entity-visuals chain (after `update_display_models` has built the body model from the
 /// want-list), so a fresh look's models are ready within a frame or two; until then it leaves the
 /// bake untouched and retries. A bare yaw change never reaches here (the booth handles it).
-#[allow(clippy::too_many_arguments)]
 pub(in crate::entities) fn build_glue_preview(
     preview: Res<GluePreview>,
     mut bake: ResMut<GluePreviewBake>,
@@ -351,7 +350,6 @@ pub(in crate::entities) fn build_glue_preview(
 /// plus the tried-on substitutions. The body display is the player's own, so it is already built
 /// (they are standing in the world); an ITEM model still has to load, which is what the retry latch
 /// is for.
-#[allow(clippy::too_many_arguments)]
 pub(in crate::entities) fn build_dressup_preview(
     preview: Res<DressUpPreview>,
     mut bake: ResMut<DressUpBake>,
diff --git a/crates/benilla-app/src/entities/attach/redress.rs b/crates/benilla-app/src/entities/attach/redress.rs
index fdd66bd9..d6c48014 100644
--- a/crates/benilla-app/src/entities/attach/redress.rs
+++ b/crates/benilla-app/src/entities/attach/redress.rs
@@ -68,7 +68,7 @@ type PartWrites<'a> = (
 /// creature's look never changes this way, and a character-model NPC wears its display's columns —
 /// a *display* change is a different model and stays a teardown
 /// ([`super::super::live_display::refresh_live_display`]).
-#[allow(clippy::type_complexity, clippy::too_many_arguments)]
+#[allow(clippy::type_complexity)]
 pub(in crate::entities) fn redress_player_looks(
     mut commands: Commands,
     mut players: Query<
diff --git a/crates/benilla-app/src/entities/chain_beam.rs b/crates/benilla-app/src/entities/chain_beam.rs
index 288855ad..08bc9462 100644
--- a/crates/benilla-app/src/entities/chain_beam.rs
+++ b/crates/benilla-app/src/entities/chain_beam.rs
@@ -240,7 +240,6 @@ fn select_targets(
 /// reapable: the reference only ever publishes a flagged node to the owner slots that the channel
 /// teardown sweeps (`0x6ecdaa` gates the AddRef on the flag), so a one-shot beam always runs its own
 /// clock to the end.
-#[allow(clippy::too_many_arguments)]
 pub(super) fn spawn_chain_beams(
     mut commands: Commands,
     time: Res<Time>,
@@ -463,7 +462,6 @@ fn push_strand(
 /// Per frame: age the beam, re-resolve every hop's live endpoints, re-jitter and advect its
 /// polyline, and write the ribbons into the shared effect-quad stream — the reference's
 /// `LightningObject::Update` (`0x6ec460`) and `CLightning::Render` (`0x7afcb0`) in one pass.
-#[allow(clippy::too_many_arguments)]
 pub(crate) fn simulate_chain_beams(
     time: Res<Time>,
     mut commands: Commands,
diff --git a/crates/benilla-app/src/entities/conform.rs b/crates/benilla-app/src/entities/conform.rs
index 134d06fe..abaf1f44 100644
--- a/crates/benilla-app/src/entities/conform.rs
+++ b/crates/benilla-app/src/entities/conform.rs
@@ -94,7 +94,7 @@ fn conform_rotation(mode: u8, n_local: Vec3) -> Quat {
 /// spawn seats instantly like the reference; and a parked rig (off-frustum, the 0448 anim-LOD
 /// gate) skips its ray and drops its vector, re-seeding warm on wake — the 0448 absolute-snap
 /// philosophy applied to the stance, bounding the cost at one ray per flagged unit ON SCREEN.
-#[allow(clippy::too_many_arguments, clippy::type_complexity)] // one Bevy system's full input set
+#[allow(clippy::type_complexity)] // one Bevy system's full input set
 pub(super) fn conform_units(
     time: Res<Time>,
     spatial: SpatialQuery,
diff --git a/crates/benilla-app/src/entities/dest_fx.rs b/crates/benilla-app/src/entities/dest_fx.rs
index 0236d66b..7e9bb6c0 100644
--- a/crates/benilla-app/src/entities/dest_fx.rs
+++ b/crates/benilla-app/src/entities/dest_fx.rs
@@ -267,7 +267,6 @@ pub(super) fn tick_shard_emitters(
 /// Attach model parts to pending instances whose M2 finished building (the missile pattern —
 /// free world models, ground-anchored so authored flat quads decal to the terrain), start the
 /// one-shot clocks, and run both reapers (one-shot expiry; the loop-repeat override).
-#[allow(clippy::too_many_arguments)] // one Bevy system's full input set
 pub(super) fn attach_ground_fx_models(
     mut commands: Commands,
     time: Res<Time>,
diff --git a/crates/benilla-app/src/entities/display.rs b/crates/benilla-app/src/entities/display.rs
index fc567cba..ed21cff8 100644
--- a/crates/benilla-app/src/entities/display.rs
+++ b/crates/benilla-app/src/entities/display.rs
@@ -375,7 +375,6 @@ pub(super) fn empty_display() -> DisplayModel {
 /// Build a display model's spawn parts once its asset has loaded — each submesh's `WowModelMaterial`,
 /// with a creature skin slot filled from the display's variation (`<dir>\<name>.blp`). Returns early
 /// (leaving `parts` `None`) while the asset is still loading.
-#[allow(clippy::too_many_arguments)]
 pub(super) fn build_parts(
     dm: &mut DisplayModel,
     m2s: &Assets<M2Model>,
diff --git a/crates/benilla-app/src/entities/equipment/resolve.rs b/crates/benilla-app/src/entities/equipment/resolve.rs
index af23e1f5..ffd1096d 100644
--- a/crates/benilla-app/src/entities/equipment/resolve.rs
+++ b/crates/benilla-app/src/entities/equipment/resolve.rs
@@ -172,7 +172,7 @@ pub(crate) struct DressKey {
 /// descriptor changed, its key changed, or a global input moved — the [`Items`] epochs (an
 /// object ingest covers the quiver bag walk, a landed template answers every pending ask) and
 /// the two client-data load edges. The idle crowd costs one tick check and one small compare.
-#[allow(clippy::type_complexity, clippy::too_many_arguments)]
+#[allow(clippy::type_complexity)]
 pub(in crate::entities) fn resolve_equipment(
     mut commands: Commands,
     units: Query<(
diff --git a/crates/benilla-app/src/entities/item_glow.rs b/crates/benilla-app/src/entities/item_glow.rs
index 834e28de..a8987b79 100644
--- a/crates/benilla-app/src/entities/item_glow.rs
+++ b/crates/benilla-app/src/entities/item_glow.rs
@@ -177,7 +177,6 @@ pub(crate) struct ItemGlowAttached;
 /// waits, so a two-model visual can't spawn half of itself and then re-enter here. A model that
 /// never loads simply never glows (the item is still perfectly drawn); the retry is a handful of
 /// roots per frame.
-#[allow(clippy::too_many_arguments)]
 pub(super) fn attach_item_glows(
     mut commands: Commands,
     pending: Query<(Entity, &ItemGlow), Without<ItemGlowAttached>>,
diff --git a/crates/benilla-app/src/entities/missile.rs b/crates/benilla-app/src/entities/missile.rs
index 13067e66..13315107 100644
--- a/crates/benilla-app/src/entities/missile.rs
+++ b/crates/benilla-app/src/entities/missile.rs
@@ -462,7 +462,6 @@ fn arrival_handoff(
 /// arrival deadline was fixed at GO). A release already past its deadline arrives on the spot:
 /// the arrival hand-off plays now, no flight entity, no flight loop — the melee-range cast
 /// shows only the hit, the reference's close-range look.
-#[allow(clippy::too_many_arguments)]
 fn launch_go(
     go: &QueuedGo,
     launch: Vec3,
@@ -535,7 +534,6 @@ fn launch_go(
 /// is created at queue time (shared with the attach-point effects — the same `.mdx` is one load
 /// however many things use it); a chain-less spawn resolves the wire ammo display instead
 /// ([`ensure_ammo_model`]).
-#[allow(clippy::too_many_arguments)]
 pub(super) fn spawn_missiles(
     mut commands: Commands,
     time: Res<Time>,
@@ -673,7 +671,6 @@ pub(super) fn spawn_missiles(
 /// Spawn a missile's model parts + particle emitters once its M2 finishes building (the shared
 /// cache's `parts` fill in `super::update_display_models`) — children of the missile entity, so
 /// they ride the mover below. An unloadable model just flies invisible and still impacts on time.
-#[allow(clippy::too_many_arguments)]
 pub(super) fn attach_missile_models(
     mut commands: Commands,
     mut missiles: Query<(Entity, &mut Missile)>,
@@ -740,7 +737,6 @@ pub(super) fn attach_missile_models(
 /// the path. On schedule-end it snaps to the point, runs the [`arrival_handoff`] (a landed
 /// target's impact, a missed one's dodge/block), and despawns (children with it; emitters
 /// self-release via the owner contract).
-#[allow(clippy::too_many_arguments)]
 pub(super) fn move_missiles(
     mut commands: Commands,
     time: Res<Time>,
diff --git a/crates/benilla-app/src/entities/mount.rs b/crates/benilla-app/src/entities/mount.rs
index 0dc01da1..237c4205 100644
--- a/crates/benilla-app/src/entities/mount.rs
+++ b/crates/benilla-app/src/entities/mount.rs
@@ -156,7 +156,6 @@ pub(super) type MountChildren<'w, 's> = Query<
 /// Drive one unit's mount side to the point where the rider can be seated. Spawns the child when
 /// it is missing, drops and retries a child built for a display the field has since moved off, and
 /// resolves the seat frame once the child's rig is up.
-#[allow(clippy::too_many_arguments)] // the seat law's full input set, like its callers
 pub(super) fn seat_or_spawn_mount(
     commands: &mut Commands,
     children: &MountChildren,
diff --git a/crates/benilla-app/src/entities/spell_fx/mod.rs b/crates/benilla-app/src/entities/spell_fx/mod.rs
index abbfe9f3..2d44ba4e 100644
--- a/crates/benilla-app/src/entities/spell_fx/mod.rs
+++ b/crates/benilla-app/src/entities/spell_fx/mod.rs
@@ -228,7 +228,6 @@ pub(crate) struct EffectHost {
 /// rather than off a slot pinned at spawn. `None` for the lanes that are not `CEffect`s and never
 /// advance — a missile (the separate `CMissile` TU), an item glow, the `fxview` preview — which
 /// keep the pinned single-clip arm they have always had.
-#[allow(clippy::too_many_arguments)]
 pub(crate) fn attach_effect_visuals(
     commands: &mut Commands,
     root: Entity,
@@ -916,7 +915,7 @@ fn reap_matching(
 /// so the whole effect — meshes and particle emitters alike — rides the animating bone. The one
 /// exception is the kit's **world-plant slot** ([`benilla_formats::WORLD_EFFECT_TAG`], kit field
 /// 12): its root is a free world entity at the owner's position/facing/scale, [`WorldPlantFx`].
-#[allow(clippy::too_many_arguments, clippy::type_complexity)] // one Bevy system's full input set
+#[allow(clippy::type_complexity)] // one Bevy system's full input set
 pub(super) fn attach_spell_fx(
     mut commands: Commands,
     mut units: Query<(
@@ -1124,7 +1123,6 @@ pub(super) fn attach_spell_fx(
 /// the world position; an instance root's own is joint-local). Unlike a streamed creature, an
 /// instance is born under our eyes at t = 0, so first sight fires the head window `[0, cur]` —
 /// the level-up pillar's `$SND(888)` sits at 0.033 s and depends on it.
-#[allow(clippy::too_many_arguments)] // the scan's own params plus the frame's two reads
 pub(super) fn fire_fx_anim_events(
     units: Query<(Entity, &FxAttached)>,
     players: Query<&AnimationPlayer>,
diff --git a/crates/benilla-app/src/entities/wmo_props.rs b/crates/benilla-app/src/entities/wmo_props.rs
index 00d11bbe..11a7ab34 100644
--- a/crates/benilla-app/src/entities/wmo_props.rs
+++ b/crates/benilla-app/src/entities/wmo_props.rs
@@ -186,7 +186,6 @@ pub(super) fn resolve_wmo_gameobject_props(
 /// Spawn each pending prop as its M2 lands, parented under the gameobject entity. The whole ship's
 /// set spawns within a few frames of the models landing — no per-frame budget (transports are a
 /// handful of instances per map, not a city's worth of placements).
-#[allow(clippy::too_many_arguments)] // one Bevy system's full input set
 pub(super) fn spawn_wmo_gameobject_props(
     mut commands: Commands,
     m2s: Res<Assets<M2Model>>,
diff --git a/crates/benilla-app/src/footprints.rs b/crates/benilla-app/src/footprints.rs
index 557fb973..c57ca982 100644
--- a/crates/benilla-app/src/footprints.rs
+++ b/crates/benilla-app/src/footprints.rs
@@ -159,7 +159,6 @@ type RootState = (
 /// Spawn a print for each per-foot plant on a footprint surface: the state gates (hover /
 /// stealth / ghost / distance), the terrain-flags gate, the unit's ink + params, the event
 /// marker's live bone position, yaw to the facing, project once, cache the triangles.
-#[allow(clippy::too_many_arguments)]
 fn spawn_footprints(
     mut events: MessageReader<AnimSoundEvent>,
     time: Res<Time>,
diff --git a/crates/benilla-app/src/game_tip.rs b/crates/benilla-app/src/game_tip.rs
index 810935f7..eab8f590 100644
--- a/crates/benilla-app/src/game_tip.rs
+++ b/crates/benilla-app/src/game_tip.rs
@@ -312,7 +312,6 @@ fn empty_tip(e: &mut EntityCommands, vis: &mut Visibility) {
 ///
 /// Two jobs in one system because they are one mechanism seen at two moments: the reference picks
 /// the row inside `EnterWorld` and lays it out once per raise, then draws that layout every frame.
-#[allow(clippy::too_many_arguments)]
 fn drive_game_tip(
     mut screen: ResMut<crate::loading_screen::LoadingScreen>,
     mut tips: ResMut<GameTips>,
diff --git a/crates/benilla-app/src/glue/dialog.rs b/crates/benilla-app/src/glue/dialog.rs
index efb51f99..05cf4202 100644
--- a/crates/benilla-app/src/glue/dialog.rs
+++ b/crates/benilla-app/src/glue/dialog.rs
@@ -394,7 +394,6 @@ pub(crate) fn spawn_dialog(
 ///
 /// Runs inside each glue screen's own system chain (again: the header says why it cannot be
 /// hoisted out with an ordering pair).
-#[allow(clippy::too_many_arguments)]
 pub(crate) fn drive_glue_dialog(
     mut commands: Commands,
     mut dialog: ResMut<GlueDialog>,
diff --git a/crates/benilla-app/src/glue/widgets.rs b/crates/benilla-app/src/glue/widgets.rs
index 87c35956..0a05c9b0 100644
--- a/crates/benilla-app/src/glue/widgets.rs
+++ b/crates/benilla-app/src/glue/widgets.rs
@@ -162,7 +162,6 @@ pub(crate) fn outlined_text<W: Bundle, T: Bundle>(
 /// Every *other* wrapped glue string in the shipped XML sets `justifyH="LEFT"` explicitly
 /// (`CharacterCreate.xml`'s race/class/faction bodies, `AddonList.xml`'s title/notes/deps), which
 /// is why [`outlined_text`] stays left and this is the exception rather than the default.
-#[allow(clippy::too_many_arguments)]
 pub(crate) fn outlined_text_centered<W: Bundle, T: Bundle>(
     parent: &mut ChildSpawnerCommands,
     node: Node,
@@ -257,7 +256,6 @@ pub(crate) fn markup_spans(text: &str, base: Color, wrap: bool) -> Vec<(String,
 ///
 /// **Private**: [`outlined_text`] is the one door in, so no caller can hand-build spans and skip
 /// the markup decode (B273's shape — see [`markup_spans`]).
-#[allow(clippy::too_many_arguments)]
 fn outlined_spans<W: Bundle, T: Bundle>(
     parent: &mut ChildSpawnerCommands,
     node: Node,
@@ -355,7 +353,6 @@ fn outlined_spans<W: Bundle, T: Bundle>(
 /// visual), and the name label along the bottom (the ref's `HighlightText`, `GlueFontNormalSmall`,
 /// anchored BOTTOM +1 — over the icon's bottom edge). `dyn_icon`/`label_dyn` are the screen's
 /// refresh markers, spawned onto the face / real label text.
-#[allow(clippy::too_many_arguments)]
 pub(crate) fn icon_button<A: Component, I: Bundle, L: Bundle>(
     parent: &mut ChildSpawnerCommands,
     font: &Handle<Font>,
@@ -712,7 +709,6 @@ pub(crate) fn paint_glue_field<'a>(
 /// onto all five row items ([`GlueFieldPart`]) so the screen's refresh can query them as a set and
 /// hand them to [`paint_glue_field`]. Plain-fill fallback without art. Focus and typing are the
 /// owning screen's systems — this is chrome only, so the screens' boxes can never fork.
-#[allow(clippy::too_many_arguments)]
 pub(crate) fn glue_edit_box<E: Bundle, T: Bundle + Clone>(
     parent: &mut ChildSpawnerCommands,
     art: &GlueArt,
@@ -821,7 +817,6 @@ pub(crate) fn glue_edit_box<E: Bundle, T: Bundle + Clone>(
 /// Returns the button's entity, so a screen can reach back into what it just built — the login
 /// screen marks its realmlist button [`GlueDisabled`] when `$WOW_HOST` owns the session (1667).
 /// Ignoring the return is the norm; nothing is `#[must_use]`.
-#[allow(clippy::too_many_arguments)]
 pub(crate) fn glue_button<A: Component>(
     parent: &mut ChildSpawnerCommands,
     art: &GlueArt,
diff --git a/crates/benilla-app/src/go_anim.rs b/crates/benilla-app/src/go_anim.rs
index 8b4fbcc1..6d91208f 100644
--- a/crates/benilla-app/src/go_anim.rs
+++ b/crates/benilla-app/src/go_anim.rs
@@ -1,8 +1,8 @@
-//! GameObject open/close animation (decision 0242; chest lid folded in by 0250) — a **client-side**
+//! GameObject open/close animation (decision 0242; chest lid folded in by 2271) — a **client-side**
 //! `GAMEOBJECT_STATE` drives a skeletal M2 sequence, so a **door** swings, a **button** depresses, and a
 //! **chest lid** opens/closes on its §243 state machine.
 //!
-//! **The model (0250, §5-VERIFIED):** the real client keeps *one* stored state per GameObject (the
+//! **The model (2271, §5-VERIFIED):** the real client keeps *one* stored state per GameObject (the
 //! binary's `go+0x27c`) and *one* `SetGoState` that all callers funnel through; a change of that state
 //! plays the §243 transition. benilla mirrors that exactly — [`GoAnim::state`] is the single source of
 //! truth, written by the **three callers** the RE census pinned:
@@ -88,7 +88,7 @@ const GO_STATE_READY: u32 = 1;
 /// object plays this once and *then* goes away; see [`DespawnAnimAnnounced`].
 const ANIM_DESPAWN: u16 = 157;
 
-/// Marker + client-side state for an animated GameObject (decisions 0242/0250). Instanced by
+/// Marker + client-side state for an animated GameObject (decisions 0242/2271). Instanced by
 /// [`crate::entities::attach`] on an animatable GO type whose model authors sequences; driven by
 /// [`drive_go_anim`]. Distinct from creatures' `AnimDriver` so the two drivers never touch one entity.
 #[derive(Component, Default)]
@@ -304,7 +304,7 @@ fn collider_is_solid(wire_state: Option<u32>) -> bool {
 }
 
 /// A cast launched at a GameObject (`SMSG_SPELL_GO` carrying a `TARGET_FLAG_GAMEOBJECT`), bridged from the
-/// net apply layer to this module (decision 0250). [`open_go_lid`] opens the target's lid/door iff the
+/// net apply layer to this module (decision 2271). [`open_go_lid`] opens the target's lid/door iff the
 /// spell carries an open-lock effect and the GO is an animated type — the client's `Spell_C` open path.
 #[derive(Message, Clone, Copy)]
 pub(crate) struct GoLidOpen {
@@ -1784,7 +1784,7 @@ mod tests {
 
     #[test]
     fn chest_animates_but_keeps_its_collider() {
-        // A chest (3) is on the animation machine (0250) but off the collision gate (0249): you see the
+        // A chest (3) is on the animation machine (2271) but off the collision gate (0249): you see the
         // lid move, but you never walk through an open chest.
         assert!(go_animates(3));
         assert!(!collision_follows_state(3));
diff --git a/crates/benilla-app/src/lib.rs b/crates/benilla-app/src/lib.rs
index 54a2ad52..7d392357 100644
--- a/crates/benilla-app/src/lib.rs
+++ b/crates/benilla-app/src/lib.rs
@@ -59,6 +59,7 @@ mod chr_classes;
 mod cinematic;
 mod combat_text;
 mod cooldowns;
+mod crash;
 mod creature_anim;
 mod cursor;
 mod cvars;
@@ -302,6 +303,16 @@ pub fn run(build: BuildId) -> AppExit {
         dev::print_scenario_names();
         return AppExit::Success;
     }
+    // `WOW_PROBE=list` prints the probe fleet's environment registry (`capture::probe_env`) the
+    // same way — before any window, so a session can ask the binary what the fleet takes.
+    if std::env::var("WOW_PROBE").as_deref() == Ok("list") {
+        dev::print_probe_vars();
+        return AppExit::Success;
+    }
+
+    // From here on a panic leaves `benilla-config/Diagnostics/crash-<unix>.txt` behind (decision
+    // 2266 §B2) — armed before the `App` exists, so a panic while plugins build is a report too.
+    crash::install(build);
 
     let mut app = App::new();
     // The stamp is plain data from here on — the panel footer and preflight banner read it back.
diff --git a/crates/benilla-app/src/loading_screen.rs b/crates/benilla-app/src/loading_screen.rs
index fb418f26..b08d3d48 100644
--- a/crates/benilla-app/src/loading_screen.rs
+++ b/crates/benilla-app/src/loading_screen.rs
@@ -549,7 +549,7 @@ fn setup_loading_screen(
 
 /// Per-frame: observe the lifecycle edges, run the trigger/clear state machine, resolve backdrop
 /// art, and push the progress fraction into the bar.
-#[allow(clippy::too_many_arguments, clippy::type_complexity)]
+#[allow(clippy::type_complexity)]
 fn drive_loading_screen(
     mut screen: ResMut<LoadingScreen>,
     // The streamer's two published facts, bundled into one param (Bevy's 16-element system-param
diff --git a/crates/benilla-app/src/login/mod.rs b/crates/benilla-app/src/login/mod.rs
index d5c97292..802bbec3 100644
--- a/crates/benilla-app/src/login/mod.rs
+++ b/crates/benilla-app/src/login/mod.rs
@@ -447,7 +447,6 @@ fn logon_refusal_text(strings: &GlueStrings, code: Option<u8>) -> &str {
 /// The policy tick + the net-message reactions. Runs in every state (the reconnect path fires
 /// while `InWorld`); the screen's own submit comes through [`login_input`], which calls
 /// [`send_login`] with `announced = true`.
-#[allow(clippy::too_many_arguments)]
 fn drive_policy(
     mut attempt: Attempt,
     realm_list_up: Res<crate::realm_select::Realms>,
@@ -792,7 +791,7 @@ fn enter_login(mut form: ResMut<LoginForm>, mut preview: ResMut<GluePreview>) {
 /// The screen's input: typing into the focused box (the ref's 16-letter cap), Tab cycling, Enter
 /// submits, Esc quits (dialog-first — an open dialog's Esc is its Cancel/Okay), clicks focus the
 /// boxes / press the buttons / toggle the checkbox.
-#[allow(clippy::too_many_arguments, clippy::type_complexity)]
+#[allow(clippy::type_complexity)]
 fn login_input(
     realms: Res<crate::realm_select::Realms>,
     presses: Query<(Entity, &LoginAction, Ref<Interaction>)>,
diff --git a/crates/benilla-app/src/login/screen.rs b/crates/benilla-app/src/login/screen.rs
index bfe241c6..bfd1a970 100644
--- a/crates/benilla-app/src/login/screen.rs
+++ b/crates/benilla-app/src/login/screen.rs
@@ -81,7 +81,6 @@ pub(super) struct RealmlistReadout;
 /// Spawn the screen tree once its prerequisites exist (the select screen's boot-order pattern:
 /// the INITIAL state's `OnEnter` fires before the MPQ chain / booth slots do) — and upgrade an
 /// artless early spawn the moment the client art lands.
-#[allow(clippy::too_many_arguments)]
 pub(super) fn materialize_screen(
     mut commands: Commands,
     existing: Query<(Entity, &LoginUi)>,
@@ -137,7 +136,6 @@ pub(super) fn materialize_screen(
     }
 }
 
-#[allow(clippy::too_many_arguments)]
 fn spawn_screen(
     commands: &mut Commands,
     assets: &AssetServer,
diff --git a/crates/benilla-app/src/login/smoke.rs b/crates/benilla-app/src/login/smoke.rs
index 1eb35ca9..083c2fcf 100644
--- a/crates/benilla-app/src/login/smoke.rs
+++ b/crates/benilla-app/src/login/smoke.rs
@@ -38,7 +38,6 @@ pub(crate) fn smoke_character(spec: &str) -> Option<String> {
 /// `WOW_UNATTENDED=1` still needs a way to name a character without taking it. The pick itself
 /// stays `char_select`'s (`apply_roster_policy` reads the third field the same way it reads
 /// `WOW_CHAR`); this only declines to exit. Pair with `WOW_PROBE_EXIT_AT` to bound the run.
-#[allow(clippy::too_many_arguments)]
 pub(super) fn debug_login_smoke(
     state: Res<State<ClientState>>,
     mut attempt: Attempt,
diff --git a/crates/benilla-app/src/minimap/blips/dots.rs b/crates/benilla-app/src/minimap/blips/dots.rs
index 0cd4cf20..b139a7ef 100644
--- a/crates/benilla-app/src/minimap/blips/dots.rs
+++ b/crates/benilla-app/src/minimap/blips/dots.rs
@@ -91,7 +91,6 @@ fn unit_dot_eligible(store: Option<&ObjectStore>, me: Option<u64>) -> bool {
 /// Walks the candidate set rather than the status map — the classifier's own shape (it is a
 /// per-object callback, not a per-status one), and the only way to reach each object's descriptor,
 /// which [`unit_dot_eligible`] needs.
-#[allow(clippy::too_many_arguments)]
 pub(in crate::minimap) fn emit_quest_dots(
     ctx: &BlipCtx,
     statuses: &HashMap<u64, u32>,
@@ -233,7 +232,6 @@ fn creature_type_of(
 /// byte-verified `0x4eac31`). Same hard 3-D radius cull, cross-interior grey, and hover law
 /// as the quest dots; drawn just before them (the draw walks the cell lists in order, so
 /// cells 0/1 sit under a same-spot quest or party dot).
-#[allow(clippy::too_many_arguments)]
 pub(in crate::minimap) fn emit_tracking_dots(
     ctx: &BlipCtx,
     tracking: SelfTracking,
diff --git a/crates/benilla-app/src/minimap/blips/mod.rs b/crates/benilla-app/src/minimap/blips/mod.rs
index 377adf11..52bfdba1 100644
--- a/crates/benilla-app/src/minimap/blips/mod.rs
+++ b/crates/benilla-app/src/minimap/blips/mod.rs
@@ -398,7 +398,6 @@ fn poi_icon_cell(icon: u32) -> Option<[f32; 4]> {
 /// Draw the landmark layer: in-range POI icons at position, then the nearest-3 rim arrows,
 /// each rotated to point at its POI. Records a hover hit (later-drawn wins, matching draw
 /// order).
-#[allow(clippy::too_many_arguments)]
 pub(super) fn emit_landmarks(
     ctx: &BlipCtx,
     cat: Option<&AreaPoiCatalog>,
diff --git a/crates/benilla-app/src/minimap/mod.rs b/crates/benilla-app/src/minimap/mod.rs
index 8666599b..c263186c 100644
--- a/crates/benilla-app/src/minimap/mod.rs
+++ b/crates/benilla-app/src/minimap/mod.rs
@@ -400,7 +400,6 @@ fn minimap_interior<'a>(
 /// Fills the extracted widget hole: the visible tile quads (clipped to the widget, masked to the
 /// circle) and the player arrow, appended at the widget's own z (stable sort keeps append order
 /// within a key, so the arrow rides above the tiles and below the widget's children).
-#[allow(clippy::too_many_arguments)]
 fn emit_minimap(
     widget: Res<MinimapWidget>,
     assets: Option<Res<MinimapAssets>>,
@@ -935,7 +934,6 @@ fn emit_minimap(
 /// — the client's own signal for "the effective zoom changed" (FrameXML `Minimap_OnEvent`). Without it
 /// the buttons keep the level you left (e.g. `ZoomIn` greyed from an outdoor max-zoom, still greyed
 /// indoors at level 3), which is the director's report (2026-07-09).
-#[allow(clippy::too_many_arguments)] // one Bevy system's full input set
 fn feed_minimap_inside(
     script: Option<bevy::ecs::system::NonSendMut<benilla_ui::script::UiScript>>,
     world: benilla_world::world_point::WorldPoint,
diff --git a/crates/benilla-app/src/minimap/ping.rs b/crates/benilla-app/src/minimap/ping.rs
index acc5afbf..50a71981 100644
--- a/crates/benilla-app/src/minimap/ping.rs
+++ b/crates/benilla-app/src/minimap/ping.rs
@@ -134,7 +134,6 @@ pub(super) fn seat_click(ctx: &BlipCtx, ping: &mut MinimapPing, click: Option<(f
 /// Runs before the script tick so the `MINIMAP_PING` event and the position behind
 /// `Minimap:GetPingPosition()` land in the same tick, and so an addon's handler sees a ping that
 /// is already seated (the renderer seated it at the end of the previous frame).
-#[allow(clippy::too_many_arguments)] // one Bevy system's full input set
 pub(super) fn drive_minimap_ping(
     script: Option<bevy::ecs::system::NonSendMut<UiScript>>,
     mut ping: ResMut<MinimapPing>,
diff --git a/crates/benilla-app/src/nameplates.rs b/crates/benilla-app/src/nameplates.rs
index da5cd612..1247042d 100644
--- a/crates/benilla-app/src/nameplates.rs
+++ b/crates/benilla-app/src/nameplates.rs
@@ -384,7 +384,7 @@ fn build_name_mesh(atlas: &mut UiFontAtlas, lines: &[String]) -> Mesh {
 /// Update (the schedule the mesh pipelines support). The per-frame *placement* is
 /// [`place_nameplates`] (PostUpdate, off this frame's propagated pose) — a fresh plate spawned
 /// here gets its first seat there, same frame (Update commands flush before PostUpdate).
-#[allow(clippy::too_many_arguments, clippy::type_complexity)] // one Bevy system's full input set
+#[allow(clippy::type_complexity)] // one Bevy system's full input set
 pub(crate) fn drive_nameplates(
     mut commands: Commands,
     units: Query<(
diff --git a/crates/benilla-app/src/net/apply.rs b/crates/benilla-app/src/net/apply.rs
index 1ec77cb3..581f77a6 100644
--- a/crates/benilla-app/src/net/apply.rs
+++ b/crates/benilla-app/src/net/apply.rs
@@ -92,7 +92,7 @@ fn addressed_store<'a>(
 // The tuple params below batch resources to stay under Bevy's 16-SystemParam ceiling; clippy reads
 // the 5-element ResMut tuples as "very complex types", but a named alias per tuple would be less
 // legible than the inline, commented groups.
-#[allow(clippy::too_many_arguments, clippy::type_complexity)]
+#[allow(clippy::type_complexity)]
 pub(crate) fn apply_net_updates(
     mut commands: Commands,
     events: Res<NetEvents>,
diff --git a/crates/benilla-app/src/net/apply/combat.rs b/crates/benilla-app/src/net/apply/combat.rs
index efcd52e5..14648ace 100644
--- a/crates/benilla-app/src/net/apply/combat.rs
+++ b/crates/benilla-app/src/net/apply/combat.rs
@@ -109,7 +109,6 @@ pub(super) fn ai_reaction(
 /// the center combat text, which the client fires **synchronously at packet parse**
 /// (`0x6255b0 → 0x629d30 → 0x703f50`, one call stack — §5-verified, wow-re
 /// `combat-text-update-emission-law.md`; decision 0580's fold-back).
-#[allow(clippy::too_many_arguments)] // one dispatch arm's full writer set
 pub(super) fn attacker_state(
     mut s: AttackerState,
     index: &GuidIndex,
diff --git a/crates/benilla-app/src/net/apply/combat_chat.rs b/crates/benilla-app/src/net/apply/combat_chat.rs
index 06b3b72e..793e8c89 100644
--- a/crates/benilla-app/src/net/apply/combat_chat.rs
+++ b/crates/benilla-app/src/net/apply/combat_chat.rs
@@ -1185,7 +1185,6 @@ fn periodic_leech_amount(power: u32, amount: u32) -> u32 {
 /// 6. **the periodic flag picks the chat-type stub** — `0x627d60` periodic, `0x627d30` direct —
 ///    and only here, *after* the fork.
 /// 7. **`drained == 0` drops the line** (`627ae3 test esi,esi` / `627ae5 je`), after the divide.
-#[allow(clippy::too_many_arguments)] // one reference function's full argument set
 fn power_drain_line(
     log: &mut ChatLog,
     ctx: &ChatCtx,
@@ -1409,8 +1408,7 @@ pub(super) fn faction_standing(
 
 /// The one tail every arm ends in: build the queued line (dropping a class-9 endpoint) and park it
 /// for its names.
-#[allow(clippy::too_many_arguments)] // the tail's args ARE the line: sink, context, and the five
-                                     // facts a queued line is made of. Bundling any of them would only move the list somewhere else.
+// facts a queued line is made of. Bundling any of them would only move the list somewhere else.
 fn queue(
     log: &mut ChatLog,
     ctx: &ChatCtx,
@@ -1436,7 +1434,6 @@ fn queue(
 
 /// [`queue`] for a family whose `Named` slot still has to be looked up — an item entry or a unit
 /// guid rides along and the drain resolves it, holding the line until it lands (§5.7).
-#[allow(clippy::too_many_arguments)] // as [`queue`], plus the one key that defers the line
 fn queue_named(
     log: &mut ChatLog,
     ctx: &ChatCtx,
@@ -1458,7 +1455,6 @@ fn queue_named(
 /// there is a **fall-through** to the generic leech/drain path, not a dropped line. Both failure
 /// shapes below are among the ones the reference reports: its own range gate, and an empty
 /// template.
-#[allow(clippy::too_many_arguments)] // as [`queue_named`], whose body this is
 fn queue_reported(
     log: &mut ChatLog,
     ctx: &ChatCtx,
diff --git a/crates/benilla-app/src/net/apply/combat_log.rs b/crates/benilla-app/src/net/apply/combat_log.rs
index dd1acdf7..55cef590 100644
--- a/crates/benilla-app/src/net/apply/combat_log.rs
+++ b/crates/benilla-app/src/net/apply/combat_log.rs
@@ -175,7 +175,6 @@ fn power_message_type(power: u32) -> Option<&'static str> {
 /// the zero-damage ABSORB/RESIST word, over the target (`0x5e85e0`). Source-classified: only my
 /// (gold) or my pet's (gold, PetSpellDamage-gated) spells draw. The handler pushes the same
 /// record/source to number and word twin alike, so the override colors both.
-#[allow(clippy::too_many_arguments)] // one dispatch arm's full writer set
 pub(super) fn spell_damage_log(
     s: SpellDamageLog,
     index: &GuidIndex,
@@ -246,7 +245,6 @@ pub(super) fn spell_damage_log(
 
 /// `SMSG_PERIODICAURALOG` → DoT ticks float like direct damage (`0x626dd0`, never crit-category);
 /// heal/energize/leech ticks float **nothing** (heals never float in 5875).
-#[allow(clippy::too_many_arguments)] // one dispatch arm's full writer set
 pub(super) fn periodic_aura_log(
     s: PeriodicAuraLog,
     index: &GuidIndex,
@@ -526,7 +524,6 @@ fn miss_action(code: u8) -> Option<&'static str> {
 /// Source-classified like every emitter (the classifier lives inside the word twin too), and
 /// **coloured by the same B/K law as a number** — `0x5e7f63 mov ecx,[ebp-0x8]; 0x5e7f66 push ecx`
 /// pushes the resolved SpellRec, not NULL, so this site's words are spell-GOLD (decision 2229).
-#[allow(clippy::too_many_arguments)] // one dispatch arm's full writer set
 pub(super) fn spell_log_miss(
     s: SpellLogMiss,
     index: &GuidIndex,
@@ -619,7 +616,6 @@ pub(super) fn xp_gain(
 ///   path as `SMSG_PLAY_SOUND`.
 ///
 /// No floating text (the XP itself still arrives via the non-kill `SMSG_LOG_XPGAIN`).
-#[allow(clippy::too_many_arguments)] // one arm of the dispatch — its param list IS its input set
 pub(super) fn exploration_xp(
     x: ExplorationXp,
     area_table: Option<&crate::area::AreaTableRes>,
diff --git a/crates/benilla-app/src/net/apply/group.rs b/crates/benilla-app/src/net/apply/group.rs
index ca39da12..74f309f0 100644
--- a/crates/benilla-app/src/net/apply/group.rs
+++ b/crates/benilla-app/src/net/apply/group.rs
@@ -88,7 +88,6 @@ pub(super) fn leader_changed(
 /// read them and both were empty for an out-of-area member before this — the raid grid's class
 /// column (`ui_party::feed::raid_roster`, whose own-row twin of this hole 1549 §7 found live), and
 /// the party frame's 2D portrait stand-in (`portrait::temporary_portrait`, report B315).
-#[allow(clippy::too_many_arguments)]
 pub(super) fn list(
     group: &mut GroupState,
     errors: &mut UiErrorKeys,
diff --git a/crates/benilla-app/src/net/apply/loot.rs b/crates/benilla-app/src/net/apply/loot.rs
index b3e0790b..2d952fe0 100644
--- a/crates/benilla-app/src/net/apply/loot.rs
+++ b/crates/benilla-app/src/net/apply/loot.rs
@@ -364,7 +364,6 @@ pub(super) fn item_template(entry: u32, info: Option<ItemInfo>, items: &mut Item
 /// [`PendingItemOps::clear_by_failure`]. This site has no `UiScript` to fire `ITEM_LOCK_CHANGED`
 /// through, so the transitioned slots queue in [`LockTransitions`] for the container feed
 /// (`ui_items::feed::feed_containers`) to drain and fire next time it runs.
-#[allow(clippy::too_many_arguments)] // one dispatch arm's full input set
 pub(super) fn inventory_failure(
     reason: u8,
     required_level: Option<u32>,
diff --git a/crates/benilla-app/src/net/apply/mail.rs b/crates/benilla-app/src/net/apply/mail.rs
index 370eb751..4b85ae1a 100644
--- a/crates/benilla-app/src/net/apply/mail.rs
+++ b/crates/benilla-app/src/net/apply/mail.rs
@@ -76,7 +76,6 @@ fn take_empties(entry: &MailListEntry, action: u32) -> bool {
 /// take/return/delete then re-syncs the inbox with a fresh `CMSG_GET_MAIL_LIST` (the reference
 /// client's inbox-refresh moment); an EQUIP_ERROR routes to the existing inventory-error surface;
 /// any other failure surfaces the red error line.
-#[allow(clippy::too_many_arguments)]
 pub(super) fn send_mail_result(
     mail_id: u32,
     action: u32,
diff --git a/crates/benilla-app/src/net/apply/names.rs b/crates/benilla-app/src/net/apply/names.rs
index 19e13c18..a3f76b56 100644
--- a/crates/benilla-app/src/net/apply/names.rs
+++ b/crates/benilla-app/src/net/apply/names.rs
@@ -40,7 +40,6 @@ pub(super) fn invalidate_player(guid: u64, names: &mut NameCache) {
 /// `SMSG_CREATURE_QUERY_RESPONSE` — the template's name plus the hover line's fields. A `None` name
 /// is the server's "no such entry", cached as such so the ask never repeats; the remaining fields
 /// then carry their miss defaults.
-#[allow(clippy::too_many_arguments)]
 pub(super) fn creature_name(
     entry: u32,
     name: Option<String>,
diff --git a/crates/benilla-app/src/net/apply/npc.rs b/crates/benilla-app/src/net/apply/npc.rs
index 355bd322..8dc12da2 100644
--- a/crates/benilla-app/src/net/apply/npc.rs
+++ b/crates/benilla-app/src/net/apply/npc.rs
@@ -42,7 +42,6 @@ fn npc_gender(guid: u64, index: &GuidIndex, stores: &Query<&mut ObjectStore>) ->
 ///
 /// The greeting is **drawn here**, not at the packet — this is the reference's own moment for it
 /// (`0x4e2010`), and the draw needs both this NPC's gender ([`npc_gender`]) and a fresh roll.
-#[allow(clippy::too_many_arguments)]
 pub(super) fn gossip_menu(
     npc: u64,
     text_id: u32,
diff --git a/crates/benilla-app/src/net/apply/objects.rs b/crates/benilla-app/src/net/apply/objects.rs
index 23b25b3d..0d85db89 100644
--- a/crates/benilla-app/src/net/apply/objects.rs
+++ b/crates/benilla-app/src/net/apply/objects.rs
@@ -63,7 +63,6 @@ pub(super) fn gameobject_despawn_anim(guid: u64, commands: &mut Commands, index:
 
 /// An object entered range / was created (`SMSG_UPDATE_OBJECT` create block): spawn or refresh the
 /// entity, warm the ask-once caches, and seed its descriptor store via the per-drain `pending` map.
-#[allow(clippy::too_many_arguments)]
 pub(super) fn object_create(
     guid: u64,
     kind: EntityKind,
@@ -317,7 +316,6 @@ pub(super) fn object_move(
 /// applies now, a future one queues on the unit and fires in `drain_pending_moves` — the dead-reckon
 /// covering the mover's own timeline in between, which is what kills the arrival-jitter snap.
 /// `WOW_REMOTE_SNAP=1` restores raw apply-at-arrival for an A/B.
-#[allow(clippy::too_many_arguments)] // the wire fields + the apply context, one per concern
 pub(super) fn unit_move(
     guid: u64,
     mv: crate::net::motion::RelayMove,
@@ -528,7 +526,6 @@ pub(super) fn objects_removed(guids: Vec<u64>, commands: &mut Commands, index: &
 /// rider's local pose for `transport::compose_riders` to carry out to the world. When it is `None`
 /// on a unit we had riding, the unit has *left* the deck — vmangos drops it from the transport on
 /// exactly this edge (`MoveSplineInit::Launch`, `spline/MoveSplineInit.cpp:156-159`).
-#[allow(clippy::too_many_arguments)]
 pub(super) fn monster_move(
     guid: u64,
     transport: Option<u64>,
@@ -754,7 +751,6 @@ pub(super) fn modes_of(
 /// the reference applies to whatever it finds — so we do too. It is inert on the avatar either way:
 /// the animation selector's `unify` gives the controller's own `MovementState` precedence, and our
 /// mover's modes are the handshake family's ([`crate::player::state::MoveModes`]).
-#[allow(clippy::too_many_arguments)] // the wire fields + the apply context, one per concern
 pub(super) fn spline_move_mode(
     guid: u64,
     mode: SplineMode,
@@ -920,7 +916,6 @@ fn live_speeds(index: &GuidIndex, speeds: &Query<&UnitSpeeds>, guid: u64) -> Opt
 /// answers the mandatory ack with its live pose (the TeleportMessage pattern). An unknown guid
 /// still acks if it's ours-by-guid; a foreign mover (we never control others) is only applied,
 /// never acked — acking a unit we don't control is the server's error path.
-#[allow(clippy::too_many_arguments)]
 pub(super) fn force_speed_change(
     guid: u64,
     kind: SpeedKind,
diff --git a/crates/benilla-app/src/net/apply/session.rs b/crates/benilla-app/src/net/apply/session.rs
index 32f3a523..b8d221f5 100644
--- a/crates/benilla-app/src/net/apply/session.rs
+++ b/crates/benilla-app/src/net/apply/session.rs
@@ -112,7 +112,6 @@ pub(super) fn cinematic_triggered(
 
 /// We are in the world (the IO thread's first in-world event): record our guid, flip the status,
 /// and seed the name cache with our own name.
-#[allow(clippy::too_many_arguments)] // the login's whole hand-off
 pub(super) fn connected(
     guid: u64,
     name: String,
@@ -170,7 +169,6 @@ pub(super) fn logged_out(
 
