From a5cb3cf7467123696dc4d4d8353cc17f76e6eb62 Mon Sep 17 00:00:00 2001
From: Sam <samuv.eth@gmail.com>
Date: Sat, 29 Aug 2026 17:21:00 +0700
Subject: [PATCH] guild charters: the registrar, the charter, and the twelve
 verbs
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- founding a guild: fourteen opcodes, eight goldens (four mutation-checked), twelve engine globals, `GuildRegistrarFrame` and `PetitionFrame` — `CMSG_PETITION_BUY` is a 72-byte frame the server reads two fields of and drops in silence if short, `allowedGender` is the family's one u16, a signature is a 12-byte stride not 8, and `MSG_PETITION_DECLINE` writes the charter guid and reads the decliner's — same width, opposite meaning
- two sessions, not one: the registrar is an NPC session (closed by walking away — its show event is one of the fourteen callers of the interact latch, so the registrar turns to face you) and the charter is bound to an item guid you carry across the city; right-clicking a charter in your bags opens it, keyed on template flag `0x2000` (item 5863 has no on-use spell and no quest, so every existing item-use arm declined it)
- the byte carve came back and rescored six named guesses — three confirmed, two corrected, one refuted: `PETITION_SHOW` is deferred until every signer name has resolved (the window never paints blank rows), `ClosePetition` on somebody else's charter sends `MSG_PETITION_DECLINE` ("sends nothing" had been chosen on principle and was wrong half the time), and founding a guild is silent — no `ERR_GUILD_FOUNDER_S`, the reference emits no text at all; the four success ids go to chat and the five refusals to the red error frame, three paraphrased strings are now the shipped ones (a sweep asserts all fifteen), and the `npc` unit token had never been fed — the registrar's name banner was blank; `WOW_PROBE_CHARTER=1` drives gossip → buy → open → rename → destroy live, 10/10

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 .../assets/ui/GuildRegistrarFrame.xml         |  346 +++++
 .../benilla-app/assets/ui/PetitionFrame.xml   |  389 +++++
 crates/benilla-app/assets/ui/UiPanels.xml     |   19 +-
 crates/benilla-app/assets/ui/benilla.toc      |   10 +
 crates/benilla-app/src/capture/mod.rs         |    2 +
 .../benilla-app/src/capture/probe_charter.rs  | 1337 +++++++++++++++++
 crates/benilla-app/src/dev.rs                 |    7 +
 crates/benilla-app/src/lib.rs                 |    6 +
 crates/benilla-app/src/net.rs                 |   59 +
 crates/benilla-app/src/net/apply.rs           |   52 +
 crates/benilla-app/src/net/io.rs              |   14 +
 crates/benilla-app/src/target/cursor_mode.rs  |    9 +-
 crates/benilla-app/src/ui_action/drain.rs     |    3 +
 crates/benilla-app/src/ui_items/drain.rs      |   11 +-
 crates/benilla-app/src/ui_items/mod.rs        |   89 ++
 crates/benilla-app/src/ui_petition/feed.rs    |  329 ++++
 crates/benilla-app/src/ui_petition/lines.rs   |  310 ++++
 crates/benilla-app/src/ui_petition/mod.rs     |  683 +++++++++
 crates/benilla-app/src/ui_script/mod.rs       |    6 +
 .../src/ui_script/petition_tests.rs           |  454 ++++++
 crates/benilla-app/src/ui_session.rs          |   18 +-
 crates/benilla-app/src/ui_unit.rs             |   64 +
 crates/benilla-protocol/src/events.rs         |   37 +-
 crates/benilla-protocol/src/events/decode.rs  |   17 +
 crates/benilla-protocol/src/messages/mod.rs   |    8 +
 .../benilla-protocol/src/messages/opcode.rs   |   36 +-
 .../benilla-protocol/src/messages/packet.rs   |   45 +-
 crates/benilla-protocol/src/messages/parse.rs |   29 +-
 .../benilla-protocol/src/messages/petition.rs |  562 +++++++
 .../benilla-protocol/src/world/writer/mod.rs  |    1 +
 .../src/world/writer/petition.rs              |  153 ++
 crates/benilla-protocol/tests/petition.rs     |  386 +++++
 crates/benilla-ui/src/script/mod.rs           |    7 +
 crates/benilla-ui/src/script/model.rs         |   19 +-
 crates/benilla-ui/src/script/petition.rs      |  692 +++++++++
 35 files changed, 6181 insertions(+), 28 deletions(-)
 create mode 100644 crates/benilla-app/assets/ui/GuildRegistrarFrame.xml
 create mode 100644 crates/benilla-app/assets/ui/PetitionFrame.xml
 create mode 100644 crates/benilla-app/src/capture/probe_charter.rs
 create mode 100644 crates/benilla-app/src/ui_petition/feed.rs
 create mode 100644 crates/benilla-app/src/ui_petition/lines.rs
 create mode 100644 crates/benilla-app/src/ui_petition/mod.rs
 create mode 100644 crates/benilla-app/src/ui_script/petition_tests.rs
 create mode 100644 crates/benilla-protocol/src/messages/petition.rs
 create mode 100644 crates/benilla-protocol/src/world/writer/petition.rs
 create mode 100644 crates/benilla-protocol/tests/petition.rs
 create mode 100644 crates/benilla-ui/src/script/petition.rs

