a crash leaves a report, and the wire's counts are capped

- a panic writes benilla-config/Diagnostics/crash-<time>.txt with the build id, the location, a backtrace and the last 200 log lines, and names the file as its last line, so a bug report can attach it (2266)
- every wire-count allocation hint is capped and the compressed update object reads through the cursor, so a malformed packet can no longer ask for gigabytes (2266)
- the 23 in-world run conditions are one set, the 45 probe variables one registry, the install-gated tests say when they skip, and every gate is timed (2266)
- one workspace-level lint allowance replaces 413 per-site attributes, and the decision corpus gets a lint in the gate (2266)

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

crates/benilla-app/src/ui_script/buff_tests.rs

@@ -69,7 +69,6 @@ fn harness() -> UiScript {
 
 /// Build an [`AuraState`] as the feed would push it. `expiration_time` 0 = permanent (no wire
 /// duration — the reference's "until cancelled"); the `GetTime()` clock starts at 0 in the harness.
-#[allow(clippy::too_many_arguments)]
 fn aura(
     spell_id: u32,
     name: &str,

crates/benilla-app/src/ui_script/extract/mod.rs

@@ -387,7 +387,6 @@ fn splice_simple(eq: &benilla_ui::script::ExtractedQuad) -> bool {
 /// `booths.panes` is the one exception, because [`convert_entry`] writes it through the shared
 /// bridge; re-adding the same tokens is idempotent, so a verify run's panes end up where the full
 /// path would have put them anyway.
-#[allow(clippy::too_many_arguments)]
 fn verify_splice(
     prev: &GateInputs,
     quads: &UiQuads,
@@ -522,7 +521,6 @@ pub(crate) fn seat_text_measurer(script: &mut UiScript, atlas: &UiFontAtlas, sea
 /// p90 of 16 px of lag per frame at 640x360 while a guard walked (the `vpl` trace, 2026-09-10), and
 /// proportionally more at a real window. That is the director's "way more jittered when the
 /// creature is moving".
-#[allow(clippy::too_many_arguments)] // a Bevy system: each param is one resource, the app's convention
 pub(super) fn tick_script(
     script: Option<NonSendMut<UiScript>>,
     window: Query<&Window, With<PrimaryWindow>>,
@@ -776,7 +774,6 @@ pub(super) fn tick_script(
 /// walked after that camera exists. The re-resolve is what makes the plates' fresh anchors real —
 /// it is the layout ledger's incremental pass, so on a frame where nothing but the plates moved it
 /// solves the plates and nothing else.
-#[allow(clippy::too_many_arguments)] // a Bevy system: each param is one resource, the app's convention
 pub(super) fn paint_script(
     script: Option<NonSendMut<UiScript>>,
     window: Query<&Window, With<PrimaryWindow>>,
@@ -1381,7 +1378,6 @@ pub(super) fn paint_script(
 /// splice both call this, which is what makes the splice's output equal the full path's by
 /// construction. An arm is splice-eligible only if it writes nothing but `out` — keep
 /// [`splice_simple`] in agreement when an arm's side effects change.
-#[allow(clippy::too_many_arguments)] // the conversion's whole environment, threaded explicitly
 fn convert_entry(
     eq: benilla_ui::script::ExtractedQuad,
     s: f32,

crates/benilla-app/src/ui_script/frame_flag_gate.rs

@@ -436,8 +436,13 @@ fn describe(frame: &str, flag: Flag, ours: &str, theirs: &str) -> String {
 /// `parent="UIParent"` back on `BlackoutWorld` and it names that.
 #[test]
 fn the_shipped_frames_carry_the_references_flags() {
+    // Two gates, because the corpus and the manifest are two assets: the extracted reference
+    // dir below, and the chain `load_default_ui` reads — under `WOW_DATA=` (1451) the first is
+    // still there and the second is not.
+    let _data = benilla_formats::wow_data_or_skip!();
     let Some(reference) = reference_frames() else {
-        return; // no install — the same skip every client-data test here takes
+        eprintln!("skipping: no extracted reference FrameXML (WoW/_extracted_framexml)");
+        return;
     };
     let nesting = reference_nesting().expect("the same corpus the frames came from");
     assert!(

crates/benilla-app/src/ui_script/lifecycle.rs

@@ -46,7 +46,7 @@ pub(crate) fn setup_script(world: &mut World) {
 /// down at `0x490c97`). Because [`end_ui_session`] routes every login through here, every session's
 /// VM gets the registry and every `inherits="GameFontNormal"` in FrameXML resolves. A design that
 /// dropped the VM and skipped index 0 on the in-game load would fail exactly there — verified in
-/// wow-re's §5 for this change (1291).
+/// wow-re's §5 for this change (2277).
 fn install_boot_vm(world: &mut World) {
     let mut script = match UiScript::new() {
         Ok(s) => s,
@@ -857,7 +857,7 @@ pub(crate) fn arm_leaving_world_on_self_create(
 ///
 /// **The last step is not "destroy the Lua state"** — which is what three of wow-re's own notes
 /// said, until this client's teardown made the question load-bearing and a §5 cross-check settled
-/// it (`system/ui/scratch/lua-state-lifecycle.md`; 1291). `0x490c97` is the frame-script owner's
+/// it (`system/ui/scratch/lua-state-lifecycle.md`; 2277). `0x490c97` is the frame-script owner's
 /// scalar-deleting destructor — the widget tree and the native virtual-font registry — and the Lua
 /// state outlives it. The state is closed and re-opened at `0x703b80`, which reaches `InitLua` by a
 /// **tail-`jmp`** (`0x703b8e`) rather than a call, which is exactly why a call-census missed it.

crates/benilla-app/src/ui_script/mod.rs

@@ -488,7 +488,7 @@ impl Plugin for UiScriptPlugin {
                 Update,
                 (
                     extract::tick_script,
-                    input::feed_ui_input.run_if(in_state(crate::char_select::ClientState::InWorld)),
+                    input::feed_ui_input.in_set(crate::char_select::InWorldGated),
                 )
                     .chain()
                     .in_set(UiInput)

crates/benilla-app/src/ui_script/trainer_tests.rs

@@ -136,7 +136,6 @@ fn text_center(quads: &[ExtractedQuad], needle: &str) -> (f32, f32) {
 
 /// One service in a named skill line, spelling out every field so the intent is legible at the call
 /// site.
-#[allow(clippy::too_many_arguments)]
 fn service(
     spell_id: u32,
     name: &str,