 /// The session ended (socket closed / handshake failure): tear down the streamed world and clear
 /// every session-scoped cache.
-#[allow(clippy::too_many_arguments)]
 pub(super) fn disconnected(
     reason: String,
     end: benilla_protocol::SessionEnd,
@@ -385,7 +383,6 @@ pub(super) fn transfer_aborted(reason: u8, pending: &mut PendingTransfer) {
 /// the seam (the `CurrentMap` flip itself flips which legs render), keeping the ride attachment
 /// and the deck collider valid the whole way; the server's post-ack re-create then refreshes its
 /// anchor in place. Boats whose paths never reach the new map despawn like everything else.
-#[allow(clippy::too_many_arguments)] // one dispatch arm's full context, like `disconnected`
 pub(super) fn worldport(
     map_id: u32,
     position: [f32; 3],
@@ -486,7 +483,9 @@ pub(super) fn reputation_delta(
 ) {
     use benilla_formats::faction_flags as flag;
     for (list_id, standing) in standings {
-        let i = list_id as usize;
+        let Some(i) = reputation_slot(list_id, "SMSG_SET_FACTION_STANDING") else {
+            continue;
+        };
         if reputations.0.len() <= i {
             reputations.0.resize(i + 1, (0, 0));
         }
@@ -508,13 +507,32 @@ pub(super) fn reputation_delta(
 /// silent failure it exists to prevent: the pane keys row membership off this bit, so a faction met
 /// mid-session would keep accruing reputation the player could never see.
 pub(super) fn reputation_visible(list_id: u32, reputations: &mut Reputations) {
-    let i = list_id as usize;
+    let Some(i) = reputation_slot(list_id, "SMSG_SET_FACTION_VISIBLE") else {
+        return;
+    };
     if reputations.0.len() <= i {
         reputations.0.resize(i + 1, (0, 0));
     }
     reputations.0[i].0 |= benilla_formats::faction_flags::VISIBLE;
 }
 
+/// A wire `repListId` as a store index, or `None` (logged) when it is not one. The list is
+/// positional in a `FACTION_LIST_LEN`-entry array (vmangos `MAX_FACTION_COUNT` 64), so a slot
+/// past it is not a faction — and resizing the store to it was the one wire value that could
+/// abort the process instead of dropping a packet (`0xFFFF_FFFF` → a 34 GB resize; decision
+/// 2265 §B1).
+fn reputation_slot(list_id: u32, opcode: &str) -> Option<usize> {
+    let i = usize::try_from(list_id).ok()?;
+    if i >= benilla_protocol::messages::FACTION_LIST_LEN {
+        warn!(
+            "net: {opcode} names reputation slot {list_id}, past the {}-entry faction list — dropped",
+            benilla_protocol::messages::FACTION_LIST_LEN
+        );
+        return None;
+    }
+    Some(i)
+}
+
 /// The dropped-packet tally (the wire-coverage instrument): count it, and announce each opcode's
 /// FIRST drop at info — visible in any log without the panel open, and one line per opcode per
 /// run, so it can never flood.
diff --git a/crates/benilla-app/src/net/apply/spells.rs b/crates/benilla-app/src/net/apply/spells.rs
index edec3857..aac14127 100644
--- a/crates/benilla-app/src/net/apply/spells.rs
+++ b/crates/benilla-app/src/net/apply/spells.rs
@@ -181,7 +181,6 @@ pub(super) fn superceded_spell(
 }
 
 /// The server's verdict on our cast (`SMSG_CAST_RESULT`).
-#[allow(clippy::too_many_arguments)]
 pub(super) fn cast_result(
     spell_id: u32,
     success: bool,
@@ -335,7 +334,6 @@ pub(super) fn cast_result(
 
 /// A unit began a non-triggered cast (`SMSG_SPELL_START`), instants included (`cast_time_ms == 0`)
 /// — the precast trigger the phase-2 casting animation loop builds on (decision 0099 phase 1).
-#[allow(clippy::too_many_arguments)]
 pub(super) fn spell_start(
     caster: u64,
     spell_id: u32,
@@ -446,7 +444,6 @@ const GO_TYPE_CHEST: i32 = 3;
 /// nothing about missile travel rides this packet; the client (and we) rebuild the flight
 /// visually from the same Speed column (decision 0099 phase 4: the target lists go out as
 /// [`SpellGoTargets`] for the router's instant-impact/missile branch).
-#[allow(clippy::too_many_arguments)] // one dispatch arm's full input set
 pub(super) fn spell_go(
     caster: u64,
     spell_id: u32,
@@ -522,7 +519,7 @@ pub(super) fn spell_go(
     }
     // A cast that names a GameObject (an open-lock cast on a chest / locked door) hands off to the GO
     // animation driver, which gates on the open-lock effect and opens the lid on the cast going off
-    // (decision 0250). Independent of the caster being streamed to us — an observed open still animates.
+    // (decision 2271). Independent of the caster being streamed to us — an observed open still animates.
     if let Some(go_guid) = go_target {
         go_lid.write(crate::go_anim::GoLidOpen { go_guid, spell_id });
     }
@@ -801,7 +798,6 @@ pub(super) fn spell_go(
 
 /// An observed cast was interrupted/cancelled (`SMSG_SPELL_FAILED_OTHER`) — ends the caster's
 /// `Casting` state seam the same as [`spell_go`].
-#[allow(clippy::too_many_arguments)] // one dispatch arm's full input set
 pub(super) fn spell_failed_other(
     caster: u64,
     spell_id: u32,
diff --git a/crates/benilla-app/src/net/io.rs b/crates/benilla-app/src/net/io.rs
index f65f2f0e..778474f7 100644
--- a/crates/benilla-app/src/net/io.rs
+++ b/crates/benilla-app/src/net/io.rs
@@ -34,6 +34,7 @@ use std::thread;
 use std::time::{Duration, Instant};
 
 use anyhow::{anyhow, bail, Result};
+use benilla_assets::LockRecover;
 use benilla_protocol::{
     host_port, messages, AuthReject, CharAction, LoginStage, Poll, SessionEnd, SessionEvent,
     WardenRequired, WorldSession, WorldWriter, WORLD_PORT,
@@ -341,6 +342,11 @@ pub(super) fn spawn_net(cfg: NetConfig, connect: bool) -> NetHandles {
                     realm_rx,
                     pick_rx,
                 };
+                // Opcodes whose decoder has already been caught leaving bytes behind — one
+                // announcement per opcode for the life of the process, like the dropped-packet
+                // tally's first-occurrence line. Lives here, above the cycle loop, so a reconnect
+                // does not re-announce what the log already says.
+                let mut tails_announced = std::collections::HashSet::new();
                 loop {
                     // **A cycle starts with no measurements.** Every way the last one ended — a
                     // stream failure, a logout, a re-park — lands here, so one clear covers them
@@ -348,8 +354,16 @@ pub(super) fn spawn_net(cfg: NetConfig, connect: bool) -> NetHandles {
                     // in from the app's drain a frame later. (`writer_loop` clears again when the
                     // fresh writer arrives, and still has to: between the old socket dying and
                     // that handover the keepalive tick can still fire on the stale writer.)
-                    read_clock.lock().expect("ping clock").clear();
-                    match run(&cfg, &events_tx, &writer_tx, &parks, &abandon, &read_clock) {
+                    read_clock.lock_recover().clear();
+                    match run(
+                        &cfg,
+                        &events_tx,
+                        &writer_tx,
+                        &parks,
+                        &abandon,
+                        &read_clock,
+                        &mut tails_announced,
+                    ) {
                         Ok(Cycle::Exit) => return,
                         Ok(Cycle::Repark) => {}
                         Ok(end @ (Cycle::LoggedOut | Cycle::LoginRefused)) => {
@@ -422,6 +436,7 @@ fn run(
     parks: &Parks,
     abandon: &AtomicU64,
     ping_clock: &Mutex<PingClock>,
+    tails_announced: &mut std::collections::HashSet<u16>,
 ) -> Result<Cycle> {
     let Parks {
         login_rx,
@@ -849,8 +864,25 @@ fn run(
             let polled = reader.poll()?;
             note_inbound(); // one packet off the wire, parsed or not — the census counts liveness
             match polled {
-                Poll::Events { opcode, events } => {
+                Poll::Events {
+                    opcode,
+                    events,
+                    tail,
+                } => {
                     skip_run = 0;
+                    // **The decode-length instrument** (decision 2265 §B1). A body is
+                    // length-framed, so a decoder shorter than the server's layout succeeds
+                    // silently and the field it never read is invisible from outside. This is
+                    // the one line that shows it — once per opcode, at info, and NEVER a skip:
+                    // the packet decoded and its events are real; a trailing field we have no
+                    // use for is drift to look at, not a packet to drop.
+                    if tail > 0 && tails_announced.insert(opcode) {
+                        bevy::log::info!(
+                            "net: opcode {} ({opcode:#06x}) left {tail} trailing byte(s) after \
+                             decode (first occurrence; announced once per opcode)",
+                            benilla_protocol::messages::opcode_name(opcode).unwrap_or("?"),
+                        );
+                    }
                     // The full inbound opcode stream (tag `in`, decision 0624) — the last place a
                     // packet could hide. `skip` covers what failed to parse and `rly` covers what
                     // reached the mover replay; between them sits the packet that parsed into *no*
@@ -876,9 +908,7 @@ fn run(
                         // a whole client frame to every reading, which is a frame's worth of the
                         // client's own slowness reported as the server's distance.
                         if let SessionEvent::Pong { sequence } = ev {
-                            if let Some(rtt) =
-                                ping_clock.lock().expect("ping clock").record_pong(sequence)
-                            {
+                            if let Some(rtt) = ping_clock.lock_recover().record_pong(sequence) {
                                 bevy::log::debug!("net: pong seq={sequence} rtt={rtt}ms");
                             }
                             continue;
@@ -1018,7 +1048,7 @@ fn writer_loop(
                     // A fresh connection restarts the keepalive from scratch, like the real
                     // client: sequence 1 is the new socket's first ping, and a stale in-flight
                     // pong from the old socket can no longer match.
-                    ping_clock.lock().expect("ping clock").clear();
+                    ping_clock.lock_recover().clear();
                     // The connect stamp: the first keepalive of a connection is a full interval
                     // out, not on the next drain (`0x537bcf` — verified; the alternative reading,
                     // that a zeroed stamp fires one immediately, is what the bytes ruled out).
@@ -1042,7 +1072,7 @@ fn writer_loop(
                     // spacing is our attempts on the socket, not the server's answers.
                     ping_tick = crossbeam_channel::after(PING_INTERVAL);
                     let (sequence, last_rtt) = {
-                        let mut c = ping_clock.lock().expect("ping clock");
+                        let mut c = ping_clock.lock_recover();
                         c.sequence += 1;
                         c.sent_at = Some(Instant::now());
                         // `lastRtt`: the most recent single sample, never the mean (VERIFIED —
diff --git a/crates/benilla-app/src/net/motion/facing.rs b/crates/benilla-app/src/net/motion/facing.rs
index 043f4f9d..44ffa0ed 100644
--- a/crates/benilla-app/src/net/motion/facing.rs
+++ b/crates/benilla-app/src/net/motion/facing.rs
@@ -227,7 +227,7 @@ fn filter_step(cur: f32, goal: f32, hist: &mut [f32; 4]) -> f32 {
 /// `pub(crate)` rather than `pub(in crate::net)` for one reason: the shuffle latch's *consumer*
 /// lives in `creature_anim`, and the only test that can catch the latch being produced but never
 /// read has to run both systems in one app (`creature_anim::driver::tests`).
-#[allow(clippy::type_complexity, clippy::too_many_arguments)] // one Bevy system's full input set
+#[allow(clippy::type_complexity)] // one Bevy system's full input set
 pub(crate) fn drive_display_facing(
     mut commands: Commands,
     index: Res<GuidIndex>,
diff --git a/crates/benilla-app/src/net/motion/remote.rs b/crates/benilla-app/src/net/motion/remote.rs
index 64f9bdaa..13f1afa9 100644
--- a/crates/benilla-app/src/net/motion/remote.rs
+++ b/crates/benilla-app/src/net/motion/remote.rs
@@ -492,7 +492,6 @@ pub(in crate::net) fn drain_pending_moves(
 /// ([`drain_pending_moves`]); a dead-reckon that advanced on a different (virtual, clamped) clock
 /// than the fire-times it converges toward would never land on them.
 #[allow(clippy::type_complexity)]
-#[allow(clippy::too_many_arguments)] // a Bevy system signature: one param per resource/query
 pub(in crate::net) fn extrapolate_remote_units(
     time: Res<Time<Real>>,
     mut commands: Commands,
diff --git a/crates/benilla-app/src/net/motion/spline.rs b/crates/benilla-app/src/net/motion/spline.rs
index 2671438b..26574270 100644
--- a/crates/benilla-app/src/net/motion/spline.rs
+++ b/crates/benilla-app/src/net/motion/spline.rs
@@ -245,7 +245,6 @@ fn catmull_rom(pts: &[[f32; 3]], i: usize, u: f32) -> ([f32; 3], [f32; 3]) {
 /// takes the Catmull-Rom family instead (the taxi/flight look — see [`Spline::sample`]'s INTERIM note).
 /// Returns `None` — "stationary, clear any path" — for a `Stop`, a zero duration, or a path with fewer
 /// than two points (nothing to travel along).
-#[allow(clippy::too_many_arguments)] // one argument per decoded wire field
 pub(in crate::net) fn monster_move_spline(
     path: Vec<[f32; 3]>,
     spline_id: u32,
diff --git a/crates/benilla-app/src/perf/gpu.rs b/crates/benilla-app/src/perf/gpu.rs
index 25c8a13f..1dc3f5a2 100644
--- a/crates/benilla-app/src/perf/gpu.rs
+++ b/crates/benilla-app/src/perf/gpu.rs
@@ -102,7 +102,7 @@ fn census(instance: Res<bevy::render::renderer::RenderInstance>, shared: Res<Wgp
 /// multi-draw indirect, so a multidrawable batch set still draws bin by bin) plus one per
 /// unbatchable entity and per non-mesh item; a sorted phase issues one per item whose batch
 /// range survived batching (a merged item's range is emptied into its predecessor's).
-#[allow(clippy::type_complexity, clippy::too_many_arguments)]
+#[allow(clippy::type_complexity)]
 fn count_draws(
     shared: Res<WgpuCensusShared>,
     opaque: Option<Res<ViewBinnedRenderPhases<Opaque3d>>>,
diff --git a/crates/benilla-app/src/perf/journal.rs b/crates/benilla-app/src/perf/journal.rs
index 206ce403..7b8aa5ce 100644
--- a/crates/benilla-app/src/perf/journal.rs
+++ b/crates/benilla-app/src/perf/journal.rs
@@ -314,7 +314,6 @@ struct JournalGpu<'w> {
 /// `NonSendMarker` pins this to the main thread, which the `main_ms` column requires:
 /// [`main_thread_cpu_secs`] reports *the calling thread*, so on a worker it would silently log
 /// whichever pool thread ran the flush.
-#[allow(clippy::too_many_arguments)]
 fn journal_fps(
     _pin_to_main_thread: bevy::ecs::system::NonSendMarker,
     mut journal: ResMut<FpsJournal>,
diff --git a/crates/benilla-app/src/perf/stall.rs b/crates/benilla-app/src/perf/stall.rs
index e27e118f..aeb6cac5 100644
--- a/crates/benilla-app/src/perf/stall.rs
+++ b/crates/benilla-app/src/perf/stall.rs
@@ -135,6 +135,10 @@ fn arm_injectors(app: &mut App) {
             app.insert_resource(TeardownWedge(ms));
         }
     }
+    // The third injector lives with the instrument it exercises — `crash::arm_injector`, a
+    // deliberate main-thread panic — and is armed from here so all three standing injectors
+    // are named in one place.
+    crate::crash::arm_injector(app);
 }
 
 fn watchdog(dir: Option<std::path::PathBuf>) {
diff --git a/crates/benilla-app/src/perf/trace.rs b/crates/benilla-app/src/perf/trace.rs
index 01f1d573..7d16a7fd 100644
--- a/crates/benilla-app/src/perf/trace.rs
+++ b/crates/benilla-app/src/perf/trace.rs
@@ -39,7 +39,6 @@ const STREAM_TRACE_HEADER: &str = "frame,t,delta_ms,cpu_ms,ents,stream_ms,furnis
                                    attached,adt_freed,meshes_freed,images_freed,adt_added,\
                                    meshes_added,images_added,pipes_new,pipes_pending\n";
 
-#[allow(clippy::too_many_arguments)]
 pub(super) fn trace_stream(
     mut trace: ResMut<StreamTrace>,
     mut activity: ResMut<benilla_world::terrain_stream::StreamActivity>,
diff --git a/crates/benilla-app/src/pipe_warm/menagerie.rs b/crates/benilla-app/src/pipe_warm/menagerie.rs
index 16558f69..3af254a1 100644
--- a/crates/benilla-app/src/pipe_warm/menagerie.rs
+++ b/crates/benilla-app/src/pipe_warm/menagerie.rs
@@ -92,7 +92,6 @@ pub(super) type BoothCamQuery<'w, 's> = Query<
 /// variant encoding can never drift from the real spawn paths; meshes from the production
 /// submesh builders (or their attribute-exact stand-ins) so the vertex layouts can't either.
 /// Returns the entity count.
-#[allow(clippy::too_many_arguments)] // one arg per store/anchor, the file's builder convention
 pub(super) fn spawn_menagerie(
     commands: &mut Commands,
     cam: Entity,
diff --git a/crates/benilla-app/src/pipe_warm/mod.rs b/crates/benilla-app/src/pipe_warm/mod.rs
index 5359762f..526bc00e 100644
--- a/crates/benilla-app/src/pipe_warm/mod.rs
+++ b/crates/benilla-app/src/pipe_warm/mod.rs
@@ -412,7 +412,6 @@ type WarmRigVis<'w, 's> = Query<
 /// 0737's rule: never hold a cover unbounded. A timeout fires the tripwire-adjacent warn and
 /// releases; the remaining compiles land live (the pre-0837 world, once, with a named cause).
 const WARM_TIMEOUT_SECS: f32 = 10.0;
-#[allow(clippy::too_many_arguments)] // a Bevy system: each param is one resource, the app's convention
 fn run_warm_pass(
     mut commands: Commands,
     mut warm: ResMut<WarmPass>,
diff --git a/crates/benilla-app/src/player.rs b/crates/benilla-app/src/player.rs
index 3171fd31..e35447f2 100644
--- a/crates/benilla-app/src/player.rs
+++ b/crates/benilla-app/src/player.rs
@@ -347,7 +347,7 @@ impl Plugin for PlayerPlugin {
                 )
                     .in_set(WorldStage::Input)
                     .before(control)
-                    .run_if(in_state(crate::char_select::ClientState::InWorld)),
+                    .in_set(crate::char_select::InWorldGated),
             );
         app.add_systems(
             Startup,
@@ -372,7 +372,7 @@ impl Plugin for PlayerPlugin {
                 .in_set(PlayerControlSet)
                 .in_set(WorldStage::Input)
                 .run_if(not(resource_exists::<crate::run_mode::CaptureMode>))
-                .run_if(in_state(crate::char_select::ClientState::InWorld)),
+                .in_set(crate::char_select::InWorldGated),
         )
         // The posture setter's queue (the `/sit` family — decision 0881; `control` is the sole
         // executor, like the sheath queue).
@@ -386,7 +386,7 @@ impl Plugin for PlayerPlugin {
             land::land_here
                 .in_set(WorldStage::Input)
                 .before(control)
-                .run_if(in_state(crate::char_select::ClientState::InWorld)),
+                .in_set(crate::char_select::InWorldGated),
         )
         // (The two scripted probe drivers that used to sit here — `WOW_PROBE_LOOK`'s
         // mouse-turn and `WOW_PROBE_CAM`'s camera park — are the harness's now, and register
@@ -401,7 +401,7 @@ impl Plugin for PlayerPlugin {
                 .in_set(WorldStage::Input)
                 .before(control)
                 .run_if(not(resource_exists::<crate::run_mode::CaptureMode>))
-                .run_if(in_state(crate::char_select::ClientState::InWorld)),
+                .in_set(crate::char_select::InWorldGated),
         )
         // A session END releases the avatar — a confirmed `/logout`, or a lost session
         // (decision 1262): the streamed entity is despawned by the net drain either way, and
@@ -457,7 +457,7 @@ impl Plugin for PlayerPlugin {
                 .in_set(WorldStage::Input)
                 .before(control)
                 .before(follow::steer_follow)
-                .run_if(in_state(crate::char_select::ClientState::InWorld)),
+                .in_set(crate::char_select::InWorldGated),
         )
         // `/follow` (decision 0890): steer the facing and decide this tick's synthesized forward
         // input immediately BEFORE the controller, which folds the flag into its forward axis.
@@ -468,7 +468,7 @@ impl Plugin for PlayerPlugin {
             follow::steer_follow
                 .in_set(WorldStage::Input)
                 .before(control)
-                .run_if(in_state(crate::char_select::ClientState::InWorld)),
+                .in_set(crate::char_select::InWorldGated),
         )
         // The self-avatar zoom-in fade rides the same `MeshTag`/material channel as the interior
         // classifier + the appear/despawn fades, so it must run *after* both to win the frame while
diff --git a/crates/benilla-app/src/player/body_pose.rs b/crates/benilla-app/src/player/body_pose.rs
index ecefe3d1..e2e4fdfc 100644
--- a/crates/benilla-app/src/player/body_pose.rs
+++ b/crates/benilla-app/src/player/body_pose.rs
@@ -15,7 +15,6 @@ use super::{model_pivot_height, wrap_pi, BodyQuery, CameraPivot, Player};
 /// Write this frame onto the driven body and return the camera-pivot **target** height it carries.
 /// `anim_flags` is [`super::gait::drive_body_heading`]'s verdict; `move_flags_now` is the live
 /// wire word, whose forward/back bits gate the swim body pitch.
-#[allow(clippy::too_many_arguments)]
 pub(super) fn drive(
     player: &Player,
     body: &mut BodyQuery,
diff --git a/crates/benilla-app/src/player/camera.rs b/crates/benilla-app/src/player/camera.rs
index e347d94b..4946891b 100644
--- a/crates/benilla-app/src/player/camera.rs
+++ b/crates/benilla-app/src/player/camera.rs
@@ -1033,7 +1033,6 @@ pub(crate) struct CameraPivot {
 /// [`PressGesture::is_click`] alone. There is no "promotion" and nothing cancels the click for
 /// having moved — the pending click used to be destroyed the moment the cursor crossed a 4 px
 /// threshold, which is why a drag could never select (ledger B226).
-#[allow(clippy::too_many_arguments)]
 pub(super) fn run_look_session(
     buttons: &ButtonInput<MouseButton>,
     mouse_motion: &AccumulatedMouseMotion,
@@ -1240,7 +1239,6 @@ pub(super) fn apply_zoom_scroll(scroll: f32, dt: f32, rig: &mut CameraControl, m
 /// `feet`/`head` are the caller's, because the head offset is the avatar capsule's and those
 /// constants are a movement concern; `body_pivot` is the target height read off the driven body
 /// this frame, used only when nothing else is being watched.
-#[allow(clippy::too_many_arguments)]
 pub(super) fn seat_on_subject(
     dt: f32,
     turn_delta: f32,
@@ -1397,7 +1395,6 @@ pub(super) fn seat_on_subject(
 /// `head`/`player_pos` are precomputed by [`super::control`] (which owns the avatar capsule
 /// constants); `cam_pivot_height` is the world pivot height it derived from [`CameraPivot`] this
 /// frame.
-#[allow(clippy::too_many_arguments)]
 pub(super) fn seat_camera(
     dt: f32,
     turn_delta: f32,
@@ -1640,7 +1637,7 @@ pub(super) fn seat_camera(
 /// compose (`wow_model.wgsl`: `out_rgb *= faded_alpha`) takes the card to black, which for an ADD blend
 /// is gone. That deliberately avoids `Visibility`, which the card's own hidden-owner mirror authors every
 /// frame in a different system.
-#[allow(clippy::type_complexity, clippy::too_many_arguments)] // one Bevy system's full input set
+#[allow(clippy::type_complexity)] // one Bevy system's full input set
 pub(crate) fn apply_self_model_fade(
     rig: Res<CameraControl>,
     self_player: Query<(Entity, Option<&crate::aura_visual::AuraNodes>), With<Embodied>>,
diff --git a/crates/benilla-app/src/player/camera_saved.rs b/crates/benilla-app/src/player/camera_saved.rs
index fe94b5da..c535160d 100644
--- a/crates/benilla-app/src/player/camera_saved.rs
+++ b/crates/benilla-app/src/player/camera_saved.rs
@@ -42,7 +42,7 @@ use std::path::PathBuf;
 
 use bevy::prelude::*;
 
-use crate::char_select::ClientState;
+use crate::char_select::{ClientState, InWorldGated};
 
 use super::camera::{CameraControl, FlyCam, CAM_DIST_MAX, CAM_DIST_MIN, CAM_PITCH_LIMIT};
 use benilla_world::view::WorldCamera;
@@ -231,9 +231,7 @@ pub(super) fn plugin(app: &mut App) {
             // frame renders rather than something the player watches glide into place. Not gated on
             // capture mode: a capture resolves no state path at all (0954's hermetic rule), so this
             // is already inert there.
-            load_camera_pose
-                .before(super::control)
-                .run_if(in_state(ClientState::InWorld)),
+            load_camera_pose.before(super::control).in_set(InWorldGated),
         )
         .add_systems(OnExit(ClientState::InWorld), save_on_session_end);
     // The quit root goes on the exit edge, never `Update` (decision 1528): the close button's
diff --git a/crates/benilla-app/src/player/controller.rs b/crates/benilla-app/src/player/controller.rs
index c2aa29d0..361dd2f8 100644
--- a/crates/benilla-app/src/player/controller.rs
+++ b/crates/benilla-app/src/player/controller.rs
@@ -20,7 +20,7 @@ use super::*;
 /// third-person control (WASD walks the avatar; right-drag turns it, left-drag orbits the camera,
 /// wheel zooms) and streams our movement to the server as the confirmed mover. The dev chord + `F`
 /// toggles free-fly (decision 1043).
-#[allow(clippy::too_many_arguments, clippy::type_complexity)]
+#[allow(clippy::type_complexity)]
 pub(super) fn control(
     time: Res<Time>,
     keys: Res<ButtonInput<KeyCode>>,
diff --git a/crates/benilla-app/src/player/embody.rs b/crates/benilla-app/src/player/embody.rs
index 6364029b..6e61ae8d 100644
--- a/crates/benilla-app/src/player/embody.rs
+++ b/crates/benilla-app/src/player/embody.rs
@@ -51,7 +51,6 @@ use crate::net::{ActiveMover, Embodied, GuidIndex, RemoteMotion, SelfGuid, SelfP
 ///
 /// Runs before the controller, which reads both to decide what — if anything — it is driving.
 // A Bevy system's parameter list, not an argument list.
-#[allow(clippy::too_many_arguments)]
 pub(super) fn maintain_embodiment(
     mut commands: Commands,
     mut player: ResMut<Player>,
diff --git a/crates/benilla-app/src/player/flags.rs b/crates/benilla-app/src/player/flags.rs
index 77a43f64..689901d0 100644
--- a/crates/benilla-app/src/player/flags.rs
+++ b/crates/benilla-app/src/player/flags.rs
@@ -33,7 +33,6 @@ pub(super) struct FrameFlags {
 /// Build this frame's two flag words. `swim` is `Some((fwd, side))` exactly while swimming — the
 /// netted swim amounts that actually drove the mover, so a rooted or key-cancelled swimmer cannot
 /// stream a phantom direction.
-#[allow(clippy::too_many_arguments)]
 pub(super) fn this_frame(
     player: &mut Player,
     axes: &input::MoveAxes,
diff --git a/crates/benilla-app/src/player/gait.rs b/crates/benilla-app/src/player/gait.rs
index c4e67f72..dd47d62f 100644
--- a/crates/benilla-app/src/player/gait.rs
+++ b/crates/benilla-app/src/player/gait.rs
@@ -37,7 +37,6 @@ use super::{Player, STATIONARY_CHASE_RATE};
 // default bound is seven. These are one frame of mover state, each read from a different one of
 // the caller's queries — bundling them into a struct would name nothing the call site does not
 // already say, and the gate is `-D warnings`, so the honest move is to say why, here.
-#[allow(clippy::too_many_arguments)]
 pub(super) fn drive_body_heading(
     player: &mut Player,
     move_flags_now: u32,
diff --git a/crates/benilla-app/src/player/land.rs b/crates/benilla-app/src/player/land.rs
index ef7b7124..8127284b 100644
--- a/crates/benilla-app/src/player/land.rs
+++ b/crates/benilla-app/src/player/land.rs
@@ -43,7 +43,6 @@ const LAND_TIMEOUT: f32 = 5.0;
 /// The land-here ask, and the re-attach that closes it. Runs before [`super::control`], so the
 /// frame that applies the teleport is the frame that takes third-person control again.
 // One system phase's input set, like the controller's own params.
-#[allow(clippy::too_many_arguments)]
 pub(crate) fn land_here(
     keys: Res<ButtonInput<KeyCode>>,
     time: Res<Time>,
diff --git a/crates/benilla-app/src/player/movement_net.rs b/crates/benilla-app/src/player/movement_net.rs
index cbb112b1..93756e30 100644
--- a/crates/benilla-app/src/player/movement_net.rs
+++ b/crates/benilla-app/src/player/movement_net.rs
@@ -147,7 +147,6 @@ pub(super) struct ArcEdges {
 /// heartbeat so next frame can diff against them.
 // Eight, down from twelve: the arc edges are one struct now (`ArcEdges`). The rest are distinct
 // types the compiler can tell apart, so the remaining count is noise rather than a miscount risk.
-#[allow(clippy::too_many_arguments)]
 pub(super) fn stream_self_movement(
     sender: &Sender<ClientCommand>,
     player: &mut Player,
diff --git a/crates/benilla-app/src/player/mover.rs b/crates/benilla-app/src/player/mover.rs
index c3ebca45..b8ba8078 100644
--- a/crates/benilla-app/src/player/mover.rs
+++ b/crates/benilla-app/src/player/mover.rs
@@ -111,7 +111,6 @@ pub(super) struct Outcome {
 /// Advance the player mover one frame: settle hold, ground classify, the slide, and the
 /// step-down snap. Writes `player.pos`/`vel_y`/`horiz_vel` (the settle *release* is the terrain
 /// streamer's — decision 0737).
-#[allow(clippy::too_many_arguments)]
 pub(super) fn step(
     player: &mut Player,
     time: &Time,
diff --git a/crates/benilla-app/src/player/posture.rs b/crates/benilla-app/src/player/posture.rs
index 0eddfe7f..d874f478 100644
--- a/crates/benilla-app/src/player/posture.rs
+++ b/crates/benilla-app/src/player/posture.rs
@@ -17,7 +17,6 @@ use super::{move_trace, state, BodyQuery, ClientCommand, NetCommands, Player, St
 /// Run this frame's stand-state decision and the sheath toggle, and return the **committed**
 /// stand state — the local commit overlaid on the server's echoed byte, which is what the body
 /// pose and the sheath guard both read (decision 0080c).
-#[allow(clippy::too_many_arguments)]
 pub(super) fn update(
     player: &mut Player,
     body: &BodyQuery,
diff --git a/crates/benilla-app/src/player/state.rs b/crates/benilla-app/src/player/state.rs
index cc7fce83..685377ce 100644
--- a/crates/benilla-app/src/player/state.rs
+++ b/crates/benilla-app/src/player/state.rs
@@ -1252,7 +1252,7 @@ impl Player {
     /// vector and the swim amounts but deliberately leaves turning live). What this exists for is
     /// the question a *log line* has to answer after a session boundary — "can the character that
     /// just entered the world be driven?" — which B306 proved nothing was asking: `scripts/smoke.sh`
-    /// has crossed `/logout` → re-enter on every run since 1291 while counting UI rebuilds, errors
+    /// has crossed `/logout` → re-enter on every run since 2277 while counting UI rebuilds, errors
     /// and shutdown writes, none of which a frozen character disturbs.
     ///
     /// It does **not** make the smoke a B306 regression: that run logs in as a GM probe, so vmangos
diff --git a/crates/benilla-app/src/player/step_probe.rs b/crates/benilla-app/src/player/step_probe.rs
index b5b37d20..37998d1c 100644
--- a/crates/benilla-app/src/player/step_probe.rs
+++ b/crates/benilla-app/src/player/step_probe.rs
@@ -86,7 +86,6 @@ pub(crate) fn latest() -> (Vec<String>, f32) {
 /// `from`/`to` are the capsule centre either side of [`super::mover::grounded_step`] — the walk
 /// resolve alone, before the hover climb and the water-walk clamp, both of which move the body for
 /// reasons that have nothing to do with a kerb.
-#[allow(clippy::too_many_arguments)]
 pub(super) fn watch(
     world: &benilla_world::collision::WorldCollision<'_, '_>,
     capsule: &Collider,
diff --git a/crates/benilla-app/src/player/swim.rs b/crates/benilla-app/src/player/swim.rs
index 45afce86..5ce30573 100644
--- a/crates/benilla-app/src/player/swim.rs
+++ b/crates/benilla-app/src/player/swim.rs
@@ -495,7 +495,6 @@ pub(super) struct SwimFrame {
 /// `basis` is the **level** facing pair `(forward, right)`; `amounts` the netted `(fwd, side)`
 /// swim translation ([`translate_amounts`]); `wobble` this frame's drunk angle, already zeroed by
 /// the caller when it must not apply (sober, stunned, or not translating).
-#[allow(clippy::too_many_arguments)]
 pub(super) fn drive_step(
     player: &mut Player,
     time: &Time,
diff --git a/crates/benilla-app/src/player/wire_in.rs b/crates/benilla-app/src/player/wire_in.rs
index a4e5f2fe..efe10d09 100644
--- a/crates/benilla-app/src/player/wire_in.rs
+++ b/crates/benilla-app/src/player/wire_in.rs
@@ -106,7 +106,7 @@ fn control_verdict(mover: u64, allow_move: bool, self_guid: Option<u64>) -> Cont
 /// snap target).
 // One system phase's full input set (the spawner precedent); the transports query type is
 // `control`'s own param shape passed through.
-#[allow(clippy::too_many_arguments, clippy::type_complexity)]
+#[allow(clippy::type_complexity)]
 pub(super) fn apply_server_moves(
     time: &Time,
     commands: &mut Commands,
diff --git a/crates/benilla-app/src/portrait/booth.rs b/crates/benilla-app/src/portrait/booth.rs
index 2c8846ba..bb752d4e 100644
--- a/crates/benilla-app/src/portrait/booth.rs
+++ b/crates/benilla-app/src/portrait/booth.rs
@@ -499,7 +499,6 @@ pub(super) enum BoothMotion {
 ///
 /// Returns the [`BoothRig`] handle — seat any remaining consumers on it (the effect hosts, the
 /// glue scene's emitters), then `finish()` it.
-#[allow(clippy::too_many_arguments)]
 pub(super) fn spawn_booth_model(
     commands: &mut Commands,
     palettes: &mut benilla_world::rig_palette::RigPalettes,
diff --git a/crates/benilla-app/src/portrait/dressup.rs b/crates/benilla-app/src/portrait/dressup.rs
index f53eb03e..331a5c77 100644
--- a/crates/benilla-app/src/portrait/dressup.rs
+++ b/crates/benilla-app/src/portrait/dressup.rs
@@ -184,7 +184,6 @@ pub(super) fn spawn_dressup_booth(
 /// differs from the paper doll is only where the parts come from (a bake resource, not a live
 /// unit's children) and the hand grip — the assembly holds the weapons, so the hands close on them
 /// (wow-re `hand-grip-mechanism.md`).
-#[allow(clippy::too_many_arguments)]
 pub(super) fn sync_dressup_booth(
     mut commands: Commands,
     preview: Res<DressUpPreview>,
diff --git a/crates/benilla-app/src/portrait/glue_booth.rs b/crates/benilla-app/src/portrait/glue_booth.rs
index d397283d..8fffab32 100644
--- a/crates/benilla-app/src/portrait/glue_booth.rs
+++ b/crates/benilla-app/src/portrait/glue_booth.rs
@@ -837,7 +837,7 @@ pub(super) fn sync_glue_ffx(
 /// seat the character on the stage spot, and hold the booth camera on the scene's authored camera 0
 /// — every frame, so the per-bake body framing from [`sync_glue_booth`] never wins while a scene
 /// shows. Leaving the screen (`look: None`) tears the scene down and restores the square target.
-#[allow(clippy::too_many_arguments, clippy::type_complexity)]
+#[allow(clippy::type_complexity)]
 pub(super) fn sync_glue_scene(
     mut commands: Commands,
     preview: Res<GluePreview>,
@@ -1318,7 +1318,6 @@ fn resize_target(images: &mut Assets<Image>, target: &Handle<Image>, w: u32, h:
 /// the select screen's hardcoded weather-sun is the in-flight §5's to settle, decision 0465 §5),
 /// the studio buffer otherwise — pose a fresh Stand-**looping** instance with the riders on its
 /// joints, and frame it full-body.
-#[allow(clippy::too_many_arguments)]
 pub(super) fn sync_glue_booth(
     mut commands: Commands,
     preview: Res<GluePreview>,
@@ -1643,7 +1642,6 @@ pub(super) fn sync_glue_booth(
 /// **Not yaw-driven.** Dragging the character spins the character: the reference's facing call
 /// (`0x4730e0`) writes the character component's model transform and nothing else, and both scene
 /// attachments are parentless unkeyed pivots, so the pet keeps the seat's own orientation.
-#[allow(clippy::too_many_arguments)]
 pub(super) fn sync_glue_pet(
     mut commands: Commands,
     pet: Res<GluePetBake>,
diff --git a/crates/benilla-app/src/portrait/mod.rs b/crates/benilla-app/src/portrait/mod.rs
index b9453887..b2419c32 100644
--- a/crates/benilla-app/src/portrait/mod.rs
+++ b/crates/benilla-app/src/portrait/mod.rs
@@ -1396,7 +1396,6 @@ pub(crate) fn spawn_warm_booth(
 /// Startup: stand up one booth per slot — its image (registered in [`PortraitImages`]), a model-root
 /// entity, and a camera rendering only that slot's layer into the image (transparent, no bloom/MSAA,
 /// rendered before the world camera via a negative order).
-#[allow(clippy::too_many_arguments)]
 fn setup_booths(
     mut commands: Commands,
     mut images: ResMut<Assets<Image>>,
@@ -1692,7 +1691,6 @@ impl SnapKey {
     /// Build the key for `unit`'s pane this frame. `dress`/`rev` are the unit's own components
     /// (absent until its equipment first resolves, which is simply another value); `show` and
     /// `aspect` are the booth's.
-    #[allow(clippy::too_many_arguments)]
     fn build(
         unit: Entity,
         parts: &[&PortraitPart],
@@ -1903,7 +1901,6 @@ impl DressedLook<'_, '_> {
 /// [`PortraitPart`] children — into the booth whenever that look changes (new unit, gear swap,
 /// appearance refresh), re-framing the camera from the display's anchors. A live unit whose model
 /// hasn't attached yet shows the ref's 2D `TemporaryPortrait` stand-in instead (RE C5).
-#[allow(clippy::too_many_arguments)]
 fn sync_portraits(
     mut commands: Commands,
     mut booths: ResMut<Booths>,
@@ -2245,7 +2242,6 @@ fn sync_portraits(
 /// pane showing, a change of dress, an explicit model event, a resize. Mirroring live put a bow
 /// drawn in combat straight onto the character sheet (`#bugs` B324); [`SnapKey`] carries the whole
 /// law and its byte provenance.
-#[allow(clippy::too_many_arguments)]
 fn sync_paperdoll(
     mut commands: Commands,
     mut booths: ResMut<Booths>,
@@ -2290,7 +2286,6 @@ fn sync_paperdoll(
 
 /// The inspect window's model pane (decision 0631 §4) — the paper doll's exact twin, pointed at
 /// whichever unit [`crate::ui_inspect`] resolved this frame instead of at the self player.
-#[allow(clippy::too_many_arguments)]
 fn sync_inspect_booth(
     mut commands: Commands,
     mut booths: ResMut<Booths>,
@@ -2334,7 +2329,6 @@ fn sync_inspect_booth(
 
 /// The pet paper doll's model pane (decision 1057) — the inspect pane's exact twin, pointed at the
 /// pet [`crate::ui_pet_doll`] resolved this frame.
-#[allow(clippy::too_many_arguments)]
 fn sync_petdoll_booth(
     mut commands: Commands,
     mut booths: ResMut<Booths>,
@@ -2463,7 +2457,6 @@ fn sync_stable_standin(
 /// subject entity. So this is [`sync_petdoll_booth`] with one `or` — which is the point of the
 /// stand-in: the summoned pet and the stabled pet reach the same bake through the same code, and so
 /// cannot drift apart in framing, lighting, animation or settle.
-#[allow(clippy::too_many_arguments)]
 fn sync_stable_booth(
     mut commands: Commands,
     mut booths: ResMut<Booths>,
@@ -2514,7 +2507,6 @@ fn sync_stable_booth(
 /// `unit` is a **subject**, not necessarily a world unit: a [`PortraitStandIn`] mirrors the same
 /// way and carries its own display id, which is how the stable pane draws a pet that has no object
 /// anywhere ([`StableBooth`]).
-#[allow(clippy::too_many_arguments)]
 fn sync_body_booth(
     palettes: &mut benilla_world::rig_palette::RigPalettes,
     slot: &str,
@@ -2837,7 +2829,6 @@ fn pipe_settle(compiling: bool, wake_drained: bool, held_for: f64) -> PipeSettle
 /// The pipeline warm pass is demand too (decision 0938): its menagerie duplicates rigs onto a
 /// booth layer so the booths' `Msaa::Off` pipeline twins compile behind the entry cover — which
 /// only works if the booth cameras render during the warm window.
-#[allow(clippy::too_many_arguments)] // a Bevy system: each param is one resource/query
 fn gate_booth_cameras(
     mut commands: Commands,
     mut booths: ResMut<Booths>,
diff --git a/crates/benilla-app/src/portrait/test_bake.rs b/crates/benilla-app/src/portrait/test_bake.rs
index a4c388ba..6bc53e25 100644
--- a/crates/benilla-app/src/portrait/test_bake.rs
+++ b/crates/benilla-app/src/portrait/test_bake.rs
@@ -14,7 +14,6 @@ use benilla_assets::m2_url;
 
 /// The debug bake driver: when `WOW_PORTRAIT_TEST` is set, bake the named model into every slot once
 /// it loads, and own the booths (the live sync yields). See [`bake_test`].
-#[allow(clippy::too_many_arguments)]
 pub(super) fn sync_test_portraits(
     mut commands: Commands,
     booths: Res<Booths>,
@@ -58,7 +57,6 @@ pub(super) fn sync_test_portraits(
 /// → the muted fallback) into every slot and frame each camera. A pipeline eyeball only — no skins, no
 /// cache. Returns `true` once the model has loaded + a light buffer exists and it's baked (the caller
 /// then stops re-baking).
-#[allow(clippy::too_many_arguments)]
 fn bake_test(
     commands: &mut Commands,
     palettes: &mut benilla_world::rig_palette::RigPalettes,
diff --git a/crates/benilla-app/src/preflight.rs b/crates/benilla-app/src/preflight.rs
index d955fead..b1d42ca4 100644
--- a/crates/benilla-app/src/preflight.rs
+++ b/crates/benilla-app/src/preflight.rs
@@ -249,7 +249,6 @@ struct Preflight {
 }
 
 /// Wait for the self descriptor after each world entry, then print the banner once.
-#[allow(clippy::too_many_arguments)]
 fn report_session(
     mut state: ResMut<Preflight>,
     mut entered: MessageReader<EnteredWorldMessage>,
diff --git a/crates/benilla-app/src/probe_shield.rs b/crates/benilla-app/src/probe_shield.rs
index d4579984..c98c5e6a 100644
--- a/crates/benilla-app/src/probe_shield.rs
+++ b/crates/benilla-app/src/probe_shield.rs
@@ -229,7 +229,6 @@ fn god_verdict(text: &str) -> Option<bool> {
 
 /// Arm the shield on every world entry, confirm it against the server's own answer, and put it
 /// back up whenever something drops it.
-#[allow(clippy::too_many_arguments)]
 fn drive_shield(
     mut shield: ResMut<ProbeShield>,
     mut entered: MessageReader<EnteredWorldMessage>,
diff --git a/crates/benilla-app/src/quest_markers/mod.rs b/crates/benilla-app/src/quest_markers/mod.rs
index 8f1a0ddc..0af139af 100644
--- a/crates/benilla-app/src/quest_markers/mod.rs
+++ b/crates/benilla-app/src/quest_markers/mod.rs
@@ -79,7 +79,7 @@
 //! few and player-adjacent, so the anim host runs ungated (no draw-gate `DoodadAnimHost`).
 //! [`pose_markers`] swaps every marker between the low and raised bob as the unit's overhead
 //! elements toggle (the floating name [`Nameplates::shows`] OR a live V-plate — our `unit+0xc7c`;
-//! the plate leg is a director-pinned deviation, rationale on [`pose_markers`], 0408/0409):
+//! the plate leg is a director-pinned deviation, rationale on [`pose_markers`], 2274/2275):
 //! cards re-arm the matching loop, hosts switch the playing clip.
 
