diff --git a/crates/benilla-app/src/capture/realm_list.rs b/crates/benilla-app/src/capture/realm_list.rs
index 270314f4..d2c39341 100644
--- a/crates/benilla-app/src/capture/realm_list.rs
+++ b/crates/benilla-app/src/capture/realm_list.rs
@@ -47,7 +47,10 @@ pub(super) fn seed_realm_list(
     }
     match *step {
         0 => {
-            lists.write(crate::net::RealmListMessage { realms: fixture() });
+            lists.write(crate::net::RealmListMessage {
+                realms: fixture(),
+                failed: false,
+            });
         }
         2 => crate::realm_select::open_over_char_select(&mut realms, &choice),
         3.. => return,
diff --git a/crates/benilla-app/src/char_select/input.rs b/crates/benilla-app/src/char_select/input.rs
index c58f3008..fc15b8f5 100644
--- a/crates/benilla-app/src/char_select/input.rs
+++ b/crates/benilla-app/src/char_select/input.rs
@@ -198,6 +198,7 @@ mod tests {
                 .insert_resource(CharPick(pick_tx))
                 .insert_resource(RealmChoice(realm_tx))
                 .add_message::<GlueSound>()
+                .add_message::<crate::login::GlueLogin>()
                 .add_message::<bevy::input::mouse::MouseWheel>()
                 .add_systems(PreUpdate, take_input);
             if list_first {
@@ -226,11 +227,21 @@ mod tests {
             } else {
                 "screen first"
             };
+            assert!(
+                !app.world().resource::<Realms>().shown,
+                "{order}: the list's Cancel ran"
+            );
             assert!(
                 realm_rx
                     .try_iter()
-                    .any(|r| matches!(r, RealmRequest::Abandon)),
-                "{order}: the list's Cancel ran"
+                    .all(|r| matches!(r, RealmRequest::Refresh)),
+                "{order}: and over character select it closes nothing"
+            );
+            assert!(
+                app.world()
+                    .resource::<bevy::ecs::message::Messages<crate::login::GlueLogin>>()
+                    .is_empty(),
+                "{order}: nor ends the login"
             );
             assert_eq!(
                 *app.world().resource::<State<ClientState>>().get(),
diff --git a/crates/benilla-app/src/login/mod.rs b/crates/benilla-app/src/login/mod.rs
index 07c2acf7..fd117e21 100644
--- a/crates/benilla-app/src/login/mod.rs
+++ b/crates/benilla-app/src/login/mod.rs
@@ -180,16 +180,22 @@ impl Attempt<'_> {
     }
 }
 
-/// What the stock glue screens ask of the login engine, past the glue manager's own guards
-/// ([`crate::ui_script::glue_mgr`]).
+/// What the glue screens ask of the login engine: the stock ones past the glue manager's own
+/// guards ([`crate::ui_script::glue_mgr`]), and the native realm list's Cancel over login.
 #[derive(Message)]
 pub(crate) enum GlueLogin {
     /// `CGlueMgr::Login` (`0x46afb0`) reaching `ClientServices`' logon (`0x5ab4b0`): one attempt,
-    /// typed, with the screen's credentials.
+    /// typed, with the screen's credentials. It supersedes a logon still parked at the realm list,
+    /// as the reference starts the next logon whatever link the last one left.
     Submit { account: String, password: String },
-    /// The status dialog's Cancel during the logon (`0x5b3320`) or the world connect (`0x5aaa50`
-    /// with `RESPONSE_CANCELLED`): the attempt in flight is dropped and nothing resubmits.
+    /// `CLoginMgr::Cancel` (`0x5b3320`): the status dialog's Cancel during the logon, and
+    /// `RealmListDialogCancelled` on the login screen. The attempt in flight is dropped, the
+    /// realmd link closes, and nothing resubmits.
     Abandon,
+    /// The status dialog's Cancel during the world connect, which completes it
+    /// `RESPONSE_CANCELLED` (`0x46b754`); the failure arm then drops the world socket alone
+    /// (`0x46befd`, `0x5ab1a0`), so the attempt in flight ends and the realmd link stays up.
+    CancelWorld,
     /// `DisconnectFromServer` (`0x46d340`): the world session dropped if there is one, then the
     /// logon cancelled, as select's Back drops the parked session.