diff --git a/crates/benilla-app/assets/ui/GuildRegistrarFrame.xml b/crates/benilla-app/assets/ui/GuildRegistrarFrame.xml
new file mode 100644
index 00000000..627dea98
--- /dev/null
+++ b/crates/benilla-app/assets/ui/GuildRegistrarFrame.xml
@@ -0,0 +1,346 @@
+<Ui>
+    <!--
+        benilla's guild registrar (decision 1672) — the window the "How do I form a guild?" gossip
+        row opens, and the only place a guild charter can be bought or turned in.
+
+        The geometry and art are the real `GuildRegistrarFrame.xml`'s (extracted at
+        `WoW/_extracted_framexml/GuildRegistrarFrame.{xml,lua}`; `ref l.N` cites are into those).
+        Every global, frame name, event, texture, string and number below is the reference's and is
+        the contract addons bind to (1260's rule, still the rule after 1602 retired the
+        transcription gate): what is ours is the expression — named functions instead of inline
+        handler bodies, the service rows over one small local template, and this comment.
+
+        TWO PANELS ON ONE CHROME, exactly as the reference has it (ref l.116, l.196):
+
+          GUILD_REGISTRAR_SHOW   → the window opens on GuildRegistrarGreetingFrame — the two
+                                   service rows, "Purchase a Guild Charter" and "Register a Guild
+                                   Charter".
+          Purchase clicked       → GuildRegistrarPurchaseFrame swaps in: the explanatory text, the
+                                   cost, and the guild-name box. NOT a second window and NOT a
+                                   server round trip — `GuildRegistrar_ShowPurchaseFrame` is a pure
+                                   local swap (ref l.8-12).
+          GUILD_REGISTRAR_CLOSED → the window hides.
+
+        WHY THE COST IS READ AT PANEL-SWAP TIME AND NOT AT SHOW TIME: the reference calls
+        `MoneyFrame_Update("GuildRegistrarMoneyFrame", GetGuildCharterCost())` inside
+        `GuildRegistrar_ShowPurchaseFrame` (ref l.10) — the greeting panel never displays a price.
+        Ours does the same, and it matters here: `GetGuildCharterCost()` answers from the *open
+        registrar's* showlist row, so reading it before a registrar is open would paint a 0.
+
+        THE WINDOW IS NOT SELF-CLOSING ON PURCHASE BY ACCIDENT. Both the Purchase button and the
+        edit box's Enter key hide the whole panel after sending (ref l.253-257, l.312-315) — a buy
+        is one-shot, and the charter arrives as an item rather than as any answer to this window.
+        That is the reference's own behaviour and it is quoted, not invented.
+
+        UIPanel slot system (decision 0084 §2): carries NO hardcoded <Anchors> — ShowUIPanel seats
+        it in the left slot from `UIPanelWindows["GuildRegistrarFrame"]` (UiPanels.xml), which is
+        the reference's own registration (`UIParent.lua:33`, area="left", pushable=0). Hiding it
+        goes through HideUIPanel so the slot is released and ESC reaches it.
+    -->
+
+    <Script><![CDATA[
+        -- ── The registrar's strings (GlobalStrings.lua, verbatim) ──────────────────────────────
+        -- The `text=` attributes below name these KEYS rather than spelling the words, which is
+        -- what the reference's own XML does and what the loader resolves (0991). In a real session
+        -- the app has already run the shipped GlobalStrings.lua, so these lines are the
+        -- standalone-load copy — same values, same file, line numbers named. `X = X or "…"`
+        -- throughout, never a bare `=`, for FriendsFrame.xml's reason: CANCEL and PURCHASE are
+        -- generic names the real string table already owns, and a bare assignment would overwrite
+        -- the shipped value with this copy on every load.
+        AVAILABLE_SERVICES = AVAILABLE_SERVICES or "Available Services"           -- l.128
+        COSTS_LABEL = COSTS_LABEL or "Cost:"                                      -- l.870
+        PURCHASE = PURCHASE or "Purchase"                                         -- l.3128
+        CANCEL = CANCEL or "Cancel"                                               -- l.465
+        GUILD_CHARTER_PURCHASE = GUILD_CHARTER_PURCHASE or "Purchase a Guild Charter" -- l.2058
+        GUILD_CHARTER_REGISTER = GUILD_CHARTER_REGISTER or "Register a Guild Charter" -- l.2059
+        GUILD_REGISTRAR_PURCHASE_TEXT = GUILD_REGISTRAR_PURCHASE_TEXT or "To create a guild you must purchase this charter, get 9 unique player signatures, and return the charter to me.  Please enter the desired name for your guild." -- l.2107
+
+        -- ref GuildRegistrarFrame.lua:1-6. Every show starts on the services list: the purchase
+        -- panel is a transient sub-view, so re-opening the window must not land on a half-filled
+        -- name box from last time.
+        function GuildRegistrar_OnShow()
+            GuildRegistrarGreetingFrame:Show()
+            GuildRegistrarPurchaseFrame:Hide()
+            SetPortraitTexture(GuildRegistrarFramePortrait, "npc")
+            GuildRegistrarFrameNpcNameText:SetText(UnitName("npc"))
+        end
+
+        -- ref GuildRegistrarFrame.lua:8-12. A pure local panel swap — no packet, no round trip.
+        -- The cost is read HERE rather than on show because this is the only panel that displays
+        -- one (see the file header).
+        function GuildRegistrar_ShowPurchaseFrame()
+            GuildRegistrarPurchaseFrame:Show()
+            GuildRegistrarGreetingFrame:Hide()
+            MoneyFrame_Update("GuildRegistrarMoneyFrame", GetGuildCharterCost())
+        end
+
+        -- The buy, shared by the Purchase button and the box's Enter key (ref l.253-257 and
+        -- l.312-315, which carry the same three lines twice). Hiding the panel after sending is
+        -- the reference's own behaviour: a buy is one-shot and its answer is an item arriving, not
+        -- anything this window will be told.
+        function GuildRegistrar_Purchase(name)
+            BuyGuildCharter(name)
+            HideUIPanel(GuildRegistrarFrame)
+            GuildRegistrar_RefocusChat()
+        end
+
+        -- The reference indexes `ChatFrameEditBox` bare (ref l.256, l.314, l.317). Ours nil-guards
+        -- it, this house's convention everywhere it is touched from outside ChatFrame.xml
+        -- (FriendsFrame.xml's four dialogs, BagFrame.xml) — an unguarded index is a real error line
+        -- for anyone who loads this window without the chat frame, which the reference never has to
+        -- consider because there FrameXML is all-or-nothing. The refocus itself stays
+        -- UNCONDITIONAL when the box exists: the popups' extra `IsVisible()` test is a rule about
+        -- dialogs, not about this window, and borrowing it would change behaviour rather than
+        -- harden it.
+        function GuildRegistrar_RefocusChat()
+            if ChatFrameEditBox then
+                ChatFrameEditBox:SetFocus()
+            end
+        end
+
+        -- ref l.318-327. The show arm's `IsVisible` re-test is the reference's own: ShowUIPanel can
+        -- refuse (another window owns the slot, or the player is dead), and a registrar session the
+        -- server thinks is open with no window on screen is a stuck NPC — so the client closes it
+        -- back out immediately.
+        function GuildRegistrar_OnEvent(event)
+            if event == "GUILD_REGISTRAR_SHOW" then
+                ShowUIPanel(GuildRegistrarFrame)
+                if not GuildRegistrarFrame:IsVisible() then
+                    CloseGuildRegistrar()
+                end
+            elseif event == "GUILD_REGISTRAR_CLOSED" then
+                HideUIPanel(GuildRegistrarFrame)
+            end
+        end
+    ]]></Script>
+
+    <!-- One service row (ref inherits="QuestTitleButtonTemplate", QuestFrameTemplates.xml l.174-213):
+         a bullet plus the service name. Local rather than QuestFrame.xml's
+         `BenillaQuestTitleButtonTemplate` because that one hardwires `QuestTitleButton_OnClick()`
+         and would drag this window's load order behind the questgiver's for a fifteen-line shape.
+         Same LEFT-anchored title as that template, and for the same reason: the round bullet is
+         cell-centred, so a TOPLEFT-anchored label rides above it (QuestFrame.xml's own note). -->
+    <Button name="BenillaGuildRegistrarServiceTemplate" virtual="true" hidden="true">
+        <Size><AbsDimension x="285" y="16"/></Size>
+        <Layers>
+            <Layer level="BACKGROUND">
+                <Texture file="Interface\QuestFrame\UI-Quest-BulletPoint">
+                    <Size><AbsDimension x="16" y="16"/></Size>
+                    <Anchors><Anchor point="TOPLEFT" relativePoint="TOPLEFT"/></Anchors>
+                </Texture>
+            </Layer>
+        </Layers>
+        <HighlightTexture file="Interface\QuestFrame\UI-QuestTitleHighlight" alphaMode="ADD"/>
+        <ButtonText>
+            <Size><AbsDimension x="275" y="0"/></Size>
+            <Anchors><Anchor point="LEFT" relativePoint="LEFT"><Offset><AbsDimension x="20" y="0"/></Offset></Anchor></Anchors>
+        </ButtonText>
+        <NormalFont inherits="QuestFont" justifyH="LEFT"/>
+    </Button>
+
+    <Frame name="GuildRegistrarFrame" toplevel="true" parent="UIParent" movable="true" enableMouse="true" hidden="true">
+        <Size><AbsDimension x="384" y="512"/></Size>
+        <!-- ref l.16-19: the window's own dead zone at the right edge and along the bottom, so a
+             drag on the parchment's painted border does not grab the window. -->
+        <HitRectInsets><AbsInset left="0" right="30" top="0" bottom="70"/></HitRectInsets>
+        <Layers>
+            <Layer level="BACKGROUND">
+                <!-- The NPC's face (ref l.21-31), filled by SetPortraitTexture on show. -->
+                <Texture name="GuildRegistrarFramePortrait">
+                    <Size><AbsDimension x="60" y="60"/></Size>
+                    <Anchors><Anchor point="TOPLEFT"><Offset><AbsDimension x="7" y="-6"/></Offset></Anchor></Anchors>
+                </Texture>
+            </Layer>
+            <Layer level="ARTWORK">
+                <!-- The quest-greeting parchment, four quadrant slabs (ref l.34-65) — the same art
+                     GossipFrame and QuestFrame wear, at the same 384x512. -->
+                <Texture file="Interface\QuestFrame\UI-QuestGreeting-TopLeft">
+                    <Size><AbsDimension x="256" y="256"/></Size>
+                    <Anchors><Anchor point="TOPLEFT"/></Anchors>
+                </Texture>
+                <Texture file="Interface\QuestFrame\UI-QuestGreeting-TopRight">
+                    <Size><AbsDimension x="128" y="256"/></Size>
+                    <Anchors><Anchor point="TOPRIGHT"/></Anchors>
+                </Texture>
+                <Texture file="Interface\QuestFrame\UI-QuestGreeting-BotLeft">
+                    <Size><AbsDimension x="256" y="256"/></Size>
+                    <Anchors><Anchor point="BOTTOMLEFT"/></Anchors>
+                </Texture>
+                <Texture file="Interface\QuestFrame\UI-QuestGreeting-BotRight">
+                    <Size><AbsDimension x="128" y="256"/></Size>
+                    <Anchors><Anchor point="BOTTOMRIGHT"/></Anchors>
+                </Texture>
+                <!-- ref l.66-79. Defined but never written by the shipped UI; kept because it is a
+                     name an addon can reach. -->
+                <FontString name="GuildRegistrarText" inherits="QuestFont" justifyH="LEFT">
+                    <Size><AbsDimension x="270" y="0"/></Size>
+                    <Anchors><Anchor point="TOPLEFT"><Offset><AbsDimension x="10" y="-10"/></Offset></Anchor></Anchors>
+                </FontString>
+            </Layer>
+        </Layers>
+        <Frames>
+            <!-- The title banner (ref l.83-107): the NPC's name, two frame levels above the
+                 parchment so it is not painted over. -->
+            <Frame name="GuildRegistrarNpcNameFrame">
+                <Size><AbsDimension x="300" y="14"/></Size>
+                <Anchors>
+                    <Anchor point="TOP" relativeTo="GuildRegistrarFrame" relativePoint="TOP"><Offset><AbsDimension x="0" y="-23"/></Offset></Anchor>
+                </Anchors>
+                <Layers>
+                    <Layer level="BACKGROUND">
+                        <FontString name="GuildRegistrarFrameNpcNameText" inherits="GameFontHighlight"/>
+                    </Layer>
+                </Layers>
+                <Scripts>
+                    <OnLoad>this:SetFrameLevel(this:GetFrameLevel() + 2)</OnLoad>
+                </Scripts>
+            </Frame>
+
+            <Button name="GuildRegistrarFrameCloseButton" inherits="UIPanelCloseButton">
+                <Anchors>
+                    <Anchor point="CENTER" relativeTo="GuildRegistrarFrame" relativePoint="TOPRIGHT"><Offset><AbsDimension x="-42" y="-30"/></Offset></Anchor>
+                </Anchors>
+            </Button>
+
+            <!-- ── Panel 1: the services list ─────────────────────────────────────────────── -->
+            <Frame name="GuildRegistrarGreetingFrame" setAllPoints="true" hidden="true">
+                <Layers>
+                    <Layer level="BACKGROUND">
+                        <FontString name="AvailableServicesText" inherits="QuestTitleFont" text="AVAILABLE_SERVICES" justifyH="LEFT">
+                            <Size><AbsDimension x="300" y="0"/></Size>
+                            <Anchors><Anchor point="TOPLEFT"><Offset><AbsDimension x="35" y="-100"/></Offset></Anchor></Anchors>
+                        </FontString>
+                        <!-- The torn-parchment patch along the bottom edge (ref l.127-138). -->
+                        <Texture file="Interface\QuestFrame\UI-Quest-BotLeftPatch">
+                            <Size><AbsDimension x="128" y="64"/></Size>
+                            <Anchors><Anchor point="BOTTOMLEFT"><Offset><AbsDimension x="22" y="68"/></Offset></Anchor></Anchors>
+                        </Texture>
+                    </Layer>
+                </Layers>
+                <Frames>
+                    <Button name="GuildRegistrarFrameGoodbyeButton" inherits="UIPanelButtonTemplate" text="CANCEL">
+                        <Size><AbsDimension x="75" y="22"/></Size>
+                        <Anchors>
+                            <Anchor point="BOTTOMRIGHT" relativeTo="GuildRegistrarFrame" relativePoint="BOTTOMRIGHT"><Offset><AbsDimension x="-40" y="72"/></Offset></Anchor>
+                        </Anchors>
+                        <Scripts><OnClick>HideUIPanel(GuildRegistrarFrame)</OnClick></Scripts>
+                    </Button>
+                    <Button name="GuildRegistrarButton1" inherits="BenillaGuildRegistrarServiceTemplate" text="GUILD_CHARTER_PURCHASE">
+                        <Anchors>
+                            <Anchor point="TOPLEFT" relativeTo="AvailableServicesText" relativePoint="BOTTOMLEFT"><Offset><AbsDimension x="-10" y="-10"/></Offset></Anchor>
+                        </Anchors>
+                        <Scripts><OnClick>GuildRegistrar_ShowPurchaseFrame()</OnClick></Scripts>
+                    </Button>
+                    <Button name="GuildRegistrarButton2" inherits="BenillaGuildRegistrarServiceTemplate" text="GUILD_CHARTER_REGISTER">
+                        <Anchors>
+                            <Anchor point="TOPLEFT" relativeTo="GuildRegistrarButton1" relativePoint="BOTTOMLEFT"/>
+                        </Anchors>
+                        <!-- Turn the charter in. Takes no argument: the engine finds the charter in
+                             the bags, because the wire wants an item guid and Lua has no way to
+                             name one. A player with no charter gets ERR_NO_GUILD_CHARTER and no
+                             packet leaves (`ui_petition::feed`'s drain). -->
+                        <Scripts><OnClick>TurnInGuildCharter()</OnClick></Scripts>
+                    </Button>
+                    <!-- The reference's third row, "Design a Guild Crest", is COMMENTED OUT in the
+                         shipped file (ref l.183-194) and its `GUILD_CREST_DESIGN` string does not
+                         exist in 1.12's GlobalStrings — tabard design runs off its own NPC gossip
+                         option, not this window. Not shipped here either, deliberately: the
+                         reference's own dead code is not a gap to fill. -->
+                </Frames>
+            </Frame>
+
+            <!-- ── Panel 2: buy a charter ─────────────────────────────────────────────────── -->
+            <Frame name="GuildRegistrarPurchaseFrame" setAllPoints="true" hidden="true">
+                <Layers>
+                    <Layer level="ARTWORK">
+                        <FontString name="GuildRegistrarPurchaseText" inherits="QuestFont" text="GUILD_REGISTRAR_PURCHASE_TEXT" justifyH="LEFT">
+                            <Size><AbsDimension x="270" y="0"/></Size>
+                            <Anchors><Anchor point="TOPLEFT"><Offset><AbsDimension x="35" y="-95"/></Offset></Anchor></Anchors>
+                        </FontString>
+                        <FontString name="GuildRegistrarCostLabel" inherits="GameFontNormal" text="COSTS_LABEL">
+                            <Anchors>
+                                <Anchor point="TOPLEFT" relativeTo="GuildRegistrarPurchaseText" relativePoint="BOTTOMLEFT"><Offset><AbsDimension x="0" y="-5"/></Offset></Anchor>
+                            </Anchors>
+                        </FontString>
+                    </Layer>
+                </Layers>
+                <Frames>
+                    <!-- The shared money kit (MoneyFrame.xml), STATIC type — a read-only price, no
+                         click-to-edit. GetGuildCharterCost() answers in copper, which is this
+                         kit's whole vocabulary. -->
+                    <Frame name="GuildRegistrarMoneyFrame" inherits="MoneyFrameTemplate">
+                        <Anchors>
+                            <Anchor point="LEFT" relativeTo="GuildRegistrarCostLabel" relativePoint="RIGHT"><Offset><AbsDimension x="15" y="0"/></Offset></Anchor>
+                        </Anchors>
+                        <Scripts>
+                            <OnLoad>
+                                MoneyFrame_OnLoad()
+                                MoneyFrame_SetType("STATIC")
+                            </OnLoad>
+                        </Scripts>
+                    </Frame>
+                    <Button name="GuildRegistrarFrameCancelButton" inherits="UIPanelButtonTemplate" text="CANCEL">
+                        <Size><AbsDimension x="75" y="22"/></Size>
+                        <Anchors>
+                            <Anchor point="BOTTOMRIGHT" relativeTo="GuildRegistrarFrame" relativePoint="BOTTOMRIGHT"><Offset><AbsDimension x="-40" y="72"/></Offset></Anchor>
+                        </Anchors>
+                        <Scripts><OnClick>HideUIPanel(GuildRegistrarFrame)</OnClick></Scripts>
+                    </Button>
+                    <Button name="GuildRegistrarFramePurchaseButton" inherits="UIPanelButtonTemplate" text="PURCHASE">
+                        <Size><AbsDimension x="85" y="22"/></Size>
+                        <Anchors>
+                            <Anchor point="BOTTOMLEFT" relativeTo="GuildRegistrarFrame"><Offset><AbsDimension x="22" y="72"/></Offset></Anchor>
+                        </Anchors>
+                        <Scripts><OnClick>GuildRegistrar_Purchase(GuildRegistrarFrameEditBox:GetText())</OnClick></Scripts>
+                    </Button>
+                    <!-- 24 letters is the server's own MAX_CHARTER_NAME, so the box cannot compose
+                         a name the server will reject for length (ref l.271). -->
+                    <EditBox name="GuildRegistrarFrameEditBox" letters="24" historyLines="1">
+                        <Size><AbsDimension x="130" y="32"/></Size>
+                        <Anchors>
+                            <Anchor point="TOPLEFT" relativeTo="GuildRegistrarCostLabel" relativePoint="BOTTOMLEFT"><Offset><AbsDimension x="0" y="-5"/></Offset></Anchor>
+                        </Anchors>
+                        <Layers>
+                            <Layer level="BACKGROUND">
+                                <Texture file="Interface\ChatFrame\UI-ChatInputBorder-Left">
+                                    <Size><AbsDimension x="75" y="32"/></Size>
+                                    <Anchors><Anchor point="LEFT"><Offset><AbsDimension x="-10" y="0"/></Offset></Anchor></Anchors>
+                                    <TexCoords left="0" right="0.29296875" top="0" bottom="1.0"/>
+                                </Texture>
+                                <Texture file="Interface\ChatFrame\UI-ChatInputBorder-Right">
+                                    <Size><AbsDimension x="75" y="32"/></Size>
+                                    <Anchors><Anchor point="RIGHT"><Offset><AbsDimension x="10" y="0"/></Offset></Anchor></Anchors>
+                                    <TexCoords left="0.70703125" right="1.0" top="0" bottom="1.0"/>
+                                </Texture>
+                            </Layer>
+                        </Layers>
+                        <Scripts>
+                            <OnEnterPressed>GuildRegistrar_Purchase(this:GetText())</OnEnterPressed>
+                            <OnEscapePressed>GuildRegistrar_RefocusChat()</OnEscapePressed>
+                        </Scripts>
+                        <FontString inherits="ChatFontNormal"/>
+                    </EditBox>
+                </Frames>
+            </Frame>
+        </Frames>
+        <Scripts>
+            <OnLoad>
+                this:RegisterEvent("GUILD_REGISTRAR_SHOW")
+                this:RegisterEvent("GUILD_REGISTRAR_CLOSED")
+            </OnLoad>
+            <OnEvent>GuildRegistrar_OnEvent(event)</OnEvent>
+            <OnShow>
+                GuildRegistrar_OnShow()
+                PlaySound("igQuestListOpen")
+            </OnShow>
+            <!-- CloseGuildRegistrar() on hide is load-bearing, not tidiness: it is what clears the
+                 engine's registrar session, so the next GUILD_REGISTRAR_SHOW is a real open (and
+                 GetGuildCharterCost() stops quoting a price for a registrar nobody is talking to).
+                 Same shape as GossipFrame's CloseGossip(). -->
+            <OnHide>
+                PlaySound("igQuestListClose")
+                CloseGuildRegistrar()
+            </OnHide>
+        </Scripts>
+    </Frame>
+</Ui>
diff --git a/crates/benilla-app/assets/ui/PetitionFrame.xml b/crates/benilla-app/assets/ui/PetitionFrame.xml
new file mode 100644
index 00000000..8d5cac8e
--- /dev/null
+++ b/crates/benilla-app/assets/ui/PetitionFrame.xml
@@ -0,0 +1,389 @@
+<Ui>
+    <!--
+        benilla's guild-charter window (decision 1672) — the sheet of parchment nine people have to
+        sign before a guild exists. It opens on a charter: yours, clicked in your bags, or somebody
+        else's, offered to you.
+
+        The geometry and art are the real `PetitionFrame.xml`'s (extracted at
+        `WoW/_extracted_framexml/PetitionFrame.{xml,lua}`; `ref l.N` cites are into those). Every
+        global, frame name, event, texture, string and number is the reference's — the contract
+        addons bind to. What is ours is the expression: `PetitionFrame_Update` is four small painters
+        over a loop instead of one function, the event ladder is a named function, and the nine name
+        rows are built by a loop rather than nine near-identical FontString blocks.
+
+        ONE WINDOW, TWO FACES, decided by a single value (ref PetitionFrame.lua:10-21):
+
+          isOriginator  → the LEADER's view: "Request Signature" + "Rename Guild", and the
+                          leader instructions.
+          not           → the SIGNER's view: "Sign Charter", and the member instructions.
+
+        The two buttons occupy the SAME anchor (ref l.304-336, both BOTTOMLEFT +22,+72) — they are
+        never both visible, which is why Show/Hide rather than Enable/Disable does the switching.
+
+        WHAT THE WINDOW OPENS WITHOUT, AND WHY IT REPAINTS. `SMSG_PETITION_SHOW_SIGNATURES` carries
+        an item guid, an owner guid, a petition id and a list of signer guids — no text at all. The
+        guild's proposed name comes from a separate petition-record query and the names from the
+        name cache, so the first paint is deliberately partial: the title reads empty and unresolved
+        signers read blank until their lookups land, at which point the engine re-fires
+        PETITION_SHOW and this file repaints. `ShowUIPanel` early-returns on an already-visible
+        frame and the open sound rides OnShow, so a repaint costs one `PetitionFrame_Update`.
+        (`ui_petition`'s module doc has the mechanism and flags what is INFERRED in it.)
+
+        THE TWO SIGNATURE NUMBERS ARE DIFFERENT NUMBERS, and this file uses both — that is the
+        reference's own doing, not a wrinkle we added. `MAX_PETITION_SIGNATURES` (9) sizes the name
+        ROWS; `maxSignatures`, from GetPetitionInfo, is what the wire says this charter REQUIRES and
+        is what disables Request Signature (ref l.30-40). They agree at 9 on a stock server and need
+        not on one that lowers its signature requirement.
+
+        UIPanel slot system (decision 0084 §2): no hardcoded <Anchors> — ShowUIPanel seats it in the
+        left slot from `UIPanelWindows["PetitionFrame"]` (UiPanels.xml), the reference's own
+        registration (`UIParent.lua:34`, area="left", pushable=0).
+    -->
+
+    <Script><![CDATA[
+        -- ── The charter's strings (GlobalStrings.lua, verbatim) ────────────────────────────────
+        -- The standalone-load copy of every key this file's `text=` attributes and Lua name; see
+        -- GuildRegistrarFrame.xml's twin block for why it is `X = X or "…"` and never a bare `=`.
+        GUILD_NAME = GUILD_NAME or "Guild Name"                                   -- l.2090
+        GUILD_RANK0_DESC = GUILD_RANK0_DESC or "Guild Master"                     -- l.2102
+        MEMBERS = MEMBERS or "Members"                                            -- l.2683
+        NOT_YET_SIGNED = NOT_YET_SIGNED or "<not yet signed>"                     -- l.2807
+        GUILD_CHARTER_TEMPLATE = GUILD_CHARTER_TEMPLATE or "%s Guild Charter"     -- l.2060
+        SIGN_CHARTER = SIGN_CHARTER or "Sign Charter"                             -- l.3464
+        REQUEST_SIGNATURE = REQUEST_SIGNATURE or "Request Signature"              -- l.3337
+        RENAME_GUILD = RENAME_GUILD or "Rename Guild"                             -- l.3318
+        RENAME_GUILD_LABEL = RENAME_GUILD_LABEL or "Enter new guild name:"        -- l.3319
+        GUILD_PETITION_LEADER_INSTRUCTIONS = GUILD_PETITION_LEADER_INSTRUCTIONS or "Select a player you wish to invite and click <request signature>.   To create this guild, turn it in to the guild registrar when you have filled the charter." -- l.2099
+        GUILD_PETITION_MEMBER_INSTRUCTIONS = GUILD_PETITION_MEMBER_INSTRUCTIONS or "Click the <Sign Charter> button to become a charter member of this guild." -- l.2100
+        ACCEPT = ACCEPT or "Accept"                                               -- l.11
+        CANCEL = CANCEL or "Cancel"                                               -- l.465
+        CLOSE = CLOSE or "Close"                                                  -- l.760
+
+        -- The nine name ROWS (ref PetitionFrame.lua:1). Not the signature requirement — that comes
+        -- off the wire per charter; see the file header.
+        MAX_PETITION_SIGNATURES = 9
+
+        -- The rename dialog (ref StaticPopup.lua:133-160). Registered here rather than in
+        -- UiPanels.xml for the same reason the guild dialogs live in FriendsFrame.xml: a popup
+        -- belongs to the window that raises it. 24 letters is the server's MAX_CHARTER_NAME, so
+        -- the box cannot compose a name that will be refused for length.
+        --
+        -- Accept and Enter run the same two lines, which is why they are one local function; the
+        -- reference spells them out twice (l.139-147). Note the ref's own Enter arm hides the
+        -- dialog and its Accept arm does not — the popup engine hides on a plain Accept anyway.
+        StaticPopupDialogs["RENAME_GUILD"] = {
+            text = RENAME_GUILD_LABEL,
+            button1 = ACCEPT,
+            button2 = CANCEL,
+            hasEditBox = 1,
+            maxLetters = 24,
+            OnAccept = function()
+                RenamePetition(getglobal(this:GetParent():GetName() .. "EditBox"):GetText())
+            end,
+            EditBoxOnEnterPressed = function()
+                RenamePetition(getglobal(this:GetParent():GetName() .. "EditBox"):GetText())
+                this:GetParent():Hide()
+            end,
+            OnShow = function()
+                getglobal(this:GetName() .. "EditBox"):SetFocus()
+            end,
+            OnHide = function()
+                if ChatFrameEditBox and ChatFrameEditBox:IsVisible() then
+                    ChatFrameEditBox:SetFocus()
+                end
+                getglobal(this:GetName() .. "EditBox"):SetText("")
+            end,
+            timeout = 0,
+            exclusive = 1,
+            whileDead = 1,
+        }
+
+        -- ref PetitionFrame.lua:2-42, as four painters. The reference has one function; the split
+        -- is ours, because the four jobs share nothing but the tuple they read.
+        function PetitionFrame_Update()
+            local petitionType, title, bodyText, maxSignatures, originatorName, isOriginator = GetPetitionInfo()
+            PetitionFrame_PaintRole(isOriginator)
+            PetitionFrame_PaintHeader(petitionType, title, originatorName)
+            local numNames = PetitionFrame_PaintSignatures()
+            PetitionFrame_PaintRequestButton(numNames, maxSignatures)
+        end
+
+        -- Which face the window wears. Show/Hide rather than Enable/Disable because the two
+        -- buttons sit on the same anchor (see the header).
+        function PetitionFrame_PaintRole(isOriginator)
+            if isOriginator then
+                PetitionFrameRequestButton:Show()
+                PetitionFrameRenameButton:Show()
+                PetitionFrameSignButton:Hide()
+                PetitionFrameInstructions:SetText(GUILD_PETITION_LEADER_INSTRUCTIONS)
+            else
+                PetitionFrameRequestButton:Hide()
+                PetitionFrameRenameButton:Hide()
+                PetitionFrameSignButton:Show()
+                PetitionFrameInstructions:SetText(GUILD_PETITION_MEMBER_INSTRUCTIONS)
+            end
+            -- The Sign button's own gate is a separate question from which face is showing: a
+            -- charter can be a signer's view and still not be signable (already signed, already
+            -- guilded, full).
+            if CanSignPetition() then
+                PetitionFrameSignButton:Enable()
+            else
+                PetitionFrameSignButton:Disable()
+            end
+        end
+
+        -- The banner and the two named lines. `petitionType` has exactly one value in 1.12,
+        -- "charter"; the else arm is the reference's own dead branch and is kept as written.
+        function PetitionFrame_PaintHeader(petitionType, title, originatorName)
+            if petitionType == "charter" then
+                PetitionFrameNpcNameText:SetText(format(GUILD_CHARTER_TEMPLATE, title))
+                PetitionFrameCharterName:SetText(title)
+                PetitionFrameMasterName:SetText(originatorName)
+            else
+                PetitionFrameNpcNameText:SetText("Petition")
+            end
+        end
+
+        -- Nine rows, always nine: a signed row shows its name, an unsigned one shows
+        -- "<not yet signed>". Returns how many have signed, which the Request button needs.
+        function PetitionFrame_PaintSignatures()
+            local numNames = GetNumPetitionNames()
+            for i = 1, MAX_PETITION_SIGNATURES do
+                local row = getglobal("PetitionFrameMemberName" .. i)
+                if i <= numNames then
+                    row:SetText(GetPetitionNameInfo(i))
+                else
+                    row:SetText(NOT_YET_SIGNED)
+                end
+            end
+            return numNames
+        end
+
+        -- Disabled once the charter is full. `maxSignatures` is the WIRE's requirement, not
+        -- MAX_PETITION_SIGNATURES (ref PetitionFrame.lua:38).
+        function PetitionFrame_PaintRequestButton(numNames, maxSignatures)
+            if numNames >= maxSignatures then
+                PetitionFrameRequestButton:Disable()
+            else
+                PetitionFrameRequestButton:Enable()
+            end
+        end
+
+        -- ref l.375-387. The `IsVisible` re-test after ShowUIPanel is the reference's own: the
+        -- panel manager can refuse, and a charter session the engine thinks is open with no window
+        -- on screen would strand it.
+        --
+        -- PETITION_SHOW also arrives for a REPAINT of a charter already on screen (a name or the
+        -- title resolving), which costs one Update and no sound — see the file header.
+        function PetitionFrame_OnEvent(event)
+            if event == "PETITION_SHOW" then
+                ShowUIPanel(PetitionFrame)
+                if not PetitionFrame:IsVisible() then
+                    ClosePetition()
+                    return
+                end
+                PetitionFrame_Update()
+            elseif event == "PETITION_CLOSED" then
+                HideUIPanel(PetitionFrame)
+            end
+        end
+    ]]></Script>
+
+    <Frame name="PetitionFrame" toplevel="true" parent="UIParent" movable="true" enableMouse="true" hidden="true">
+        <Size><AbsDimension x="384" y="512"/></Size>
+        <HitRectInsets><AbsInset left="0" right="30" top="0" bottom="70"/></HitRectInsets>
+        <Layers>
+            <Layer level="BACKGROUND">
+                <!-- The charter's own icon, not an NPC portrait (ref l.20-30): this window has no
+                     NPC. It is a piece of paper. -->
+                <Texture name="PetitionFramePortrait" file="Interface\PetitionFrame\GuildCharter-Icon">
+                    <Size><AbsDimension x="58" y="58"/></Size>
+                    <Anchors><Anchor point="TOPLEFT"><Offset><AbsDimension x="10" y="-8"/></Offset></Anchor></Anchors>
+                </Texture>
+            </Layer>
+            <Layer level="ARTWORK">
+                <!-- The quest-greeting parchment, four quadrant slabs (ref l.32-63). -->
+                <Texture file="Interface\QuestFrame\UI-QuestGreeting-TopLeft">
+                    <Size><AbsDimension x="256" y="256"/></Size>
+                    <Anchors><Anchor point="TOPLEFT"/></Anchors>
+                </Texture>
+                <Texture file="Interface\QuestFrame\UI-QuestGreeting-TopRight">
+                    <Size><AbsDimension x="128" y="256"/></Size>
+                    <Anchors><Anchor point="TOPRIGHT"/></Anchors>
+                </Texture>
+                <Texture file="Interface\QuestFrame\UI-QuestGreeting-BotLeft">
+                    <Size><AbsDimension x="256" y="256"/></Size>
+                    <Anchors><Anchor point="BOTTOMLEFT"/></Anchors>
+                </Texture>
+                <Texture file="Interface\QuestFrame\UI-QuestGreeting-BotRight">
+                    <Size><AbsDimension x="128" y="256"/></Size>
+                    <Anchors><Anchor point="BOTTOMRIGHT"/></Anchors>
+                </Texture>
+
+                <!-- ref l.66-77. Defined but never written by the shipped UI; kept because it is
+                     a name an addon can reach (GuildRegistrarText's twin). -->
+                <FontString name="PetitionText" inherits="QuestFont" justifyH="LEFT">
+                    <Size><AbsDimension x="270" y="0"/></Size>
+                    <Anchors><Anchor point="TOPLEFT"><Offset><AbsDimension x="10" y="-10"/></Offset></Anchor></Anchors>
+                </FontString>
+
+                <!-- The header block: a static label over its value, three times — "Guild Name",
+                     "Guild Master", "Members" — then the nine signature rows, then the
+                     instructions (ref l.78-257). The labels come from GlobalStrings via `text=`
+                     and are never rewritten; only the two *Name strings and the rows are painted.
+                     The whole column is one anchor chain, so a row's height change pushes
+                     everything below it — which is what lets the instructions sit under a list
+                     that is always nine rows tall. -->
+                <FontString name="PetitionFrameCharterTitle" inherits="QuestTitleFont" text="GUILD_NAME" justifyH="LEFT">
+                    <Size><AbsDimension x="285" y="0"/></Size>
+                    <Anchors><Anchor point="TOPLEFT"><Offset><AbsDimension x="30" y="-95"/></Offset></Anchor></Anchors>
+                </FontString>
+                <FontString name="PetitionFrameCharterName" inherits="QuestFont" justifyH="LEFT">
+                    <Size><AbsDimension x="285" y="0"/></Size>
+                    <Anchors>
+                        <Anchor point="TOPLEFT" relativeTo="PetitionFrameCharterTitle" relativePoint="BOTTOMLEFT"/>
+                    </Anchors>
+                </FontString>
+                <FontString name="PetitionFrameMasterTitle" inherits="QuestTitleFont" text="GUILD_RANK0_DESC" justifyH="LEFT">
+                    <Size><AbsDimension x="285" y="0"/></Size>
+                    <Anchors>
+                        <Anchor point="TOPLEFT" relativeTo="PetitionFrameCharterName" relativePoint="BOTTOMLEFT"><Offset><AbsDimension x="0" y="-5"/></Offset></Anchor>
+                    </Anchors>
+                </FontString>
+                <FontString name="PetitionFrameMasterName" inherits="QuestFont" justifyH="LEFT">
+                    <Size><AbsDimension x="285" y="0"/></Size>
+                    <Anchors>
+                        <Anchor point="TOPLEFT" relativeTo="PetitionFrameMasterTitle" relativePoint="BOTTOMLEFT"/>
+                    </Anchors>
+                </FontString>
+                <FontString name="PetitionFrameMemberTitle" inherits="QuestTitleFont" text="MEMBERS" justifyH="LEFT">
+                    <Size><AbsDimension x="285" y="0"/></Size>
+                    <Anchors>
+                        <Anchor point="TOPLEFT" relativeTo="PetitionFrameMasterName" relativePoint="BOTTOMLEFT"><Offset><AbsDimension x="0" y="-5"/></Offset></Anchor>
+                    </Anchors>
+                </FontString>
+                <!-- Row 1 anchors to the "Members" label; rows 2..9 chain off their predecessor
+                     (ref l.138-245, nine identical blocks). Written out because a FontString
+                     cannot be created from Lua in 1.12 and the chain is what makes the column. -->
+                <FontString name="PetitionFrameMemberName1" inherits="QuestFont" justifyH="LEFT">
+                    <Size><AbsDimension x="285" y="0"/></Size>
+                    <Anchors>
+                        <Anchor point="TOPLEFT" relativeTo="PetitionFrameMemberTitle" relativePoint="BOTTOMLEFT"/>
+                    </Anchors>
+                </FontString>
+                <FontString name="PetitionFrameMemberName2" inherits="QuestFont" justifyH="LEFT">
+                    <Size><AbsDimension x="285" y="0"/></Size>
+                    <Anchors><Anchor point="TOPLEFT" relativeTo="PetitionFrameMemberName1" relativePoint="BOTTOMLEFT"/></Anchors>
+                </FontString>
+                <FontString name="PetitionFrameMemberName3" inherits="QuestFont" justifyH="LEFT">
+                    <Size><AbsDimension x="285" y="0"/></Size>
+                    <Anchors><Anchor point="TOPLEFT" relativeTo="PetitionFrameMemberName2" relativePoint="BOTTOMLEFT"/></Anchors>
+                </FontString>
+                <FontString name="PetitionFrameMemberName4" inherits="QuestFont" justifyH="LEFT">
+                    <Size><AbsDimension x="285" y="0"/></Size>
+                    <Anchors><Anchor point="TOPLEFT" relativeTo="PetitionFrameMemberName3" relativePoint="BOTTOMLEFT"/></Anchors>
+                </FontString>
+                <FontString name="PetitionFrameMemberName5" inherits="QuestFont" justifyH="LEFT">
+                    <Size><AbsDimension x="285" y="0"/></Size>
+                    <Anchors><Anchor point="TOPLEFT" relativeTo="PetitionFrameMemberName4" relativePoint="BOTTOMLEFT"/></Anchors>
+                </FontString>
+                <FontString name="PetitionFrameMemberName6" inherits="QuestFont" justifyH="LEFT">
+                    <Size><AbsDimension x="285" y="0"/></Size>
+                    <Anchors><Anchor point="TOPLEFT" relativeTo="PetitionFrameMemberName5" relativePoint="BOTTOMLEFT"/></Anchors>
+                </FontString>
+                <FontString name="PetitionFrameMemberName7" inherits="QuestFont" justifyH="LEFT">
+                    <Size><AbsDimension x="285" y="0"/></Size>
+                    <Anchors><Anchor point="TOPLEFT" relativeTo="PetitionFrameMemberName6" relativePoint="BOTTOMLEFT"/></Anchors>
+                </FontString>
+                <FontString name="PetitionFrameMemberName8" inherits="QuestFont" justifyH="LEFT">
+                    <Size><AbsDimension x="285" y="0"/></Size>
+                    <Anchors><Anchor point="TOPLEFT" relativeTo="PetitionFrameMemberName7" relativePoint="BOTTOMLEFT"/></Anchors>
+                </FontString>
+                <FontString name="PetitionFrameMemberName9" inherits="QuestFont" justifyH="LEFT">
+                    <Size><AbsDimension x="285" y="0"/></Size>
+                    <Anchors><Anchor point="TOPLEFT" relativeTo="PetitionFrameMemberName8" relativePoint="BOTTOMLEFT"/></Anchors>
+                </FontString>
+                <FontString name="PetitionFrameInstructions" inherits="QuestFont" justifyH="LEFT">
+                    <Size><AbsDimension x="285" y="0"/></Size>
+                    <Anchors>
+                        <Anchor point="TOPLEFT" relativeTo="PetitionFrameMemberName9" relativePoint="BOTTOMLEFT"><Offset><AbsDimension x="0" y="-10"/></Offset></Anchor>
+                    </Anchors>
+                </FontString>
+            </Layer>
+        </Layers>
+        <Frames>
+            <!-- The title banner (ref l.261-286): "<Guild> Guild Charter". -->
+            <Frame name="PetitionNpcNameFrame">
+                <Size><AbsDimension x="300" y="14"/></Size>
+                <Anchors>
+                    <Anchor point="TOP" relativeTo="PetitionFrame" relativePoint="TOP"><Offset><AbsDimension x="0" y="-23"/></Offset></Anchor>
+                </Anchors>
+                <Layers>
+                    <Layer level="BACKGROUND">
+                        <FontString name="PetitionFrameNpcNameText" inherits="GameFontHighlight"/>
+                    </Layer>
+                </Layers>
+                <Scripts>
+                    <OnLoad>this:SetFrameLevel(this:GetFrameLevel() + 2)</OnLoad>
+                </Scripts>
+            </Frame>
+
+            <Button name="PetitionFrameCancelButton" inherits="UIPanelButtonTemplate" text="CLOSE">
+                <Size><AbsDimension x="75" y="22"/></Size>
+                <Anchors>
+                    <Anchor point="BOTTOMRIGHT" relativeTo="PetitionFrame" relativePoint="BOTTOMRIGHT"><Offset><AbsDimension x="-40" y="72"/></Offset></Anchor>
+                </Anchors>
+                <Scripts><OnClick>HideUIPanel(PetitionFrame)</OnClick></Scripts>
+            </Button>
+            <!-- Sign and Request share this anchor: exactly one of them is ever shown. -->
+            <Button name="PetitionFrameSignButton" inherits="UIPanelButtonTemplate" text="SIGN_CHARTER">
+                <Size><AbsDimension x="110" y="22"/></Size>
+                <Anchors>
+                    <Anchor point="BOTTOMLEFT" relativeTo="PetitionFrame"><Offset><AbsDimension x="22" y="72"/></Offset></Anchor>
+                </Anchors>
+                <Scripts><OnClick>SignPetition()</OnClick></Scripts>
+            </Button>
+            <!-- Offers the charter to the current TARGET — the verb carries no argument, so with
+                 nobody targeted nothing is sent (`ui_petition`'s drain). -->
+            <Button name="PetitionFrameRequestButton" inherits="UIPanelButtonTemplate" text="REQUEST_SIGNATURE">
+                <Size><AbsDimension x="140" y="22"/></Size>
+                <Anchors>
+                    <Anchor point="BOTTOMLEFT" relativeTo="PetitionFrame"><Offset><AbsDimension x="22" y="72"/></Offset></Anchor>
+                </Anchors>
+                <Scripts><OnClick>OfferPetition()</OnClick></Scripts>
+            </Button>
+            <Button name="PetitionFrameCloseButton" inherits="UIPanelCloseButton">
+                <Anchors>
+                    <Anchor point="CENTER" relativeTo="PetitionFrame" relativePoint="TOPRIGHT"><Offset><AbsDimension x="-42" y="-30"/></Offset></Anchor>
+                </Anchors>
+            </Button>
+            <!-- Two-point width (ref l.347-362): the button stretches to fill whatever is left
+                 between Request and Close, so its label fits at any panel width. -->
+            <Button name="PetitionFrameRenameButton" inherits="UIPanelButtonTemplate" text="RENAME_GUILD">
+                <Size><AbsDimension x="10" y="22"/></Size>
+                <Anchors>
+                    <Anchor point="LEFT" relativeTo="PetitionFrameRequestButton" relativePoint="RIGHT"><Offset><AbsDimension x="-3" y="0"/></Offset></Anchor>
+                    <Anchor point="RIGHT" relativeTo="PetitionFrameCancelButton" relativePoint="LEFT"/>
+                </Anchors>
+                <Scripts><OnClick>StaticPopup_Show("RENAME_GUILD")</OnClick></Scripts>
+            </Button>
+        </Frames>
+        <Scripts>
+            <OnLoad>
+                this:RegisterEvent("PETITION_SHOW")
+                this:RegisterEvent("PETITION_CLOSED")
+            </OnLoad>
+            <OnEvent>PetitionFrame_OnEvent(event)</OnEvent>
+            <OnShow>PlaySound("igQuestListOpen")</OnShow>
+            <!-- ClosePetition() on hide clears the engine's charter session — the same load-bearing
+                 role CloseGossip() has on GossipFrame. -->
+            <OnHide>
+                PlaySound("igQuestListClose")
+                ClosePetition()
+            </OnHide>
+            <!-- ref l.395-397: the window swallows the wheel rather than letting it reach whatever
+                 is behind it. -->
+            <OnMouseWheel>return</OnMouseWheel>
+        </Scripts>
+    </Frame>
+</Ui>
diff --git a/crates/benilla-app/assets/ui/UiPanels.xml b/crates/benilla-app/assets/ui/UiPanels.xml
index 69f82084..a0c9e4fc 100644
--- a/crates/benilla-app/assets/ui/UiPanels.xml
+++ b/crates/benilla-app/assets/ui/UiPanels.xml
@@ -25,11 +25,11 @@
     -->
     <Script><![CDATA[
         -- UIParent.lua l.14-42: UIPanelWindows["FrameName"] = { area, pushable, whileDead }. Only
-        -- the rows benilla ships today; the ref rows with no benilla window yet (Tabard, Petition,
-        -- GuildRegistrar, Battlefield, Cinematic, WorldStateScore, Minigame) join as their windows
-        -- land (audited row-by-row against the bytes, decision 1507). Three have since left that
-        -- list: the doublewide AuctionFrame with decision 1511, PetStableFrame with 1676, and
-        -- HelpFrame with 1673 — all three are rows below.
+        -- the rows benilla ships today; the ref rows with no benilla window yet (Tabard,
+        -- Battlefield, Cinematic, WorldStateScore, Minigame) join as their windows land (audited
+        -- row-by-row against the bytes, decision 1507). Four have since left that list: the
+        -- doublewide AuctionFrame with decision 1511, PetStableFrame with 1676, HelpFrame with
+        -- 1673, and Petition + GuildRegistrar with 1672 — all of them are rows below.
         UIPanelWindows = {}
         UIPanelWindows["GossipFrame"] = { area = "left", pushable = 0 }
         UIPanelWindows["MerchantFrame"] = { area = "left", pushable = 0 }
@@ -125,6 +125,15 @@
         -- (`UIPanelWindows["FriendsFrame"] = { area = "left", pushable = 0, whileDead = 1 }`,
         -- UIParent.lua l.29). whileDead: a corpse run is exactly when you want to whisper someone.
         UIPanelWindows["FriendsFrame"] = { area = "left", pushable = 0, whileDead = 1 }
+        -- The two guild-charter windows (decision 1672), the ref's own UIParent.lua l.33-34
+        -- verbatim. They are ordinary left-slot rivals of each other and of the gossip menu, all
+        -- pushable 0 — which is exactly right: selecting the registrar's gossip row makes the
+        -- server close the menu and push the charter list, so the registrar replacing the gossip
+        -- window in the same slot IS the handoff. Both must be registered or ShowUIPanel degrades
+        -- to a bare Show() in no slot, which is what left the item-text reader interleaved with a
+        -- gossip window in B288 (1507).
+        UIPanelWindows["GuildRegistrarFrame"] = { area = "left", pushable = 0 }
+        UIPanelWindows["PetitionFrame"] = { area = "left", pushable = 0 }
         -- The macro window (decision 0983, MacroFrame.xml) — the ref's own registration line
         -- verbatim (`UIPanelWindows["MacroFrame"] = { area = "left", pushable = 5, whileDead = 1 }`,
         -- Blizzard_MacroUI.lua:7). whileDead is the ref's and it earns its keep: writing a macro
diff --git a/crates/benilla-app/assets/ui/benilla.toc b/crates/benilla-app/assets/ui/benilla.toc
index a5bba594..11704f53 100644
--- a/crates/benilla-app/assets/ui/benilla.toc
+++ b/crates/benilla-app/assets/ui/benilla.toc
@@ -402,6 +402,16 @@ GroupLootFrame.xml
 # MerchantFrame (the BenillaMoney coin helpers live there) and GossipFrame (shared parchment
 # art conventions); its title/panel-button labels use the auto-centred ButtonText slot.
 QuestFrame.xml
+# The two guild-charter windows (decision 1672): the guild registrar — the window the "How do I
+# form a guild?" gossip row opens — and the charter itself, the sheet nine people sign. Loaded
+# here, right after QuestFrame, because both wear the QuestGreeting parchment and its QuestFont /
+# QuestTitleFont objects and read as that family; they need UiPanels (the panel manager seats both,
+# and PetitionFrame registers its RENAME_GUILD dialog on the shared popup engine), MoneyFrame (the
+# registrar's price rides MoneyFrameTemplate, resolved at LOAD — decision 1580's ordering rule) and
+# UIPanelTemplates (the close/action buttons), all far above. The registrar must come first: no
+# load-order dependency links them, but the flow does, and the pair reads in the order it is used.
+GuildRegistrarFrame.xml
+PetitionFrame.xml
 # The quest log window (decision 0088 arc, the quest-log slice): durable player state, not an
 # NPC session — loaded after MerchantFrame (the BenillaMoney coin helpers it reuses) and
 # alongside QuestFrame (same arc); the 'L' binding (ui_script/input.rs) calls its
diff --git a/crates/benilla-app/src/capture/mod.rs b/crates/benilla-app/src/capture/mod.rs
index 580410cb..bcf5a423 100644
--- a/crates/benilla-app/src/capture/mod.rs
+++ b/crates/benilla-app/src/capture/mod.rs
@@ -87,6 +87,7 @@ mod probe_binder;
 mod probe_book;
 mod probe_castcancel;
 mod probe_charcreate;
+mod probe_charter;
 mod probe_chest;
 mod probe_clam;
 mod probe_crossing;
@@ -111,6 +112,7 @@ pub(crate) use probe_binder::ProbeBinderPlugin;
 pub(crate) use probe_book::ProbeBookPlugin;
 pub(crate) use probe_castcancel::ProbeCastCancelPlugin;
 pub(crate) use probe_charcreate::ProbeCharCreatePlugin;
+pub(crate) use probe_charter::ProbeCharterPlugin;
 pub(crate) use probe_chest::ProbeChestPlugin;
 pub(crate) use probe_clam::ProbeClamPlugin;
 pub(crate) use probe_crossing::ProbeCrossingPlugin;
diff --git a/crates/benilla-app/src/capture/probe_charter.rs b/crates/benilla-app/src/capture/probe_charter.rs
new file mode 100644
index 00000000..e9a8c490
--- /dev/null
+++ b/crates/benilla-app/src/capture/probe_charter.rs
@@ -0,0 +1,1337 @@
+//! The guild-charter live probe (`WOW_PROBE_CHARTER=1`) — decision 1672's end-to-end instrument:
+//! log in, GM-hop to the Stormwind guild registrar, open his gossip menu on the real wire, assert
+//! the charter row's icon reads **petition**, select it by its wire index, buy a charter through
+//! the registrar's own window, right-click the charter in the bags the way a player does, watch the
+//! petition window fill in a round trip later, rename it, and destroy it again so the next run can
+//! do the same. One `PROBE_CHARTER: <step> PASS/FAIL/SKIP <detail>` line per step, then a final
+//! `PROBE_CHARTER: DONE pass=<n> fail=<m>`. Modeled closely on [`super::probe_binder`] — same phase
+//! machine, same trace style, same self-terminating exit ([`super::probes::ProbeExitPlugin`]'s
+//! pattern), same live-VM observation idiom (`script.eval` against the real UI VM) — with
+//! [`super::probe_clam`]'s bag-click leg (`UseContainerItem` through the live VM, so the real
+//! dispatcher runs) and its watch-the-cleanup-land exit.
+//!
+//! **Unit tests cannot reach any of this.** Every claim the charter slice rests on is about what a
+//! real server sends and in what order: a packet that had no const and no parse arm until 1672
+//! landed, a window that deliberately opens *empty* and fills a round trip later, and an item-use
+//! fork arm whose whole evidence is "no other arm accepts a charter". Those are only visible
+//! against real bytes.
+//!
+//! ## The registrar (live-DB verified this session, `/Users/sam/dev/vmangos-deploy` → `mangos` DB)
+//!
+//! Aldwin Laughlin, the Stormwind guild registrar — `creature_template.entry = 4974`, spawn
+//! `creature.guid = 79681`, **map 0**, position `(-8885.25, 614.395, 95.2576)`,
+//! `creature_template.npc_flags = 1537` = `0x601` = GOSSIP | **PETITIONER (0x200)** |
+//! TABARDDESIGNER (0x400), `gossip_menu_id = 708`. Both of the top two bits matter: vmangos's
+//! buy handler fetches the NPC with `GetNPCIfCanInteractWith(guid, UNIT_NPC_FLAG_PETITIONER)` and
+//! then *also* refuses anything that is not `IsTabardDesigner()`
+//! (`Handlers/PetitionsHandler.cpp:44-52`), so a petitioner without the tabard bit sells nothing.
+//!
+//! **`UNIT_NPC_FLAG_PETITIONER` is `0x200`** (vmangos `Objects/UnitDefines.h:666`). The probe
+//! reuses [`crate::target::cursor_mode::npc_flags::PETITIONER`] rather than keeping a second copy
+//! — a duplicated flag table is exactly how B249's icon map went stale.
+//!
+//! ## The charter row (live-DB verified this session)
+//!
+//! `gossip_menu_option` for menu 708 carries **exactly two rows, both unconditional**
+//! (`condition_id = 0`), so a GM probe and a player see the same two — unlike the innkeeper menu
+//! [`super::probe_binder`] walks, where GM mode adds holiday rows:
+//!
+//! | wire index | `option_icon` | `option_id`                    | text                            |
+//! |------------|---------------|--------------------------------|---------------------------------|
+//! | 0          | **7**         | 10 (`GOSSIP_OPTION_PETITIONER`)| *"How do I form a guild?"*      |
+//! | 1          | 8             | 11 (tabard designer)           | *"I want to create a guild crest."* |
+//!
+//! Icon byte **7** is `"petition"` in [`crate::ui_gossip`]'s `GOSSIP_ICON_TYPES` — the client's own
+//! `0x84b7ac` table, byte-verified in decision 1335. The probe finds the row **by that icon byte
+//! and selects by the row's wire index, never by list position**: that is the lesson
+//! [`super::probe_binder`]'s header records, and it is why this probe survives a menu that grows a
+//! row. The label guard is a lowercase substring for the same file's other lesson — vmangos
+//! prefers `option_broadcast_text` (3413) over the `option_text` column, so an equality test would
+//! be asserting which of two copies of the same sentence the server happened to pick.
+//!
+//! ## The charter item and its price (live-DB + vmangos source, verified this session)
+//!
+//! Entry **5863** "Guild Charter", `display_id = 16161`, `flags = 8192` (`0x2000` =
+//! `ITEM_FLAG_CHARTER`), `max_count = 1`, `inventory_type = 0`, `start_quest = 0`, `page_text = 0`,
+//! **no ON_USE spell** and not LOOTABLE. That combination is the whole of
+//! [`crate::ui_items::ItemUseRoute::ShowPetition`]'s evidence: every other arm of the item-use fork
+//! declines a charter, so before 1672 a right-click reached `Nothing` and sent nothing at all.
+//!
+//! The price is **1000 copper** (10 silver) — vmangos `GUILD_CHARTER_COST`
+//! (`Handlers/PetitionsHandler.cpp:39`), which arrives in `SMSG_PETITION_SHOWLIST`'s `charterCost`
+//! field and is what `GetGuildCharterCost()` must quote.
+//!
+//! `MAX_CHARTER_NAME` is **24** UTF-8 characters (`ObjectMgr.h:401`, enforced by
+//! `ObjectMgr::IsValidCharterName`, which allows digits and spaces —
+//! `isValidString(…, numericOrSpace = true)`). The probe's names are 22 characters.
+//!
+//! ## What each step can and cannot conclude
+//!
+//! | step | what a FAIL there means | `ui_petition` claim it bears on |
+//! |------|-------------------------|---------------------------------|
+//! | 0 | the probe left a guild behind and `GuildLeave`/`GuildDisband` did not take — every later step is meaningless, because a buy is refused **silently** while guilded | — (re-runnability) |
+//! | 1 | environmental: the `.go` was refused or Stormwind never streamed — SKIP, not a defect | — |
+//! | 2 | the gossip wire or the B292 text-query hold is broken for this NPC | — |
+//! | 3 | the icon table regressed one row over from B249: byte 7 must read `"petition"` | — |
+//! | 4 | `SMSG_PETITION_SHOWLIST` is not parsed, does not fire `GUILD_REGISTRAR_SHOW`, or its `charterCost` is not what `GetGuildCharterCost()` reads | **INFERRED #1**, and `script::petition`'s "what `GetGuildCharterCost` reads" |
+//! | 5 | the buy never reached the server, or was refused — there is **no confirmation packet at all**, so the item arriving *is* the answer | — |
+//! | 6 | using a charter does not open the petition window: either the fork arm or `SMSG_PETITION_SHOW_SIGNATURES` → `PETITION_SHOW` | **INFERRED #6**, and **#2** |
+//! | 7 | the lazy record fill is broken — the window would sit titleless forever, which is the whole two-caches design | `script::petition`'s "the repaint path" |
+//! | 8 | `MSG_PETITION_RENAME`'s echo does not patch the cached record (the echo is sent **only on success**) | — |
+//! | 9 | the charter is still in the bags, and the **next** run's buy will be refused silently for "the owner already has one" (`PetitionsHandler.cpp:70`) — a failure that looks nothing like its cause | — (re-runnability) |
+//!
+//! Three of `ui_petition`'s six INFERRED claims are **not** touched here, and none of the three is
+//! an oversight. #4 (re-asking for the signature list on an `OK` sign result) needs a second
+//! account to sign, and #5 (`ERR_GUILD_FOUNDER_S` on a successful turn-in) needs nine of them —
+//! neither is reachable from one client, so the whole sign/offer/turn-in half of the family
+//! (`SignPetition`, `OfferPetition`, `TurnInGuildCharter`, `MSG_PETITION_DECLINE`) still has no
+//! live coverage after this probe. #3 (the two closes send nothing) is *superseded*: the wow-re
+//! carve that landed alongside this file finds that closing a charter you do NOT own can send
+//! `MSG_PETITION_DECLINE`, so this probe deliberately asserts nothing about either close rather
+//! than pinning a claim that is being rewritten.
+//!
+//! ## The run recipe
+//!
+//! ```text
+//! WOW_NOSOUND=1 WOW_USER=probe0 WOW_PASS=pprobe0 WOW_CHAR=Probezero \
+//!     WOW_PROBE_CHARTER=1 cargo run -q -p benilla
+//! ```
+//! (the slot-keyed probe identity — this worktree is `pool-0` → `probe0`/`pprobe0`/`Probezero`;
+//! method.md "The local vmangos server". **Never the default `one` account** — a login on it kicks
+//! the director's live session.) `WOW_NOSOUND=1` because an unattended probe must not play zone
+//! music into the director's room; `caffeinate -dis` is **not** needed for a run this short — the
+//! whole sequence is a handful of round trips and finishes in well under a minute.
+//!
+//! Non-combat: this probe never fights and never targets anything. GM mode is left exactly as
+//! found. An outer `timeout` + grep on `PROBE_CHARTER:` is the whole harness; the probe self-exits
+//! once DONE, and every wait is bounded — a hung leg FAILs with a legible detail rather than
+//! hanging the run.
+
+use bevy::prelude::*;
+
+use benilla_protocol::messages::{
+    BAG_PLAYER_INVENTORY, CHARTER_ITEM_ENTRY, ITEM_FLAG_CHARTER, SLOT_BAG_FIRST, SLOT_PACK_FIRST,
+};
+use benilla_protocol::EntityKind;
+use benilla_ui::script::UiScript;
+
+use super::probes::ProbeClock;
+use crate::items::Items;
+use crate::net::{ChatKind, ClientCommand, Guid, NetCommands, NetEntity, ObjectStore, SelfPlayer};
+use crate::player::Player;
+use crate::target::cursor_mode::npc_flags;
+use crate::ui_gossip::GossipState;
+use crate::ui_items::{find_item, ItemSearch, PACK_SLOTS};
+use crate::ui_petition::GuildRegistrarState;
+use crate::ui_session::NpcSession;
+
+/// Aldwin Laughlin's spawn (vmangos `creature` guid 79681, entry 4974) — the `.go xyz` target.
+const REGISTRAR_AT: [f32; 3] = [-8885.25, 614.395, 95.2576];
+/// His map — Eastern Kingdoms. `.go xyz` takes the map id as its fourth argument.
+const REGISTRAR_MAP: u32 = 0;
+/// His creature template entry — the streamed-unit identity check (module doc). The `0x200` npc
+/// flag is only the fallback, exactly as the binder probe splits it.
+const REGISTRAR_ENTRY: u32 = 4974;
+/// The wire `GOSSIP_ICON` byte menu 708's charter row sends (module doc) — decision 1335's table
+/// indexes it to [`ICON_TYPE_PETITION`].
+const ICON_PETITION: u8 = 7;
+/// The type string [`crate::ui_gossip`]'s table must produce for [`ICON_PETITION`].
+const ICON_TYPE_PETITION: &str = "petition";
+/// What a broken icon table produces instead — the chat bubble. Seeing it back here is B249's
+/// regression one row over, not a flake.
+const ICON_TYPE_REGRESSION: &str = "gossip";
+/// The substring the charter row's label must carry before the probe is willing to select it. A
+/// lowercase *substring*, never an equality: the label on the wire is the row's
+/// `option_broadcast_text` (3413) rather than its `option_text` column, and the exact wording is
+/// the server's to choose (module doc).
+const CHARTER_LABEL_HINT: &str = "guild";
+/// Scan radius around the `.go` landing, generously wide so a slightly-off hop still finds him
+/// (the bank/mail/binder probes' shared idiom).
+const SCAN_RANGE: f32 = 12.0;
+/// The price `GetGuildCharterCost()` must quote, in copper — vmangos `GUILD_CHARTER_COST`
+/// (`PetitionsHandler.cpp:39`), carried in `SMSG_PETITION_SHOWLIST`'s `charterCost`.
+const CHARTER_COST_COPPER: i64 = 1000;
+/// What `GetPetitionInfo()`'s `maxSignatures` must read once the record lands — vmangos answers
+/// `SMSG_PETITION_QUERY_RESPONSE` with `minSignatures = maxSignatures = 9`, hardcoded
+/// (`PetitionsHandler.cpp:182-183`), whatever `MinPetitionSigns` is configured to.
+const REQUIRED_SIGNATURES: i64 = 9;
+/// A fresh charter has **no** signatures: `GetNumPetitionNames()` counts signers, and the owner is
+/// not one of them (the reference paints the owner into its own font string).
+const FRESH_SIGNATURES: i64 = 0;
+/// Copper handed to the probe body up front so the buy can never fail for funds. `.modify money`
+/// is `SEC_BASIC_ADMIN` (4) in vmangos's `Chat.cpp` command table and every `probeN` account is
+/// gmlevel **6** (method.md, decision 0651), so it lands; with no selection it targets the sender
+/// (`ChatHandler::GetSelectedPlayer`, `Chat.cpp:2601-2612`), which is why it is sent before the
+/// probe touches an NPC.
+const FUND_COPPER: u32 = 100_000;
+
+/// Settle after the `.go` before scanning — the hop's own travel plus a frame for the stream.
+const SETTLE_SECS: f64 = 3.0;
+/// The waits are deliberately generous, for the reason [`super::probe_binder`] measured: a `.go`
+/// can land inside a terrain load, and the probe then gets roughly one frame per second to poll
+/// in. A timeout tight enough to trip on that would report a FAIL about the wire, which is the one
+/// thing an instrument must never do.
+const GUILD_CLEAR_TIMEOUT_SECS: f64 = 20.0;
+const SCAN_TIMEOUT_SECS: f64 = 25.0;
+const MENU_TIMEOUT_SECS: f64 = 20.0;
+/// How long step 4 will wait for the portrait booth's `"npc"` token before reporting it empty.
+///
+/// Not a gate — the step passes either way. It exists so the detail line says something true: the
+/// booth is fed by a system that is deliberately unordered against the apply pass, so the token is
+/// `None` on the frame the window opens and resolves on the next.
+const REGISTRAR_TOKEN_SETTLE_SECS: f64 = 1.0;
+
+const REGISTRAR_TIMEOUT_SECS: f64 = 15.0;
+/// The buy's wait is the longest of the action legs: nothing acknowledges it, so this is the time
+/// the *item* gets to arrive and its template with it.
+const BUY_TIMEOUT_SECS: f64 = 25.0;
+const PETITION_TIMEOUT_SECS: f64 = 15.0;
+const RECORD_TIMEOUT_SECS: f64 = 15.0;
+const RENAME_TIMEOUT_SECS: f64 = 15.0;
+const DESTROY_TIMEOUT_SECS: f64 = 15.0;
+
+pub(crate) struct ProbeCharterPlugin;
+
+impl Plugin for ProbeCharterPlugin {
+    fn build(&self, app: &mut App) {
+        app.init_resource::<CharterProbe>()
+            .add_systems(Update, charter_probe);
+    }
+}
+
+/// The probe's phase machine plus the identities discovered along the way (the binder/bank probes'
+/// shape: a `Copy` phase snapshotted out of the resource each tick, so an arm can mutate `probe`
+/// freely).
+#[derive(Resource, Default)]
+struct CharterProbe {
+    phase: Phase,
+    /// The registrar's guid, once streamed in.
+    registrar: Option<u64>,
+    /// The charter row's **wire** `index` — the value the packet carried and the value
+    /// `CMSG_GOSSIP_SELECT_OPTION` must echo back. vmangos numbers them over the rows it actually
+    /// sends (`GossipDef.cpp:188`), so it is the row's 0-based position in *this* menu — neither
+    /// the DB's `gossip_menu_option.id` nor the Lua menu's 1-based position, and the probe assumes
+    /// no relation between them for the same reason the real drain doesn't.
+    charter_row: Option<u32>,
+    /// Where the bought charter is: the wire `(bag_index, slot)` pair and the instance guid, from
+    /// [`find_item`]. The Lua click position is derived from it by [`lua_bag_pos`].
+    charter: Option<(u8, u8, u64)>,
+    /// The guild name bought in step 5 — what step 7 waits for the title to become.
+    bought: String,
+    /// The name step 8 renames to — what step 8 waits for the title to become.
+    renamed: String,
+    /// The title read at the instant the petition window first became visible (step 6). Step 7
+    /// asserts it was either empty (the packet carries no text) or already filled.
+    title_at_open: String,
+    passes: u32,
+    fails: u32,
+    /// Latched once [`Phase::Done`] has fired its exit (never re-fire on a later frame).
+    exited: bool,
+}
+
+impl CharterProbe {
+    fn pass(&mut self, step: u8, name: &str, detail: String) {
+        self.passes += 1;
+        info!("PROBE_CHARTER: {step} PASS ({name}) — {detail}");
+    }
+
+    fn fail(&mut self, step: u8, name: &str, detail: String) {
+        self.fails += 1;
+        error!("PROBE_CHARTER: {step} FAIL ({name}) — {detail}");
+    }
+
+    fn skip(&mut self, step: u8, name: &str, detail: String) {
+        warn!("PROBE_CHARTER: {step} SKIP ({name}) — {detail}");
+    }
+}
+
+#[derive(Default, Clone, Copy, PartialEq)]
+enum Phase {
+    #[default]
+    Wait,
+    /// Step 0 — the money is sent and any guild an earlier run founded is being left. `sent`
+    /// distinguishes "haven't asked yet" from "asked, waiting for the descriptor to clear".
+    Unguild {
+        since: f64,
+        sent: bool,
+    },
+    /// Step 1 — `.go` issued; settling before the world streams the registrar in.
+    Settling {
+        sent_at: f64,
+    },
+    /// Step 2 — `GossipHello` sent; waiting for the parsed menu AND its push into the VM.
+    Menu {
+        sent_at: f64,
+    },
+    /// Step 4 — the charter row selected; waiting for `SMSG_PETITION_SHOWLIST` to reach
+    /// [`GuildRegistrarState`] and `GUILD_REGISTRAR_SHOW` to open the window.
+    Registrar {
+        since: f64,
+    },
+    /// Step 5 — the registrar's purchase panel driven; waiting for the charter item to arrive.
+    Buying {
+        since: f64,
+        sent: bool,
+    },
+    /// Step 6 — the charter right-clicked through the live VM; waiting for the petition window.
+    Opening {
+        since: f64,
+        sent: bool,
+    },
+    /// Step 7 — waiting for `SMSG_PETITION_QUERY_RESPONSE` to fill the title in.
+    Record {
+        since: f64,
+    },
+    /// Step 8 — `RenamePetition` run in the live VM; waiting for the echo to patch the record.
+    Renaming {
+        since: f64,
+        sent: bool,
+    },
+    /// Step 9 — the charter destroyed; watching it actually leave the bags before exiting.
+    Destroying {
+        since: f64,
+        sent: bool,
+    },
+    Done,
+}
+
+// ── The live-VM readings ─────────────────────────────────────────────────────────────────────
+// Every one of these answers a default on an eval hiccup and is treated as "nothing observed
+// yet", never a panic (the bank/binder probes' idiom): the probe's own timeouts are what turn a
+// persistently missing reading into a verdict.
+
+/// The `CHAT_MSG_SYSTEM` / `UI_ERROR_MESSAGE` lines seen since the hook went in, newest last.
+///
+/// This is the probe's window into the family's **silent** refusals: a buy or a rename that the
+/// server turns down comes back as `SMSG_GUILD_COMMAND_RESULT` on the *guild* family's channel,
+/// which [`crate::ui_guild::lines`] prints as a system line and nothing else records. Without it a
+/// refused buy and a lost packet read identically.
+fn probe_lines(script: &UiScript) -> Vec<String> {
+    script
+        .eval::<Vec<String>>("return ProbeCharterLines or {}")
+        .unwrap_or_default()
+}
+
+/// How many values the live `GetGossipOptions()` returns — flat `(label, type)` pairs, so twice the
+/// row count. The probe waits on this rather than assuming the feed already ran this frame, and it
+/// is also what makes the wait honour [`crate::ui_gossip`]'s B292 hold: on the first visit to a
+/// `text_id` the menu deliberately does not reach the VM until `SMSG_NPC_TEXT_UPDATE` lands.
+fn vm_gossip_values(script: &UiScript) -> i64 {
+    script
+        .eval::<i64>("local t = { GetGossipOptions() } return table.getn(t)")
+        .unwrap_or(0)
+}
+
+/// The icon **type string** the app mapped for the 1-based menu row `pos` — read exactly where the
+/// FrameXML reads it, out of the pushed snapshot through the Era `GetGossipOptions()` vararg.
+fn vm_icon_type(script: &UiScript, pos: usize) -> String {
+    script
+        .eval::<String>(&format!(
+            "local t = {{ GetGossipOptions() }} return t[{}] or \"\"",
+            pos * 2
+        ))
+        .unwrap_or_default()
+}
+
+/// The texture path `BENILLA_GOSSIP_ICONS.petition` resolves to in the live VM — `""` if the table
+/// or the key is missing, which would mean the row draws the fallback bubble whatever the app
+/// mapped ([`super::probe_binder`]'s second half of the same assert).
+fn vm_petition_texture(script: &UiScript) -> String {
+    script
+        .eval::<String>("return (BENILLA_GOSSIP_ICONS and BENILLA_GOSSIP_ICONS.petition) or \"\"")
+        .unwrap_or_default()
+}
+
+/// Is a named frame up, asked of the live UI rather than of our own state — the window is what a
+/// player looks for. Nil-guarded on the global so a build without the file reads `false` instead of
+/// raising.
+fn vm_visible(script: &UiScript, frame: &str) -> bool {
+    script
+        .eval::<bool>(&format!(
+            "return ({frame} and {frame}:IsVisible()) and 1 or nil"
+        ))
+        .unwrap_or(false)
+}
+
+/// `GetGuildCharterCost()` — the registrar's price in copper.
+fn vm_charter_cost(script: &UiScript) -> i64 {
+    script
+        .eval::<i64>("return GetGuildCharterCost()")
+        .unwrap_or(-1)
+}
+
+/// One of `GetPetitionInfo()`'s six returns, by 1-based position, as a string. With nothing open
+/// the getter returns **no values at all**, so every slot reads `""`.
+fn vm_petition_str(script: &UiScript, slot: usize) -> String {
+    let binds = "_,".repeat(slot - 1);
+    script
+        .eval::<String>(&format!(
+            "local {binds}v = GetPetitionInfo() return v or \"\""
+        ))
+        .unwrap_or_default()
+}
+
+/// `GetPetitionInfo()`'s fourth return — the signature requirement off the wire.
+fn vm_petition_max(script: &UiScript) -> i64 {
+    script
+        .eval::<i64>("local _,_,_,v = GetPetitionInfo() return v or -1")
+        .unwrap_or(-1)
+}
+
+/// `GetPetitionInfo()`'s sixth return — `isOriginator`, an Era `1`/`nil` (never `true`/`false`).
+fn vm_is_originator(script: &UiScript) -> i64 {
+    script
+        .eval::<i64>("local _,_,_,_,_,v = GetPetitionInfo() return v or 0")
+        .unwrap_or(0)
+}
+
+/// `GetNumPetitionNames()` — the signers, which never include the owner.
+fn vm_num_names(script: &UiScript) -> i64 {
+    script
+        .eval::<i64>("return GetNumPetitionNames()")
+        .unwrap_or(-1)
+}
+
+/// The inverse of [`crate::ui_items::wire_pos`] for the two regions a **bag right-click** can
+/// address: the backpack (Lua container `0`) and the four equipped bags (`1..=4`).
+///
+/// `None` for anywhere else — the bank, the keyring, a doll slot. A bought charter cannot land in
+/// any of them, so a `None` here is the probe refusing to click a slot it cannot name rather than
+/// guessing one.
+fn lua_bag_pos(bag_index: u8, slot: u8) -> Option<(i64, u32)> {
+    if bag_index == BAG_PLAYER_INVENTORY {
+        let inner = slot.checked_sub(SLOT_PACK_FIRST)?;
+        (inner < PACK_SLOTS).then_some((0, u32::from(inner) + 1))
+    } else {
+        let bag = bag_index.checked_sub(SLOT_BAG_FIRST)?;
+        (bag < 4 && slot < 36).then_some((i64::from(bag) + 1, u32::from(slot) + 1))
+    }
+}
+
+/// A guild name that cannot collide with a previous run or a real guild, and cannot be refused for
+/// length: a 13-character prefix, a space, and the low 8 digits of the wall clock — 22 characters,
+/// inside vmangos's `MAX_CHARTER_NAME` of 24. Digits and spaces are both allowed by
+/// `IsValidCharterName` (`isValidString(…, numericOrSpace = true)`, verified this session).
+fn probe_guild_name(prefix: &str) -> String {
+    let secs = std::time::SystemTime::now()
+        .duration_since(std::time::UNIX_EPOCH)
+        .map_or(0, |d| d.as_secs())
+        % 100_000_000;
+    format!("{prefix} {secs:08}")
+}
+
+#[allow(clippy::too_many_arguments)]
+fn charter_probe(
+    time: ProbeClock,
+    mut probe: ResMut<CharterProbe>,
+    gossip: Res<GossipState>,
+    registrar: Res<GuildRegistrarState>,
+    mut items: ResMut<Items>,
+    script: Option<NonSendMut<UiScript>>,
+    self_q: Query<&ObjectStore, With<SelfPlayer>>,
+    player: Res<Player>,
+    units: Query<(&Guid, &NetEntity, &ObjectStore, &Transform), Without<SelfPlayer>>,
+    net: Res<NetCommands>,
+    mut exit: MessageWriter<AppExit>,
+) {
+    let Ok(store) = self_q.single() else {
+        return; // not in-world yet
+    };
+    let Some(script) = script else {
+        return; // no UI VM this build (headless net-only) — nothing this probe can drive
+    };
+    let now = time.elapsed_secs_f64();
+    let phase = probe.phase;
+
+    match phase {
+        Phase::Wait => {
+            // The refusal channel, installed up front so it is live long before the first verb.
+            // Both events land on the same list because the probe only ever reads it as "what did
+            // the client say while this leg ran".
+            if let Err(e) = script.run(
+                r#"
+                if not ProbeCharterHooked then
+                    ProbeCharterHooked = true
+                    ProbeCharterLines = {}
+                    local f = CreateFrame("Frame")
+                    f:RegisterEvent("CHAT_MSG_SYSTEM")
+                    f:RegisterEvent("UI_ERROR_MESSAGE")
+                    f:SetScript("OnEvent", function()
+                        table.insert(ProbeCharterLines, (event or "") .. ": " .. (arg1 or ""))
+                    end)
+                end
+                "#,
+            ) {
+                error!("PROBE_CHARTER: installing the refusal hook: {e}");
+            }
+            // Money first, before anything is targeted: `.modify money` with no selection targets
+            // the sender, and with a *creature* selected it answers "no character selected".
+            let _ = net.0.send(ClientCommand::Chat {
+                kind: ChatKind::Say,
+                target: None,
+                text: format!(".modify money {FUND_COPPER}"),
+            });
+            info!(
+                "PROBE_CHARTER: 0 (precheck) — funding the body with {FUND_COPPER} copper so the \
+                 buy cannot fail for money"
+            );
+            probe.phase = Phase::Unguild {
+                since: now,
+                sent: false,
+            };
+        }
+        // ── Step 0 — the preconditions ──────────────────────────────────────────────────────
+        // A buy is refused **silently** while the buyer is in a guild (`PetitionsHandler.cpp:66`,
+        // a bare `return`), so a run that founded one and never left it would make step 5 fail
+        // for a reason with no trace anywhere. Leaving is therefore a precondition, not tidiness,
+        // and it is what makes this probe re-runnable rather than a one-shot.
+        //
+        // A FAIL here means `GuildLeave()`/`GuildDisband()` did not take: the descriptor's
+        // `PLAYER_GUILDID` never came back to 0, which is the same field `IsInGuild()` reads and
+        // the same edge that fires `PLAYER_GUILD_UPDATE`. Every step below it would be meaningless.
+        Phase::Unguild { since, sent } => {
+            let guild_id = store.0.player_guild_id();
+            if !sent {
+                if guild_id == 0 {
+                    probe.pass(
+                        0,
+                        "precheck",
+                        "not in a guild — nothing to leave, and the buy's silent guilded-refusal \
+                         cannot apply"
+                            .to_string(),
+                    );
+                    return hop(&mut probe, &net, now);
+                }
+                // Disband if we are the master (a guild master cannot simply leave — vmangos
+                // answers that with `ERR_GUILD_LEADER_LEAVE_S`), else leave. The verb runs through
+                // the live VM's own globals so the whole engine→drain→wire chain is exercised, but
+                // the *decision* is read straight off the descriptor rather than out of
+                // `IsGuildLeader()`: rank 0 IS the guild master, `PLAYER_GUILDRANK` is mirrored
+                // into the model by a feed this probe is not ordered against, and on the first
+                // frame in-world that one frame of lag would pick the wrong verb.
+                let verb = if store.0.player_guild_rank() == 0 {
+                    "GuildDisband()"
+                } else {
+                    "GuildLeave()"
+                };
+                if let Err(e) = script.run(verb) {
+                    probe.fail(
+                        0,
+                        "precheck",
+                        format!(
+                            "in guild {guild_id} and {verb} would not run in the live VM: {e} — \
+                             the buy in step 5 would be refused silently"
+                        ),
+                    );
+                    probe.phase = Phase::Done;
+                    return;
+                }
+                info!(
+                    "PROBE_CHARTER: 0 (precheck) — still in guild {guild_id} from an earlier run; \
+                     {verb} sent through the live VM"
+                );
+                probe.phase = Phase::Unguild {
+                    since: now,
+                    sent: true,
+                };
+            } else if guild_id == 0 {
+                probe.pass(
+                    0,
+                    "precheck",
+                    "the guild an earlier run founded is gone — PLAYER_GUILDID is back to 0"
+                        .to_string(),
+                );
+                hop(&mut probe, &net, now);
+            } else if now - since > GUILD_CLEAR_TIMEOUT_SECS {
+                probe.fail(
+                    0,
+                    "precheck",
+                    format!(
+                        "still in guild {guild_id} {GUILD_CLEAR_TIMEOUT_SECS}s after the leave — \
+                         the buy in step 5 would be refused SILENTLY (a bare `return` at \
+                         PetitionsHandler.cpp:66), so the run is stopped here rather than \
+                         reporting that as a wire failure. Lines seen: {:?}",
+                        probe_lines(&script)
+                    ),
+                );
+                probe.phase = Phase::Done;
+            }
+        }
+        // ── Step 1 — the hop ────────────────────────────────────────────────────────────────
+        // A SKIP here is environmental and says so: the `.go` may have been refused, or Stormwind
+        // may never have streamed. It is not evidence about the charter flow either way.
+        Phase::Settling { sent_at } => {
+            if now - sent_at < SETTLE_SECS {
+                return;
+            }
+            let me = player.pos;
+            let found = units.iter().find(|(_, net_e, store, tf)| {
+                net_e.kind == EntityKind::Unit
+                    && (store.0.object_entry() == Some(REGISTRAR_ENTRY)
+                        || store.0.unit_npc_flags() & npc_flags::PETITIONER != 0)
+                    && tf.translation.distance(me) < SCAN_RANGE
+            });
+            if let Some((guid, ..)) = found {
+                probe.pass(
+                    1,
+                    "hop",
+                    format!(
+                        "registrar {:#x} streamed within {SCAN_RANGE}yd of the landing",
+                        guid.0
+                    ),
+                );
+                probe.registrar = Some(guid.0);
+                let _ = net.0.send(ClientCommand::GossipHello { guid: guid.0 });
+                info!("PROBE_CHARTER: 2 (menu) GossipHello({:#x}) sent", guid.0);
+                probe.phase = Phase::Menu { sent_at: now };
+            } else if now - sent_at > SCAN_TIMEOUT_SECS {
+                probe.skip(
+                    1,
+                    "hop",
+                    format!(
+                        "no entry {REGISTRAR_ENTRY} / petitioner-flagged unit streamed in within \
+                         {SCAN_TIMEOUT_SECS}s of the hop (the `.go` may have been refused, or \
+                         Stormwind never streamed) — environmental, not a defect"
+                    ),
+                );
+                probe.phase = Phase::Done;
+            }
+        }
+        // ── Step 2 — the menu ───────────────────────────────────────────────────────────────
+        // A FAIL means the gossip wire is broken for this NPC. The wait is for the menu **in the
+        // VM**, not for the packet: `ui_gossip`'s B292 hold deliberately keeps a first visit's
+        // menu closed until `SMSG_NPC_TEXT_UPDATE` answers the greeting query, so a wait on the
+        // parse alone would race the hold and read a menu the player cannot see.
+        Phase::Menu { sent_at } => {
+            let Some(npc) = probe.registrar else {
+                probe.phase = Phase::Done;
+                return;
+            };
+            let open = gossip.npc == Some(npc) && !gossip.options.is_empty();
+            let pushed = vm_gossip_values(&script) as usize == gossip.options.len() * 2;
+            if open && pushed {
+                probe.pass(
+                    2,
+                    "menu",
+                    format!(
+                        "{} option(s) open on {npc:#x}: {}",
+                        gossip.options.len(),
+                        gossip
+                            .options
+                            .iter()
+                            .map(|o| format!("[{} icon={} {:?}]", o.index, o.icon, o.message))
+                            .collect::<Vec<_>>()
+                            .join(" ")
+                    ),
+                );
+                assert_icon_and_select(&mut probe, &gossip, &script, &net, npc, now);
+            } else if now - sent_at > MENU_TIMEOUT_SECS {
+                probe.fail(
+                    2,
+                    "menu",
+                    format!(
+                        "no gossip menu for {npc:#x} within {MENU_TIMEOUT_SECS}s (parsed \
+                         npc={:?} options={} vm_values={})",
+                        gossip.npc,
+                        gossip.options.len(),
+                        vm_gossip_values(&script)
+                    ),
+                );
+                probe.phase = Phase::Done;
+            }
+        }
+        // ── Step 4's second half — the window ───────────────────────────────────────────────
+        // **The load-bearing step.** Before decision 1672 `SMSG_PETITION_SHOWLIST` had no const
+        // and no parse arm: it fell through `parse.rs`'s tail into `ServerPacket::Other`, and
+        // clicking "How do I form a guild?" closed the gossip window and did nothing else. A FAIL
+        // here is exactly that shape, and it is the evidence for `ui_petition`'s INFERRED #1 —
+        // that this packet is what fires `GUILD_REGISTRAR_SHOW`. The cost reading is the second
+        // half: `GetGuildCharterCost` is modelled as the showlist row's `charterCost` in copper,
+        // and 1000 is the only number vmangos can send.
+        Phase::Registrar { since } => {
+            let Some(npc) = probe.registrar else {
+                probe.phase = Phase::Done;
+                return;
+            };
+            let parked = registrar.npc() == Some(npc);
+            let visible = vm_visible(&script, "GuildRegistrarFrame");
+            let cost = vm_charter_cost(&script);
+            if parked && visible && cost == CHARTER_COST_COPPER {
+                // The portrait booth's `"npc"` token is reported, never asserted: it is what
+                // paints the window's face and name banner, and a blank one is a look question,
+                // which is the director's to call and not a probe's.
+                //
+                // **Sampled one frame late, on purpose.** `feed_interact_npc` runs in
+                // `WorldStage::Net` deliberately unordered against the apply pass (its own doc says
+                // so: a session is open for seconds, so one frame either way is invisible), which
+                // means on the very frame the registrar opens `InteractNpc` is still `None` and
+                // this token reads `""` every single time. A detail line that is always empty is an
+                // instrument that lies — it reads exactly like the black-disc bug this arm was
+                // added to fix.
+                let token = script
+                    .eval::<String>("return UnitName(\"npc\") or \"\"")
+                    .unwrap_or_default();
+                if token.is_empty() && now - since < REGISTRAR_TOKEN_SETTLE_SECS {
+                    return;
+                }
+                let row = probe.charter_row;
+                probe.pass(
+                    4,
+                    "registrar",
+                    format!(
+                        "wire row {row:?} selected: SMSG_PETITION_SHOWLIST parked on {npc:#x}, \
+                         GUILD_REGISTRAR_SHOW opened GuildRegistrarFrame, and \
+                         GetGuildCharterCost() reads {cost} copper (portrait token \
+                         UnitName(\"npc\") = {token:?})"
+                    ),
+                );
+                probe.phase = Phase::Buying {
+                    since: now,
+                    sent: false,
+                };
+            } else if parked && visible && cost != CHARTER_COST_COPPER {
+                // The window opened, so the packet parsed — this is a value bug, not a wire one,
+                // and saying which saves the next reader the bisect.
+                probe.fail(
+                    4,
+                    "registrar",
+                    format!(
+                        "the registrar opened on {npc:#x} but GetGuildCharterCost() reads {cost}, \
+                         not {CHARTER_COST_COPPER} (vmangos GUILD_CHARTER_COST, \
+                         PetitionsHandler.cpp:39) — the showlist row's charterCost is not what \
+                         the getter reads, or the visible-row `&1` rule picked the wrong row"
+                    ),
+                );
+                probe.phase = Phase::Done;
+            } else if now - since > REGISTRAR_TIMEOUT_SECS {
+                probe.fail(
+                    4,
+                    "registrar",
+                    format!(
+                        "no registrar window within {REGISTRAR_TIMEOUT_SECS}s of the select: \
+                         GuildRegistrarState npc={:?} (wanted {npc:#x}), \
+                         GuildRegistrarFrame:IsVisible()={visible}, GetGuildCharterCost()={cost}. \
+                         Before decision 1672 SMSG_PETITION_SHOWLIST had no parse arm at all and \
+                         fell through to ServerPacket::Other — that is what this reading looks \
+                         like. Lines seen: {:?}",
+                        registrar.npc(),
+                        probe_lines(&script)
+                    ),
+                );
+                probe.phase = Phase::Done;
+            }
+        }
+        // ── Step 5 — the buy ────────────────────────────────────────────────────────────────
+        // Driven through the registrar's own window: `GuildRegistrar_ShowPurchaseFrame()` is the
+        // reference's pure local panel swap (and the only place the price is painted), then
+        // `BuyGuildCharter(name)` is the Purchase button's own send. The real button also hides
+        // the window afterwards (`GuildRegistrar_Purchase`); the probe deliberately does not, so
+        // the registrar session stays observable — and it costs nothing, because step 6's
+        // `ShowUIPanel(PetitionFrame)` displaces the left-slot incumbent anyway
+        // (`SeatLeftAreaPanel`'s two-pushable-0 arm).
+        //
+        // **There is no confirmation packet at all for a successful buy** — the item arriving IS
+        // the answer (`PetitionsHandler.cpp:130` pushes it and nothing else) — so this is a poll
+        // with a timeout, and a FAIL means either the send never happened or the server refused.
+        // The four silent refusals are: already in a guild, already owns a petition, the name is
+        // taken, or not enough money; the name-taken one is the only one that says anything, and
+        // it says it on the guild family's channel, which is why the detail dumps the lines.
+        Phase::Buying { since, sent } => {
+            if !sent {
+                let name = probe_guild_name("Probe Charter");
+                if let Err(e) = script.run(&format!(
+                    "GuildRegistrar_ShowPurchaseFrame() BuyGuildCharter(\"{name}\")"
+                )) {
+                    probe.skip(
+                        5,
+                        "buy",
+                        format!(
+                            "the purchase chunk would not run in the live VM: {e} \
+                             (environmental, not a wire failure)"
+                        ),
+                    );
+                    probe.phase = Phase::Done;
+                    return;
+                }
+                info!(
+                    "PROBE_CHARTER: 5 (buy) — GuildRegistrar_ShowPurchaseFrame() then \
+                     BuyGuildCharter({name:?}) run in the live VM; waiting for item \
+                     {CHARTER_ITEM_ENTRY} to reach the bags"
+                );
+                probe.bought = name;
+                probe.phase = Phase::Buying {
+                    since: now,
+                    sent: true,
+                };
+                return;
+            }
+            let found = find_item(&store.0, &items, CHARTER_ITEM_ENTRY, ItemSearch::default());
+            // The template has to have landed too, and it is folded into the SAME `Option` as the
+            // item rather than short-circuiting on its own: the click dispatcher's charter arm is
+            // a **template flag** test (`ITEM_FLAG_CHARTER`), so a click made before the answer
+            // arrives falls through to a plain use and proves nothing — but an early `return` on a
+            // template that never answers would sail straight past the timeout below and hang the
+            // run, which is the one thing an instrument may never do. Reading the flags here also
+            // cross-checks the DB fact (`flags = 8192`) against what the live server sends.
+            let ready = found.and_then(|(bag_index, slot, guid)| {
+                items
+                    .template(CHARTER_ITEM_ENTRY, guid, &net)
+                    .map(|t| (bag_index, slot, guid, t.flags))
+            });
+            if let Some((bag_index, slot, guid, flags)) = ready {
+                if flags & ITEM_FLAG_CHARTER == 0 {
+                    probe.fail(
+                        5,
+                        "buy",
+                        format!(
+                            "item {CHARTER_ITEM_ENTRY} arrived at wire {bag_index}/{slot} but its \
+                             template flags are {flags:#x}, with no ITEM_FLAG_CHARTER \
+                             ({ITEM_FLAG_CHARTER:#x}) — the live server disagrees with the world \
+                             DB's `flags = 8192`, and the item-use fork's charter arm cannot fire"
+                        ),
+                    );
+                    probe.charter = Some((bag_index, slot, guid));
+                    probe.phase = Phase::Destroying {
+                        since: now,
+                        sent: false,
+                    };
+                    return;
+                }
+                probe.pass(
+                    5,
+                    "buy",
+                    format!(
+                        "charter {guid:#x} (entry {CHARTER_ITEM_ENTRY}, template flags \
+                         {flags:#x}) is in the bags at wire {bag_index}/{slot} — the only \
+                         acknowledgement a successful buy has"
+                    ),
+                );
+                probe.charter = Some((bag_index, slot, guid));
+                probe.phase = Phase::Opening {
+                    since: now,
+                    sent: false,
+                };
+            } else if now - since > BUY_TIMEOUT_SECS {
+                let bought = probe.bought.clone();
+                probe.fail(
+                    5,
+                    "buy",
+                    format!(
+                        "no usable item {CHARTER_ITEM_ENTRY} in the bags {BUY_TIMEOUT_SECS}s \
+                         after BuyGuildCharter({bought:?}) — find_item says {found:?} and its \
+                         template {}. Nothing acks a buy, so a missing item is either a send that \
+                         never happened or one of vmangos's four refusals (already guilded, \
+                         already owns a petition, the name is taken/invalid, not enough money); an \
+                         item present with no template is the ask-once ItemQuery going \
+                         unanswered. Lines seen: {:?}",
+                        if found.is_some() {
+                            "never answered"
+                        } else {
+                            "was never asked for"
+                        },
+                        probe_lines(&script)
+                    ),
+                );
+                // Nothing usable arrived, but `find_item` may still have seen a charter — hand it
+                // to the cleanup rather than to `Done`, or the next run's buy is refused silently.
+                probe.charter = found;
+                probe.phase = if found.is_some() {
+                    Phase::Destroying {
+                        since: now,
+                        sent: false,
+                    }
+                } else {
+                    Phase::Done
+                };
+            }
+        }
+        // ── Step 6 — the item-use fork ──────────────────────────────────────────────────────
+        // Driven as a bag right-click through the live VM's own `UseContainerItem`, so
+        // `ui_items::drain::drain_container_uses` runs its real dispatcher and reaches
+        // `ItemUseRoute::ShowPetition` — **not** a synthesized `CMSG_PETITION_SHOW_SIGNATURES`.
+        // That distinction is the whole point of this step: the arm's position in the fork is
+        // INFERRED (`ui_petition`'s #6), and the only thing that can exercise it is a real click.
+        //
+        // A FAIL means one of two things, and the detail says which it cannot separate: either
+        // the fork never reached the charter arm (the charter fell through to `Nothing`, which is
+        // exactly the pre-1672 behaviour — right-click a charter, nothing happens at all), or the
+        // answer never became a window (INFERRED #2, `SMSG_PETITION_SHOW_SIGNATURES` →
+        // `PETITION_SHOW`).
+        //
+        // **What the window's identity rests on is the control, not a field.** Every reading here
+        // is the live VM's, and none of the charter getters exposes the open charter's ITEM guid,
+        // so "the window is on the charter we just bought" is established by the BEFORE control
+        // (no petition window existed before the click) plus the click itself, rather than by
+        // matching guids. `PetitionState::open_item` would give the direct form in one term; it is
+        // private to `ui_petition`, and widening it is that module's call to make, not this
+        // probe's.
+        Phase::Opening { since, sent } => {
+            let Some((bag_index, slot, guid)) = probe.charter else {
+                probe.phase = Phase::Done;
+                return;
+            };
+            if !sent {
+                // The control, the clam probe's first reading: a window that was already up would
+                // make everything below it meaningless.
+                if vm_visible(&script, "PetitionFrame") {
+                    probe.fail(
+                        6,
+                        "open",
+                        "PetitionFrame was ALREADY visible before the click — the control failed, \
+                         so nothing this step could read would be evidence"
+                            .to_string(),
+                    );
+                    probe.phase = Phase::Destroying {
+                        since: now,
+                        sent: false,
+                    };
+                    return;
+                }
+                let Some((container, lua_slot)) = lua_bag_pos(bag_index, slot) else {
+                    probe.skip(
+                        6,
+                        "open",
+                        format!(
+                            "the charter landed at wire {bag_index}/{slot}, which is not a \
+                             position a bag right-click can address — refusing to click a slot \
+                             the probe cannot name"
+                        ),
+                    );
+                    probe.phase = Phase::Destroying {
+                        since: now,
+                        sent: false,
+                    };
+                    return;
+                };
+                if let Err(e) = script.run(&format!("UseContainerItem({container}, {lua_slot})")) {
+                    probe.skip(
+                        6,
+                        "open",
+                        format!("the click chunk did not run in the live VM: {e}"),
+                    );
+                    probe.phase = Phase::Destroying {
+                        since: now,
+                        sent: false,
+                    };
+                    return;
+                }
+                info!(
+                    "PROBE_CHARTER: 6 (open) — UseContainerItem({container}, {lua_slot}) through \
+                     the live VM for charter {guid:#x} (wire {bag_index}/{slot})"
+                );
+                probe.phase = Phase::Opening {
+                    since: now,
+                    sent: true,
+                };
+                return;
+            }
+            let visible = vm_visible(&script, "PetitionFrame");
+            let kind = vm_petition_str(&script, 1);
+            let originator = vm_is_originator(&script);
+            let names = vm_num_names(&script);
+            if visible
+                && kind == benilla_ui::script::PETITION_TYPE_CHARTER
+                && originator == 1
+                && names == FRESH_SIGNATURES
+            {
+                let at_open = vm_petition_str(&script, 2);
+                probe.title_at_open = at_open.clone();
+                probe.pass(
+                    6,
+                    "open",
+                    format!(
+                        "the click on charter {guid:#x} opened PetitionFrame: \
+                         petitionType={kind:?}, isOriginator=1, GetNumPetitionNames()={names} \
+                         (the owner is not a signer), title at open {at_open:?}"
+                    ),
+                );
+                probe.phase = Phase::Record { since: now };
+            } else if now - since > PETITION_TIMEOUT_SECS {
+                probe.fail(
+                    6,
+                    "open",
+                    format!(
+                        "charter {guid:#x} did not open within {PETITION_TIMEOUT_SECS}s of the \
+                         click: PetitionFrame:IsVisible()={visible}, petitionType={kind:?}, \
+                         isOriginator={originator}, GetNumPetitionNames()={names}. Either the \
+                         item-use fork never reached ItemUseRoute::ShowPetition (a charter that \
+                         falls through to `Nothing` sends nothing at all — the pre-1672 \
+                         behaviour) or the answer never became a window. Lines seen: {:?}",
+                        probe_lines(&script)
+                    ),
+                );
+                probe.phase = Phase::Destroying {
+                    since: now,
+                    sent: false,
+                };
+            }
+        }
+        // ── Step 7 — the lazy record fill ───────────────────────────────────────────────────
+        // The window opens with an EMPTY title: `SMSG_PETITION_SHOW_SIGNATURES` carries an item
+        // guid, an owner guid, a petition id and signer guids, and no text at all. The name
+        // arrives a round trip later on `SMSG_PETITION_QUERY_RESPONSE`, keyed by petition id, and
+        // the feed re-fires `PETITION_SHOW` so the window repaints in place.
+        //
+        // A PASS here is the whole two-caches design observed working end to end. A FAIL means the
+        // ask-once record query never went out, its answer never landed, or the repaint edge never
+        // fired — in every one of which the window sits titleless forever, which is what a player
+        // would report as "the charter has no name".
+        Phase::Record { since } => {
+            let title = vm_petition_str(&script, 2);
+            let max = vm_petition_max(&script);
+            if title == probe.bought && max == REQUIRED_SIGNATURES {
+                // The first half of the claim, checked against what step 6 latched: the title at
+                // open was either empty (the packet carries none) or already the bought name (the
+                // record beat the paint). Anything else is a title from somewhere it cannot have
+                // come from.
+                let at_open = probe.title_at_open.clone();
+                if at_open.is_empty() || at_open == probe.bought {
+                    probe.pass(
+                        7,
+                        "record",
+                        format!(
+                            "the window opened with title {at_open:?} and filled to {title:?} a \
+                             round trip later, maxSignatures={max} — the record cache and its \
+                             PETITION_SHOW repaint both working"
+                        ),
+                    );
+                } else {
+                    probe.fail(
+                        7,
+                        "record",
+                        format!(
+                            "the title filled to {title:?} correctly, but at open it read \
+                             {at_open:?} — neither empty nor the bought name, so it came from a \
+                             record that is not this charter's"
+                        ),
+                    );
+                }
+                probe.phase = Phase::Renaming {
+                    since: now,
+                    sent: false,
+                };
+            } else if now - since > RECORD_TIMEOUT_SECS {
+                let bought = probe.bought.clone();
+                probe.fail(
+                    7,
+                    "record",
+                    format!(
+                        "the petition record never landed within {RECORD_TIMEOUT_SECS}s: title \
+                         reads {title:?} (wanted {bought:?}), maxSignatures={max} (wanted \
+                         {REQUIRED_SIGNATURES} — vmangos hardcodes 9 at \
+                         PetitionsHandler.cpp:182-183). The window opens titleless by design, so \
+                         this is the lazy CMSG_PETITION_QUERY, its answer, or the repaint edge"
+                    ),
+                );
+                probe.phase = Phase::Destroying {
+                    since: now,
+                    sent: false,
+                };
+            }
+        }
+        // ── Step 8 — the rename echo ────────────────────────────────────────────────────────
+        // `RenamePetition(name)` in the live VM — the `RENAME_GUILD` popup's own Accept. vmangos
+        // sends `MSG_PETITION_RENAME` back **only on success** (`PetitionsHandler.cpp:209-215`,
+        // inside `if (petition->Rename(...))`), so the title changing IS the echo arriving; a
+        // refusal is silent apart from a guild-command result on the other channel.
+        //
+        // A FAIL means the echo never arrived or never patched the cached record — the window
+        // would keep showing the old name indefinitely, since nothing re-queries.
+        Phase::Renaming { since, sent } => {
+            if !sent {
+                let name = probe_guild_name("Probe Renamed");
+                if let Err(e) = script.run(&format!("RenamePetition(\"{name}\")")) {
+                    probe.skip(
+                        8,
+                        "rename",
+                        format!("RenamePetition would not run in the live VM: {e}"),
+                    );
+                    probe.phase = Phase::Destroying {
+                        since: now,
+                        sent: false,
+                    };
+                    return;
+                }
+                info!("PROBE_CHARTER: 8 (rename) — RenamePetition({name:?}) run in the live VM");
+                probe.renamed = name;
+                probe.phase = Phase::Renaming {
+                    since: now,
+                    sent: true,
+                };
+                return;
+            }
+            let title = vm_petition_str(&script, 2);
+            if title == probe.renamed {
+                let bought = probe.bought.clone();
+                probe.pass(
+                    8,
+                    "rename",
+                    format!(
+                        "the title changed from {bought:?} to {title:?} — MSG_PETITION_RENAME's \
+                         echo arrived and patched the cached record in place"
+                    ),
+                );
+                probe.phase = Phase::Destroying {
+                    since: now,
+                    sent: false,
+                };
+            } else if now - since > RENAME_TIMEOUT_SECS {
+                let renamed = probe.renamed.clone();
+                probe.fail(
+                    8,
+                    "rename",
+                    format!(
+                        "the title still reads {title:?} {RENAME_TIMEOUT_SECS}s after \
+                         RenamePetition({renamed:?}). The echo is sent ONLY on success, so either \
+                         the rename was refused (name taken/invalid/reserved) or the echo did not \
+                         patch the record. Lines seen: {:?}",
+                        probe_lines(&script)
+                    ),
+                );
+                probe.phase = Phase::Destroying {
+                    since: now,
+                    sent: false,
+                };
+            }
+        }
+        // ── Step 9 — the cleanup that makes the probe re-runnable ───────────────────────────
+        // `CMSG_DESTROYITEM` on the charter's own wire slot. vmangos cascades that into deleting
+        // the petition (`Player.cpp:10811-10817`: `if (pItem->IsCharter())` → `DeletePetition`),
+        // which is the only reason destroying the item is enough.
+        //
+        // **Without this, the NEXT run's buy is refused silently** — "Cannot buy a petition if the
+        // owner already has one", a bare `return` at `PetitionsHandler.cpp:70` — and step 5 would
+        // fail for a reason that looks nothing like its cause: no packet, no error line, just an
+        // item that never arrives. That is exactly the failure this step exists to prevent, and it
+        // is why every exit from steps 5-8 routes through here rather than to `Done`.
+        //
+        // The send is watched to land, the clam probe's lesson: `AppExit` tears the net thread
+        // down within a frame or two, so a fire-and-forget destroy written on the way out never
+        // reaches the wire.
+        Phase::Destroying { since, sent } => {
+            let Some((bag_index, slot, guid)) = probe.charter else {
+                probe.phase = Phase::Done; // nothing was bought — nothing to clean up
+                return;
+            };
+            if !sent {
+                // The position is read FRESH rather than reused from step 5's latch. `count: 0`
+                // destroys whatever whole stack sits at the addressed position, so a stale pair
+                // would destroy the wrong item; nothing is expected to move a charter, and that is
+                // exactly the kind of expectation a destructive send must not rest on.
+                let Some((bag_index, slot, _)) =
+                    find_item(&store.0, &items, CHARTER_ITEM_ENTRY, ItemSearch::default())
+                else {
+                    probe.pass(
+                        9,
+                        "cleanup",
+                        format!(
+                            "charter {guid:#x} was already out of the bags before the destroy — \
+                             nothing left to clean up (latched at wire {bag_index}/{slot})"
+                        ),
+                    );
+                    probe.phase = Phase::Done;
+                    return;
+                };
+                let _ = net.0.send(ClientCommand::DestroyItem {
+                    bag_index,
+                    slot,
+                    count: 0,
+                });
+                info!(
+                    "PROBE_CHARTER: 9 (cleanup) — CMSG_DESTROYITEM on wire {bag_index}/{slot} \
+                     (charter {guid:#x}); vmangos deletes the petition with it"
+                );
+                probe.phase = Phase::Destroying {
+                    since: now,
+                    sent: true,
+                };
+                return;
+            }
+            let still_there =
+                find_item(&store.0, &items, CHARTER_ITEM_ENTRY, ItemSearch::default());
+            if still_there.is_none() {
+                probe.pass(
+                    9,
+                    "cleanup",
+                    format!(
+                        "charter {guid:#x} left the bags and its petition went with it — the next \
+                         run's buy will not hit the silent already-owns-a-petition refusal"
+                    ),
+                );
+                probe.phase = Phase::Done;
+            } else if now - since > DESTROY_TIMEOUT_SECS {
+                probe.fail(
+                    9,
+                    "cleanup",
+                    format!(
+                        "charter {guid:#x} is STILL in the bags {DESTROY_TIMEOUT_SECS}s after \
+                         CMSG_DESTROYITEM. Remove it by hand before the next run — otherwise its \
+                         step 5 is refused silently for `the owner already has one` and reads as a \
+                         buy that never sent. Lines seen: {:?}",
+                        probe_lines(&script)
+                    ),
+                );
+                probe.phase = Phase::Done;
+            }
+        }
+        Phase::Done => {
+            if probe.exited {
+                return;
+            }
+            probe.exited = true;
+            info!(
+                "PROBE_CHARTER: DONE pass={} fail={}",
+                probe.passes, probe.fails
+            );
+            // The probe self-exit pattern (`ProbeExitPlugin::fire_probe_exit`): a polite AppExit
+            // plus a hard backstop thread, so a net/winit teardown hang can't leave a zombie
+            // client holding the probe account.
+            exit.write(AppExit::Success);
+            std::thread::spawn(|| {
+                std::thread::sleep(std::time::Duration::from_secs(5));
+                warn!("PROBE_CHARTER: still alive 5s after AppExit — hard exit");
+                std::process::exit(0);
+            });
+        }
+    }
+}
+
+/// Step 1's send, shared by both of step 0's exits so the hop is spelled once.
+fn hop(probe: &mut CharterProbe, net: &NetCommands, now: f64) {
+    let [x, y, z] = REGISTRAR_AT;
+    info!(
+        "PROBE_CHARTER: 1 (hop) — hopping to Aldwin Laughlin (entry {REGISTRAR_ENTRY}) at \
+         ({x}, {y}, {z}) map {REGISTRAR_MAP}"
+    );
+    let _ = net.0.send(ClientCommand::Chat {
+        kind: ChatKind::Say,
+        target: None,
+        text: format!(".go xyz {x} {y} {z} {REGISTRAR_MAP}"),
+    });
+    probe.phase = Phase::Settling { sent_at: now };
+}
+
+/// Steps 3 and 4's first half — the icon, then the click.
+///
+/// Split out of the phase match because it is one straight line of asserts with several exits, and
+/// inlining it buried the phase machine's shape ([`super::probe_binder`]'s own split). Sets
+/// `probe.phase` on every path.
+///
+/// **Step 3's FAIL is the icon-table regression, one row over from B249.** Byte 7 is `"petition"`
+/// in the client's own `0x84b7ac` table (decision 1335); a `"gossip"` here means the row draws the
+/// chat bubble, which is what the pre-1331 hand-written map did to the innkeeper's byte 5.
+///
+/// **Step 4's send is by WIRE INDEX**, read off the packet, never derived from where the row sits
+/// in the list — the drain's own rule, and the reason a menu that grows a row cannot silently make
+/// this probe click the tabard designer.
+fn assert_icon_and_select(
+    probe: &mut CharterProbe,
+    gossip: &GossipState,
+    script: &UiScript,
+    net: &NetCommands,
+    npc: u64,
+    now: f64,
+) {
+    let Some((pos, opt)) = gossip
+        .options
+        .iter()
+        .enumerate()
+        .find(|(_, o)| o.icon == ICON_PETITION)
+    else {
+        probe.fail(
+            3,
+            "icon",
+            format!(
+                "no wire icon=={ICON_PETITION} row in Aldwin's menu (icons seen: {:?}); menu 708 \
+                 pairs option_id 10 (GOSSIP_OPTION_PETITIONER) with icon 7 unconditionally, so \
+                 either the parse or the menu is wrong",
+                gossip.options.iter().map(|o| o.icon).collect::<Vec<_>>()
+            ),
+        );
+        probe.phase = Phase::Done;
+        return;
+    };
+    let ty = vm_icon_type(script, pos + 1);
+    if ty == ICON_TYPE_REGRESSION {
+        probe.fail(
+            3,
+            "icon",
+            format!(
+                "the charter row {:?} (wire icon={ICON_PETITION}) maps to \
+                 {ICON_TYPE_REGRESSION:?}, the chat bubble. That is B249's regression one row \
+                 over: decision 1335's table must index byte 7 to {ICON_TYPE_PETITION:?}",
+                opt.message
+            ),
+        );
+        probe.phase = Phase::Done;
+        return;
+    }
+    if ty != ICON_TYPE_PETITION {
+        probe.fail(
+            3,
+            "icon",
+            format!(
+                "the charter row {:?} (wire icon={ICON_PETITION}) maps to {ty:?}, wanted \
+                 {ICON_TYPE_PETITION:?}",
+                opt.message
+            ),
+        );
+        probe.phase = Phase::Done;
+        return;
+    }
+    // The type string being right is not the row drawing right: the XML looks the type up in
+    // `BENILLA_GOSSIP_ICONS`, and a missing key falls back to the chat bubble with no error
+    // anywhere. Both halves, exactly as the binder probe asserts them.
+    let texture = vm_petition_texture(script);
+    if texture.is_empty() {
+        probe.fail(
+            3,
+            "icon",
+            format!(
+                "the app maps the row to {ICON_TYPE_PETITION:?} but BENILLA_GOSSIP_ICONS.petition \
+                 resolves to nothing in the live VM, so the row would still draw the fallback \
+                 bubble"
+            ),
+        );
+        probe.phase = Phase::Done;
+        return;
+    }
+    probe.pass(
+        3,
+        "icon",
+        format!(
+            "row {} {:?}: wire icon={ICON_PETITION} index={} → type {ty:?}, \
+             BENILLA_GOSSIP_ICONS.petition = {texture:?}",
+            pos + 1,
+            opt.message,
+            opt.index
+        ),
+    );
+
+    // Step 4's click. Guarded on the label — a lowercase substring, never an equality, because the
+    // wire's label is the row's broadcast text rather than its `option_text` column.
+    if !opt.message.to_lowercase().contains(CHARTER_LABEL_HINT) {
+        probe.skip(
+            4,
+            "registrar",
+            format!(
+                "the icon=={ICON_PETITION} row reads {:?}, which does not contain \
+                 {CHARTER_LABEL_HINT:?}; refusing to select something that may not be the charter \
+                 line",
+                opt.message
+            ),
+        );
+        probe.phase = Phase::Done;
+        return;
+    }
+    let _ = net.0.send(ClientCommand::GossipSelectOption {
+        guid: npc,
+        option: opt.index,
+    });
+    info!(
+        "PROBE_CHARTER: 4 (registrar) GossipSelectOption({npc:#x}, wire index {}) sent for {:?}",
+        opt.index, opt.message
+    );
+    probe.charter_row = Some(opt.index);
+    probe.phase = Phase::Registrar { since: now };
+}
diff --git a/crates/benilla-app/src/dev.rs b/crates/benilla-app/src/dev.rs
index 37ae1c29..cefe1de8 100644
--- a/crates/benilla-app/src/dev.rs
+++ b/crates/benilla-app/src/dev.rs
@@ -331,6 +331,13 @@ impl Plugin for DevProbesPlugin {
             if std::env::var("WOW_PROBE_GMTICKET").is_ok() {
                 app.add_plugins(crate::capture::ProbeGmTicketPlugin);
             }
+            // The guild-charter live probe: `WOW_PROBE_CHARTER=1` GM-hops to the Stormwind guild
+            // registrar, asserts the charter row's icon reads "petition", buys a charter through the
+            // registrar's own window, opens it with a real bag right-click and renames it — decision
+            // 1672's end-to-end instrument (see `capture::ProbeCharterPlugin`).
+            if std::env::var("WOW_PROBE_CHARTER").is_ok() {
+                app.add_plugins(crate::capture::ProbeCharterPlugin);
+            }
             // The world-book live probe: `WOW_PROBE_BOOK=1` teleports to the Old Town plaque and
             // measures what having the item-text reader open costs per frame, closed vs open —
             // B240's instrument (see `capture::ProbeBookPlugin`).
diff --git a/crates/benilla-app/src/lib.rs b/crates/benilla-app/src/lib.rs
index c69d4c5f..f27b0515 100644
--- a/crates/benilla-app/src/lib.rs
+++ b/crates/benilla-app/src/lib.rs
@@ -139,6 +139,7 @@ mod ui_pet;
 mod ui_pet_book;
 mod ui_pet_doll;
 mod ui_pet_stats;
+mod ui_petition;
 mod ui_quest;
 mod ui_quest_log;
 mod ui_reputation;
@@ -213,6 +214,7 @@ use ui_pet::UiPetPlugin;
 use ui_pet_book::UiPetBookPlugin;
 use ui_pet_doll::UiPetDollPlugin;
 use ui_pet_stats::UiPetStatsPlugin;
+use ui_petition::UiPetitionPlugin;
 use ui_quest::UiQuestPlugin;
 use ui_quest_log::UiQuestLogPlugin;
 use ui_saved::UiSavedPlugin;
@@ -617,6 +619,10 @@ pub fn run(build: BuildId) -> AppExit {
     // membership verbs, and the `ERR_GUILD_*` lines. Right after the social session, whose
     // FriendsFrame it shares a window with and whose ignore list its sign-on lines consult.
     .add_plugins(UiGuildPlugin)
+    // Founding a guild (decision 1672): the guild registrar and the charter window — the slice
+    // 1257 §2 left out. Right after the guild session, whose error channel its refusals ride and
+    // whose roster its success produces.
+    .add_plugins(UiPetitionPlugin)
     .add_plugins(UiTooltipPlugin)
     // The character-window feed (decision 0208): the combat-stats/inventory snapshots + events
     // the paper doll reads, and the paper-doll booth's yaw mirror.
diff --git a/crates/benilla-app/src/net.rs b/crates/benilla-app/src/net.rs
index 2dbe2991..e1b3205e 100644
--- a/crates/benilla-app/src/net.rs
+++ b/crates/benilla-app/src/net.rs
@@ -1964,6 +1964,65 @@ pub(crate) enum ClientCommand {
     GuildInfoText {
         text: String,
     },
+    // ── The petition family (writer bodies in benilla-protocol `world/writer/petition.rs`,
+    //    decision 1672) — FOUNDING a guild, which at 1.12 shares nothing with the band above but
+    //    its error channel: a refusal on any of these comes back as `SMSG_GUILD_COMMAND_RESULT`.
+    //
+    //    **A charter is addressed by its ITEM guid**, not by a petition id, everywhere except the
+    //    record query. And almost none of these is acked positively: buying answers with the new
+    //    item alone, offering answers the TARGET, renaming echoes only if it took. Nothing here may
+    //    be treated as applied at the send.
+    /// Ask a petitioner NPC for its charter list (`CMSG_PETITION_SHOWLIST`). The gossip row pushes
+    /// the same answer unasked, so this is the direct re-open, not the only way in.
+    #[allow(dead_code)]
+    PetitionShowList {
+        npc: u64,
+    },
+    /// Buy a guild charter under a name (`CMSG_PETITION_BUY`). Answered by nothing at all on
+    /// success — only the new item arrives.
+    PetitionBuy {
+        npc: u64,
+        name: String,
+    },
+    /// Open a charter and list its signatures (`CMSG_PETITION_SHOW_SIGNATURES`). Sent by the
+    /// item-use fork when a charter is clicked, and again to refresh after a signature lands.
+    PetitionShowSignatures {
+        item: u64,
+    },
+    /// Sign somebody's charter (`CMSG_PETITION_SIGN`). `byte` is the optional Lua argument's wire
+    /// byte, whose client-side default is **1**; the server reads and discards it.
+    PetitionSign {
+        item: u64,
+        byte: i8,
+    },
+    /// Show our charter to a player so they can sign it (`CMSG_OFFER_PETITION`) — the success path
+    /// answers *them*, not us.
+    OfferPetition {
+        item: u64,
+        player: u64,
+    },
+    /// Turn a completed charter in (`CMSG_TURN_IN_PETITION`). Owner only; a name collision answers
+    /// with a guild command result and **no** turn-in result at all.
+    TurnInPetition {
+        item: u64,
+    },
+    /// Ask for a petition's record by id (`CMSG_PETITION_QUERY`) — the only packet carrying the
+    /// proposed guild's name and its signature requirement.
+    PetitionQuery {
+        petition_id: u32,
+        item: u64,
+    },
+    /// Rename a charter (`MSG_PETITION_RENAME`); echoed back only on success.
+    PetitionRename {
+        item: u64,
+        name: String,
+    },
+    /// Decline a charter offered to us (`MSG_PETITION_DECLINE`) — we send the item guid, the owner
+    /// receives ours.
+    #[allow(dead_code)]
+    PetitionDecline {
+        item: u64,
+    },
     // ── The taxi/flight-master family (decision 0484 phase 1; writer bodies in
     //    benilla-protocol `messages::taxi`) ──────────────────────────────────────────────────
     /// Ask a nearby flight master's known status (`CMSG_TAXINODE_STATUS_QUERY`): the guid of the
diff --git a/crates/benilla-app/src/net/apply.rs b/crates/benilla-app/src/net/apply.rs
index 81b06537..a0c1e073 100644
--- a/crates/benilla-app/src/net/apply.rs
+++ b/crates/benilla-app/src/net/apply.rs
@@ -242,6 +242,12 @@ pub(super) fn apply_net_updates(
                 // diffs on: the Help window re-polls every 10 minutes and an unchanged answer
                 // still has to re-fire `UPDATE_TICKET`.
                 ResMut<crate::ui_gm_ticket::GmTicketState>,
+                // The guild-charter session (decision 1672) — two resources because only the
+                // registrar half is NPC-bound: `SMSG_PETITION_SHOWLIST` opens the registrar, and
+                // `SMSG_PETITION_SHOW_SIGNATURES` opens the item-bound charter window, which must
+                // survive walking away from the registrar.
+                ResMut<crate::ui_petition::GuildRegistrarState>,
+                ResMut<crate::ui_petition::PetitionState>,
             ),
         ),
     ),
@@ -418,6 +424,8 @@ pub(super) fn apply_net_updates(
                 guild_notify,
                 mut ping,
                 mut gm_ticket,
+                mut registrar,
+                mut petition,
             ),
         ),
     ) = caches;
@@ -1123,6 +1131,50 @@ pub(super) fn apply_net_updates(
                 crate::ui_guild::apply::decline(&mut chat_log, &name)
             }
             SessionEvent::GuildInfo(info) => crate::ui_guild::apply::info(&mut chat_log, info),
+            // ── The petition family (decision 1672): founding a guild. The registrar half is an
+            // NPC window, the charter half is item-bound, and they are two resources for that
+            // reason — see `ui_petition`'s module doc.
+            SessionEvent::PetitionShowList(list) => {
+                // The registrar's two `UNIT_NPC_FLAGS` gates are on LIVE NPC state rather than on
+                // the packet, so the flags are read here — this pass holds the store. An unstreamed
+                // guid reads `None` and fails the gate, as the client's own resolve does.
+                let flags = index
+                    .0
+                    .get(&list.npc)
+                    .and_then(|e| stores.get(*e).ok())
+                    .map(|s| s.0.unit_npc_flags());
+                crate::ui_petition::apply::show_list(&mut registrar, list, flags)
+            }
+            SessionEvent::PetitionShowSignatures(sigs) => {
+                // An ignored owner suppresses the ENTIRE update — no record fetch, no list, no
+                // event, no error line (`0x5eeefe`). Consulted before anything else happens.
+                let ignored = social.is_ignored(sigs.owner);
+                crate::ui_petition::apply::show_signatures(
+                    &mut petition,
+                    sigs,
+                    ignored,
+                    &net_commands,
+                )
+            }
+            SessionEvent::PetitionQueryResponse(response) => {
+                crate::ui_petition::apply::query_response(&mut petition, response)
+            }
+            SessionEvent::PetitionSignResults(results) => crate::ui_petition::apply::sign_results(
+                &mut petition,
+                &mut names,
+                self_guid.0.unwrap_or(0),
+                results,
+                &net_commands,
+            ),
+            SessionEvent::TurnInPetitionResults { result } => {
+                crate::ui_petition::apply::turn_in_results(&mut petition, &mut registrar, result)
+            }
+            SessionEvent::PetitionDeclined { player } => {
+                crate::ui_petition::apply::declined(&mut petition, &names, player)
+            }
+            SessionEvent::PetitionRenamed(rename) => {
+                crate::ui_petition::apply::renamed(&mut petition, rename)
+            }
             SessionEvent::LootResponse {
                 guid,
                 loot_type,
diff --git a/crates/benilla-app/src/net/io.rs b/crates/benilla-app/src/net/io.rs
index ca909df8..1cd8e6dd 100644
--- a/crates/benilla-app/src/net/io.rs
+++ b/crates/benilla-app/src/net/io.rs
@@ -1090,6 +1090,20 @@ fn writer_loop(
                         w.guild_set_officer_note(&name, &note)
                     }
                     ClientCommand::GuildInfoText { text } => w.guild_info_text(&text),
+                    // The petition family (decision 1672) — founding a guild.
+                    ClientCommand::PetitionShowList { npc } => w.petition_show_list(npc),
+                    ClientCommand::PetitionBuy { npc, name } => w.petition_buy(npc, &name),
+                    ClientCommand::PetitionShowSignatures { item } => {
+                        w.petition_show_signatures(item)
+                    }
+                    ClientCommand::PetitionSign { item, byte } => w.petition_sign(item, byte),
+                    ClientCommand::OfferPetition { item, player } => w.offer_petition(item, player),
+                    ClientCommand::TurnInPetition { item } => w.turn_in_petition(item),
+                    ClientCommand::PetitionQuery { petition_id, item } => {
+                        w.petition_query(petition_id, item)
+                    }
+                    ClientCommand::PetitionRename { item, name } => w.petition_rename(item, &name),
+                    ClientCommand::PetitionDecline { item } => w.petition_decline(item),
                     ClientCommand::TaxiNodeStatusQuery { guid } => w.taxi_node_status_query(guid),
                     ClientCommand::TaxiQueryNodes { guid } => w.taxi_query_available_nodes(guid),
                     ClientCommand::ActivateTaxi {
diff --git a/crates/benilla-app/src/target/cursor_mode.rs b/crates/benilla-app/src/target/cursor_mode.rs
index 2eca1bb3..ae80864d 100644
--- a/crates/benilla-app/src/target/cursor_mode.rs
+++ b/crates/benilla-app/src/target/cursor_mode.rs
@@ -146,9 +146,12 @@ impl WorldCursor {
 