 mod query;
@@ -200,7 +200,6 @@ fn despawn_marker(commands: &mut Commands, roots: &Query<&QuestMarkerRoot>, root
 /// client's two handlers race last-write-wins on the same attach slot; we compose
 /// deterministically instead — a quest marker, when the status yields one, outranks the green
 /// (a named deviation, invisible in practice: a flight master carrying an active quest marker).
-#[allow(clippy::too_many_arguments)] // a Bevy system's full input set
 fn sync_markers(
     mut commands: Commands,
     quest: Res<QuestGiver>,
@@ -327,7 +326,6 @@ fn seat_is_stale(marker: &QuestMarkerRoot, seat_alive: bool, want: Option<u16>)
 /// billboard cards under the identity root with their bob loop armed (the `?`). Retries silently
 /// while either half still loads; latches [`QuestMarkerRoot::no_anchor`] when the body model has
 /// no overhead point (the client's marker never parents — invisible).
-#[allow(clippy::too_many_arguments)]
 fn build_markers(
     mut commands: Commands,
     mut roots: Query<(Entity, &mut QuestMarkerRoot)>,
@@ -513,13 +511,13 @@ fn build_markers(
 /// (WoW z +0.427..+0.517 vs anim 0's −0.089..0), lifting the marker clear of the name text.
 /// Benilla raises for the floating name ([`Nameplates::shows`]) OR a live V-plate
 /// ([`VPlates`](crate::vplates::VPlates)) — the plate leg is a **director-pinned deviation**
-/// (0409): the reference arms anim 0 under a live plate (byte-verified, wow-re
+/// (2275): the reference arms anim 0 under a live plate (byte-verified, wow-re
 /// `questgiver-marker.md` Q4a — ShouldShowName's plate suppression destroys the rendered name
 /// and nulls the `desc+0x8` handle the selector `0x6c7950` tests), leaving its marker low
 /// behind the plate; the director rejected that overlap on sight. The re-arm law is settled
 /// faithful: the reference arms at attach AND re-arms on the frame the name shown-state flips
 /// (an edge inside `0x6c6e90`, never per-frame) — exactly our re-arm-on-flip.
-#[allow(clippy::type_complexity, clippy::too_many_arguments)] // a Bevy system: each param is one resource, the app's convention
+#[allow(clippy::type_complexity)] // a Bevy system: each param is one resource, the app's convention
 fn pose_markers(
     plates: Res<Nameplates>,
     vplates: Res<crate::vplates::VPlates>,
diff --git a/crates/benilla-app/src/quest_markers/query.rs b/crates/benilla-app/src/quest_markers/query.rs
index c34eaa54..20ac58f6 100644
--- a/crates/benilla-app/src/quest_markers/query.rs
+++ b/crates/benilla-app/src/quest_markers/query.rs
@@ -132,7 +132,7 @@ const GO_FLAG_INTERACT_COND: u32 = 0x4;
 /// equipping, unequipping and swapping a bag but not moving a stack inside one. Per unit, the
 /// reference's reaction refresh also keys on charm/persuade/duel-team/`PLAYER_BYTES_3`; we key on
 /// the faction template, and catch a standing change through the reputation sweep instead.
-#[allow(clippy::type_complexity, clippy::too_many_arguments)] // a Bevy system: one param per resource
+#[allow(clippy::type_complexity)] // a Bevy system: one param per resource
 pub(super) fn query_statuses(
     self_q: Query<Ref<ObjectStore>, With<SelfPlayer>>,
     objects: Query<
diff --git a/crates/benilla-app/src/raid_marks.rs b/crates/benilla-app/src/raid_marks.rs
index a35da50f..d27e3328 100644
--- a/crates/benilla-app/src/raid_marks.rs
+++ b/crates/benilla-app/src/raid_marks.rs
@@ -98,7 +98,6 @@ fn mark_mesh(icon: u32) -> Mesh {
 /// The marker's world transform for `unit` this frame — the §6 seat over the shared
 /// anchor/scale law. Generic over the joint-globals filter like [`overhead_anchor`] (the placer
 /// passes a disjoint query).
-#[allow(clippy::too_many_arguments)] // the anchor law's full input set, like its callers
 fn mark_place<F: bevy::ecs::query::QueryFilter>(
     unit: Entity,
     tf: &Transform,
@@ -131,7 +130,7 @@ fn mark_place<F: bevy::ecs::query::QueryFilter>(
 /// gate on the plate exclusion, and (re)build the billboard entities. Runs after the name
 /// driver (the seat reads this frame's line counts) — spawn-frame seat here, the per-frame
 /// re-seat is [`place_raid_marks`].
-#[allow(clippy::too_many_arguments, clippy::type_complexity)] // one Bevy system's full input set
+#[allow(clippy::type_complexity)] // one Bevy system's full input set
 fn drive_raid_marks(
     mut commands: Commands,
     group: Res<GroupState>,
diff --git a/crates/benilla-app/src/realm_select/input.rs b/crates/benilla-app/src/realm_select/input.rs
index dd05b76c..b7fafcb9 100644
--- a/crates/benilla-app/src/realm_select/input.rs
+++ b/crates/benilla-app/src/realm_select/input.rs
@@ -20,7 +20,6 @@ const DOUBLE_CLICK_SECS: f32 = 0.4;
 
 /// Clicks: a row selects (a second one enters), the column headers sort, Okay enters, Cancel and
 /// the close X leave.
-#[allow(clippy::too_many_arguments)]
 pub(super) fn clicks(
     buttons: Query<(Entity, &RealmAction)>,
     hits: Res<crate::glue::GlueClicks>,
diff --git a/crates/benilla-app/src/realm_select/screen.rs b/crates/benilla-app/src/realm_select/screen.rs
index fad76189..bc2b3e27 100644
--- a/crates/benilla-app/src/realm_select/screen.rs
+++ b/crates/benilla-app/src/realm_select/screen.rs
@@ -136,7 +136,6 @@ pub(super) struct OkButton;
 /// **Not a state transition.** The frame is shown over whatever glue screen is current and hidden
 /// again; nothing about that screen changes, which is the whole of `RealmList`'s lifecycle in the
 /// reference (see [`super`]).
-#[allow(clippy::too_many_arguments)]
 pub(super) fn drive_screen(
     mut commands: Commands,
     realms: Res<Realms>,
diff --git a/crates/benilla-app/src/realm_select/smoke.rs b/crates/benilla-app/src/realm_select/smoke.rs
index 48b75aec..60d5f5c9 100644
--- a/crates/benilla-app/src/realm_select/smoke.rs
+++ b/crates/benilla-app/src/realm_select/smoke.rs
@@ -56,7 +56,6 @@ pub(super) struct Walk {
 
 /// The walk. Every leg names itself on the way in, so a timeout says which boundary stalled
 /// instead of "the client did not exit".
-#[allow(clippy::too_many_arguments)]
 pub(super) fn debug_realm_smoke(
     mut msgs: MessageReader<crate::net::CharListMessage>,
     realms: ResMut<Realms>,
diff --git a/crates/benilla-app/src/sound/anim_events.rs b/crates/benilla-app/src/sound/anim_events.rs
index 13a38002..61c2b0e4 100644
--- a/crates/benilla-app/src/sound/anim_events.rs
+++ b/crates/benilla-app/src/sound/anim_events.rs
@@ -60,7 +60,6 @@ const TRD_HEIGHT: f32 = 1.0;
 /// The attachment the emote voice is born at — `0x623c3a push 0x11`.
 const CSD_ATTACH: u16 = 17;
 
-#[allow(clippy::too_many_arguments)] // the standard sound-route param set + the two resolvers
 pub(super) fn route_anim_events(
     mut events: MessageReader<AnimSoundEvent>,
     // GlobalTransform: `$SND` tags can fire from parented visuals (a mount child's model),
diff --git a/crates/benilla-app/src/sound/combat.rs b/crates/benilla-app/src/sound/combat.rs
index 582252dc..ca505c25 100644
--- a/crates/benilla-app/src/sound/combat.rs
+++ b/crates/benilla-app/src/sound/combat.rs
@@ -457,7 +457,6 @@ struct MeleeTables<'w> {
     voices: Option<Res<'w, CreatureVoices>>,
 }
 
-#[allow(clippy::too_many_arguments)]
 fn combat_sounds(
     mut swings: MessageReader<SwingMessage>,
     mut contacts: MessageReader<SwingImpact>,
diff --git a/crates/benilla-app/src/sound/creature.rs b/crates/benilla-app/src/sound/creature.rs
index 69aa16f0..de2681af 100644
--- a/crates/benilla-app/src/sound/creature.rs
+++ b/crates/benilla-app/src/sound/creature.rs
@@ -108,7 +108,6 @@ const fn bark_kit(voice: &benilla_formats::CreatureVoice, state: u8) -> u32 {
 ///    client's behaviour, not an oversight of ours. (It is not reachable through the pet barks on
 ///    a vmangos server: `SendPetTalk` is gated on `SUMMON_PET`, and only those four voices carry
 ///    the columns — see [`pet_talk_vocals`].)
-#[allow(clippy::too_many_arguments)]
 fn play_bark(
     kits: &mut SoundKits,
     assets: &WorldAssets,
@@ -153,7 +152,6 @@ fn play_bark(
 /// Play the death vocal on a **live** death: a unit whose store transitions alive→dead. First
 /// sight already-dead records silently (a streamed corpse doesn't cry — the same distinction the
 /// animation driver makes for the settled-corpse pose).
-#[allow(clippy::too_many_arguments)]
 fn death_vocals(
     changed: Query<(Entity, &NetEntity, &ObjectStore, &Transform), Changed<ObjectStore>>,
     mut known_dead: Local<EntityHashMap<bool>>,
@@ -240,7 +238,6 @@ fn death_vocals(
 /// for as long as it sounds, and [`kit::object_sound_playing`] is `0x4591f0`. ALERT (class 8) and
 /// HOSTILE (the priority route) consult it below; the combat vocals (classes 0–3) consult it in
 /// `super::combat`. Players are exempt — the CGPlayer twin `0x62f880` omits the gate entirely.
-#[allow(clippy::too_many_arguments)]
 fn ai_reaction_vocals(
     mut reactions: MessageReader<crate::net::AiReactionMessage>,
     units: Query<(&NetEntity, &Transform, Option<&MountChild>)>,
@@ -334,7 +331,6 @@ fn ai_reaction_vocals(
 /// the packet for `GetPetType() == SUMMON_PET`, i.e. those same demons, at a **10% roll** per
 /// order (`Unit.cpp:8939`, `PetHandler.cpp:522`, `PetAI.cpp:335`; the other 90% is
 /// `SendPetAIReaction`, the growl). A hunter's pet never reaches either half.
-#[allow(clippy::too_many_arguments)]
 fn pet_talk_vocals(
     mut talks: MessageReader<crate::net::PetTalkMessage>,
     units: Query<(&NetEntity, &Transform)>,
@@ -404,7 +400,6 @@ fn pet_talk_vocals(
 /// **vmangos never sends this packet**, so nothing here fires against our server today. It is
 /// built because the reference is the spec, and because it is what makes loading column 29 a
 /// mechanism rather than a guess.
-#[allow(clippy::too_many_arguments)]
 fn pet_dismiss_sounds(
     mut dismissals: MessageReader<crate::net::PetDismissSoundMessage>,
     voices: Option<Res<CreatureVoices>>,
@@ -457,7 +452,6 @@ fn pet_dismiss_sounds(
 /// is **forced** regardless of the kit's own 0x200 flag — every col-23 kit in 5875 is authored
 /// `*Loop*` yet half omit the flag, so respecting it would silence half the class (`0x461d80`'s
 /// flag handling is unpinned; the record covers the reading).
-#[allow(clippy::too_many_arguments)]
 fn creature_body_loops(
     units: Query<(
         Entity,
@@ -568,7 +562,6 @@ fn creature_body_loops(
 ///   `BasiliskStand2`, so it is audible — and it is the only model in 5875 that authors `$FDX`
 ///   *and* reaches a nonzero stand column (censused across all 20 models that reach one of the 19
 ///   rows carrying a stand kit).
-#[allow(clippy::too_many_arguments)]
 fn creature_anim_vocals(
     mut events: MessageReader<AnimSoundEvent>,
     // GlobalTransform: the mount child's local Transform is the seat-relative ~origin — world
@@ -654,7 +647,6 @@ fn creature_anim_vocals(
 /// sound at all — the grunt is predicted at the landing frame off the client's own fall height.
 /// The dust leg of the same predictor lives in `creature_anim::env_damage`; both gate on the
 /// shared [`crate::creature_anim::HARD_LANDING_DESCENT`].
-#[allow(clippy::too_many_arguments)]
 fn fall_landing_vocals(
     mut landings: MessageReader<crate::creature_anim::HardLanding>,
     units: Query<(&NetEntity, &Transform)>,
diff --git a/crates/benilla-app/src/sound/death_thud.rs b/crates/benilla-app/src/sound/death_thud.rs
index 9ffa6c87..44c2db7a 100644
--- a/crates/benilla-app/src/sound/death_thud.rs
+++ b/crates/benilla-app/src/sound/death_thud.rs
@@ -128,7 +128,6 @@ fn load_death_thuds(mut commands: Commands, assets: Option<Res<WorldAssets>>) {
     }
 }
 
-#[allow(clippy::too_many_arguments)] // the standard sound-route param set + the two catalogs
 fn death_thud_sounds(
     mut events: MessageReader<AnimSoundEvent>,
     // GlobalTransform for the same reason every other anim-event consumer takes one: the tag can
diff --git a/crates/benilla-app/src/sound/emitter_pool.rs b/crates/benilla-app/src/sound/emitter_pool.rs
index 0446b7ab..d30a128f 100644
--- a/crates/benilla-app/src/sound/emitter_pool.rs
+++ b/crates/benilla-app/src/sound/emitter_pool.rs
@@ -369,7 +369,6 @@ const fn cap_step(entitled: bool, sounding_so_far: usize) -> CapStep {
 
 /// The pump (`0x461990`): fade the orphans, mark unresolvable kits, then service the admitted
 /// entries — start a channel where there is none, and otherwise only *move* the one there is.
-#[allow(clippy::too_many_arguments)] // the standard sound-driver param set
 fn pump_emitters(
     mut pool: ResMut<AmbientEmitterPool>,
     mut emitters: Query<&mut Transform, With<PoolEmitter>>,
diff --git a/crates/benilla-app/src/sound/emote.rs b/crates/benilla-app/src/sound/emote.rs
index f84cfa63..4db6aa84 100644
--- a/crates/benilla-app/src/sound/emote.rs
+++ b/crates/benilla-app/src/sound/emote.rs
@@ -95,7 +95,6 @@ fn load_emote_sounds(mut commands: Commands, assets: Option<Res<WorldAssets>>) {
 /// Route the bridged emotes: a text emote plays the performer's race/sex voice; an anim emote
 /// plays its event kit. A performer without race/sex in its store yet (partial snapshot) stays
 /// silent rather than guessing a voice.
-#[allow(clippy::too_many_arguments)]
 fn emote_sounds(
     mut msgs: MessageReader<EmoteMessage>,
     units: Query<(&ObjectStore, &Transform)>,
diff --git a/crates/benilla-app/src/sound/footsteps.rs b/crates/benilla-app/src/sound/footsteps.rs
index 8aee65c8..a759013a 100644
--- a/crates/benilla-app/src/sound/footsteps.rs
+++ b/crates/benilla-app/src/sound/footsteps.rs
@@ -102,7 +102,6 @@ fn load_footsteps(mut commands: Commands, assets: Option<Res<WorldAssets>>) {
     }
 }
 
-#[allow(clippy::too_many_arguments)]
 fn footstep_sounds(
     mut events: MessageReader<AnimSoundEvent>,
     // GlobalTransform: a mounted unit's steps are the MOUNT model's own tags, fired by the
diff --git a/crates/benilla-app/src/sound/gameobject.rs b/crates/benilla-app/src/sound/gameobject.rs
index c5053b16..022be03b 100644
--- a/crates/benilla-app/src/sound/gameobject.rs
+++ b/crates/benilla-app/src/sound/gameobject.rs
@@ -93,7 +93,6 @@ fn go_event_slot(ident: &[u8; 4]) -> Option<usize> {
 /// `SMSG_PLAY_OBJECT_SOUND(3355)` ~200 ms earlier — and every lit prop in the world, whose
 /// `CampFireSmallLoop`/`TorchLoop`/`ElvenFountainSmallA` take the pool lane and hum until the
 /// object's state changes under them.
-#[allow(clippy::too_many_arguments)]
 pub(super) fn go_display_sounds(
     mut dispatched: MessageReader<GoStateDispatch>,
     mut events: MessageReader<crate::creature_anim::AnimSoundEvent>,
diff --git a/crates/benilla-app/src/sound/greeting.rs b/crates/benilla-app/src/sound/greeting.rs
index 2f9f4621..c075c399 100644
--- a/crates/benilla-app/src/sound/greeting.rs
+++ b/crates/benilla-app/src/sound/greeting.rs
@@ -182,7 +182,6 @@ fn resolve(
 
 /// Play one line for `npc` at kit `kit_id` (0 = no such line → nothing), variation `variant`
 /// (`None` = free-pick), latch-gated on the unit's channel (`0x60c28c`) and tagged with the unit.
-#[allow(clippy::too_many_arguments)]
 fn play_line(
     npc: Entity,
     kit_id: u32,
@@ -221,7 +220,6 @@ fn play_line(
 }
 
 /// System 1 — the select greeting: drain [`NpcGreetingRequest`]s and play the cycling welcome.
-#[allow(clippy::too_many_arguments)]
 fn play_select_greetings(
     mut reqs: MessageReader<NpcGreetingRequest>,
     mut seq: Local<GreetSeq>,
@@ -279,7 +277,6 @@ fn play_select_greetings(
 
 /// System 2 — the interaction-window hello/goodbye: diff the active interaction NPC (the union of
 /// the open window sessions) and play hello on open/swap, goodbye on close-to-nothing.
-#[allow(clippy::too_many_arguments)]
 fn play_window_greetings(
     merchant: Res<MerchantOpen>,
     gossip: Res<GossipState>,
diff --git a/crates/benilla-app/src/sound/kit.rs b/crates/benilla-app/src/sound/kit.rs
index 14c0c085..618861c8 100644
--- a/crates/benilla-app/src/sound/kit.rs
+++ b/crates/benilla-app/src/sound/kit.rs
@@ -576,7 +576,6 @@ pub(crate) enum KitRef<'a> {
 /// Silently succeeds without playing when the kit is out of range or duplicate-suppressed
 /// (matching the client: gates are not errors) — `Ok(false)` is that outcome, see
 /// [`play_kit_ext`]'s return.
-#[allow(clippy::too_many_arguments)]
 pub(crate) fn play_kit(
     kits: &mut SoundKits,
     assets: &WorldAssets,
@@ -617,7 +616,6 @@ pub(crate) fn play_kit(
 /// per-bus cap, the duplicate walk), and callers that care read that zero. Almost none do, and
 /// `Ok(false)` reads exactly like `Ok(())` did for them; [`super::vocal`]'s escalation counter is
 /// the one place the distinction is the mechanism.
-#[allow(clippy::too_many_arguments)]
 pub(super) fn play_kit_ext(
     kits: &mut SoundKits,
     assets: &WorldAssets,
diff --git a/crates/benilla-app/src/sound/liquid_loop.rs b/crates/benilla-app/src/sound/liquid_loop.rs
index 0e85c573..47de19c5 100644
--- a/crates/benilla-app/src/sound/liquid_loop.rs
+++ b/crates/benilla-app/src/sound/liquid_loop.rs
@@ -89,7 +89,6 @@ fn load_water_sounds(mut commands: Commands, assets: Option<Res<WorldAssets>>) {
 }
 
 /// The per-frame driver (`0x462b50`): scan, arm/retire by priority, slew, fade.
-#[allow(clippy::too_many_arguments)]
 fn drive_liquid_loops(
     mut state: ResMut<LiquidLoopState>,
     water_sounds: Option<Res<WaterSounds>>,
@@ -284,7 +283,6 @@ fn near_clamped(pos: Vec3, player: Vec3) -> Vec3 {
 /// rides the emitter's `Transform`), force-looped (the type-22 kits are all authored loops but
 /// the lava pool omits the 0x200 flag — the same column-authority INTERIM as the creature
 /// body-loop), at an initial pump-lane gain.
-#[allow(clippy::too_many_arguments)]
 fn start_loop(
     kits: &mut SoundKits,
     assets: &WorldAssets,
diff --git a/crates/benilla-app/src/sound/message.rs b/crates/benilla-app/src/sound/message.rs
index 4cac62a0..148b2c23 100644
--- a/crates/benilla-app/src/sound/message.rs
+++ b/crates/benilla-app/src/sound/message.rs
@@ -87,7 +87,6 @@ impl MessageSounds {
 }
 
 /// Drain [`MessageSounds`]: cue by name, or speech by line (module doc).
-#[allow(clippy::too_many_arguments)]
 fn play_message_sounds(
     mut queue: ResMut<MessageSounds>,
     mut speech: ResMut<VocalSpeech>,
diff --git a/crates/benilla-app/src/sound/reverb.rs b/crates/benilla-app/src/sound/reverb.rs
index 6efe753d..af89c71d 100644
--- a/crates/benilla-app/src/sound/reverb.rs
+++ b/crates/benilla-app/src/sound/reverb.rs
@@ -60,7 +60,6 @@ struct AppliedPreset(Option<u32>);
 /// React to area/interior/underwater changes: resolve the preset id and hand the row to the
 /// mixer. The WMO interior's preset overrides the terrain area's (decision 0076 — this is where
 /// ~4 000 CAVE/AUDITORIUM rows live); zero falls through to the area chain.
-#[allow(clippy::too_many_arguments)]
 fn zone_reverb(
     mut applied: ResMut<AppliedPreset>,
     mut out: NonSendMut<SoundOutput>,
diff --git a/crates/benilla-app/src/sound/sheathe.rs b/crates/benilla-app/src/sound/sheathe.rs
index a2de56b1..b8aa06c6 100644
--- a/crates/benilla-app/src/sound/sheathe.rs
+++ b/crates/benilla-app/src/sound/sheathe.rs
@@ -49,7 +49,6 @@ fn load_sheathe_sounds(mut commands: Commands, assets: Option<Res<WorldAssets>>)
     }
 }
 
-#[allow(clippy::too_many_arguments)]
 fn sheathe_sounds(
     mut swaps: MessageReader<SheathSwapMessage>,
     units: Query<(&Transform, &Wielded), With<NetEntity>>,
diff --git a/crates/benilla-app/src/sound/spell.rs b/crates/benilla-app/src/sound/spell.rs
index bde10bd6..d22a1e14 100644
--- a/crates/benilla-app/src/sound/spell.rs
+++ b/crates/benilla-app/src/sound/spell.rs
@@ -21,7 +21,6 @@ use super::kit::{
 };
 use super::{AudioListener, SoundConfig, SoundOutput};
 
-#[allow(clippy::too_many_arguments)] // the standard sound-route param set + the hold ledger
 fn route_spell_kit_sounds(
     mut events: MessageReader<SpellKitSound>,
     transforms: Query<&Transform, Without<Camera3d>>,
diff --git a/crates/benilla-app/src/sound/ui.rs b/crates/benilla-app/src/sound/ui.rs
index 9fce2b15..e2f8fe9c 100644
--- a/crates/benilla-app/src/sound/ui.rs
+++ b/crates/benilla-app/src/sound/ui.rs
@@ -153,7 +153,6 @@ enum CursorGesture {
 /// missing link (template in flight, unknown display, group 0, kit 0, absent catalog) is the
 /// client's own silent return, never an error. The previous payload is tracked here (a `Local`),
 /// not in the VM — the engine-free model owns the state, the app owns the sound.
-#[allow(clippy::too_many_arguments)]
 fn play_item_gesture_sounds(
     script: Option<NonSend<UiScript>>,
     mut prev: Local<crate::ui_script::VmMemo<Option<CursorPayload>>>,
@@ -267,7 +266,6 @@ fn play_item_gesture_sounds(
 /// through the byte-verified chain `ItemGroupSounds[ItemDisplayInfo[displayId].group_sounds]
 /// .kit[gesture]` and play it 2D on the SFX bucket. Every missing link (unknown display, group 0,
 /// kit 0) is the client's own silent return, never an error.
-#[allow(clippy::too_many_arguments)]
 fn play_item_gesture(
     display_id: u32,
     gesture: ItemGesture,
diff --git a/crates/benilla-app/src/sound/vocal.rs b/crates/benilla-app/src/sound/vocal.rs
index a8426f0c..517ba486 100644
--- a/crates/benilla-app/src/sound/vocal.rs
+++ b/crates/benilla-app/src/sound/vocal.rs
@@ -250,7 +250,6 @@ fn build_vocal_table(
 /// Say one error-speech line in the local player's own voice — the app-side entry point
 /// [`super::message`] calls, and the only caller there should ever be (the reference has exactly
 /// one too).
-#[allow(clippy::too_many_arguments)]
 pub(super) fn speak_line(
     line: u8,
     speech: &mut VocalSpeech,
diff --git a/crates/benilla-app/src/sound/water.rs b/crates/benilla-app/src/sound/water.rs
index d83fe0e2..b5702b2a 100644
--- a/crates/benilla-app/src/sound/water.rs
+++ b/crates/benilla-app/src/sound/water.rs
@@ -51,7 +51,6 @@ type SplashQuery = (Entity, &'static Transform, Option<&'static CollisionHeight>
 type SplashGate = Or<(Changed<Transform>, Changed<CollisionHeight>)>;
 
 /// Play the water splash on a unit's `0.4·h` depth-line crossing, either direction (module docs).
-#[allow(clippy::too_many_arguments)] // the sound-play plumbing, one param per concern
 fn water_splashes(
     units: Query<SplashQuery, (With<NetEntity>, SplashGate)>,
     world: benilla_world::world_point::WorldPoint,
diff --git a/crates/benilla-app/src/sound/zone.rs b/crates/benilla-app/src/sound/zone.rs
index a513a0a2..79d5e1e8 100644
--- a/crates/benilla-app/src/sound/zone.rs
+++ b/crates/benilla-app/src/sound/zone.rs
@@ -265,7 +265,6 @@ fn load_area_sounds(mut commands: Commands, assets: Option<Res<WorldAssets>>) {
 
 /// The per-frame scheduler: react to area/phase changes, arm the transition fade-stop, run the
 /// silence timer, start the next track, and keep the stream volumes on the sliders.
-#[allow(clippy::too_many_arguments)]
 fn zone_audio(
     mut zone: NonSendMut<ZoneAudio>,
     mut out: NonSendMut<SoundOutput>,
@@ -644,7 +643,6 @@ fn start_music_stream(
 /// out on the backend (drop the handle — the ramp finishes on kira's thread) while the new bed
 /// starts silent and fades in under the per-frame envelope. This mirrors the client's `0x460b00`
 /// (a 5.0 s crossfade — out `0x7a5a10(5.0f)`, in `0x7a5dc0(0)` → `0x7a57b0(5.0f)`).
-#[allow(clippy::too_many_arguments)]
 fn swap_ambience(
     zone: &mut ZoneAudio,
     out: &mut SoundOutput,
@@ -707,7 +705,6 @@ fn swap_ambience(
 /// `net::apply_net_updates`): 2D kits and object-positioned 3D kits go through the kit player;
 /// music takes the zone music slot (interrupting the current track — the zone scheduler resumes
 /// its own rotation after the pushed track ends, via the normal silence interval).
-#[allow(clippy::too_many_arguments)]
 fn server_sounds(
     mut msgs: MessageReader<ServerSoundMessage>,
     mut zone: NonSendMut<ZoneAudio>,
diff --git a/crates/benilla-app/src/target/by_name.rs b/crates/benilla-app/src/target/by_name.rs
index 0cf8fbc7..d0d18a2c 100644
--- a/crates/benilla-app/src/target/by_name.rs
+++ b/crates/benilla-app/src/target/by_name.rs
@@ -514,7 +514,6 @@ pub(super) fn assist_requests(
 /// The followee's **name** is latched here rather than re-read later: it is what
 /// `AUTOFOLLOW_BEGIN` carries into the status text ([`crate::ui_follow`]), and the resolver has
 /// already produced it for the by-name half.
-#[allow(clippy::too_many_arguments)] // a Bevy system's param list IS its dependency set
 pub(super) fn follow_requests(
     mut requests: MessageReader<crate::player::FollowRequest>,
     scan_params: ByNameScan,
diff --git a/crates/benilla-app/src/target/click.rs b/crates/benilla-app/src/target/click.rs
index f271f1f1..50ebfc5d 100644
--- a/crates/benilla-app/src/target/click.rs
+++ b/crates/benilla-app/src/target/click.rs
@@ -70,7 +70,6 @@ pub(super) fn world_right_click_payload(
 /// fires on the up edge and the replay below turns it into the interact leg — which is the
 /// reference's own shape, `0x7cb910` → `0x4949f0(mask 4)` → `0x492820`, the same terminal the world
 /// right-click's object leg `0x492ce0` reaches.
-#[allow(clippy::too_many_arguments)]
 pub(super) fn select_on_plate_click(
     mut plate: ResMut<crate::vplates::PlateClicks>,
     press: Res<PressPick>,
@@ -132,7 +131,6 @@ pub(super) fn select_on_plate_click(
 /// for the whole look session, as the reference suppresses its own hover during freelook. Reading
 /// the live hover here would take the `_ =>` arm below and *clear* the player's target on every
 /// drag. The reference picks once, on the down edge, and this consumes that same latch.
-#[allow(clippy::too_many_arguments)] // one Bevy system's full input set
 pub(super) fn select_on_click(
     mut clicks: MessageReader<WorldClick>,
     inspect: Res<InspectMode>,
@@ -293,7 +291,7 @@ fn interaction_already_open_on(target: u64, interact: &crate::ui_session::Intera
 /// (`unable` only grays): the server holds the swing until we're in reach, as the real client does.
 /// A right-click on empty ground was just a turn — it never deselects.
 // The `ui_feedback` tuple is the 16-SystemParam ceiling's overflow bundle, commented at its site.
-#[allow(clippy::too_many_arguments, clippy::type_complexity)]
+#[allow(clippy::type_complexity)]
 pub(super) fn act_on_right_click(
     mut clicks: MessageReader<WorldRightClick>,
     // **The press pick, not the live hover** (decision 2230) — the same latch the left button has
diff --git a/crates/benilla-app/src/target/cursor_mode.rs b/crates/benilla-app/src/target/cursor_mode.rs
index dfb59423..3beb6946 100644
--- a/crates/benilla-app/src/target/cursor_mode.rs
+++ b/crates/benilla-app/src/target/cursor_mode.rs
@@ -780,7 +780,7 @@ fn corpse_cursor(f: CorpseFacts) -> Option<(CursorKind, bool)> {
 /// Resolve this frame's [`WorldCursor`] from the hovered unit — the reference's classifier order:
 /// interactable-NPC service ladder, else loot/skin/attack by state, each grayed by its own range
 /// gate. No hover (or anything unresolvable) → Point.
-#[allow(clippy::type_complexity, clippy::too_many_arguments)]
+#[allow(clippy::type_complexity)]
 pub(super) fn classify_cursor(
     hovered: Res<Hovered>,
     hovered_object: Res<HoveredObject>,
diff --git a/crates/benilla-app/src/target/flash.rs b/crates/benilla-app/src/target/flash.rs
index 56d0c8e4..2854444e 100644
--- a/crates/benilla-app/src/target/flash.rs
+++ b/crates/benilla-app/src/target/flash.rs
@@ -73,7 +73,7 @@ fn wave_g(now: u32, last_reset: &mut u32, rising: &mut bool) -> u8 {
 /// Recompute the flash verdict — the client's per-frame OnUpdate gate, evaluated over the one
 /// unit that can qualify (your current target). Runs before the ring update and the nameplate
 /// drive so both consume this frame's verdict.
-#[allow(clippy::type_complexity, clippy::too_many_arguments)] // one Bevy system's full input set
+#[allow(clippy::type_complexity)] // one Bevy system's full input set
 pub(super) fn drive_flash(
     mut flash: ResMut<CombatFlash>,
     time: Res<Time>,
diff --git a/crates/benilla-app/src/target/hover.rs b/crates/benilla-app/src/target/hover.rs
index 839d988a..c49c16cf 100644
--- a/crates/benilla-app/src/target/hover.rs
+++ b/crates/benilla-app/src/target/hover.rs
@@ -125,7 +125,7 @@ pub(super) struct PickPose<'w, 's> {
 /// body — held weapons, the helm, the shoulders, a mount — is its own pass-1/pass-2 candidate
 /// resolving to the same unit, because the reference registers the whole CM2 attachment tree into
 /// the pick scene under one candidate node (`0x480d90` walking `[model+0x1dc]`/`[+0x1e4]`).
-#[allow(clippy::type_complexity, clippy::too_many_arguments)]
+#[allow(clippy::type_complexity)]
 pub(super) fn update_hover(
     camera: Query<(&Camera, &GlobalTransform), With<WorldCamera>>,
     window: Query<&Window, With<PrimaryWindow>>,
@@ -614,7 +614,6 @@ fn net_entity_of(
     cur
 }
 
-#[allow(clippy::too_many_arguments)]
 pub(super) fn update_hovered_object(
     camera: Query<(&Camera, &GlobalTransform), With<WorldCamera>>,
     window: Query<&Window, With<PrimaryWindow>>,
diff --git a/crates/benilla-app/src/target/lock.rs b/crates/benilla-app/src/target/lock.rs
index 40be999b..9388f4cd 100644
--- a/crates/benilla-app/src/target/lock.rs
+++ b/crates/benilla-app/src/target/lock.rs
@@ -148,7 +148,6 @@ pub(crate) const GO_FLAG_LOCKED: u32 = 0x2;
 /// — so iterating a `HashSet` put Blizzard's placeholder name on the cast bar at the hash's whim
 /// (B247). `known` is a [`BTreeSet`] for exactly that reason: ascending spell id is the reference
 /// array's own order after login, the server building `SMSG_INITIAL_SPELLS` out of a `std::map`.
-#[allow(clippy::too_many_arguments)] // the reference fn's own inputs, plus the two out-params
 pub(crate) fn resolve_lock(
     slots: &[LockSlot],
     known: &BTreeSet<u32>,
diff --git a/crates/benilla-app/src/target/ring.rs b/crates/benilla-app/src/target/ring.rs
index 8752ee32..595a0458 100644
--- a/crates/benilla-app/src/target/ring.rs
+++ b/crates/benilla-app/src/target/ring.rs
@@ -258,7 +258,7 @@ pub(super) fn load_factions(mut commands: Commands, world_assets: Option<Res<Wor
 /// merges `Values` deltas), the handle swapped only on change. No pulse — the reference's unit ring
 /// is steady. If the target's entity is gone (destroyed / streamed out) the selection clears and the
 /// server is told — the reference's teardown clear sends `CMSG_SET_SELECTION 0` on both paths.
-#[allow(clippy::type_complexity, clippy::too_many_arguments)]
+#[allow(clippy::type_complexity)]
 pub(super) fn update_ring(
     mut selection: ResMut<Selection>,
     factions: Option<Res<Factions>>,
diff --git a/crates/benilla-app/src/target/scan.rs b/crates/benilla-app/src/target/scan.rs
index 1764d872..9260fbf3 100644
--- a/crates/benilla-app/src/target/scan.rs
+++ b/crates/benilla-app/src/target/scan.rs
@@ -635,7 +635,6 @@ pub(super) struct CommitOutcome {
 /// don't. Shared with the UI's `TargetUnit` drain (`super::target_unit_requests`) so every
 /// non-mouse selection writer commits identically — a `TargetUnit("player")` mid-combat stops
 /// the swing and does NOT re-point (the tail's self exception).
-#[allow(clippy::too_many_arguments)] // `0x493540`'s own inputs, one press's worth
 pub(super) fn commit(
     selection: &mut Selection,
     seam: &mut crate::creature_anim::AttackSeam,
@@ -695,7 +694,6 @@ pub(super) fn commit(
 ///
 /// Re-score the live world, pool by tier, skip the recent history forward (or walk it backward),
 /// commit through the byte-law [`commit`].
-#[allow(clippy::too_many_arguments)] // the shared core's full input set, one press's worth
 fn cycle(
     side: ScanSide,
     reverse: bool,
@@ -1023,7 +1021,6 @@ pub(crate) struct AttackNearestRequest;
 /// error `0xa0` "There is nothing to attack" (we log; the red error banner is its own arc). The
 /// TAB history is not touched — an auto-pick is not a press (Classic's
 /// `TargetPriorityAutoTargetIgnoreWindow` nuance, disclosed unmodeled).
-#[allow(clippy::too_many_arguments)] // one Bevy system's full input set
 pub(super) fn acquire_and_attack(
     mut requests: MessageReader<AttackNearestRequest>,
     scan: TargetScan,
diff --git a/crates/benilla-app/src/text_filter.rs b/crates/benilla-app/src/text_filter.rs
index 8d69e023..855cdbae 100644
--- a/crates/benilla-app/src/text_filter.rs
+++ b/crates/benilla-app/src/text_filter.rs
@@ -464,9 +464,7 @@ mod tests {
     /// empty string**, which is the assumption `mask_uncached`'s zero-length break rests on.
     #[test]
     fn every_shipped_pattern_compiles_and_none_matches_empty() {
-        let Some(data) = benilla_formats::wow_data() else {
-            return;
-        };
+        let data = benilla_formats::wow_data_or_skip!();
         let mut chain = benilla_formats::open_chain(&data).expect("open chain");
         let profanity = benilla_formats::load_chat_profanity(&mut chain).expect("profanity");
         let spam = benilla_formats::load_spam_messages(&mut chain).expect("spam");
@@ -489,9 +487,7 @@ mod tests {
     /// The shipped data end to end: the oracle's own sentences through the real lists.
     #[test]
     fn the_shipped_lists_reproduce_the_oracle_sentences() {
-        let Some(data) = benilla_formats::wow_data() else {
-            return;
-        };
+        let data = benilla_formats::wow_data_or_skip!();
         let mut chain = benilla_formats::open_chain(&data).expect("open chain");
         let profanity = benilla_formats::load_chat_profanity(&mut chain).expect("profanity");
         let spam = benilla_formats::load_spam_messages(&mut chain).expect("spam");
diff --git a/crates/benilla-app/src/text_reshape.rs b/crates/benilla-app/src/text_reshape.rs
index 266e2b69..c29ccde7 100644
--- a/crates/benilla-app/src/text_reshape.rs
+++ b/crates/benilla-app/src/text_reshape.rs
@@ -183,7 +183,6 @@ pub(crate) mod harness {
             .expect("the relayout system runs");
     }
 
-    #[allow(clippy::too_many_arguments)]
     fn relayout_one(
         In(root): In<Entity>,
         mut pipeline: ResMut<TextPipeline>,
diff --git a/crates/benilla-app/src/ui_action/cast_send.rs b/crates/benilla-app/src/ui_action/cast_send.rs
index 04cef4d5..0eea0004 100644
--- a/crates/benilla-app/src/ui_action/cast_send.rs
+++ b/crates/benilla-app/src/ui_action/cast_send.rs
@@ -265,7 +265,6 @@ impl CastLadder<'_, '_> {
 /// source while one is already in flight, so mashing a key can no longer fire a duplicate
 /// `CMSG_CAST_SPELL` the server bounces back as a spurious cast-bar cancel. Ranged/auto-repeat
 /// shots keep their own lifecycle — they never arm the guard and are never blocked by it.
-#[allow(clippy::too_many_arguments)] // every input the follow-through + the send itself need
 fn send_spell_cast(
     spell_id: u32,
     ctx: &cast_target::CastContext,
diff --git a/crates/benilla-app/src/ui_action/drop_item.rs b/crates/benilla-app/src/ui_action/drop_item.rs
index 3c1492ef..f60ca8b1 100644
--- a/crates/benilla-app/src/ui_action/drop_item.rs
+++ b/crates/benilla-app/src/ui_action/drop_item.rs
@@ -65,7 +65,6 @@ fn feedable_pet(
 ///
 /// One law, one place: whichever entry it came from, the ask runs the same three gates and the same
 /// commit.
-#[allow(clippy::too_many_arguments)]
 pub(crate) fn drop_item_on_unit(
     script: Option<NonSendMut<UiScript>>,
     self_q: Query<(&crate::net::Guid, &crate::net::ObjectStore), With<crate::net::SelfPlayer>>,
diff --git a/crates/benilla-app/src/ui_action/feed.rs b/crates/benilla-app/src/ui_action/feed.rs
index 109fb9c3..449ba077 100644
--- a/crates/benilla-app/src/ui_action/feed.rs
+++ b/crates/benilla-app/src/ui_action/feed.rs
@@ -100,7 +100,6 @@ impl FailNameTables<'_> {
     }
 }
 
-#[allow(clippy::too_many_arguments)] // a Bevy system's full input set
 pub(super) fn feed_actions(
     script: Option<NonSendMut<UiScript>>,
     mut actions: ResMut<PlayerActions>,
@@ -600,7 +599,6 @@ pub(super) fn feed_actions(
 /// The spellbook's `GetSpellTexture` (`0x4b3f50`) deliberately runs ONLY arms 1 and 3 — it never
 /// serves `ActiveIconID` (proof by exhaustion in the note). `ui_spellbook` keeps that asymmetry;
 /// do not "fix" it to match the bar.
-#[allow(clippy::too_many_arguments)] // the resolver's full input set, twice-called above
 fn spell_action_icon(
     spell_id: u32,
     d: &benilla_formats::SpellDisplay,
diff --git a/crates/benilla-app/src/ui_action/state.rs b/crates/benilla-app/src/ui_action/state.rs
index e5245eed..634d74de 100644
--- a/crates/benilla-app/src/ui_action/state.rs
+++ b/crates/benilla-app/src/ui_action/state.rs
@@ -384,7 +384,7 @@ fn resolve_through_macro(
 }
 
 /// Compute + diff-push every occupied slot's dynamic state, and fire the reference event edges.
-#[allow(clippy::too_many_arguments, clippy::type_complexity)] // a Bevy system's full input set
+#[allow(clippy::type_complexity)] // a Bevy system's full input set
 pub(super) fn feed_action_state(
     script: Option<NonSendMut<UiScript>>,
     actions: Res<PlayerActions>,
diff --git a/crates/benilla-app/src/ui_action/targeting/cursor.rs b/crates/benilla-app/src/ui_action/targeting/cursor.rs
index 49e54256..1309496f 100644
--- a/crates/benilla-app/src/ui_action/targeting/cursor.rs
+++ b/crates/benilla-app/src/ui_action/targeting/cursor.rs
@@ -111,7 +111,6 @@ pub(crate) fn ground_cast_radius(spells: Option<&Spells>, spell_id: u32, level:
 /// The cursor is still a **whole-word** surface in one respect — every seam shows the `Cast`
 /// *kind*, only `unable` differs — which is why it reads [`SpellTargeting::spell`]. The reticle is
 /// per-seam and reads [`SpellTargeting::spell_for`] (decision 0943).
-#[allow(clippy::too_many_arguments)]
 pub(crate) fn drive_targeting_cursor(
     targeting: Res<SpellTargeting>,
     occlusion: Res<PickOcclusion>,
diff --git a/crates/benilla-app/src/ui_auction/mod.rs b/crates/benilla-app/src/ui_auction/mod.rs
index f37527af..3934f239 100644
--- a/crates/benilla-app/src/ui_auction/mod.rs
+++ b/crates/benilla-app/src/ui_auction/mod.rs
@@ -411,7 +411,6 @@ fn time_left_bucket(ms: u32) -> u32 {
 /// row's full enchant/property/suffix tail (an auction row carries all three, so it gets the
 /// complete link rather than the zeroed one a bag slot settles for). `None`s stay `None` while a
 /// query is in flight — the row shows a placeholder and fills in when the answer lands.
-#[allow(clippy::too_many_arguments)] // one resolve per ask-once cache the row reads
 fn resolve_row(
     entry: &AuctionListEntry,
     self_guid: Option<u64>,
@@ -507,7 +506,6 @@ pub(crate) fn categories(
 }
 
 /// Resolve + sort one list into its display rows.
-#[allow(clippy::too_many_arguments)] // one resolve per ask-once cache the row reads
 fn rows_for(
     slot: &AuctionListSlot,
     self_guid: Option<u64>,
@@ -561,7 +559,6 @@ type AuctionCatalogs<'w> = (
 
 /// Push the current auction house into the VM and fire the show/close/list-update events on a
 /// transition or content change. Diffed against a `VmMemo`, exactly like the merchant/mail feeds.
-#[allow(clippy::too_many_arguments)] // one parameter per ask-once cache a row reads
 fn feed_auction(
     script: Option<NonSendMut<UiScript>>,
     mut auction: ResMut<AuctionOpen>,
@@ -726,7 +723,6 @@ fn feed_auction(
 }
 
 /// Drain the Lua intents into the auction `CMSG`s.
-#[allow(clippy::too_many_arguments)]
 fn drain_auction(
     script: Option<NonSendMut<UiScript>>,
     mut auction: ResMut<AuctionOpen>,
diff --git a/crates/benilla-app/src/ui_aura.rs b/crates/benilla-app/src/ui_aura.rs
index 32dda837..74a04fa9 100644
--- a/crates/benilla-app/src/ui_aura.rs
+++ b/crates/benilla-app/src/ui_aura.rs
@@ -522,7 +522,6 @@ fn tracking_state_of(
     })
 }
 
-#[allow(clippy::too_many_arguments)]
 fn feed_auras(
     script: Option<NonSendMut<UiScript>>,
     self_q: Query<(&ObjectStore, &Guid), With<SelfPlayer>>,
diff --git a/crates/benilla-app/src/ui_bank.rs b/crates/benilla-app/src/ui_bank.rs
index df6f7233..36929cb5 100644
--- a/crates/benilla-app/src/ui_bank.rs
+++ b/crates/benilla-app/src/ui_bank.rs
@@ -127,7 +127,6 @@ fn bank_slot_error_key(result: u32) -> Option<&'static str> {
 /// window with `UnitName("npc")`, off the interaction token [`crate::ui_session`] already points
 /// at the banker. Firing an argument the reference does not fire is a divergence an addon can
 /// see, and it bought nothing once the reference's file was the one reading the event.
-#[allow(clippy::too_many_arguments)]
 fn feed_bank(
     script: Option<NonSendMut<UiScript>>,
     open: Res<BankOpen>,
diff --git a/crates/benilla-app/src/ui_battlefield.rs b/crates/benilla-app/src/ui_battlefield.rs
index 1cf4adce..65d6a420 100644
--- a/crates/benilla-app/src/ui_battlefield.rs
+++ b/crates/benilla-app/src/ui_battlefield.rs
@@ -215,7 +215,6 @@ fn group_fits(catalog: Option<&MapCatalog>, map_id: u32, group: Option<&GroupSta
 /// Every frame, before the dialog feed fires `UPDATE_BATTLEFIELD_STATUS` and the score feed
 /// fires `UPDATE_BATTLEFIELD_SCORE`: the list (when it changed), the queue slots (always), the
 /// `BATTLEFIELDS_SHOW` event with its anchor, the leash, and the speaking handlers' lines.
-#[allow(clippy::too_many_arguments)] // one Bevy system's full input set
 fn feed_battlefield(
     script: Option<NonSendMut<UiScript>>,
     mut state: ResMut<Battlefield>,
diff --git a/crates/benilla-app/src/ui_battlefield_positions.rs b/crates/benilla-app/src/ui_battlefield_positions.rs
index 78ce02e0..5cd10034 100644
--- a/crates/benilla-app/src/ui_battlefield_positions.rs
+++ b/crates/benilla-app/src/ui_battlefield_positions.rs
@@ -101,7 +101,6 @@ fn flag_token(faction: Option<&str>) -> Option<&'static str> {
     }
 }
 