     Disconnect,
@@ -205,26 +211,22 @@ pub(crate) fn answer_glue(
     mut asks: MessageReader<GlueLogin>,
     mut attempt: Attempt,
     pick: Option<Res<crate::net::CharPick>>,
+    realm: Option<Res<crate::net::RealmChoice>>,
     state: Res<State<ClientState>>,
     time: Res<Time>,
     mut commands: Commands,
 ) {
     for ask in asks.read() {
         match ask {
-            GlueLogin::Submit { account, password } => {
-                if !attempt.intent.in_flight {
-                    attempt.send(account, password, true);
-                }
-            }
+            GlueLogin::Submit { account, password } => attempt.send(account, password, true),
             GlueLogin::Abandon => {
+                close_logon(&attempt.abandon, &mut attempt.intent, realm.as_deref());
+            }
+            GlueLogin::CancelWorld => {
                 attempt.abandon.0.fetch_add(1, Ordering::SeqCst);
-                attempt.intent.in_flight = false;
-                attempt.intent.clear();
             }
             GlueLogin::Disconnect => {
-                attempt.abandon.0.fetch_add(1, Ordering::SeqCst);
-                attempt.intent.in_flight = false;
-                attempt.intent.clear();
+                close_logon(&attempt.abandon, &mut attempt.intent, realm.as_deref());
                 if matches!(
                     state.get(),
                     ClientState::CharSelect | ClientState::CharCreate
@@ -243,6 +245,22 @@ pub(crate) fn answer_glue(
     }
 }
 
+/// `CLoginMgr::Cancel` (`0x5b3320`): the attempt in flight is dropped at its next stage boundary
+/// (a dial asked for under the old generation included), the realmd link closes, and nothing
+/// resubmits.
+fn close_logon(
+    abandon: &LoginAbandon,
+    intent: &mut LoginIntent,
+    realm: Option<&crate::net::RealmChoice>,
+) {
+    abandon.0.fetch_add(1, Ordering::SeqCst);
+    intent.in_flight = false;
+    intent.clear();
+    if let Some(realm) = realm {
+        let _ = realm.0.send(crate::net::RealmRequest::Close);
+    }
+}
+
 /// The queue ring's clock, standing in for the reference's `GetTickCount`: only differences
 /// matter, and `u32` keeps the reference's wrapping width.
 fn queue_now_ms(time: &Time) -> u32 {
@@ -956,6 +974,7 @@ fn answer_dialog(
     mut realmlist: ResMut<crate::realmlist::Realmlist>,
     mut script: Option<NonSendMut<benilla_ui::script::UiScript>>,
     abandon: Res<LoginAbandon>,
+    realm: Option<Res<crate::net::RealmChoice>>,
 ) {
     for answer in answers.read() {
         match answer.kind {
@@ -975,11 +994,9 @@ fn answer_dialog(
                     dialog.dismiss(&mut commands);
                 }
             }
+            // Cancel, as the reference's state-1 Cancel (`0x46b73d` → `CLoginMgr::Cancel`).
             DialogKind::Status | DialogKind::Queued => {
-                // Cancel: the next stage boundary discards the attempt, and nothing resubmits.
-                abandon.0.fetch_add(1, Ordering::SeqCst);
-                intent.in_flight = false;
-                intent.clear();
+                close_logon(&abandon, &mut intent, realm.as_deref());
                 dialog.dismiss(&mut commands);
             }
         }
@@ -1117,6 +1134,7 @@ mod tests {
                 .insert_resource(crate::net::RealmChoice(realm_tx))
                 .add_message::<KeyboardInput>()
                 .add_message::<GlueSound>()
+                .add_message::<GlueLogin>()
                 .add_message::<bevy::input::mouse::MouseWheel>()
                 .add_systems(PreUpdate, crate::realm_select::take_input);
             let list = crate::realm_select::list_keys;
@@ -1143,11 +1161,17 @@ mod tests {
                 !app.world().resource::<crate::realm_select::Realms>().shown,
                 "{order}: the list's Cancel closed it"
             );
+            let asks = app
+                .world()
+                .resource::<bevy::ecs::message::Messages<GlueLogin>>();
             assert!(
-                realm_rx
-                    .try_iter()
-                    .any(|r| matches!(r, crate::net::RealmRequest::Abandon)),
-                "{order}: and answered the park"
+                asks.iter_current_update_messages()
+                    .any(|a| matches!(a, GlueLogin::Abandon)),
+                "{order}: and ended the attempt, which closes the logon"
+            );
+            assert!(
+                realm_rx.try_recv().is_err(),
+                "{order}: the login engine sends the close"
             );
             assert!(
                 !app.world().contains_resource::<QuitArm>(),
@@ -1156,6 +1180,103 @@ mod tests {
         }
     }
 
+    /// The status dialog's Cancel is `CLoginMgr::Cancel` (`0x46b73d` → `0x5b3320`): the attempt
+    /// ends at its next boundary and the logon park closes, so a logon that already finished is
+    /// not left parked.