 /// Vanilla `UNIT_NPC_FLAGS` bits (vmangos `UnitDefines.h`, 1.12 values — later expansions differ).
 /// REPAIR (0x4000) exists but the classifier never consults it (falls `je 0x4826cb`).
-/// `pub(super)` so the right-click dispatch ([`super::click`]) reuses BANKER to split the shared
-/// Buy cursor kind (banker vs auctioneer) without a duplicate table (decision 0604).
-pub(super) mod npc_flags {
+/// `pub(crate)` so the right-click dispatch ([`super::click`]) reuses BANKER to split the shared
+/// Buy cursor kind (banker vs auctioneer) without a duplicate table (decision 0604), and so a live
+/// probe scans for a service NPC by the same bits the cursor classifies with instead of keeping a
+/// private copy ([`crate::capture::ProbeCharterPlugin`] and PETITIONER) — a duplicated flag table
+/// is how B249's icon map went stale.
+pub(crate) mod npc_flags {
     pub const GOSSIP: u32 = 0x1;
     pub const QUESTGIVER: u32 = 0x2;
     pub const VENDOR: u32 = 0x4;
diff --git a/crates/benilla-app/src/ui_action/drain.rs b/crates/benilla-app/src/ui_action/drain.rs
index 9fedae27..12f24697 100644
--- a/crates/benilla-app/src/ui_action/drain.rs
+++ b/crates/benilla-app/src/ui_action/drain.rs
@@ -340,6 +340,9 @@ pub(super) fn drain_action_uses(
                             spell_index,
                             use_spell: template.use_spell.map(|u| u.spell_id),
                             on_object: None,
+                            is_charter: template.flags
+                                & benilla_protocol::messages::ITEM_FLAG_CHARTER
+                                != 0,
                         },
                         &targeting.context(),
                         &mut ladder,
diff --git a/crates/benilla-app/src/ui_items/drain.rs b/crates/benilla-app/src/ui_items/drain.rs
index d83eca98..86ff4925 100644
--- a/crates/benilla-app/src/ui_items/drain.rs
+++ b/crates/benilla-app/src/ui_items/drain.rs
@@ -95,7 +95,7 @@ pub(super) fn drain_inventory_uses(
         let slot = (id - 1) as u8;
         // The doll's own slot ids ARE the wire slots (`wire_pos`'s EQUIPMENT_BAG law), so the
         // equipped instance resolves off the player's INV array directly.
-        let (guid, start_quest, spell_index, use_spell, entry) = self_q
+        let (guid, start_quest, spell_index, use_spell, entry, is_charter) = self_q
             .iter()
             .next()
             .and_then(|store| slot_guid(&store.0, EQUIPMENT_BAG, slot, &ladder.items))
@@ -110,9 +110,10 @@ pub(super) fn drain_inventory_uses(
                     t.use_spell_index().unwrap_or(0),
                     t.use_spell.map(|u| u.spell_id),
                     Some(entry),
+                    t.flags & benilla_protocol::messages::ITEM_FLAG_CHARTER != 0,
                 ))
             })
-            .unwrap_or((None, 0, 0, None, None));
+            .unwrap_or((None, 0, 0, None, None, false));
         debug!("ui_items: use equipped item, lua slot {id} (wire 255/{slot})");
         super::send_item_use(
             super::ItemUse {
@@ -124,6 +125,7 @@ pub(super) fn drain_inventory_uses(
                 spell_index,
                 use_spell,
                 on_object: None,
+                is_charter,
             },
             &targeting.context(),
             &mut ladder,
@@ -255,6 +257,7 @@ pub(super) fn drain_container_uses(
                     unwraps_gift: t.unwraps_gift(inst_flags),
                     opens_loot: t.opens_loot(),
                     page_text: t.page_text,
+                    is_charter: t.flags & benilla_protocol::messages::ITEM_FLAG_CHARTER != 0,
                 })
             });
 