-#[allow(clippy::too_many_arguments)]
 fn feed_battlefield_positions(
     script: Option<NonSendMut<UiScript>>,
     mut state: ResMut<BattlefieldPositions>,
diff --git a/crates/benilla-app/src/ui_cast.rs b/crates/benilla-app/src/ui_cast.rs
index 1457f46e..f6bfd47d 100644
--- a/crates/benilla-app/src/ui_cast.rs
+++ b/crates/benilla-app/src/ui_cast.rs
@@ -426,7 +426,6 @@ pub(crate) struct LocalMoveStart(pub(crate) bool);
 /// ~1.9 s in the reference bottle (whose `Config.wtf` caps `maxfps` at 30, and the ref steps
 /// alpha PER TICK), the director's observed "2–3 s"; our transcription normalizes those steps
 /// to the same 30 Hz reference tick so the tail matches at any render rate (`CastingBar.xml`).
-#[allow(clippy::too_many_arguments)] // one resolution's full input set (the reap needs the ECS half)
 fn local_self_cancel(
     script: Option<NonSendMut<UiScript>>,
     mut moved: ResMut<LocalMoveStart>,
@@ -605,7 +604,6 @@ fn cast_bar_label(spells: Option<&crate::ui_action::Spells>, id: u32) -> String
 /// queued strike makes `IsCasting` true in the reference, so `SpellStopCasting()` returns `1` and
 /// `ToggleGameMenu`'s ladder never reaches `ClearTarget()` (`UIParent.lua` l.1489 vs l.1492).
 /// Reading only the ordinary-cast half here is what dropped the target on the first Esc.
-#[allow(clippy::too_many_arguments)] // a Bevy system's full input set
 fn feed_cast_bar(
     script: Option<NonSendMut<UiScript>>,
     mut feed: ResMut<CastBarFeed>,
diff --git a/crates/benilla-app/src/ui_char.rs b/crates/benilla-app/src/ui_char.rs
index 7ef82f2d..7b18ff1f 100644
--- a/crates/benilla-app/src/ui_char.rs
+++ b/crates/benilla-app/src/ui_char.rs
@@ -642,7 +642,6 @@ fn combat_stats(store: &ObjectStore, items: &mut Items, commands: &NetCommands)
 /// equipped-bag icons 20..=23) and the bank bags' own `PLAYER_FIELD_BANK_BAG_SLOT_*` (live ids
 /// 64..=69). Everything past the guid — template, enchants, durability, the pending lock — is
 /// identical for both, which is the whole reason there is one function here and not two.
-#[allow(clippy::too_many_arguments)] // the slot resolve's full read set — the bag feed's twin
 fn slot_view(
     items: &mut Items,
     icons: Option<&ItemDisplays>,
@@ -809,7 +808,6 @@ fn ammo_count(store: &ObjectStore, items: &Items, ammo_id: u32) -> u32 {
 /// the four equipped-bag icons (decision 0216 slice 2's bag bar — the bag ITEM occupying `INV_SLOT`
 /// 19..22, not its contents) — all the client's 1-based `GetInventorySlotInfo` ids over the
 /// 0-based inv-slot array.
-#[allow(clippy::too_many_arguments)] // [`slot_view`]'s read set, plus the descriptor it walks
 fn inventory_slots(
     store: &ObjectStore,
     items: &mut Items,
@@ -905,7 +903,6 @@ fn inventory_slots(
 /// `BankButtonIDToInvSlotID(i, 1)` (BankFrame.lua:28-35, 194-198), and the guids stream in the
 /// player descriptor whether or not a banker is open. So they ride the inventory feed, beside the
 /// doll snapshot, rather than the `BankState` the bank window pushes.
-#[allow(clippy::too_many_arguments)] // [`slot_view`]'s read set, one band over
 fn bank_bag_slots(
     store: &ObjectStore,
     items: &mut Items,
@@ -1047,7 +1044,6 @@ pub(crate) fn fire_stat_transitions(
     }
 }
 
-#[allow(clippy::too_many_arguments)]
 pub(crate) fn feed_char(
     // `ChrClasses.dbc` field 16, for the fit rule's relic half — `ui_items::find_equip_slot`
     // (1803). Absent client data reads every class as an ordinary ranged wielder.
diff --git a/crates/benilla-app/src/ui_chat.rs b/crates/benilla-app/src/ui_chat.rs
index 9f17526b..de49afe6 100644
--- a/crates/benilla-app/src/ui_chat.rs
+++ b/crates/benilla-app/src/ui_chat.rs
@@ -227,7 +227,7 @@ impl Plugin for UiChatPlugin {
                 )
                     .chain()
                     .after(UiInput)
-                    .run_if(in_state(crate::char_select::ClientState::InWorld)),
+                    .in_set(crate::char_select::InWorldGated),
             )
             // The zone-channel auto-join (0288 P6): the client half of a handshake vmangos
             // deliberately leaves to us. In-world only, and it early-outs on an unchanged zone.
@@ -250,10 +250,8 @@ impl Plugin for UiChatPlugin {
                 Update,
                 (
                     channels::end_session_channels_on_disconnect,
-                    channels::auto_join_zone_channels
-                        .run_if(in_state(crate::char_select::ClientState::InWorld)),
-                    recruitment::guild_recruitment_cascade
-                        .run_if(in_state(crate::char_select::ClientState::InWorld)),
+                    channels::auto_join_zone_channels.in_set(crate::char_select::InWorldGated),
+                    recruitment::guild_recruitment_cascade.in_set(crate::char_select::InWorldGated),
                 )
                     .chain()
                     .after(benilla_world::terrain_stream::AreaAuthoritySet),
diff --git a/crates/benilla-app/src/ui_chat/channels.rs b/crates/benilla-app/src/ui_chat/channels.rs
index 90f34e92..f87ac012 100644
--- a/crates/benilla-app/src/ui_chat/channels.rs
+++ b/crates/benilla-app/src/ui_chat/channels.rs
@@ -523,7 +523,6 @@ fn zone_is_settled(player: Option<&crate::player::Player>) -> bool {
 /// `flags & INITIAL` read fresh. The DBC bit only seeds the mask on a character with no file
 /// (`0x4997fc`). This is what makes `/leave General` stick: the leave clears the bit in the
 /// character's file, and the next login's walk never registers the row ([`plan_walk`]).
-#[allow(clippy::too_many_arguments)] // a Bevy system's param list IS its dependency set
 pub(super) fn auto_join_zone_channels(
     commands: Res<NetCommands>,
     mut channels: ResMut<ChannelState>,
diff --git a/crates/benilla-app/src/ui_chat/combat.rs b/crates/benilla-app/src/ui_chat/combat.rs
index 521ae4b8..b12f11bd 100644
--- a/crates/benilla-app/src/ui_chat/combat.rs
+++ b/crates/benilla-app/src/ui_chat/combat.rs
@@ -370,7 +370,6 @@ impl UnitClass {
 /// [`crate::target::ring::can_attack_from_player`] is specialised to the local player as the
 /// attacker (1530). We run the direction we have. It differs only for a unit that can attack you
 /// while you cannot attack it, which needs the general two-unit form to answer.
-#[allow(clippy::too_many_arguments)]
 pub(crate) fn classify(
     guid: u64,
     self_guid: &SelfGuid,
diff --git a/crates/benilla-app/src/ui_chat/combat/watch.rs b/crates/benilla-app/src/ui_chat/combat/watch.rs
index e6c6d7db..b79660ef 100644
--- a/crates/benilla-app/src/ui_chat/combat/watch.rs
+++ b/crates/benilla-app/src/ui_chat/combat/watch.rs
@@ -82,7 +82,6 @@ impl WatchCtx<'_> {
 }
 
 /// Queue one single-endpoint line, gated the way its formatter gates.
-#[allow(clippy::too_many_arguments)] // the line's own facts, plus the two contexts the gate reads
 fn queue_one(
     log: &mut ChatLog,
     ctx: &WatchCtx,
diff --git a/crates/benilla-app/src/ui_chat/feed.rs b/crates/benilla-app/src/ui_chat/feed.rs
index 71d17d70..ecb90a45 100644
--- a/crates/benilla-app/src/ui_chat/feed.rs
+++ b/crates/benilla-app/src/ui_chat/feed.rs
@@ -765,7 +765,6 @@ pub(super) struct SpeakerEffects<'w> {
 
 /// Drain [`ChatLog`]: resolve names (ask-once, bounded), build events, [`route`] them. Also ticks
 /// the whisper-chime throttle.
-#[allow(clippy::too_many_arguments)] // a Bevy system's param list IS its dependency set
 pub(super) fn feed_chat(
     script: Option<NonSendMut<benilla_ui::script::UiScript>>,
     mut log: ResMut<ChatLog>,
diff --git a/crates/benilla-app/src/ui_chat/idle.rs b/crates/benilla-app/src/ui_chat/idle.rs
index def9e066..55ac7faf 100644
--- a/crates/benilla-app/src/ui_chat/idle.rs
+++ b/crates/benilla-app/src/ui_chat/idle.rs
@@ -217,7 +217,6 @@ pub(crate) fn idle_action(idle: Duration, gates: IdleGates) -> IdleAction {
 
 /// The handler proper. In-world only: `0x482ea0` is `WorldFrame::Render`, so there is no idle
 /// timer at the glue screens.
-#[allow(clippy::too_many_arguments)]
 pub(crate) fn idle_handler(
     time: Res<Time<Real>>,
     last: Res<LastInput>,
diff --git a/crates/benilla-app/src/ui_chat/input/mod.rs b/crates/benilla-app/src/ui_chat/input/mod.rs
index d42c70c0..9c52de99 100644
--- a/crates/benilla-app/src/ui_chat/input/mod.rs
+++ b/crates/benilla-app/src/ui_chat/input/mod.rs
@@ -21,7 +21,6 @@ use crate::creature_anim::{move_flags, MovementState};
 use crate::net::{ClientCommand, NetCommands, SelfPlayer};
 use crate::target::Selection;
 
-#[allow(clippy::too_many_arguments)] // a Bevy system's param list IS its dependency set
 /// The target half of the ref's `GetSlashCmdTarget` (ChatFrame.lua:650-658): a bare party
 /// command falls back to the current selection iff it's a PLAYER; anything else is `None` (the
 /// ref's silent no-op). The name is cache-resolved — a streamed player target is always cached.
@@ -67,7 +66,6 @@ pub(super) fn emote_target(selection: &Selection, me: Option<Entity>) -> u64 {
     }
 }
 
-#[allow(clippy::too_many_arguments)]
 /// The client-local diagnostics' inputs, as one [`SystemParam`] — [`drain_chat_input`] is at the
 /// 16-parameter ceiling, and a named struct beats a nested tuple nobody can read.
 ///
@@ -203,7 +201,6 @@ fn manual_join_or_leave(
     }
 }
 
-#[allow(clippy::too_many_arguments)]
 pub(super) fn drain_chat_input(
     script: Option<NonSendMut<benilla_ui::script::UiScript>>,
     mut chat_log: ResMut<super::feed::ChatLog>,
diff --git a/crates/benilla-app/src/ui_chat/logging.rs b/crates/benilla-app/src/ui_chat/logging.rs
index 8bcd81d7..81ac72d2 100644
--- a/crates/benilla-app/src/ui_chat/logging.rs
+++ b/crates/benilla-app/src/ui_chat/logging.rs
@@ -130,7 +130,7 @@ pub(super) fn sync_chat_logging(
 pub(super) fn plugin(app: &mut App) {
     app.add_systems(
         Update,
-        sync_chat_logging.run_if(in_state(crate::char_select::ClientState::InWorld)),
+        sync_chat_logging.in_set(crate::char_select::InWorldGated),
     );
 }
 
diff --git a/crates/benilla-app/src/ui_chat/settings.rs b/crates/benilla-app/src/ui_chat/settings.rs
index 76288545..c306bb2c 100644
--- a/crates/benilla-app/src/ui_chat/settings.rs
+++ b/crates/benilla-app/src/ui_chat/settings.rs
@@ -809,11 +809,11 @@ pub(super) fn plugin(app: &mut App) {
         // [`restore_chat_looks`], decision 2119. Only the watcher belongs in `Update`.
         .add_systems(
             Update,
-            watch_chat_looks.run_if(in_state(crate::char_select::ClientState::InWorld)),
+            watch_chat_looks.in_set(crate::char_select::InWorldGated),
         )
         .add_systems(
             Update,
-            save_chat_looks.run_if(in_state(crate::char_select::ClientState::InWorld)),
+            save_chat_looks.in_set(crate::char_select::InWorldGated),
         );
     // **The session-end flush is not registered here.** It is called from inside
     // `ui_script::end_ui_session` ([`fold_dying_vm_chat_cache`]) so that it covers `/reload` — a
diff --git a/crates/benilla-app/src/ui_craft.rs b/crates/benilla-app/src/ui_craft.rs
index 993890df..ce9d2101 100644
--- a/crates/benilla-app/src/ui_craft.rs
+++ b/crates/benilla-app/src/ui_craft.rs
@@ -131,7 +131,6 @@ fn craft_tooltip(spell_id: u32, d: &benilla_formats::SpellDisplay) -> CraftToolt
 }
 
 /// Build the craft snapshot — `None` when the window is closed or the catalogs haven't loaded.
-#[allow(clippy::too_many_arguments)] // a Bevy system's full input set (the feed precedent)
 fn feed_craft(
     script: Option<NonSendMut<UiScript>>,
     open: Res<CraftOpen>,
diff --git a/crates/benilla-app/src/ui_dialog_verbs.rs b/crates/benilla-app/src/ui_dialog_verbs.rs
index 655cf0f8..4f75969c 100644
--- a/crates/benilla-app/src/ui_dialog_verbs.rs
+++ b/crates/benilla-app/src/ui_dialog_verbs.rs
@@ -705,7 +705,7 @@ impl Plugin for UiDialogVerbsPlugin {
                     // packet, and the boot VM exists at the glue screen too.
                     meeting_stone_enter_world
                         .before(feed_meeting_stone)
-                        .run_if(in_state(crate::char_select::ClientState::InWorld)),
+                        .in_set(crate::char_select::InWorldGated),
                     feed_meeting_stone.before(UiInput),
                     drain_latch_verbs.after(UiInput),
                     drain_queue_verbs.after(UiInput),
diff --git a/crates/benilla-app/src/ui_duel.rs b/crates/benilla-app/src/ui_duel.rs
index 0daad436..fa615082 100644
--- a/crates/benilla-app/src/ui_duel.rs
+++ b/crates/benilla-app/src/ui_duel.rs
@@ -343,7 +343,6 @@ fn tick_countdown(time: Res<Time>, mut duel: ResMut<DuelState>, mut started: Loc
 }
 
 /// Drain the Era API's duel intents into their sends.
-#[allow(clippy::too_many_arguments)] // a Bevy system's param list IS its dependency set
 fn drain_duel(
     script: Option<NonSendMut<UiScript>>,
     duel: Res<DuelState>,
diff --git a/crates/benilla-app/src/ui_gossip.rs b/crates/benilla-app/src/ui_gossip.rs
index e7b900c3..dc501a2d 100644
--- a/crates/benilla-app/src/ui_gossip.rs
+++ b/crates/benilla-app/src/ui_gossip.rs
@@ -309,7 +309,6 @@ fn snapshot(state: &GossipState) -> Option<GossipMenu> {
 /// Push the current menu into the VM and fire the open/close events on a transition (or a content
 /// change — the greeting arriving a frame after the menu). Diffed against a `Local` memory, exactly
 /// like the container feed's per-bag diff.
-#[allow(clippy::too_many_arguments)]
 fn feed_gossip(
     script: Option<NonSendMut<UiScript>>,
     state: Res<GossipState>,
diff --git a/crates/benilla-app/src/ui_hide.rs b/crates/benilla-app/src/ui_hide.rs
index 0002a40a..035e6765 100644
--- a/crates/benilla-app/src/ui_hide.rs
+++ b/crates/benilla-app/src/ui_hide.rs
@@ -7,7 +7,7 @@
 
 use bevy::prelude::*;
 
-use crate::char_select::ClientState;
+use crate::char_select::{ClientState, InWorldGated};
 use crate::ui_script::UiInput;
 
 /// Is the player UI hidden right now? (`ALT-Z` — [`toggle_ui_hidden`].)
@@ -37,9 +37,7 @@ impl Plugin for UiHidePlugin {
                 Update,
                 // After `UiInput`, like every other gameplay key reader: an EditBox that consumed
                 // this frame's keys has already published its capture flag by then.
-                toggle_ui_hidden
-                    .after(UiInput)
-                    .run_if(in_state(ClientState::InWorld)),
+                toggle_ui_hidden.after(UiInput).in_set(InWorldGated),
             )
             .add_systems(OnExit(ClientState::InWorld), show_ui);
     }
diff --git a/crates/benilla-app/src/ui_honor.rs b/crates/benilla-app/src/ui_honor.rs
index b98697b7..8f51f0f7 100644
--- a/crates/benilla-app/src/ui_honor.rs
+++ b/crates/benilla-app/src/ui_honor.rs
@@ -164,7 +164,6 @@ fn events_for(before: Option<&HonorState>, after: &HonorState) -> (bool, bool) {
 }
 
 /// Push the self snapshot and the inspect reply, fire what moved, and drain the pane's request.
-#[allow(clippy::too_many_arguments)] // a Bevy system's param list IS its dependency set
 fn feed_honor(
     script: Option<NonSendMut<UiScript>>,
     self_store: Query<&ObjectStore, With<SelfPlayer>>,
diff --git a/crates/benilla-app/src/ui_inspect.rs b/crates/benilla-app/src/ui_inspect.rs
index 1cbd448d..2b7edd46 100644
--- a/crates/benilla-app/src/ui_inspect.rs
+++ b/crates/benilla-app/src/ui_inspect.rs
@@ -155,7 +155,6 @@ fn inspect_slot_view(
     })
 }
 
-#[allow(clippy::too_many_arguments)]
 fn feed_inspect(
     script: Option<NonSendMut<UiScript>>,
     mut target: ResMut<InspectTarget>,
diff --git a/crates/benilla-app/src/ui_item_text.rs b/crates/benilla-app/src/ui_item_text.rs
index bf54a382..f4c6fc3b 100644
--- a/crates/benilla-app/src/ui_item_text.rs
+++ b/crates/benilla-app/src/ui_item_text.rs
@@ -267,7 +267,6 @@ fn readable(
 /// paint a Stone plaque in parchment ink. READY holds until the body and, for a letter, the creator
 /// line are both in. (The window itself only shows on READY — `ItemTextFrame.lua` calls
 /// `ShowUIPanel` there, not on BEGIN.)
-#[allow(clippy::too_many_arguments)]
 fn feed_item_text(
     script: Option<NonSendMut<UiScript>>,
     mut open: ResMut<ItemTextOpen>,
diff --git a/crates/benilla-app/src/ui_items/drain.rs b/crates/benilla-app/src/ui_items/drain.rs
index 644a0c38..ac28c36b 100644
--- a/crates/benilla-app/src/ui_items/drain.rs
+++ b/crates/benilla-app/src/ui_items/drain.rs
@@ -30,7 +30,6 @@ use super::{slot_guid, slot_guid_count, wire_pos, INVTYPE_AMMO};
 ///   `bonding == 2` item raises `AUTOEQUIP_BIND_CONFIRM` and sends NOTHING. `suppress` is the
 ///   reference's own parameter, set on the re-issue `EquipPendingItem` drives — which is what stops
 ///   the accept from asking the same question again forever.
-#[allow(clippy::too_many_arguments)]
 pub(crate) fn send_auto_equip(
     script: &mut UiScript,
     gate: &mut crate::ui_bind_confirm::BindGate,
@@ -256,7 +255,6 @@ pub(super) fn drain_inventory_uses(
     }
 }
 
-#[allow(clippy::too_many_arguments)]
 pub(super) fn drain_container_uses(
     script: Option<NonSendMut<UiScript>>,
     self_q: Query<&ObjectStore, With<SelfPlayer>>,
@@ -726,7 +724,6 @@ fn is_equip_position(bag_index: u8, slot: u8) -> bool {
 /// same body with `suppress` set, rather than a second copy of it that has to be kept agreeing.
 ///
 /// Returns whether the move was sent (`false` = deferred behind `EQUIP_BIND_CONFIRM`).
-#[allow(clippy::too_many_arguments)]
 pub(crate) fn send_container_move(
     script: &mut UiScript,
     gate: &mut crate::ui_bind_confirm::BindGate,
diff --git a/crates/benilla-app/src/ui_items/feed.rs b/crates/benilla-app/src/ui_items/feed.rs
index 0de1d04c..916ddf2c 100644
--- a/crates/benilla-app/src/ui_items/feed.rs
+++ b/crates/benilla-app/src/ui_items/feed.rs
@@ -149,7 +149,6 @@ fn standing_label(rank: u32, get: &dyn Fn(&str) -> Option<String>) -> Option<Str
 /// `0x506f70`; its bare name otherwise), the skill requirement's name off `SkillLine.dbc`, the
 /// reputation requirement off `Faction.dbc` names (the red check is the engine's, against the
 /// player's rank map).
-#[allow(clippy::too_many_arguments)] // one app-resolved catalog per argument, by design
 fn template_view(
     t: &ItemInfo,
     spells: Option<&crate::ui_action::Spells>,
@@ -388,7 +387,6 @@ pub(super) fn feed_random_properties(
     *pushed.get(&script) = true;
 }
 
-#[allow(clippy::too_many_arguments)]
 pub(super) fn feed_item_stats(
     script: Option<NonSendMut<UiScript>>,
     mut items: ResMut<Items>,
@@ -493,7 +491,6 @@ pub(super) fn feed_item_stats(
 /// bits) + the full skill-rank map, read off the self player's descriptor, plus the equip
 /// proficiencies (`SMSG_SET_PROFICIENCY`) and the faction → reputation-rank map (DBC base for our
 /// race/class + the `SMSG_INITIALIZE_FACTIONS` standing, ranked) — pushed on change.
-#[allow(clippy::too_many_arguments)] // a Bevy system's full input set
 pub(super) fn feed_player_req(
     script: Option<NonSendMut<UiScript>>,
     self_q: Query<&ObjectStore, With<SelfPlayer>>,
@@ -607,7 +604,6 @@ pub(super) fn feed_player_req(
 /// read the action feed's ITEM arm does). `None` = the slot is empty (guid 0/unsent) — an
 /// *unresolved* occupied slot is `Some` with empty fields instead, so the bag shows the item
 /// exists before its query answers.
-#[allow(clippy::too_many_arguments)] // the slot resolve's full read set (stores + both clocks)
 fn resolve_slot(
     guid: u64,
     items: &mut Items,
@@ -840,7 +836,7 @@ pub(crate) fn resolve_item_locks(
         .extend(pending.resolve(|bag, slot1| slot_guid_count(player, bag, slot1, &items)));
 }
 
-#[allow(clippy::too_many_arguments, clippy::type_complexity)] // the param list IS the input set
+#[allow(clippy::type_complexity)] // the param list IS the input set
 pub(crate) fn feed_containers(
     script: Option<NonSendMut<UiScript>>,
     // `ChrClasses.dbc` field 16, for the fit rule's relic half — see `find_equip_slot` (1803).
diff --git a/crates/benilla-app/src/ui_layout.rs b/crates/benilla-app/src/ui_layout.rs
index 48f175af..e0016fa9 100644
--- a/crates/benilla-app/src/ui_layout.rs
+++ b/crates/benilla-app/src/ui_layout.rs
@@ -339,7 +339,7 @@ impl Plugin for UiLayoutPlugin {
             Update,
             (load_layout, watch_layout, save_layout)
                 .chain()
-                .run_if(in_state(crate::char_select::ClientState::InWorld)),
+                .in_set(crate::char_select::InWorldGated),
         );
     }
 }
diff --git a/crates/benilla-app/src/ui_loot.rs b/crates/benilla-app/src/ui_loot.rs
index f1cc6f62..871d3832 100644
--- a/crates/benilla-app/src/ui_loot.rs
+++ b/crates/benilla-app/src/ui_loot.rs
@@ -372,7 +372,7 @@ impl LootState {
 
     /// The guid of the loot source whose window is open (`None` = closed). Read by the GameObject
     /// lid-close watcher ([`crate::go_anim`]) to close a chest's lid when its loot window closes
-    /// (decision 0250) — the faithful client-authoritative close, any path (player close or the
+    /// (decision 2271) — the faithful client-authoritative close, any path (player close or the
     /// server's release on the last item).
     pub(crate) fn source(&self) -> Option<u64> {
         self.source
@@ -943,7 +943,6 @@ fn drain_receives(
 /// Push the current loot into the VM and fire open/update/close on a transition (or a content change
 /// — an async name landing, a removed row, the coin clearing). Also routes refusals + receive lines
 /// into the chat window. Diffed against a `Local` memory, exactly like the merchant/gossip feeds.
-#[allow(clippy::too_many_arguments)]
 fn feed_loot(
     script: Option<NonSendMut<UiScript>>,
     mut loot: ResMut<LootState>,
@@ -1164,7 +1163,6 @@ fn close_on_move_start(
 /// `CLootButton`'s arm) and `LootSlot` is the LOOT_BIND confirmation continuation (`flag == 1`,
 /// which sends only for the pending slot). Keeping them apart is what makes a second click on a
 /// bind-on-pickup row re-raise the confirm instead of looting behind it.
-#[allow(clippy::too_many_arguments)] // one Bevy system's full input set
 fn drain_loot(
     script: Option<NonSendMut<UiScript>>,
     mut loot: ResMut<LootState>,
diff --git a/crates/benilla-app/src/ui_loot_roll.rs b/crates/benilla-app/src/ui_loot_roll.rs
index c094671e..7952051f 100644
--- a/crates/benilla-app/src/ui_loot_roll.rs
+++ b/crates/benilla-app/src/ui_loot_roll.rs
@@ -484,7 +484,6 @@ fn render(
 /// Surface the queued announcement lines in the chat window once their names resolve, colored
 /// `LOOT` green (the roll lines ride `CHAT_MSG_LOOT` in the real client, like the receive lines).
 /// Unresolved lines retry up to [`LINE_MAX_TRIES`] frames, then drop.
-#[allow(clippy::too_many_arguments)] // the line resolve's full read set
 fn drain_lines(
     rolls: &mut LootRolls,
     self_guid: Option<u64>,
@@ -575,7 +574,6 @@ fn snapshot(
 
 /// Tick the open rolls, push them into the VM, fire the open/close events, and drain the queued
 /// announcement lines into chat.
-#[allow(clippy::too_many_arguments)]
 fn feed_loot_rolls(
     script: Option<NonSendMut<UiScript>>,
     mut rolls: ResMut<LootRolls>,
diff --git a/crates/benilla-app/src/ui_macro/mod.rs b/crates/benilla-app/src/ui_macro/mod.rs
index c8d14ffb..3d23ea60 100644
--- a/crates/benilla-app/src/ui_macro/mod.rs
+++ b/crates/benilla-app/src/ui_macro/mod.rs
@@ -19,7 +19,7 @@ use bevy::prelude::*;
 
 use benilla_ui::script::{MacroState, ScriptValue, UiScript};
 
-use crate::char_select::ClientState;
+use crate::char_select::InWorldGated;
 use benilla_assets::{LockRecover, WorldAssets};
 
 pub(crate) mod run;
@@ -79,7 +79,7 @@ impl Plugin for UiMacroPlugin {
                     // roster only names it once a login is live. It self-gates on the identity, so
                     // a re-entry with a different character reloads and a re-entry with the same
                     // one is a no-op.
-                    load_macros.run_if(in_state(ClientState::InWorld)),
+                    load_macros.in_set(InWorldGated),
                     // The save edge is checked every frame, in or out of world: the macro window is
                     // `whileDead = 1` and reachable from the game menu, and a `/logout` must not
                     // strand an unsaved edit.
diff --git a/crates/benilla-app/src/ui_mail/mod.rs b/crates/benilla-app/src/ui_mail/mod.rs
index b822c7fb..0c4c4659 100644
--- a/crates/benilla-app/src/ui_mail/mod.rs
+++ b/crates/benilla-app/src/ui_mail/mod.rs
@@ -283,7 +283,6 @@ use invoice::auction_mail;
 /// item-template cache + `ItemDisplayInfo.dbc`, the body from the cache, the stationery basename
 /// from `Stationery.dbc`. `None`s stay `None` while a query is in flight — the row shows a
 /// placeholder and fills in when the answer lands (the merchant/loot pattern).
-#[allow(clippy::too_many_arguments)] // one resolve per ask-once cache the row reads
 fn resolve_row(
     entry: &MailListEntry,
     bodies: &HashMap<u32, String>,
@@ -482,7 +481,6 @@ fn stationeries(
     out.into_iter().map(|(_, v)| v).collect()
 }
 
-#[allow(clippy::too_many_arguments)] // mirrors `resolve_row`'s cache set
 fn snapshot(
     mail: &MailOpen,
     items: &mut Items,
@@ -531,7 +529,6 @@ struct MailFeedExtras<'w, 's> {
     stationeries: Local<'s, crate::ui_script::VmMemo<Vec<StationeryView>>>,
 }
 
-#[allow(clippy::too_many_arguments)]
 fn feed_mail(
     script: Option<NonSendMut<UiScript>>,
     mut mail: ResMut<MailOpen>,
diff --git a/crates/benilla-app/src/ui_merchant.rs b/crates/benilla-app/src/ui_merchant.rs
index abdd1b53..382d7d6a 100644
--- a/crates/benilla-app/src/ui_merchant.rs
+++ b/crates/benilla-app/src/ui_merchant.rs
@@ -393,7 +393,6 @@ fn repair_all_cost(
 
 /// Build the Lua-facing snapshot from [`MerchantOpen`] + the player/vendor descriptors — `None`
 /// when no vendor is open.
-#[allow(clippy::too_many_arguments)]
 fn snapshot(
     open: &MerchantOpen,
     items: &mut Items,
@@ -433,7 +432,6 @@ fn snapshot(
 /// content change — the async name landing, a post-buy stock update). Also surfaces refusals on the
 /// red error line and pushes the player's purse each frame it changes. Diffed against a `Local`
 /// memory, exactly like the gossip/container feeds.
-#[allow(clippy::too_many_arguments)]
 fn feed_merchant(
     script: Option<NonSendMut<UiScript>>,
     open: Res<MerchantOpen>,
diff --git a/crates/benilla-app/src/ui_models/mod.rs b/crates/benilla-app/src/ui_models/mod.rs
index c2238f90..6cd058c2 100644
--- a/crates/benilla-app/src/ui_models/mod.rs
+++ b/crates/benilla-app/src/ui_models/mod.rs
@@ -874,7 +874,7 @@ fn forget_dead_vm_tiles(
 
 /// The per-frame pass: feed the engine the facts it asked for, keep one tile per visible pane,
 /// pack the atlas, place every tile at its cell and its play head, and aim the camera.
-#[allow(clippy::too_many_arguments, clippy::type_complexity)] // a Bevy system's full input set
+#[allow(clippy::type_complexity)] // a Bevy system's full input set
 fn sync_tiles(
     mut commands: Commands,
     script: Option<NonSendMut<UiScript>>,
@@ -1837,7 +1837,6 @@ struct BuiltTile {
 /// Spawn a file's parts, rig and emitters under `root` on the tile layer — the booth bake's
 /// recipe (`portrait::booth::spawn_booth_model`) for a file with no unit. `None` when a material
 /// is not resident yet (the caller retries next frame rather than latch a world-lit twin).
-#[allow(clippy::too_many_arguments)]
 fn build_tile(
     commands: &mut Commands,
     root: Entity,
diff --git a/crates/benilla-app/src/ui_net.rs b/crates/benilla-app/src/ui_net.rs
index 3f8735a0..2ef4260e 100644
--- a/crates/benilla-app/src/ui_net.rs
+++ b/crates/benilla-app/src/ui_net.rs
@@ -18,6 +18,8 @@ use bevy::prelude::*;
 
 use benilla_ui::script::UiScript;
 
+use benilla_assets::LockRecover;
+
 use crate::net::PingShared;
 use crate::ui_script::UiInput;
 
@@ -32,6 +34,8 @@ impl Plugin for UiNetPlugin {
 /// Push the averaged round trip behind `GetNetStats()`.
 fn feed_net_stats(script: Option<NonSendMut<UiScript>>, ping: Res<PingShared>) {
     let Some(mut script) = script else { return };
-    let latency = ping.0.lock().expect("ping clock").avg_latency_ms();
+    // Recovered, not unwrapped: the net threads hold this lock too, and a panic there must end
+    // the connection, not the app (decision 2265 §B1).
+    let latency = ping.0.lock_recover().avg_latency_ms();
     script.set_latency_ms(latency);
 }
diff --git a/crates/benilla-app/src/ui_party/feed.rs b/crates/benilla-app/src/ui_party/feed.rs
index 2756b6ba..2be9bdbb 100644
--- a/crates/benilla-app/src/ui_party/feed.rs
+++ b/crates/benilla-app/src/ui_party/feed.rs
@@ -103,7 +103,6 @@ pub(crate) const GROUP_MEMBER_SUBGROUP: u8 = 0x07;
 /// events on their edges. The per-member unit state is the 0434 §2 **merged view**: a streamed
 /// member's live descriptor wins; the `PARTY_MEMBER_STATS` snapshot covers the rest — and the
 /// roster status byte overlays both (the descriptor never carries connected/AFK/DND).
-#[allow(clippy::too_many_arguments)] // a Bevy system's param list IS its dependency set
 pub(super) fn feed_party(
     // `ChrClasses.dbc` field 16 — `UnitHasRelicSlot`'s only input. Absent when the client data
     // failed to load, in which case no class reads as having a relic slot.
diff --git a/crates/benilla-app/src/ui_pet/bar.rs b/crates/benilla-app/src/ui_pet/bar.rs
index 4e7f20ac..7610d1de 100644
--- a/crates/benilla-app/src/ui_pet/bar.rs
+++ b/crates/benilla-app/src/ui_pet/bar.rs
@@ -264,7 +264,6 @@ pub(super) fn active_aura_press(
 /// `pet-action-bar-api.md` §9). Diffing the pushed state is the same edge from the other side:
 /// the slots' content and usability are the bar's, the ten triples are the bank's. `UNIT_PET` is
 /// `feed_pet_unit`'s; `UNIT_FLAGS`/`UNIT_AURA` for `"pet"` are the unit feed's.
-#[allow(clippy::too_many_arguments)]
 pub(super) fn feed_pet_bar(
     script: Option<NonSendMut<UiScript>>,
     bar: Res<PetBar>,
diff --git a/crates/benilla-app/src/ui_pet/drain.rs b/crates/benilla-app/src/ui_pet/drain.rs
index bfcedb40..300c4ab8 100644
--- a/crates/benilla-app/src/ui_pet/drain.rs
+++ b/crates/benilla-app/src/ui_pet/drain.rs
@@ -53,7 +53,6 @@ pub(super) const UNIT_FLAG_POSSESSED: u32 = 0x0100_0000;
 ///
 /// The optimism is bounded by the same packet that owns everything else — the next
 /// `SMSG_PET_SPELLS` (a re-summon, a learn, a stable swap) replaces state and contents together.
-#[allow(clippy::too_many_arguments)] // one Bevy system's full input set
 pub(super) fn drain_pet_actions(
     script: Option<NonSendMut<UiScript>>,
     mut bar: ResMut<PetBar>,
diff --git a/crates/benilla-app/src/ui_pet/unit.rs b/crates/benilla-app/src/ui_pet/unit.rs
index a7b4f250..16b94ab5 100644
--- a/crates/benilla-app/src/ui_pet/unit.rs
+++ b/crates/benilla-app/src/ui_pet/unit.rs
@@ -59,7 +59,6 @@ pub(super) const UNIT_FLAG_PET_IN_COMBAT: u32 = 0x0000_0800;
 /// The reaction argument is `0`: the pet frame reads no reaction (only `"target"` resolves one —
 /// [`crate::ui_unit::feed_units`]' own note), and the party feed passes the same for the same
 /// reason.
-#[allow(clippy::too_many_arguments)] // a Bevy system's param list IS its dependency set
 pub(super) fn feed_pet_unit(
     script: Option<NonSendMut<UiScript>>,
     bar: Res<PetBar>,
diff --git a/crates/benilla-app/src/ui_pet_book.rs b/crates/benilla-app/src/ui_pet_book.rs
index dcd2c0a1..132c700d 100644
--- a/crates/benilla-app/src/ui_pet_book.rs
+++ b/crates/benilla-app/src/ui_pet_book.rs
@@ -89,7 +89,6 @@ struct FeedMemory {
     pushed: PetBookState,
 }
 
-#[allow(clippy::too_many_arguments)] // a Bevy system's full input set
 fn feed_pet_book(
     script: Option<NonSendMut<UiScript>>,
     bar: Res<PetBar>,
@@ -176,7 +175,6 @@ fn book_changed(fresh: &PetBookState, old: &PetBookState) -> bool {
 }
 
 /// One book slot, fully resolved.
-#[allow(clippy::too_many_arguments)]
 fn slot_view(
     entry: PetActionEntry,
     d: &SpellDisplay,
diff --git a/crates/benilla-app/src/ui_pet_stats.rs b/crates/benilla-app/src/ui_pet_stats.rs
index f378f325..be4a933c 100644
--- a/crates/benilla-app/src/ui_pet_stats.rs
+++ b/crates/benilla-app/src/ui_pet_stats.rs
@@ -235,7 +235,6 @@ fn stats_for(
     )
 }
 
-#[allow(clippy::too_many_arguments)]
 fn feed_pet_stats(
     script: Option<NonSendMut<UiScript>>,
     bar: Res<PetBar>,
diff --git a/crates/benilla-app/src/ui_petition/feed.rs b/crates/benilla-app/src/ui_petition/feed.rs
index 816014dd..fae4775a 100644
--- a/crates/benilla-app/src/ui_petition/feed.rs
+++ b/crates/benilla-app/src/ui_petition/feed.rs
@@ -58,7 +58,6 @@ pub(super) struct FedPetition {
 }
 
 /// Build the snapshot, push it, drain the queued lines, and fire the four events on their edges.
-#[allow(clippy::too_many_arguments)]
 pub(super) fn feed_petition(
     script: Option<NonSendMut<UiScript>>,
     registrar: Res<GuildRegistrarState>,
@@ -219,7 +218,6 @@ pub(super) fn feed_petition(
 /// flight, a record is cached, and we are **not** its owner. Closing somebody else's charter tells
 /// them so. `CloseGuildRegistrar`, by contrast, really does send nothing — verified by a closure
 /// walk that found no `CDataStore` build on its whole path.
-#[allow(clippy::too_many_arguments)]
 pub(super) fn drain_petition(
     script: Option<NonSendMut<UiScript>>,
     mut registrar: ResMut<GuildRegistrarState>,
diff --git a/crates/benilla-app/src/ui_quest.rs b/crates/benilla-app/src/ui_quest.rs
index 66c5e127..4d4a80e2 100644
--- a/crates/benilla-app/src/ui_quest.rs
+++ b/crates/benilla-app/src/ui_quest.rs
@@ -498,7 +498,6 @@ fn panel_event(panel: QuestPanel) -> &'static str {
 /// change → the panel's open event; same panel, content changed → `QUEST_ITEM_UPDATE`; closed →
 /// `QUEST_FINISHED`). Diffed against a `Local`, exactly like the gossip/merchant feeds. The NPC
 /// name rides as arg1 (resolved through the NameCache, ask-once — the merchant's pattern).
-#[allow(clippy::too_many_arguments)]
 fn feed_quest(
     script: Option<NonSendMut<UiScript>>,
     mut giver: ResMut<QuestGiver>,
diff --git a/crates/benilla-app/src/ui_quest_log.rs b/crates/benilla-app/src/ui_quest_log.rs
index 2f268dbd..5591b2bc 100644
--- a/crates/benilla-app/src/ui_quest_log.rs
+++ b/crates/benilla-app/src/ui_quest_log.rs
@@ -336,7 +336,6 @@ fn resolve_template_item(
 ///
 /// Still not emitted, and still gaps rather than errors (1156 §4): the `event` line and the
 /// reputation line.
-#[allow(clippy::too_many_arguments)]
 fn build_objectives(
     template: &QuestTemplate,
     log_slot: &QuestLogSlot,
@@ -542,7 +541,6 @@ fn order_groups(rows: &[GroupRow]) -> Vec<(i32, String, Vec<usize>)> {
 /// and push a [`QuestLogState`] snapshot on change (diffed against a `Local`, the crate's standard
 /// feed shape). Also refreshes [`QuestLog::active_quest_ids`]/`entry_slots` for the greeting split
 /// and the abandon drain.
-#[allow(clippy::too_many_arguments)]
 fn feed_quest_log(
     script: Option<NonSendMut<UiScript>>,
     self_q: Query<(&ObjectStore, &Guid), With<SelfPlayer>>,
diff --git a/crates/benilla-app/src/ui_script/buff_tests.rs b/crates/benilla-app/src/ui_script/buff_tests.rs
index afe1d717..e424ec60 100644
--- a/crates/benilla-app/src/ui_script/buff_tests.rs
+++ b/crates/benilla-app/src/ui_script/buff_tests.rs
@@ -69,7 +69,6 @@ fn harness() -> UiScript {
 
 /// Build an [`AuraState`] as the feed would push it. `expiration_time` 0 = permanent (no wire
 /// duration — the reference's "until cancelled"); the `GetTime()` clock starts at 0 in the harness.
-#[allow(clippy::too_many_arguments)]
 fn aura(
     spell_id: u32,
     name: &str,
diff --git a/crates/benilla-app/src/ui_script/extract/mod.rs b/crates/benilla-app/src/ui_script/extract/mod.rs
index b39e753b..72569ad2 100644
--- a/crates/benilla-app/src/ui_script/extract/mod.rs
+++ b/crates/benilla-app/src/ui_script/extract/mod.rs
@@ -387,7 +387,6 @@ fn splice_simple(eq: &benilla_ui::script::ExtractedQuad) -> bool {
 /// `booths.panes` is the one exception, because [`convert_entry`] writes it through the shared
 /// bridge; re-adding the same tokens is idempotent, so a verify run's panes end up where the full
 /// path would have put them anyway.
-#[allow(clippy::too_many_arguments)]
 fn verify_splice(
     prev: &GateInputs,
     quads: &UiQuads,
@@ -522,7 +521,6 @@ pub(crate) fn seat_text_measurer(script: &mut UiScript, atlas: &UiFontAtlas, sea
 /// p90 of 16 px of lag per frame at 640x360 while a guard walked (the `vpl` trace, 2026-09-10), and
 /// proportionally more at a real window. That is the director's "way more jittered when the
 /// creature is moving".
-#[allow(clippy::too_many_arguments)] // a Bevy system: each param is one resource, the app's convention
 pub(super) fn tick_script(
     script: Option<NonSendMut<UiScript>>,
     window: Query<&Window, With<PrimaryWindow>>,
@@ -776,7 +774,6 @@ pub(super) fn tick_script(
 /// walked after that camera exists. The re-resolve is what makes the plates' fresh anchors real —
 /// it is the layout ledger's incremental pass, so on a frame where nothing but the plates moved it
 /// solves the plates and nothing else.
-#[allow(clippy::too_many_arguments)] // a Bevy system: each param is one resource, the app's convention
 pub(super) fn paint_script(
     script: Option<NonSendMut<UiScript>>,
     window: Query<&Window, With<PrimaryWindow>>,
@@ -1381,7 +1378,6 @@ pub(super) fn paint_script(
 /// splice both call this, which is what makes the splice's output equal the full path's by
 /// construction. An arm is splice-eligible only if it writes nothing but `out` — keep
 /// [`splice_simple`] in agreement when an arm's side effects change.
-#[allow(clippy::too_many_arguments)] // the conversion's whole environment, threaded explicitly
 fn convert_entry(
     eq: benilla_ui::script::ExtractedQuad,
     s: f32,
diff --git a/crates/benilla-app/src/ui_script/frame_flag_gate.rs b/crates/benilla-app/src/ui_script/frame_flag_gate.rs
index 8289b15d..17f64443 100644
--- a/crates/benilla-app/src/ui_script/frame_flag_gate.rs
+++ b/crates/benilla-app/src/ui_script/frame_flag_gate.rs
@@ -436,8 +436,13 @@ fn describe(frame: &str, flag: Flag, ours: &str, theirs: &str) -> String {
 /// `parent="UIParent"` back on `BlackoutWorld` and it names that.
 #[test]
 fn the_shipped_frames_carry_the_references_flags() {
+    // Two gates, because the corpus and the manifest are two assets: the extracted reference
+    // dir below, and the chain `load_default_ui` reads — under `WOW_DATA=` (1451) the first is
+    // still there and the second is not.
+    let _data = benilla_formats::wow_data_or_skip!();
     let Some(reference) = reference_frames() else {
-        return; // no install — the same skip every client-data test here takes
+        eprintln!("skipping: no extracted reference FrameXML (WoW/_extracted_framexml)");
+        return;
     };
     let nesting = reference_nesting().expect("the same corpus the frames came from");
     assert!(
diff --git a/crates/benilla-app/src/ui_script/lifecycle.rs b/crates/benilla-app/src/ui_script/lifecycle.rs
index adbf603e..8217e932 100644
--- a/crates/benilla-app/src/ui_script/lifecycle.rs
+++ b/crates/benilla-app/src/ui_script/lifecycle.rs
@@ -46,7 +46,7 @@ pub(crate) fn setup_script(world: &mut World) {
 /// down at `0x490c97`). Because [`end_ui_session`] routes every login through here, every session's
 /// VM gets the registry and every `inherits="GameFontNormal"` in FrameXML resolves. A design that
 /// dropped the VM and skipped index 0 on the in-game load would fail exactly there — verified in
-/// wow-re's §5 for this change (1291).
+/// wow-re's §5 for this change (2277).
 fn install_boot_vm(world: &mut World) {
     let mut script = match UiScript::new() {
         Ok(s) => s,
@@ -857,7 +857,7 @@ pub(crate) fn arm_leaving_world_on_self_create(
 ///
 /// **The last step is not "destroy the Lua state"** — which is what three of wow-re's own notes
 /// said, until this client's teardown made the question load-bearing and a §5 cross-check settled
-/// it (`system/ui/scratch/lua-state-lifecycle.md`; 1291). `0x490c97` is the frame-script owner's
+/// it (`system/ui/scratch/lua-state-lifecycle.md`; 2277). `0x490c97` is the frame-script owner's
 /// scalar-deleting destructor — the widget tree and the native virtual-font registry — and the Lua
 /// state outlives it. The state is closed and re-opened at `0x703b80`, which reaches `InitLua` by a
 /// **tail-`jmp`** (`0x703b8e`) rather than a call, which is exactly why a call-census missed it.
diff --git a/crates/benilla-app/src/ui_script/mod.rs b/crates/benilla-app/src/ui_script/mod.rs
index 837d8774..837f1b35 100644
--- a/crates/benilla-app/src/ui_script/mod.rs
+++ b/crates/benilla-app/src/ui_script/mod.rs
@@ -488,7 +488,7 @@ impl Plugin for UiScriptPlugin {
                 Update,
                 (
                     extract::tick_script,
-                    input::feed_ui_input.run_if(in_state(crate::char_select::ClientState::InWorld)),
+                    input::feed_ui_input.in_set(crate::char_select::InWorldGated),
                 )
                     .chain()
                     .in_set(UiInput)
diff --git a/crates/benilla-app/src/ui_script/trainer_tests.rs b/crates/benilla-app/src/ui_script/trainer_tests.rs
index 862cb611..25f6023d 100644
--- a/crates/benilla-app/src/ui_script/trainer_tests.rs
+++ b/crates/benilla-app/src/ui_script/trainer_tests.rs
@@ -136,7 +136,6 @@ fn text_center(quads: &[ExtractedQuad], needle: &str) -> (f32, f32) {
 
 /// One service in a named skill line, spelling out every field so the intent is legible at the call
 /// site.
-#[allow(clippy::too_many_arguments)]
 fn service(
     spell_id: u32,
     name: &str,
diff --git a/crates/benilla-app/src/ui_session.rs b/crates/benilla-app/src/ui_session.rs
index 3a2da7fd..3ef4700b 100644
--- a/crates/benilla-app/src/ui_session.rs
+++ b/crates/benilla-app/src/ui_session.rs
@@ -169,7 +169,6 @@ pub(crate) struct InteractNpc(pub(crate) Option<Entity>, pub(crate) Option<u64>)
 /// no cross-system race over who owns the `"npc"` token — the sessions are mutually exclusive, and a
 /// bare `.or` chain is the whole rule. `Option<Res<_>>` keeps it safe in a headless test that mounts
 /// the portrait plugin without every window plugin.
-#[allow(clippy::too_many_arguments)]
 pub(crate) fn feed_interact_npc(
     gossip: Option<Res<crate::ui_gossip::GossipState>>,
     quest: Option<Res<crate::ui_quest::QuestGiver>>,
diff --git a/crates/benilla-app/src/ui_shapeshift.rs b/crates/benilla-app/src/ui_shapeshift.rs
index 291cf943..2a7d01c4 100644
--- a/crates/benilla-app/src/ui_shapeshift.rs
+++ b/crates/benilla-app/src/ui_shapeshift.rs
@@ -225,7 +225,7 @@ impl Plugin for UiShapeshiftPlugin {
 
 /// Build the bar list from the known-spell set × the catalog, per the module-doc mechanism, and
 /// diff-push it.
-#[allow(clippy::too_many_arguments, clippy::type_complexity)] // a Bevy system's full input set
+#[allow(clippy::type_complexity)] // a Bevy system's full input set
 fn feed_shapeshift_bar(
     script: Option<NonSendMut<UiScript>>,
     actions: Res<PlayerActions>,
diff --git a/crates/benilla-app/src/ui_social/feed.rs b/crates/benilla-app/src/ui_social/feed.rs
index 6e7d3f0a..86367804 100644
--- a/crates/benilla-app/src/ui_social/feed.rs
+++ b/crates/benilla-app/src/ui_social/feed.rs
@@ -60,7 +60,6 @@ pub(super) struct FedSocial {
 
 /// Build the display snapshot, push it to the VM, fire the list events, and drain the owed
 /// result lines.
-#[allow(clippy::too_many_arguments)] // a Bevy system's param list IS its dependency set
 pub(super) fn feed_social(
     script: Option<NonSendMut<UiScript>>,
     mut social: ResMut<SocialState>,
diff --git a/crates/benilla-app/src/ui_spellbook.rs b/crates/benilla-app/src/ui_spellbook.rs
index aaac0715..f8e50e4d 100644
--- a/crates/benilla-app/src/ui_spellbook.rs
+++ b/crates/benilla-app/src/ui_spellbook.rs
@@ -145,7 +145,6 @@ struct FeedMemory {
     self_present: gate::Watch,
 }
 
-#[allow(clippy::too_many_arguments)] // a Bevy system's full input set
 fn feed_spellbook(
     script: Option<NonSendMut<UiScript>>,
     actions: Res<PlayerActions>,
diff --git a/crates/benilla-app/src/ui_stable.rs b/crates/benilla-app/src/ui_stable.rs
index 38dfe80e..290c5835 100644
--- a/crates/benilla-app/src/ui_stable.rs
+++ b/crates/benilla-app/src/ui_stable.rs
@@ -193,7 +193,6 @@ fn resolve_pet(
 }
 
 /// Build the Lua-facing snapshot from [`StableOpen`] — `None` when no stable is open.
-#[allow(clippy::too_many_arguments)]
 fn snapshot(
     open: &StableOpen,
     names: &mut NameCache,
@@ -228,7 +227,6 @@ fn snapshot(
 
 /// Push the current stable into the VM and fire the show/update/close events on a transition (or a
 /// content change). Diffed against a `Local` memory, exactly like the trainer/merchant feeds.
-#[allow(clippy::too_many_arguments)] // the resolver's full catalog set
 fn feed_stable(
     script: Option<NonSendMut<UiScript>>,
     // ResMut only to consume the fresh-list latch; the feed never authors stable content.
diff --git a/crates/benilla-app/src/ui_tabard.rs b/crates/benilla-app/src/ui_tabard.rs
index 2260e892..0a3bb672 100644
--- a/crates/benilla-app/src/ui_tabard.rs
+++ b/crates/benilla-app/src/ui_tabard.rs
@@ -149,7 +149,6 @@ pub(crate) fn preflight(
     Ok(design.map(|v| v as u32))
 }
 
-#[allow(clippy::too_many_arguments)]
 fn feed_tabard(
     script: Option<NonSendMut<UiScript>>,
     mut open: ResMut<TabardOpen>,
diff --git a/crates/benilla-app/src/ui_talent.rs b/crates/benilla-app/src/ui_talent.rs
index 2d314558..117d76b1 100644
--- a/crates/benilla-app/src/ui_talent.rs
+++ b/crates/benilla-app/src/ui_talent.rs
@@ -97,7 +97,6 @@ struct FeedMemory {
     points: Option<(u32, u32)>,
 }
 
-#[allow(clippy::too_many_arguments)] // a Bevy system's param list IS its dependency set
 fn feed_talents(
     script: Option<NonSendMut<UiScript>>,
     talents: Option<Res<Talents>>,
@@ -222,7 +221,6 @@ fn rank_of(t: &Talent, known: &BTreeSet<u32>) -> u32 {
 }
 
 /// Build the pushed snapshot — the app's whole resolve (module doc).
-#[allow(clippy::too_many_arguments)] // the catalogs, the player's state, and the string table
 pub(crate) fn build_pages(
     catalog: &TalentCatalog,
     known: &BTreeSet<u32>,
diff --git a/crates/benilla-app/src/ui_taxi/mod.rs b/crates/benilla-app/src/ui_taxi/mod.rs
index 9c5a0023..2654348e 100644
--- a/crates/benilla-app/src/ui_taxi/mod.rs
+++ b/crates/benilla-app/src/ui_taxi/mod.rs
@@ -130,7 +130,6 @@ impl NpcSession for TaxiState {
 /// on `OK` instead — the flight starts and the map has nothing left to show), present a
 /// first-visit discovery, and push the `UnitOnTaxi` ride flag off [`Player::server_riding`].
 /// Diffed against `Local` memory, the trainer/merchant feed shape.
-#[allow(clippy::too_many_arguments)]
 fn feed_taxi(
     script: Option<NonSendMut<UiScript>>,
     mut state: ResMut<TaxiState>,
diff --git a/crates/benilla-app/src/ui_text/layout/mod.rs b/crates/benilla-app/src/ui_text/layout/mod.rs
index ff3a911b..50c35b2b 100644
--- a/crates/benilla-app/src/ui_text/layout/mod.rs
+++ b/crates/benilla-app/src/ui_text/layout/mod.rs
@@ -201,7 +201,6 @@ pub(crate) struct LinkSpan {
 /// line block vertically (default `Middle`, the client's FontString default; degenerate zero-height
 /// rects keep top). Each line is measured once (a first pass laying glyphs at a zero line-origin),
 /// then shifted by the justification offset.
-#[allow(clippy::too_many_arguments)] // the shared layout context, plus the seat
 pub(crate) fn layout_text_quads(
     e: &mut TextEngine,
     text: &str,
@@ -218,7 +217,6 @@ pub(crate) fn layout_text_quads(
 /// [`layout_text_quads`] that also collects the laid-out [`LinkSpan`]s — the message-frame path
 /// (chat lines carry `|H` item/player links; the app feeds the spans back to the engine's click
 /// hit-test, `benilla_ui::script::UiScript::set_link_spans`).
-#[allow(clippy::too_many_arguments)] // the shared layout context, plus one out-param
 pub(crate) fn layout_text_quads_links(
     e: &mut TextEngine,
     text: &str,
@@ -243,7 +241,6 @@ pub(crate) fn layout_text_quads_links(
     )
 }
 
-#[allow(clippy::too_many_arguments)] // the public pair above is the real surface; this is their body
 fn layout_text_quads_inner(
     e: &mut TextEngine,
     text: &str,
diff --git a/crates/benilla-app/src/ui_tooltip/mod.rs b/crates/benilla-app/src/ui_tooltip/mod.rs
index 2e7ce490..3919a397 100644
--- a/crates/benilla-app/src/ui_tooltip/mod.rs
+++ b/crates/benilla-app/src/ui_tooltip/mod.rs
@@ -422,7 +422,6 @@ struct SpellFeedMemory {
 /// display + next-rank reads), and the live aura spells (`SetPlayerBuff`) — so a first hover
 /// never misses, exactly like the reference's all-local reads. The renderers' recorded asks
 /// (the odd id outside those sets) answer through the same build as the fallback.
-#[allow(clippy::too_many_arguments)]
 fn feed_spell_tooltips(
     script: Option<NonSendMut<UiScript>>,
     actions: Option<Res<PlayerActions>>,
@@ -697,7 +696,6 @@ fn locked_line_tint(outcome: Option<crate::target::lock::LockOutcome>) -> Toolti
     }
 }
 
-#[allow(clippy::too_many_arguments)]
 fn drive_mouseover_tooltip(
     script: Option<NonSendMut<UiScript>>,
     hovered: Res<Hovered>,
diff --git a/crates/benilla-app/src/ui_trade.rs b/crates/benilla-app/src/ui_trade.rs
index ddf001de..8bb1cc05 100644
--- a/crates/benilla-app/src/ui_trade.rs
+++ b/crates/benilla-app/src/ui_trade.rs
@@ -594,7 +594,6 @@ fn streamed_player<'a>(
     index.0.get(&guid).and_then(|e| stores.get(*e).ok())
 }
 
-#[allow(clippy::too_many_arguments)]
 fn answer_trade_request(
     mut trade: ResMut<TradeSession>,
     commands: Res<NetCommands>,
@@ -827,7 +826,6 @@ fn snapshot(
 /// against `Local` memory, exactly like the mail/merchant feeds. The accept-update fires **after** the
 /// show/update block so an open frame's `TRADE_SHOW` (which hides the highlights) is followed by the
 /// glow, not overwritten by it.
-#[allow(clippy::too_many_arguments)]
 fn feed_trade(
     script: Option<NonSendMut<UiScript>>,
     mut trade: ResMut<TradeSession>,
@@ -979,7 +977,6 @@ fn feed_trade(
 /// the token → player guid → `CMSG_INITIATE_TRADE` (recording the target so `OPEN_WINDOW` can name
 /// it); `AcceptTrade`/`CancelTradeAccept` → the accept/un-accept verbs (with the optimistic local
 /// glow); `CloseTrade` → `CMSG_CANCEL_TRADE` + a local clear.
-#[allow(clippy::too_many_arguments)]
 fn drain_trade(
     script: Option<NonSendMut<UiScript>>,
     mut trade: ResMut<TradeSession>,
diff --git a/crates/benilla-app/src/ui_tradeskill.rs b/crates/benilla-app/src/ui_tradeskill.rs
index 86bc3646..8be06620 100644
--- a/crates/benilla-app/src/ui_tradeskill.rs
+++ b/crates/benilla-app/src/ui_tradeskill.rs
@@ -240,7 +240,6 @@ fn recipe_icon(
 
 /// Build one recipe row: reagents/tools/product resolved through the ask-once template cache
 /// (`None` names re-resolve next frame when the template lands — the item-row precedent).
-#[allow(clippy::too_many_arguments)] // the resolver's full catalog set
 fn resolve_recipe(
     spell_id: u32,
     rank: u32,
@@ -365,7 +364,6 @@ fn resolve_recipe(
 /// Build the book: the known attr-`0x20` recipes of the open line, difficulty-banded against the
 /// current rank. No sort applied here — the engine owns ALL ordering (group + tier + name, the
 /// VERIFIED two-level law, decision 0446 wow-re `tradeskill` TU-B).
-#[allow(clippy::too_many_arguments)] // a Bevy system's full input set (the feed precedent)
 fn feed_trade_skill(
     script: Option<NonSendMut<UiScript>>,
     open: Res<TradeSkillOpen>,
diff --git a/crates/benilla-app/src/ui_trainer/mod.rs b/crates/benilla-app/src/ui_trainer/mod.rs
index aaec197f..cda01873 100644
--- a/crates/benilla-app/src/ui_trainer/mod.rs
+++ b/crates/benilla-app/src/ui_trainer/mod.rs
@@ -186,7 +186,6 @@ fn train_error_log_line(code: u32) -> &'static str {
 /// the ability-req names + rank from the same spell catalog, the state/cost/gates straight off the
 /// wire. `known` is the player's known-spell set ([`PlayerActions::spells`]) — each prerequisite
 /// ability is coloured by whether the player already knows that specific spell (see below).
-#[allow(clippy::too_many_arguments)] // the resolver's full catalog set
 fn resolve_service(
     wire: &TrainerSpell,
     trainer_type: u32,
@@ -305,7 +304,6 @@ fn resolve_service(
 
 /// Build the Lua-facing snapshot from [`TrainerOpen`] + the spell/skill catalogs — `None` when no
 /// trainer is open.
-#[allow(clippy::too_many_arguments)] // the catalogs, the player's state, and the string table
 fn snapshot(
     open: &TrainerOpen,
     spells: &SpellCatalog,
@@ -347,7 +345,6 @@ fn snapshot(
 /// content change). Diffed against a `Local` memory, exactly like the gossip/merchant feeds. A
 /// different trainer while the window is already open is a real close+open (the client's `ShowUIPanel`
 /// early-returns when visible, so the open sound only re-plays after a hide — decision 0096).
-#[allow(clippy::too_many_arguments)]
 fn feed_trainer(
     script: Option<NonSendMut<UiScript>>,
     // ResMut only to consume the fresh-packet latch below — the feed never authors trainer content.
diff --git a/crates/benilla-app/src/ui_unit.rs b/crates/benilla-app/src/ui_unit.rs
index 95f23c9e..970a3d3b 100644
--- a/crates/benilla-app/src/ui_unit.rs
+++ b/crates/benilla-app/src/ui_unit.rs
@@ -1577,7 +1577,6 @@ pub(crate) fn fire_transitions(
     }
 }
 
-#[allow(clippy::too_many_arguments)]
 fn feed_units(
     script: Option<NonSendMut<UiScript>>,
     // `ChrClasses.dbc` field 16, the only thing `UnitHasRelicSlot` reads. Absent when the client
diff --git a/crates/benilla-app/src/ui_world_map.rs b/crates/benilla-app/src/ui_world_map.rs
index 517f7537..8015167d 100644
--- a/crates/benilla-app/src/ui_world_map.rs
+++ b/crates/benilla-app/src/ui_world_map.rs
@@ -561,7 +561,6 @@ struct FeedMemos {
     map_synced: bool,
 }
 
-#[allow(clippy::too_many_arguments)]
 fn feed_world_map(
     script: Option<NonSendMut<UiScript>>,
     data: Option<Res<WorldMapUiData>>,
@@ -816,7 +815,6 @@ fn feed_world_map(
 /// also runs and drills into the clicked zone, which is what you want anyway — you arrive, and the
 /// map is showing where you arrived. Adding a modifier fork to the reference's click law to
 /// suppress that would be a dev affordance rewriting a faithful one.
-#[allow(clippy::too_many_arguments)]
 fn dev_map_jump(
     buttons: Res<ButtonInput<MouseButton>>,
     keys: Res<ButtonInput<KeyCode>>,
diff --git a/crates/benilla-app/src/vplates.rs b/crates/benilla-app/src/vplates.rs
index 7b514acd..cadc2d52 100644
--- a/crates/benilla-app/src/vplates.rs
+++ b/crates/benilla-app/src/vplates.rs
@@ -56,7 +56,7 @@
 //!   (The questgiver marker raises for a live plate too — a director-pinned DEVIATION: the
 //!   reference really does sit low under a plate (byte-verified, wow-re `questgiver-marker.md`
 //!   Q4a) and the director rejected that overlap; rationale on `quest_markers::pose_markers`,
-//!   0408/0409.)
+//!   2274/2275.)
 //!
 //! (The skull's trivial-gray leg is the shared grey check, [`benilla_ui::script::unit_is_grey`]
 //! — `0x5f0700`, §5-VERIFIED 2026-07-17, the same one the tooltip/quest-range APIs read; it is
@@ -441,7 +441,7 @@ struct PlateWorld<'w, 's> {
 /// name-exclusivity verdict), seat each one, and hand the result to the widget layer as
 /// [`PlateState`] — at constant screen size over the projected anchor + 2/3 yd. Runs after
 /// the script extract), after the targeting chain (it reads the frame's selection verdict).
-#[allow(clippy::too_many_arguments, clippy::type_complexity)] // one Bevy system's full input set
+#[allow(clippy::type_complexity)] // one Bevy system's full input set
 fn drive_vplates(
     mode: Res<VPlateMode>,
     mut plates: ResMut<VPlates>,
diff --git a/crates/benilla-app/tests/message_keys.rs b/crates/benilla-app/tests/message_keys.rs
index 7a75310b..25a673b3 100644
--- a/crates/benilla-app/tests/message_keys.rs
+++ b/crates/benilla-app/tests/message_keys.rs
@@ -111,10 +111,7 @@ fn every_error_key_in_the_source_resolves_to_real_text() {
         "ERR_PET_SPELL_NOPATH",
     ];
 
-    let data = match benilla_formats::wow_data() {
-        Some(d) => d,
-        None => return,
-    };
+    let data = benilla_formats::wow_data_or_skip!();
     let mut chain = benilla_formats::open_chain(&data).expect("open chain");
     let src = chain
         .read_file("Interface\\FrameXML\\GlobalStrings.lua")
@@ -179,10 +176,7 @@ fn every_voiced_key_the_source_raises_has_audio_for_every_playable_race() {
         (0x31, 2, 0), // ERR_MUST_EQUIP_ITEM, Orc male
     ];
 
-    let data = match benilla_formats::wow_data() {
-        Some(d) => d,
-        None => return,
-    };
+    let data = benilla_formats::wow_data_or_skip!();
     let mut chain = benilla_formats::open_chain(&data).expect("open chain");
     let vocal = benilla_formats::load_vocal_ui_sounds(&mut chain).expect("VocalUISounds.dbc");
     let kits = benilla_formats::load_sound_kit_catalog(&mut chain).expect("SoundEntries.dbc");
@@ -249,10 +243,7 @@ fn every_voiced_key_the_source_raises_has_audio_for_every_playable_race() {
 /// than alongside it. Skips without client data.
 #[test]
 fn every_sounding_catalog_row_also_has_text_to_show() {
-    let data = match benilla_formats::wow_data() {
-        Some(d) => d,
-        None => return,
-    };
+    let data = benilla_formats::wow_data_or_skip!();
     let mut chain = benilla_formats::open_chain(&data).expect("open chain");
     let src = chain
         .read_file("Interface\\FrameXML\\GlobalStrings.lua")
diff --git a/crates/benilla-app/tests/reference_strings.rs b/crates/benilla-app/tests/reference_strings.rs
index 1f81a914..70ec307c 100644
--- a/crates/benilla-app/tests/reference_strings.rs
+++ b/crates/benilla-app/tests/reference_strings.rs
@@ -201,10 +201,7 @@ fn resolves(body: &str) -> bool {
 
 #[test]
 fn no_user_facing_sentence_is_written_in_rust_when_the_reference_ships_one() {
-    let data = match benilla_formats::wow_data() {
-        Some(d) => d,
-        None => return,
-    };
+    let data = benilla_formats::wow_data_or_skip!();
     let mut chain = benilla_formats::open_chain(&data).expect("open chain");
     let mut shipped: HashMap<String, Vec<String>> = HashMap::new();
     // The base tables AND the locale patches laid over them (decision 2052): where `Localize()`
diff --git a/crates/benilla-app/tests/ui_script_wall.rs b/crates/benilla-app/tests/ui_script_wall.rs
new file mode 100644
index 00000000..bedad844
--- /dev/null
+++ b/crates/benilla-app/tests/ui_script_wall.rs
@@ -0,0 +1,112 @@
+//! **The reverse wall of decision 1177, measured** — how many files in `benilla-app` outside the
+//! VM's own module name `UiScript`.
+//!
+//! 1177 (2026-08-10) drew the line: the feed layer becomes one module, the only legitimate caller
+//! of the Lua VM, and everything else produces model values. Its instrument was 1160's — a wall
+//! test in `tests/` whose number is ratcheted down by the work — and it named the number: **141
+//! files**. The instrument was never built, and with nothing failing the count went the other
+//! way: 164 files by 2026-09-16 (decision 2265 §A3). This file is the instrument. It does not
+//! decide whether the crate move happens — that stays the director's — it only makes the number
+//! visible on every test run and refuses to let it grow unnoticed.
+//!
+//! "Outside the VM's module" means any `.rs` under `crates/benilla-app/src` whose path does not
+//! start with `ui_script/`; 1177's "feed module" does not exist yet, and when it does the
+//! exclusion moves there. A file counts if it contains the identifier `UiScript` at all — a type
+//! in a parameter list, a `use`, a doc comment naming the seam: each is a place that knows the
+//! FrameXML VM exists, which is the coupling 1177 measures.
+//!
+//! Same shape as `world_api_wall.rs`: `CEILING` is the standing count, `SLACK` keeps a single
+//! closure from failing the gate while making it impossible to bank a whole stage of work without
+//! writing the new number down. `WOW_UISCRIPT_DUMP=1` prints the files.
+
+use std::path::{Path, PathBuf};
+
+/// The standing count. **2026-09-16, 164** — measured the day the instrument was built, against
+/// 1177's 141 five weeks earlier.
+const CEILING: usize = 164;
+
+/// How far under [`CEILING`] the count may sit before the test asks for the ceiling to follow it.
+const SLACK: usize = 8;
+
+#[test]
+fn the_vm_is_named_by_no_more_files_than_the_ceiling_says() {
+    let src = Path::new(env!("CARGO_MANIFEST_DIR")).join("src");
+    let mut files: Vec<String> = rs_files(&src)
+        .into_iter()
+        .filter_map(|p| {
+            let rel = p
+                .strip_prefix(&src)
+                .unwrap_or(&p)
+                .to_string_lossy()
+                .replace('\\', "/");
+            if rel.starts_with("ui_script/") || rel == "ui_script.rs" {
+                return None;
+            }
+            let text = std::fs::read_to_string(&p).ok()?;
+            names_ident(&text, "UiScript").then_some(rel)
+        })
+        .collect();
+    files.sort();
+    let n = files.len();
+    eprintln!("files outside ui_script/ naming UiScript: {n} (ceiling {CEILING}, slack {SLACK})");
+    if std::env::var("WOW_UISCRIPT_DUMP").is_ok() {
+        eprintln!("{}", files.join("\n"));
+    }
+    assert!(
+        n <= CEILING,
+        "{n} files outside ui_script/ name UiScript; the ceiling is {CEILING}.\n\
+         A new file learned that the FrameXML VM exists. Decision 1177's line is that only the \
+         feed layer may know; either feed a model value instead, or — if this file genuinely is \
+         feed code — raise CEILING here with the reason, the way world_api_wall.rs requires.\n\
+         WOW_UISCRIPT_DUMP=1 lists the files."
+    );
+    assert!(
+        n + SLACK >= CEILING,
+        "only {n} files name UiScript and the ceiling still says {CEILING}. Lower CEILING to {n} \
+         in this file so the next coupling has to earn its place — the ratchet only holds if the \
+         number follows the work down."
+    );
+}
+
+/// Does `text` contain `ident` as a whole identifier (not as part of a longer one)?
+fn names_ident(text: &str, ident: &str) -> bool {
+    let is_ident = |c: char| c.is_alphanumeric() || c == '_';
+    let mut from = 0;
+    while let Some(i) = text[from..].find(ident) {
+        let at = from + i;
+        let end = at + ident.len();
+        let before_ok = at == 0 || !text[..at].chars().next_back().is_some_and(is_ident);
+        let after_ok = !text[end..].chars().next().is_some_and(is_ident);
+        if before_ok && after_ok {
+            return true;
+        }
+        from = end;
+    }
+    false
+}
+
+fn rs_files(dir: &Path) -> Vec<PathBuf> {
+    let mut out = Vec::new();
+    let mut stack = vec![dir.to_path_buf()];
+    while let Some(d) = stack.pop() {
+        for e in std::fs::read_dir(&d).into_iter().flatten().flatten() {
+            let p = e.path();
+            if p.is_dir() {
+                stack.push(p);
+            } else if p.extension().is_some_and(|x| x == "rs") {
+                out.push(p);
+            }
+        }
+    }
+    out.sort();
+    out
+}
+
+#[test]
+fn the_identifier_match_is_whole_word() {
+    assert!(names_ident("fn f(s: NonSendMut<UiScript>)", "UiScript"));
+    assert!(names_ident("UiScript", "UiScript"));
+    assert!(!names_ident("UiScriptPlugin only", "UiScript"));
+    assert!(!names_ident("MyUiScript", "UiScript"));
+    assert!(names_ident("MyUiScript and UiScript", "UiScript"));
+}
diff --git a/crates/benilla-app/tests/world_api_wall.rs b/crates/benilla-app/tests/world_api_wall.rs
index 62ba79e9..977ec1a5 100644
--- a/crates/benilla-app/tests/world_api_wall.rs
+++ b/crates/benilla-app/tests/world_api_wall.rs
@@ -103,7 +103,14 @@ const INSTRUMENT_ROOTS: &[&str] = &["art_scope", "debug_panel", "perf", "pipe_wa
 /// So they are excluded from the gated number and **counted separately**, because a rule that
 /// hides a number is worse than no rule. `art_scope` is not here: it is registered by
 /// `WorldPlugins` and lives inside the engine, so it never crosses.
-const INSTRUMENT_CONSUMERS: &[&str] = &["debug_panel", "perf", "pipe_warm"];
+///
+/// `crash` (decision 2266 §B2) is the fourth: the panic hook that writes the crash report. It is
+/// `perf::stall`'s sibling — a diagnostic that writes into `Diagnostics/` and nothing gameplay
+/// reads — and the one engine item it names, `log_ring::recent`, is a diagnostic feed kept beside
+/// the engine's `LogPlugin` because that is where the layer has to be installed. An API shaped
+/// by what a crash report wanted to attach is 1163's failure exactly, so it is counted here, not
+/// in the doorway.
+const INSTRUMENT_CONSUMERS: &[&str] = &["crash", "debug_panel", "perf", "pipe_warm"];
 
 /// Is this file one of the app-side instruments?
 fn is_instrument_consumer(rel: &str) -> bool {
diff --git a/crates/benilla-assets/Cargo.toml b/crates/benilla-assets/Cargo.toml
index 9107b56d..359e8062 100644
--- a/crates/benilla-assets/Cargo.toml
+++ b/crates/benilla-assets/Cargo.toml
@@ -5,6 +5,9 @@ edition.workspace = true
 license.workspace = true
 description = "Bevy AssetSource + AssetLoaders over the WoW 1.12.1 MPQ patch chain"
 
+[lints]
+workspace = true
+
 [features]
 # Forwarded dev/player seam (0026 · 1173/1174 · 1175). Default-on. `benilla-formats` must be taken
 # with `default-features = false` and its `dev` re-exported here: it is default-on there too, so
diff --git a/crates/benilla-assets/src/world_assets/mod.rs b/crates/benilla-assets/src/world_assets/mod.rs
index c46e8d73..4416ffcd 100644
--- a/crates/benilla-assets/src/world_assets/mod.rs
+++ b/crates/benilla-assets/src/world_assets/mod.rs
@@ -654,8 +654,6 @@ impl WorldAssets {
     /// A `StandardMaterial` for a model submesh, deduped by (texture, blend) so submeshes/models
     /// sharing a texture share one material handle (enabling draw-call batching). A missing/failed
     /// texture falls back to a single shared untextured material.
-    #[allow(clippy::too_many_arguments)]
-    #[allow(clippy::too_many_arguments)]
     pub fn model_material(
         &mut self,
         texture: Option<&str>,
diff --git a/crates/benilla-blp/Cargo.toml b/crates/benilla-blp/Cargo.toml
index ef182020..c0c84dae 100644
--- a/crates/benilla-blp/Cargo.toml
+++ b/crates/benilla-blp/Cargo.toml
@@ -5,6 +5,9 @@ edition.workspace = true
 license.workspace = true
 description = "BLP2 texture decoder for WoW 1.12.1 (build 5875) — in-repo, decision 0021"
 
+[lints]
+workspace = true
+
 [dependencies]
 benilla-bytes = { path = "../benilla-bytes" }
 # S3TC/DXT block decompression — the same fixed-point codec wow-blp uses, so DXT output is
diff --git a/crates/benilla-blp/src/lib.rs b/crates/benilla-blp/src/lib.rs
index 8660c55c..ab6f740c 100644
--- a/crates/benilla-blp/src/lib.rs
+++ b/crates/benilla-blp/src/lib.rs
@@ -524,7 +524,6 @@ mod tests {
     use super::*;
 
     /// Build a minimal-but-complete BLP2 header (magic..=mip_sizes[16], `HEADER_SIZE` bytes).
-    #[allow(clippy::too_many_arguments)]
     fn header(
         compression: u8,
         alpha_bits: u8,
diff --git a/crates/benilla-buildstamp/Cargo.toml b/crates/benilla-buildstamp/Cargo.toml
index 04915de5..690ae057 100644
--- a/crates/benilla-buildstamp/Cargo.toml
+++ b/crates/benilla-buildstamp/Cargo.toml
@@ -5,6 +5,9 @@ edition.workspace = true
 license.workspace = true
 description = "The git build-id stamp emitter shared by the launcher shims' build scripts (decision 0993/1160)"
 
+[lints]
+workspace = true
+
 [lib]
 # A build-dependency only. No tests, no bevy, no app deps — it runs inside cargo's build-script
 # pass and must stay trivially cheap to compile.
diff --git a/crates/benilla-bytes/Cargo.toml b/crates/benilla-bytes/Cargo.toml
index 1f48c4bc..ba42e121 100644
--- a/crates/benilla-bytes/Cargo.toml
+++ b/crates/benilla-bytes/Cargo.toml
@@ -5,4 +5,7 @@ edition.workspace = true
 license.workspace = true
 description = "Bounds-checked byte readers + IFF chunk iteration shared by the format parsers — decision 0064"
 
+[lints]
+workspace = true
+
 [dependencies]
diff --git a/crates/benilla-dbc/Cargo.toml b/crates/benilla-dbc/Cargo.toml
index b5bd99f2..4bf84425 100644
--- a/crates/benilla-dbc/Cargo.toml
+++ b/crates/benilla-dbc/Cargo.toml
@@ -5,5 +5,8 @@ edition.workspace = true
 license.workspace = true
 description = "WDBC (client DBC) reader for WoW 1.12.1 (build 5875) — in-repo, decision 0021"
 
+[lints]
+workspace = true
+
 [dependencies]
 benilla-bytes = { path = "../benilla-bytes" }
diff --git a/crates/benilla-formats/Cargo.toml b/crates/benilla-formats/Cargo.toml
index 90d33937..d018a5ad 100644
--- a/crates/benilla-formats/Cargo.toml
+++ b/crates/benilla-formats/Cargo.toml
@@ -5,6 +5,9 @@ edition.workspace = true
 license.workspace = true
 description = "WoW 1.12.1 asset-format adapters (MPQ/BLP/DBC/ADT/WDT) and the benilla-extract CLI"
 
+[lints]
+workspace = true
+
 [features]
 # The dev/player seam (0026, built by 1173/1174). Default-on, so every normal build keeps the
 # instruments; `--no-default-features` is the player build. Here it gates exactly one thing:
diff --git a/crates/benilla-formats/examples/dump_bone_keys.rs b/crates/benilla-formats/examples/dump_bone_keys.rs
index 5cef3387..95ee8f3e 100644
--- a/crates/benilla-formats/examples/dump_bone_keys.rs
+++ b/crates/benilla-formats/examples/dump_bone_keys.rs
@@ -1,7 +1,7 @@
 //! Session probe: which bones carry keys in a given sequence — `cargo run -p benilla-formats
 //! --example dump_bone_keys <file.m2> <anim_id> [bone ...]`. With bone indices, prints their
 //! key counts + first rotation keys; without, lists every keyed bone. Extract the file first
-//! via `mpqx` (benilla-mpq). Built for the nocked-ammo RE round (decision 0406 follow-up).
+//! via `mpqx` (benilla-mpq). Built for the nocked-ammo RE round (decision 2273 follow-up).
 
 fn main() {
     let mut args = std::env::args().skip(1);
diff --git a/crates/benilla-formats/src/characters/customization.rs b/crates/benilla-formats/src/characters/customization.rs
index e09e9056..8a067c64 100644
--- a/crates/benilla-formats/src/characters/customization.rs
+++ b/crates/benilla-formats/src/characters/customization.rs
@@ -563,7 +563,6 @@ mod tests {
     /// vmangos's `Player::ValidateAppearance`, transcribed verbatim (`Player.cpp:326`): the exact
     /// predicate the server runs on `CMSG_CHAR_CREATE`. `GetCharSectionEntry` is an available-row
     /// lookup (`avail` already excludes the `0x1`-flagged rows), and face is keyed by *skinColor*.
-    #[allow(clippy::too_many_arguments)] // mirrors vmangos's 7-param signature + the two data tables
     fn validate_appearance(
         avail: &HashSet<SectionKey>,
         facial: &HashMap<(u8, u8), HashSet<u8>>,
diff --git a/crates/benilla-formats/src/characters/sections.rs b/crates/benilla-formats/src/characters/sections.rs
index d8eaf0a7..ad251850 100644
--- a/crates/benilla-formats/src/characters/sections.rs
+++ b/crates/benilla-formats/src/characters/sections.rs
@@ -244,7 +244,6 @@ impl CharSections {
     ///
     /// `emblem` is the wearer's guild tabard (decision 1704), which paints the torso layers' cells
     /// 2/3/4 over the garment's own — see [`equip_blits`] for when it installs and when it does not.
-    #[allow(clippy::too_many_arguments)]
     pub fn composite_body(
         &self,
         chain: &mut Chain,
diff --git a/crates/benilla-formats/src/lib.rs b/crates/benilla-formats/src/lib.rs
index 88d94c2f..2fc20047 100644
--- a/crates/benilla-formats/src/lib.rs
+++ b/crates/benilla-formats/src/lib.rs
@@ -845,7 +845,6 @@ mod tests {
 
     /// A minimal, complete BLP2 header (magic..=mip_sizes[16], 148 bytes) — mirrors the private
     /// builder in `benilla_blp`'s own tests (that crate's helper isn't exported).
-    #[allow(clippy::too_many_arguments)]
     fn blp2_header(
         compression: u8,
         alpha_bits: u8,
diff --git a/crates/benilla-formats/src/light.rs b/crates/benilla-formats/src/light.rs
index bd9b4c89..abc5df50 100644
--- a/crates/benilla-formats/src/light.rs
+++ b/crates/benilla-formats/src/light.rs
@@ -584,7 +584,6 @@ impl LightCatalog {
     /// (`1` inside `falloffStart`, ramping to `0` at `falloffEnd`). Contrast with [`pick_light`], which
     /// picks just the single most-local sphere — this tells us whether a faithful blend resolves a
     /// **different** (e.g. redder) light at our spot than the single-sample approximation.
-    #[allow(clippy::too_many_arguments)]
     pub fn sample_blended(
         &self,
         map: u32,
diff --git a/crates/benilla-formats/src/spell_visual/tests.rs b/crates/benilla-formats/src/spell_visual/tests.rs
index b2042096..ddd377ef 100644
--- a/crates/benilla-formats/src/spell_visual/tests.rs
+++ b/crates/benilla-formats/src/spell_visual/tests.rs
@@ -27,7 +27,6 @@ fn u32le(v: u32) -> [u8; 4] {
 
 /// One `SpellVisual` row: id, the five stage kits, then the missile block — field 7 (model
 /// effect id) and field 9 (dest-attach ordinal) live, the rest zeroed to fill 16 fields.
-#[allow(clippy::too_many_arguments)]
 fn spell_visual_row(
     id: u32,
     precast: u32,
diff --git a/crates/benilla-m2/Cargo.toml b/crates/benilla-m2/Cargo.toml
index a6923e78..3840f2f3 100644
--- a/crates/benilla-m2/Cargo.toml
+++ b/crates/benilla-m2/Cargo.toml
@@ -5,5 +5,8 @@ edition.workspace = true
 license.workspace = true
 description = "M2 (MD20) model reader for WoW 1.12.1 (build 5875) — in-repo, decision 0021"
 
+[lints]
+workspace = true
+
 [dependencies]
 benilla-bytes = { path = "../benilla-bytes" }
diff --git a/crates/benilla-m2/examples/dump_attach.rs b/crates/benilla-m2/examples/dump_attach.rs
index d7e56d37..5685233e 100644
--- a/crates/benilla-m2/examples/dump_attach.rs
+++ b/crates/benilla-m2/examples/dump_attach.rs
@@ -1,6 +1,6 @@
 //! Session probe: dump an M2's attachment table (+ each attach bone's parent/pivot) —
 //! `cargo run -p benilla-m2 --example dump_attach <file.m2>`. Extract the file first via
-//! `mpqx` (benilla-mpq). Built for the nocked-ammo RE round (decision 0406 follow-up), kept
+//! `mpqx` (benilla-mpq). Built for the nocked-ammo RE round (decision 2273 follow-up), kept
 //! because "which attach ids does this model actually have" keeps coming up.
 
 use std::io::Cursor;
diff --git a/crates/benilla-m2/examples/dump_skin.rs b/crates/benilla-m2/examples/dump_skin.rs
index ed94bcdb..1ed6e927 100644
--- a/crates/benilla-m2/examples/dump_skin.rs
+++ b/crates/benilla-m2/examples/dump_skin.rs
@@ -1,6 +1,6 @@
 //! Session probe: dump an M2's skin-0 sections/batches with material + texture resolution —
 //! `cargo run -p benilla-m2 --example dump_skin <file.m2>`. Extract the file first via `mpqx`
-//! (benilla-mpq). Built for the bowstring round (decision 0406 follow-up), kept because "why is
+//! (benilla-mpq). Built for the bowstring round (decision 2273 follow-up), kept because "why is
 //! this submesh (not) rendering" keeps coming up.
 
 use std::io::Cursor;
diff --git a/crates/benilla-mpq/Cargo.toml b/crates/benilla-mpq/Cargo.toml
index ea4d5ebf..1f9dd5c5 100644
--- a/crates/benilla-mpq/Cargo.toml
+++ b/crates/benilla-mpq/Cargo.toml
@@ -5,6 +5,9 @@ edition.workspace = true
 license.workspace = true
 description = "Read-only MPQ archive reader for WoW 1.12.1 (build 5875) — in-repo, decision 0021"
 
+[lints]
+workspace = true
+
 [dependencies]
 # Bounds-checked byte readers + the allocation-cap guard (decision 0064). MPQ migrates minimally: the
 # hand-rolled rd_u16/rd_u32 move to ByteExt and the header/block-table/sector allocations get capped;
diff --git a/crates/benilla-protocol/Cargo.toml b/crates/benilla-protocol/Cargo.toml
index 7bada359..9c857205 100644
--- a/crates/benilla-protocol/Cargo.toml
+++ b/crates/benilla-protocol/Cargo.toml
@@ -5,6 +5,9 @@ edition.workspace = true
 license.workspace = true
 description = "WoW 1.12.1 auth (SRP6) + world wire protocol and the benilla-auth CLI"
 
+[lints]
+workspace = true
+
 [dependencies]
 anyhow.workspace = true
 clap.workspace = true
diff --git a/crates/benilla-protocol/src/events.rs b/crates/benilla-protocol/src/events.rs
index 645e3f9b..c5bcb9f2 100644
--- a/crates/benilla-protocol/src/events.rs
+++ b/crates/benilla-protocol/src/events.rs
@@ -854,7 +854,7 @@ pub enum SessionEvent {
         misses: Vec<(u64, u8)>,
         target: Option<u64>,
         /// The GameObject an open-lock cast launched at (`TARGET_FLAG_GAMEOBJECT`) — opens a chest lid /
-        /// locked door (decision 0250). `None` for a unit spell.
+        /// locked door (decision 2271). `None` for a unit spell.
         go_target: Option<u64>,
         /// The ground point a dest-targeted cast launched at (`TARGET_FLAG_DEST_LOCATION`), raw
         /// WoW coords — where a ground AOE's launch-side visual belongs (the B132 follow-up;
@@ -1604,9 +1604,16 @@ pub enum Poll {
     /// census counted it like any other packet. A relayed move landing in an unmodelled opcode was
     /// therefore indistinguishable from one that never arrived. `opcode` rides along so the net
     /// thread can name what actually came off the wire.
+    ///
+    /// `tail` is how many body bytes the decoder left unconsumed
+    /// ([`crate::messages::parse_server_with_tail`]): a length-framed body lets a decoder shorter
+    /// than the server's layout succeed silently, and this is the one number that shows it. An
+    /// instrument, not a verdict — the packet decoded, its events are real, and the tail is
+    /// announced (once per opcode) rather than turned into a [`Poll::Skipped`].
     Events {
         opcode: u16,
         events: Vec<SessionEvent>,
+        tail: usize,
     },
     /// An unparseable packet was skipped — kept the stream aligned, not an error. Carries the
     /// opcode (for the app's dropped-packet tally) and a short description (opcode + error + a hex
diff --git a/crates/benilla-protocol/src/messages/auction.rs b/crates/benilla-protocol/src/messages/auction.rs
index 42a2a228..00a29db4 100644
--- a/crates/benilla-protocol/src/messages/auction.rs
+++ b/crates/benilla-protocol/src/messages/auction.rs
@@ -20,7 +20,7 @@
 
 use std::io;
 
-use crate::wire::{read_i32_le, read_u32_le, read_u64_le};
+use crate::wire::{capacity_hint, read_i32_le, read_u32_le, read_u64_le};
 