@@ -332,6 +335,7 @@ pub(super) fn drain_container_uses(
                     spell_index: c.spell_index,
                     use_spell: c.use_spell,
                     on_object: None,
+                    is_charter: c.is_charter,
                 },
                 &targeting.context(),
                 &mut ladder,
@@ -442,6 +446,7 @@ pub(super) fn drain_container_uses(
                 spell_index: clicked.map_or(0, |c| c.spell_index),
                 use_spell: clicked.and_then(|c| c.use_spell),
                 on_object: None,
+                is_charter: clicked.is_some_and(|c| c.is_charter),
             },
             &targeting.context(),
             &mut ladder,
@@ -475,6 +480,8 @@ struct Clicked {
     /// book. The reader re-reads the head (and the material) off the template itself as it paints,
     /// like the reference, so only the fork's predicate is carried here.
     page_text: u32,
+    /// The template's `ITEM_FLAG_CHARTER` — a guild petition (decision 1672).
+    is_charter: bool,
 }
 
 /// Drain the pick/place/swap/split moves `PickupContainerItem`/`SplitContainerItem` queued and
diff --git a/crates/benilla-app/src/ui_items/mod.rs b/crates/benilla-app/src/ui_items/mod.rs
index 9ab2419b..581ce31b 100644
--- a/crates/benilla-app/src/ui_items/mod.rs
+++ b/crates/benilla-app/src/ui_items/mod.rs
@@ -611,6 +611,9 @@ pub(crate) struct ItemUse {
     /// The GameObject this use is aimed at — the key-in-a-lock arm (decision 0769), which is
     /// `CGItem::Use`'s own target argument. `None` for every ordinary click.
     pub(crate) on_object: Option<u64>,
+    /// The template's `ITEM_FLAG_CHARTER` (`0x2000`) — a signable guild petition
+    /// (decision 1672). Diverts to [`ItemUseRoute::ShowPetition`].
+    pub(crate) is_charter: bool,
 }
 
 /// **The item-use fork** — our `CGItem::Use` (`0x5d8d00`): the one place that decides what "using"
@@ -653,6 +656,31 @@ pub(crate) enum ItemUseRoute {
     /// with **nothing sent**. (Before decision 0914 we sent anyway, and vmangos answered
     /// `EQUIP_ERR_ITEM_NOT_FOUND` — a red "Item not found." the reference never shows.)
     Nothing,
+    /// **The charter arm** (decision 1672): using an item whose template flags carry
+    /// `ITEM_FLAG_CHARTER` (`0x2000`) opens the petition window — it sends
+    /// `CMSG_PETITION_SHOW_SIGNATURES` for the instance, not `CMSG_USE_ITEM`.
+    ///
+    /// **INFERRED, and this is the whole of the evidence.** wow-re has not carved `CGItem::Use`'s
+    /// charter branch, so the *position* of this arm and the opcode it sends are reasoned rather
+    /// than read:
+    ///
+    /// - 1.12's shipped FrameXML special-cases a charter **nowhere** — `UseContainerItem` and
+    ///   `UseAction` are entirely generic — so whatever opens the window is engine-side.
+    /// - The charter template (entry 5863) has no ON_USE spell, no `StartQuest`, and
+    ///   `InventoryType = 0`, so *every* other arm of this fork declines it and the click currently
+    ///   reaches [`Self::Nothing`] and sends nothing at all. Right-clicking a charter in 1.12
+    ///   plainly does something, so an arm must exist.
+    /// - `CMSG_PETITION_SHOW_SIGNATURES` is the only opcode that opens the window, and vmangos's
+    ///   `HandleUseItemOpcode` has no charter branch — a `CMSG_USE_ITEM` here would be answered
+    ///   with nothing.
+    /// - The reference already keys other charter behaviour on this exact flag bit: the item
+    ///   tooltip's `ITEM_SIGNABLE` line and its enchant-line suppression both test `0x2000`
+    ///   (wow-re `system/ui/scratch/tooltip-content-law.md:485-505`).
+    ///
+    /// The arm sits directly after the quest fork. Its **order relative to the quest fork is
+    /// unobservable** — no 1.12 item is both a charter and a quest starter — so nothing here rests
+    /// on it; a byte read of `0x5d8d00` settles both the position and the opcode.
+    ShowPetition { item: u64 },
 }
 
 /// [`ItemUseRoute`]'s decision. `guid: None` (the instance never resolved) cannot address a
@@ -669,6 +697,12 @@ pub(crate) fn item_use_route(it: ItemUse, aura_cancels: impl Fn(u32) -> bool) ->
             quest: it.start_quest,
         };
     }
+    // The charter arm (decision 1672) — see `ItemUseRoute::ShowPetition` for its evidence and for
+    // why its position here is unobservable. A charter with no resolved instance cannot be
+    // addressed, so it falls through to the ordinary path exactly as the quest fork does.
+    if let Some(item) = it.guid.filter(|_| it.is_charter) {
+        return ItemUseRoute::ShowPetition { item };
+    }
     match it.use_spell {
         Some(spell) if aura_cancels(spell) => ItemUseRoute::ToggleCancel(spell),
         Some(spell) => ItemUseRoute::Cast(spell),
@@ -750,6 +784,13 @@ pub(crate) fn send_item_use(
                 .send(crate::net::ClientCommand::QuestgiverQuery { npc, quest });
             true
         }
+        ItemUseRoute::ShowPetition { item } => {
+            let _ = ladder
+                .commands
+                .0
+                .send(crate::net::ClientCommand::PetitionShowSignatures { item });
+            true
+        }
         ItemUseRoute::Nothing => {
             debug!(
                 "ui_items: the item at wire {}/{} has no ON_USE block — nothing sent (TryCast's null-rec bail)",
@@ -1098,6 +1139,7 @@ mod tests {
             spell_index: 0,
             use_spell,
             on_object: None,
+            is_charter: false,
         };
         let never = |_| false;
         assert_eq!(
@@ -1125,6 +1167,52 @@ mod tests {
         );
     }
 
+    /// **The charter arm** (decision 1672): an item whose template carries `ITEM_FLAG_CHARTER`
+    /// opens the petition window instead of taking the cast tail.
+    ///
+    /// This is the arm's whole justification as a test: the live charter template (entry 5863) has
+    /// **no** ON_USE spell, **no** `StartQuest` and `InventoryType = 0`, so without this arm the
+    /// click reaches `Nothing` and sends absolutely nothing — a charter you can buy and never open.
+    /// The `Nothing` case below is that pre-1672 behaviour, pinned beside the fix so the two are
+    /// visibly one decision.
+    #[test]
+    fn a_charter_click_opens_the_petition_instead_of_casting() {
+        let charter = 0x4000_0000_0000_5863_u64;
+        let it = |guid, is_charter, use_spell| ItemUse {
+            entry: 5863,
+            guid,
+            start_quest: 0,
+            bag_index: 255,
+            slot: 23,
+            spell_index: 0,
+            use_spell,
+            on_object: None,
+            is_charter,
+        };
+        let never = |_| false;
+        assert_eq!(
+            item_use_route(it(Some(charter), true, None), never),
+            ItemUseRoute::ShowPetition { item: charter },
+            "the charter opens its petition window"
+        );
+        // Without the flag, the very same item is the reference's silent no-op — which is what a
+        // charter click did before this arm existed.
+        assert_eq!(
+            item_use_route(it(Some(charter), false, None), never),
+            ItemUseRoute::Nothing
+        );
+        // No resolved instance: nothing to address the show-signatures with, so it falls through
+        // exactly as the quest fork does on the same condition.
+        assert_eq!(
+            item_use_route(it(None, true, None), never),
+            ItemUseRoute::Nothing
+        );
+        assert_eq!(
+            item_use_route(it(None, true, Some(8690)), never),
+            ItemUseRoute::Cast(8690)
+        );
+    }
+
     /// **The mount click, both ways** (the director, 08-03: "clicking the mount while mounted
     /// should dismount"). `CGItem::Use`'s toggle scan sits above the cast tail, so an item whose
     /// ON_USE spell is already live on the caster cancels its aura and never casts — and the same
@@ -1143,6 +1231,7 @@ mod tests {
             spell_index: 0,
             use_spell,
             on_object: None,
+            is_charter: false,
         };
         let mounted = |spell: u32| spell == SUMMON_HORSE;
         assert_eq!(
diff --git a/crates/benilla-app/src/ui_petition/feed.rs b/crates/benilla-app/src/ui_petition/feed.rs
new file mode 100644
index 00000000..e4aba1d1
--- /dev/null
+++ b/crates/benilla-app/src/ui_petition/feed.rs
@@ -0,0 +1,329 @@
+//! The charter VM feed/drain — the systems half of [`super`]: resolve the wire's guids and ids into
+//! the snapshot the two charter windows read, fire the four events on their edges, drain the
+//! composed lines onto their two channels, and turn the Lua-side [`PetitionRequest`] intents into
+//! their sends.
+//!
+//! **`PETITION_SHOW` is DEFERRED, and that is the load-bearing behaviour of this file.** The real
+//! client fires it only when *no signer name is still resolving* **and** *the petition record has
+//! arrived* (`0x4f419b`-`0x4f41ad`), and it fires exactly once however many names were outstanding
+//! (`0x4f4320` decrements the pending counter and fires only on the transition to zero). wow-re's
+//! note puts it flatly: *"A client that fires `PETITION_SHOW` straight off the packet paints a
+//! window with blank signer names."* That is precisely what this file did before the carve — it
+//! opened immediately and repainted as each lookup landed, which is a visibly different window.
+//!
+//! Two things follow, and they are why the deferral is a simplification rather than a cost:
+//!
+//! - the window never paints a partial state, so `PetitionFrame`'s `format(GUILD_CHARTER_TEMPLATE,
+//!   title)` can never see a nil title;
+//! - the *getters* still answer honestly at any moment (an addon may call them whenever it likes),
+//!   which is why `benilla_ui::script::petition` keeps its no-record leg and its nil names. The
+//!   deferral is about the **event**, not about the data.
+//!
+//! **The owner's name is deliberately NOT part of the defer condition.** The pending counter is
+//! incremented only for *signers* (`0x4f4186`/`0x4f42e8`), so a charter whose owner name has not
+//! resolved still opens, with `GetPetitionInfo`'s fifth return reading nil. Folding the owner in
+//! would look tidier and would hold the window shut in a case the client does not.
+//!
+//! **Lines go to two different channels**, and which one is not guessable from the key names — see
+//! [`super::lines`]. The red `UI_ERROR_MESSAGE` needs the `script` handle, which is why they are
+//! composed at apply time and fired here.
+
+use benilla_ui::script::{
+    PetitionRecordView, PetitionRequest, PetitionState as VmPetition, ScriptValue, UiScript,
+    PETITION_TYPE_CHARTER, PETITION_TYPE_PETITION,
+};
+use bevy::prelude::*;
+
+use crate::items::Items;
+use crate::names::NameCache;
+use crate::net::{ClientCommand, NetCommands, ObjectStore, SelfGuid, SelfPlayer};
+use crate::ui_chat::{ChatEvent, ChatEventKind, ChatLog};
+use crate::ui_items::{find_item, ItemSearch};
+use crate::ui_session::{npc_switched, NpcSession};
+
+use super::{lines, GuildRegistrarState, PetitionState};
+
+/// What the feed last announced, so the events fire on edges rather than every frame.
+#[derive(Default)]
+pub(super) struct FedPetition {
+    /// The registrar's NPC, if the window was open last frame.
+    registrar: Option<u64>,
+    /// The charter item the petition window was **showing** last frame — set only once the charter
+    /// became READY (module doc). A charter that is open but still resolving is `None` here, which
+    /// is what makes the deferral a plain edge rather than a second flag.
+    shown_charter: Option<u64>,
+    /// The last pushed view, so a change while shown re-fires `PETITION_SHOW`.
+    shown: Option<PetitionRecordView>,
+    /// …and the signer names beside it, which change independently of the record.
+    shown_signers: Vec<Option<String>>,
+}
+
+/// Build the snapshot, push it, drain the queued lines, and fire the four events on their edges.
+#[allow(clippy::too_many_arguments)]
+pub(super) fn feed_petition(
+    script: Option<NonSendMut<UiScript>>,
+    registrar: Res<GuildRegistrarState>,
+    mut petition: ResMut<PetitionState>,
+    mut names: ResMut<NameCache>,
+    self_q: Query<&ObjectStore, With<SelfPlayer>>,
+    self_guid: Res<SelfGuid>,
+    commands: Res<NetCommands>,
+    mut chat_log: ResMut<ChatLog>,
+    mut fed: Local<crate::ui_script::VmMemo<FedPetition>>,
+) {
+    let Some(mut script) = script else {
+        return;
+    };
+    let fed = fed.get(&script);
+
+    // The composed lines, onto their two channels. Drained before the snapshot so a refusal shows
+    // in the same frame as the state change that caused it.
+    for line in std::mem::take(&mut petition.lines) {
+        match line {
+            lines::Line::Chat(text) => {
+                chat_log.push_event(ChatEvent::text_only(ChatEventKind::System, text));
+            }
+            lines::Line::Error(text) => {
+                script.fire_event("UI_ERROR_MESSAGE", vec![ScriptValue::Str(text)]);
+            }
+        }
+    }
+
+    // **Rebuilt every frame, deliberately.** Half of what this window shows arrives from a CACHE,
+    // not a packet, and reading that cache is what ISSUES its query (decision 0660's law). So a
+    // name landing sets no flag anywhere — the only evidence is that rebuilding differs. This is
+    // also what drives the deferral: `ready` below can only become true on a rebuild.
+    // A price and at most nine names, so the honest version is the cheap one too.
+    let open = petition.open.clone();
+    let me = self_guid.0.unwrap_or(0);
+
+    let signers: Vec<Option<String>> = open
+        .as_ref()
+        .map(|o| {
+            o.signers
+                .iter()
+                .map(|s| names.resolve(*s, &commands).map(str::to_string))
+                .collect()
+        })
+        .unwrap_or_default();
+
+    let record = open.as_ref().and_then(|o| {
+        let r = petition.records.get(&o.petition_id)?;
+        Some(PetitionRecordView {
+            petition_type: if r.is_charter {
+                PETITION_TYPE_CHARTER
+            } else {
+                PETITION_TYPE_PETITION
+            }
+            .to_string(),
+            title: r.name.clone(),
+            body_text: r.body_text.clone(),
+            max_signatures: r.required,
+            // Nil until the cache has it — and NOT part of the defer condition (module doc).
+            originator: names.resolve(o.owner, &commands).map(str::to_string),
+            is_originator: o.owner == me,
+        })
+    });
+
+    // `CanSignPetition`, the four refusals of `0x4f45e0` — and its no-record leg, which answers
+    // **1**. That asymmetry is the reference's own: with no record cached it jumps past the three
+    // record-dependent tests straight into the signer scan, over an array the close path has
+    // already zeroed.
+    let in_guild = self_q
+        .iter()
+        .next()
+        .is_some_and(|s| s.0.player_guild_id() != 0);
+    let can_sign = match (open.as_ref(), record.as_ref()) {
+        (Some(o), Some(r)) => {
+            // (a)/(b) are gated on the charter bit, so a non-charter petition is refused for
+            // neither guild membership nor a full list.
+            let charter_refusal = r.petition_type == PETITION_TYPE_CHARTER
+                && (in_guild || o.signers.len() as i32 >= r.max_signatures);
+            !charter_refusal && !r.is_originator && !o.signers.contains(&me)
+        }
+        // No record: only the signer scan runs, and it is over an empty array.
+        (Some(o), None) => !o.signers.contains(&me),
+        (None, _) => true,
+    };
+
+    script.set_petition(VmPetition {
+        charter_cost: registrar.cost(),
+        signers: signers.clone(),
+        record: record.clone(),
+        can_sign,
+    });
+
+    // ── The registrar's edges. A registrar→registrar switch is a real close+open in the
+    //    reference, because `ShowUIPanel` early-returns on a visible frame and the open sound
+    //    would otherwise never replay (`crate::ui_session::npc_switched`).
+    let now_registrar = registrar.npc();
+    if npc_switched(fed.registrar, now_registrar) {
+        script.fire_event("GUILD_REGISTRAR_CLOSED", vec![]);
+        script.fire_event("GUILD_REGISTRAR_SHOW", vec![]);
+        // …then consume the close `OnHide` just queued, or the drain would apply it to the
+        // registrar we have this instant re-opened (decision 0096).
+        let _ = script.drop_petition_close_intents();
+    } else {
+        match (fed.registrar, now_registrar) {
+            (None, Some(_)) => script.fire_event("GUILD_REGISTRAR_SHOW", vec![]),
+            (Some(_), None) => script.fire_event("GUILD_REGISTRAR_CLOSED", vec![]),
+            _ => {}
+        }
+    }
+    fed.registrar = now_registrar;
+
+    // ── The petition window's edges, **behind the deferral**.
+    //
+    // `ready` is the client's two conditions: the record has arrived, and no signer name is still
+    // resolving. A charter that is open but not ready is invisible to every arm below — which is
+    // exactly the point, and is why an unresolved name cannot reach the screen.
+    let ready = record.is_some() && signers.iter().all(Option::is_some);
+    let now_charter = open.as_ref().map(|o| o.item).filter(|_| ready);
+    match (fed.shown_charter, now_charter) {
+        (Some(a), Some(b)) if a != b => {
+            // A charter arriving while another is shown — somebody offering us theirs while ours is
+            // up. Close then open, then eat the close `OnHide` queued: without that last line the
+            // drain clears the session this branch just opened, AND puts a `MSG_PETITION_DECLINE`
+            // on the wire for a charter we did not decline.
+            script.fire_event("PETITION_CLOSED", vec![]);
+            script.fire_event("PETITION_SHOW", vec![]);
+            let _ = script.drop_petition_close_intents();
+        }
+        // The deferral's own edge: the record landed, or the last name resolved. Fires ONCE.
+        (None, Some(_)) => script.fire_event("PETITION_SHOW", vec![]),
+        (Some(_), None) => script.fire_event("PETITION_CLOSED", vec![]),
+        // A rename echo, or a name resolving after the window was already up.
+        (Some(_), Some(_)) if fed.shown != record || fed.shown_signers != signers => {
+            script.fire_event("PETITION_SHOW", vec![])
+        }
+        _ => {}
+    }
+    fed.shown_charter = now_charter;
+    fed.shown = record;
+    fed.shown_signers = signers;
+}
+
+/// Turn the Era API's charter intents into their sends.
+///
+/// Most need the app because Lua has no way to name what they act on: buying needs the latched
+/// registrar's NPC, turning in needs the charter *in the bags*, offering needs the current target,
+/// and the item verbs need the open charter's item guid.
+///
+/// **`ClosePetition` is not local-only, and that was this file's sharpest correction.** `0x4f3f60`'s
+/// decline leg puts `MSG_PETITION_DECLINE` on the wire whenever a petition was open, no sign is in
+/// flight, a record is cached, and we are **not** its owner. Closing somebody else's charter tells
+/// them so. `CloseGuildRegistrar`, by contrast, really does send nothing — verified by a closure
+/// walk that found no `CDataStore` build on its whole path.
+#[allow(clippy::too_many_arguments)]
+pub(super) fn drain_petition(
+    script: Option<NonSendMut<UiScript>>,
+    mut registrar: ResMut<GuildRegistrarState>,
+    mut petition: ResMut<PetitionState>,
+    mut names: ResMut<NameCache>,
+    items: Res<Items>,
+    self_q: Query<&ObjectStore, With<SelfPlayer>>,
+    self_guid: Res<SelfGuid>,
+    selection: Res<crate::target::Selection>,
+    commands: Res<NetCommands>,
+) {
+    let Some(mut script) = script else {
+        return;
+    };
+    let requests = script.take_petition_requests();
+    if requests.is_empty() {
+        return;
+    }
+    let me = self_guid.0.unwrap_or(0);
+    for request in requests {
+        match request {
+            PetitionRequest::Buy(name) => {
+                // The NPC is the petition module's own latched registrar (`[0xbdceb0]`), never the
+                // current target and never `CGGameUI`'s interaction pair — the send site's only
+                // caller passes that cell by address.
+                let Some(npc) = registrar.npc() else {
+                    debug!("ui_petition: BuyGuildCharter with no registrar open — dropped");
+                    continue;
+                };
+                let _ = commands.0.send(ClientCommand::PetitionBuy { npc, name });
+            }
+            PetitionRequest::TurnIn => {
+                // A **bag scan**, verified: `0x5ef2b0` walks the sixteen backpack slots then the
+                // four bags on every call and latches nothing. Ours is the same walk through the
+                // reference's own inventory search; `max_count = 1` means there is at most one.
+                let charter = self_q.iter().next().and_then(|store| {
+                    find_item(
+                        &store.0,
+                        &items,
+                        benilla_protocol::messages::CHARTER_ITEM_ENTRY,
+                        ItemSearch::default(),
+                    )
+                });
+                match charter {
+                    Some((_, _, item)) => {
+                        let _ = commands.0.send(ClientCommand::TurnInPetition { item });
+                    }
+                    // Nothing to address the send with, so none is built — and the refusal is a
+                    // RED line, not a chat one (`0x5ef49a` emits id `0x7c`, kind 2).
+                    None => petition.lines.push(lines::no_charter_line()),
+                }
+            }
+            // Verified send-free.
+            PetitionRequest::CloseRegistrar => registrar.close(),
+            PetitionRequest::ClosePetition => {
+                petition.decline_on_close(me, &commands);
+                petition.close();
+            }
+            PetitionRequest::Sign(byte) => {
+                let Some(item) = petition.open_item() else {
+                    continue;
+                };
+                let _ = commands.0.send(ClientCommand::PetitionSign { item, byte });
+                // The in-flight latch, whose one reader is the decline leg above: a close while our
+                // own signature is outstanding must not read as a decline.
+                petition.signing = true;
+            }
+            PetitionRequest::Offer => {
+                let Some(item) = petition.open_item() else {
+                    continue; // guard 1 — silent
+                };
+                // `OfferPetition()` carries no argument, and the guid it needs is `CGGameUI`'s
+                // **selection** pair — the current target — not the interaction pair the registrar
+                // latches. With no target the reference is silent too (guard 2).
+                let Some(player) = selection.guid else {
+                    debug!("ui_petition: OfferPetition with no target — dropped");
+                    continue;
+                };
+                if player == me {
+                    // Guard 6, and the only one of the eight that is both reachable here and has a
+                    // message. Guards 3/4/5/7 (unit resolution, is-a-player, faction) are the
+                    // server's to enforce and are not built; guard 8 (target already guilded) needs
+                    // the target's descriptor and is likewise left to the refusal.
+                    petition.lines.push(lines::self_offer_line());
+                    continue;
+                }
+                let _ = commands
+                    .0
+                    .send(ClientCommand::OfferPetition { item, player });
+                // Emitted **optimistically on the send**, with no server confirmation — the target
+                // is the one the server answers, so this echo is the offerer's only feedback.
+                let name = names
+                    .resolve(player, &commands)
+                    .unwrap_or_default()
+                    .to_string();
+                petition.lines.push(lines::offered_line(&name));
+            }
+            PetitionRequest::Rename(name) => {
+                let Some(item) = petition.open_item() else {
+                    continue;
+                };
+                let _ = commands
+                    .0
+                    .send(ClientCommand::PetitionRename { item, name });
+            }
+            // The client's own name validator refused it; no packet was ever built.
+            PetitionRequest::NameRefused(key) => {
+                petition.lines.push(lines::name_refused_line(key));
+            }
+        }
+    }
+}
diff --git a/crates/benilla-app/src/ui_petition/lines.rs b/crates/benilla-app/src/ui_petition/lines.rs
new file mode 100644
index 00000000..a9b3a4ff
--- /dev/null
+++ b/crates/benilla-app/src/ui_petition/lines.rs
@@ -0,0 +1,310 @@
+//! The charter session's **system lines** — the messages the engine composes, and *which of the
+//! client's two message channels each one goes to*.
+//!
+//! The split is the part a re-implementation cannot guess, and we did guess it wrong first: by the
+//! key names, `ERR_PETITION_SIGNED_S` and `ERR_PETITION_ALREADY_SIGNED` look like the same kind of
+//! thing. They are not. wow-re
+//! `system/object-layer/scratch/petition-wire-law.md` §4 read the message catalog at `0xb4b498`
+//! (stride `0x14`, field `+4` = kind, routed through the four-entry table at `0x496888`) and swept
+//! every row:
+//!
+//! - the **four** `_S`/success ids `0x141`-`0x144` carry kind `0` → the shared chat chokepoint
+//!   `0x49a870` with the row's own `+0x10` chat type, which is `0xa` → **`CHAT_MSG_SYSTEM`**, the
+//!   same channel every `ERR_GUILD_*` line uses;
+//! - the **five** refusals `0x145`-`0x149`, and `ERR_NO_GUILD_CHARTER` (`0x7c`), carry kind `2` →
+//!   `UI_ERROR_MESSAGE` (`0xe0`), the **red UIErrorsFrame line**.
+//!
+//! Two more facts from the same sweep that shape the tables below:
+//!
+//! - **`PETITION_SIGN_NEED_MORE` (4) has no user-visible message on the SIGN path at all.** It
+//!   falls into the default arm with `>= 6` and reaches only the debug console
+//!   (`0x63cb50("Petition error")`). It *does* have one on the turn-in path. Same code, two
+//!   packets, two behaviours.
+//! - **A successful turn-in emits no text whatsoever** (`0x5ef166`). It fires
+//!   `GUILD_REGISTRAR_CLOSED` and says nothing. This file first shipped an `ERR_GUILD_FOUNDER_S`
+//!   line there, reasoned from the fact that vmangos never sends the guild-command result that
+//!   would produce one; the binary settles it — founding a guild really is silent, and the player
+//!   learns of it from the guild pane lighting up.
+//!
+//! Every one of these rows also carries a named sound cue (`+0xc = 0x44`): `0x142`/`0x143` play
+//! `igPlayerInviteAccept` and `0x144`-`0x149` play `igPlayerInviteDecline`, while `0x141` has none.
+//! Recorded here; wiring the cue is [`super`]'s job, not this module's.
+
+use benilla_protocol::messages::petition_result;
+
+// ── The templates, quoted verbatim from the reference's own patch chain; the `GlobalStrings.lua`
+//    line is on each ──────────────────────────────────────────────────────────────────────────
+const ERR_PETITION_ALREADY_SIGNED: &str = "You have already signed that guild charter."; // :1762
+const ERR_PETITION_CREATOR: &str = "You can't sign your own guild charter."; // :1763
+const ERR_PETITION_DECLINED_S: &str = "%s has declined your guild invitation."; // :1764
+const ERR_PETITION_IN_GUILD: &str = "You are already in a guild."; // :1765
+const ERR_PETITION_NOT_ENOUGH_SIGNATURES: &str = "You need more signatures."; // :1766
+const ERR_PETITION_NOT_SAME_SERVER: &str = "That player is not from your server"; // :1767
+const ERR_PETITION_OFFERED_S: &str = "You have requested %s's signature."; // :1768
+const ERR_PETITION_SIGNED: &str = "Guild charter signed."; // :1769
+const ERR_PETITION_SIGNED_S: &str = "%s has signed your guild charter."; // :1770
+const ERR_NO_GUILD_CHARTER: &str = "You don't have a guild charter."; // :1745
+
+// The guild-name validator's messages (`0x4f5160`'s seven arms). Only the three
+// `benilla_ui::script::validate_guild_name` implements can be produced; the rest are here so the
+// key→text map is complete and a later carve of `0x6c9b70` only has to add the branch.
+const ERR_GUILD_ENTER_NAME: &str = "Enter a name for your guild."; // :1603
+const ERR_GUILD_NAME_INVALID: &str = "That name contains invalid characters,  Enter a new name."; // :1616
+const ERR_GUILD_NAME_INVALID_SPACE: &str =
+    "Guild names cannot start or end with a space.  Enter a new name."; // :1617
+const ERR_GUILD_NAME_NAME_CONSECUTIVE_SPACES: &str =
+    "Consecutive spaces are not allowed.  Enter a new name."; // :1619
+const ERR_GUILD_NAME_TOO_SHORT: &str = "That name is too short.  Enter a new name."; // :1622
+
+/// Which of the client's two channels a line goes to — the `+4 kind` field, as a type.
+///
+/// Modelled rather than left implicit because the split does not follow the key names, and a
+/// `String` return would let a future edit put a refusal in the chat log without anything noticing.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub(super) enum Line {
+    /// Kind `0` → the `CHAT_MSG_SYSTEM` chat line.
+    Chat(String),
+    /// Kind `2` → the red `UI_ERROR_MESSAGE` frame.
+    Error(String),
+}
+
+/// One `%s` substitution.
+fn fill(template: &str, arg: &str) -> String {
+    template.replacen("%s", arg, 1)
+}
+
+/// The line one `SMSG_PETITION_SIGN_RESULTS` prints **when the signer is us** — the switch at
+/// `0x5eeff5`'s "I signed" leg.
+///
+/// The owner's copy of the same packet is a different path entirely: it appends the signer and
+/// emits `ERR_PETITION_SIGNED_S`, and never inspects the result at all ([`signed_by_other`]).
+///
+/// `NEED_MORE` and anything `>= 6` return `None` — the default arm reaches only the debug console.
+pub(super) fn my_sign_line(result: u32) -> Option<Line> {
+    Some(match result {
+        petition_result::OK => Line::Chat(ERR_PETITION_SIGNED.to_string()),
+        petition_result::ALREADY_SIGNED => Line::Error(ERR_PETITION_ALREADY_SIGNED.to_string()),
+        petition_result::ALREADY_IN_GUILD => Line::Error(ERR_PETITION_IN_GUILD.to_string()),
+        petition_result::CANT_SIGN_OWN => Line::Error(ERR_PETITION_CREATOR.to_string()),
+        petition_result::NOT_SERVER => Line::Error(ERR_PETITION_NOT_SAME_SERVER.to_string()),
+        // `NEED_MORE` (4) and >= 6: the default arm, debug console only.
+        _ => return None,
+    })
+}
+
+/// The line the **owner** gets when somebody else signs — `ERR_PETITION_SIGNED_S`, a chat line, and
+/// emitted **only when the signer's name is already cached** (`0x4f42f6`); on a cache miss the
+/// client increments its pending-name counter instead and says nothing until the name lands.
+pub(super) fn signed_by_other(name: &str) -> Line {
+    Line::Chat(fill(ERR_PETITION_SIGNED_S, name))
+}
+
+/// The line one `SMSG_TURN_IN_PETITION_RESULTS` prints. **Success prints nothing** — see the module
+/// doc; it is not an omission here.
+pub(super) fn turn_in_line(result: u32) -> Option<Line> {
+    Some(match result {
+        petition_result::ALREADY_IN_GUILD => Line::Error(ERR_PETITION_IN_GUILD.to_string()),
+        petition_result::NEED_MORE => Line::Error(ERR_PETITION_NOT_ENOUGH_SIGNATURES.to_string()),
+        _ => return None,
+    })
+}
+
+/// The line an inbound `MSG_PETITION_DECLINE` prints to the charter's owner — a chat line, and
+/// **only if the declining player's name is already cached**. There is no query and no retry: an
+/// uncached name means the owner is told nothing at all (`0x5ef12a`/`0x5ef139`).
+pub(super) fn declined_line(name: &str) -> Line {
+    Line::Chat(fill(ERR_PETITION_DECLINED_S, name))
+}
+
+/// The local echo for a charter we just offered — emitted **optimistically on the send**, with no
+/// server confirmation (`0x4f48fa`). Nothing comes back on success; the *target* is the one the
+/// server answers.
+pub(super) fn offered_line(name: &str) -> Line {
+    Line::Chat(fill(ERR_PETITION_OFFERED_S, name))
+}
+
+/// Offering a charter to yourself — guard 6 of `OfferPetition`'s eight (`0x4f4839`), which emits
+/// `ERR_PETITION_CREATOR`, the same red line signing your own charter gets.
+pub(super) fn self_offer_line() -> Line {
+    Line::Error(ERR_PETITION_CREATOR.to_string())
+}
+
+/// The local refusal when `TurnInGuildCharter()`'s bag scan finds no charter — a **red** line
+/// (`0x5ef49a` emits id `0x7c`, kind 2), and no packet is built.
+pub(super) fn no_charter_line() -> Line {
+    Line::Error(ERR_NO_GUILD_CHARTER.to_string())
+}
+
+/// The line for a name the client's own validator refused
+/// ([`benilla_ui::script::validate_guild_name`]) — a red line, by the class every other
+/// `ERR_GUILD_NAME_*` row in the catalog belongs to.
+///
+/// **The kind of these five rows is INFERRED**, unlike the nine petition rows above: that round
+/// swept the petition ids and `0x7c`, not the `0x75`-`0x7b` band. They are refusals, and every
+/// refusal in the swept set is kind 2. An unknown key falls back to the generic invalid-name text
+/// rather than showing a raw key.
+pub(super) fn name_refused_line(key: &str) -> Line {
+    Line::Error(
+        match key {
+            "ERR_GUILD_ENTER_NAME" => ERR_GUILD_ENTER_NAME,
+            "ERR_GUILD_NAME_INVALID_SPACE" => ERR_GUILD_NAME_INVALID_SPACE,
+            "ERR_GUILD_NAME_NAME_CONSECUTIVE_SPACES" => ERR_GUILD_NAME_NAME_CONSECUTIVE_SPACES,
+            "ERR_GUILD_NAME_TOO_SHORT" => ERR_GUILD_NAME_TOO_SHORT,
+            _ => ERR_GUILD_NAME_INVALID,
+        }
+        .to_string(),
+    )
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    /// **The channel split, which does not follow the key names.** Success to chat, refusal to the
+    /// red frame — swept out of the message catalog, not guessed. This test is the one that would
+    /// fail if somebody "tidied" the two into a single `String` return.
+    #[test]
+    fn successes_go_to_chat_and_refusals_go_to_the_red_line() {
+        assert_eq!(
+            my_sign_line(petition_result::OK),
+            Some(Line::Chat("Guild charter signed.".into()))
+        );
+        assert_eq!(
+            signed_by_other("Bob"),
+            Line::Chat("Bob has signed your guild charter.".into())
+        );
+        assert_eq!(
+            declined_line("Bob"),
+            Line::Chat("Bob has declined your guild invitation.".into())
+        );
+        assert_eq!(
+            offered_line("Bob"),
+            Line::Chat("You have requested Bob's signature.".into())
+        );
+
+        for (code, text) in [
+            (
+                petition_result::ALREADY_SIGNED,
+                "You have already signed that guild charter.",
+            ),
+            (
+                petition_result::ALREADY_IN_GUILD,
+                "You are already in a guild.",
+            ),
+            (
+                petition_result::CANT_SIGN_OWN,
+                "You can't sign your own guild charter.",
+            ),
+            (
+                petition_result::NOT_SERVER,
+                "That player is not from your server",
+            ),
+        ] {
+            assert_eq!(
+                my_sign_line(code),
+                Some(Line::Error(text.into())),
+                "code {code} is a RED line"
+            );
+        }
+        assert_eq!(
+            no_charter_line(),
+            Line::Error("You don't have a guild charter.".into())
+        );
+    }
+
+    /// **`NEED_MORE` is silent on the sign path and loud on the turn-in path** — one result code,
+    /// two packets, two behaviours. Reading the enum and giving both packets the same table is the
+    /// mistake this pins, and it is the shape the first version of this file had.
+    #[test]
+    fn need_more_is_silent_when_signing_and_loud_when_turning_in() {
+        assert_eq!(
+            my_sign_line(petition_result::NEED_MORE),
+            None,
+            "the sign switch's default arm reaches only the debug console"
+        );
+        assert_eq!(
+            turn_in_line(petition_result::NEED_MORE),
+            Some(Line::Error("You need more signatures.".into()))
+        );
+    }
+
+    /// A successful turn-in says **nothing**. The window closing is the whole of the feedback.
+    #[test]
+    fn a_successful_turn_in_prints_no_line_at_all() {
+        assert_eq!(turn_in_line(petition_result::OK), None);
+        // …and the codes the turn-in packet cannot carry stay silent rather than borrowing the
+        // sign path's wording.
+        assert_eq!(turn_in_line(petition_result::CANT_SIGN_OWN), None);
+        assert_eq!(turn_in_line(petition_result::ALREADY_SIGNED), None);
+    }
+
+    /// **Every string in this file, checked against the shipped `GlobalStrings.lua`.**
+    ///
+    /// Three of the five validator lines shipped here as *paraphrases* — "Names may not begin or
+    /// end with a space." where the real client says "Guild names cannot start or end with a
+    /// space.  Enter a new name." — because they were written from the key name instead of copied.
+    /// Nothing else could catch that: the text is never compared to anything at runtime, so a
+    /// paraphrase renders, reads plausibly, and is simply not what the game says. This test is the
+    /// oracle, and it is `ui_items::equip_error`'s, applied one table over.
+    #[test]
+    fn every_line_matches_the_real_global_strings() {
+        let data = benilla_formats::wow_data_or_skip!();
+        let mut chain = benilla_formats::open_chain(&data).expect("open chain");
+        let src = chain
+            .read_file("Interface\\FrameXML\\GlobalStrings.lua")
+            .expect("GlobalStrings.lua in the chain");
+        let s = benilla_ui::script::UiScript::new().expect("VM");
+        s.run(&String::from_utf8_lossy(&src)).expect("runs clean");
+        let g = |key: &str| {
+            s.lua()
+                .globals()
+                .get::<String>(key)
+                .unwrap_or_else(|e| panic!("{key} missing from GlobalStrings: {e}"))
+        };
+
+        for (key, ours) in [
+            ("ERR_PETITION_ALREADY_SIGNED", ERR_PETITION_ALREADY_SIGNED),
+            ("ERR_PETITION_CREATOR", ERR_PETITION_CREATOR),
+            ("ERR_PETITION_DECLINED_S", ERR_PETITION_DECLINED_S),
+            ("ERR_PETITION_IN_GUILD", ERR_PETITION_IN_GUILD),
+            (
+                "ERR_PETITION_NOT_ENOUGH_SIGNATURES",
+                ERR_PETITION_NOT_ENOUGH_SIGNATURES,
+            ),
+            ("ERR_PETITION_NOT_SAME_SERVER", ERR_PETITION_NOT_SAME_SERVER),
+            ("ERR_PETITION_OFFERED_S", ERR_PETITION_OFFERED_S),
+            ("ERR_PETITION_SIGNED", ERR_PETITION_SIGNED),
+            ("ERR_PETITION_SIGNED_S", ERR_PETITION_SIGNED_S),
+            ("ERR_NO_GUILD_CHARTER", ERR_NO_GUILD_CHARTER),
+            ("ERR_GUILD_ENTER_NAME", ERR_GUILD_ENTER_NAME),
+            ("ERR_GUILD_NAME_INVALID", ERR_GUILD_NAME_INVALID),
+            ("ERR_GUILD_NAME_INVALID_SPACE", ERR_GUILD_NAME_INVALID_SPACE),
+            (
+                "ERR_GUILD_NAME_NAME_CONSECUTIVE_SPACES",
+                ERR_GUILD_NAME_NAME_CONSECUTIVE_SPACES,
+            ),
+            ("ERR_GUILD_NAME_TOO_SHORT", ERR_GUILD_NAME_TOO_SHORT),
+        ] {
+            assert_eq!(g(key), ours, "{key} is not what the client says");
+        }
+    }
+
+    /// The validator's keys resolve to their own text, and an unknown key degrades to the generic
+    /// invalid-name line rather than surfacing a raw key to the player.
+    #[test]
+    fn refused_names_resolve_their_key_and_degrade_safely() {
+        assert_eq!(
+            name_refused_line("ERR_GUILD_ENTER_NAME"),
+            Line::Error("Enter a name for your guild.".into())
+        );
+        assert_eq!(
+            name_refused_line("ERR_GUILD_NAME_INVALID_SPACE"),
+            Line::Error("Guild names cannot start or end with a space.  Enter a new name.".into())
+        );
+        assert_eq!(
+            name_refused_line("ERR_SOMETHING_UNCARVED"),
+            Line::Error("That name contains invalid characters,  Enter a new name.".into()),
+            "never a raw key on screen"
+        );
+    }
+}
diff --git a/crates/benilla-app/src/ui_petition/mod.rs b/crates/benilla-app/src/ui_petition/mod.rs
new file mode 100644
index 00000000..093c0db0
--- /dev/null
+++ b/crates/benilla-app/src/ui_petition/mod.rs
@@ -0,0 +1,683 @@
+//! The guild-charter session — the registrar window, the petition window, and the verbs that found
+//! a guild (decision 1672).
+//!
+//! [`crate::ui_guild`] is *being* in a guild; this is *making* one, the slice 1257 §2 deliberately
+//! left out and named as the next. It mirrors the wire the way that module does: the seven server
+//! packets replace or patch [`PetitionState`] / [`GuildRegistrarState`], and [`feed`] turns them
+//! into the display-ready snapshot `benilla_ui::script::petition` reads.
+//!
+//! **Two windows, two sessions, and only one of them is an NPC session.**
+//!
+//! - [`GuildRegistrarState`] is the NPC half: it opens on `SMSG_PETITION_SHOWLIST` (which the
+//!   server pushes when the "How do I form a guild?" gossip row is selected — vmangos
+//!   `Player.cpp:12428-12431` closes the gossip menu and calls `SendPetitionShowList`), it knows a
+//!   price and an NPC guid, and it closes when the player walks away like every other NPC window
+//!   ([`crate::ui_session`]). wow-re corroborates the shape rather than merely permitting it: the
+//!   function that fires `GUILD_REGISTRAR_SHOW` (`0x4f4fb0`, firing at `0x4f4fff`) is one of the
+//!   fourteen callers of `CGGameUI::SetInteractNPC 0x4930d0`
+//!   (`system/object-layer/scratch/interaction-facing.md:177-178`), which is the *same* latch every
+//!   other NPC window arms.
+//! - [`PetitionState`] is the item half: it opens on `SMSG_PETITION_SHOW_SIGNATURES`, is bound to a
+//!   charter **item guid**, and has no NPC at all. Walking away from the registrar must not close
+//!   it, which is why the two are separate resources rather than one with a half-meaning `close()`.
+//!
+//! They meet at exactly one place: `TurnInGuildCharter()` is a *registrar* button that acts on a
+//! charter in the *bags*, found by [`crate::ui_items::find_item`].
+//!
+//! **The gossip handoff needs no special case, and that is worth saying because the banker's did**
+//! (decision 0607). vmangos's `GOSSIP_OPTION_PETITIONER` arm calls `PlayerTalkClass->CloseGossip()`
+//! *before* `SendPetitionShowList` (`Player.cpp:12428-12431`), and `CloseGossip` really does send
+//! `SMSG_GOSSIP_COMPLETE` (`GossipDef.cpp:231-236`) — so the menu closes itself, and the registrar
+//! takes the left panel slot the gossip window has already released. The bank needed
+//! `npc::show_bank` to force that close precisely because its option sends no such packet; this one
+//! must NOT, or the close would be done twice.
+//!
+//! **The laws that are not what the obvious design would do:**
+//!
+//! - **The window opens before it knows what it is showing.**
+//!   `SMSG_PETITION_SHOW_SIGNATURES` carries an item guid, an owner guid, a petition id and a list
+//!   of signer guids — and no text whatsoever. The proposed guild's name and the signature
+//!   requirement come only from `SMSG_PETITION_QUERY_RESPONSE`, keyed by petition id, and the
+//!   names come from [`crate::names::NameCache`]. So the petition window's first paint is
+//!   deliberately partial and repaints as each lookup lands. This is the identical two-caches shape
+//!   `SMSG_GUILD_ROSTER` has with `SMSG_GUILD_QUERY_RESPONSE` ([`crate::ui_guild`]'s own module
+//!   doc), and the cache is lazy for the same reason: nothing queries a petition we are not looking
+//!   at.
+//! - **One inbound packet, two meanings.** `SMSG_PETITION_SHOW_SIGNATURES` answers our own
+//!   `CMSG_PETITION_SHOW_SIGNATURES` *and* is what arrives when somebody offers us their charter
+//!   (`Handlers/PetitionsHandler.cpp:390-397`). Nothing distinguishes them but whether `owner` is
+//!   us — so there is no "an offer arrived" path separate from "a charter opened", and building one
+//!   would be inventing a distinction the wire does not make.
+//! - **A signature does not push a new list.** vmangos answers a successful sign with
+//!   `SMSG_PETITION_SIGN_RESULTS` to both parties and **no fresh signatures packet**
+//!   (`:299`, `:312-316`), while the reference's `PetitionFrame` registers only `PETITION_SHOW` and
+//!   `PETITION_CLOSED`. Nothing would ever repaint the name rows. So an `OK` result naming the open
+//!   charter re-sends `CMSG_PETITION_SHOW_SIGNATURES` ([`apply::sign_results`]) — INFERRED, and
+//!   flagged as such below.
+//! - **Two success paths are silent on the wire and speak locally.** Offering a charter answers the
+//!   *target*, not us, and finding no charter to turn in is refused before any packet is built —
+//!   so `ERR_PETITION_OFFERED_S` and `ERR_NO_GUILD_CHARTER` are composed here. Both strings exist
+//!   in `GlobalStrings.lua` and nothing on the wire can produce either, which is the same test
+//!   [`crate::ui_guild::lines`] uses to identify an engine-composed line.
+//!
+//! ## What is INFERRED, and what would settle it
+//!
+//! wow-re had **not carved a single one of this subsystem's contracts** when this landed — it holds
+//! the eight binding addresses (`system/ui/scratch/bindings.md:455-462`, all classified
+//! ORCHESTRATION: located, contract never derived) and the four event ids
+//! (`guild-api-carve.md:603-624`), and nothing about the wire or the handlers. Every claim below is
+//! read off the *demand* side (the shipped `PetitionFrame.lua` / `GuildRegistrarFrame.lua`) plus
+//! vmangos, and is named here so none of it is mistaken for byte law:
+//!
+//! 1. **`SMSG_PETITION_SHOWLIST` → `GUILD_REGISTRAR_SHOW`** (no args). The firer `0x4f4fb0` sits in
+//!    the petition band with `0x5eeb80` as its sole caller; the byte read of that handler settles
+//!    it.
+//! 2. **`SMSG_PETITION_SHOW_SIGNATURES` → `PETITION_SHOW`** (no args), everything painted from
+//!    getters. The reference's own OnEvent uses no `arg1`, which makes this weak-but-consistent.
+//! 3. **`ClosePetition()` / `CloseGuildRegistrar()` send nothing.** Chosen because inventing
+//!    traffic 1.12 never sends is the worse failure, and because wow-re already recorded exactly
+//!    that verdict for the neighbouring `CloseGuildRoster` (`xor eax,eax; ret`).
+//! 4. **Re-requesting the signature list on an `OK` sign result** (above).
+//! 5. **`ERR_GUILD_FOUNDER_S` on a successful turn-in.** vmangos declares `GUILD_FOUNDER_S = 0x0E`
+//!    and **never sends it** — `Guild::Create` broadcasts no event at all on the founding path
+//!    (`Guild/Guild.cpp:104-119`), so without a local line, founding a guild is completely silent.
+//!    The string is routed through [`crate::ui_guild::lines`]'s existing constant so there is one
+//!    copy; a server that *does* send the command result would double the line, which is visible
+//!    and cheap to undo.
+//! 6. **Using a charter item opens it** — see [`crate::ui_items::ItemUseRoute::ShowPetition`],
+//!    where the evidence and its limits are written down.
+
+use std::collections::{HashMap, HashSet};
+
+use benilla_protocol::messages::{
+    petition_result, PetitionQueryResponse, PetitionRename, PetitionShowList,
+    PetitionShowSignatures, PetitionSignResults,
+};
+use bevy::prelude::*;
+
+use crate::names::NameCache;
+use crate::net::{ClientCommand, NetCommands};
+use crate::ui_script::UiInput;
+use crate::ui_session::NpcSession;
+
+mod feed;
+mod lines;
+
+/// The open guild registrar — an NPC window, and nothing more than a price.
+///
+/// Deliberately separate from [`PetitionState`]: only this half is bound to an NPC, so only this
+/// half may be closed by the walk-away guard. A single resource implementing [`NpcSession`] would
+/// have a `close()` that closed half of itself, which is the kind of thing that reads as correct
+/// for a year.
+#[derive(Resource, Default)]
+pub(crate) struct GuildRegistrarState {
+    open: Option<Registrar>,
+}
+
+/// What one open registrar knows.
+#[derive(Clone, Debug)]
+struct Registrar {
+    /// The NPC — what `BuyGuildCharter` addresses (the petition module's own latched guid
+    /// `[0xbdceb0]`, *not* `CGGameUI`'s interaction pair), and what the range guard watches.
+    npc: u64,
+    /// The charter's price in copper. **Unsigned**, because the binding pushes it through the
+    /// zero-extending `fild QWORD` idiom.
+    cost: u32,
+}
+
+/// The two `UNIT_NPC_FLAGS` bits the client requires on a showlist's NPC before it will open the
+/// registrar — bit 9 **and** bit 10, `PETITIONER | TABARDDESIGNER`
+/// (`0x5eec33`/`0x5eec3b`, two separate `test`/`je` pairs).
+///
+/// vmangos gates its *send* on `PETITIONER` alone, so the two disagree — but not observably on this
+/// world's data: all six petitioner templates carry both bits, and the eight tabard-only ones never
+/// send a showlist at all. Implemented anyway, because it is three lines and a silent-drop gate is
+/// exactly the kind of thing that matters the day the data changes.
+const REGISTRAR_NPC_FLAGS: u32 = crate::target::cursor_mode::npc_flags::PETITIONER
+    | crate::target::cursor_mode::npc_flags::TABARDDESIGNER;
+
+impl GuildRegistrarState {
+    /// `SMSG_PETITION_SHOWLIST` — open (or re-open) the registrar, **if it passes all three gates**.
+    ///
+    /// `npc_flags` is the NPC's live `UNIT_NPC_FLAGS`, or `None` when the guid does not resolve to a
+    /// streamed unit — which fails the gate, as the client's own `0x5eec1a` resolve does.
+    ///
+    /// The three gates, from `system/object-layer/scratch/petition-wire-law.md` §2:
+    /// 1. the NPC resolves as a unit and carries [`REGISTRAR_NPC_FLAGS`];
+    /// 2. **entry\[0\]**'s `entryFlags & 1` is set (`0x5eec42`, and it is entry\[0\]'s fifth dword
+    ///    specifically — no other entry's flags are tested anywhere on this path);
+    /// 3. there is an entry\[0\] at all.
+    ///
+    /// **Entry\[0\] and no other.** The handler parses every entry the count declares — a
+    /// re-implementation must too, to stay in sync with the stream — but a whole-image census of the
+    /// ten-entry table found exactly four references, all inside the handler, and only entry\[0\] is
+    /// ever consumed. This file first took "the first row with the visible flag", which reads as the
+    /// same thing on a one-row packet and is a different rule.
+    ///
+    /// A packet that fails any gate is **parsed and silently dropped** — no window, no error line.
+    fn open(&mut self, list: &PetitionShowList, npc_flags: Option<u32>) -> bool {
+        if npc_flags.is_none_or(|f| f & REGISTRAR_NPC_FLAGS != REGISTRAR_NPC_FLAGS) {
+            debug!(
+                "ui_petition: showlist from {:#x} without both registrar npc flags — dropped",
+                list.npc
+            );
+            return false;
+        }
+        let Some(first) = list.entries.first().filter(|e| e.entry_flags & 1 != 0) else {
+            debug!("ui_petition: showlist entry[0] not flagged visible — dropped");
+            return false;
+        };
+        self.open = Some(Registrar {
+            npc: list.npc,
+            cost: first.charter_cost as u32,
+        });
+        true
+    }
+
+    /// The charter's price in copper, `0` when no registrar is open — `GetGuildCharterCost()`.
+    fn cost(&self) -> u32 {
+        self.open.as_ref().map_or(0, |r| r.cost)
+    }
+}
+
+impl NpcSession for GuildRegistrarState {
+    fn npc(&self) -> Option<u64> {
+        self.open.as_ref().map(|r| r.npc)
+    }
+
+    fn close(&mut self) {
+        self.open = None;
+    }
+}
+
+/// The open charter and the petition-record cache.
+#[derive(Resource, Default)]
+pub(crate) struct PetitionState {
+    open: Option<OpenCharter>,
+    /// The lazy record cache, keyed by petition id — the guild-identity cache's twin. Session
+    /// state: a petition id means nothing across a reconnect.
+    records: HashMap<u32, Record>,
+    /// Petition ids with a `CMSG_PETITION_QUERY` in flight, so the ask happens once per id per
+    /// connection ([`crate::names::NameCache`]'s rule).
+    querying: HashSet<u32>,
+    /// `[0xbdce1c]` — set while a sign we sent is outstanding, cleared when its result lands.
+    ///
+    /// It exists for one reader, and that reader is easy to miss: the decline leg of a close is
+    /// gated on it (`0x4f3f89`), so closing a window while your own signature is in flight must
+    /// **not** put `MSG_PETITION_DECLINE` on the wire.
+    signing: bool,
+    /// Lines composed at apply time, waiting for the feed — which is where the `script` handle
+    /// lives, and so the only place a red `UI_ERROR_MESSAGE` can be fired ([`crate::ui_bank`]'s
+    /// `BankErrors` shape).
+    lines: Vec<lines::Line>,
+}
+
+/// The charter the petition window is showing.
+#[derive(Clone, Debug)]
+struct OpenCharter {
+    /// The charter **item's** guid — the handle every verb in the family takes.
+    item: u64,
+    /// Its owner. Whether this is us decides which half of the window shows.
+    owner: u64,
+    /// The petition id — the key into [`PetitionState::records`].
+    petition_id: u32,
+    /// The signer guids, in wire order. Names are resolved at feed time and are deliberately not
+    /// stored: a name that lands later must change the display without any packet re-arriving.
+    signers: Vec<u64>,
+}
+
+/// One petition's record, from `SMSG_PETITION_QUERY_RESPONSE`.
+#[derive(Clone, Debug, Default)]
+struct Record {
+    /// The proposed guild's name.
+    name: String,
+    /// Free text — always empty on a 1.12 server.
+    body_text: String,
+    /// How many signatures it **requires** — the record's `+0x1118`, and a **signed** i32 because
+    /// the binding pushes it with `fild DWORD`. What the Request-Signature button disables against,
+    /// and what `CanSignPetition` compares the live count to (`0x4f4634`); distinct from the nine
+    /// name *rows*.
+    required: i32,
+    /// The record's `+0x1110` bit 0 — set for a guild charter, clear for a plain petition. It picks
+    /// `GetPetitionInfo`'s first return, and it **gates two of `CanSignPetition`'s refusals**, so a
+    /// non-charter petition is never refused for guild membership or for a full list.
+    is_charter: bool,
+}
+
+impl PetitionState {
+    /// `SMSG_PETITION_SHOW_SIGNATURES` — open the window on this charter, and fire the record
+    /// query if we have never seen this petition.
+    ///
+    /// Takes the command channel rather than holding one: the same seam
+    /// [`crate::ui_guild::GuildState::request_identity`] has, so the state stays plain data.
+    fn show(&mut self, sigs: PetitionShowSignatures, commands: &NetCommands) {
+        let petition_id = sigs.petition_id;
+        self.open = Some(OpenCharter {
+            item: sigs.item,
+            owner: sigs.owner,
+            petition_id,
+            signers: sigs.signatures.into_iter().map(|s| s.signer).collect(),
+        });
+        self.request_record(petition_id, sigs.item, commands);
+    }
+
+    /// The lazy record fill: ask once per petition id, and answer nothing for the call that missed.
+    /// The arrival simply lands in the cache; the feed's next rebuild picks it up (see
+    /// [`feed`]'s note on why there is no flag).
+    fn request_record(&mut self, petition_id: u32, item: u64, commands: &NetCommands) {
+        if self.records.contains_key(&petition_id) || !self.querying.insert(petition_id) {
+            return;
+        }
+        let _ = commands
+            .0
+            .send(ClientCommand::PetitionQuery { petition_id, item });
+    }
+
+    /// `SMSG_PETITION_QUERY_RESPONSE` — fill the cache.
+    fn apply_record(&mut self, response: PetitionQueryResponse) {
+        self.querying.remove(&response.petition_id);
+        self.records.insert(
+            response.petition_id,
+            Record {
+                name: response.name,
+                body_text: response.body_text,
+                required: response.min_signatures as i32,
+                is_charter: response.flags & 1 != 0,
+            },
+        );
+    }
+
+    /// Append one signer to the open charter — the owner's half of a successful sign
+    /// (`0x4f41c0`), and it is an **append, not a re-request**.
+    ///
+    /// The server sends no fresh signature list when somebody signs, and the reference's
+    /// `PetitionFrame` registers only `PETITION_SHOW`/`PETITION_CLOSED`. This file first re-sent
+    /// `CMSG_PETITION_SHOW_SIGNATURES` to make the rows repaint, which is a round trip the real
+    /// client does not make: it grows its own array and fires the event itself.
+    ///
+    /// Returns the signer's name when the cache already had it — the condition on emitting
+    /// `ERR_PETITION_SIGNED_S`. On a miss the name is left unresolved in the list and the feed's own
+    /// deferral holds the repaint until it lands, which is the same effect as the client's
+    /// pending-name counter.
+    ///
+    /// A result for a charter we do not have open is not ours to apply.
+    fn append_signer(
+        &mut self,
+        item: u64,
+        signer: u64,
+        names: &mut NameCache,
+        commands: &NetCommands,
+    ) -> Option<String> {
+        let open = self.open.as_mut().filter(|o| o.item == item)?;
+        if !open.signers.contains(&signer) {
+            open.signers.push(signer);
+        }
+        names.resolve(signer, commands).map(str::to_string)
+    }
+
+    /// The decline `ClosePetition()` can put on the wire — `0x4f3f60`'s leg at `0x4f3fb5`.
+    ///
+    /// **This is the half of `ClosePetition` that is not a local reset**, and it is guarded by four
+    /// conditions, every one of which matters:
+    ///
+    /// 1. a petition is open (`0x4f3f7c`) — otherwise there is nothing to decline;
+    /// 2. **no sign of ours is in flight** (`0x4f3f89`) — closing the window while your own
+    ///    signature is on the wire must not read as a refusal of the same charter;
+    /// 3. a record is cached (`0x4f3f95`) — without one the ownership test below cannot run;
+    /// 4. we are **not** the owner (`0x4f3fa5`/`0x4f3fae`) — you do not decline your own charter.
+    ///
+    /// The same leg runs when a *different* petition replaces the open one, which is why the feed's
+    /// switch arm consumes the close intent it causes: without that, being offered a second charter
+    /// would silently decline the first.
+    fn decline_on_close(&mut self, me: u64, commands: &NetCommands) {
+        let Some(open) = self.open.as_ref() else {
+            return;
+        };
+        if self.signing || !self.records.contains_key(&open.petition_id) || open.owner == me {
+            return;
+        }
+        let _ = commands
+            .0
+            .send(ClientCommand::PetitionDecline { item: open.item });
+    }
+
+    /// The window's client-side close — no packet (module doc, INFERRED #3).
+    fn close(&mut self) {
+        self.open = None;
+    }
+
+    /// The open charter's item guid — what `SignPetition` / `OfferPetition` / `RenamePetition`
+    /// address. `None` = nothing open, and the verb is dropped rather than sent against a guess.
+    fn open_item(&self) -> Option<u64> {
+        self.open.as_ref().map(|o| o.item)
+    }
+}
+
+/// The plugin: two resources, the walk-away guard on the registrar half, and the feed/drain pair.
+pub(crate) struct UiPetitionPlugin;
+
+impl Plugin for UiPetitionPlugin {
+    fn build(&self, app: &mut App) {
+        app.init_resource::<GuildRegistrarState>()
+            .init_resource::<PetitionState>()
+            .add_systems(
+                Update,
+                (
+                    // Ahead of the feed, so a walk-away turns into GUILD_REGISTRAR_CLOSED the same
+                    // frame — every other NPC window's ordering.
+                    crate::ui_session::close_npc_session_out_of_range::<GuildRegistrarState>
+                        .before(feed::feed_petition),
+                    feed::feed_petition.before(UiInput),
+                    feed::drain_petition.after(UiInput),
+                ),
+            );
+    }
+}
+
+/// The inbound arms — one per packet, each beside the state it drives.
+///
+/// **Nothing here fires an event or writes a chat line directly.** Composed lines go onto
+/// [`PetitionState::lines`] and the feed drains them, because the red `UI_ERROR_MESSAGE` channel
+/// needs the `script` handle and apply has none (`crate::ui_bank`'s `BankErrors` shape).
+pub(crate) mod apply {
+    use super::*;
+
+    /// `SMSG_PETITION_SHOWLIST` — the registrar's charter list, subject to its three gates.
+    ///
+    /// `npc_flags` is the NPC's live `UNIT_NPC_FLAGS`; the caller reads it because only the apply
+    /// pass holds the object store.
+    pub(crate) fn show_list(
+        registrar: &mut GuildRegistrarState,
+        list: PetitionShowList,
+        npc_flags: Option<u32>,
+    ) {
+        registrar.open(&list, npc_flags);
+    }
+
+    /// `SMSG_PETITION_SHOW_SIGNATURES` — a charter opened, ours or one offered to us.
+    ///
+    /// **An ignored owner suppresses the whole update** (`0x5eeefe`-`0x5eef0b`): no record fetch, no
+    /// signer list, no event, no error line. The player is simply never told. That gate is checked
+    /// by the caller, which holds the ignore list.
+    pub(crate) fn show_signatures(
+        petition: &mut PetitionState,
+        sigs: PetitionShowSignatures,
+        owner_ignored: bool,
+        commands: &NetCommands,
+    ) {
+        if owner_ignored {
+            debug!(
+                "ui_petition: charter from ignored owner {:#x} — whole update dropped",
+                sigs.owner
+            );
+            return;
+        }
+        petition.show(sigs, commands);
+    }
+
+    /// `SMSG_PETITION_QUERY_RESPONSE` — the record cache fill.
+    pub(crate) fn query_response(petition: &mut PetitionState, response: PetitionQueryResponse) {
+        petition.apply_record(response);
+    }
+
+    /// `SMSG_PETITION_SIGN_RESULTS` — and it is **two different code paths in one packet**.
+    ///
+    /// The server sends a byte-identical copy to the signer and to the charter's owner, and the
+    /// client tells them apart by comparing the packet's player guid against its own
+    /// (`0x5eefee`). What each does could hardly be less alike:
+    ///
+    /// - **somebody else signed**: the result is *never inspected*. The signer is **appended to the
+    ///   local list** (`0x4f41c0`) — no re-request, which is what this file first did — the count
+    ///   rises, and a cached name emits `ERR_PETITION_SIGNED_S` while an uncached one just raises
+    ///   the pending counter and stays quiet until it lands.
+    /// - **we signed**: the result is switched on for a line, the in-flight latch clears, and a
+    ///   success additionally **closes the window** (`0x5ef037` fires `PETITION_CLOSED`).
+    pub(crate) fn sign_results(
+        petition: &mut PetitionState,
+        names: &mut NameCache,
+        self_guid: u64,
+        results: PetitionSignResults,
+        commands: &NetCommands,
+    ) {
+        if results.player != self_guid {
+            let cached = petition.append_signer(results.item, results.player, names, commands);
+            if let Some(name) = cached {
+                petition.lines.push(lines::signed_by_other(&name));
+            }
+            return;
+        }
+        petition.signing = false;
+        if let Some(line) = lines::my_sign_line(results.result) {
+            petition.lines.push(line);
+        }
+        if results.result == petition_result::OK {
+            petition.close();
+        }
+    }
+
+    /// `SMSG_TURN_IN_PETITION_RESULTS` — the verdict on a turn-in.
+    ///
+    /// **Success says nothing and closes the REGISTRAR** (`0x5ef166` fires
+    /// `GUILD_REGISTRAR_CLOSED`), not the charter window — which the destroyed item closes on its
+    /// own. Only the two refusals print, and both are red.
+    pub(crate) fn turn_in_results(
+        petition: &mut PetitionState,
+        registrar: &mut GuildRegistrarState,
+        result: u32,
+    ) {
+        if result == petition_result::OK {
+            // The server has destroyed the charter, so the item-bound window has nothing left to
+            // point at either.
+            petition.close();
+            registrar.close();
+            return;
+        }
+        if let Some(line) = lines::turn_in_line(result) {
+            petition.lines.push(line);
+        }
+    }
+
+    /// `MSG_PETITION_DECLINE` inbound — somebody turned our charter down.
+    ///
+    /// **Only if their name is already cached** (`0x5ef12a`/`0x5ef139`). There is no query and no
+    /// retry: an uncached name means the owner is told nothing at all, ever. So this arm
+    /// deliberately does *not* take the command channel — it must not be able to ask.
+    pub(crate) fn declined(petition: &mut PetitionState, names: &NameCache, player: u64) {
+        if let Some(name) = names.peek(player) {
+            let line = lines::declined_line(name);
+            petition.lines.push(line);
+        }
+    }
+
+    /// `MSG_PETITION_RENAME` inbound — the echo of a rename that took.
+    ///
+    /// Patches the cached title **in place** (`0x5ef292` overwrites the record's inline `char[0x100]`
+    /// and fires `PETITION_SHOW`), rather than re-querying: the echo carries the new name.
+    pub(crate) fn renamed(petition: &mut PetitionState, rename: PetitionRename) {
+        let Some(id) = petition
+            .open
+            .as_ref()
+            .filter(|o| o.item == rename.item)
+            .map(|o| o.petition_id)
+        else {
+            return;
+        };
+        petition.records.entry(id).or_default().name = rename.name;
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use benilla_protocol::messages::{PetitionShowListEntry, PetitionSignature};
+    use crossbeam_channel::unbounded;
+
+    fn commands() -> (NetCommands, crossbeam_channel::Receiver<ClientCommand>) {
+        let (tx, rx) = unbounded();
+        (NetCommands(tx), rx)
+    }
+
+    fn show_list(npc: u64, rows: &[(i32, i32)]) -> PetitionShowList {
+        PetitionShowList {
+            npc,
+            entries: rows
+                .iter()
+                .enumerate()
+                .map(|(i, (cost, flags))| PetitionShowListEntry {
+                    index: i as u32 + 1,
+                    charter_entry: benilla_protocol::messages::CHARTER_ITEM_ENTRY,
+                    charter_display_id: benilla_protocol::messages::CHARTER_DISPLAY_ID,
+                    charter_cost: *cost,
+                    entry_flags: *flags,
+                })
+                .collect(),
+        }
+    }
+
+    /// The open charter's cached title — what the feed reads to fill `GetPetitionInfo`'s second
+    /// return, spelled once here rather than at three assertion sites.
+    fn open_title(p: &PetitionState) -> Option<&str> {
+        let open = p.open.as_ref()?;
+        p.records.get(&open.petition_id).map(|r| r.name.as_str())
+    }
+
+    fn signatures(item: u64, owner: u64, id: u32, signers: &[u64]) -> PetitionShowSignatures {
+        PetitionShowSignatures {
+            item,
+            owner,
+            petition_id: id,
+            signatures: signers
+                .iter()
+                .map(|s| PetitionSignature {
+                    signer: *s,
+                    unknown: 0,
+                })
+                .collect(),
+        }
+    }
+
+    /// **The registrar's three gates**, and the price is entry\[0\]'s — not the first *visible*
+    /// row's, which is what this file shipped first.
+    ///
+    /// The two readings agree on every packet vmangos sends (one row, flag set), which is exactly
+    /// why the wrong one survives: it takes a two-row fixture whose first row is hidden to tell
+    /// them apart, and the real client would drop that packet where a first-visible reading quotes
+    /// the second row's price.
+    #[test]
+    fn the_registrar_gates_on_entry_zero_and_on_both_npc_flags() {
+        let both = Some(REGISTRAR_NPC_FLAGS);
+
+        let mut r = GuildRegistrarState::default();
+        assert!(r.open(&show_list(0x2a1f, &[(1000, 1)]), both));
+        assert_eq!(r.cost(), 1000, "entry[0]'s price, in copper");
+        assert_eq!(r.npc(), Some(0x2a1f));
+
+        // Entry[0] hidden: the WHOLE packet is dropped. A "first visible row" reading would open
+        // the window here and quote 1000.
+        let mut r = GuildRegistrarState::default();
+        assert!(!r.open(&show_list(0x2a1f, &[(9999, 0), (1000, 1)]), both));
+        assert_eq!(r.npc(), None, "no window at all — entry[0] is not visible");
+
+        // Each NPC-flag gate alone is not enough; the client tests both, separately.
+        for flags in [
+            None,
+            Some(0),
+            Some(crate::target::cursor_mode::npc_flags::PETITIONER),
+            Some(crate::target::cursor_mode::npc_flags::TABARDDESIGNER),
+        ] {
+            let mut r = GuildRegistrarState::default();
+            assert!(
+                !r.open(&show_list(0x2a1f, &[(1000, 1)]), flags),
+                "flags {flags:?} must not open the registrar"
+            );
+        }
+    }
+
+    /// The registrar is an NPC session and the petition window is not: closing the first must not
+    /// touch the second. This is the whole reason they are two resources.
+    #[test]
+    fn walking_away_from_the_registrar_leaves_an_open_charter_alone() {
+        let (commands, _rx) = commands();
+        let mut registrar = GuildRegistrarState::default();
+        let mut petition = PetitionState::default();
+        registrar.open(&show_list(0x2a1f, &[(1000, 1)]), Some(REGISTRAR_NPC_FLAGS));
+        petition.show(signatures(0x99, 0xaa, 7, &[0xbb]), &commands);
+
+        registrar.close();
+        assert_eq!(registrar.npc(), None);
+        assert_eq!(
+            petition.open_item(),
+            Some(0x99),
+            "the charter window is item-bound and survives the walk-away"
+        );
+    }
+
+    /// The record query fires once per petition id and not again — the guild-identity cache's
+    /// ask-once rule, which is what stops a window that repaints every frame from hammering the
+    /// server.
+    #[test]
+    fn the_record_query_is_asked_once_per_petition() {
+        let (commands, rx) = commands();
+        let mut petition = PetitionState::default();
+        petition.show(signatures(0x99, 0xaa, 7, &[]), &commands);
+        petition.show(signatures(0x99, 0xaa, 7, &[0xbb]), &commands);
+        let sent: Vec<_> = rx.try_iter().collect();
+        assert_eq!(
+            sent.len(),
+            1,
+            "one query for two opens of the same petition"
+        );
+        assert!(matches!(
+            sent[0],
+            ClientCommand::PetitionQuery {
+                petition_id: 7,
+                item: 0x99
+            }
+        ));
+
+        // The answer landing does not re-arm the ask.
+        petition.apply_record(PetitionQueryResponse {
+            petition_id: 7,
+            name: "Legacy".into(),
+            min_signatures: 9,
+            ..Default::default()
+        });
+        petition.show(signatures(0x99, 0xaa, 7, &[0xbb, 0xcc]), &commands);
+        assert!(rx.try_iter().next().is_none(), "still no second query");
+        assert_eq!(open_title(&petition), Some("Legacy"));
+    }
+
+    /// A rename echo patches the cached record in place. Re-querying instead would be a round trip
+    /// for a value the echo already carries — and would leave the window showing the old name for
+    /// as long as it took.
+    #[test]
+    fn a_rename_echo_patches_the_cached_record() {
+        let (commands, _rx) = commands();
+        let mut petition = PetitionState::default();
+        petition.show(signatures(0x99, 0xaa, 7, &[]), &commands);
+        petition.apply_record(PetitionQueryResponse {
+            petition_id: 7,
+            name: "First".into(),
+            min_signatures: 9,
+            ..Default::default()
+        });
+        apply::renamed(
+            &mut petition,
+            PetitionRename {
+                item: 0x99,
+                name: "Second".into(),
+            },
+        );
+        assert_eq!(open_title(&petition), Some("Second"));
+
+        // An echo for a charter we do not have open is not ours to apply.
+        apply::renamed(
+            &mut petition,
+            PetitionRename {
+                item: 0xdead,
+                name: "Wrong".into(),
+            },
+        );
+        assert_eq!(open_title(&petition), Some("Second"));
+    }
+}
diff --git a/crates/benilla-app/src/ui_script/mod.rs b/crates/benilla-app/src/ui_script/mod.rs
index daf0bfe9..87c1afa4 100644
--- a/crates/benilla-app/src/ui_script/mod.rs
+++ b/crates/benilla-app/src/ui_script/mod.rs
@@ -923,6 +923,12 @@ mod guild_tests;
 #[cfg(test)]
 mod help_frame_tests;
 