 /// `SMSG_AUCTION_COMMAND_RESULT`'s `action` field — which verb the verdict answers (VERIFIED
 /// vmangos `AuctionHouseMgr.h:53-58`, `AuctionAction`).
@@ -276,7 +276,6 @@ pub fn auction_remove_item(auctioneer: u64, auction_id: u32) -> Vec<u8> {
 /// `level_min`/`level_max` gate `RequiredLevel`, not item level. The name match is a
 /// case-insensitive substring against the localized name *with the random-property suffix
 /// appended*. `list_from` pages by [`AUCTION_PAGE_SIZE`].
-#[allow(clippy::too_many_arguments)]
 pub fn auction_list_items(
     auctioneer: u64,
     list_from: u32,
@@ -398,7 +397,7 @@ pub(super) fn read_auction_list_result(r: &mut &[u8]) -> io::Result<(Vec<Auction
     let count = read_u32_le(r)?;
     // Bound the allocation by what the buffer could actually hold, not by a `count` we do not
     // trust (see the loop guard below).
-    let mut auctions = Vec::with_capacity((count as usize).min(r.len() / AUCTION_RECORD_BYTES));
+    let mut auctions = Vec::with_capacity(capacity_hint(count, r.len() / AUCTION_RECORD_BYTES));
     for _ in 0..count {
         // `count` is an UPPER BOUND, not a record count. vmangos's *browse fast
         // path* (the no-filter branch of `BuildListAuctionItems`, `AuctionHouseMgr.cpp:716-735`)
diff --git a/crates/benilla-protocol/src/messages/battlefield.rs b/crates/benilla-protocol/src/messages/battlefield.rs
index 03f76f3c..dfceb428 100644
--- a/crates/benilla-protocol/src/messages/battlefield.rs
+++ b/crates/benilla-protocol/src/messages/battlefield.rs
@@ -4,7 +4,7 @@
 
 use std::io::{self, Read};
 
-use crate::wire::{read_u32_le, read_u8};
+use crate::wire::{capacity_hint, read_u32_le, read_u8};
 
 /// `SMSG_BATTLEFIELD_STATUS`, one slot's update (VERIFIED at the bytes, handler `0x4aa850`).
 #[derive(Clone, Debug, PartialEq, Eq)]
@@ -111,7 +111,7 @@ pub(super) fn read_pvp_log_data(r: &mut impl Read) -> io::Result<PvpLogData> {
     let ended = read_u8(r)? != 0;
     let winner = if ended { Some(read_u8(r)?) } else { None };
     let count = read_u32_le(r)?;
-    let mut rows = Vec::with_capacity(count.min(80) as usize);
+    let mut rows = Vec::with_capacity(capacity_hint(count, 80));
     for _ in 0..count {
         let guid = crate::wire::read_u64_le(r)?;
         let rank = read_u32_le(r)?;
@@ -120,7 +120,7 @@ pub(super) fn read_pvp_log_data(r: &mut impl Read) -> io::Result<PvpLogData> {
         let deaths = read_u32_le(r)?;
         let honor_gained = read_u32_le(r)?;
         let stat_count = read_u32_le(r)?;
-        let mut stats = Vec::with_capacity(stat_count.min(8) as usize);
+        let mut stats = Vec::with_capacity(capacity_hint(stat_count, 8));
         for i in 0..stat_count {
             let v = read_u32_le(r)?;
             if i < 8 {
@@ -173,7 +173,7 @@ pub(super) fn read_battlefield_list(r: &mut impl Read) -> io::Result<Battlefield
     let map_id = read_u32_le(r)?;
     let bracket = read_u8(r)?;
     let count = read_u32_le(r)?;
-    let mut instances = Vec::with_capacity(count.min(64) as usize);
+    let mut instances = Vec::with_capacity(capacity_hint(count, 64));
     for _ in 0..count {
         instances.push(read_u32_le(r)?);
     }
@@ -212,7 +212,7 @@ pub const BATTLEFIELD_POSITIONS_MAX: usize = 40;
 /// triple only when that byte is non-zero.
 pub(super) fn read_battlefield_positions(r: &mut impl Read) -> io::Result<BattlefieldPositions> {
     let count = read_u32_le(r)?;
-    let mut players = Vec::with_capacity((count as usize).min(BATTLEFIELD_POSITIONS_MAX));
+    let mut players = Vec::with_capacity(capacity_hint(count, BATTLEFIELD_POSITIONS_MAX));
     for i in 0..count {
         let guid = crate::wire::read_u64_le(r)?;
         let x = crate::wire::read_f32_le(r)?;
diff --git a/crates/benilla-protocol/src/messages/channel.rs b/crates/benilla-protocol/src/messages/channel.rs
index c7b36596..65b9c764 100644
--- a/crates/benilla-protocol/src/messages/channel.rs
+++ b/crates/benilla-protocol/src/messages/channel.rs
@@ -10,7 +10,7 @@
 
 use std::io;
 
-use crate::wire::{read_cstring, read_u32_le, read_u64_le, read_u8};
+use crate::wire::{capacity_hint, read_cstring, read_u32_le, read_u64_le, read_u8};
 
 /// `SMSG_CHANNEL_NOTIFY`'s notice byte (`ChatNotify`, VERIFIED vmangos `Chat/Channel.h:35-71`) —
 /// selects which tail follows the channel name (see [`ChannelNoticeTail`]/[`read_channel_notify`]).
@@ -173,7 +173,7 @@ pub(super) fn read_channel_list(r: &mut &[u8]) -> io::Result<(String, u8, Vec<(u
     // The count is wire-controlled — never let it drive allocation (a corrupt 0xFFFFFFFF must fail
     // at the bounds-checked reads below, not abort in the allocator). Legit rosters exceed 256
     // rarely; push simply grows past the hint.
-    let mut members = Vec::with_capacity((count as usize).min(256));
+    let mut members = Vec::with_capacity(capacity_hint(count, 256));
     for _ in 0..count {
         let guid = read_u64_le(r)?;
         let member_flags = read_u8(r)?;
diff --git a/crates/benilla-protocol/src/messages/combat_log.rs b/crates/benilla-protocol/src/messages/combat_log.rs
index 2a381d35..a3c26f16 100644
--- a/crates/benilla-protocol/src/messages/combat_log.rs
+++ b/crates/benilla-protocol/src/messages/combat_log.rs
@@ -14,7 +14,9 @@
 
 use std::io::{self, Read};
 
-use crate::wire::{read_f32_le, read_i32_le, read_packed_guid, read_u32_le, read_u64_le, read_u8};
+use crate::wire::{
+    capacity_hint, read_f32_le, read_i32_le, read_packed_guid, read_u32_le, read_u64_le, read_u8,
+};
 
 /// One decoded `SMSG_SPELLNONMELEEDAMAGELOG` — non-melee (spell) damage dealt (vmangos
 /// `WorldPackets::Spell::SpellNonMeleeDamageLog::AppendBodyTo`, `Server/Packets/Spell.cpp:124-140` +
@@ -117,7 +119,8 @@ pub(super) fn read_periodic_aura_log(r: &mut impl Read) -> io::Result<PeriodicAu
     let caster = read_packed_guid(r)?;
     let spell_id = read_u32_le(r)?;
     let count = read_u32_le(r)?;
-    let mut ticks = Vec::with_capacity(count as usize);
+    // vmangos writes `count = 1` unconditionally (`Objects/Unit.cpp:4410`); 64 is far past it.
+    let mut ticks = Vec::with_capacity(capacity_hint(count, 64));
     for _ in 0..count {
         let aura_type = read_u32_le(r)?;
         let tick = match aura_type {
@@ -281,7 +284,9 @@ pub(super) fn read_spell_log_miss(r: &mut impl Read) -> io::Result<SpellLogMiss>
     let caster = read_u64_le(r)?;
     let use_extended = read_u8(r)?;
     let count = read_u32_le(r)?;
-    let mut misses = Vec::with_capacity(count as usize);
+    // No server bound: vmangos never sends this opcode at all (its miss list rides
+    // `SMSG_SPELL_GO`), so 64 is a generous sane one.
+    let mut misses = Vec::with_capacity(capacity_hint(count, 64));
     for _ in 0..count {
         let target = read_u64_le(r)?;
         let miss_info = read_u8(r)?;
@@ -375,7 +380,7 @@ pub(super) fn read_spell_dispel_log(r: &mut impl Read) -> io::Result<SpellDispel
     let victim = read_packed_guid(r)?;
     let caster = read_packed_guid(r)?;
     let count = read_u32_le(r)?;
-    let mut spell_ids = Vec::with_capacity(count.min(64) as usize);
+    let mut spell_ids = Vec::with_capacity(capacity_hint(count, 64));
     for _ in 0..count {
         spell_ids.push(read_u32_le(r)?);
     }
@@ -536,11 +541,11 @@ pub(super) fn read_spell_log_execute(r: &mut impl Read) -> io::Result<SpellLogEx
     let caster = read_packed_guid(r)?;
     let spell_id = read_u32_le(r)?;
     let group_count = read_u32_le(r)?;
-    let mut effects = Vec::with_capacity(group_count.min(8) as usize);
+    let mut effects = Vec::with_capacity(capacity_hint(group_count, 8));
     for _ in 0..group_count {
         let effect = read_u32_le(r)?;
         let rows = read_u32_le(r)?;
-        let mut out = Vec::with_capacity(rows.min(64) as usize);
+        let mut out = Vec::with_capacity(capacity_hint(rows, 64));
         for _ in 0..rows {
             out.push(match effect {
                 EFFECT_POWER_DRAIN => ExecuteLog::PowerDrain {
diff --git a/crates/benilla-protocol/src/messages/gossip.rs b/crates/benilla-protocol/src/messages/gossip.rs
index c85032eb..aac5d1ca 100644
--- a/crates/benilla-protocol/src/messages/gossip.rs
+++ b/crates/benilla-protocol/src/messages/gossip.rs
@@ -7,7 +7,7 @@
 
 use std::io;
 
-use crate::wire::{read_cstring, read_f32_le, read_u32_le, read_u64_le, read_u8};
+use crate::wire::{capacity_hint, read_cstring, read_f32_le, read_u32_le, read_u64_le, read_u8};
 
 /// One gossip menu entry (`SMSG_GOSSIP_MESSAGE`'s option list, 1.12 shape — no box-money field,
 /// that's TBC+). `index` is the value the client echoes back as `gossipListId` on select; `icon` is
@@ -76,7 +76,8 @@ pub(super) fn read_gossip_message(
     let npc_guid = read_u64_le(r)?;
     let text_id = read_u32_le(r)?;
     let option_count = read_u32_le(r)?;
-    let mut options = Vec::with_capacity(option_count as usize);
+    // vmangos `GOSSIP_MAX_MENU_ITEMS` 32 (`GossipDef.h:32`, "client supports showing max 32").
+    let mut options = Vec::with_capacity(capacity_hint(option_count, 32));
     for _ in 0..option_count {
         options.push(GossipOption {
             index: read_u32_le(r)?,
@@ -86,7 +87,9 @@ pub(super) fn read_gossip_message(
         });
     }
     let quest_count = read_u32_le(r)?;
-    let mut quests = Vec::with_capacity(quest_count as usize);
+    // The quest menu is an unbounded vector server-side (`GossipDef.h:184`); the same 32-item
+    // client display limit bounds the hint.
+    let mut quests = Vec::with_capacity(capacity_hint(quest_count, 32));
     for _ in 0..quest_count {
         quests.push(QuestOption {
             quest_id: read_u32_le(r)?,
diff --git a/crates/benilla-protocol/src/messages/group.rs b/crates/benilla-protocol/src/messages/group.rs
index 1d16e7af..97d53e5b 100644
--- a/crates/benilla-protocol/src/messages/group.rs
+++ b/crates/benilla-protocol/src/messages/group.rs
@@ -12,7 +12,8 @@ use std::io::{self, Read};
 
 use crate::messages::update_object::power_display_scale;
 use crate::wire::{
-    read_cstring, read_f32_le, read_packed_guid, read_u16_le, read_u32_le, read_u64_le, read_u8,
+    capacity_hint, read_cstring, read_f32_le, read_packed_guid, read_u16_le, read_u32_le,
+    read_u64_le, read_u8,
 };
 
 /// The raid-assistant bit in [`GroupMemberEntry::flags`] / `SMSG_GROUP_LIST`'s own-flags byte —
@@ -95,7 +96,8 @@ pub(super) fn read_group_list(
     let group_type = read_u8(r)?;
     let own_flags = read_u8(r)?;
     let count = read_u32_le(r)?;
-    let mut members = Vec::with_capacity(count as usize);
+    // A raid is the widest list this carries: vmangos `MAX_RAID_SIZE` 40 (`Group/Group.h:50`).
+    let mut members = Vec::with_capacity(capacity_hint(count, 40));
     for _ in 0..count {
         members.push(GroupMemberEntry {
             name: read_cstring(r)?,
@@ -633,7 +635,7 @@ pub(super) fn read_raid_instance_info(r: &mut &[u8]) -> io::Result<Vec<RaidInsta
     // A cap before the allocation: `count` is attacker-controlled in the general case, and the
     // real client's own list is `MAX_RAID_INFOS`-bounded at the UI. 1024 is far above anything a
     // server can legitimately send and far below a memory problem.
-    let mut out = Vec::with_capacity((count as usize).min(1024));
+    let mut out = Vec::with_capacity(capacity_hint(count, 1024));
     for _ in 0..count {
         out.push(RaidInstanceEntry {
             map: read_u32_le(r)?,
diff --git a/crates/benilla-protocol/src/messages/guild.rs b/crates/benilla-protocol/src/messages/guild.rs
index 7c79898e..3e054f19 100644
--- a/crates/benilla-protocol/src/messages/guild.rs
+++ b/crates/benilla-protocol/src/messages/guild.rs
@@ -39,7 +39,7 @@
 
 use std::io::{self, Read};
 
-use crate::wire::{read_cstring, read_f32_le, read_u32_le, read_u64_le, read_u8};
+use crate::wire::{capacity_hint, read_cstring, read_f32_le, read_u32_le, read_u64_le, read_u8};
 
 /// A guild always has at least this many ranks — vmangos `GUILD_RANKS_MIN_COUNT` (`Guild/Guild.h:31`);
 /// the five defaults are GM / Officer / Veteran / Member / Initiate ([`guild_default_rank`]).
@@ -493,12 +493,12 @@ pub(super) fn read_guild_roster(r: &mut impl Read) -> io::Result<GuildRoster> {
     let info = read_cstring(r)?;
 
     let rank_count = read_u32_le(r)?;
-    let mut rank_rights = Vec::with_capacity((rank_count as usize).min(GUILD_RANKS_MAX_COUNT));
+    let mut rank_rights = Vec::with_capacity(capacity_hint(rank_count, GUILD_RANKS_MAX_COUNT));
     for _ in 0..rank_count {
         rank_rights.push(read_u32_le(r)?);
     }
 
-    let mut members = Vec::with_capacity((member_count as usize).min(ROSTER_CAPACITY_HINT_CAP));
+    let mut members = Vec::with_capacity(capacity_hint(member_count, ROSTER_CAPACITY_HINT_CAP));
     for _ in 0..member_count {
         let mut member = GuildRosterMember {
             guid: read_u64_le(r)?,
@@ -566,7 +566,9 @@ pub struct GuildEventNotice {
 pub(super) fn read_guild_event(r: &mut impl Read) -> io::Result<GuildEventNotice> {
     let event = read_u8(r)?;
     let param_count = read_u8(r)?;
-    let mut params = Vec::with_capacity(param_count as usize);
+    // No protocol bound (`Server/Packets/Guild.h:222`, a vector); the events carry one to three
+    // strings, so 16 is generous.
+    let mut params = Vec::with_capacity(capacity_hint(param_count, 16));
     for _ in 0..param_count {
         params.push(read_cstring(r)?);
     }
diff --git a/crates/benilla-protocol/src/messages/loot.rs b/crates/benilla-protocol/src/messages/loot.rs
index 5868b25c..7f5e23ad 100644
--- a/crates/benilla-protocol/src/messages/loot.rs
+++ b/crates/benilla-protocol/src/messages/loot.rs
@@ -10,7 +10,7 @@
 
 use std::io;
 
-use crate::wire::{read_u32_le, read_u64_le, read_u8};
+use crate::wire::{capacity_hint, read_u32_le, read_u64_le, read_u8};
 
 /// One item row on the normal shape of `SMSG_LOOT_RESPONSE` (vmangos `LootMgr.cpp:837-845` the
 /// `LootItem` write, wrapped by the slot index + trailing slot-type byte the caller appends around
@@ -377,7 +377,9 @@ pub(super) fn read_loot_all_passed(r: &mut &[u8]) -> io::Result<LootAllPassed> {
 /// and filters the list by loot-XP distance and `IsAllowedLooter` (`Group.cpp:914-940`).
 pub(super) fn read_loot_master_list(r: &mut &[u8]) -> io::Result<Vec<u64>> {
     let count = read_u8(r)?;
-    let mut candidates = Vec::with_capacity(count as usize);
+    // The candidates are group members (`Group.cpp:914-940`): vmangos `MAX_RAID_SIZE` 40
+    // (`Group/Group.h:50`).
+    let mut candidates = Vec::with_capacity(capacity_hint(count, 40));
     for _ in 0..count {
         candidates.push(read_u64_le(r)?);
     }
@@ -398,7 +400,9 @@ pub(super) fn read_loot_response(r: &mut &[u8]) -> io::Result<(u64, LootResponse
     }
     let gold = read_u32_le(r)?;
     let count = read_u8(r)?;
-    let mut items = Vec::with_capacity(count as usize);
+    // The loot view indexes both lists by one `u8`: `MAX_NR_LOOT_ITEMS` 16 + `MAX_NR_QUEST_ITEMS`
+    // 32 (vmangos `LootMgr.h:34,36`).
+    let mut items = Vec::with_capacity(capacity_hint(count, 16 + 32));
     for _ in 0..count {
         let slot = read_u8(r)?;
         let item_id = read_u32_le(r)?;
diff --git a/crates/benilla-protocol/src/messages/mail.rs b/crates/benilla-protocol/src/messages/mail.rs
index 1ecbb337..8335bdd5 100644
--- a/crates/benilla-protocol/src/messages/mail.rs
+++ b/crates/benilla-protocol/src/messages/mail.rs
@@ -7,7 +7,7 @@
 
 use std::io;
 
-use crate::wire::{read_cstring, read_f32_le, read_u32_le, read_u64_le, read_u8};
+use crate::wire::{capacity_hint, read_cstring, read_f32_le, read_u32_le, read_u64_le, read_u8};
 
 /// `MAIL_ITEM (5)` on [`MailListEntry::message_type`] carries no sender bytes at all — the only
 /// branch of the four that reads nothing before the subject cstring (VERIFIED vmangos
@@ -106,7 +106,6 @@ pub fn get_mail_list(mailbox: u64) -> Vec<u8> {
 /// a `u8 0`) — the 1.12.1 tail vmangos read-skips without interpreting. vmangos *discards* the
 /// client's `stationery`/`package` choice: player mail is always stored `MAIL_STATIONERY_DEFAULT`
 /// (41), so both fields exist only to keep the reader aligned.
-#[allow(clippy::too_many_arguments)]
 pub fn send_mail(
     mailbox: u64,
     receiver: &str,
@@ -210,7 +209,8 @@ pub fn item_text_query(text_id: u32, mail_id: u32) -> Vec<u8> {
 /// expireDays, u32 mailTemplateId`.
 pub(super) fn read_mail_list_result(r: &mut &[u8]) -> io::Result<Vec<MailListEntry>> {
     let count = read_u8(r)?;
-    let mut mails = Vec::with_capacity(count as usize);
+    // vmangos stops the list at 254 (`MailHandler.cpp:761`, `mailsCount >= 254`).
+    let mut mails = Vec::with_capacity(capacity_hint(count, 254));
     for _ in 0..count {
         let message_id = read_u32_le(r)?;
         let message_type = read_u8(r)?;
diff --git a/crates/benilla-protocol/src/messages/mod.rs b/crates/benilla-protocol/src/messages/mod.rs
index 8f00e15d..379c4de7 100644
--- a/crates/benilla-protocol/src/messages/mod.rs
+++ b/crates/benilla-protocol/src/messages/mod.rs
@@ -184,7 +184,7 @@ pub use movement::{
 pub use opcode_names::opcode_name;
 pub use packet::{CreatureQueryInfo, MonsterMoveFacing, ServerPacket};
 pub use page_text::page_text_query;
-pub use parse::parse_server;
+pub use parse::{parse_server, parse_server_with_tail};
 pub use pet::{
     pet_abandon, pet_action, pet_cancel_aura, pet_rename, pet_set_action, pet_spell_autocast,
     pet_stop_attack, pet_tame_failure_key, pet_unlearn, PetActionEntry, PetMode, PetSpellCooldown,
@@ -217,7 +217,8 @@ pub use quest::{
     QUEST_EMOTE_COUNT, QUEST_OBJECTIVES_COUNT, QUEST_REWARDS_COUNT, QUEST_REWARD_CHOICES_COUNT,
 };
 pub use reputation::{
-    set_faction_at_war, set_faction_inactive, set_watched_faction, WATCHED_FACTION_NONE,
+    set_faction_at_war, set_faction_inactive, set_watched_faction, FACTION_LIST_LEN,
+    WATCHED_FACTION_NONE,
 };
 pub use roster::{
     CharCreateReq, CharEnumItem, Character, CHARACTER_FLAG_GHOST, CHARACTER_FLAG_HIDE_CLOAK,
diff --git a/crates/benilla-protocol/src/messages/monster_move.rs b/crates/benilla-protocol/src/messages/monster_move.rs
index 76e0b27f..8cb9b20f 100644
--- a/crates/benilla-protocol/src/messages/monster_move.rs
+++ b/crates/benilla-protocol/src/messages/monster_move.rs
@@ -19,8 +19,8 @@ use std::io;
 
 use crate::messages::{MonsterMoveFacing, ServerPacket};
 use crate::wire::{
-    packed_to_vector3d, read_f32_le, read_i32_le, read_packed_guid, read_u32_le, read_u64_le,
-    read_u8, Vector3d,
+    capacity_hint, packed_to_vector3d, read_f32_le, read_i32_le, read_packed_guid, read_u32_le,
+    read_u64_le, read_u8, Vector3d,
 };
 
 /// `MonsterMoveType::Stop` (`SMSG_MONSTER_MOVE`).
@@ -148,10 +148,9 @@ fn read_monster_move_spline(r: &mut &[u8], catmull_rom: bool) -> io::Result<Vec<
     let count = read_u32_le(r)?;
     // Cap the *pre-allocation* (not the read) at a sane bound — a corrupt `count` must not reserve GBs;
     // the read itself still errors the instant the (bounded) body underruns.
-    let cap = count.min(0xFFFF) as usize;
     if catmull_rom {
         // Absolute control points, verbatim.
-        let mut points = Vec::with_capacity(cap);
+        let mut points = Vec::with_capacity(capacity_hint(count, 0xFFFF));
         for _ in 0..count {
             points.push(Vector3d::read(r)?);
         }
@@ -162,7 +161,7 @@ fn read_monster_move_spline(r: &mut &[u8], catmull_rom: bool) -> io::Result<Vec<
         return Ok(Vec::new());
     }
     let endpoint = Vector3d::read(r)?;
-    let mut points = Vec::with_capacity(cap);
+    let mut points = Vec::with_capacity(capacity_hint(count, 0xFFFF));
     // `count == 2` ⇒ the producer skipped its offset loop entirely (`last_idx > 1`); the destination is
     // the whole payload, and the caller pairs it with the packet's exact `start`.
     let offsets = if count > 2 { count - 1 } else { 0 };
diff --git a/crates/benilla-protocol/src/messages/packet.rs b/crates/benilla-protocol/src/messages/packet.rs
index cbf12a9f..56f35a88 100644
--- a/crates/benilla-protocol/src/messages/packet.rs
+++ b/crates/benilla-protocol/src/messages/packet.rs
@@ -731,7 +731,7 @@ pub enum ServerPacket {
     },
     /// `SMSG_CANCEL_AUTO_REPEAT` — stop our own ranged auto-repeat visual; self-only, empty body
     /// (vmangos `WorldPackets::Misc::CancelAutoRepeat`). Consumed by the local cancel funnel
-    /// (`net/apply/spells.rs::cancel_auto_repeat`, decision 0406). vmangos DOES send it —
+    /// (`net/apply/spells.rs::cancel_auto_repeat`, decision 2273). vmangos DOES send it —
     /// `SpellCaster::InterruptSpell` → `Player::SendAutoRepeatCancel`, on every player autorepeat
     /// interrupt, target death included (corrected 2026-08-05; the earlier "zero send sites" note
     /// here was wrong).
@@ -964,8 +964,8 @@ pub enum ServerPacket {
         blocks: Vec<super::gossip::NpcTextBlock>,
     },
     /// `SMSG_LIST_INVENTORY` — a vendor's stock, answering `CMSG_LIST_INVENTORY` (vmangos
-    /// `ItemHandler.cpp:741-810`). Empty stock sends `count = 0` plus a trailing error byte the
-    /// parser leaves unconsumed.
+    /// `ItemHandler.cpp:741-810`). Empty stock sends `count = 0` plus one error byte (always 0,
+    /// "Vendor has no inventory") that the parser consumes and drops.
     VendorList {
         vendor: u64,
         items: Vec<VendorItem>,
diff --git a/crates/benilla-protocol/src/messages/parse.rs b/crates/benilla-protocol/src/messages/parse.rs
index 78da65f1..e8318852 100644
--- a/crates/benilla-protocol/src/messages/parse.rs
+++ b/crates/benilla-protocol/src/messages/parse.rs
@@ -6,8 +6,8 @@
 use std::io::{self, Read};
 
 use crate::wire::{
-    read_cstring, read_f32_le, read_packed_guid, read_u16_le, read_u32_le, read_u64_le, read_u8,
-    Vector3d,
+    capacity_hint, read_cstring, read_f32_le, read_packed_guid, read_u16_le, read_u32_le,
+    read_u64_le, read_u8, Vector3d,
 };
 
 use super::{
@@ -233,9 +233,45 @@ fn skip(r: &mut &[u8], n: usize) -> Option<()> {
     (r.len() >= n).then(|| *r = &r[n..])
 }
 
+/// Decode one server packet body into its [`ServerPacket`]. The body is the whole length-framed
+/// packet, so a decoder that reads fewer bytes than the server wrote succeeds all the same; that
+/// gap is what [`parse_server_with_tail`] reports, and this is its `(packet, _)` projection.
 pub fn parse_server(opcode: u16, body: &[u8]) -> io::Result<ServerPacket> {
+    parse_server_with_tail(opcode, body).map(|(packet, _)| packet)
+}
+
+/// [`parse_server`], also reporting the **tail**: how many of `body`'s bytes the decoder left
+/// unconsumed. A body is length-framed, so a decoder shorter than the server's layout does not
+/// fail — it silently reads a prefix, and the next field the server added is invisible from
+/// outside. A non-zero tail is the instrument for that drift (decision 2265 §B1): the reader
+/// surfaces it on [`crate::Poll::Events`], the app announces it once per opcode. It is a count,
+/// never a failure — a working decoder with a trailing field it has no use for stays working.
+/// An unknown opcode ([`ServerPacket::Other`]) consumes nothing by definition and reports `0`,
+/// so the tally does not double-count what the dropped-packet tally already names.
+pub fn parse_server_with_tail(opcode: u16, body: &[u8]) -> io::Result<(ServerPacket, usize)> {
     let mut r = body;
-    Ok(match opcode {
+    // `inner_tail` is the one arm that decodes through a second stream (the compressed update
+    // object): the outer cursor ends at the zlib stream's end, and what the INFLATED bytes left
+    // unread is that packet's tail.
+    let mut inner_tail = 0;
+    let packet = parse_server_body(opcode, &mut r, &mut inner_tail)?;
+    let tail = match packet {
+        ServerPacket::Other { .. } => 0,
+        _ => r.len() + inner_tail,
+    };
+    Ok((packet, tail))
+}
+
+/// The opcode → variant dispatch over a slice cursor. `cursor` is advanced past what the arm read
+/// **only on success** (an error's partial read is nobody's business); the arms themselves keep
+/// the plain `&[u8]` local every helper is typed over.
+fn parse_server_body(
+    opcode: u16,
+    cursor: &mut &[u8],
+    inner_tail: &mut usize,
+) -> io::Result<ServerPacket> {
+    let mut r: &[u8] = cursor;
+    let packet = match opcode {
         opcode::SMSG_AUTH_CHALLENGE => ServerPacket::AuthChallenge {
             server_seed: read_u32_le(&mut r)?,
         },
@@ -284,7 +320,9 @@ pub fn parse_server(opcode: u16, body: &[u8]) -> io::Result<ServerPacket> {
         }
         opcode::SMSG_CHAR_ENUM => {
             let count = read_u8(&mut r)?;
-            let mut characters = Vec::with_capacity(count as usize);
+            // Hint bounded by the realm's character cap: vmangos clamps `CharactersPerRealm` to
+            // 10 (`World.cpp:629`, `setConfigMinMax(…, 10, 1, 10)`).
+            let mut characters = Vec::with_capacity(capacity_hint(count, 10));
             for _ in 0..count {
                 characters.push(Character::read(&mut r)?);
             }
@@ -310,13 +348,19 @@ pub fn parse_server(opcode: u16, body: &[u8]) -> io::Result<ServerPacket> {
         },
         opcode::SMSG_COMPRESSED_UPDATE_OBJECT => {
             let _decompressed_size = read_u32_le(&mut r)?;
-            let mut decoder = flate2::read::ZlibDecoder::new(r);
+            // Through `&mut r`, so the cursor advances over the compressed bytes. Handed `r` by
+            // value the decoder reads a COPY of the slice, and the whole zlib body then reads
+            // as unconsumed — 803 bytes on the decode-length instrument's first live login
+            // (2266 §B1). The tail that means drift here is the inflated stream's, reported
+            // through `inner_tail`.
+            let mut decoder = flate2::read::ZlibDecoder::new(&mut r);
             let mut decompressed = Vec::new();
             decoder.read_to_end(&mut decompressed)?;
+            drop(decoder);
             let mut dr = decompressed.as_slice();
-            ServerPacket::UpdateObject {
-                objects: update_object::read_update_object(&mut dr)?,
-            }
+            let objects = update_object::read_update_object(&mut dr)?;
+            *inner_tail = dr.len();
+            ServerPacket::UpdateObject { objects }
         }
         opcode::SMSG_COMPRESSED_MOVES => ServerPacket::CompressedMoves {
             packets: read_compressed_moves(&mut r)?,
@@ -572,7 +616,7 @@ pub fn parse_server(opcode: u16, body: &[u8]) -> io::Result<ServerPacket> {
             // untargeted emote arrives as the empty string — which is precisely the "untargeted"
             // bit of the sentence-form selector, not a missing value.
             let namelen = read_u32_le(&mut r)? as usize;
-            let mut name = Vec::with_capacity(namelen.min(64));
+            let mut name = Vec::with_capacity(capacity_hint(namelen, 64));
             for _ in 0..namelen {
                 name.push(read_u8(&mut r)?);
             }
@@ -1152,7 +1196,9 @@ pub fn parse_server(opcode: u16, body: &[u8]) -> io::Result<ServerPacket> {
         }
         opcode::SMSG_INITIALIZE_FACTIONS => {
             let count = read_u32_le(&mut r)?;
-            let mut standings = Vec::with_capacity(count as usize);
+            // The array is exactly `MAX_FACTION_COUNT` 64 entries long (`FACTION_LIST_LEN`).
+            let mut standings =
+                Vec::with_capacity(capacity_hint(count, super::reputation::FACTION_LIST_LEN));
             for _ in 0..count {
                 let flags = read_u8(&mut r)?;
                 let standing = read_u32_le(&mut r)? as i32;
@@ -1162,7 +1208,9 @@ pub fn parse_server(opcode: u16, body: &[u8]) -> io::Result<ServerPacket> {
         }
         opcode::SMSG_SET_FACTION_STANDING => {
             let count = read_u32_le(&mut r)?;
-            let mut standings = Vec::with_capacity(count as usize);
+            // At most one row per reputation-list slot (`FACTION_LIST_LEN`).
+            let mut standings =
+                Vec::with_capacity(capacity_hint(count, super::reputation::FACTION_LIST_LEN));
             for _ in 0..count {
                 let list_id = read_u32_le(&mut r)?;
                 let standing = read_u32_le(&mut r)? as i32;
@@ -1653,5 +1701,100 @@ pub fn parse_server(opcode: u16, body: &[u8]) -> io::Result<ServerPacket> {
             statuses: read_addon_info(&mut r),
         },
         other => ServerPacket::Other { opcode: other },
-    })
+    };
+    *cursor = r;
+    Ok(packet)
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    /// The tail is the decoder's unconsumed remainder: a known-good body reports 0, the same body
+    /// with one byte appended reports 1, and neither is an error.
+    #[test]
+    fn a_trailing_byte_is_reported_as_tail_one_and_never_as_a_failure() {
+        // `SMSG_SET_FACTION_VISIBLE`: exactly one `u32 repListId`.
+        let body = 21u32.to_le_bytes().to_vec();
+        let (packet, tail) = parse_server_with_tail(opcode::SMSG_SET_FACTION_VISIBLE, &body)
+            .expect("a well-formed body decodes");
+        assert!(matches!(
+            packet,
+            ServerPacket::SetFactionVisible { list_id: 21 }
+        ));
+        assert_eq!(tail, 0);
+
+        let mut longer = body.clone();
+        longer.push(0xEE);
+        let (packet, tail) = parse_server_with_tail(opcode::SMSG_SET_FACTION_VISIBLE, &longer)
+            .expect("a trailing byte is not a parse failure");
+        assert!(matches!(
+            packet,
+            ServerPacket::SetFactionVisible { list_id: 21 }
+        ));
+        assert_eq!(tail, 1);
+        // …and the projection every existing caller uses is unchanged by it.
+        assert!(parse_server(opcode::SMSG_SET_FACTION_VISIBLE, &longer).is_ok());
+    }
+
+    /// The compressed update object decodes through a second stream. Its zlib bytes are consumed
+    /// through the cursor (a copy of the slice read the whole body as a tail — 803 bytes on the
+    /// instrument's first live login), and the tail it reports is what the INFLATED stream left
+    /// unread — the one leftover that means the inner layout drifted.
+    #[test]
+    fn the_compressed_update_object_reports_the_inflated_streams_tail_not_its_zlib_bytes() {
+        use std::io::Write;
+        fn body(inflated: &[u8]) -> Vec<u8> {
+            let mut out = (inflated.len() as u32).to_le_bytes().to_vec();
+            let mut z = flate2::write::ZlibEncoder::new(Vec::new(), flate2::Compression::default());
+            z.write_all(inflated).unwrap();
+            out.extend(z.finish().unwrap());
+            out
+        }
+        // `u32 count = 0, u8 has_transport = 0`: a well-formed, empty object list.
+        let empty = [0u8, 0, 0, 0, 0];
+        let (packet, tail) =
+            parse_server_with_tail(opcode::SMSG_COMPRESSED_UPDATE_OBJECT, &body(&empty))
+                .expect("an empty update object decodes");
+        assert!(matches!(packet, ServerPacket::UpdateObject { ref objects } if objects.is_empty()));
+        assert_eq!(tail, 0, "the zlib bytes are consumed, not reported");
+
+        let mut longer = empty.to_vec();
+        longer.push(0xEE);
+        let (_, tail) =
+            parse_server_with_tail(opcode::SMSG_COMPRESSED_UPDATE_OBJECT, &body(&longer))
+                .expect("a trailing inflated byte is not a failure");
+        assert_eq!(tail, 1, "the inflated stream's leftover is the tail");
+    }
+
+    /// An unknown opcode consumes nothing by definition; reporting its whole body as a tail would
+    /// double-count what the dropped-packet tally already names.
+    #[test]
+    fn an_unknown_opcode_reports_no_tail() {
+        let (packet, tail) =
+            parse_server_with_tail(0xFFFF, &[1, 2, 3]).expect("unknown opcodes never fail");
+        assert!(matches!(packet, ServerPacket::Other { opcode: 0xFFFF }));
+        assert_eq!(tail, 0);
+    }
+
+    /// **The falsifier for decision 2265 §B1**: a wire count of `0xFFFF_FFFF` followed by one
+    /// valid row must come back as a short-read `Err` — never reserve the count, never abort.
+    #[test]
+    fn a_lying_faction_count_is_a_short_read_not_an_allocation() {
+        let mut body = 0xFFFF_FFFFu32.to_le_bytes().to_vec();
+        body.push(0x01); // flags
+        body.extend_from_slice(&3000i32.to_le_bytes()); // standing
+        let err = parse_server(opcode::SMSG_INITIALIZE_FACTIONS, &body)
+            .err()
+            .expect("the second row is missing, so the read is short");
+        assert_eq!(err.kind(), io::ErrorKind::UnexpectedEof);
+
+        let mut body = 0xFFFF_FFFFu32.to_le_bytes().to_vec();
+        body.extend_from_slice(&5u32.to_le_bytes());
+        body.extend_from_slice(&(-100i32).to_le_bytes());
+        let err = parse_server(opcode::SMSG_SET_FACTION_STANDING, &body)
+            .err()
+            .expect("the second row is missing, so the read is short");
+        assert_eq!(err.kind(), io::ErrorKind::UnexpectedEof);
+    }
 }
diff --git a/crates/benilla-protocol/src/messages/pet.rs b/crates/benilla-protocol/src/messages/pet.rs
index 5b58449f..9bfcb92d 100644
--- a/crates/benilla-protocol/src/messages/pet.rs
+++ b/crates/benilla-protocol/src/messages/pet.rs
@@ -22,7 +22,7 @@
 
 use std::io::{self, Read};
 
-use crate::wire::{read_u16_le, read_u32_le, read_u64_le, read_u8, Vector3d};
+use crate::wire::{capacity_hint, read_u16_le, read_u32_le, read_u64_le, read_u8, Vector3d};
 
 /// Pet action-bar slots (vmangos `MAX_UNIT_ACTION_BAR_INDEX` = `ACTION_BAR_INDEX_END(10) -
 /// ACTION_BAR_INDEX_START(0)`, `Objects/UnitDefines.h:781-787`); the client's own
@@ -286,7 +286,8 @@ pub(super) fn read_pet_spells(r: &mut &[u8]) -> io::Result<PetSpells> {
     }
 
     let spell_count = read_u8(r)?;
-    let mut spells = Vec::with_capacity(spell_count as usize);
+    // A `u8` count with no tighter server bound (`Player.cpp:17471`, `uint8 addlist`).
+    let mut spells = Vec::with_capacity(capacity_hint(spell_count, usize::from(u8::MAX)));
     for _ in 0..spell_count {
         spells.push(read_u32_le(r)?.into());
     }
@@ -321,16 +322,19 @@ pub(super) fn read_pet_spells(r: &mut &[u8]) -> io::Result<PetSpells> {
 /// discriminator is exact, not a heuristic — and the day vmangos is fixed, this keeps working.
 fn read_cooldown_block(r: &mut &[u8]) -> io::Result<Vec<PetSpellCooldown>> {
     let count = usize::from(read_u8(r)?);
-    if count == 0 {
-        // vmangos leaves its count's high byte behind; the client's form leaves nothing. Either
-        // way there is nothing to read, and trailing slack is not an error.
-        return Ok(Vec::new());
-    }
+    // The discriminator holds at `count == 0` too: vmangos's lone leftover is its `u16` count's
+    // high byte, the client's form leaves nothing. The byte is consumed rather than left behind
+    // so an empty block is not a tail for the decode-length check to announce (decision 2265
+    // §B1); either way nothing else is read and no entry is invented.
     let vmangos = r.len() == 1 + 14 * count;
     if vmangos {
         let _high_byte = read_u8(r)?;
     }
-    let mut cooldowns = Vec::with_capacity(count);
+    if count == 0 {
+        return Ok(Vec::new());
+    }
+    // `count` came off a `u8` (above); no tighter bound exists on either producer.
+    let mut cooldowns = Vec::with_capacity(capacity_hint(count, usize::from(u8::MAX)));
     for _ in 0..count {
         let spell_id = if vmangos {
             read_u32_le(r)?
@@ -697,11 +701,19 @@ mod tests {
     }
 
     /// A pet with no cooldowns at all: the client's form ends the packet, vmangos's leaves its
-    /// count's high byte behind. Neither is an error and neither invents an entry.
+    /// count's high byte behind. Neither is an error and neither invents an entry — and the
+    /// high byte is consumed, so neither leaves a tail.
     #[test]
     fn an_empty_cooldown_block_reads_either_way() {
-        assert!(read_cooldown_block(&mut &[0u8][..]).unwrap().is_empty());
-        assert!(read_cooldown_block(&mut &[0u8, 0][..]).unwrap().is_empty());
+        let mut client = &[0u8][..];
+        assert!(read_cooldown_block(&mut client).unwrap().is_empty());
+        assert!(client.is_empty());
+        let mut vmangos = &[0u8, 0][..];
+        assert!(read_cooldown_block(&mut vmangos).unwrap().is_empty());
+        assert!(
+            vmangos.is_empty(),
+            "vmangos's count high byte is consumed, not left as a tail"
+        );
     }
 
     /// The teardown: an 8-byte body of zero guid ⇒ a default value whose `pet_guid` is 0. This is
diff --git a/crates/benilla-protocol/src/messages/petition.rs b/crates/benilla-protocol/src/messages/petition.rs
index 5f45a7e8..595b94d7 100644
--- a/crates/benilla-protocol/src/messages/petition.rs
+++ b/crates/benilla-protocol/src/messages/petition.rs
@@ -42,7 +42,9 @@
 
 use std::io::{self, Read};
 
-use crate::wire::{read_cstring, read_i32_le, read_u16_le, read_u32_le, read_u64_le, read_u8};
+use crate::wire::{
+    capacity_hint, read_cstring, read_i32_le, read_u16_le, read_u32_le, read_u64_le, read_u8,
+};
 
 /// The one item that is a guild charter — vmangos `GUILD_CHARTER` (`PetitionsHandler.cpp:37`),
 /// also `Item::IsCharter`'s literal (`Item.h:158`, `GetEntry() == 5863u`). Confirmed against this
@@ -147,7 +149,9 @@ pub struct PetitionShowList {
 pub(super) fn read_petition_show_list(r: &mut impl Read) -> io::Result<PetitionShowList> {
     let npc = read_u64_le(r)?;
     let count = read_u8(r)?;
-    let mut entries = Vec::with_capacity(count as usize);
+    // vmangos sends exactly one charter (`PetitionsHandler.cpp:503`, `entries = { entry }`);
+    // 8 is generous.
+    let mut entries = Vec::with_capacity(capacity_hint(count, 8));
     for _ in 0..count {
         entries.push(PetitionShowListEntry {
             index: read_u32_le(r)?,
@@ -209,7 +213,8 @@ pub(super) fn read_petition_show_signatures(
     let owner = read_u64_le(r)?;
     let petition_id = read_u32_le(r)?;
     let count = read_u8(r)?;
-    let mut signatures = Vec::with_capacity(count as usize);
+    // "Client hard limit at 9 signatures" (vmangos `PetitionsHandler.cpp:269-270`).
+    let mut signatures = Vec::with_capacity(capacity_hint(count, 9));
     for _ in 0..count {
         signatures.push(PetitionSignature {
             signer: read_u64_le(r)?,
@@ -325,7 +330,7 @@ pub(super) fn read_petition_query_response(r: &mut impl Read) -> io::Result<Peti
     let allowed_min_level = read_u32_le(r)?;
     let allowed_max_level = read_u32_le(r)?;
     let choice_count = read_u32_le(r)?;
-    let mut choices = Vec::with_capacity(choice_count.min(64) as usize);
+    let mut choices = Vec::with_capacity(capacity_hint(choice_count, 64));
     for _ in 0..choice_count {
         choices.push(read_cstring(r)?);
     }
diff --git a/crates/benilla-protocol/src/messages/quest/giver.rs b/crates/benilla-protocol/src/messages/quest/giver.rs
index 1c6aad2d..08ece1aa 100644
--- a/crates/benilla-protocol/src/messages/quest/giver.rs
+++ b/crates/benilla-protocol/src/messages/quest/giver.rs
@@ -18,7 +18,7 @@
 
 use std::io;
 
-use crate::wire::{read_cstring, read_i32_le, read_u32_le, read_u64_le, read_u8};
+use crate::wire::{capacity_hint, read_cstring, read_i32_le, read_u32_le, read_u64_le, read_u8};
 
 /// `QUEST_EMOTE_COUNT` (vmangos `QuestDef.h:43`) — DETAILS always writes exactly this many emote
 /// pairs; OFFER_REWARD writes a variable count (0..=4), so only DETAILS relies on the constant.
@@ -215,7 +215,9 @@ fn read_item_triple(r: &mut &[u8]) -> io::Result<QuestRewardItem> {
 /// Read a count-prefixed run of item triples (`u32 count` then that many triples).
 fn read_item_block(r: &mut &[u8]) -> io::Result<Vec<QuestRewardItem>> {
     let count = read_u32_le(r)?;
-    let mut items = Vec::with_capacity(count as usize);
+    // The wider of the two lists this reads: `QUEST_REWARD_CHOICES_COUNT` 6 (vmangos
+    // `QuestDef.h:39`; the fixed rewards are `QUEST_REWARDS_COUNT` 4).
+    let mut items = Vec::with_capacity(capacity_hint(count, 6));
     for _ in 0..count {
         items.push(read_item_triple(r)?);
     }
@@ -237,7 +239,9 @@ pub(in crate::messages) fn read_questgiver_quest_list(r: &mut &[u8]) -> io::Resu
     let emote_delay = read_u32_le(r)?;
     let emote = read_u32_le(r)?;
     let count = read_u8(r)?;
-    let mut quests = Vec::with_capacity(count as usize);
+    // No server cap (the quest menu is a vector, `GossipDef.h:184`); `GOSSIP_MAX_MENU_ITEMS` 32
+    // (`GossipDef.h:32`) is the client's display limit.
+    let mut quests = Vec::with_capacity(capacity_hint(count, 32));
     for _ in 0..count {
         quests.push(QuestListEntry {
             quest_id: read_u32_le(r)?,
@@ -375,7 +379,8 @@ pub(in crate::messages) fn read_questgiver_quest_complete(
     let xp = read_u32_le(r)?;
     let money = read_u32_le(r)?;
     let count = read_u32_le(r)?;
-    let mut items = Vec::with_capacity(count as usize);
+    // `QUEST_REWARDS_COUNT` 4 (vmangos `QuestDef.h:40`).
+    let mut items = Vec::with_capacity(capacity_hint(count, 4));
     for _ in 0..count {
         items.push((read_u32_le(r)?, read_u32_le(r)?));
     }
diff --git a/crates/benilla-protocol/src/messages/reputation.rs b/crates/benilla-protocol/src/messages/reputation.rs
index 62f0f852..673e0961 100644
--- a/crates/benilla-protocol/src/messages/reputation.rs
+++ b/crates/benilla-protocol/src/messages/reputation.rs
@@ -25,6 +25,14 @@
 //! its own optimistic flag copy, exactly as it owns the collapse state. The watched index comes back
 //! as a `PLAYER_FIELD_WATCHED_FACTION_INDEX` descriptor update.
 