+/// The two guild-charter windows — the registrar and the petition sheet (decision 1672). Its own
+/// module for `guild_tests`' reason: it stands the charter engine API in for in Lua before the XML
+/// loads, so what is under test is the window and not `script::petition`'s plumbing.
+#[cfg(test)]
+mod petition_tests;
+
 /// The social window's fourth tab — the raid pane and its grid (decision 1549). Its own module for
 /// `guild_tests`' reason: every test in it pushes a RAID roster first, which a file about the
 /// friends list must not be in the business of.
diff --git a/crates/benilla-app/src/ui_script/petition_tests.rs b/crates/benilla-app/src/ui_script/petition_tests.rs
new file mode 100644
index 00000000..34d50459
--- /dev/null
+++ b/crates/benilla-app/src/ui_script/petition_tests.rs
@@ -0,0 +1,454 @@
+//! The two guild-charter windows (decision 1672): the guild registrar's two panels, and the
+//! charter itself with its two faces.
+//!
+//! What these guard that the Rust-side unit tests structurally cannot: the windows are Lua over an
+//! engine snapshot, so a `GetPetitionInfo` destructured in the wrong order, a name row wired to the
+//! wrong index, the leader/signer swap tested the wrong way round, or a button pointed at the wrong
+//! verb are all invisible to `script::petition`'s own tests and green in the parse sweep. Each test
+//! below fails on exactly one of those.
+//!
+//! **The engine API is STOOD IN FOR here, deliberately** — `guild_tests`' convention, and for its
+//! reasons: what is under test is the window and nothing else, the tests need no app feed seated,
+//! and a change to the engine's plumbing cannot quietly turn one green. Two fixture shapes are the
+//! ones `script::petition` promises and are easy to get wrong:
+//!
+//! - **era booleans are `1`/`nil`, never `true`/`false`** — `isOriginator` and `CanSignPetition`;
+//! - **`GetPetitionInfo` returns SIX values in a fixed order**
+//!   (`petitionType, title, bodyText, maxSignatures, originatorName, isOriginator`), and the
+//!   fourth is the wire's *requirement*, not `MAX_PETITION_SIGNATURES`.
+
+use benilla_ui::script::UiScript;
+
+/// Load one shipped `assets/ui/<file>`, panicking on any loader error **and on any
+/// unknown-template warning** — `guild_tests`' loader, and the decision-0672 reason is the same:
+/// `inherits=` a template this house doesn't ship is a *warning*, the frame still loads, and a
+/// bare Button still clicks. Both windows here inherit from `UIPanelTemplates.xml` and
+/// `MoneyFrame.xml`, and the registrar defines one local template of its own.
+fn load_xml(s: &UiScript, file: &str) {
+    let text = std::fs::read_to_string(
+        std::path::Path::new(env!("CARGO_MANIFEST_DIR"))
+            .join("assets/ui")
+            .join(file),
+    )
+    .unwrap();
+    let doc = benilla_ui::framexml::parse(&text).unwrap();
+    let report = benilla_ui::loader::load(s, &doc, &|_| None);
+    assert!(
+        report.errors.is_empty(),
+        "{file}: loader errors: {:?}",
+        report.errors
+    );
+    let missing: Vec<&String> = report
+        .warnings
+        .iter()
+        .filter(|w| w.contains("unknown template"))
+        .collect();
+    assert!(
+        missing.is_empty(),
+        "{file}: inherits a template this house does not ship (the frame loads, its ART does \
+         not): {missing:?}"
+    );
+}
+
+/// The charter engine API, stood in for in Lua.
+///
+/// One mutable table, `BenillaPetitionFixture`, is the whole model; every verb appends to `.calls`,
+/// which a test drains with `BenillaPetitionCalls()`. Tests mutate the table's FIELDS — never
+/// replace the table, since the closures below hold it as an upvalue.
+///
+/// Seeded as a **signer's** view of a charter with two of nine signatures: the case where every
+/// distinction this window makes is live at once (the Sign face showing, rows both filled and
+/// empty, Request still enabled).
+const PETITION_FIXTURE: &str = r#"
+BenillaPetitionFixture = {
+    petitionType = "charter",
+    title = "Legacy of Steel",
+    bodyText = "",
+    -- The WIRE's requirement, deliberately not 9, so a test can tell it apart from
+    -- MAX_PETITION_SIGNATURES.
+    maxSignatures = 4,
+    originator = "Tigole",
+    isOriginator = nil,
+    canSign = 1,
+    signers = { "Furor", "Kaplan" },
+    charterCost = 1000,
+    calls = {},
+}
+
+local F = BenillaPetitionFixture
+
+function BenillaPetitionCalls()
+    local out = table.concat(F.calls, "|")
+    F.calls = {}
+    return out
+end
+
+local function record(call)
+    table.insert(F.calls, call)
+end
+
+function GetPetitionInfo()
+    return F.petitionType, F.title, F.bodyText, F.maxSignatures, F.originator, F.isOriginator
+end
+
+function GetNumPetitionNames() return table.getn(F.signers) end
+function GetPetitionNameInfo(i) return F.signers[i] end
+function CanSignPetition() return F.canSign end
+function GetGuildCharterCost() return F.charterCost end
+
+function SignPetition() record("SignPetition") end
+function OfferPetition() record("OfferPetition") end
+function ClosePetition() record("ClosePetition") end
+function CloseGuildRegistrar() record("CloseGuildRegistrar") end
+function TurnInGuildCharter() record("TurnInGuildCharter") end
+function BuyGuildCharter(name) record("BuyGuildCharter:" .. name) end
+function RenamePetition(name) record("RenamePetition:" .. name) end
+"#;
+
+/// The windows' manifest slice, in `benilla.toc` order, with the fixture seated first.
+///
+/// `MoneyFrame.xml` is load-bearing rather than incidental: `GuildRegistrarMoneyFrame` declares
+/// `inherits="MoneyFrameTemplate"`, which resolves at LOAD (decision 1580), so without it the
+/// registrar's price row would be a bare frame and the unknown-template guard above would fire.
+fn setup() -> UiScript {
+    let mut s = UiScript::new().unwrap();
+    s.set_screen_size(1024.0, 768.0);
+    s.run(PETITION_FIXTURE).unwrap();
+    load_xml(&s, "Fonts.xml");
+    load_xml(&s, "BasicControls.xml");
+    load_xml(&s, "MoneyFrame.xml");
+    load_xml(&s, "UiPanels.xml");
+    load_xml(&s, "UIPanelTemplates.xml");
+    load_xml(&s, "GuildRegistrarFrame.xml");
+    load_xml(&s, "PetitionFrame.xml");
+    s
+}
+
+fn text(s: &UiScript, expr: &str) -> String {
+    s.eval::<String>(&format!("return {expr}:GetText() or \"\""))
+        .unwrap_or_else(|e| panic!("{expr}:GetText() — {e}"))
+}
+
+fn visible(s: &UiScript, frame: &str) -> bool {
+    s.eval::<bool>(&format!("return {frame}:IsVisible()"))
+        .unwrap_or_else(|e| panic!("{frame}:IsVisible() — {e}"))
+}
+
+fn calls(s: &UiScript) -> String {
+    s.eval::<String>("return BenillaPetitionCalls()").unwrap()
+}
+
+/// Open the charter window the way the engine does.
+fn show_petition(s: &mut UiScript) {
+    s.fire_event("PETITION_SHOW", vec![]);
+    assert!(s.errors().is_empty(), "PETITION_SHOW: {:?}", s.errors());
+}
+
+fn show_registrar(s: &mut UiScript) {
+    s.fire_event("GUILD_REGISTRAR_SHOW", vec![]);
+    assert!(
+        s.errors().is_empty(),
+        "GUILD_REGISTRAR_SHOW: {:?}",
+        s.errors()
+    );
+}
+
+/// A signer's charter paints the header, the signed rows, the unsigned rows, and the member
+/// instructions — and shows Sign, not Request/Rename.
+///
+/// The row assertion is the load-bearing half: rows 1..2 carry the two signers and rows 3..9 must
+/// read `<not yet signed>`. A `GetPetitionNameInfo` bound 0-based would put "Kaplan" in row 1 and
+/// blank row 2 while every other assertion here still passed.
+#[test]
+fn a_signers_charter_shows_the_sign_face_and_nine_rows() {
+    let mut s = setup();
+    show_petition(&mut s);
+
+    assert!(visible(&s, "PetitionFrame"));
+    assert_eq!(
+        text(&s, "PetitionFrameNpcNameText"),
+        "Legacy of Steel Guild Charter",
+        "GUILD_CHARTER_TEMPLATE filled with the title"
+    );
+    assert_eq!(text(&s, "PetitionFrameCharterName"), "Legacy of Steel");
+    assert_eq!(text(&s, "PetitionFrameMasterName"), "Tigole");
+    // The three static labels come from GlobalStrings via `text=` and are never painted.
+    assert_eq!(text(&s, "PetitionFrameCharterTitle"), "Guild Name");
+    assert_eq!(text(&s, "PetitionFrameMasterTitle"), "Guild Master");
+    assert_eq!(text(&s, "PetitionFrameMemberTitle"), "Members");
+
+    assert_eq!(text(&s, "PetitionFrameMemberName1"), "Furor");
+    assert_eq!(text(&s, "PetitionFrameMemberName2"), "Kaplan");
+    for i in 3..=9 {
+        assert_eq!(
+            text(&s, &format!("PetitionFrameMemberName{i}")),
+            "<not yet signed>",
+            "row {i} is an empty seat"
+        );
+    }
+
+    assert!(visible(&s, "PetitionFrameSignButton"));
+    assert!(!visible(&s, "PetitionFrameRequestButton"));
+    assert!(
+        !visible(&s, "PetitionFrameRenameButton"),
+        "only the charter's owner may rename it"
+    );
+    assert_eq!(
+        text(&s, "PetitionFrameInstructions"),
+        "Click the <Sign Charter> button to become a charter member of this guild."
+    );
+}
+
+/// The owner's charter is the same window inside out: Request + Rename replace Sign, and the
+/// instructions change.
+///
+/// Both halves are asserted because the two buttons share one anchor — a Show/Hide written the
+/// wrong way round stacks them and the top one wins, which looks correct from a screenshot of
+/// either view alone.
+#[test]
+fn the_owners_charter_swaps_sign_for_request_and_rename() {
+    let mut s = setup();
+    s.run("BenillaPetitionFixture.isOriginator = 1").unwrap();
+    show_petition(&mut s);
+
+    assert!(visible(&s, "PetitionFrameRequestButton"));
+    assert!(visible(&s, "PetitionFrameRenameButton"));
+    assert!(!visible(&s, "PetitionFrameSignButton"));
+    assert_eq!(
+        text(&s, "PetitionFrameInstructions"),
+        "Select a player you wish to invite and click <request signature>.   To create this \
+         guild, turn it in to the guild registrar when you have filled the charter."
+    );
+}
+
+/// Request Signature disables against the **wire's** requirement, never against the nine rows.
+///
+/// The fixture requires 4. At three signatures the button is live; at four it is not — and nine
+/// rows are still painted either way. A window that compared against `MAX_PETITION_SIGNATURES`
+/// would leave Request enabled on a full charter, and every other assertion in this file would
+/// still pass.
+#[test]
+fn request_signature_disables_at_the_wires_requirement_not_at_nine() {
+    let mut s = setup();
+    s.run(
+        r#"
+        BenillaPetitionFixture.isOriginator = 1
+        BenillaPetitionFixture.signers = { "A", "B", "C" }
+    "#,
+    )
+    .unwrap();
+    show_petition(&mut s);
+    assert!(
+        s.eval::<bool>("return PetitionFrameRequestButton:IsEnabled() and true or false")
+            .unwrap(),
+        "three of four signatures — still asking"
+    );
+
+    s.run(r#"BenillaPetitionFixture.signers = { "A", "B", "C", "D" }"#)
+        .unwrap();
+    show_petition(&mut s);
+    assert!(
+        !s.eval::<bool>("return PetitionFrameRequestButton:IsEnabled() and true or false")
+            .unwrap(),
+        "four of four — the charter is full, though only four of nine rows are used"
+    );
+    assert_eq!(
+        text(&s, "PetitionFrameMemberName5"),
+        "<not yet signed>",
+        "the nine rows are unaffected by the requirement"
+    );
+}
+
+/// `CanSignPetition` gates the Sign button independently of which face is showing: a charter can be
+/// a signer's view and still be unsignable (already signed, already guilded, full).
+#[test]
+fn the_sign_button_follows_can_sign_petition() {
+    let mut s = setup();
+    show_petition(&mut s);
+    assert!(s
+        .eval::<bool>("return PetitionFrameSignButton:IsEnabled() and true or false")
+        .unwrap());
+
+    s.run("BenillaPetitionFixture.canSign = nil").unwrap();
+    show_petition(&mut s);
+    assert!(
+        !s.eval::<bool>("return PetitionFrameSignButton:IsEnabled() and true or false")
+            .unwrap(),
+        "nil, the era false, disables it"
+    );
+    assert!(
+        visible(&s, "PetitionFrameSignButton"),
+        "disabled, not hidden — hiding would expose the Request button beneath it"
+    );
+}
+
+/// Each button reaches its own verb, and closing the window closes the engine's session.
+///
+/// The `ClosePetition` half is the one worth pinning: it rides `OnHide`, so it fires however the
+/// window closes, and without it the engine keeps a charter session for a window nobody can see.
+#[test]
+fn the_charter_buttons_reach_their_verbs_and_the_close_clears_the_session() {
+    let mut s = setup();
+    show_petition(&mut s);
+    let _ = calls(&s);
+
+    s.run("PetitionFrameSignButton:Click()").unwrap();
+    assert_eq!(calls(&s), "SignPetition");
+
+    s.run("BenillaPetitionFixture.isOriginator = 1").unwrap();
+    show_petition(&mut s);
+    let _ = calls(&s);
+    s.run("PetitionFrameRequestButton:Click()").unwrap();
+    assert_eq!(calls(&s), "OfferPetition");
+
+    s.run("HideUIPanel(PetitionFrame)").unwrap();
+    assert!(!visible(&s, "PetitionFrame"));
+    assert_eq!(calls(&s), "ClosePetition", "OnHide clears the session");
+}
+
+/// The rename dialog is registered, takes the box's text, and is capped at the server's own
+/// 24-character charter-name limit.
+#[test]
+fn rename_guild_sends_the_box_text_and_caps_at_twenty_four() {
+    let mut s = setup();
+    s.run("BenillaPetitionFixture.isOriginator = 1").unwrap();
+    show_petition(&mut s);
+    let _ = calls(&s);
+
+    s.run("PetitionFrameRenameButton:Click()").unwrap();
+    assert!(s.errors().is_empty(), "{:?}", s.errors());
+    assert_eq!(
+        s.eval::<i64>("return StaticPopupDialogs[\"RENAME_GUILD\"].maxLetters")
+            .unwrap(),
+        24,
+        "the server's MAX_CHARTER_NAME"
+    );
+    assert!(
+        visible(&s, "StaticPopup1"),
+        "the popup engine raised the dialog"
+    );
+    s.run(
+        r#"
+        StaticPopup1EditBox:SetText("Second Legacy")
+        StaticPopup1Button1:Click()
+    "#,
+    )
+    .unwrap();
+    assert_eq!(calls(&s), "RenamePetition:Second Legacy");
+}
+
+/// The registrar opens on its services list, and Purchase swaps panels **locally** — no verb, no
+/// packet. Getting that wrong would send a buy on the first click of "Purchase a Guild Charter",
+/// before the player has typed a name.
+#[test]
+fn the_registrar_opens_on_services_and_purchase_is_a_local_panel_swap() {
+    let mut s = setup();
+    show_registrar(&mut s);
+
+    assert!(visible(&s, "GuildRegistrarFrame"));
+    assert!(visible(&s, "GuildRegistrarGreetingFrame"));
+    assert!(!visible(&s, "GuildRegistrarPurchaseFrame"));
+    assert_eq!(
+        text(&s, "GuildRegistrarButton1"),
+        "Purchase a Guild Charter"
+    );
+    assert_eq!(
+        text(&s, "GuildRegistrarButton2"),
+        "Register a Guild Charter"
+    );
+    let _ = calls(&s);
+
+    s.run("GuildRegistrarButton1:Click()").unwrap();
+    assert!(visible(&s, "GuildRegistrarPurchaseFrame"));
+    assert!(!visible(&s, "GuildRegistrarGreetingFrame"));
+    assert_eq!(calls(&s), "", "the swap sends nothing");
+}
+
+/// Buying sends the box's text and closes the window; registering sends the no-argument turn-in.
+///
+/// The close-after-buy is the reference's own behaviour and is asserted because it looks like a bug
+/// otherwise: a buy is one-shot, and its answer is an item arriving rather than anything this
+/// window will be told.
+#[test]
+fn purchase_sends_the_typed_name_and_register_turns_the_charter_in() {
+    let mut s = setup();
+    show_registrar(&mut s);
+    s.run("GuildRegistrarButton1:Click()").unwrap();
+    let _ = calls(&s);
+
+    s.run(
+        r#"
+        GuildRegistrarFrameEditBox:SetText("Legacy of Steel")
+        GuildRegistrarFramePurchaseButton:Click()
+    "#,
+    )
+    .unwrap();
+    assert_eq!(
+        calls(&s),
+        "BuyGuildCharter:Legacy of Steel|CloseGuildRegistrar",
+        "the buy, then the window's own OnHide close"
+    );
+    assert!(!visible(&s, "GuildRegistrarFrame"));
+
+    show_registrar(&mut s);
+    let _ = calls(&s);
+    s.run("GuildRegistrarButton2:Click()").unwrap();
+    assert_eq!(
+        calls(&s),
+        "TurnInGuildCharter",
+        "no argument — the engine finds the charter in the bags"
+    );
+}
+
+/// The price row is filled at panel-swap time from `GetGuildCharterCost()`, in copper.
+///
+/// Reading it at *show* time instead would paint a 0: the cost belongs to the open registrar's
+/// charter list, and the greeting panel never displays one.
+#[test]
+fn the_charter_price_is_read_when_the_purchase_panel_opens() {
+    let mut s = setup();
+    show_registrar(&mut s);
+    s.run("GuildRegistrarButton1:Click()").unwrap();
+    // 1000 copper = 10 silver: the gold slot is empty, the silver slot reads 10.
+    assert_eq!(text(&s, "GuildRegistrarMoneyFrameSilverButtonText"), "10");
+    assert_eq!(text(&s, "GuildRegistrarCostLabel"), "Cost:");
+}
+
+/// Re-opening the registrar always lands on the services list, never on a half-filled purchase
+/// panel left over from last time.
+#[test]
+fn reopening_the_registrar_returns_to_the_services_list() {
+    let mut s = setup();
+    show_registrar(&mut s);
+    s.run("GuildRegistrarButton1:Click()").unwrap();
+    assert!(visible(&s, "GuildRegistrarPurchaseFrame"));
+
+    s.fire_event("GUILD_REGISTRAR_CLOSED", vec![]);
+    assert!(!visible(&s, "GuildRegistrarFrame"));
+    show_registrar(&mut s);
+    assert!(visible(&s, "GuildRegistrarGreetingFrame"));
+    assert!(!visible(&s, "GuildRegistrarPurchaseFrame"));
+}
+
+/// Both windows are registered UIPanels — without a row, `ShowUIPanel` degrades to a bare `Show()`
+/// in no slot and two left-slot windows paint over each other (B288's shape, decision 1507).
+#[test]
+fn both_charter_windows_are_registered_left_slot_panels() {
+    let mut s = setup();
+    for frame in ["GuildRegistrarFrame", "PetitionFrame"] {
+        assert_eq!(
+            s.eval::<String>(&format!("return UIPanelWindows[\"{frame}\"].area"))
+                .unwrap(),
+            "left",
+            "{frame} must hold a panel row"
+        );
+    }
+    // And they are rivals, not neighbours: opening one seats it where the other was.
+    show_registrar(&mut s);
+    show_petition(&mut s);
+    assert!(visible(&s, "PetitionFrame"));
+    assert!(
+        !visible(&s, "GuildRegistrarFrame"),
+        "one left slot, both pushable 0"
+    );
+}
diff --git a/crates/benilla-app/src/ui_session.rs b/crates/benilla-app/src/ui_session.rs
index c593f2fb..45ce7b99 100644
--- a/crates/benilla-app/src/ui_session.rs
+++ b/crates/benilla-app/src/ui_session.rs
@@ -100,7 +100,7 @@ pub(crate) fn close_npc_session_out_of_range<T: NpcSession>(
 /// window open, so the booth empties; the ring is hidden with its window then, so the dark disc
 /// never shows.
 #[derive(Resource, Default)]
-pub(crate) struct InteractNpc(pub(crate) Option<Entity>);
+pub(crate) struct InteractNpc(pub(crate) Option<Entity>, pub(crate) Option<u64>);
 
 /// Collapse the portrait-bound sessions into [`InteractNpc`] each frame: the open one's guid,
 /// resolved to its entity. One deterministic writer (not one publish-system per session), so there is
@@ -123,6 +123,13 @@ pub(crate) fn feed_interact_npc(
     // here is what left `AuctionPortraitTexture` a black disc: the window asks for `"npc"` in its
     // OnShow like every other NPC window, and nothing was answering.
     auction: Option<Res<crate::ui_auction::AuctionOpen>>,
+    // The guild registrar's, while the charter window is open (decision 1672) — same booth path,
+    // and it is NOT covered by the gossip arm above: the server closes the gossip menu before it
+    // sends `SMSG_PETITION_SHOWLIST` (`Player.cpp:12428-12431` — `CloseGossip()` then
+    // `SendPetitionShowList`), so by the time `GuildRegistrar_OnShow` asks for `"npc"` the gossip
+    // session is already gone. Without this arm the window's portrait is the auctioneer's black
+    // disc all over again and its name banner is blank.
+    registrar: Option<Res<crate::ui_petition::GuildRegistrarState>>,
     index: Option<Res<GuidIndex>>,
     mut out: ResMut<InteractNpc>,
 ) {
@@ -134,8 +141,15 @@ pub(crate) fn feed_interact_npc(
         .or_else(|| taxi.and_then(|s| s.npc()))
         .or_else(|| trade.and_then(|s| s.npc()))
         .or_else(|| bank.and_then(|s| s.npc()))
-        .or_else(|| auction.and_then(|s| s.npc()));
+        .or_else(|| auction.and_then(|s| s.npc()))
+        .or_else(|| registrar.and_then(|s| s.npc()));
+    // Field 0 is the entity the portrait booth bakes and the facing chain steers by; field 1 is
+    // the same NPC's **guid**, which `crate::ui_unit`'s feed needs to resolve the `"npc"` unit
+    // token's name (a name lives in the `NameCache`, keyed by guid — there is no way back to one
+    // from an entity). Both are set together and cleared together; a guid whose entity is not
+    // streamed still names the unit, which is why they are two fields rather than one lookup.
     out.0 = guid.and_then(|g| index.and_then(|i| i.0.get(&g).copied()));
+    out.1 = guid;
 }
 
 #[cfg(test)]
diff --git a/crates/benilla-app/src/ui_unit.rs b/crates/benilla-app/src/ui_unit.rs
index 34ab9ad7..809249aa 100644
--- a/crates/benilla-app/src/ui_unit.rs
+++ b/crates/benilla-app/src/ui_unit.rs
@@ -1041,6 +1041,9 @@ fn feed_units(
     // (decision 1257): a lookup that misses is what sends the `CMSG_GUILD_QUERY`, exactly as a
     // `NameCache::resolve` miss sends the name query above.
     mut guild: ResMut<crate::ui_guild::GuildState>,
+    // The NPC the player is interacting with, for the `"npc"` token below. `Option` for the same
+    // reason `index` and `factions` are: a UI-only harness runs this feed with no session plugin.
+    interact: Option<Res<crate::ui_session::InteractNpc>>,
 ) {
     let Some(mut script) = script else {
         return;
@@ -1272,6 +1275,67 @@ fn feed_units(
         script.set_unit("targettarget", tot.clone());
     }
 
+    // `"npc"` — the unit the player is interacting with, resolved through the SAME interaction guid
+    // the real client's token reads (`CGGameUI`'s `[0xb4e2d0]`, what `CGGameUI::SetInteractNPC`
+    // writes; wow-re confirms the guild registrar's own opener is one of that function's fourteen
+    // callers). `crate::ui_session::InteractNpc` is benilla's model of exactly that cell, so the
+    // token and the portrait booth cannot disagree about who "npc" is.
+    //
+    // **It had no feed at all until decision 1678**, and the gap was invisible because nothing
+    // called it: `TaxiFrame.xml` and `TradeFrame.xml` both take the NPC's name from an event
+    // argument instead and say in their own comments that they are deviating from the reference's
+    // `UnitName("NPC")` to do it. `GuildRegistrarFrame.xml` is the first window here to ship the
+    // reference's line unchanged — and it painted a blank name banner, because
+    // `GUILD_REGISTRAR_SHOW` is verified to carry no arguments, so there is nothing else for it to
+    // read. The probe caught it; a one-frame-lag theory was the first (wrong) explanation.
+    //
+    // No `guild` leg, for `"targettarget"`'s reason: nothing asks an NPC for its guild, and the
+    // lookup is the lazy cache whose miss SENDS a query.
+    let npc = interact
+        .as_deref()
+        .and_then(|i| Some((i.0?, i.1?)))
+        .and_then(|(entity, guid)| {
+            let store = stores.get(entity).ok()?;
+            let name = names.resolve(guid, &commands).map(str::to_string);
+            let reaction = ring_reaction(
+                factions.as_deref(),
+                &reputations,
+                Some(store),
+                self_pair.map(|(s, _)| s),
+            ) + 1;
+            let mut s = snapshot(store, name, reaction);
+            s.guid = guid;
+            s.is_connected = true;
+            s.raid_target = group.raid_target_index(guid);
+            s.faction_group = faction_group(store, factions.as_deref());
+            s.can_attack = crate::target::can_attack(
+                Some(store),
+                factions.as_deref(),
+                &reputations,
+                self_pair.map(|(s, _)| s),
+            );
+            enrich_unit(
+                &mut s,
+                guid,
+                &names,
+                store,
+                factions.as_deref(),
+                self_pair.map(|(s, _)| s),
+            );
+            Some(s)
+        });
+    // "Absence IS data" again: closing an NPC window must clear the token, or the next window's
+    // first frame paints the last NPC's name.
+    let npc_dirty = match (&npc, memo.last.get("npc")) {
+        (Some(cur), Some(prev)) => cur != prev,
+        (None, None) => false,
+        _ => true,
+    };
+    if npc_dirty {
+        gate.audit("feed_units", "the interaction-NPC snapshot");
+        script.set_unit("npc", npc.clone());
+    }
+
     // The XP bar's feed: push our own avatar's PLAYER_XP / PLAYER_NEXT_LEVEL_XP (both PRIVATE, only
     // ever streamed for self) and fire PLAYER_XP_UPDATE when either changes — the coinage feed's
     // shape. Absent fields read 0 (a fresh descriptor's zero default; the bar shows empty until XP
diff --git a/crates/benilla-protocol/src/events.rs b/crates/benilla-protocol/src/events.rs
index 6899e860..39b04efc 100644
--- a/crates/benilla-protocol/src/events.rs
+++ b/crates/benilla-protocol/src/events.rs
@@ -17,10 +17,11 @@ use crate::messages::{
     GuildQueryResponse, GuildRoster, InspectHonorStats, ItemInfo, ItemPushResult, JumpInfo,
     LevelUpInfo, LootAllPassed, LootItem, LootRoll, LootRollWon, LootStartRoll, MailListEntry,
     MirrorTimerStart, MonsterMoveFacing, ObjectFields, PartyMemberStatsInfo, PeriodicAuraLog,
-    PetMode, PetSpells, PvpCredit, QuestComplete, QuestDetails, QuestGiverList, QuestOfferReward,
-    QuestRequestItems, QuestTemplate, SpellDamageLog, SpellEnergizeLog, SpellHealLog, SpellLogMiss,
-    StabledPet, TaxiMask, TradeStatus, TradeStatusExtended, TrainerSpell, TransportPose,
-    VendorItem, WhoResults, XpGain,
+    PetMode, PetSpells, PetitionQueryResponse, PetitionRename, PetitionShowList,
+    PetitionShowSignatures, PetitionSignResults, PvpCredit, QuestComplete, QuestDetails,
+    QuestGiverList, QuestOfferReward, QuestRequestItems, QuestTemplate, SpellDamageLog,
+    SpellEnergizeLog, SpellHealLog, SpellLogMiss, StabledPet, TaxiMask, TradeStatus,
+    TradeStatusExtended, TrainerSpell, TransportPose, VendorItem, WhoResults, XpGain,
 };
 
 /// Coarse entity classification, free of wire types so the app can branch on it without depending on
@@ -1180,6 +1181,34 @@ pub enum SessionEvent {
     /// The guild's "founded on / N members / N accounts" summary (`SMSG_GUILD_INFO`) — a separate
     /// ask from the roster, sharing no fields with it.
     GuildInfo(GuildInfo),
+    /// A guild registrar's charter list (`SMSG_PETITION_SHOWLIST`) — what opens the registrar
+    /// window. Always one row at 1.12; `npc` is the registrar every later verb names.
+    PetitionShowList(PetitionShowList),
+    /// Who has signed a charter (`SMSG_PETITION_SHOW_SIGNATURES`). **Two meanings in one packet**:
+    /// the answer to our own ask, or somebody offering us theirs — a consumer tells them apart by
+    /// whether `owner` is us, and nothing else does.
+    ///
+    /// It carries neither the proposed guild's name nor the signature requirement. Those live only
+    /// on [`Self::PetitionQueryResponse`], keyed by `petition_id` — the same two-caches shape the
+    /// guild roster has with [`Self::GuildQueryResponse`].
+    PetitionShowSignatures(PetitionShowSignatures),
+    /// The verdict on one signature (`SMSG_PETITION_SIGN_RESULTS`). Sent to **both** the signer and
+    /// the charter's owner on success, and both copies name the *signer*, so a consumer cannot tell
+    /// which copy it holds from the packet alone.
+    PetitionSignResults(PetitionSignResults),
+    /// A petition's record (`SMSG_PETITION_QUERY_RESPONSE`) — the proposed guild name and the
+    /// signature requirement. The lazy cache fill behind the charter window's title.
+    PetitionQueryResponse(PetitionQueryResponse),
+    /// The verdict on a turn-in (`SMSG_TURN_IN_PETITION_RESULTS`) — a bare code, with no charter
+    /// named. **Silence is a real outcome**: a name collision answers with an
+    /// [`Self::GuildCommandResult`] and no results packet at all.
+    TurnInPetitionResults { result: u32 },
+    /// Somebody declined our charter (`MSG_PETITION_DECLINE`) — their guid, delivered to the
+    /// charter's owner only.
+    PetitionDeclined { player: u64 },
+    /// A charter rename that took (`MSG_PETITION_RENAME`) — the server's echo, sent only on
+    /// success. A rejected name arrives as a [`Self::GuildCommandResult`] instead.
+    PetitionRenamed(PetitionRename),
     /// The taxi map (`SMSG_SHOWTAXINODES`, decision 0484): `flightmaster` is the NPC the menu
     /// opened on, `nearest_node` the node it sits at, `known_mask` the full known-node bitmask
     /// ([`TaxiMask::is_known`]). The wire's window-framing constant carries no state and is
diff --git a/crates/benilla-protocol/src/events/decode.rs b/crates/benilla-protocol/src/events/decode.rs
index a0c4c8e3..6d4998ff 100644
--- a/crates/benilla-protocol/src/events/decode.rs
+++ b/crates/benilla-protocol/src/events/decode.rs
@@ -567,6 +567,23 @@ pub fn decode(packet: ServerPacket) -> Vec<SessionEvent> {
         }
         ServerPacket::GuildDecline { name } => vec![SessionEvent::GuildDecline { name }],
         ServerPacket::GuildInfo(info) => vec![SessionEvent::GuildInfo(info)],
+        ServerPacket::PetitionShowList(list) => vec![SessionEvent::PetitionShowList(list)],
+        ServerPacket::PetitionShowSignatures(sigs) => {
+            vec![SessionEvent::PetitionShowSignatures(sigs)]
+        }
+        ServerPacket::PetitionSignResults(results) => {
+            vec![SessionEvent::PetitionSignResults(results)]
+        }
+        ServerPacket::PetitionQueryResponse(response) => {
+            vec![SessionEvent::PetitionQueryResponse(response)]
+        }
+        ServerPacket::TurnInPetitionResults { result } => {
+            vec![SessionEvent::TurnInPetitionResults { result }]
+        }
+        ServerPacket::PetitionDeclined { player } => {
+            vec![SessionEvent::PetitionDeclined { player }]
+        }
+        ServerPacket::PetitionRenamed(rename) => vec![SessionEvent::PetitionRenamed(rename)],
         ServerPacket::DestroyObject { guid } => vec![SessionEvent::ObjectDestroyed(guid)],
         ServerPacket::TriggerCinematic { cinematic_id } => {
             vec![SessionEvent::CinematicTriggered { cinematic_id }]
diff --git a/crates/benilla-protocol/src/messages/mod.rs b/crates/benilla-protocol/src/messages/mod.rs
index 2a6ce841..fa45af91 100644
--- a/crates/benilla-protocol/src/messages/mod.rs
+++ b/crates/benilla-protocol/src/messages/mod.rs
@@ -45,6 +45,7 @@ mod packet;
 mod page_text;
 mod parse;
 mod pet;
+mod petition;
 mod pose;
 mod progression;
 mod pvp;
@@ -172,6 +173,13 @@ pub use pet::{
     PET_REACT_DEFENSIVE, PET_REACT_PASSIVE, PET_STATE_BAR_DISABLED, PET_TYPE_SPELL_FIRST,
     PET_TYPE_SPELL_LAST, PET_UNUSABLE_UNIT_FLAGS,
 };
+pub use petition::{
+    offer_petition, petition_buy, petition_decline, petition_query, petition_rename,
+    petition_result, petition_show_list, petition_show_signatures, petition_sign, turn_in_petition,
+    PetitionQueryResponse, PetitionRename, PetitionShowList, PetitionShowListEntry,
+    PetitionShowSignatures, PetitionSignResults, PetitionSignature, CHARTER_DISPLAY_ID,
+    CHARTER_ITEM_ENTRY, CHARTER_NAME_MAX_LENGTH, ITEM_FLAG_CHARTER, MAX_PETITION_SIGNATURES,
+};
 pub use pose::{set_sheathed, stand_state_change};
 pub use progression::{
     learn_talent, talent_wipe_confirm, ExplorationXp, LevelUpInfo, TalentWipeConfirm, XpGain,
diff --git a/crates/benilla-protocol/src/messages/opcode.rs b/crates/benilla-protocol/src/messages/opcode.rs
index 3f057a07..830d797a 100644
--- a/crates/benilla-protocol/src/messages/opcode.rs
+++ b/crates/benilla-protocol/src/messages/opcode.rs
@@ -942,7 +942,8 @@ pub const CMSG_DEL_IGNORE: u16 = 0x006D; // 109
 // The numbers are two contiguous runs plus two strays: the query pair sits with the other ask-once
 // caches at 0x54/0x55, the core family runs 0x81-0x93 immediately after the group family, rank
 // administration was appended at 0x231-0x235, and the guild info text at 0x2FC. The
-// charter/petition/tabard opcodes that *found* a guild are a separate slice and are not here.
+// charter/petition opcodes that *found* a guild are their own family, below; the tabard
+// opcodes that dress one are not built.
 pub const CMSG_GUILD_QUERY: u16 = 0x0054; // 84
 pub const SMSG_GUILD_QUERY_RESPONSE: u16 = 0x0055; // 85
 /// vmangos registers this `STATUS_NEVER` (`Opcodes.cpp:210`): at 1.12 a guild is founded through
@@ -975,6 +976,39 @@ pub const CMSG_GUILD_SET_PUBLIC_NOTE: u16 = 0x0234; // 564
 pub const CMSG_GUILD_SET_OFFICER_NOTE: u16 = 0x0235; // 565
 pub const CMSG_GUILD_INFO_TEXT: u16 = 0x02FC; // 764
 
+// The petition family — the guild-charter flow that FOUNDS a guild (VERIFIED vmangos
+// `Opcodes_1_12_1.h:444-456`, `:705-706` + `Server/Packets/Petition.{h,cpp}`,
+// `Handlers/PetitionsHandler.cpp`; the handler table is `Opcodes.cpp:528-540` and `:800-801`).
+// Bodies in [`super::petition`]; decision 1672.
+//
+// Two shapes to know. The three `MSG_` opcodes are genuinely bidirectional with *different*
+// bodies each way — decline sends an item guid and receives a player guid — so each has its own
+// reader and its own builder rather than one shared body. And `MSG_DELETE_GUILD_CHARTER` (0x2C0)
+// is deliberately **absent**: vmangos registers it `INVALID_PACKET(…, Unhandled)`
+// (`Opcodes.cpp:800`) and has no handler at all, because destroying a charter runs through the
+// ordinary item-destroy path, which cascades into deleting the petition (`Player.cpp:10811-10817`,
+// `Item.cpp:515-516`). Declaring it would model traffic that nothing on either end sends.
+pub const CMSG_PETITION_SHOWLIST: u16 = 0x01BB; // 443
+pub const SMSG_PETITION_SHOWLIST: u16 = 0x01BC; // 444
+pub const CMSG_PETITION_BUY: u16 = 0x01BD; // 445
+pub const CMSG_PETITION_SHOW_SIGNATURES: u16 = 0x01BE; // 446
+/// The answer to **two** different asks — our own `CMSG_PETITION_SHOW_SIGNATURES`, and someone
+/// else's `CMSG_OFFER_PETITION` aimed at us. Only its `owner` field tells the two apart.
+pub const SMSG_PETITION_SHOW_SIGNATURES: u16 = 0x01BF; // 447
+pub const CMSG_PETITION_SIGN: u16 = 0x01C0; // 448
+pub const SMSG_PETITION_SIGN_RESULTS: u16 = 0x01C1; // 449
+/// Bidirectional with different bodies: we send the charter **item's** guid, the owner receives
+/// the declining **player's** guid.
+pub const MSG_PETITION_DECLINE: u16 = 0x01C2; // 450
+pub const CMSG_OFFER_PETITION: u16 = 0x01C3; // 451
+pub const CMSG_TURN_IN_PETITION: u16 = 0x01C4; // 452
+pub const SMSG_TURN_IN_PETITION_RESULTS: u16 = 0x01C5; // 453
+pub const CMSG_PETITION_QUERY: u16 = 0x01C6; // 454
+pub const SMSG_PETITION_QUERY_RESPONSE: u16 = 0x01C7; // 455
+/// Bidirectional, and here the two bodies agree: `u64 item` + the new name, both ways. The echo
+/// comes back only on success.
+pub const MSG_PETITION_RENAME: u16 = 0x02C1; // 705
+
 // The group/party family — invite/accept/decline/kick/leader/disband, the loot-method setting, the
 // roster push (`SMSG_GROUP_LIST`), party command feedback, live member stats for the party/raid
 // frame, minimap pings, raid subgroup management, raid-target icons, and ready checks (VERIFIED
diff --git a/crates/benilla-protocol/src/messages/packet.rs b/crates/benilla-protocol/src/messages/packet.rs
index 1cbbbf16..80572d9e 100644
--- a/crates/benilla-protocol/src/messages/packet.rs
+++ b/crates/benilla-protocol/src/messages/packet.rs
@@ -12,12 +12,13 @@ use super::{
     GuildCommandResult, GuildEventNotice, GuildInfo, GuildQueryResponse, GuildRoster,
     InitWorldStates, InspectHonorStats, ItemInfo, ItemPushResult, JumpInfo, LevelUpInfo,
     LootAllPassed, LootItem, LootRoll, LootRollWon, LootStartRoll, MailListEntry, MirrorTimerStart,
-    MoveMode, Object, PartyMemberStatsInfo, PeriodicAuraLog, PetMode, PetSpells, PvpCredit,
-    QuestComplete, QuestDetails, QuestGiverList, QuestOfferReward, QuestOption, QuestRequestItems,
-    QuestTemplate, ResurrectRequestBody, SpeedKind, SpellChainTargets, SpellCooldown,
-    SpellDamageLog, SpellEnergizeLog, SpellGo, SpellHealLog, SpellLogMiss, SpellStart, StabledPet,
-    TaxiMask, TradeStatus, TradeStatusExtended, TrainerSpell, TransportPose, VendorItem,
-    WhoResults, XpGain,
+    MoveMode, Object, PartyMemberStatsInfo, PeriodicAuraLog, PetMode, PetSpells,
+    PetitionQueryResponse, PetitionRename, PetitionShowList, PetitionShowSignatures,
+    PetitionSignResults, PvpCredit, QuestComplete, QuestDetails, QuestGiverList, QuestOfferReward,
+    QuestOption, QuestRequestItems, QuestTemplate, ResurrectRequestBody, SpeedKind,
+    SpellChainTargets, SpellCooldown, SpellDamageLog, SpellEnergizeLog, SpellGo, SpellHealLog,
+    SpellLogMiss, SpellStart, StabledPet, TaxiMask, TradeStatus, TradeStatusExtended, TrainerSpell,
+    TransportPose, VendorItem, WhoResults, XpGain,
 };
 
 /// The **final facing** a `SMSG_MONSTER_MOVE` dictates (its `moveType`): the unit snaps to face this
@@ -1133,6 +1134,31 @@ pub enum ServerPacket {
     /// `SMSG_GUILD_INFO` — the "founded on / N members / N accounts" summary; a separate ask from
     /// the roster, with no overlapping fields.
     GuildInfo(GuildInfo),
+    /// `SMSG_PETITION_SHOWLIST` — a guild registrar's charter list. In 1.12 always one row, and
+    /// the packet that opens the registrar window.
+    PetitionShowList(PetitionShowList),
+    /// `SMSG_PETITION_SHOW_SIGNATURES` — who has signed a charter. Answers **two** different asks
+    /// (our own show-signatures, and someone else's offer aimed at us); only `owner` tells them
+    /// apart.
+    PetitionShowSignatures(PetitionShowSignatures),
+    /// `SMSG_PETITION_SIGN_RESULTS` — the verdict on one signature. Sent to *both* parties on
+    /// success, and both copies name the signer.
+    PetitionSignResults(PetitionSignResults),
+    /// `SMSG_PETITION_QUERY_RESPONSE` — a petition's record: the proposed guild name and the
+    /// signature requirement, neither of which is on any other packet.
+    PetitionQueryResponse(PetitionQueryResponse),
+    /// `SMSG_TURN_IN_PETITION_RESULTS` — a bare result code. A name collision produces no packet
+    /// at all, so silence is a real outcome.
+    TurnInPetitionResults {
+        result: u32,
+    },
+    /// `MSG_PETITION_DECLINE` inbound — the guid of the player who declined our charter. Sent only
+    /// to the charter's owner.
+    PetitionDeclined {
+        player: u64,
+    },
+    /// `MSG_PETITION_RENAME` inbound — the server's echo of a rename that took. Only on success.
+    PetitionRenamed(PetitionRename),
     /// A `SMSG_SPLINE_SET_*_SPEED` — a speed change on a unit we don't control (a creature, or a
     /// player mid-spline): `[packed guid][f32 speed]`, no counter, no ack (decision 0441 — how an
     /// observed unit's mounted speed reaches us).
@@ -1527,6 +1553,13 @@ impl ServerPacket {
             ServerPacket::GuildInvite { .. } => "SMSG_GUILD_INVITE".into(),
             ServerPacket::GuildDecline { .. } => "SMSG_GUILD_DECLINE".into(),
             ServerPacket::GuildInfo(..) => "SMSG_GUILD_INFO".into(),
+            ServerPacket::PetitionShowList(..) => "SMSG_PETITION_SHOWLIST".into(),
+            ServerPacket::PetitionShowSignatures(..) => "SMSG_PETITION_SHOW_SIGNATURES".into(),
+            ServerPacket::PetitionSignResults(..) => "SMSG_PETITION_SIGN_RESULTS".into(),
+            ServerPacket::PetitionQueryResponse(..) => "SMSG_PETITION_QUERY_RESPONSE".into(),
+            ServerPacket::TurnInPetitionResults { .. } => "SMSG_TURN_IN_PETITION_RESULTS".into(),
+            ServerPacket::PetitionDeclined { .. } => "MSG_PETITION_DECLINE".into(),
+            ServerPacket::PetitionRenamed(..) => "MSG_PETITION_RENAME".into(),
             ServerPacket::SplineSpeedChange { kind, .. } => {
                 format!("SMSG_SPLINE_SET_{kind:?}_SPEED")
             }
diff --git a/crates/benilla-protocol/src/messages/parse.rs b/crates/benilla-protocol/src/messages/parse.rs
index a8a9d3af..7d4d3d89 100644
--- a/crates/benilla-protocol/src/messages/parse.rs
+++ b/crates/benilla-protocol/src/messages/parse.rs
@@ -13,8 +13,8 @@ use crate::wire::{
 use super::{
     action_bar, area_trigger, attack, auction, bank, binder, channel, chat, combat_log, death,
     duel, gameobject, gm_ticket, gossip, group, guild, items, loot, mail, mirror_timer,
-    monster_move, movement, opcode, page_text, pet, progression, pvp, quest, social, spellbook,
-    spells, stable, taxi, trade, trainer, update_object, vendor, world_state, Character,
+    monster_move, movement, opcode, page_text, pet, petition, progression, pvp, quest, social,
+    spellbook, spells, stable, taxi, trade, trainer, update_object, vendor, world_state, Character,
     CreatureQueryInfo, MoveMode, ServerPacket, SpeedKind,
 };
 