+/// The length of the reputation-list array `SMSG_INITIALIZE_FACTIONS` is positional in — vmangos
+/// `WorldPackets::Misc::InitializeFactions::MAX_FACTION_COUNT` (`Server/Packets/Misc.h:607`), the
+/// `std::array<FactionInitEntry, 64>` the packet is built over. Every `repListId` on this wire —
+/// the `SMSG_SET_FACTION_STANDING` / `SMSG_SET_FACTION_VISIBLE` slot, and the three send verbs' —
+/// is an index into that array, so one past it is not a faction and a store sized from it is a
+/// store sized from a lie (decision 2265 §B1).
+pub const FACTION_LIST_LEN: usize = 64;
+
 /// The `PLAYER_FIELD_WATCHED_FACTION_INDEX` / `CMSG_SET_WATCHED_FACTION` sentinel for "watch no
 /// faction" — see the module header on why it cannot be `0`.
 pub const WATCHED_FACTION_NONE: i32 = -1;
diff --git a/crates/benilla-protocol/src/messages/social.rs b/crates/benilla-protocol/src/messages/social.rs
index 2f074ae2..7058a1a4 100644
--- a/crates/benilla-protocol/src/messages/social.rs
+++ b/crates/benilla-protocol/src/messages/social.rs
@@ -30,7 +30,7 @@
 
 use std::io::{self, Read};
 
-use crate::wire::{read_cstring, read_u32_le, read_u64_le, read_u8};
+use crate::wire::{capacity_hint, read_cstring, read_u32_le, read_u64_le, read_u8};
 
 /// `SMSG_FRIEND_STATUS`'s result byte — vmangos's `FriendsResult` (`SocialMgr.h:81-110`), which is
 /// the client's own enum: `FriendList::HandleResult 0x5acab0` switches on it and displays
@@ -130,7 +130,8 @@ impl FriendEntry {
 /// an online one 21.
 pub fn read_friend_list(r: &mut impl Read) -> io::Result<Vec<FriendEntry>> {
     let count = read_u8(r)?;
-    let mut friends = Vec::with_capacity(count as usize);
+    // vmangos `SOCIALMGR_FRIEND_LIMIT` 50 (`SocialMgr.h:114`).
+    let mut friends = Vec::with_capacity(capacity_hint(count, 50));
     for _ in 0..count {
         let mut entry = FriendEntry {
             guid: read_u64_le(r)?,
@@ -254,7 +255,7 @@ pub struct WhoResults {
 pub fn read_who(r: &mut impl Read) -> io::Result<WhoResults> {
     let displayed = read_u32_le(r)?;
     let total = read_u32_le(r)?;
-    let mut entries = Vec::with_capacity(displayed.min(64) as usize);
+    let mut entries = Vec::with_capacity(capacity_hint(displayed, 64));
     for _ in 0..displayed {
         entries.push(WhoEntry {
             name: read_cstring(r)?,
diff --git a/crates/benilla-protocol/src/messages/spellbook.rs b/crates/benilla-protocol/src/messages/spellbook.rs
index 1956a83d..e28126ad 100644
--- a/crates/benilla-protocol/src/messages/spellbook.rs
+++ b/crates/benilla-protocol/src/messages/spellbook.rs
@@ -17,7 +17,7 @@
 
 use std::io::{self, Read};
 
-use crate::wire::{read_u16_le, read_u32_le, read_u64_le, read_u8};
+use crate::wire::{capacity_hint, read_u16_le, read_u32_le, read_u64_le, read_u8};
 
 /// One active cooldown from `SMSG_INITIAL_SPELLS`' second list (vmangos `SendInitialSpells`):
 /// `u16 spell, u16 castItem, u16 category, u32 spellCdMs, u32 categoryCdMs`. A *permanent*
@@ -38,13 +38,15 @@ pub struct SpellCooldown {
 pub(super) fn read_initial_spells(r: &mut impl Read) -> io::Result<(Vec<u16>, Vec<SpellCooldown>)> {
     let _ = read_u8(r)?;
     let n = read_u16_le(r)?;
-    let mut spells = Vec::with_capacity(n as usize);
+    // No protocol bound on either list (`Player::SendInitialSpells` walks the spell map); a
+    // 1.12 spellbook is a few hundred entries, so 1024 is generous.
+    let mut spells = Vec::with_capacity(capacity_hint(n, 1024));
     for _ in 0..n {
         spells.push(read_u16_le(r)?);
         let _ = read_u16_le(r)?;
     }
     let m = read_u16_le(r)?;
-    let mut cooldowns = Vec::with_capacity(m as usize);
+    let mut cooldowns = Vec::with_capacity(capacity_hint(m, 1024));
     for _ in 0..m {
         cooldowns.push(SpellCooldown {
             spell_id: read_u16_le(r)?,
diff --git a/crates/benilla-protocol/src/messages/spells.rs b/crates/benilla-protocol/src/messages/spells.rs
index eef7f96b..463b26f5 100644
--- a/crates/benilla-protocol/src/messages/spells.rs
+++ b/crates/benilla-protocol/src/messages/spells.rs
@@ -24,7 +24,8 @@
 use std::io::{self, Read};
 
 use crate::wire::{
-    read_cstring, read_packed_guid, read_u16_le, read_u32_le, read_u64_le, read_u8, Vector3d,
+    capacity_hint, read_cstring, read_packed_guid, read_u16_le, read_u32_le, read_u64_le, read_u8,
+    Vector3d,
 };
 
 /// `SMSG_CAST_RESULT`'s verdict: `u32 spellId, u8 status` — status `0` (`SPELL_RESULT_STATUS_OKAY`)
@@ -106,7 +107,7 @@ pub struct SpellCastTargets {
     pub mask: u16,
     pub unit_target: Option<u64>,
     /// The GameObject this cast targets (`TARGET_FLAG_GAMEOBJECT`) — an open-lock cast on a chest / locked
-    /// door rides here. Surfaced for the GO lid/door open animation (decision 0250); a unit spell leaves
+    /// door rides here. Surfaced for the GO lid/door open animation (decision 2271); a unit spell leaves
     /// it `None`. Mutually exclusive with `unit_target` in practice (the writer emits one guid).
     pub go_target: Option<u64>,
     pub dest: Option<Vector3d>,
@@ -242,13 +243,15 @@ pub(super) fn read_spell_go(r: &mut impl Read) -> io::Result<SpellGo> {
     let spell_id = read_u32_le(r)?;
     let cast_flags = read_u16_le(r)?;
 
+    // Both counts are `u8` placeholders the server writes back over (`Spell.cpp:4607-4609`);
+    // no tighter bound exists.
     let hit_count = read_u8(r)?;
-    let mut hits = Vec::with_capacity(hit_count as usize);
+    let mut hits = Vec::with_capacity(capacity_hint(hit_count, usize::from(u8::MAX)));
     for _ in 0..hit_count {
         hits.push(read_u64_le(r)?); // raw guid (Spell.cpp:4627,4635) — the hit list is never packed
     }
     let miss_count = read_u8(r)?;
-    let mut misses = Vec::with_capacity(miss_count as usize);
+    let mut misses = Vec::with_capacity(capacity_hint(miss_count, usize::from(u8::MAX)));
     for _ in 0..miss_count {
         let guid = read_u64_le(r)?;
         let reason = read_u8(r)?;
diff --git a/crates/benilla-protocol/src/messages/stable.rs b/crates/benilla-protocol/src/messages/stable.rs
index f31f23ed..df2491b7 100644
--- a/crates/benilla-protocol/src/messages/stable.rs
+++ b/crates/benilla-protocol/src/messages/stable.rs
@@ -21,7 +21,7 @@
 
 use std::io;
 
-use crate::wire::{read_cstring, read_u32_le, read_u64_le, read_u8};
+use crate::wire::{capacity_hint, read_cstring, read_u32_le, read_u64_le, read_u8};
 
 /// One row of `MSG_LIST_STABLED_PETS` (vmangos `WorldSession::SendStablePet`,
 /// `NPCHandler.cpp:522-575`) — a pet the stable master can show, whether it is the one currently at
@@ -173,7 +173,8 @@ pub(super) fn read_list_stabled_pets(r: &mut &[u8]) -> io::Result<(u64, u8, Vec<
     let npc = read_u64_le(r)?;
     let num_pets = read_u8(r)?;
     let num_stable_slots = read_u8(r)?;
-    let mut pets = Vec::with_capacity(num_pets as usize);
+    // The current pet plus the stable slots: 1 + vmangos `MAX_PET_STABLES` 2 (`Objects/Pet.h:37`).
+    let mut pets = Vec::with_capacity(capacity_hint(num_pets, 1 + 2));
     for _ in 0..num_pets {
         // Struct-literal fields evaluate top-to-bottom, so this reads in wire order.
         pets.push(StabledPet {
diff --git a/crates/benilla-protocol/src/messages/trainer.rs b/crates/benilla-protocol/src/messages/trainer.rs
index 39cde4ed..844a815d 100644
--- a/crates/benilla-protocol/src/messages/trainer.rs
+++ b/crates/benilla-protocol/src/messages/trainer.rs
@@ -8,7 +8,7 @@
 
 use std::io;
 
-use crate::wire::{read_cstring, read_u32_le, read_u64_le, read_u8};
+use crate::wire::{capacity_hint, read_cstring, read_u32_le, read_u64_le, read_u8};
 
 /// One trainer service (`SMSG_TRAINER_LIST`, vmangos `SendTrainerSpellHelper`,
 /// `NPCHandler.cpp:97-139`) — a spell or tradeskill step the trainer can teach. The 38-byte wire
@@ -96,7 +96,9 @@ pub(super) fn read_trainer_list(
     let trainer = read_u64_le(r)?;
     let trainer_type = read_u32_le(r)?;
     let count = read_u32_le(r)?;
-    let mut services = Vec::with_capacity(count as usize);
+    // No protocol bound: the list is every spell the trainer's template carries (vmangos
+    // `NPCHandler.cpp:170` sums its two lists). 1024 is far past any real trainer.
+    let mut services = Vec::with_capacity(capacity_hint(count, 1024));
     for _ in 0..count {
         // Struct-literal fields evaluate top-to-bottom, so this reads in wire order.
         services.push(TrainerSpell {
diff --git a/crates/benilla-protocol/src/messages/update_object/fields/mod.rs b/crates/benilla-protocol/src/messages/update_object/fields/mod.rs
index b144b807..9a04da2c 100644
--- a/crates/benilla-protocol/src/messages/update_object/fields/mod.rs
+++ b/crates/benilla-protocol/src/messages/update_object/fields/mod.rs
@@ -1,6 +1,6 @@
 use std::io::{self, Read};
 
-use crate::wire::{read_u32_le, read_u8, Vector3d};
+use crate::wire::{capacity_hint, read_u32_le, read_u8, Vector3d};
 
 use super::movement::ObjectType;
 
@@ -656,10 +656,14 @@ fn descriptor_len(object_type: ObjectType) -> u16 {
     }
 }
 
+/// The widest descriptor's mask-word count: `PLAYER_END` 1282 fields (the [`descriptor_len`]
+/// table) is 41 words of 32 bits. A block count past it describes no 1.12 object.
+const MAX_MASK_WORDS: usize = 1282usize.div_ceil(32);
+
 impl ObjectFields {
     pub(super) fn read(r: &mut impl Read) -> io::Result<Self> {
         let amount_of_blocks = read_u8(r)?;
-        let mut present = Vec::with_capacity(amount_of_blocks as usize);
+        let mut present = Vec::with_capacity(capacity_hint(amount_of_blocks, MAX_MASK_WORDS));
         for _ in 0..amount_of_blocks {
             present.push(read_u32_le(r)?);
         }
@@ -893,6 +897,9 @@ impl ObjectFields {
     }
 
     fn insert(&mut self, index: u16, value: u32) {
+        // `index` is a `u16`, so `word` is at most 2047 and the store at most 64 Ki values —
+        // bounded by the type, not by anything the wire says (the wire's block count above is
+        // a `u8`, 255 words at the very most).
         let word = usize::from(index / 32);
         if word >= self.present.len() {
             self.present.resize(word + 1, 0);
diff --git a/crates/benilla-protocol/src/messages/update_object/mod.rs b/crates/benilla-protocol/src/messages/update_object/mod.rs
index 46c7b531..6763fd6a 100644
--- a/crates/benilla-protocol/src/messages/update_object/mod.rs
+++ b/crates/benilla-protocol/src/messages/update_object/mod.rs
@@ -7,7 +7,7 @@
 
 use std::io::{self, Read};
 
-use crate::wire::{read_packed_guid, read_u32_le, read_u8};
+use crate::wire::{capacity_hint, read_packed_guid, read_u32_le, read_u8};
 
 mod fields;
 mod movement;
@@ -92,7 +92,7 @@ impl Object {
 
 fn read_guid_list(r: &mut impl Read) -> io::Result<Vec<u64>> {
     let count = read_u32_le(r)?;
-    let mut guids = Vec::with_capacity(count.min(0xFFFF) as usize);
+    let mut guids = Vec::with_capacity(capacity_hint(count, 0xFFFF));
     for _ in 0..count {
         guids.push(read_packed_guid(r)?);
     }
@@ -103,7 +103,7 @@ fn read_guid_list(r: &mut impl Read) -> io::Result<Vec<u64>> {
 pub(super) fn read_update_object(r: &mut impl Read) -> io::Result<Vec<Object>> {
     let amount_of_objects = read_u32_le(r)?;
     let _has_transport = read_u8(r)?;
-    let mut objects = Vec::with_capacity(amount_of_objects.min(0xFFFF) as usize);
+    let mut objects = Vec::with_capacity(capacity_hint(amount_of_objects, 0xFFFF));
     for _ in 0..amount_of_objects {
         objects.push(Object::read(r)?);
     }
diff --git a/crates/benilla-protocol/src/messages/update_object/movement.rs b/crates/benilla-protocol/src/messages/update_object/movement.rs
index d901fe62..6e770110 100644
--- a/crates/benilla-protocol/src/messages/update_object/movement.rs
+++ b/crates/benilla-protocol/src/messages/update_object/movement.rs
@@ -4,7 +4,9 @@ use crate::messages::movement::{
     TransportPose, MOVEMENT_FLAG_JUMPING, MOVEMENT_FLAG_ON_TRANSPORT,
     MOVEMENT_FLAG_SPLINE_ELEVATION, MOVEMENT_FLAG_SPLINE_ENABLED, MOVEMENT_FLAG_SWIMMING,
 };
-use crate::wire::{read_f32_le, read_packed_guid, read_u32_le, read_u64_le, read_u8, Vector3d};
+use crate::wire::{
+    capacity_hint, read_f32_le, read_packed_guid, read_u32_le, read_u64_le, read_u8, Vector3d,
+};
 
 /// Object class (the `TypeId` on a create packet).
 #[derive(Debug, Clone, Copy, PartialEq, Eq)]
@@ -227,7 +229,7 @@ impl MovementBlock {
                 let duration_ms = read_u32_le(r)?;
                 let id = read_u32_le(r)?;
                 let amount_of_nodes = read_u32_le(r)?;
-                let mut nodes = Vec::with_capacity(amount_of_nodes.min(0xFFFF) as usize);
+                let mut nodes = Vec::with_capacity(capacity_hint(amount_of_nodes, 0xFFFF));
                 for _ in 0..amount_of_nodes {
                     let v = Vector3d::read(r)?;
                     nodes.push([v.x, v.y, v.z]);
diff --git a/crates/benilla-protocol/src/messages/vendor.rs b/crates/benilla-protocol/src/messages/vendor.rs
index 3369cd24..80012a8c 100644
--- a/crates/benilla-protocol/src/messages/vendor.rs
+++ b/crates/benilla-protocol/src/messages/vendor.rs
@@ -6,7 +6,7 @@
 
 use std::io;
 
-use crate::wire::{read_u32_le, read_u64_le, read_u8};
+use crate::wire::{capacity_hint, read_u32_le, read_u64_le, read_u8};
 
 /// One vendor row (`SMSG_LIST_INVENTORY`, vmangos `ItemHandler.cpp:741-810`). `slot` (the wire's
 /// `muid`) is the row's 1-based position in the vendor's list — **not** what buying uses; buying
@@ -130,14 +130,21 @@ pub fn repair_item(vendor_guid: u64, item_guid: u64) -> Vec<u8> {
 }
 
 /// Read `SMSG_LIST_INVENTORY` (vmangos `ItemHandler.cpp:741-810`): `u64 vendorGuid, u8 count`
-/// (≤ `MAX_VENDOR_ITEMS` 128) then `count` rows of [`VendorItem`]. The empty-vendor case sends
-/// `count = 0` followed by a trailing `u8` error byte (`ItemHandler.cpp:728-733,806-809`); this
-/// parser tolerates it by construction — the row loop simply doesn't run, so the byte is left
-/// harmlessly unconsumed rather than misread as a row.
+/// (≤ `MAX_VENDOR_ITEMS` 128) then `count` rows of [`VendorItem`]. The empty-vendor case is
+/// `count = 0` followed by one trailing `u8` — both producers write a literal `uint8(0)`
+/// ("Vendor has no inventory": `ItemHandler.cpp:728-733` for a creature with no item lists,
+/// `:806-809` for one whose every item is hidden from this player). It carries no other value
+/// on this wire, so it is consumed and dropped — consumed *explicitly*, so an empty list leaves
+/// no tail for the decode-length check to report (decision 2265 §B1).
 pub(super) fn read_list_inventory(r: &mut &[u8]) -> io::Result<(u64, Vec<VendorItem>)> {
     let vendor_guid = read_u64_le(r)?;
     let count = read_u8(r)?;
-    let mut items = Vec::with_capacity(count as usize);
+    if count == 0 {
+        let _no_inventory = read_u8(r)?;
+        return Ok((vendor_guid, Vec::new()));
+    }
+    // vmangos `MAX_VENDOR_ITEMS` 128 (`Objects/CreatureDefines.h:624`).
+    let mut items = Vec::with_capacity(capacity_hint(count, 128));
     for _ in 0..count {
         items.push(VendorItem {
             slot: read_u32_le(r)?,
diff --git a/crates/benilla-protocol/src/wire.rs b/crates/benilla-protocol/src/wire.rs
index 38c6e0e4..9023af02 100644
--- a/crates/benilla-protocol/src/wire.rs
+++ b/crates/benilla-protocol/src/wire.rs
@@ -92,6 +92,27 @@ pub fn read_cstring(r: &mut impl Read) -> io::Result<String> {
     Ok(String::from_utf8_lossy(&bytes).into_owned())
 }
 
+/// Bound a wire-derived element count before it becomes a `Vec::with_capacity` hint.
+///
+/// A count read off the wire is server- (and so bug- and attacker-) controlled, and
+/// `Vec::with_capacity(count as usize)` on a raw `u32` is the one failure the decoders' `io::Result`
+/// totality does not cover: an allocation that cannot be satisfied is `handle_alloc_error` →
+/// `abort()` — no unwind, no [`crate::Poll::Skipped`], no tally (decision 2265 §B1). The returned
+/// hint bounds only the **up-front** allocation: the `Vec` still grows past it when the body really
+/// carries more rows, and a lying count still fails on the short read of the body, which is
+/// `u16`-bounded and read whole before parse. `cap` is the protocol's own bound where one exists
+/// (cited at the call site), or a generous sane one where none does.
+///
+/// Every `with_capacity` under `messages/` whose argument is a wire count goes through this; the
+/// source-scan test beside it (`wire_count_capacity_hints_are_capped`) keeps that true.
+pub fn capacity_hint(count: impl TryInto<u64>, cap: usize) -> usize {
+    count
+        .try_into()
+        .ok()
+        .and_then(|n| usize::try_from(n).ok())
+        .map_or(cap, |n| n.min(cap))
+}
+
 /// A 3-float position/vector in raw WoW coordinates.
 #[derive(Debug, Clone, Copy, PartialEq)]
 pub struct Vector3d {
@@ -160,4 +181,173 @@ mod tests {
             assert_eq!((v.x, v.y, v.z), (x, y, z));
         }
     }
+    #[test]
+    fn capacity_hint_is_the_smaller_of_count_and_cap() {
+        assert_eq!(capacity_hint(3u8, 64), 3);
+        assert_eq!(capacity_hint(0xFFFF_FFFFu32, 64), 64);
+        assert_eq!(capacity_hint(0u32, 64), 0);
+        assert_eq!(capacity_hint(usize::MAX, 8), 8);
+        assert_eq!(capacity_hint(u64::MAX, 1024), 1024);
+    }
+
+    /// **The rule, enforced instead of remembered** (decision 2265 §B1).
+    ///
+    /// A `Vec::with_capacity` whose argument is a raw wire count aborts the process — not the
+    /// packet — the day a server (or a decoder bug) puts a huge number there: an allocation
+    /// failure never unwinds, so it never becomes `Poll::Skipped`. There is no runtime signal to
+    /// test for, which is exactly why the check is structural: every `with_capacity(` under
+    /// `messages/` whose argument is a bare variable (cast or not) must go through
+    /// [`capacity_hint`] or carry a `.min(`, or be named in [`EXEMPT`] with the reason.
+    #[test]
+    fn wire_count_capacity_hints_are_capped() {
+        let root = std::path::Path::new(env!("CARGO_MANIFEST_DIR")).join("src/messages");
+        let mut offenders = Vec::new();
+        for file in rust_files(&root) {
+            let text = std::fs::read_to_string(&file).expect("readable source");
+            let rel = file
+                .strip_prefix(&root)
+                .unwrap_or(&file)
+                .to_string_lossy()
+                .replace('\\', "/");
+            for (line_no, arg) in capacity_arguments(&text) {
+                if uncapped_wire_count(&arg) && !EXEMPT.contains(&(rel.as_str(), arg.as_str())) {
+                    offenders.push(format!("{rel}:{line_no}: `with_capacity({arg})`"));
+                }
+            }
+        }
+        assert!(
+            offenders.is_empty(),
+            "these capacity hints are raw wire counts — an unsatisfiable allocation aborts the \
+             process instead of skipping the packet. Bound each with \
+             `crate::wire::capacity_hint(count, CAP)` (CAP = the protocol's own bound, cited at \
+             the site, or a generous sane one), or add it to `EXEMPT` in `wire.rs` with the reason \
+             it is not a wire count (decision 2265 §B1):\n  {}",
+            offenders.join("\n  ")
+        );
+    }
+
+    /// `with_capacity` arguments under `messages/` that look like bare variables but are **not**
+    /// wire counts, each with the reason. Keyed `(path under src/messages/, argument text)`.
+    const EXEMPT: &[(&str, &str)] = &[];
+
+    /// The classifier, pinned on synthetic arguments so a regression in it cannot pass silently
+    /// as "nothing to flag".
+    #[test]
+    fn the_scan_flags_a_bare_wire_count_and_passes_a_bounded_one() {
+        // Flagged: a bare variable, with or without the cast, however it is wrapped.
+        for arg in [
+            "count as usize",
+            "count",
+            "(count as usize)",
+            "usize::from(count)",
+            "option_count as usize",
+            "n as usize",
+        ] {
+            assert!(uncapped_wire_count(arg), "should flag `{arg}`");
+        }
+        // Passes: literals, length arithmetic, a constant, and the two bounded forms.
+        for arg in [
+            "12",
+            "name.len() + 1",
+            "NPC_TEXT_BLOCKS",
+            "QUEST_OBJECTIVES_COUNT as usize",
+            "capacity_hint(count, 64)",
+            "(count as usize).min(64)",
+            "count.min(0xFFFF) as usize",
+            "8 + 8 * entries.len()",
+            "addons.iter().map(|a| a.name.len() + 10).sum()",
+        ] {
+            assert!(!uncapped_wire_count(arg), "should pass `{arg}`");
+        }
+        // The extractor: the balanced argument of every call on the line, with its line number.
+        let src = "let a = Vec::with_capacity(count as usize);\nlet b = Vec::with_capacity((n as usize).min(4));\n";
+        assert_eq!(
+            capacity_arguments(src),
+            vec![
+                (1, "count as usize".to_string()),
+                (2, "(n as usize).min(4)".to_string())
+            ]
+        );
+    }
+
+    /// Is this `with_capacity` argument a raw wire count? A bare identifier (optionally cast
+    /// `as usize`, optionally parenthesised, optionally `usize::from(...)`-wrapped) that is not a
+    /// `const` (all caps) and carries neither `.min(` nor `capacity_hint(`.
+    fn uncapped_wire_count(arg: &str) -> bool {
+        if arg.contains(".min(") || arg.contains("capacity_hint(") {
+            return false;
+        }
+        let mut inner = arg.trim();
+        loop {
+            let t = inner.trim();
+            if let Some(rest) = t
+                .strip_prefix("usize::from(")
+                .and_then(|r| r.strip_suffix(')'))
+            {
+                inner = rest;
+            } else if let Some(rest) = t.strip_prefix('(').and_then(|r| r.strip_suffix(')')) {
+                inner = rest;
+            } else if let Some(rest) = t.strip_suffix("as usize") {
+                inner = rest;
+            } else {
+                inner = t;
+                break;
+            }
+        }
+        let is_ident = !inner.is_empty()
+            && inner.chars().all(|c| c.is_ascii_alphanumeric() || c == '_')
+            && !inner.starts_with(|c: char| c.is_ascii_digit());
+        // A `const` is SCREAMING_CASE; a wire count is a local.
+        is_ident && inner.chars().any(|c| c.is_ascii_lowercase())
+    }
+
+    /// Every `with_capacity(` call's balanced argument text in `text`, with its 1-based line.
+    fn capacity_arguments(text: &str) -> Vec<(usize, String)> {
+        let mut out = Vec::new();
+        let needle = "with_capacity(";
+        let mut from = 0;
+        while let Some(at) = text[from..].find(needle) {
+            let open = from + at + needle.len();
+            let mut depth = 1usize;
+            let mut end = open;
+            for (i, c) in text[open..].char_indices() {
+                match c {
+                    '(' => depth += 1,
+                    ')' => {
+                        depth -= 1;
+                        if depth == 0 {
+                            end = open + i;
+                            break;
+                        }
+                    }
+                    _ => {}
+                }
+            }
+            let line = text[..open].matches('\n').count() + 1;
+            out.push((line, text[open..end].trim().to_string()));
+            from = end.max(open);
+        }
+        out
+    }
+
+    /// Every `.rs` file under `root`, recursively.
+    fn rust_files(root: &std::path::Path) -> Vec<std::path::PathBuf> {
+        let mut out = Vec::new();
+        let mut stack = vec![root.to_path_buf()];
+        while let Some(dir) = stack.pop() {
+            let Ok(entries) = std::fs::read_dir(&dir) else {
+                continue;
+            };
+            for entry in entries.flatten() {
+                let path = entry.path();
+                if path.is_dir() {
+                    stack.push(path);
+                } else if path.extension().is_some_and(|e| e == "rs") {
+                    out.push(path);
+                }
+            }
+        }
+        out.sort();
+        out
+    }
 }
diff --git a/crates/benilla-protocol/src/world/reader.rs b/crates/benilla-protocol/src/world/reader.rs
index 5b194f3f..480f574f 100644
--- a/crates/benilla-protocol/src/world/reader.rs
+++ b/crates/benilla-protocol/src/world/reader.rs
@@ -41,10 +41,11 @@ impl WorldReader {
         if let Err(e) = self.stream.read_exact(&mut body) {
             return Err(anyhow!("world stream closed: {e}"));
         }
-        match messages::parse_server(opcode, &body) {
-            Ok(packet) => Ok(crate::Poll::Events {
+        match messages::parse_server_with_tail(opcode, &body) {
+            Ok((packet, tail)) => Ok(crate::Poll::Events {
                 opcode,
                 events: crate::decode(packet),
+                tail,
             }),
             // Include the raw body (capped) so an unparseable packet can be decoded by hand — a parse
             // bug is otherwise invisible past "failed to fill whole buffer". The opcode rides
diff --git a/crates/benilla-protocol/src/world/writer/auction.rs b/crates/benilla-protocol/src/world/writer/auction.rs
index 6b4a6781..ddbaf276 100644
--- a/crates/benilla-protocol/src/world/writer/auction.rs
+++ b/crates/benilla-protocol/src/world/writer/auction.rs
@@ -36,7 +36,6 @@ impl WorldWriter {
     /// [`messages::auction_filter`]'s sentinels for the ones left unset. **No sort rides the
     /// wire**: sorting the returned page is entirely ours. `list_from` pages by
     /// [`messages::AUCTION_PAGE_SIZE`]. Answered by `SMSG_AUCTION_LIST_RESULT`.
-    #[allow(clippy::too_many_arguments)]
     pub fn auction_list_items(
         &mut self,
         auctioneer: u64,
diff --git a/crates/benilla-protocol/src/world/writer/mail.rs b/crates/benilla-protocol/src/world/writer/mail.rs
index f9a632f6..3d10954e 100644
--- a/crates/benilla-protocol/src/world/writer/mail.rs
+++ b/crates/benilla-protocol/src/world/writer/mail.rs
@@ -26,7 +26,6 @@ impl WorldWriter {
     /// COD. `stationery`/`package` ride the wire but are discarded server-side (player mail is
     /// always stored `MAIL_STATIONERY_DEFAULT`). Answered by `SMSG_SEND_MAIL_RESULT` (a
     /// `SendMailResult` event).
-    #[allow(clippy::too_many_arguments)]
     pub fn send_mail(
         &mut self,
         mailbox: u64,
diff --git a/crates/benilla-protocol/src/world/writer/self_movement.rs b/crates/benilla-protocol/src/world/writer/self_movement.rs
index 938362dd..887dfe6c 100644
--- a/crates/benilla-protocol/src/world/writer/self_movement.rs
+++ b/crates/benilla-protocol/src/world/writer/self_movement.rs
@@ -25,7 +25,6 @@ impl WorldWriter {
     /// nearby players. `flags` must only set bits whose `MovementInfo` tail we serialize — the base
     /// directional/turn/walk bits, `JUMPING` (with its `jump` tail), `SWIMMING` (with its `pitch`
     /// tail), and `ON_TRANSPORT` (with its `transport` local-frame tail — decision 0438 phase 2).
-    #[allow(clippy::too_many_arguments)]
     pub fn send_movement(
         &mut self,
         opcode: u16,
@@ -133,7 +132,6 @@ impl WorldWriter {
     /// echo the mover `guid` + `counter` + the exact `speed` the server sent, carrying our live
     /// `MovementInfo` (same field set as [`Self::send_movement`] — the server relocates us to it).
     /// Mandatory: unacked, the server force-resolves the change after ~4 s and flags its anticheat.
-    #[allow(clippy::too_many_arguments)]
     pub fn force_speed_change_ack(
         &mut self,
         kind: messages::SpeedKind,
diff --git a/crates/benilla-protocol/tests/char_enum.rs b/crates/benilla-protocol/tests/char_enum.rs
index 76e8e42f..101754d8 100644
--- a/crates/benilla-protocol/tests/char_enum.rs
+++ b/crates/benilla-protocol/tests/char_enum.rs
@@ -12,7 +12,6 @@ use benilla_protocol::ServerPacket;
 
 /// One serialized enum entry, vmangos field order. Non-roster fields get distinct junk values so a
 /// misaligned parse can't accidentally pass.
-#[allow(clippy::too_many_arguments)]
 fn enum_entry(
     guid: u64,
     name: &str,
diff --git a/crates/benilla-protocol/tests/gossip_vendor.rs b/crates/benilla-protocol/tests/gossip_vendor.rs
index 4f0eb103..246dfd28 100644
--- a/crates/benilla-protocol/tests/gossip_vendor.rs
+++ b/crates/benilla-protocol/tests/gossip_vendor.rs
@@ -378,17 +378,42 @@ fn vendor_list_inventory_wire() {
     }
 
     // Empty stock: count = 0 followed by the trailing error byte (ItemHandler.cpp:728-733,
-    // 806-809) — the parser must tolerate it (the row loop simply never runs).
+    // 806-809) — consumed explicitly, so the decode leaves no tail to report.
     let mut empty_body = 0xDDu64.to_le_bytes().to_vec();
     empty_body.push(0); // count
     empty_body.push(0); // trailing errorByte(0)
-    match messages::parse_server(messages::opcode::SMSG_LIST_INVENTORY, &empty_body).unwrap() {
+    let (packet, tail) =
+        messages::parse_server_with_tail(messages::opcode::SMSG_LIST_INVENTORY, &empty_body)
+            .unwrap();
+    assert_eq!(tail, 0, "the error byte is part of the layout, not a tail");
+    match packet {
         ServerPacket::VendorList { vendor, items } => {
             assert_eq!(vendor, 0xDD);
             assert!(items.is_empty());
         }
         other => panic!("empty vendor list, got {}", other.name()),
     }
+    // …and the byte is REQUIRED: a count of 0 with nothing after it is the short read it is.
+    let truncated = &empty_body[..empty_body.len() - 1];
+    assert!(messages::parse_server(messages::opcode::SMSG_LIST_INVENTORY, truncated).is_err());
+}
+
+/// **The falsifier for decision 2265 §B1** on a `u32`-counted list: an option count of
+/// `0xFFFF_FFFF` followed by one valid option must come back as a short-read `Err` — the decoder
+/// must neither reserve the count nor abort.
+#[test]
+fn a_lying_gossip_option_count_is_a_short_read_not_an_allocation() {
+    let mut body = 0x77u64.to_le_bytes().to_vec(); // npc guid
+    body.extend_from_slice(&1u32.to_le_bytes()); // text id
+    body.extend_from_slice(&0xFFFF_FFFFu32.to_le_bytes()); // option count
+    body.extend_from_slice(&0u32.to_le_bytes()); // one valid option: index
+    body.push(0); // icon
+    body.push(0); // coded
+    body.extend_from_slice(b"Hello.\0"); // message
+    let err = messages::parse_server(messages::opcode::SMSG_GOSSIP_MESSAGE, &body)
+        .err()
+        .expect("the second option is missing, so the read is short");
+    assert_eq!(err.kind(), std::io::ErrorKind::UnexpectedEof);
 }
 
 #[test]
diff --git a/crates/benilla-protocol/tests/guild.rs b/crates/benilla-protocol/tests/guild.rs
index ecd2d060..ac312881 100644
--- a/crates/benilla-protocol/tests/guild.rs
+++ b/crates/benilla-protocol/tests/guild.rs
@@ -261,7 +261,6 @@ fn guild_query_response_reports_no_such_guild_as_an_empty_name() {
 /// `last_online` is passed explicitly rather than derived from `presence`, so the *fixture* states
 /// the wire rule independently of the parser under test: an offline member carries the float, an
 /// online one does not.
-#[allow(clippy::too_many_arguments)]
 fn push_member(
     body: &mut Vec<u8>,
     guid: u64,
diff --git a/crates/benilla-protocol/tests/mail.rs b/crates/benilla-protocol/tests/mail.rs
index 244772a2..b8af7981 100644
--- a/crates/benilla-protocol/tests/mail.rs
+++ b/crates/benilla-protocol/tests/mail.rs
@@ -87,7 +87,6 @@ fn mail_send_bodies_golden() {
 /// Append one 8-byte-fixed item block (the tail every `SMSG_MAIL_LIST_RESULT` row always carries,
 /// zeroed when the mail has no attachment): entry, permEnchant, randomPropId, suffixFactor u32 ×4,
 /// stackCount u8, spellCharges/durabilityMax/durabilityCur u32 ×3.
-#[allow(clippy::too_many_arguments)]
 fn push_item_block(
     body: &mut Vec<u8>,
     entry: u32,
diff --git a/crates/benilla-protocol/tests/spells.rs b/crates/benilla-protocol/tests/spells.rs
index 9f1240c6..7b1b4e17 100644
--- a/crates/benilla-protocol/tests/spells.rs
+++ b/crates/benilla-protocol/tests/spells.rs
@@ -741,7 +741,7 @@ fn spell_visual_wire_golden() {
 
 /// An open-lock cast on a chest / locked door: `SMSG_SPELL_GO` whose `SpellCastTargets` names a
 /// GameObject (`TARGET_FLAG_GAMEOBJECT`, no unit target). The decoder must surface the GO guid so the
-/// lid/door animation can open it (decision 0250) — the guid the older decode read for alignment and
+/// lid/door animation can open it (decision 2271) — the guid the older decode read for alignment and
 /// dropped.
 #[test]
 fn spell_go_surfaces_the_gameobject_target() {
diff --git a/crates/benilla-protocol/tests/trainer.rs b/crates/benilla-protocol/tests/trainer.rs
index 81b78190..904e1bae 100644
--- a/crates/benilla-protocol/tests/trainer.rs
+++ b/crates/benilla-protocol/tests/trainer.rs
@@ -38,7 +38,6 @@ fn trainer_send_bodies_golden() {
 /// Append one 38-byte service record (vmangos SendTrainerSpellHelper, NPCHandler.cpp:97-139) to a
 /// SMSG_TRAINER_LIST body: spell u32, state u8, cost u32, canLearnPrimaryProf u32, isPrimaryProfFirstRank
 /// u32, reqLevel u8, reqSkill u32, reqSkillValue u32, then three prerequisite-spell u32s.
-#[allow(clippy::too_many_arguments)]
 fn push_service(
     body: &mut Vec<u8>,
     spell: u32,
diff --git a/crates/benilla-srp/Cargo.toml b/crates/benilla-srp/Cargo.toml
index 15111bc8..c9e9c663 100644
--- a/crates/benilla-srp/Cargo.toml
+++ b/crates/benilla-srp/Cargo.toml
@@ -5,6 +5,9 @@ edition.workspace = true
 license.workspace = true
 description = "WoW 1.12.1 (build 5875) SRP6 client + vanilla world-header crypto — in-repo, decision 0021"
 
+[lints]
+workspace = true
+
 [dependencies]
 num-bigint = "0.4.6"
 sha1.workspace = true
diff --git a/crates/benilla-ui/Cargo.toml b/crates/benilla-ui/Cargo.toml
index af1f704e..96f2f778 100644
--- a/crates/benilla-ui/Cargo.toml
+++ b/crates/benilla-ui/Cargo.toml
@@ -5,6 +5,9 @@ edition.workspace = true
 license.workspace = true
 description = "Engine-free WoW UI engine core: TOC/FrameXML parsing, templates, anchors, z-order — decision 0068"
 
+[lints]
+workspace = true
+
 [dependencies]
 roxmltree = "0.20"
 # The embedded Lua runtime for the script host (decision 0068). `lua51` = Classic Era's Lua
diff --git a/crates/benilla-ui/src/order.rs b/crates/benilla-ui/src/order.rs
index c05b0e43..dfc60077 100644
--- a/crates/benilla-ui/src/order.rs
+++ b/crates/benilla-ui/src/order.rs
@@ -269,7 +269,6 @@ impl ZKey {
     /// The key for one **region** of a frame. `strata`/`level`/`insertion` are the *owner frame's*
     /// (so the region stays grouped behind its frame); `is_fontstring` places textures before
     /// fontstrings at equal (layer, sub-level).
-    #[allow(clippy::too_many_arguments)]
     pub fn region(
         strata: Strata,
         level: u16,
diff --git a/crates/benilla-ui/src/script/skills.rs b/crates/benilla-ui/src/script/skills.rs
index 6fdcb6b6..6e081251 100644
--- a/crates/benilla-ui/src/script/skills.rs
+++ b/crates/benilla-ui/src/script/skills.rs
@@ -556,7 +556,6 @@ mod tests {
     use super::*;
     use crate::script::UiScript;
 
-    #[allow(clippy::too_many_arguments)]
     fn entry(
         skill_id: u32,
         name: &str,
diff --git a/crates/benilla-ui/src/script/tradeskill/tests.rs b/crates/benilla-ui/src/script/tradeskill/tests.rs
index 933d709d..a8def0fa 100644
--- a/crates/benilla-ui/src/script/tradeskill/tests.rs
+++ b/crates/benilla-ui/src/script/tradeskill/tests.rs
@@ -2,7 +2,6 @@ use super::*;
 use crate::script::UiScript;
 
 /// One recipe fixture — a single-reagent, single-tool row, distinct spell/product ids per name.
-#[allow(clippy::too_many_arguments)]
 fn recipe(
     spell_id: u32,
     name: &str,
diff --git a/crates/benilla-visual/Cargo.toml b/crates/benilla-visual/Cargo.toml
index adb63d9c..266d5ea7 100644
--- a/crates/benilla-visual/Cargo.toml
+++ b/crates/benilla-visual/Cargo.toml
@@ -5,6 +5,9 @@ edition.workspace = true
 license.workspace = true
 description = "Perceptual image diff for the Phase-5 visual A/B render harness (decision 0008)"
 
+[lints]
+workspace = true
+
 [dependencies]
 anyhow.workspace = true
 # PNG-only image IO + the RgbImage buffer the metrics run over. No Bevy — this is the pure-math half of
diff --git a/crates/benilla-wdt/Cargo.toml b/crates/benilla-wdt/Cargo.toml
index 80b811bf..e69add2d 100644
--- a/crates/benilla-wdt/Cargo.toml
+++ b/crates/benilla-wdt/Cargo.toml
@@ -4,3 +4,6 @@ version.workspace = true
 edition.workspace = true
 license.workspace = true
 description = "WDT map tile-table reader + tile/world coords for WoW 1.12.1 (build 5875) — in-repo, decision 0021"
+
+[lints]
+workspace = true
diff --git a/crates/benilla-wmo/Cargo.toml b/crates/benilla-wmo/Cargo.toml
index c45bd335..b043efd7 100644
--- a/crates/benilla-wmo/Cargo.toml
+++ b/crates/benilla-wmo/Cargo.toml
@@ -5,5 +5,8 @@ edition.workspace = true
 license.workspace = true
 description = "WMO (root + group) reader for WoW 1.12.1 (build 5875) — in-repo, decision 0021"
 
+[lints]
+workspace = true
+
 [dependencies]
 benilla-bytes = { path = "../benilla-bytes" }
diff --git a/crates/benilla-world/Cargo.toml b/crates/benilla-world/Cargo.toml
index 062aa4a7..eadf82f7 100644
--- a/crates/benilla-world/Cargo.toml
+++ b/crates/benilla-world/Cargo.toml
@@ -5,6 +5,9 @@ edition.workspace = true
 license.workspace = true
 description = "The world renderer: terrain, water, sky, weather, models, lighting, collision and the frame ladder — everything needed to put something in a world and ask the world about itself, with no game attached (decision 1160)"
 