@@ -1071,6 +1071,31 @@ pub fn parse_server(opcode: u16, body: &[u8]) -> io::Result<ServerPacket> {
             name: guild::read_guild_decline(&mut r)?,
         },
         opcode::SMSG_GUILD_INFO => ServerPacket::GuildInfo(guild::read_guild_info(&mut r)?),
+        // The petition family (bodies in `petition`) — founding a guild, which at 1.12 is an
+        // entirely different wire from the guild family above. Note `SMSG_PETITION_SHOW_SIGNATURES`
+        // answers two different asks, and the two `MSG_` opcodes read a *different* body from the
+        // one they write (see `petition`'s own docs).
+        opcode::SMSG_PETITION_SHOWLIST => {
+            ServerPacket::PetitionShowList(petition::read_petition_show_list(&mut r)?)
+        }
+        opcode::SMSG_PETITION_SHOW_SIGNATURES => {
+            ServerPacket::PetitionShowSignatures(petition::read_petition_show_signatures(&mut r)?)
+        }
+        opcode::SMSG_PETITION_SIGN_RESULTS => {
+            ServerPacket::PetitionSignResults(petition::read_petition_sign_results(&mut r)?)
+        }
+        opcode::SMSG_PETITION_QUERY_RESPONSE => {
+            ServerPacket::PetitionQueryResponse(petition::read_petition_query_response(&mut r)?)
+        }
+        opcode::SMSG_TURN_IN_PETITION_RESULTS => ServerPacket::TurnInPetitionResults {
+            result: petition::read_turn_in_petition_results(&mut r)?,
+        },
+        opcode::MSG_PETITION_DECLINE => ServerPacket::PetitionDeclined {
+            player: petition::read_petition_decline(&mut r)?,
+        },
+        opcode::MSG_PETITION_RENAME => {
+            ServerPacket::PetitionRenamed(petition::read_petition_rename(&mut r)?)
+        }
         // The observer speed legs (decision 0441): a unit we don't control changed speed — a
         // creature or mid-spline player (SPLINE family), or a freely-moving player (MOVE_SET
         // family, which carries a fresh pose too). No ack on either.
diff --git a/crates/benilla-protocol/src/messages/petition.rs b/crates/benilla-protocol/src/messages/petition.rs
new file mode 100644
index 00000000..5f45a7e8
--- /dev/null
+++ b/crates/benilla-protocol/src/messages/petition.rs
@@ -0,0 +1,562 @@
+//! The petition family — the guild-charter flow that *founds* a guild (opcodes `0x1BB`–`0x1C7`
+//! plus `0x2C1`).
+//!
+//! [`super::guild`] is about *being* in a guild; this is about *making* one. At 1.12 those are
+//! entirely different wires: `CMSG_GUILD_CREATE` is registered `STATUS_NEVER` on vmangos, and the
+//! only path to a new guild is buy a charter → collect nine signatures → turn it in.
+//!
+//! The server side is pinned at the bytes by vmangos `Server/Packets/Petition.{h,cpp}` (the
+//! `ReadFromWorldPacket` / `AppendBodyTo` pairs) and `Handlers/PetitionsHandler.cpp` (which
+//! packets each handler answers with, and the order of its refusals). **Two of the five
+//! server→client packets are not built through the packet classes at all** —
+//! `SMSG_PETITION_SHOW_SIGNATURES` is hand-assembled at `PetitionsHandler.cpp:160-168` and
+//! `:390-397` — so their layout is read off the handler, not off `Petition.cpp`.
+//!
+//! Four shapes of this family are worth knowing before touching any of it:
+//!
+//! - **The charter is an ITEM, and the petition id rides in its enchantment slot.** Buying stores
+//!   item [`CHARTER_ITEM_ENTRY`] and writes the petition id into `ITEM_FIELD_ENCHANTMENT` slot 0's
+//!   `id` dword (`PetitionsHandler.cpp:126`). That is not a hack the client is unaware of: the
+//!   reference's item tooltip **forces enchantment slot 0 to zero and skips the enchant lines
+//!   entirely** for any item whose template flags carry [`ITEM_FLAG_CHARTER`]
+//!   (`test ah,0x20 / jne 0x52c9ee`, wow-re `system/ui/scratch/tooltip-content-law.md:485-505`).
+//!   So slot 0 on a charter is a petition id by contract on both ends, and nothing may read it as
+//!   a `SpellItemEnchantment.dbc` row.
+//! - **Almost nothing is acked positively.** A successful buy sends **no confirmation packet** —
+//!   the client learns of it only from the `SMSG_ITEM_PUSH_RESULT` for the new item
+//!   (`PetitionsHandler.cpp:130`). Rename echoes only on success (`:209-215`). The refusals come
+//!   back as `SMSG_GUILD_COMMAND_RESULT`, the *guild* family's error channel, reused here.
+//! - **`SMSG_PETITION_SHOW_SIGNATURES` is the answer to two different questions.** It answers our
+//!   own `CMSG_PETITION_SHOW_SIGNATURES` (`:160-168`), and it is also what a *third party* is sent
+//!   when someone offers us their charter (`:390-397`, the `CMSG_OFFER_PETITION` path). One
+//!   inbound packet, two meanings, distinguished only by whether its `owner` is us.
+//! - **The signature limit is enforced three times with three different numbers.** vmangos's
+//!   `MinPetitionSigns` config (clamped 0..=9, `World.cpp:665`) decides when a petition
+//!   `IsComplete()` — with `==`, not `>=` (`GuildMgr.h:124`); the sign handler *separately*
+//!   hard-caps at nine with the comment "Client hard limit at 9 signatures"
+//!   (`PetitionsHandler.cpp:269-271`); and `SMSG_PETITION_QUERY_RESPONSE` reports min = max = 9
+//!   hardcoded (`:182-183`), regardless of the config. [`MAX_PETITION_SIGNATURES`] is that client
+//!   limit; a consumer wanting "how many does this petition need" reads the wire's
+//!   `max_signatures`, not the constant, because on a server with `MinPetitionSigns` lowered the
+//!   two disagree.
+
+use std::io::{self, Read};
+
+use crate::wire::{read_cstring, read_i32_le, read_u16_le, read_u32_le, read_u64_le, read_u8};
+
+/// The one item that is a guild charter — vmangos `GUILD_CHARTER` (`PetitionsHandler.cpp:37`),
+/// also `Item::IsCharter`'s literal (`Item.h:158`, `GetEntry() == 5863u`). Confirmed against this
+/// deployment's world DB: entry 5863 "Guild Charter", display 16161, flags `0x2000`.
+pub const CHARTER_ITEM_ENTRY: u32 = 5863;
+
+/// The charter's inventory display id — vmangos `CHARTER_DISPLAY_ID` (`PetitionsHandler.cpp:38`).
+/// It rides in [`PetitionShowListEntry::charter_display_id`] as well as in the item template, and
+/// the two agree; the packet's copy exists so a vendor list can be drawn before the item is owned.
+pub const CHARTER_DISPLAY_ID: u32 = 16161;
+
+/// `ITEM_FLAG_CHARTER` — the template-flag bit that makes an item a signable petition
+/// (vmangos `ItemPrototype.h:77`). **The reference client keys on this same bit** to print the
+/// green `ITEM_SIGNABLE` tooltip line and to suppress the enchantment lines
+/// (wow-re `system/ui/scratch/tooltip-content-law.md:485-505`), so it is a shared contract rather
+/// than a server-side convenience.
+pub const ITEM_FLAG_CHARTER: u32 = 0x0000_2000;
+
+/// The most signatures a 1.12 charter can hold — vmangos's own "Client hard limit at 9
+/// signatures" (`PetitionsHandler.cpp:269-271`), and the reference FrameXML's
+/// `MAX_PETITION_SIGNATURES = 9` (`PetitionFrame.lua:1`), which sizes the window's name rows.
+///
+/// This is the **row count**, not the requirement: how many a petition needs to be turned in is
+/// [`PetitionQueryResponse::min_signatures`] off the wire, which a server may configure lower.
+pub const MAX_PETITION_SIGNATURES: usize = 9;
+
+/// Charter-name cap, in *characters* — vmangos `MAX_CHARTER_NAME` (`ObjectMgr.h:401`), enforced by
+/// `ObjectMgr::IsValidCharterName` (`ObjectMgr.cpp:9322-9334`) as a UTF-8 length. The reference's
+/// own edit boxes agree: `GuildRegistrarFrameEditBox letters="24"` and the `RENAME_GUILD` popup's
+/// `maxLetters = 24`. Same number as [`super::GUILD_NAME_MAX_LENGTH`], and not a coincidence — a
+/// charter name becomes a guild name.
+pub const CHARTER_NAME_MAX_LENGTH: usize = 24;
+
+/// `SMSG_PETITION_SIGN_RESULTS`' and `SMSG_TURN_IN_PETITION_RESULTS`' shared result code —
+/// vmangos `PetitionSigns` (`Guild/Guild.h:147-154`). One enum, two packets, and the two use
+/// **disjoint subsets** of it, which is why the arms are documented by packet.
+pub mod petition_result {
+    /// Signed, or turned in. Used by both packets.
+    pub const OK: u32 = 0;
+    /// Sign only — this account has already signed this charter. vmangos checks uniqueness **per
+    /// account first**, then per character (`GuildMgr.cpp:388-400`), so a second character on one
+    /// account gets this, not a second signature.
+    pub const ALREADY_SIGNED: u32 = 1;
+    /// Turn-in only — the would-be founder is already in a guild (`PetitionsHandler.cpp:427`).
+    /// Never sent by the sign path, which answers an already-guilded *signer* with an
+    /// `SMSG_GUILD_COMMAND_RESULT` instead (`:258`).
+    pub const ALREADY_IN_GUILD: u32 = 2;
+    /// Sign only — you cannot sign your own charter (`PetitionsHandler.cpp:237`).
+    pub const CANT_SIGN_OWN: u32 = 3;
+    /// Turn-in only — not enough signatures yet (`PetitionsHandler.cpp:438`).
+    pub const NEED_MORE: u32 = 4;
+    /// Not on the same realm. vmangos never sends it (cross-realm charters cannot arise on a
+    /// single-realm server); modelled because the reference has a string for it
+    /// (`ERR_PETITION_NOT_SAME_SERVER`) and the client's switch must have an arm.
+    pub const NOT_SERVER: u32 = 5;
+}
+
+/// One row of `SMSG_PETITION_SHOWLIST` — a charter a petitioner NPC will sell.
+///
+/// vmangos always sends exactly one of these, and its own header says **"only 1 element is
+/// supported in the client"** (`Petition.h:176`). We parse the counted list faithfully anyway: a
+/// count is a count, and a reader that assumes one would desynchronise rather than degrade if it
+/// were ever wrong.
+#[derive(Debug, Clone, PartialEq, Eq, Default)]
+pub struct PetitionShowListEntry {
+    /// Row index, 1-based (`PetitionsHandler.cpp:501`, a literal `1`).
+    pub index: u32,
+    /// The item entry sold — [`CHARTER_ITEM_ENTRY`] in practice.
+    pub charter_entry: u32,
+    /// Its display id — [`CHARTER_DISPLAY_ID`] in practice.
+    pub charter_display_id: u32,
+    /// Price in **copper** (1000 = 10 silver on vmangos, `PetitionsHandler.cpp:39`). Signed on the
+    /// wire (`int32`), which is why it is signed here: a reader that narrows it to `u32` would be
+    /// asserting a range the sender does not.
+    pub charter_cost: i32,
+    /// vmangos sends `1` and its header says the row **"must be `&1` to show it in the UI"**
+    /// (`Petition.h:169`). Kept raw rather than folded into a `bool`: that claim is a *comment*
+    /// about the reference client, not something vmangos itself enforces, and a consumer that
+    /// wants the filter can apply it knowingly.
+    pub entry_flags: i32,
+}
+
+/// `SMSG_PETITION_SHOWLIST` — a petitioner NPC's "here is what I sell" list. In 1.12 that is
+/// always the single guild charter, and this packet is what puts the guild registrar's window on
+/// screen.
+#[derive(Debug, Clone, PartialEq, Eq, Default)]
+pub struct PetitionShowList {
+    /// The NPC we are talking to. Every later verb in the flow that names an NPC uses this guid.
+    pub npc: u64,
+    /// The rows, in wire order. Normally exactly one; see [`PetitionShowListEntry`].
+    pub entries: Vec<PetitionShowListEntry>,
+}
+
+/// Read `SMSG_PETITION_SHOWLIST` (VERIFIED vmangos `Server/Packets/Petition.cpp:115-127`
+/// `PetitionShowList::AppendBodyTo`, filled at `Handlers/PetitionsHandler.cpp:482-507`):
+/// `u64 npcGuid`, `u8 count`, then per row `u32 index`, `u32 charterEntry`, `u32 charterDisplayId`,
+/// `i32 charterCost`, `i32 entryFlags`.
+///
+/// The send is gated on `GetNPCIfCanInteractWith(guid, UNIT_NPC_FLAG_PETITIONER)`
+/// (`:484`; the flag is `0x200`, `Objects/UnitDefines.h:666`), so a list arriving at all is the
+/// server's confirmation that we are in range of a real registrar.
+pub(super) fn read_petition_show_list(r: &mut impl Read) -> io::Result<PetitionShowList> {
+    let npc = read_u64_le(r)?;
+    let count = read_u8(r)?;
+    let mut entries = Vec::with_capacity(count as usize);
+    for _ in 0..count {
+        entries.push(PetitionShowListEntry {
+            index: read_u32_le(r)?,
+            charter_entry: read_u32_le(r)?,
+            charter_display_id: read_u32_le(r)?,
+            charter_cost: read_i32_le(r)?,
+            entry_flags: read_i32_le(r)?,
+        });
+    }
+    Ok(PetitionShowList { npc, entries })
+}
+
+/// One signature on a charter — a signer's guid, and the dword that always follows it.
+#[derive(Debug, Clone, PartialEq, Eq, Default)]
+pub struct PetitionSignature {
+    /// The signing character's guid. Turning it into a *name* is the client's job: the packet
+    /// carries no names at all.
+    pub signer: u64,
+    /// The trailing dword, which vmangos writes as a literal `0`
+    /// (`Guild/GuildMgr.cpp:358-366`, `data << 0`). Kept rather than skipped so the field is
+    /// visible in a dump and a non-zero value from another server would be *noticed* rather than
+    /// silently consumed.
+    pub unknown: u32,
+}
+
+/// `SMSG_PETITION_SHOW_SIGNATURES` — who has signed a charter. **The answer to two different
+/// questions** (module doc): our own `CMSG_PETITION_SHOW_SIGNATURES`, and someone else's
+/// `CMSG_OFFER_PETITION` aimed at us.
+///
+/// Note what is *not* here: the guild name, the body text, and the signature requirement. Those
+/// live only in `SMSG_PETITION_QUERY_RESPONSE`, keyed by [`Self::petition_id`] — the same
+/// two-caches shape [`super::guild`] has, where the roster carries no guild name.
+#[derive(Debug, Clone, PartialEq, Eq, Default)]
+pub struct PetitionShowSignatures {
+    /// The charter **item's** guid — the handle every later verb takes (sign, offer, rename, turn
+    /// in, decline). Not the petition id.
+    pub item: u64,
+    /// The charter owner's character guid. Whether this is us is what makes the window the
+    /// leader's view or a signer's view.
+    pub owner: u64,
+    /// The petition id — the key `CMSG_PETITION_QUERY` takes, and the same value the charter
+    /// item's enchantment slot 0 carries (module doc).
+    pub petition_id: u32,
+    /// The signatures so far, in wire order.
+    pub signatures: Vec<PetitionSignature>,
+}
+
+/// Read `SMSG_PETITION_SHOW_SIGNATURES` (VERIFIED vmangos `Handlers/PetitionsHandler.cpp:160-168`
+/// and `:390-397`, which build it **by hand** rather than through a packet class):
+/// `u64 itemGuid`, `u64 ownerGuid`, `u32 petitionId`, `u8 signatureCount`, then per signature
+/// `u64 signerGuid` + `u32 0`.
+///
+/// The 12-byte stride is corroborated by the sender's own size hint `8+8+4+1 + signs*12` and by
+/// `Guild/GuildMgr.cpp:358-366` (`Petition::BuildSignatureData`).
+pub(super) fn read_petition_show_signatures(
+    r: &mut impl Read,
+) -> io::Result<PetitionShowSignatures> {
+    let item = read_u64_le(r)?;
+    let owner = read_u64_le(r)?;
+    let petition_id = read_u32_le(r)?;
+    let count = read_u8(r)?;
+    let mut signatures = Vec::with_capacity(count as usize);
+    for _ in 0..count {
+        signatures.push(PetitionSignature {
+            signer: read_u64_le(r)?,
+            unknown: read_u32_le(r)?,
+        });
+    }
+    Ok(PetitionShowSignatures {
+        item,
+        owner,
+        petition_id,
+        signatures,
+    })
+}
+
+/// `SMSG_PETITION_SIGN_RESULTS` — the verdict on one signature attempt.
+///
+/// **It is sent to both parties on success**: once to the signer (`PetitionsHandler.cpp:299`) and
+/// again, identical, to the charter's owner if they are online (`:312-316`). Both copies name the
+/// *signer* in [`Self::player`], so a receiver cannot tell the two apart from this packet alone —
+/// only from whether it holds that charter.
+#[derive(Debug, Clone, PartialEq, Eq, Default)]
+pub struct PetitionSignResults {
+    /// The charter item's guid.
+    pub item: u64,
+    /// The **signer's** guid — in both copies of the packet, per the doc above.
+    pub player: u64,
+    /// A [`petition_result`] code.
+    pub result: u32,
+}
+
+/// Read `SMSG_PETITION_SIGN_RESULTS` (VERIFIED vmangos `Server/Packets/Petition.cpp:69-74`
+/// `PetitionSignResults::AppendBodyTo`): `u64 itemGuid`, `u64 playerGuid`, `u32 result`.
+pub(super) fn read_petition_sign_results(r: &mut impl Read) -> io::Result<PetitionSignResults> {
+    Ok(PetitionSignResults {
+        item: read_u64_le(r)?,
+        player: read_u64_le(r)?,
+        result: read_u32_le(r)?,
+    })
+}
+
+/// `SMSG_PETITION_QUERY_RESPONSE` — a petition's own record, keyed by petition id.
+///
+/// Sixteen fields, of which vmangos fills three with anything but a constant, and whose own header
+/// says *"all those fields below don't really change anything in the UI"* (`Petition.h:126`). They
+/// are parsed in full regardless: the trailing `choice` list is length-prefixed, so skipping the
+/// middle would make the tail unreadable, and a field that is constant on this server is not
+/// thereby constant on the wire.
+#[derive(Debug, Clone, PartialEq, Eq, Default)]
+pub struct PetitionQueryResponse {
+    /// The petition id we asked about.
+    pub petition_id: u32,
+    /// The charter owner's character guid.
+    pub owner: u64,
+    /// The proposed guild's name. This is the only place it exists on the wire.
+    pub name: String,
+    /// Free text on the charter — always empty on vmangos (`PetitionsHandler.cpp:178`).
+    pub body_text: String,
+    /// vmangos sends `1` (`:179`). Meaning unknown; kept because it is a real wire field.
+    pub flags: u32,
+    /// How many signatures are **required**. vmangos hardcodes 9 here even when its
+    /// `MinPetitionSigns` config is lower (module doc), so this is the number the reference's
+    /// Request-Signature button disables against, and it need not equal
+    /// [`MAX_PETITION_SIGNATURES`].
+    pub min_signatures: u32,
+    /// How many signatures fit. vmangos hardcodes 9 (`:183`).
+    pub max_signatures: u32,
+    /// Deadline timestamp — `0` on vmangos.
+    pub deadline: u32,
+    /// Creation timestamp — `0` on vmangos.
+    pub creation: u32,
+    /// Restricting guild id — `0` on vmangos.
+    pub allowed_guild_id: u32,
+    /// Class mask restriction — `0` on vmangos.
+    pub allowed_classes: u32,
+    /// Race mask restriction — `0` on vmangos.
+    pub allowed_races: u32,
+    /// Gender restriction — **`u16` on the wire, not `u32`** (`Petition.cpp:94`). The one odd
+    /// width in the packet, and misreading it as a dword shifts every field after it by two bytes.
+    pub allowed_gender: u16,
+    /// Minimum level — `0` on vmangos.
+    pub allowed_min_level: u32,
+    /// Maximum level — `0` on vmangos.
+    pub allowed_max_level: u32,
+    /// The multiple-choice options this petition offers — always empty on vmangos, and the reason
+    /// the tail cannot be skipped: the count is what says where `default_choice` starts.
+    pub choices: Vec<String>,
+    /// Which choice is pre-selected — `0` on vmangos.
+    pub default_choice: u32,
+}
+
+/// Read `SMSG_PETITION_QUERY_RESPONSE` (VERIFIED vmangos `Server/Packets/Petition.cpp:81-102`
+/// `PetitionQueryResponse::AppendBodyTo`, filled at `Handlers/PetitionsHandler.cpp:177-184`):
+/// `u32 petitionId`, `u64 ownerGuid`, cstring name, cstring bodyText, `u32 flags`,
+/// `u32 minSignatures`, `u32 maxSignatures`, `u32 deadline`, `u32 creation`, `u32 allowedGuildID`,
+/// `u32 allowedClasses`, `u32 allowedRaces`, **`u16 allowedGender`**, `u32 allowedMinLevel`,
+/// `u32 allowedMaxLevel`, `u32 choiceCount`, `choiceCount ×` cstring, `u32 defaultChoice`.
+///
+/// The `u16` in the middle is the trap: see [`PetitionQueryResponse::allowed_gender`].
+pub(super) fn read_petition_query_response(r: &mut impl Read) -> io::Result<PetitionQueryResponse> {
+    let petition_id = read_u32_le(r)?;
+    let owner = read_u64_le(r)?;
+    let name = read_cstring(r)?;
+    let body_text = read_cstring(r)?;
+    let flags = read_u32_le(r)?;
+    let min_signatures = read_u32_le(r)?;
+    let max_signatures = read_u32_le(r)?;
+    let deadline = read_u32_le(r)?;
+    let creation = read_u32_le(r)?;
+    let allowed_guild_id = read_u32_le(r)?;
+    let allowed_classes = read_u32_le(r)?;
+    let allowed_races = read_u32_le(r)?;
+    let allowed_gender = read_u16_le(r)?;
+    let allowed_min_level = read_u32_le(r)?;
+    let allowed_max_level = read_u32_le(r)?;
+    let choice_count = read_u32_le(r)?;
+    let mut choices = Vec::with_capacity(choice_count.min(64) as usize);
+    for _ in 0..choice_count {
+        choices.push(read_cstring(r)?);
+    }
+    Ok(PetitionQueryResponse {
+        petition_id,
+        owner,
+        name,
+        body_text,
+        flags,
+        min_signatures,
+        max_signatures,
+        deadline,
+        creation,
+        allowed_guild_id,
+        allowed_classes,
+        allowed_races,
+        allowed_gender,
+        allowed_min_level,
+        allowed_max_level,
+        choices,
+        default_choice: read_u32_le(r)?,
+    })
+}
+
+/// `MSG_PETITION_RENAME` — the server's echo of a successful rename.
+///
+/// Sent **only on success** (`PetitionsHandler.cpp:209-215`); a rejected name comes back as an
+/// `SMSG_GUILD_COMMAND_RESULT` instead. Note the handler does **no ownership check** — anyone
+/// holding the item may rename it.
+#[derive(Debug, Clone, PartialEq, Eq, Default)]
+pub struct PetitionRename {
+    /// The charter item's guid.
+    pub item: u64,
+    /// Its new name.
+    pub name: String,
+}
+
+/// Read `MSG_PETITION_RENAME` (VERIFIED vmangos `Server/Packets/Petition.cpp:104-108`
+/// `PetitionRename::AppendBodyTo`): `u64 itemGuid`, cstring newName. The same two fields the
+/// client sends, in the same order — which is what makes it an `MSG_` rather than a pair.
+pub(super) fn read_petition_rename(r: &mut impl Read) -> io::Result<PetitionRename> {
+    Ok(PetitionRename {
+        item: read_u64_le(r)?,
+        name: read_cstring(r)?,
+    })
+}
+
+/// Read `SMSG_TURN_IN_PETITION_RESULTS` (VERIFIED vmangos `Server/Packets/Petition.cpp:76-79`
+/// `TurnInPetitionResults::AppendBodyTo`): one `u32`, a [`petition_result`] code — and **only** the
+/// code. Which charter it refers to is implicit; there can be only one in flight.
+///
+/// The three codes vmangos actually sends here are [`petition_result::OK`] (`:473`),
+/// [`petition_result::ALREADY_IN_GUILD`] (`:427`) and [`petition_result::NEED_MORE`] (`:438`). A
+/// name collision is reported as `SMSG_GUILD_COMMAND_RESULT` instead and produces no results
+/// packet at all (`:445`), so "no answer" is a real outcome of a turn-in.
+pub(super) fn read_turn_in_petition_results(r: &mut impl Read) -> io::Result<u32> {
+    read_u32_le(r)
+}
+
+/// Read `MSG_PETITION_DECLINE`'s **inbound** form (VERIFIED vmangos
+/// `Server/Packets/Petition.cpp:110-113` `PetitionDecline::AppendBodyTo`): one `u64`, the guid of
+/// the player who declined. Delivered only to the charter's owner
+/// (`Handlers/PetitionsHandler.cpp:321-338`).
+///
+/// The outbound form of the same opcode carries the *item* guid instead
+/// ([`petition_decline`]) — one opcode, two different bodies by direction, which is what `MSG_`
+/// means here.
+pub(super) fn read_petition_decline(r: &mut impl Read) -> io::Result<u64> {
+    read_u64_le(r)
+}
+
+/// Body of `CMSG_PETITION_SHOWLIST` (VERIFIED vmangos `Server/Packets/Petition.cpp:3-6`
+/// `PetitionShowListRequest::ReadFromWorldPacket`): one `u64`, the petitioner NPC's guid.
+///
+/// Answered by `SMSG_PETITION_SHOWLIST`, or by nothing at all if the NPC is out of range or lacks
+/// `UNIT_NPC_FLAG_PETITIONER` (`Handlers/PetitionsHandler.cpp:484`). The server also sends that
+/// answer unasked when a `GOSSIP_OPTION_PETITIONER` row is selected (`Player.cpp:12428-12431`), so
+/// this request is the *second* way in, not the only one.
+pub fn petition_show_list(npc: u64) -> Vec<u8> {
+    npc.to_le_bytes().to_vec()
+}
+
+/// Body of `CMSG_PETITION_BUY` (VERIFIED vmangos `Server/Packets/Petition.cpp:47-67`
+/// `PetitionBuy::ReadFromWorldPacket`) — **72 bytes, of which the server reads exactly two
+/// fields**: the NPC guid at offset 0 and the name at offset 20. Everything else is skipped.
+///
+/// The shape is a generic multi-choice petition struct that never shipped: `u64 npcGuid`,
+/// `u32 0`, `u64 0`, cstring name, `10 × u32 0`, `u16 0`, `u8 0`, `u32 index`, `u32 0`. We send
+/// zeros for every skipped field — including `index`, which the server's own comment calls
+/// "unused" — because a field nobody reads has no correct non-zero value, and a zero is the one
+/// choice that cannot encode an accident.
+///
+/// The refusal ladder is worth knowing, because none of it is a petition packet: an already-taken
+/// or invalid name answers `SMSG_GUILD_COMMAND_RESULT(GUILD_CREATE_S, name, …)`
+/// (`Handlers/PetitionsHandler.cpp:78`, `:83`, `:93`), too little money answers `SMSG_BUY_FAILED`
+/// (`:108`), a full bag answers `SMSG_INVENTORY_CHANGE_FAILURE` (`:116`) — and **success answers
+/// nothing but the new item** (`:130`).
+pub fn petition_buy(npc: u64, name: &str) -> Vec<u8> {
+    let mut body = Vec::with_capacity(72 + name.len());
+    body.extend_from_slice(&npc.to_le_bytes());
+    body.extend_from_slice(&0u32.to_le_bytes());
+    body.extend_from_slice(&0u64.to_le_bytes());
+    push_cstring(&mut body, name);
+    body.extend_from_slice(&[0u8; 40]); // 10 × u32
+    body.extend_from_slice(&0u16.to_le_bytes());
+    body.push(0);
+    body.extend_from_slice(&0u32.to_le_bytes()); // index — the server's own "unused"
+    body.extend_from_slice(&0u32.to_le_bytes());
+    body
+}
+
+/// Body of `CMSG_PETITION_SHOW_SIGNATURES` (VERIFIED vmangos `Server/Packets/Petition.cpp:8-11`
+/// `PetitionShowSignaturesRequest::ReadFromWorldPacket`): one `u64`, the charter **item's** guid.
+///
+/// Answered with `SMSG_PETITION_SHOW_SIGNATURES` — or silently dropped if we are already in a
+/// guild (`Handlers/PetitionsHandler.cpp:140`) or do not hold that item (`:143`).
+pub fn petition_show_signatures(item: u64) -> Vec<u8> {
+    item.to_le_bytes().to_vec()
+}
+
+/// Body of `CMSG_PETITION_SIGN` (VERIFIED vmangos `Server/Packets/Petition.cpp:35-39`
+/// `PetitionSign::ReadFromWorldPacket`): `u64 itemGuid` then one `i8` the server **skips**, whose
+/// own vmangos comment is *"argument of `/run SignPetition(123)` is never used in the official
+/// interface"*.
+///
+/// **The client's default for that byte is `1`, not `0`** — `SignPetition`'s optional Lua argument
+/// initialises `edi = 1` at `0x4f46d9` and the byte goes out through `Put8` at `0x4f4749` (wow-re
+/// `system/ui/scratch/petition-charter-api.md`). Since the server reads and discards it, **nothing
+/// observable depends on the value**, which is exactly why it shipped here as `0` and why only a
+/// golden can tell the difference.
+pub fn petition_sign(item: u64, arg: i8) -> Vec<u8> {
+    let mut body = Vec::with_capacity(9);
+    body.extend_from_slice(&item.to_le_bytes());
+    body.push(arg as u8);
+    body
+}
+
+/// Body of `CMSG_OFFER_PETITION` (VERIFIED vmangos `Server/Packets/Petition.cpp:41-45`
+/// `OfferPetition::ReadFromWorldPacket`): `u64 itemGuid`, `u64 playerGuid` — the charter, and who
+/// to show it to.
+///
+/// On success the server sends `SMSG_PETITION_SHOW_SIGNATURES` **to the target**, not back to us
+/// (`Handlers/PetitionsHandler.cpp:390-397`); we hear only about refusals, as
+/// `SMSG_GUILD_COMMAND_RESULT`.
+pub fn offer_petition(item: u64, player: u64) -> Vec<u8> {
+    let mut body = Vec::with_capacity(16);
+    body.extend_from_slice(&item.to_le_bytes());
+    body.extend_from_slice(&player.to_le_bytes());
+    body
+}
+
+/// Body of `CMSG_TURN_IN_PETITION` (VERIFIED vmangos `Server/Packets/Petition.cpp:24-27`
+/// `TurnInPetition::ReadFromWorldPacket`): one `u64`, the charter item's guid.
+///
+/// Only the petition's **owner** may turn it in; anyone else is refused silently
+/// (`Handlers/PetitionsHandler.cpp:432`). On success the guild is created with every signer as a
+/// member at the lowest rank, the petition row is deleted, and *then* the item is destroyed — in
+/// that order, because destroying a charter cascades into deleting its petition
+/// (`Player.cpp:10811-10817`).
+pub fn turn_in_petition(item: u64) -> Vec<u8> {
+    item.to_le_bytes().to_vec()
+}
+
+/// Body of `CMSG_PETITION_QUERY` (VERIFIED vmangos `Server/Packets/Petition.cpp:13-17`
+/// `PetitionQuery::ReadFromWorldPacket`): `u32 petitionId`, `u64 itemGuid`.
+///
+/// The item guid is **read and then ignored** by the handler (`Handlers/PetitionsHandler.cpp:171-185`),
+/// which looks the petition up by id alone. Sent anyway, at its true value: a field the current
+/// server does not use is not a field to fill with garbage.
+pub fn petition_query(petition_id: u32, item: u64) -> Vec<u8> {
+    let mut body = Vec::with_capacity(12);
+    body.extend_from_slice(&petition_id.to_le_bytes());
+    body.extend_from_slice(&item.to_le_bytes());
+    body
+}
+
+/// Body of `MSG_PETITION_RENAME`'s **outbound** form (VERIFIED vmangos
+/// `Server/Packets/Petition.cpp:29-33` `PetitionRename::ReadFromWorldPacket`): `u64 itemGuid`,
+/// cstring newName.
+///
+/// Echoed back as the same two fields on success ([`read_petition_rename`]); rejected names come
+/// back as `SMSG_GUILD_COMMAND_RESULT` and no echo. The name is capped at
+/// [`CHARTER_NAME_MAX_LENGTH`] characters by the server's own validator — not truncated here, for
+/// the reason [`super::guild`]'s caps give: silently shortening sends the wrong text.
+pub fn petition_rename(item: u64, name: &str) -> Vec<u8> {
+    let mut body = Vec::with_capacity(9 + name.len());
+    body.extend_from_slice(&item.to_le_bytes());
+    push_cstring(&mut body, name);
+    body
+}
+
+/// Body of `MSG_PETITION_DECLINE`'s **outbound** form (VERIFIED vmangos
+/// `Server/Packets/Petition.cpp:19-22` `PetitionDecline::ReadFromWorldPacket`): one `u64`, the
+/// charter item's guid. The server forwards our guid to the charter's owner
+/// ([`read_petition_decline`]).
+pub fn petition_decline(item: u64) -> Vec<u8> {
+    item.to_le_bytes().to_vec()
+}
+
+/// Append a NUL-terminated string to `body`.
+fn push_cstring(body: &mut Vec<u8>, s: &str) {
+    body.extend_from_slice(s.as_bytes());
+    body.push(0);
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    /// `CMSG_PETITION_BUY`'s body is a fixed 72 bytes plus the name — the shape vmangos's reader
+    /// walks field by field. A body one byte short leaves the reader mid-field and the buy is
+    /// silently dropped, which is exactly the failure this pins.
+    #[test]
+    fn petition_buy_body_is_seventy_two_bytes_plus_the_name() {
+        let body = petition_buy(0x1234_5678_9abc_def0, "Test");
+        // 8 npc + 4 + 8 + (4+1) name + 40 + 2 + 1 + 4 + 4
+        assert_eq!(body.len(), 72 + 4, "72 fixed bytes + a 4-char name");
+        assert_eq!(
+            petition_buy(0, "").len(),
+            72,
+            "the empty name still costs its NUL"
+        );
+    }
+
+    /// The charter constants are a shared contract between server and reference client, not
+    /// vmangos policy — the tooltip's signable branch keys on the same `0x2000`.
+    #[test]
+    fn charter_constants_match_the_world_data() {
+        assert_eq!(CHARTER_ITEM_ENTRY, 5863);
+        assert_eq!(CHARTER_DISPLAY_ID, 16161);
+        assert_eq!(ITEM_FLAG_CHARTER, 0x2000);
+        assert_eq!(CHARTER_NAME_MAX_LENGTH, super::super::GUILD_NAME_MAX_LENGTH);
+    }
+}
diff --git a/crates/benilla-protocol/src/world/writer/mod.rs b/crates/benilla-protocol/src/world/writer/mod.rs
index 2b517ac4..3d298ba6 100644
--- a/crates/benilla-protocol/src/world/writer/mod.rs
+++ b/crates/benilla-protocol/src/world/writer/mod.rs
@@ -76,6 +76,7 @@ mod loot;
 mod mail;
 mod names;
 mod pet;
+mod petition;
 mod player_flags;
 mod pose;
 mod progression;
diff --git a/crates/benilla-protocol/src/world/writer/petition.rs b/crates/benilla-protocol/src/world/writer/petition.rs
new file mode 100644
index 00000000..6c023bea
--- /dev/null
+++ b/crates/benilla-protocol/src/world/writer/petition.rs
@@ -0,0 +1,153 @@
+//! The petition family's `WorldWriter` sends — buying a guild charter, showing it, signing it,
+//! offering it, renaming it and turning it in (decision 1672).
+//!
+//! [`super::guild`] is *being* in a guild; this is *founding* one, and at 1.12 the two share only
+//! their error channel. Three shapes bind every caller here:
+//!
+//! - **A charter is addressed by its ITEM guid**, not by a petition id — sign, offer, rename,
+//!   decline and turn-in all take the item. The petition *id* appears in exactly one place,
+//!   [`WorldWriter::petition_query`], and it is not derivable from the item without either a
+//!   preceding `SMSG_PETITION_SHOW_SIGNATURES` or a read of the item's enchantment slot 0
+//!   (see [`crate::messages::petition`]'s module doc).
+//! - **Success is mostly silent.** Buying answers with nothing but the new item; offering answers
+//!   the *target*, not us; renaming echoes only if it took. What comes back on a refusal is an
+//!   `SMSG_GUILD_COMMAND_RESULT`, borrowed from the guild family — so a caller that only listens
+//!   for petition opcodes will see a failed verb as a hang.
+//! - **Every one of these can be refused silently** by a range or ownership check the client
+//!   cannot see (`GetNPCIfCanInteractWith`, "do we hold that item", "are we the owner"). None of
+//!   them is safe to treat as applied at the send.
+
+use anyhow::Result;
+
+use crate::messages::{self, opcode};
+
+use super::WorldWriter;
+
+impl WorldWriter {
+    /// Ask a petitioner NPC what charters it sells (`CMSG_PETITION_SHOWLIST`), answered by
+    /// `SMSG_PETITION_SHOWLIST`.
+    ///
+    /// This is the **second** way that answer arrives: selecting the NPC's
+    /// `GOSSIP_OPTION_PETITIONER` row makes the server close the gossip menu and push the same
+    /// packet unasked (`Player.cpp:12428-12431`). So a client that only ever talks through gossip
+    /// never needs this send — it is here for the direct re-open, and because the opcode exists.
+    pub fn petition_show_list(&mut self, npc: u64) -> Result<()> {
+        self.send(
+            opcode::CMSG_PETITION_SHOWLIST,
+            &messages::petition_show_list(npc),
+        )
+    }
+
+    /// Buy a guild charter from a petitioner NPC (`CMSG_PETITION_BUY`) under the given name.
+    ///
+    /// **Nothing acknowledges a successful buy.** The server takes the money, stores item
+    /// [`messages::CHARTER_ITEM_ENTRY`] and sends only the ordinary `SMSG_ITEM_PUSH_RESULT`
+    /// (`Handlers/PetitionsHandler.cpp:130`). A refusal, by contrast, is loud and arrives on three
+    /// *different* opcodes depending on which check failed: `SMSG_GUILD_COMMAND_RESULT` for a
+    /// taken or invalid name, `SMSG_BUY_FAILED` for too little money, `SMSG_INVENTORY_CHANGE_FAILURE`
+    /// for a full bag.
+    ///
+    /// The name is capped at [`messages::CHARTER_NAME_MAX_LENGTH`] characters by the server's own
+    /// validator; the caller enforces that at the edit box, as the reference does, rather than
+    /// truncating here.
+    pub fn petition_buy(&mut self, npc: u64, name: &str) -> Result<()> {
+        self.send(
+            opcode::CMSG_PETITION_BUY,
+            &messages::petition_buy(npc, name),
+        )
+    }
+
+    /// Open a charter and see who has signed it (`CMSG_PETITION_SHOW_SIGNATURES`), answered by
+    /// `SMSG_PETITION_SHOW_SIGNATURES`.
+    ///
+    /// Dropped **silently** if we are already in a guild or do not hold that item
+    /// (`Handlers/PetitionsHandler.cpp:140`, `:143`), so a caller must not wait on the answer as
+    /// though it were guaranteed.
+    pub fn petition_show_signatures(&mut self, item: u64) -> Result<()> {
+        self.send(
+            opcode::CMSG_PETITION_SHOW_SIGNATURES,
+            &messages::petition_show_signatures(item),
+        )
+    }
+
+    /// Sign somebody's charter (`CMSG_PETITION_SIGN`), answered by `SMSG_PETITION_SIGN_RESULTS` —
+    /// which the server sends to the **owner too**, identical, with the signer's guid in both
+    /// copies.
+    ///
+    /// Not every refusal comes back on that opcode: an already-guilded or cross-faction signer is
+    /// answered with an `SMSG_GUILD_COMMAND_RESULT` instead
+    /// (`Handlers/PetitionsHandler.cpp:252`, `:258`).
+    /// `arg` is the byte the optional Lua argument rides on; the client's own default is `1`.
+    pub fn petition_sign(&mut self, item: u64, arg: i8) -> Result<()> {
+        self.send(
+            opcode::CMSG_PETITION_SIGN,
+            &messages::petition_sign(item, arg),
+        )
+    }
+
+    /// Show our charter to another player so they can sign it (`CMSG_OFFER_PETITION`).
+    ///
+    /// The success path answers **them**, not us: the server sends *the target* an
+    /// `SMSG_PETITION_SHOW_SIGNATURES` (`Handlers/PetitionsHandler.cpp:390-397`). We hear only
+    /// about refusals, as `SMSG_GUILD_COMMAND_RESULT`. So there is nothing local to update on the
+    /// send, and no answer to wait for.
+    pub fn offer_petition(&mut self, item: u64, player: u64) -> Result<()> {
+        self.send(
+            opcode::CMSG_OFFER_PETITION,
+            &messages::offer_petition(item, player),
+        )
+    }
+
+    /// Turn a completed charter in to a guild registrar (`CMSG_TURN_IN_PETITION`), answered by
+    /// `SMSG_TURN_IN_PETITION_RESULTS`.
+    ///
+    /// Only the charter's **owner** may do this; anyone else is refused silently
+    /// (`Handlers/PetitionsHandler.cpp:432`). And a guild-name collision answers with an
+    /// `SMSG_GUILD_COMMAND_RESULT` and **no results packet at all** (`:445`) — so the absence of a
+    /// result is itself an outcome, not a dropped packet.
+    ///
+    /// On success the guild is created with every signer as a member, and the charter item is
+    /// destroyed — which arrives as an ordinary inventory update, plus the guild family's own
+    /// roster push.
+    pub fn turn_in_petition(&mut self, item: u64) -> Result<()> {
+        self.send(
+            opcode::CMSG_TURN_IN_PETITION,
+            &messages::turn_in_petition(item),
+        )
+    }
+
+    /// Ask for a petition's record by id (`CMSG_PETITION_QUERY`), answered by
+    /// `SMSG_PETITION_QUERY_RESPONSE` — the **only** packet that carries the proposed guild's name
+    /// and the signature requirement.
+    ///
+    /// The `item` field is read and then ignored by vmangos, which looks the petition up by id
+    /// alone (`Handlers/PetitionsHandler.cpp:171-185`); it is sent at its true value anyway.
+    pub fn petition_query(&mut self, petition_id: u32, item: u64) -> Result<()> {
+        self.send(
+            opcode::CMSG_PETITION_QUERY,
+            &messages::petition_query(petition_id, item),
+        )
+    }
+
+    /// Rename a charter (`MSG_PETITION_RENAME`), echoed back **only if it took**; a rejected name
+    /// comes back as an `SMSG_GUILD_COMMAND_RESULT` and no echo.
+    ///
+    /// vmangos does **no ownership check** here — anyone holding the item may rename it
+    /// (`Handlers/PetitionsHandler.cpp:187-216`).
+    pub fn petition_rename(&mut self, item: u64, name: &str) -> Result<()> {
+        self.send(
+            opcode::MSG_PETITION_RENAME,
+            &messages::petition_rename(item, name),
+        )
+    }
+
+    /// Decline a charter someone offered us (`MSG_PETITION_DECLINE`). We send the charter's item
+    /// guid; the server forwards **our** guid to its owner, which is why one opcode has two
+    /// bodies.
+    pub fn petition_decline(&mut self, item: u64) -> Result<()> {
+        self.send(
+            opcode::MSG_PETITION_DECLINE,
+            &messages::petition_decline(item),
+        )
+    }
+}
diff --git a/crates/benilla-protocol/tests/petition.rs b/crates/benilla-protocol/tests/petition.rs
new file mode 100644
index 00000000..ebeed018
--- /dev/null
+++ b/crates/benilla-protocol/tests/petition.rs
@@ -0,0 +1,386 @@
+//! Golden tests for the petition opcode family — the guild-charter flow that founds a guild
+//! (decision 1672). CMSG bodies are asserted byte-exact against the builder output; SMSG bodies are
+//! hand-built per the vmangos layouts (cited inline) and round-tripped through `parse_server` +
+//! `decode`. See `tests/common` for the shared `hx()` helper and methodology note.
+//!
+//! Four of the tests exist for a specific failure mode rather than for coverage, and each was
+//! mutation-checked — the code was broken that exact way and the test observed to fail:
+//!
+//! - `petition_buy_body_is_the_full_seventy_two_byte_frame` — vmangos's reader walks 72 fixed bytes
+//!   field by field and never checks the remainder, so a body one field short leaves it reading
+//!   garbage and the buy is dropped **silently**. There is no error packet for a malformed buy.
+//! - `petition_query_response_gender_is_sixteen_bit` — the one odd width in the family. Read as a
+//!   `u32`, every field after it shifts by two bytes and the choice count becomes a huge number.
+//! - `petition_show_signatures_stride_is_twelve_bytes` — the trailing zero dword per signature is
+//!   easy to omit; a nine-signature charter then reads eight signers and a truncation error, and a
+//!   two-signature fixture would still pass.
+//! - `msg_petition_opcodes_read_a_different_body_than_they_write` — the two `MSG_` opcodes are
+//!   genuinely asymmetric (decline sends an item guid and receives a player guid), which is exactly
+//!   the shape a shared body type would paper over.
+
+mod common;
+
+use benilla_protocol::events::{decode, SessionEvent};
+use benilla_protocol::messages::{
+    self, opcode, petition_result, CHARTER_DISPLAY_ID, CHARTER_ITEM_ENTRY, MAX_PETITION_SIGNATURES,
+};
+use benilla_protocol::ServerPacket;
+use common::hx;
+
+/// Every CMSG builder in the family, byte-exact.
+#[test]
+fn cmsg_bodies_golden() {
+    // CMSG_PETITION_SHOWLIST (vmangos Server/Packets/Petition.cpp:3-6): one u64, the NPC.
+    assert_eq!(
+        messages::petition_show_list(0x0000_0000_0000_2a1f),
+        hx("1f2a000000000000"),
+        "CMSG_PETITION_SHOWLIST body"
+    );
+
+    // CMSG_PETITION_SHOW_SIGNATURES (Petition.cpp:8-11): one u64, the charter ITEM.
+    assert_eq!(
+        messages::petition_show_signatures(0x0000_0000_0001_0203),
+        hx("0302010000000000"),
+        "CMSG_PETITION_SHOW_SIGNATURES body"
+    );
+
+    // CMSG_TURN_IN_PETITION (Petition.cpp:24-27): one u64, the item.
+    assert_eq!(
+        messages::turn_in_petition(0x0000_0000_0001_0203),
+        hx("0302010000000000"),
+        "CMSG_TURN_IN_PETITION body"
+    );
+
+    // MSG_PETITION_DECLINE outbound (Petition.cpp:19-22): one u64 — the ITEM, not the player.
+    assert_eq!(
+        messages::petition_decline(0x0000_0000_0001_0203),
+        hx("0302010000000000"),
+        "MSG_PETITION_DECLINE body"
+    );
+
+    // CMSG_PETITION_SIGN (Petition.cpp:35-39): u64 item, then an i8 the server reads and skips.
+    // The client's own default for that byte is 1, not 0 (`0x4f46d9`) — and because the server
+    // discards it, this golden is the ONLY thing that can tell the two apart.
+    assert_eq!(
+        messages::petition_sign(0x0000_0000_0001_0203, 1),
+        hx("030201000000000001"),
+        "CMSG_PETITION_SIGN body, the client's default byte"
+    );
+    assert_eq!(
+        messages::petition_sign(0x0000_0000_0001_0203, -1),
+        hx("0302010000000000ff"),
+        "…and a negative argument rides as its two's complement"
+    );
+
+    // CMSG_OFFER_PETITION (Petition.cpp:41-45): u64 item, u64 target player.
+    assert_eq!(
+        messages::offer_petition(0x0000_0000_0001_0203, 0x0000_0000_0000_00aa),
+        hx("0302010000000000aa00000000000000"),
+        "CMSG_OFFER_PETITION body"
+    );
+
+    // CMSG_PETITION_QUERY (Petition.cpp:13-17): u32 petitionId, u64 itemGuid.
+    assert_eq!(
+        messages::petition_query(7, 0x0000_0000_0001_0203),
+        hx("070000000302010000000000"),
+        "CMSG_PETITION_QUERY body"
+    );
+
+    // MSG_PETITION_RENAME outbound (Petition.cpp:29-33): u64 item, cstring newName.
+    assert_eq!(
+        messages::petition_rename(0x0000_0000_0001_0203, "Legacy"),
+        hx("03020100000000004c656761637900"),
+        "MSG_PETITION_RENAME body"
+    );
+}
+
+/// `CMSG_PETITION_BUY` is 72 fixed bytes plus the name's, laid out exactly as vmangos's reader
+/// walks them (`Server/Packets/Petition.cpp:47-67`): `u64 npc`, `u32 0`, `u64 0`, cstring name,
+/// `10 × u32 0`, `u16 0`, `u8 0`, `u32 index`, `u32 0`.
+///
+/// **Mutation-checked.** Dropping any one of the skipped fields still compiles, still sends, and is
+/// answered by nothing at all — the server reads past the end, `IsValidCharterName` sees garbage or
+/// the handler returns, and no error packet exists for a malformed buy. This test is the only thing
+/// between that and a "the Purchase button does nothing" report.
+#[test]
+fn petition_buy_body_is_the_full_seventy_two_byte_frame() {
+    let body = messages::petition_buy(0x0000_0000_0000_2a1f, "Legacy");
+    assert_eq!(
+        body,
+        hx(concat!(
+            "1f2a000000000000", // u64 npcGuid
+            "00000000",         // u32 skipped
+            "0000000000000000", // u64 skipped
+            "4c656761637900",   // cstring "Legacy"
+            // 10 × u32 skipped
+            "00000000000000000000000000000000000000000000000000000000000000000000000000000000",
+            "0000",     // u16 skipped
+            "00",       // u8 skipped
+            "00000000", // u32 index — the server's own "unused"
+            "00000000", // u32 skipped
+        )),
+        "CMSG_PETITION_BUY body"
+    );
+    assert_eq!(body.len(), 72 + "Legacy".len(), "72 fixed bytes + the name");
+
+    // The name is the only variable-length part, and it sits at offset 20 — where the server's
+    // reader arrives after skipping 8 + 4 + 8 bytes.
+    assert_eq!(
+        &body[20..27],
+        b"Legacy\0",
+        "the name starts at offset 20, NUL-terminated"
+    );
+}
+
+/// `SMSG_PETITION_SHOWLIST` — the packet that opens the guild registrar. Layout from
+/// `Server/Packets/Petition.cpp:115-127`, values from `Handlers/PetitionsHandler.cpp:482-507`.
+///
+/// The list is **counted**, and parsed as one even though vmangos's own header says the reference
+/// client supports only one row: a reader that assumed one would desynchronise rather than degrade
+/// if a server ever sent two. The fixture sends two for exactly that reason.
+#[test]
+fn petition_show_list_parses_a_counted_list() {
+    let body = hx(concat!(
+        "1f2a000000000000", // u64 npcGuid
+        "02",               // u8 count — deliberately not vmangos's 1
+        // row 1: index 1, entry 5863, display 16161, cost 1000, flags 1
+        "01000000",
+        "e7160000",
+        "213f0000",
+        "e8030000",
+        "01000000",
+        // row 2: index 2, entry 5863, display 16161, cost 2000, flags 0 (the "hidden" case)
+        "02000000",
+        "e7160000",
+        "213f0000",
+        "d0070000",
+        "00000000",
+    ));
+    let packet = messages::parse_server(opcode::SMSG_PETITION_SHOWLIST, &body).unwrap();
+    let ServerPacket::PetitionShowList(list) = &packet else {
+        panic!("expected PetitionShowList, got {}", packet.name());
+    };
+    assert_eq!(list.npc, 0x2a1f);
+    assert_eq!(
+        list.entries.len(),
+        2,
+        "both rows parsed, not just the first"
+    );
+    assert_eq!(list.entries[0].index, 1);
+    assert_eq!(list.entries[0].charter_entry, CHARTER_ITEM_ENTRY);
+    assert_eq!(list.entries[0].charter_display_id, CHARTER_DISPLAY_ID);
+    assert_eq!(list.entries[0].charter_cost, 1000, "10 silver, in copper");
+    assert_eq!(list.entries[0].entry_flags, 1);
+    assert_eq!(list.entries[1].charter_cost, 2000);
+    assert_eq!(
+        list.entries[1].entry_flags, 0,
+        "the flag is kept raw, not folded into a bool"
+    );
+
+    let events = decode(packet);
+    assert!(
+        matches!(events.as_slice(), [SessionEvent::PetitionShowList(l)] if l.npc == 0x2a1f),
+        "one PetitionShowList event, got {events:?}"
+    );
+}
+
+/// `SMSG_PETITION_SHOW_SIGNATURES` — `u64 item`, `u64 owner`, `u32 petitionId`, `u8 count`, then
+/// **12 bytes per signature**: the signer's guid and a dword vmangos writes as a literal zero
+/// (`Handlers/PetitionsHandler.cpp:160-168`, `Guild/GuildMgr.cpp:358-366`).
+///
+/// **Mutation-checked** against omitting that dword. The fixture carries a full nine signatures
+/// because that is the only size at which the drift is unmistakable — with two, an 8-byte stride
+/// reads one signer and then a truncation error, which is easy to misread as a short packet.
+#[test]
+fn petition_show_signatures_stride_is_twelve_bytes() {
+    let mut body = hx(concat!(
+        "0302010000000000", // u64 itemGuid
+        "aa00000000000000", // u64 ownerGuid
+        "07000000",         // u32 petitionId
+        "09",               // u8 signatureCount
+    ));
+    for signer in 1..=MAX_PETITION_SIGNATURES as u64 {
+        body.extend_from_slice(&signer.to_le_bytes());
+        body.extend_from_slice(&0u32.to_le_bytes());
+    }
+
+    let packet = messages::parse_server(opcode::SMSG_PETITION_SHOW_SIGNATURES, &body).unwrap();
+    let ServerPacket::PetitionShowSignatures(sigs) = &packet else {
+        panic!("expected PetitionShowSignatures, got {}", packet.name());
+    };
+    assert_eq!(sigs.item, 0x0001_0203);
+    assert_eq!(sigs.owner, 0xaa);
+    assert_eq!(sigs.petition_id, 7);
+    assert_eq!(sigs.signatures.len(), MAX_PETITION_SIGNATURES);
+    // The LAST signer is the one that proves the stride: an 8-byte stride would have walked into
+    // the padding long before here.
+    assert_eq!(
+        sigs.signatures[MAX_PETITION_SIGNATURES - 1].signer,
+        MAX_PETITION_SIGNATURES as u64,
+        "the ninth signer, at stride 12"
+    );
+    assert!(sigs.signatures.iter().all(|s| s.unknown == 0));
+
+    let events = decode(packet);
+    assert!(
+        matches!(events.as_slice(), [SessionEvent::PetitionShowSignatures(s)] if s.petition_id == 7),
+        "one PetitionShowSignatures event, got {events:?}"
+    );
+}
+
+/// `SMSG_PETITION_QUERY_RESPONSE` — sixteen fields, one of which is sixteen bits.
+///
+/// **Mutation-checked** against reading `allowedGender` as a `u32`. That shifts everything after it
+/// by two bytes: `allowedMinLevel` picks up half of `allowedMaxLevel`, and the choice count reads a
+/// large number, so the parse fails on a truncated cstring — far from the cause. The fixture gives
+/// every trailing field a distinct value so the shift cannot land on a lucky zero.
+#[test]
+fn petition_query_response_gender_is_sixteen_bit() {
+    let body = hx(concat!(
+        "07000000",         // u32 petitionId
+        "aa00000000000000", // u64 ownerGuid
+        "4c656761637900",   // cstring name "Legacy"
+        "00",               // cstring bodyText ""
+        "01000000",         // u32 flags
+        "09000000",         // u32 minSignatures
+        "09000000",         // u32 maxSignatures
+        "11111111",         // u32 deadline
+        "22222222",         // u32 creation
+        "33333333",         // u32 allowedGuildID
+        "44444444",         // u32 allowedClasses
+        "55555555",         // u32 allowedRaces
+        "6666",             // u16 allowedGender  <-- sixteen bits
+        "77777777",         // u32 allowedMinLevel
+        "88888888",         // u32 allowedMaxLevel
+        "01000000",         // u32 choiceCount
+        "59657300",         // cstring "Yes"
+        "99999999",         // u32 defaultChoice
+    ));
+    let packet = messages::parse_server(opcode::SMSG_PETITION_QUERY_RESPONSE, &body).unwrap();
+    let ServerPacket::PetitionQueryResponse(r) = &packet else {
+        panic!("expected PetitionQueryResponse, got {}", packet.name());
+    };
+    assert_eq!(r.petition_id, 7);
+    assert_eq!(r.owner, 0xaa);
+    assert_eq!(r.name, "Legacy");
+    assert_eq!(r.body_text, "", "vmangos always sends this empty");
+    assert_eq!(r.min_signatures, 9);
+    assert_eq!(r.max_signatures, 9);
+    assert_eq!(r.allowed_gender, 0x6666, "sixteen bits, not thirty-two");
+    // These two are what a 32-bit gender read would corrupt first.
+    assert_eq!(r.allowed_min_level, 0x7777_7777);
+    assert_eq!(r.allowed_max_level, 0x8888_8888);
+    assert_eq!(r.choices, vec!["Yes".to_string()], "the counted tail");
+    assert_eq!(r.default_choice, 0x9999_9999);
+
+    let events = decode(packet);
+    assert!(
+        matches!(events.as_slice(), [SessionEvent::PetitionQueryResponse(q)] if q.name == "Legacy"),
+        "one PetitionQueryResponse event, got {events:?}"
+    );
+}
+
+/// `SMSG_PETITION_SIGN_RESULTS` (`Petition.cpp:69-74`) and `SMSG_TURN_IN_PETITION_RESULTS`
+/// (`:76-79`) share the `PetitionSigns` enum but not a layout: the first carries two guids and a
+/// code, the second carries **only** the code.
+#[test]
+fn the_two_results_packets_share_an_enum_but_not_a_layout() {
+    let body = hx(concat!(
+        "0302010000000000", // u64 itemGuid
+        "bb00000000000000", // u64 playerGuid — the SIGNER, in both copies of this packet
+        "03000000",         // u32 result = CANT_SIGN_OWN
+    ));
+    let packet = messages::parse_server(opcode::SMSG_PETITION_SIGN_RESULTS, &body).unwrap();
+    let ServerPacket::PetitionSignResults(r) = &packet else {
+        panic!("expected PetitionSignResults, got {}", packet.name());
+    };
+    assert_eq!(r.item, 0x0001_0203);
+    assert_eq!(r.player, 0xbb);
+    assert_eq!(r.result, petition_result::CANT_SIGN_OWN);
+
+    // The turn-in answer is a bare u32 with no charter named at all.
+    let packet = messages::parse_server(
+        opcode::SMSG_TURN_IN_PETITION_RESULTS,
+        &hx("04000000"), // NEED_MORE
+    )
+    .unwrap();
+    assert!(
+        matches!(
+            packet,
+            ServerPacket::TurnInPetitionResults { result } if result == petition_result::NEED_MORE
+        ),
+        "expected TurnInPetitionResults, got {}",
+        packet.name()
+    );
+    let events = decode(packet);
+    assert!(
+        matches!(
+            events.as_slice(),
+            [SessionEvent::TurnInPetitionResults { result: 4 }]
+        ),
+        "one TurnInPetitionResults event, got {events:?}"
+    );
+}
+
+/// The two `MSG_` opcodes are genuinely bidirectional, and **decline reads a different body than it
+/// writes**: we send the charter's item guid, the owner receives the declining player's guid. Both
+/// are eight bytes, so nothing but this test distinguishes a correct implementation from one that
+/// reuses a single body type and is wrong half the time.
+///
+/// Rename, by contrast, is symmetric — the same `u64 item` + cstring both ways — which is why the
+/// two are asserted together: the family is not uniformly one or the other.
+#[test]
+fn msg_petition_opcodes_read_a_different_body_than_they_write() {
+    // Decline: outbound is the ITEM, inbound is the PLAYER. Same width, opposite meaning.
+    assert_eq!(
+        messages::petition_decline(0x0001_0203),
+        hx("0302010000000000"),
+        "outbound MSG_PETITION_DECLINE carries the item guid"
+    );
+    let packet =
+        messages::parse_server(opcode::MSG_PETITION_DECLINE, &hx("bb00000000000000")).unwrap();
+    assert!(
+        matches!(packet, ServerPacket::PetitionDeclined { player } if player == 0xbb),
+        "inbound MSG_PETITION_DECLINE carries the player guid, got {}",
+        packet.name()
+    );
+
+    // Rename: symmetric, and the echo arrives only on success.
+    let body = hx("03020100000000004c656761637900");
+    assert_eq!(
+        messages::petition_rename(0x0001_0203, "Legacy"),
+        body,
+        "outbound MSG_PETITION_RENAME"
+    );
+    let packet = messages::parse_server(opcode::MSG_PETITION_RENAME, &body).unwrap();
+    let ServerPacket::PetitionRenamed(r) = &packet else {
+        panic!("expected PetitionRenamed, got {}", packet.name());
+    };
+    assert_eq!(r.item, 0x0001_0203);
+    assert_eq!(r.name, "Legacy");
+
+    let events = decode(packet);
+    assert!(
+        matches!(events.as_slice(), [SessionEvent::PetitionRenamed(p)] if p.name == "Legacy"),
+        "one PetitionRenamed event, got {events:?}"
+    );
+}
+
+/// An empty charter — no signatures yet, which is what the owner sees the moment they buy one.
+/// The count byte is zero and the packet simply ends; nothing may read a signature record that is
+/// not there.
+#[test]
+fn a_freshly_bought_charter_has_no_signatures() {
+    let body = hx(concat!(
+        "0302010000000000", // item
+        "aa00000000000000", // owner
+        "07000000",         // petitionId
+        "00",               // no signatures
+    ));
+    let packet = messages::parse_server(opcode::SMSG_PETITION_SHOW_SIGNATURES, &body).unwrap();
+    let ServerPacket::PetitionShowSignatures(sigs) = &packet else {
+        panic!("expected PetitionShowSignatures, got {}", packet.name());
+    };
+    assert!(sigs.signatures.is_empty());
+    assert_eq!(sigs.owner, 0xaa, "the owner is still named");
+}
diff --git a/crates/benilla-ui/src/script/mod.rs b/crates/benilla-ui/src/script/mod.rs
index 04ff9a9c..4e3f2a7d 100644
--- a/crates/benilla-ui/src/script/mod.rs
+++ b/crates/benilla-ui/src/script/mod.rs
@@ -98,6 +98,7 @@ mod net_stats;
 mod object;
 mod party;
 mod pet;
+mod petition;
 mod pointer;
 mod pvp;
 mod quest;
@@ -175,6 +176,11 @@ pub use guild::{
     GuildMemberInfo, GuildRankEdit, GuildRankInfo, GuildRequest, GuildState, LastOnline, UnitGuild,
     MAX_RANKS, MIN_RANKS, RANK_RIGHT_BITS,
 };
+pub use petition::{
+    validate_guild_name, PetitionRecordView, PetitionRequest, PetitionState, PETITION_TYPE_CHARTER,
+    PETITION_TYPE_PETITION,
+};
+
 pub use inspect::{InspectView, UnitReach};
 pub use item_stats::{item_usable, ItemSetView, ItemTemplateView, PlayerReqState};
 pub use item_text::ItemTextState;
@@ -544,6 +550,7 @@ impl UiScript {
         party::install(&lua)?;
         social::install(&lua)?;
         guild::install(&lua)?;
+        petition::install(&lua)?;
         binder::install(&lua)?;
         gm_ticket::install(&lua)?;
         duel::install(&lua)?;
diff --git a/crates/benilla-ui/src/script/model.rs b/crates/benilla-ui/src/script/model.rs
index b27d8ea5..e0fb86e1 100644
--- a/crates/benilla-ui/src/script/model.rs
+++ b/crates/benilla-ui/src/script/model.rs
@@ -6,9 +6,10 @@ use crate::widget::{FrameHandle, RegionHandle, WidgetArena};
 use super::{
     auction, backdrop, bank, char_stats, chat_window, colorselect, container, craft, cursor, death,
     duel, follow, gossip, guild, inspect, item_text, loot, loot_roll, macros, mail, merchant,
-    party, pvp, quest, quest_log, reputation, session, simplehtml, skills, slider, social,
-    spellbook, stable, taxi, trade, tradeskill, trainer, weapon_enchant, ActionSlot, AuraState,
-    FontObject, ItemTemplateView, PlayerReqState, RegionData, ScriptValue, SoundRequest, UnitState,
+    party, petition, pvp, quest, quest_log, reputation, session, simplehtml, skills, slider,
+    social, spellbook, stable, taxi, trade, tradeskill, trainer, weapon_enchant, ActionSlot,
+    AuraState, FontObject, ItemTemplateView, PlayerReqState, RegionData, ScriptValue, SoundRequest,
+    UnitState,
 };
 
 // ─────────────────────────────────────────────────────────────────────────────────────────────
@@ -452,6 +453,16 @@ pub(crate) struct Model {
     /// the app's last [`super::UiScript::take_guild_requests`] drain — the outbound seam
     /// ([`guild`]).
     pub(crate) guild_requests: Vec<guild::GuildRequest>,
+    /// The guild-charter snapshot the app pushes (the registrar's price and the open petition —
+    /// decision 1672): `GetPetitionInfo`/`GetPetitionNameInfo`/`GetGuildCharterCost`/… read it
+    /// ([`petition`]). Names and the proposed guild's title are already resolved, because in the
+    /// real client too they come from caches the engine owns and not from the packet that opens
+    /// the window.
+    pub(crate) petition: petition::PetitionState,
+    /// Charter intents (`BuyGuildCharter`/`SignPetition`/`TurnInGuildCharter`/…) queued since the
+    /// app's last [`super::UiScript::take_petition_requests`] drain — the outbound seam
+    /// ([`petition`]).
+    pub(crate) petition_requests: Vec<petition::PetitionRequest>,
     /// Whisper targets `ChatFrame_SendTell` queued since the app's last
     /// [`super::UiScript::take_tell_requests`] drain — the app opens its chat edit box prefilled
     /// `/w <name> ` (the unit popup's WHISPER action; [`party`] registers the global).
@@ -1472,6 +1483,8 @@ impl Model {
             guild: guild::GuildState::default(),
             guild_control: guild::GuildRankEdit::default(),
             guild_requests: Vec::new(),
+            petition: petition::PetitionState::default(),
+            petition_requests: Vec::new(),
             tell_requests: Vec::new(),
             open_chat_requests: Vec::new(),
             chat_window_looks: [chat_window::ChatWindowLook::DEFAULT;
diff --git a/crates/benilla-ui/src/script/petition.rs b/crates/benilla-ui/src/script/petition.rs
new file mode 100644
index 00000000..a4f7c7cc
--- /dev/null
+++ b/crates/benilla-ui/src/script/petition.rs
@@ -0,0 +1,692 @@
+//! The guild-charter **Era API surface** — the guild registrar and the petition window
+//! (decision 1672, **re-derived against the byte law in 1678**).
+//!
+//! [`super::guild`] is *being* in a guild; this is *founding* one, which 1257 §2 deliberately left
+//! out and named as the next slice. Fifteen registered globals across two windows (the three tabard
+//! ones are the adjacent family and are not built), and the same shape as every other domain here:
+//! the app pushes a [`PetitionState`] snapshot ([`UiScript::set_petition`]) and the getters read
+//! that plain data; every verb queues a [`PetitionRequest`] the app drains
+//! ([`UiScript::take_petition_requests`]). No ECS or net reach from the engine (decision 0068 §3).
+//!
+//! Every contract below is **VERIFIED at the bytes** — wow-re
+//! `system/ui/scratch/petition-charter-api.md`, a §5 round commissioned by this slice, which carved
+//! the whole `PetitionInfo.cpp` TU (`0x84cfb8`). Where it corrected what this file first shipped,
+//! the correction is named on the binding.
+//!
+//! **The snapshot mirrors the module's own `.data` state, and that is why it looks split.** The
+//! real client keeps the signature list (`[0xbdce20]` + the `0x10`-stride signer array) and the
+//! cached `CGPetition` record (`[0xbdce28]`) as two independent things, because the bindings read
+//! them independently: `GetNumPetitionNames`/`GetPetitionNameInfo` answer off the *packet's* list
+//! while `GetPetitionInfo` answers off the *record*, and either can exist without the other. So
+//! [`PetitionState`] carries them separately rather than as one "is the window open" struct — a
+//! collapsed model cannot express `CanSignPetition`'s no-record leg below, and gets it wrong.
+//!
+//! **This client has no `lua_pushboolean`.** Every predicate is the number `1` or `nil`
+//! (`0x6f3810` / `0x6f37f0`), and a name the `NameCache` has not resolved is **`nil`**, not `""`.
+//!
+//! **`PETITION_SHOW` is deferred, which is what makes the partial states below unreachable in
+//! practice.** The event fires only when no signer name is still resolving *and* the record has
+//! arrived (`0x4f419b`-`0x4f41ad`), so the window never paints a blank title or a blank row. The
+//! deferral lives app-side in `crate::ui_petition`; the getters here still answer honestly at any
+//! moment, because an addon may call them whenever it likes.
+
+use mlua::{Lua, MultiValue, Value};
+
+use super::Model;
+
+/// `GetPetitionInfo`'s first return when the record's `"charter"` bit is SET — `0x84cf8c`, selected
+/// by `0x4f43fb test BYTE PTR [edi+0x1110],0x1`. The literal the reference compares against
+/// (`PetitionFrame.lua:22`).
+pub const PETITION_TYPE_CHARTER: &str = "charter";
+
+/// …and when it is clear — `0x84b8f8`. **Reachable**, not dead: the bit is the record's own, so a
+/// server that sent a non-charter petition would land here, and `CanSignPetition`'s guild-membership
+/// and full-charter refusals are *both* gated on the same bit. 1.12 servers only ever send charters,
+/// which is why the reference's `else` arm merely writes the bare word.
+pub const PETITION_TYPE_PETITION: &str = "petition";
+
+/// The cached `CGPetition` record, as [`GetPetitionInfo`] reads it — `[0xbdce28]`'s six fields.
+///
+/// `None` on [`PetitionState::record`] is the no-record leg, which is a real state with its own
+/// return tuple; see [`GetPetitionInfo`].
+#[derive(Debug, Clone, PartialEq, Eq, Default)]
+pub struct PetitionRecordView {
+    /// [`PETITION_TYPE_CHARTER`] or [`PETITION_TYPE_PETITION`] — the record's `+0x1110` bit 0.
+    pub petition_type: String,
+    /// The record's inline `char[0x100]` title (`+0x10`) — the proposed guild's name.
+    pub title: String,
+    /// The record's inline `char[0x1000]` body text (`+0x110`). Empty on every 1.12 server.
+    pub body_text: String,
+    /// The record's `+0x1118`, pushed as a **signed** i32 (`fild DWORD`, not the zero-extending
+    /// `fild QWORD` the two counters use).
+    ///
+    /// **That this field is the signature cap is settled inside the binary rather than inferred
+    /// from the packet's field order**: `CanSignPetition` refuses at `0x4f4634 cmp ecx,[esi+0x1118]`
+    /// against the live signature count. It is *not* the nine name rows — see the module doc of
+    /// `crate::ui_petition`.
+    pub max_signatures: i32,
+    /// The owner's name through the `NameCache` — **`nil` when uncached** (`0x4f446d`), never `""`.
+    pub originator: Option<String>,
+    /// Whether the active player's guid equals the record's owner (`0x4f447a`/`0x4f4481`).
+    pub is_originator: bool,
+}
+
+/// What the two charter windows read — the module's `.data` state, in the same three pieces.
+#[derive(Debug, Clone, PartialEq, Eq, Default)]
+pub struct PetitionState {
+    /// `GetGuildCharterCost()` — showlist **entry\[0\]**'s fourth dword (`[0xbdce50]`), in copper.
+    ///
+    /// **Unsigned**, because the binding pushes it through the `fild QWORD` idiom with the high
+    /// dword forced to zero (`0x4f5245`): a negative `charterCost` on the wire surfaces in Lua as
+    /// ~4.29e9, not as a negative number. `0` before any showlist has arrived, and after the
+    /// world-enter clear.
+    ///
+    /// That it is **copper** is settled without going through the UI: `0x4f50ed` compares this cell
+    /// directly against `PLAYER_FIELD_COINAGE` and refuses with `ERR_NOT_ENOUGH_MONEY`.
+    pub charter_cost: u32,
+    /// The open petition's signers in wire order, each resolved through the `NameCache` — `None`
+    /// where the name has not landed. Its length is `GetNumPetitionNames()`, which counts
+    /// **signatures only**: the petition's owner is not among them.
+    ///
+    /// Independent of [`Self::record`] on purpose (module doc): the packet fills this, the cache
+    /// fills that, and the bindings read one each.
+    pub signers: Vec<Option<String>>,
+    /// The cached record, or `None` — the no-record leg.
+    pub record: Option<PetitionRecordView>,
+    /// `CanSignPetition()`, computed app-side because three of its four refusals need state the
+    /// engine does not hold. See [`PetitionState::can_sign`]'s own note in `crate::ui_petition`;
+    /// the shape to remember here is that **it is `1` when nothing is open at all**.
+    pub can_sign: bool,
+}
+
+/// A charter intent queued from Lua, drained by the app into its send.
+///
+/// **Almost every one is fire-and-forget, and that is the wire's shape**: buying is answered only by
+/// the item appearing, offering is answered to the *target*, and a refusal comes back on the guild
+/// family's own error channel. Nothing here may update local state optimistically.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub enum PetitionRequest {
+    /// `BuyGuildCharter(name)` — the registrar's Purchase button, **after** the name passed
+    /// [`validate_guild_name`]. The app supplies the NPC guid from the latched registrar, which is
+    /// the petition module's own `[0xbdceb0]` and *not* `CGGameUI`'s interaction pair.
+    Buy(String),
+    /// `TurnInGuildCharter()` — no argument. The app scans the bags, because the real client does
+    /// (`0x5ef2b0`, and it latches nothing: it re-scans on every call).
+    TurnIn,
+    /// `CloseGuildRegistrar()` — **sends nothing of its own**, VERIFIED by a closure walk over
+    /// `0x4f5010` that finds no `CDataStore` build and no send, with this TU's own four sends as
+    /// the positive control.
+    CloseRegistrar,
+    /// `SignPetition([n])` — the optional argument is a **byte on the wire** and defaults to `1`
+    /// (`0x4f46d9`), not to `0`. vmangos skips it, so only a golden can tell the difference.
+    Sign(i8),
+    /// `OfferPetition()` — no argument; the app resolves the **current target** (`CGGameUI`'s
+    /// *selection* pair, not its interaction pair) and runs the eight guards.
+    Offer,
+    /// `RenamePetition(name)` — after [`validate_guild_name`].
+    Rename(String),
+    /// `ClosePetition()` — **and this one can put bytes on the wire.** `0x4f3f60`'s decline leg
+    /// sends `MSG_PETITION_DECLINE` whenever a petition was open, no sign is in flight, a record is
+    /// cached, and we are **not** its owner. The app decides that; the verb just says "close".
+    ClosePetition,
+    /// A name the client itself refused ([`validate_guild_name`]) — carries the GlobalStrings key
+    /// of the message to show. **No packet is built**: the real client's validator runs before the
+    /// send and emits through the message catalog on its own.
+    NameRefused(&'static str),
+}
+
+impl super::UiScript {
+    /// Push the charter snapshot, replacing whatever was there. A bare setter — firing the four
+    /// events on their edges (and *deferring* `PETITION_SHOW`) is the app's job.
+    pub fn set_petition(&mut self, state: PetitionState) {
+        self.model_mut().petition = state;
+    }
+
+    /// Take the charter intents queued since the last drain.
+    pub fn take_petition_requests(&mut self) -> Vec<PetitionRequest> {
+        std::mem::take(&mut self.model_mut().petition_requests)
+    }
+
+    /// Drop any queued close intent, reporting how many went — **the close-intent consumption
+    /// decision 0096 named**, and the one thing a window switch cannot work without.
+    ///
+    /// Firing `PETITION_CLOSED` runs the frame's `OnHide` synchronously, and that handler calls
+    /// `ClosePetition()`, which queues a close. On a *switch* — a charter offered to us while ours
+    /// is open — the feed fires `PETITION_CLOSED` then `PETITION_SHOW` for the new charter, and the
+    /// close queued by the first would be drained onto the session the second just opened: the new
+    /// charter's window flashes and shuts. **And here it would also put a `MSG_PETITION_DECLINE` on
+    /// the wire for a charter we did not decline**, which is the sharper reason it must go.
+    ///
+    /// It cannot eat a *user's* close by mistake, and the ordering is what guarantees that rather
+    /// than a flag: the feed runs `before(UiInput)`, so a click's own `OnHide` queues its close
+    /// after this has already run.
+    pub fn drop_petition_close_intents(&mut self) -> usize {
+        let requests = &mut self.model_mut().petition_requests;
+        let before = requests.len();
+        requests.retain(|r| {
+            !matches!(
+                r,
+                PetitionRequest::CloseRegistrar | PetitionRequest::ClosePetition
+            )
+        });
+        before - requests.len()
+    }
+
+    /// Queue one charter intent directly — the test seam.
+    #[cfg(test)]
+    pub fn queue_petition_request(&mut self, request: PetitionRequest) {
+        self.model_mut().petition_requests.push(request);
+    }
+}
+
+/// The client-side guild-name check `BuyGuildCharter` and `RenamePetition` **share** — `0x4f5160`,
+/// which runs the name through the locale-aware string checker `0x6c9b70` and maps its code to one
+/// of seven messages, accepting **only** code `0xd`. `Ok(())` is that acceptance; `Err(key)` is the
+/// GlobalStrings key of the line to show, and **no packet is built**.
+///
+/// **Partial, deliberately, and here is exactly how far it goes.** The code space belongs to
+/// `0x6c9b70`, which that round did not carve, so only the checks whose meaning is unambiguous from
+/// the message keys are implemented — empty, a leading or trailing space, and consecutive spaces.
+/// The three that need data we do not have (`ERR_GUILD_NAME_TOO_SHORT`'s minimum,
+/// `ERR_GUILD_NAME_PROFANE`'s word list, `ERR_GUILD_NAME_MIXED_LANGUAGES`' script rules) **pass**
+/// rather than guess: refusing a name the server would have accepted is the worse failure, and the
+/// server re-checks every one of them anyway (`ObjectMgr::IsValidCharterName`). What this buys over
+/// sending blindly is the case the reference makes loudest and the server answers with silence —
+/// clicking Purchase with an empty box.
+///
+/// The full table, from the note, with what each maps to:
+///
+/// | code | key | implemented |
+/// |---|---|---|
+/// | 0 | `ERR_GUILD_ENTER_NAME` | **yes** — the empty string |
+/// | 1 | `ERR_GUILD_NAME_TOO_SHORT` | no — the minimum is inside `0x6c9b70` |
+/// | 4 | `ERR_GUILD_NAME_MIXED_LANGUAGES` | no |
+/// | 5 | `ERR_GUILD_NAME_PROFANE` | no |
+/// | 6 | `ERR_GUILD_NAME_RESERVED` | no |
+/// | 10 | `ERR_GUILD_NAME_INVALID_SPACE` | **yes** — a leading or trailing space |
+/// | 11 | `ERR_GUILD_NAME_NAME_CONSECUTIVE_SPACES` | **yes** |
+/// | 2,3,7,8,9,>0xb | `ERR_GUILD_NAME_INVALID` | no |
+pub fn validate_guild_name(name: &str) -> Result<(), &'static str> {
+    if name.is_empty() {
+        return Err("ERR_GUILD_ENTER_NAME");
+    }
+    if name.starts_with(' ') || name.ends_with(' ') {
+        return Err("ERR_GUILD_NAME_INVALID_SPACE");
+    }
+    if name.contains("  ") {
+        return Err("ERR_GUILD_NAME_NAME_CONSECUTIVE_SPACES");
+    }
+    Ok(())
+}
+
+/// 1.12's `1`/`nil`, never `true`/`false` — this client has no `lua_pushboolean`.
+fn era_bool(on: bool) -> Value {
+    if on {
+        Value::Integer(1)
+    } else {
+        Value::Nil
+    }
+}
+
+/// A cached name pushes as a string; an uncached one pushes **nil**.
+fn name_value(lua: &Lua, name: Option<&String>) -> mlua::Result<Value> {
+    match name {
+        Some(n) => Ok(Value::String(lua.create_string(n)?)),
+        None => Ok(Value::Nil),
+    }
+}
+
+/// Register the charter globals against the snapshot store.
+pub(super) fn install(lua: &Lua) -> mlua::Result<()> {
+    let g = lua.globals();
+
+    // ── The petition window ──────────────────────────────────────────────────────────────────
+    // GetPetitionInfo() (`0x4f43d0`) — **exactly six values on BOTH legs** (`mov eax,0x6` at
+    // `0x4f4493` and `0x4f44d4`), in the order the reference destructures them
+    // (`PetitionFrame.lua:10`).
+    //
+    // The no-record leg is NOT "return nothing": it is `nil, nil, nil, 0, nil, nil`, with the
+    // fourth pushed as the *number* zero (`0x4f44b4 push 0; push 0; call 0x6f3810`). This file
+    // first shipped an empty return, which reads identically through the reference's own
+    // destructure and differently to anything that counts its arguments.
+    g.set(
+        "GetPetitionInfo",
+        lua.create_function(|lua, ()| {
+            let model = lua.app_data_ref::<Model>().expect("model app_data");
+            let Some(r) = model.petition.record.as_ref() else {
+                return Ok(MultiValue::from_vec(vec![
+                    Value::Nil,
+                    Value::Nil,
+                    Value::Nil,
+                    Value::Integer(0),
+                    Value::Nil,
+                    Value::Nil,
+                ]));
+            };
+            Ok(MultiValue::from_vec(vec![
+                Value::String(lua.create_string(&r.petition_type)?),
+                Value::String(lua.create_string(&r.title)?),
+                Value::String(lua.create_string(&r.body_text)?),
+                Value::Integer(i64::from(r.max_signatures)),
+                name_value(lua, r.originator.as_ref())?,
+                era_bool(r.is_originator),
+            ]))
+        })?,
+    )?;
+
+    // GetNumPetitionNames() (`0x4f44e0`, 44 bytes — one field read) — `[0xbdce20]`, pushed
+    // UNSIGNED. It counts **signatures only**; the owner is painted separately by the window and is
+    // never in this list.
+    g.set(
+        "GetNumPetitionNames",
+        lua.create_function(|lua, ()| {
+            let model = lua.app_data_ref::<Model>().expect("model app_data");
+            Ok(model.petition.signers.len() as i64)
+        })?,
+    )?;
+
+    // GetPetitionNameInfo(index) (`0x4f4510`) — **1-based** (`0x4f4569 dec eax`), one value on
+    // every leg. The bound test `0x4f456c jae` is UNSIGNED, so index `< 1` wraps to `0xffffffff`
+    // and fails the same comparison — which is why a zero or negative index answers nil rather
+    // than the last row. An uncached name is **nil**, not `""`.
+    //
+    // A non-numeric argument is `luaL_error("Usage: GetPetitionNameInfo(index)")`, which longjmps;
+    // mlua's coercion raises for us on the same input, so the shape is preserved.
+    g.set(
+        "GetPetitionNameInfo",
+        lua.create_function(|lua, index: i64| {
+            let model = lua.app_data_ref::<Model>().expect("model app_data");
+            let Some(name) = usize::try_from(index)
+                .ok()
+                .and_then(|i| i.checked_sub(1))
+                .and_then(|i| model.petition.signers.get(i))
+            else {
+                return Ok(Value::Nil);
+            };
+            name_value(lua, name.as_ref())
+        })?,
+    )?;
+
+    // CanSignPetition() (`0x4f45e0`) — the Sign button's only gate.
+    //
+    // **It returns `1` with NO petition open**, and that is the reference's own asymmetry rather
+    // than a reading error: `0x4f45f7 je 0x4f4655` jumps past the three record-dependent refusals
+    // straight into the signer scan, over an array the close path has already zeroed. A client that
+    // treats this as a sufficient precondition lets the user click Sign with nothing to sign — so
+    // the window's own `isOriginator` branch is what actually keeps the button off screen.
+    g.set(
+        "CanSignPetition",
+        lua.create_function(|lua, ()| {
+            let model = lua.app_data_ref::<Model>().expect("model app_data");
+            Ok(era_bool(model.petition.can_sign))
+        })?,
+    )?;
+
+    // ── The registrar window ─────────────────────────────────────────────────────────────────
+    // GetGuildCharterCost() (`0x4f5230`) — copper, unsigned, `0` before any showlist.
+    g.set(
+        "GetGuildCharterCost",
+        lua.create_function(|lua, ()| {
+            let model = lua.app_data_ref::<Model>().expect("model app_data");
+            Ok(i64::from(model.petition.charter_cost))
+        })?,
+    )?;
+
+    // ── The verbs ────────────────────────────────────────────────────────────────────────────
+    // The four that carry nothing and push nothing. None may touch the snapshot: none of them is
+    // acknowledged, so a local update would show a charter as signed that the server refused.
+    for (global, request) in [
+        ("TurnInGuildCharter", PetitionRequest::TurnIn),
+        ("CloseGuildRegistrar", PetitionRequest::CloseRegistrar),
+        ("OfferPetition", PetitionRequest::Offer),
+        ("ClosePetition", PetitionRequest::ClosePetition),
+    ] {
+        g.set(
+            global,
+            lua.create_function(move |lua, ()| {
+                let mut model = lua.app_data_mut::<Model>().expect("model app_data");
+                model.petition_requests.push(request.clone());
+                Ok(())
+            })?,
+        )?;
+    }
+
+    // SignPetition([n]) (`0x4f46d0`) — the argument is OPTIONAL and rides the wire as a byte,
+    // defaulting to **1**, not 0 (`0x4f46d9 edi = 1`, `0x4f4749 Put8`). The server skips the byte,
+    // so nothing observable depends on it — which is exactly why it is easy to ship as 0 and never
+    // find out.
+    g.set(
+        "SignPetition",
+        lua.create_function(|lua, n: Option<f64>| {
+            let mut model = lua.app_data_mut::<Model>().expect("model app_data");
+            // `trunc` toward zero, then narrowed the way the `Put8` does.
+            let byte = n.map_or(1i8, |v| v.trunc() as i64 as i8);
+            model.petition_requests.push(PetitionRequest::Sign(byte));
+            Ok(())
+        })?,
+    )?;
+
+    // BuyGuildCharter(guildName) (`0x4f5260`) — **returns the number `1` or `nil`**, and what it
+    // reports is NAME VALIDITY, not that a packet was sent: `0x4f5294` runs the shared validator and
+    // only its non-zero return reaches the action, which then has five silent refusals of its own.
+    // Nothing in the shipped FrameXML reads the return; an addon can.
+    g.set(
+        "BuyGuildCharter",
+        lua.create_function(|lua, name: String| {
+            let mut model = lua.app_data_mut::<Model>().expect("model app_data");
+            match validate_guild_name(&name) {
+                Ok(()) => {
+                    model.petition_requests.push(PetitionRequest::Buy(name));
+                    Ok(Value::Integer(1))
+                }
+                Err(key) => {
+                    model
+                        .petition_requests
+                        .push(PetitionRequest::NameRefused(key));
+                    Ok(Value::Nil)
+                }
+            }
+        })?,
+    )?;
+
+    // RenamePetition(name) (`0x4f4930`) — **0 values**, the SAME validator, and silent on refusal
+    // beyond the validator's own message. (Its usage string is literally
+    // `Usage(RenamePetition("name")` in the binary — Blizzard's own unbalanced parenthesis. It is
+    // unreachable from our binding, which raises through mlua's coercion instead, and is recorded
+    // here rather than reproduced.)
+    g.set(
+        "RenamePetition",
+        lua.create_function(|lua, name: String| {
+            let mut model = lua.app_data_mut::<Model>().expect("model app_data");
+            match validate_guild_name(&name) {
+                Ok(()) => model.petition_requests.push(PetitionRequest::Rename(name)),
+                Err(key) => model
+                    .petition_requests
+                    .push(PetitionRequest::NameRefused(key)),
+            }
+            Ok(())
+        })?,
+    )?;
+
+    Ok(())
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::script::UiScript;
+
+    fn record() -> PetitionRecordView {
+        PetitionRecordView {
+            petition_type: PETITION_TYPE_CHARTER.into(),
+            title: "Legacy".into(),
+            body_text: String::new(),
+            max_signatures: 9,
+            originator: Some("Founder".into()),
+            is_originator: false,
+        }
+    }
+
+    fn open(script: &mut UiScript, r: PetitionRecordView, signers: Vec<Option<String>>) {
+        script.set_petition(PetitionState {
+            charter_cost: 1000,
+            signers,
+            record: Some(r),
+            can_sign: true,
+        });
+    }
+
+    /// The six returns, in the reference's own destructuring order.
+    #[test]
+    fn get_petition_info_returns_the_reference_six_in_order() {
+        let mut s = UiScript::new().unwrap();
+        open(&mut s, record(), vec![]);
+        let (kind, title, body, max, originator, is_originator) = s
+            .eval::<(String, String, String, i32, String, Option<u32>)>("return GetPetitionInfo()")
+            .unwrap();
+        assert_eq!(kind, "charter");
+        assert_eq!(title, "Legacy");
+        assert_eq!(body, "");
+        assert_eq!(max, 9);
+        assert_eq!(originator, "Founder");
+        assert_eq!(is_originator, None, "era nil, not false");
+
+        open(
+            &mut s,
+            PetitionRecordView {
+                is_originator: true,
+                ..record()
+            },
+            vec![],
+        );
+        assert_eq!(
+            s.eval::<Option<u32>>("local _,_,_,_,_,o = GetPetitionInfo(); return o")
+                .unwrap(),
+            Some(1),
+            "era 1, not true"
+        );
+    }
+
+    /// **The no-record leg is six values, not none** — `nil, nil, nil, 0, nil, nil`, with the
+    /// fourth the *number* zero.
+    ///
+    /// This file first shipped an empty return, which the reference's own six-way destructure
+    /// cannot tell apart (both give six nils… except the fourth, which is `0` here and `nil`
+    /// there). `select("#", …)` is what separates them, and it is the whole point of the test.
+    #[test]
+    fn the_no_record_leg_is_six_values_with_a_numeric_zero() {
+        let s = UiScript::new().unwrap();
+        assert_eq!(
+            s.eval::<i64>("return select(\"#\", GetPetitionInfo())")
+                .unwrap(),
+            6,
+            "six values even with nothing open"
+        );
+        assert_eq!(
+            s.eval::<i64>("local _,_,_,m = GetPetitionInfo(); return m")
+                .unwrap(),
+            0,
+            "the fourth is the number 0, not nil"
+        );
+        assert_eq!(
+            s.eval::<Option<String>>("return (GetPetitionInfo())")
+                .unwrap(),
+            None,
+            "…and the first really is nil"
+        );
+    }
+
+    /// The name list is 1-based and bounded, an uncached name is **nil**, and the count excludes
+    /// the owner. The zero/negative cases matter because the binary's bound test is *unsigned*.
+    #[test]
+    fn petition_names_are_one_based_and_uncached_reads_nil() {
+        let mut s = UiScript::new().unwrap();
+        open(
+            &mut s,
+            record(),
+            vec![Some("Aaa".into()), None, Some("Ccc".into())],
+        );
+        assert_eq!(
+            s.eval::<i64>("return GetNumPetitionNames()").unwrap(),
+            3,
+            "three signers — the owner is not one of them"
+        );
+        assert_eq!(
+            s.eval::<String>("return GetPetitionNameInfo(1)").unwrap(),
+            "Aaa"
+        );
+        assert_eq!(
+            s.eval::<Option<String>>("return GetPetitionNameInfo(2)")
+                .unwrap(),
+            None,
+            "an unresolved name is nil, never an empty string"
+        );
+        assert_eq!(
+            s.eval::<String>("return GetPetitionNameInfo(3)").unwrap(),
+            "Ccc",
+            "and it keeps its ROW — the list does not close up around it"
+        );
+        for out_of_range in ["0", "4", "-1"] {
+            assert_eq!(
+                s.eval::<Option<String>>(&format!("return GetPetitionNameInfo({out_of_range})"))
+                    .unwrap(),
+                None,
+                "index {out_of_range} answers nil"
+            );
+        }
+    }
+
+    /// `CanSignPetition()` is era-boolean **and answers `1` with nothing open** — the reference's
+    /// own asymmetry, pinned so nobody "fixes" it into a nil.
+    #[test]
+    fn can_sign_petition_answers_one_with_nothing_open() {
+        let s = UiScript::new().unwrap();
+        assert_eq!(
+            s.eval::<Option<u32>>("return CanSignPetition()").unwrap(),
+            None,
+            "the app's own default is a refusal…"
+        );
+
+        let mut s = UiScript::new().unwrap();
+        s.set_petition(PetitionState {
+            can_sign: true,
+            ..PetitionState::default()
+        });
+        assert_eq!(
+            s.eval::<Option<u32>>("return CanSignPetition()").unwrap(),
+            Some(1),
+            "…but the binding reports whatever the app computed, including the no-record 1"
+        );
+    }
+
+    /// The cost is copper, unsigned, and belongs to the registrar rather than to any petition.
+    #[test]
+    fn charter_cost_is_unsigned_copper_and_the_registrars() {
+        let mut s = UiScript::new().unwrap();
+        s.set_petition(PetitionState {
+            charter_cost: 1000,
+            ..PetitionState::default()
+        });
+        assert_eq!(s.eval::<i64>("return GetGuildCharterCost()").unwrap(), 1000);
+
+        // A negative wire cost surfaces as ~4.29e9, not as a negative — the `fild QWORD` idiom.
+        s.set_petition(PetitionState {
+            charter_cost: (-1i32) as u32,
+            ..PetitionState::default()
+        });
+        assert_eq!(
+            s.eval::<i64>("return GetGuildCharterCost()").unwrap(),
+            4_294_967_295
+        );
+
+        s.set_petition(PetitionState::default());
+        assert_eq!(s.eval::<i64>("return GetGuildCharterCost()").unwrap(), 0);
+    }
+
+    /// `SignPetition`'s optional argument rides the wire as a byte and **defaults to 1**.
+    #[test]
+    fn sign_petition_defaults_its_wire_byte_to_one() {
+        let mut s = UiScript::new().unwrap();
+        s.run("SignPetition(); SignPetition(7); SignPetition(3.9)")
+            .unwrap();
+        assert_eq!(
+            s.take_petition_requests(),
+            vec![
+                PetitionRequest::Sign(1),
+                PetitionRequest::Sign(7),
+                PetitionRequest::Sign(3),
+            ],
+            "absent = 1, present = truncated toward zero"
+        );
+    }
+
+    /// `BuyGuildCharter` reports **name validity** as `1`/`nil`, and a refused name queues its
+    /// message instead of a packet. `RenamePetition` shares the validator and returns nothing.
+    #[test]
+    fn the_name_validator_gates_both_verbs_and_only_buy_reports_it() {
+        let mut s = UiScript::new().unwrap();
+        assert_eq!(
+            s.eval::<Option<u32>>("return BuyGuildCharter(\"Legacy\")")
+                .unwrap(),
+            Some(1)
+        );
+        assert_eq!(
+            s.eval::<Option<u32>>("return BuyGuildCharter(\"\")")
+                .unwrap(),
+            None,
+            "an empty name is refused locally — the server answers it with silence"
+        );
+        assert_eq!(
+            s.eval::<i64>("return select(\"#\", RenamePetition(\"Legacy\"))")
+                .unwrap(),
+            0,
+            "rename pushes nothing at all"
+        );
+        s.run("RenamePetition(\"  spaced  \")").unwrap();
+        assert_eq!(
+            s.take_petition_requests(),
+            vec![
+                PetitionRequest::Buy("Legacy".into()),
+                PetitionRequest::NameRefused("ERR_GUILD_ENTER_NAME"),
+                PetitionRequest::Rename("Legacy".into()),
+                PetitionRequest::NameRefused("ERR_GUILD_NAME_INVALID_SPACE"),
+            ]
+        );
+    }
+
+    /// The validator's three implemented codes, and — just as load-bearing — the names it lets
+    /// through rather than guessing at.
+    #[test]
+    fn the_validator_refuses_only_what_it_can_prove() {
+        assert_eq!(validate_guild_name(""), Err("ERR_GUILD_ENTER_NAME"));
+        assert_eq!(
+            validate_guild_name(" Legacy"),
+            Err("ERR_GUILD_NAME_INVALID_SPACE")
+        );
+        assert_eq!(
+            validate_guild_name("Legacy "),
+            Err("ERR_GUILD_NAME_INVALID_SPACE")
+        );
+        assert_eq!(
+            validate_guild_name("Legacy  of Steel"),
+            Err("ERR_GUILD_NAME_NAME_CONSECUTIVE_SPACES")
+        );
+        // Passed through on purpose: the minimum length, the profanity list and the script rules
+        // all live inside a function that round did not carve, and refusing a name the server would
+        // accept is the worse failure. The server re-checks every one of them.
+        for ok in ["Legacy of Steel", "A", "Ab", "Éclair", "x y z"] {
+            assert_eq!(
+                validate_guild_name(ok),
+                Ok(()),
+                "{ok:?} passes to the server"
+            );
+        }
+    }
+
+    /// The close-intent consumption removes exactly the two close verbs and preserves the order of
+    /// everything else.
+    #[test]
+    fn dropping_close_intents_leaves_the_other_verbs_untouched() {
+        let mut s = UiScript::new().unwrap();
+        s.run(
+            r#"
+            SignPetition()
+            ClosePetition()
+            BuyGuildCharter("Legacy")
+            CloseGuildRegistrar()
+            OfferPetition()
+        "#,
+        )
+        .unwrap();
+        assert_eq!(s.drop_petition_close_intents(), 2);
+        assert_eq!(
+            s.take_petition_requests(),
+            vec![
+                PetitionRequest::Sign(1),
+                PetitionRequest::Buy("Legacy".into()),
+                PetitionRequest::Offer,
+            ],
+        );
+        assert_eq!(s.drop_petition_close_intents(), 0);
+    }
+}