+[lints]
+workspace = true
+
 [features]
 # Forwarded dev/player seam (0026 · 1173/1174 · 1175). Default-on. `benilla-formats` must be taken
 # with `default-features = false` and its `dev` re-exported here: it is default-on there too, so
diff --git a/crates/benilla-world/src/boot.rs b/crates/benilla-world/src/boot.rs
index e1d04c8d..e7ee1843 100644
--- a/crates/benilla-world/src/boot.rs
+++ b/crates/benilla-world/src/boot.rs
@@ -32,9 +32,11 @@ pub fn tuned_default_plugins(primary_window: Window) -> PluginGroupBuilder {
         // (`crate::shaders`, `benilla_app::shaders`, `benilla_assets::materials`) and addressed
         // `embedded://<crate>/shaders/…`, so nothing reaches for a file root at all and 1171's
         // engine/game line survives as the crate each shader is embedded from.
-        // Quiet wgpu/naga; our own crates stay at info.
+        // Quiet wgpu/naga; our own crates stay at info. The ring keeps the last lines of what
+        // stderr shows for the crash report (`log_ring`; decision 2266 §B2).
         .set(bevy::log::LogPlugin {
             filter: "wgpu=error,naga=warn".into(),
+            custom_layer: |_| Some(Box::new(crate::log_ring::LogRing)),
             ..default()
         })
         // Asset streaming is this client's load bottleneck: every M2/WMO/BLP read decompresses from
diff --git a/crates/benilla-world/src/clouds/mod.rs b/crates/benilla-world/src/clouds/mod.rs
index 89a6d8f3..3996dbc7 100644
--- a/crates/benilla-world/src/clouds/mod.rs
+++ b/crates/benilla-world/src/clouds/mod.rs
@@ -105,7 +105,6 @@ impl Plugin for CloudsPlugin {
 /// incremental 32-row band scroll (or the frozen capture clock) — and re-upload the colored
 /// RGBA texels when they changed (the reference's per-regen `0x58ac70` upload of the `0x6cfb00`
 /// color buffer, Addendum A §3).
-#[allow(clippy::too_many_arguments)] // one Bevy system's full input set
 fn tick_clouds(
     mut cov: ResMut<CloudCoverage>,
     light: Res<WowLighting>,
diff --git a/crates/benilla-world/src/clutter.rs b/crates/benilla-world/src/clutter.rs
index 96ddf445..8a5d7929 100644
--- a/crates/benilla-world/src/clutter.rs
+++ b/crates/benilla-world/src/clutter.rs
@@ -399,7 +399,6 @@ pub(crate) fn scatter_tile_clutter(
 /// and spawn them as children of `chunk_entity` (so a tile unload cascades to them). Returns the spawned
 /// entities (tracked on the `ClutterChunk` for distance teardown). Same merge as the old per-tile path,
 /// now per-chunk so only the ~70 yd bubble is ever built/drawn.
-#[allow(clippy::too_many_arguments)]
 fn build_chunk_clutter(
     chunk_entity: Entity,
     models: &[(String, Vec<ShadedPlacement>)],
@@ -547,7 +546,6 @@ fn frustum_corner_reach(fov_y: f32, aspect: f32) -> f32 {
 /// the player instead of every loaded tile and, with the per-frame build cap, spreads the cost so a
 /// tile-load no longer builds 256 chunks at once. Build/teardown happen where the fade ramp is
 /// already alpha 0, so they are invisible.
-#[allow(clippy::too_many_arguments)]
 pub(crate) fn stream_chunk_clutter(
     mut commands: Commands,
     cam: Query<(&GlobalTransform, Option<&Projection>), With<WorldCamera>>,
diff --git a/crates/benilla-world/src/collision.rs b/crates/benilla-world/src/collision.rs
index 1081e646..48e68a76 100644
--- a/crates/benilla-world/src/collision.rs
+++ b/crates/benilla-world/src/collision.rs
@@ -346,7 +346,6 @@ impl WorldCollision<'_, '_> {
     }
 
     /// Move `shape` by `velocity` for `delta_time`, sliding along what it hits.
-    #[allow(clippy::too_many_arguments)] // the mover's full step, minus the two the facade owns
     pub fn slide_body(
         &self,
         shape: &Collider,
@@ -369,7 +368,6 @@ impl WorldCollision<'_, '_> {
 
     /// [`slide_body`](Self::slide_body) against a caller-supplied filter — the ghost's door
     /// exclusion, for the reason spelled out on [`cast_body_with`](Self::cast_body_with).
-    #[allow(clippy::too_many_arguments)] // `slide_body`'s list, plus the filter it defaults
     fn slide_body_with(
         &self,
         shape: &Collider,
diff --git a/crates/benilla-world/src/collision/one_sided.rs b/crates/benilla-world/src/collision/one_sided.rs
index 208d3fcb..cad3913d 100644
--- a/crates/benilla-world/src/collision/one_sided.rs
+++ b/crates/benilla-world/src/collision/one_sided.rs
@@ -292,7 +292,6 @@ pub(crate) fn cast_ray(
 /// is what displaced a seated body out of its chair). The `on_hit` callback contract is avian's
 /// ([`MoveAndSlideHitData`] / [`MoveAndSlideHitResponse`]), so the mover's ride/steep-wall handlers
 /// move over unchanged.
-#[allow(clippy::too_many_arguments)]
 pub(crate) fn move_and_slide(
     ms: &MoveAndSlide<'_, '_>,
     shape: &Collider,
diff --git a/crates/benilla-world/src/doodad_anim/lazy.rs b/crates/benilla-world/src/doodad_anim/lazy.rs
index d6b6d38d..58848afb 100644
--- a/crates/benilla-world/src/doodad_anim/lazy.rs
+++ b/crates/benilla-world/src/doodad_anim/lazy.rs
@@ -88,7 +88,6 @@ pub(super) type TwinParts<'w, 's> = Query<
 /// first skinned frame shows the parked pose the static mesh was already showing, and the world
 /// pass takes over the same frame (the wake re-arms the player, whose evaluation re-raises
 /// `pose_dirty`).
-#[allow(clippy::too_many_arguments)] // the gate's full promote handoff
 pub(super) fn promote_lazy_rig(
     commands: &mut Commands,
     palettes: &mut RigPalettes,
diff --git a/crates/benilla-world/src/doodad_anim/mat_anim.rs b/crates/benilla-world/src/doodad_anim/mat_anim.rs
index 297ec129..156ec7ea 100644
--- a/crates/benilla-world/src/doodad_anim/mat_anim.rs
+++ b/crates/benilla-world/src/doodad_anim/mat_anim.rs
@@ -420,7 +420,6 @@ pub fn register_uv(
 /// It over-includes (a part left `Inherited` under a hidden ancestor counts as drawn), which is the
 /// safe direction: an extra write costs a frame's uniform upload, a missed one would freeze a
 /// visible scroll.
-#[allow(clippy::too_many_arguments)]
 pub(super) fn tick_anim_materials(
     time: Res<Time>,
     real: Res<Time<bevy::time::Real>>,
@@ -659,7 +658,6 @@ pub fn register_tint(
 /// works in a deterministic capture** — where [`tick_anim_materials`] is skipped entirely and the
 /// rows stay zero by design. In a live run the `row` column is the tick's real output and the two
 /// halves can be compared directly.
-#[allow(clippy::too_many_arguments)]
 pub(super) fn matanim_probe(
     time: Res<Time>,
     uv_reg: Res<UvAnimMaterials>,
diff --git a/crates/benilla-world/src/doodad_anim/mod.rs b/crates/benilla-world/src/doodad_anim/mod.rs
index 27978875..6ce1d26a 100644
--- a/crates/benilla-world/src/doodad_anim/mod.rs
+++ b/crates/benilla-world/src/doodad_anim/mod.rs
@@ -478,7 +478,7 @@ fn reroll_doodad_variation(
 /// both clocks to the shared-clock position — when one is again. Runs before [`AnimationSystems`] so
 /// a resume's seek lands the same frame. Steady state (nothing flipped) is one `Visibility` read per
 /// mesh, no writes.
-#[allow(clippy::too_many_arguments, clippy::type_complexity)] // one Bevy system's full input set
+#[allow(clippy::type_complexity)] // one Bevy system's full input set
 fn gate_doodad_anim(
     time: Res<Time>,
     mut hosts: Query<(
diff --git a/crates/benilla-world/src/entity_shade.rs b/crates/benilla-world/src/entity_shade.rs
index d624dac5..440993e8 100644
--- a/crates/benilla-world/src/entity_shade.rs
+++ b/crates/benilla-world/src/entity_shade.rs
@@ -349,7 +349,6 @@ impl Plugin for EntityShadePlugin {
 // A Bevy system's params are not an argument list to shorten — each is a distinct world access the
 // scheduler needs by name, and the card pass below deliberately takes its own disjoint `MeshTag`
 // query rather than smuggling one through a shared `ParamSet`.
-#[allow(clippy::too_many_arguments)]
 pub(crate) fn update_ground_shade(
     time: Res<Time>,
     streamer: Option<Res<TerrainStreamer>>,
diff --git a/crates/benilla-world/src/exterior_cull.rs b/crates/benilla-world/src/exterior_cull.rs
index 75a439fa..5e09ba85 100644
--- a/crates/benilla-world/src/exterior_cull.rs
+++ b/crates/benilla-world/src/exterior_cull.rs
@@ -427,7 +427,6 @@ type ElectedBody = (
 /// it is the sole authority for: terrain cells, the WDL far band, and — in the second query below,
 /// a different audience under the same law rather than a second system — the elected net bodies
 /// ([`ElectedBody`], decision 1270), whose roots nothing else writes.
-#[allow(clippy::too_many_arguments)]
 // A Bevy system's params are not an argument list to shorten — each is a distinct world access
 // the scheduler needs by name (the `update_ground_shade` precedent).
 fn apply_exterior_cull(
diff --git a/crates/benilla-world/src/ground_fx.rs b/crates/benilla-world/src/ground_fx.rs
index 479473b6..ae9d9ee0 100644
--- a/crates/benilla-world/src/ground_fx.rs
+++ b/crates/benilla-world/src/ground_fx.rs
@@ -82,7 +82,6 @@ pub(crate) struct GroundFxDecal {
 /// projection rides the effect stream). The caller resolves the part's texture/blend/fog/tint
 /// identity from its shared material; the caller also inserts the part's `MatAnim` rider (its
 /// `current` is the push-time alpha).
-#[allow(clippy::too_many_arguments)] // the part's full draw identity, one call site
 pub fn spawn_ground_fx_decal(
     commands: &mut Commands,
     texture: Handle<Image>,
diff --git a/crates/benilla-world/src/interior.rs b/crates/benilla-world/src/interior.rs
index d1efd070..8348acee 100644
--- a/crates/benilla-world/src/interior.rs
+++ b/crates/benilla-world/src/interior.rs
@@ -470,7 +470,7 @@ pub struct BakeState {
 /// The walk is over ANCHORS, not parts (0734): a settled anchor is one distance compare, whatever
 /// its part count, and parts are written only when their anchor's law changes (or through the
 /// [`InteriorReauthor`] drain — a fresh part, a fade latch, the zoom feather's release).
-#[allow(clippy::type_complexity, clippy::too_many_arguments)]
+#[allow(clippy::type_complexity)]
 pub fn classify_entity_interior(
     mut commands: Commands,
     time: Res<Time>,
@@ -947,7 +947,6 @@ fn attach_anchor(
 /// stuck-black-unit bug; the fade-latch reauthor is the other half). The slot component lives on
 /// the ANCHOR — its on-remove hook frees the slot on despawn; law transitions remove/insert it
 /// here.
-#[allow(clippy::too_many_arguments)]
 fn resolve_anchor_law(
     commands: &mut Commands,
     probes: &mut PropProbes,
diff --git a/crates/benilla-world/src/lib.rs b/crates/benilla-world/src/lib.rs
index e2e6b40a..c3cdc684 100644
--- a/crates/benilla-world/src/lib.rs
+++ b/crates/benilla-world/src/lib.rs
@@ -147,6 +147,7 @@ pub mod interact;
 pub mod interior;
 pub mod lighting;
 pub mod liquid;
+pub mod log_ring;
 
 /// macOS `Cmd+Q`, re-pointed at the window close so the gesture goes through an exit the client
 /// can actually observe (decision 1528).
diff --git a/crates/benilla-world/src/lighting/global_light.rs b/crates/benilla-world/src/lighting/global_light.rs
index 702762ea..0f10e5d2 100644
--- a/crates/benilla-world/src/lighting/global_light.rs
+++ b/crates/benilla-world/src/lighting/global_light.rs
@@ -287,7 +287,7 @@ pub(super) fn per_frame_blob_bytes() -> u64 {
 /// std430 blob. The `.w` lanes carry the faithful invariants the shaders expect (Mod2x 1.0, clamp on,
 /// terrain shininess 20, fog-enable, farclip wall); the model SH coeffs and both water swatches are
 /// derived here once per frame (they used to be recomputed + pushed per-material in `apply_wow_lighting`).
-#[allow(clippy::type_complexity, clippy::too_many_arguments)]
+#[allow(clippy::type_complexity)]
 fn build_light_data(
     light: Res<WowLighting>,
     debug: Res<DebugState>,
diff --git a/crates/benilla-world/src/lighting/resolve.rs b/crates/benilla-world/src/lighting/resolve.rs
index 5072fbb5..7050f0bd 100644
--- a/crates/benilla-world/src/lighting/resolve.rs
+++ b/crates/benilla-world/src/lighting/resolve.rs
@@ -211,7 +211,6 @@ fn hsv_value_scale(c: [f32; 3], f: f32) -> [f32; 3] {
     [c[0] * f, c[1] * f, c[2] * f]
 }
 
-#[allow(clippy::too_many_arguments)]
 pub(super) fn update_time_lighting(
     world_time: Res<super::WorldTime>,
     sampler: Option<Res<LightSampler>>,
diff --git a/crates/benilla-world/src/liquid/query.rs b/crates/benilla-world/src/liquid/query.rs
index 2a2f5916..a957dfd4 100644
--- a/crates/benilla-world/src/liquid/query.rs
+++ b/crates/benilla-world/src/liquid/query.rs
@@ -965,7 +965,6 @@ pub(super) fn lowest_near_corner_drop(rotation: Quat, fov: f32, aspect: f32, nea
 
 // Eight parameters: the probe reads a camera, the loaded surfaces, two scoping resources and a
 // clock, then writes the verdict and its two scalars. They are the inputs the rule has.
-#[allow(clippy::too_many_arguments)]
 pub(super) fn detect_submersion(
     mut underwater: ResMut<Underwater>,
     camera: Query<(&Transform, &Projection), With<WorldCamera>>,
diff --git a/crates/benilla-world/src/liquid/surface.rs b/crates/benilla-world/src/liquid/surface.rs
index 8bf6b52c..45faf5f2 100644
--- a/crates/benilla-world/src/liquid/surface.rs
+++ b/crates/benilla-world/src/liquid/surface.rs
@@ -390,7 +390,6 @@ fn liquid_bevy_mesh(lq: &LiquidMesh, body_color: Option<[f32; 3]>) -> Mesh {
 /// floor. A liquid footprint has no floor of its own, so an unscoped pool claims every position
 /// under its XY forever — the Uldaman entrance read as submerged under a mushroom cave's water
 /// 186 yd overhead (0696), and Undercity's upper slime submerged the rooms 115 yd below it (0701).
-#[allow(clippy::too_many_arguments)] // one param per concern: assets, placement, fog block, scope
 pub(crate) fn spawn_wmo_liquids<'a>(
     commands: &mut Commands,
     liquids: impl Iterator<Item = &'a LiquidMesh>,
diff --git a/crates/benilla-world/src/log_ring.rs b/crates/benilla-world/src/log_ring.rs
new file mode 100644
index 00000000..253337a0
--- /dev/null
+++ b/crates/benilla-world/src/log_ring.rs
@@ -0,0 +1,122 @@
+//! **The last few hundred log lines, kept in memory** — so a crash report can carry what the
+//! client was doing when it died (decision 2266 §B2).
+//!
+//! The only log sink is stderr, and a player's terminal (or a packaged Windows build with no
+//! console at all) is gone with the process. Of bug B390's four reporters one attached anything,
+//! and only because he had set `RUST_BACKTRACE=1` himself. A panic hook can write a file, but a
+//! payload and a backtrace without the minute of log before them is a symptom without a story:
+//! which zone, which opcode, which asset was loading. This ring is that story.
+//!
+//! Installed as [`bevy::log::LogPlugin::custom_layer`] by [`crate::boot::tuned_default_plugins`],
+//! so it sits under the same `EnvFilter` as the stderr formatter — the ring holds exactly the lines
+//! stderr showed, no more (a `wgpu=trace` firehose the filter drops never reaches it either).
+//! Bounded at [`CAPACITY`] lines; the cost is one string clone per emitted line, on the thread that
+//! logged it, behind a mutex that is never held across anything else.
+//!
+//! Read with [`recent`]. Nothing else in the engine reads it: it is an artefact feed, not a log.
+
+use std::collections::VecDeque;
+use std::fmt::Write as _;
+use std::sync::{Mutex, OnceLock};
+use std::time::Instant;
+
+use bevy::log::tracing::field::{Field, Visit};
+use bevy::log::tracing::{Event, Subscriber};
+use bevy::log::tracing_subscriber::layer::Context;
+use bevy::log::tracing_subscriber::Layer;
+
+/// How many lines the ring keeps. Two hundred is about a minute of an ordinary session's `info`
+/// stream and a few seconds of a bad one, which is the window a crash needs.
+pub const CAPACITY: usize = 200;
+
+static RING: Mutex<VecDeque<String>> = Mutex::new(VecDeque::new());
+static START: OnceLock<Instant> = OnceLock::new();
+
+/// The layer. Zero-sized; the state is the module's static so the panic hook — which has no
+/// handle to the subscriber — can read it.
+pub struct LogRing;
+
+impl<S: Subscriber> Layer<S> for LogRing {
+    fn on_event(&self, event: &Event<'_>, _ctx: Context<'_, S>) {
+        let start = START.get_or_init(Instant::now);
+        let meta = event.metadata();
+        let mut line = format!(
+            "+{:9.3}s {:5} {}: ",
+            start.elapsed().as_secs_f64(),
+            meta.level(),
+            meta.target()
+        );
+        event.record(&mut MessageVisitor(&mut line));
+        let mut ring = RING.lock().unwrap_or_else(|p| p.into_inner());
+        if ring.len() >= CAPACITY {
+            ring.pop_front();
+        }
+        ring.push_back(line);
+    }
+}
+
+/// Renders an event's fields the way the stderr formatter does: the `message` field bare, every
+/// other field as ` name=value` after it.
+struct MessageVisitor<'a>(&'a mut String);
+
+impl Visit for MessageVisitor<'_> {
+    fn record_debug(&mut self, field: &Field, value: &dyn std::fmt::Debug) {
+        if field.name() == "message" {
+            let _ = write!(self.0, "{value:?}");
+        } else {
+            let _ = write!(self.0, " {}={:?}", field.name(), value);
+        }
+    }
+
+    fn record_str(&mut self, field: &Field, value: &str) {
+        if field.name() == "message" {
+            self.0.push_str(value);
+        } else {
+            let _ = write!(self.0, " {}={value:?}", field.name());
+        }
+    }
+}
+
+/// The ring's contents, oldest first. A snapshot: the ring keeps filling behind it.
+pub fn recent() -> Vec<String> {
+    RING.lock()
+        .unwrap_or_else(|p| p.into_inner())
+        .iter()
+        .cloned()
+        .collect()
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use bevy::log::tracing_subscriber::layer::SubscriberExt;
+
+    /// The ring is a process-wide static, so this test owns the whole contract in one go: lines
+    /// land in emission order, the message field renders bare and the others as `k=v`, and the
+    /// ring drops its oldest line rather than growing past [`CAPACITY`].
+    #[test]
+    fn the_ring_keeps_the_last_lines_in_order() {
+        let subscriber = bevy::log::tracing_subscriber::registry().with(LogRing);
+        bevy::log::tracing::subscriber::with_default(subscriber, || {
+            for i in 0..(CAPACITY + 5) {
+                bevy::log::tracing::info!(n = i, "ring line");
+            }
+        });
+        let lines = recent();
+        assert_eq!(lines.len(), CAPACITY, "bounded at CAPACITY");
+        let first = &lines[0];
+        assert!(
+            first.contains("ring line n=5"),
+            "oldest surviving line: {first}"
+        );
+        assert!(first.contains(" INFO "), "level rendered: {first}");
+        assert!(
+            lines
+                .last()
+                .unwrap()
+                .contains(&format!("n={}", CAPACITY + 4)),
+            "newest last: {}",
+            lines.last().unwrap()
+        );
+    }
+}
diff --git a/crates/benilla-world/src/model_fade.rs b/crates/benilla-world/src/model_fade.rs
index ea21a77b..f5231566 100644
--- a/crates/benilla-world/src/model_fade.rs
+++ b/crates/benilla-world/src/model_fade.rs
@@ -1153,7 +1153,6 @@ fn start_alpha(tag: Option<&MeshTag>) -> f32 {
 /// itself but has fadeable meshes beneath it). Every entity visited — parts, joints, attach roots,
 /// billboard anchors alike — is recorded in `walked`, which the caller uses to recognise the
 /// world-root billboard cards that follow this model.
-#[allow(clippy::too_many_arguments)]
 fn arm_despawn_descendants(
     entity: Entity,
     now: f32,
diff --git a/crates/benilla-world/src/model_forms.rs b/crates/benilla-world/src/model_forms.rs
index 7aa7df36..d33ac40b 100644
--- a/crates/benilla-world/src/model_forms.rs
+++ b/crates/benilla-world/src/model_forms.rs
@@ -242,7 +242,6 @@ fn build_entry(
 /// urgent requester first — uncapped behind the loading cover (entry/teleport/world-stale), which
 /// exists to absorb exactly that burst. At least one submesh always builds, so progress is
 /// guaranteed. Frees an entry when its model asset leaves the store.
-#[allow(clippy::too_many_arguments)] // a Bevy system: each param is one resource, the app's convention
 pub(crate) fn furnish_model_forms(
     mut forms: ResMut<ModelForms>,
     m2s: Res<Assets<M2Model>>,
diff --git a/crates/benilla-world/src/model_render.rs b/crates/benilla-world/src/model_render.rs
index fd6ed5e2..407fca9a 100644
--- a/crates/benilla-world/src/model_render.rs
+++ b/crates/benilla-world/src/model_render.rs
@@ -220,7 +220,6 @@ pub type MaterialCache = benilla_assets::SpatialCache<MatKey, Handle<WowModelMat
 /// test at all. The source blend is what sets [`TWIN_CUTOUT_MARKER`] right (decision 0842: a twin
 /// built as `Blend` cut every texel under 224/255 out of a stealthed Opaque batch, which erased
 /// Gressil's blade body and left only its high-alpha rune pattern).
-#[allow(clippy::too_many_arguments)]
 pub fn model_material(
     cache: &mut MaterialCache,
     materials: &mut Assets<WowModelMaterial>,
@@ -830,7 +829,7 @@ pub struct FarSideOfWater;
 /// walking regime's continuous despawn stream costs ~0.5 full walks/s instead of 12–22.
 const GC_DEADLINE_SECS: f32 = 2.0;
 
-#[allow(clippy::type_complexity, clippy::too_many_arguments)]
+#[allow(clippy::type_complexity)]
 pub(crate) fn classify_water_side(
     interleave: crate::particles::WaterInterleave,
     mut twins: ResMut<FarSideTwins>,
diff --git a/crates/benilla-world/src/model_render/batch.rs b/crates/benilla-world/src/model_render/batch.rs
index e237dd62..ea4f7263 100644
--- a/crates/benilla-world/src/model_render/batch.rs
+++ b/crates/benilla-world/src/model_render/batch.rs
@@ -434,7 +434,6 @@ impl M2BatchMaterials<'_> {
 
     /// The one call into the twenty-argument builder: every argument but the four this facade's
     /// entry points choose is read straight off the authored batch.
-    #[allow(clippy::too_many_arguments)]
     fn build(
         &mut self,
         sub: &ModelSubmesh,
diff --git a/crates/benilla-world/src/model_render/visibility.rs b/crates/benilla-world/src/model_render/visibility.rs
index 336c38de..f952f24e 100644
--- a/crates/benilla-world/src/model_render/visibility.rs
+++ b/crates/benilla-world/src/model_render/visibility.rs
@@ -26,7 +26,7 @@ use benilla_assets::materials::WowModelMaterial;
 /// Runs every frame (the camera moves, so this can't be snapshot-gated like a pure toggle), but only
 /// **writes** `Visibility` when a submesh's decision actually flips — so the steady-state cost is one
 /// squared-distance compare per submesh and no change-detection churn.
-#[allow(clippy::type_complexity, clippy::too_many_arguments)]
+#[allow(clippy::type_complexity)]
 pub(super) fn apply_model_visibility(
     debug: Res<DebugState>,
     view: Res<ViewDistance>,
diff --git a/crates/benilla-world/src/particles.rs b/crates/benilla-world/src/particles.rs
index 01dbe8e5..9cea071c 100644
--- a/crates/benilla-world/src/particles.rs
+++ b/crates/benilla-world/src/particles.rs
@@ -35,7 +35,7 @@ mod emitdump;
 mod model;
 mod quads;
 pub mod render;
-pub(crate) mod sim; // `SceneGates` is the ribbon sim's draw-set input too (decision 1291)
+pub(crate) mod sim; // `SceneGates` is the ribbon sim's draw-set input too (decision 1294)
 
 use emit::{emit_local, next_u32, rand01, rand_s11};
 use sim::simulate_particles;
diff --git a/crates/benilla-world/src/particles/depthdump.rs b/crates/benilla-world/src/particles/depthdump.rs
index 2963ba10..bad17920 100644
--- a/crates/benilla-world/src/particles/depthdump.rs
+++ b/crates/benilla-world/src/particles/depthdump.rs
@@ -66,7 +66,6 @@ pub(super) fn frame(elapsed: f32, count: &mut u32) -> Option<u32> {
 
 /// Dump one emitter's live pool against the camera it billboards toward.
 #[cold]
-#[allow(clippy::too_many_arguments)] // the sim loop's full draw context, verbatim
 pub(super) fn dump_emitter(
     fidx: u32,
     def: &ParticleEmitterDef,
diff --git a/crates/benilla-world/src/particles/model.rs b/crates/benilla-world/src/particles/model.rs
index 24a555ec..4ff81a48 100644
--- a/crates/benilla-world/src/particles/model.rs
+++ b/crates/benilla-world/src/particles/model.rs
@@ -41,7 +41,6 @@ pub(super) struct ModelInstance {
 /// Grow + position each model-particle emitter's instance pool from its freshly-simulated
 /// pool. Runs after [`super::sim::simulate_particles`] in the same set, so instances land on
 /// this frame's positions (the anchored-exactness rule).
-#[allow(clippy::too_many_arguments)] // a Bevy system: each param is one resource, the app's convention
 pub(super) fn update_model_particles(
     mut commands: Commands,
     models: Res<Assets<M2Model>>,
diff --git a/crates/benilla-world/src/particles/render.rs b/crates/benilla-world/src/particles/render.rs
index 7b31db4d..aa602b98 100644
--- a/crates/benilla-world/src/particles/render.rs
+++ b/crates/benilla-world/src/particles/render.rs
@@ -560,7 +560,6 @@ pub static EFFECT_DRAW_STATS: [std::sync::atomic::AtomicU32; 2] = [
 /// (0733 §2; decal draws are exempt — 0781), upload them, build the frame's index stream in
 /// sorted-item order while merging sort-adjacent compatible items into single draws, and write
 /// the canonical fog-params rows once.
-#[allow(clippy::too_many_arguments)] // one render system's full input set
 fn prepare_effects(
     device: Res<RenderDevice>,
     queue: Res<RenderQueue>,
@@ -761,7 +760,6 @@ fn prepare_effects(
 }
 
 /// Build the view bind group and any missing per-texture groups for this frame's draws.
-#[allow(clippy::too_many_arguments)] // one render system's full input set
 fn prepare_effect_bind_groups(
     device: Res<RenderDevice>,
     pipeline_cache: Res<PipelineCache>,
diff --git a/crates/benilla-world/src/particles/sim.rs b/crates/benilla-world/src/particles/sim.rs
index 4dbd10be..d00df264 100644
--- a/crates/benilla-world/src/particles/sim.rs
+++ b/crates/benilla-world/src/particles/sim.rs
@@ -139,7 +139,6 @@ fn inherit_trigger(accum: &mut f32, held: &mut Vec3, dt: f32, delta: Vec3, live:
 /// PARTICLE's velocity into the child's inherit add (`(1+S11·var)·v` — for children the
 /// inherit vector IS the particle velocity, copied per call at `0x7b5b5e`). A burst child
 /// latches on its first call of the rising-edge frame. A child never self-emits ambiently.
-#[allow(clippy::too_many_arguments)] // the birth fold's full frame, same as the parent path
 fn drive_child(
     child: &mut ChildEmitter,
     now: &benilla_formats::ParamsNow,
@@ -489,7 +488,7 @@ fn scene_frozen(booth: Option<(bool, bool)>, owner_frozen: bool, draining: bool)
 
 /// Per-frame: emit, integrate, and expand each emitter's pool into the shared effect-quad
 /// stream ([`super::buffer::EffectQuads`]).
-#[allow(clippy::too_many_arguments, clippy::type_complexity)] // one Bevy system's full input set
+#[allow(clippy::type_complexity)] // one Bevy system's full input set
 pub(super) fn simulate_particles(
     time: Res<Time>,
     tuning: Res<ParticleTuning>,
diff --git a/crates/benilla-world/src/ribbons.rs b/crates/benilla-world/src/ribbons.rs
index 0292036a..dd8bcde2 100644
--- a/crates/benilla-world/src/ribbons.rs
+++ b/crates/benilla-world/src/ribbons.rs
@@ -221,7 +221,6 @@ pub enum RibbonSeq {
 /// sequence that answers it changes while the instance lives. Refusing at spawn was correct only
 /// for the fixed-sequence lanes it was written for (a held item, a missile) and silently wrong for
 /// everything with a state machine — see [`simulate_ribbons`].
-#[allow(clippy::too_many_arguments)] // the spawn's full wiring, `alpha_src` included
 pub fn spawn_ribbon(
     commands: &mut Commands,
     ribbon: &ModelRibbon,
@@ -286,7 +285,6 @@ pub fn spawn_ribbon(
 
 /// Per-frame: place the node from the owner's live transform, commit/expire edges, sag by
 /// gravity, and write the strip into the shared effect-quad stream.
-#[allow(clippy::too_many_arguments)] // one Bevy system's full input set
 pub(crate) fn simulate_ribbons(
     time: Res<Time>,
     mut commands: Commands,
diff --git a/crates/benilla-world/src/rig_anim/compose.rs b/crates/benilla-world/src/rig_anim/compose.rs
index 6e4e62a3..a13c8826 100644
--- a/crates/benilla-world/src/rig_anim/compose.rs
+++ b/crates/benilla-world/src/rig_anim/compose.rs
@@ -167,7 +167,7 @@ pub(crate) fn seed_rig_rows(
 /// Post-propagation (inside `BillboardPlace`, chained after the entity lane's
 /// `billboard_joint_palette` and before `face_billboards`): finalize every rig that needs it —
 /// palette rows + replaced-subtree anchor re-seats, with the seat-frame cascade.
-#[allow(clippy::type_complexity, clippy::too_many_arguments)] // billboard_joint_palette's shape
+#[allow(clippy::type_complexity)] // billboard_joint_palette's shape
 pub fn finalize_rig_worlds(
     cam: Query<&GlobalTransform, With<WorldCamera>>,
     // `Option<&RigSkin>`, not `&RigSkin` (decision 1365): the doodad lane's rigs hold their
diff --git a/crates/benilla-world/src/skybox.rs b/crates/benilla-world/src/skybox.rs
index ca3d5414..e6410da6 100644
--- a/crates/benilla-world/src/skybox.rs
+++ b/crates/benilla-world/src/skybox.rs
@@ -246,7 +246,6 @@ impl Plugin for SkyboxPlugin {
 /// the reported spot it seeds the street group g08 (`0x42805`, a true interior; pin-probed
 /// 2026-09-01, decision 1827) — which is what lets the crossfade weight engage in the square while
 /// the skybox *name* comes from the flood predicate above.
-#[allow(clippy::too_many_arguments)]
 fn resolve_camera_skybox(
     instances: Query<&crate::wmo_portal::WmoPortalInstance>,
     wmos: Res<Assets<WmoModel>>,
diff --git a/crates/benilla-world/src/static_gx/cull.rs b/crates/benilla-world/src/static_gx/cull.rs
index 8b83bb7a..70c64321 100644
--- a/crates/benilla-world/src/static_gx/cull.rs
+++ b/crates/benilla-world/src/static_gx/cull.rs
@@ -171,7 +171,6 @@ fn spawn_exile(commands: &mut Commands, f: &GxFader, alpha: f32, admitted: bool)
 /// on that same next frame — the retained item dies in the rendered frame the entity
 /// appears (the overlap protocol; see [`FaderState`]). A re-admit reverses both in ONE
 /// frame: the despawn lands before extract and the cleared bit rides the same publish.
-#[allow(clippy::too_many_arguments)]
 pub(super) fn cull_cells(
     mut commands: Commands,
     mut gx: ResMut<StaticGx>,
diff --git a/crates/benilla-world/src/static_gx/render.rs b/crates/benilla-world/src/static_gx/render.rs
index 013430d9..2ed8c691 100644
--- a/crates/benilla-world/src/static_gx/render.rs
+++ b/crates/benilla-world/src/static_gx/render.rs
@@ -338,7 +338,6 @@ fn vertex_layout() -> VertexBufferLayout {
 
 /// (Re-)specialize the four pipelines for the world view's (samples, format), and assemble
 /// visible cells' GPU state: classes, arrays, layer table, bind groups, runs.
-#[allow(clippy::too_many_arguments)]
 fn prepare_static_gx(
     gx: Res<GxWorld>,
     mut cache: ResMut<GxGpuCache>,
diff --git a/crates/benilla-world/src/straddle.rs b/crates/benilla-world/src/straddle.rs
index 82c28da7..208cc7b2 100644
--- a/crates/benilla-world/src/straddle.rs
+++ b/crates/benilla-world/src/straddle.rs
@@ -283,7 +283,6 @@ type BandRoot<'a> = (
 /// Update, after the submersion verdict and before `classify_water_side` — the auto-inserted
 /// sync point between them lands a first-time `ModelWaterBand` before the classifier looks, so
 /// the clip and the twin set flip on the same frame.
-#[allow(clippy::too_many_arguments)]
 pub(crate) fn band_instances(
     interleave: WaterInterleave,
     mut clips: ResMut<WaterClips>,
diff --git a/crates/benilla-world/src/terrain_stream.rs b/crates/benilla-world/src/terrain_stream.rs
index 9ebb2867..a804f585 100644
--- a/crates/benilla-world/src/terrain_stream.rs
+++ b/crates/benilla-world/src/terrain_stream.rs
@@ -619,7 +619,7 @@ impl Plugin for TerrainPlugin {
 /// register its doodad/WMO placements. The desired square is gated on the map's WDT `MAIN` grid
 /// (decision 0476): a tile the map doesn't author is never requested — no NotFound error spam on
 /// open-ocean crossings, and the loading screen's ready/total counts only tiles that can exist.
-#[allow(clippy::too_many_arguments, clippy::type_complexity)] // the bundled asset_stores tuple
+#[allow(clippy::type_complexity)] // the bundled asset_stores tuple
 fn stream_terrain(
     mut commands: Commands,
     mut state: ResMut<TerrainStreamer>,
diff --git a/crates/benilla-world/src/terrain_stream/merge.rs b/crates/benilla-world/src/terrain_stream/merge.rs
index e87f44f3..425e133c 100644
--- a/crates/benilla-world/src/terrain_stream/merge.rs
+++ b/crates/benilla-world/src/terrain_stream/merge.rs
@@ -281,7 +281,6 @@ impl StaticMerge {
     /// and the shader's `> 7` arm pins it opaque). `false` = this site never merges (WMO group
     /// geometry and props — 1418's verdict / the referrer-set key) — the caller spawns the
     /// batch individually, the fail-open arm.
-    #[allow(clippy::too_many_arguments)]
     pub(super) fn divert(
         &mut self,
         site: &MergeSite<'_>,
diff --git a/crates/benilla-world/src/terrain_stream/spawn/assemble.rs b/crates/benilla-world/src/terrain_stream/spawn/assemble.rs
index 2c65c6ff..255539dc 100644
--- a/crates/benilla-world/src/terrain_stream/spawn/assemble.rs
+++ b/crates/benilla-world/src/terrain_stream/spawn/assemble.rs
@@ -82,7 +82,6 @@ pub struct SpawnedModel {
 /// WMO-display GameObject's doodad props ([`crate::entities`]'s `wmo_props`, the ship's sails), which
 /// pass a doodad-LOCAL `transform` + `card_owner` and parent the returned entities under the moving
 /// gameobject (every downstream system reads propagated `GlobalTransform`s, so the composition holds).
-#[allow(clippy::too_many_arguments)]
 pub fn spawn_model_entities(
     commands: &mut Commands,
     mat_cache: &mut MaterialCache,
diff --git a/crates/benilla-world/src/terrain_stream/spawn/mod.rs b/crates/benilla-world/src/terrain_stream/spawn/mod.rs
index 2b9d0d57..5838d886 100644
--- a/crates/benilla-world/src/terrain_stream/spawn/mod.rs
+++ b/crates/benilla-world/src/terrain_stream/spawn/mod.rs
@@ -71,7 +71,6 @@ type SpawnTables<'w> = (
     Option<ResMut<'w, crate::static_gx::StaticGx>>,
 );
 
-#[allow(clippy::too_many_arguments)]
 pub(super) fn spawn_loaded_placements(
     mut commands: Commands,
     placements: ResMut<Placements>,
diff --git a/crates/benilla-world/src/water_fx/mod.rs b/crates/benilla-world/src/water_fx/mod.rs
index 73978607..d2b4c105 100644
--- a/crates/benilla-world/src/water_fx/mod.rs
+++ b/crates/benilla-world/src/water_fx/mod.rs
@@ -318,7 +318,6 @@ fn build_patch(
 
 /// Classify + gate + emit for one unit this frame (the driver `0x5fa760`, once per unit per
 /// frame; emission paced by the unit's shared cooldown cell).
-#[allow(clippy::too_many_arguments)]
 fn drive_unit(
     foam_state: &mut UnitFoam,
     alloc: &mut dyn FnMut(FoamRecord),
@@ -413,7 +412,6 @@ fn drive_unit(
 
 /// Per frame: run the driver for the avatar (its real movement flags — the reference's own
 /// selection bits) and for every streamed unit (the velocity/yaw proxy), emitting pool records.
-#[allow(clippy::too_many_arguments)] // the emitter's real input set; the index ride-along tipped it
 fn emit_water_foam(
     time: Res<Time>,
     materials: Option<Res<FoamAssets>>,
diff --git a/crates/benilla-world/src/wdl.rs b/crates/benilla-world/src/wdl.rs
index 319ede87..dec57ba8 100644
--- a/crates/benilla-world/src/wdl.rs
+++ b/crates/benilla-world/src/wdl.rs
@@ -131,7 +131,6 @@ fn setup_wdl(
     });
 }
 
-#[allow(clippy::too_many_arguments)]
 fn stream_wdl(
     mut commands: Commands,
     streamer: Option<ResMut<WdlStreamer>>,
diff --git a/crates/benilla-world/src/weather/precip/mist.rs b/crates/benilla-world/src/weather/precip/mist.rs
index d351068d..92bd4d31 100644
--- a/crates/benilla-world/src/weather/precip/mist.rs
+++ b/crates/benilla-world/src/weather/precip/mist.rs
@@ -179,7 +179,6 @@ fn accrue(budget: f32, rate: f32, dt: f32) -> f32 {
 /// (the arg is the RAMPED effect density — the same `effect+0xd0` value the drop kinematics
 /// read, so the knee sits on the density, not the raw wire grade), one node per unit, cap 128;
 /// then every node streams along its motion basis and retires at end-of-life.
-#[allow(clippy::too_many_arguments)]
 pub(super) fn run_mist(
     mist: &mut Mist,
     weather: &WeatherState,
diff --git a/crates/benilla-world/src/weather/precip/mod.rs b/crates/benilla-world/src/weather/precip/mod.rs
index 3304841f..059fdf29 100644
--- a/crates/benilla-world/src/weather/precip/mod.rs
+++ b/crates/benilla-world/src/weather/precip/mod.rs
@@ -98,7 +98,7 @@ pub(crate) use wind::{wow_azimuth_to_bevy, WeatherWind};
 
 /// Which weather **leg** we run — the reference picks per the `useWeatherShaders` CVar
 /// (default "1", registered `0x67b81d`) AND a rain.bls/patter.bls ARB validation (`0x58b360`);
-/// the verdict lands in `effect+0`. **SHADER — settled in round 3** (0333, retracting 0332's
+/// the verdict lands in `effect+0`. **SHADER — settled in round 3** (2272, retracting 0332's
 /// fixed-func inference): the shader leg's ~10 s onset is real — close-only packet visibility
 /// (`0x6752b0` bakes at flush alone), the packet-1 forecast orphan, and the RNE parity stick
 /// (`0x6754cc`) stack into a stochastic onset (~75% in the 8.5–14 s band, ~25% at ~5 s), and
@@ -453,7 +453,6 @@ fn setup_precip(
 
 /// Per frame: wind, spawn budgets, integrate, land. (The geometry push is [`push_precip`]'s,
 /// in `PostUpdate` after the stream clear.)
-#[allow(clippy::too_many_arguments)]
 fn simulate_precip(
     time: Res<Time>,
     weather: Res<WeatherState>,
@@ -611,7 +610,6 @@ fn simulate_precip(
 /// anchor at the camera — view-z ≈ 0 sorts them after every world transparent, before the
 /// biased glare/nameplate rungs, exactly where the old camera-anchored layer entities landed.
 /// Indoors nothing is pushed — the frozen drops hang, unrendered (`[0xca80c4]`'s draw kill).
-#[allow(clippy::too_many_arguments)] // one push system's full input set
 fn push_precip(
     precip: Option<Res<Precip>>,
     assets: Option<Res<PrecipAssets>>,
diff --git a/crates/benilla-world/src/weather/precip/pool.rs b/crates/benilla-world/src/weather/precip/pool.rs
index c783a066..3a04b45d 100644
--- a/crates/benilla-world/src/weather/precip/pool.rs
+++ b/crates/benilla-world/src/weather/precip/pool.rs
@@ -294,7 +294,6 @@ pub(super) fn spawn_particle(
 
 /// One kind's frame: record (RNE-counted, packet-stamped), activate sealed cohorts,
 /// integrate, land into the ground layer.
-#[allow(clippy::too_many_arguments)]
 pub(super) fn run_kind(
     pool: &mut Pool,
     kind: WeatherKind,
diff --git a/crates/benilla-world/src/wmo_portal/interior.rs b/crates/benilla-world/src/wmo_portal/interior.rs
index cb8116a9..b1bdfefa 100644
--- a/crates/benilla-world/src/wmo_portal/interior.rs
+++ b/crates/benilla-world/src/wmo_portal/interior.rs
@@ -212,7 +212,6 @@ pub(super) fn track_area_interior(
 /// flicker, 2026-07-03). The camera is the fallback before login / detached free-fly.
 /// Independent of the PVS compute (which early-outs on portal-less models — a portal-less hut
 /// still has a floor to stand on; the *render* seed stays the camera, as the client's does).
-#[allow(clippy::too_many_arguments)] // a Bevy system: each arg is a distinct resource/query
 pub(super) fn track_current_interior(
     wmos: Res<Assets<WmoModel>>,
     viewer: Res<crate::view::Viewer>,
diff --git a/crates/benilla-world/src/wmo_portal/mod.rs b/crates/benilla-world/src/wmo_portal/mod.rs
index b7d92a15..ff7fc4ce 100644
--- a/crates/benilla-world/src/wmo_portal/mod.rs
+++ b/crates/benilla-world/src/wmo_portal/mod.rs
@@ -366,7 +366,6 @@ const MAX_FLOOR_DROP: f32 = 1760.0;
 
 /// Recompute each resident WMO's per-group visible set from the camera. Cheap: a handful of buildings,
 /// each a small portal flood; a portal-less prop just stays all-visible.
-#[allow(clippy::too_many_arguments)] // a Bevy system: each arg is a distinct resource/query
 fn compute_wmo_pvs(
     wmos: Res<Assets<WmoModel>>,
     cam: Query<(&GlobalTransform, &Projection), With<WorldCamera>>,
diff --git a/crates/benilla-world/src/wmo_portal/seed.rs b/crates/benilla-world/src/wmo_portal/seed.rs
index e05779f0..6373b658 100644
--- a/crates/benilla-world/src/wmo_portal/seed.rs
+++ b/crates/benilla-world/src/wmo_portal/seed.rs
@@ -82,7 +82,6 @@ pub fn down_ray_seeds(model: &WmoModel, eye: [f32; 3], terrain_z: Option<f32>) -
 /// space** (the down-ray's own frame), or `None` where there is no terrain surface to hit — off the
 /// streamed tiles, or a hole cut through the ground into this very interior. It is the client's second
 /// probe, and it wins the column whenever it is *strictly* nearer to the eye than the WMO's hit.
-#[allow(clippy::too_many_arguments)] // the model's stored pieces, passed as parallel slices
 pub(crate) fn down_ray_pick(
     tris: &[Vec<[[f32; 3]; 3]>],
     grids: &[Option<ColumnGrid>],
@@ -354,7 +353,6 @@ pub(crate) fn up_ray_claim(
 
 /// The shared body: `up` flips which side of the probe a face must lie on and which candidate
 /// wins — the nearest one in the cast's own direction, exactly as `footprint_scan` does it.
-#[allow(clippy::too_many_arguments)]
 fn ray_claim(
     tris: &[Vec<[[f32; 3]; 3]>],
     bounds: &[Option<([f32; 3], [f32; 3])>],
diff --git a/crates/benilla-worldview/Cargo.toml b/crates/benilla-worldview/Cargo.toml
index baff5ca6..a7a7d236 100644
--- a/crates/benilla-worldview/Cargo.toml
+++ b/crates/benilla-worldview/Cargo.toml
@@ -5,6 +5,9 @@ edition.workspace = true
 license.workspace = true
 description = "The world viewer: the engine with no game attached — and the wall that keeps the split honest (decision 1160)"
 
+[lints]
+workspace = true
+
 [dependencies]
 # **Only the engine.** This is the edge the binary exists to hold: if a world concept
 # ever needs the game, this line is what refuses to let it.
diff --git a/crates/benilla/Cargo.toml b/crates/benilla/Cargo.toml
index 6d7350b9..4505c87c 100644
--- a/crates/benilla/Cargo.toml
+++ b/crates/benilla/Cargo.toml
@@ -5,6 +5,9 @@ edition.workspace = true
 license.workspace = true
 description = "The launcher: build.rs stamps the git build id, main() hands it to benilla-app. A shim, so the stamp's every-commit rebuild dirties this package and not the app crate (decision 0993)"
 
+[lints]
+workspace = true
+
 [features]
 # The dev/player seam, forwarded (decisions 0026 + 1173): this shim is the binary a player would
 # run, so `cargo build -p benilla --no-default-features` is the player build — and the gate.