+    #[test]
+    fn the_status_cancel_closes_the_logon() {
+        let (realm_tx, realm_rx) = crossbeam_channel::unbounded();
+        let abandon = std::sync::Arc::new(std::sync::atomic::AtomicU64::new(0));
+        let mut app = App::new();
+        app.init_resource::<GlueDialog>()
+            .init_resource::<LoginIntent>()
+            .insert_resource(crate::realmlist::Realmlist::unpinned(
+                crate::realmlist::DEFAULT_REALMLIST,
+            ))
+            .insert_resource(LoginAbandon(abandon.clone()))
+            .insert_resource(crate::net::RealmChoice(realm_tx))
+            .add_message::<crate::glue::dialog::GlueDialogAnswer>()
+            .add_systems(Update, answer_dialog);
+        app.world_mut().resource_mut::<LoginIntent>().in_flight = true;
+        app.world_mut()
+            .write_message(crate::glue::dialog::GlueDialogAnswer {
+                kind: DialogKind::Status,
+                button1: true,
+                button2: false,
+            });
+        app.update();
+        assert_eq!(abandon.load(Ordering::SeqCst), 1);
+        assert!(matches!(
+            realm_rx.try_recv(),
+            Ok(crate::net::RealmRequest::Close)
+        ));
+        assert!(!app.world().resource::<LoginIntent>().in_flight);
+    }
+
+    /// The realm list's Cancel over the login screen ends the attempt (#833): the logon closes
+    /// and the next Login is sent, where the attempt left in flight refused it.
+    #[test]
+    fn the_realm_lists_cancel_lets_the_next_login_through() {
+        let (tx, requests) = crossbeam_channel::unbounded();
+        let (realm_tx, realm_rx) = crossbeam_channel::unbounded();
+        let mut app = App::new();
+        app.add_plugins(MinimalPlugins)
+            .init_resource::<crate::glue::GlueClicks>()
+            .init_resource::<ButtonInput<KeyCode>>()
+            .init_resource::<crate::bindings::LayoutNames>()
+            .insert_non_send_resource(HostClipboard::default())
+            .init_resource::<LoginForm>()
+            .init_resource::<LoginIntent>()
+            .init_resource::<GlueDialog>()
+            .init_resource::<crate::realm_select::Realms>()
+            .insert_resource(crate::realmlist::Realmlist::unpinned(
+                crate::realmlist::DEFAULT_REALMLIST,
+            ))
+            .insert_resource(LoginSubmit(tx))
+            .insert_resource(LoginAbandon(std::sync::Arc::new(
+                std::sync::atomic::AtomicU64::new(0),
+            )))
+            .insert_resource(crate::net::RealmChoice(realm_tx))
+            .insert_resource(State::new(ClientState::Login))
+            .add_message::<KeyboardInput>()
+            .add_message::<GlueSound>()
+            .add_message::<GlueLogin>()
+            .add_message::<bevy::input::mouse::MouseWheel>()
+            .add_systems(PreUpdate, crate::realm_select::take_input)
+            .add_systems(
+                Update,
+                (crate::realm_select::list_keys, answer_glue, login_input).chain(),
+            );
+        {
+            let w = app.world_mut();
+            let mut form = w.resource_mut::<LoginForm>();
+            form.account.text = "probe".into();
+            form.password.text = "secret".into();
+            // The attempt reached the realm park, which raised the list over this screen.
+            w.resource_mut::<LoginIntent>().in_flight = true;
+            w.resource_mut::<crate::realm_select::Realms>().shown = true;
+        }
+        let press = |app: &mut App, key: KeyCode| {
+            app.world_mut()
+                .resource_mut::<ButtonInput<KeyCode>>()
+                .press(key);
+            app.update();
+            app.world_mut()
+                .resource_mut::<ButtonInput<KeyCode>>()
+                .clear();
+        };
+        press(&mut app, KeyCode::Escape);
+        assert!(
+            matches!(realm_rx.try_recv(), Ok(crate::net::RealmRequest::Close)),
+            "Cancel closes the logon"
+        );
+        assert!(!app.world().resource::<LoginIntent>().in_flight);
+        app.update(); // the list's input ownership settles
+        press(&mut app, KeyCode::Enter);
+        let req = requests.try_recv().expect("the next Login is sent");
+        assert_eq!(req.user, "probe");
+    }
+
     /// A lost session does not log itself back in: a displaced client's resubmit would kick the
     /// client that displaced it. `GlueParent.lua` retries nothing.
     #[test]
diff --git a/crates/benilla-app/src/net.rs b/crates/benilla-app/src/net.rs
index 7f0a1c3b..49b66ac1 100644
--- a/crates/benilla-app/src/net.rs
+++ b/crates/benilla-app/src/net.rs
@@ -401,16 +401,28 @@ pub(crate) enum CharRequest {
 #[derive(Resource)]
 pub(crate) struct RealmChoice(pub(crate) Sender<RealmRequest>);
 
-/// One request to the IO thread parked at the realm list.
+/// One request to the IO thread about the realm list, served at the logon park and at character
+/// select; at the login park a query fails and the rest are dropped.
 #[derive(Debug)]
 pub(crate) enum RealmRequest {
-    /// Enter this realm, by name: the list refreshes while open, so an index could shift.
-    Enter(String),
-    /// Re-request the realm list (`RequestRealmList`, every 5 s from `RealmList_OnUpdate`).
+    /// Dial this realm (`ConnectToRealm`, `0x46b210`), the record as the list held it, as the
+    /// reference dials its copy (`0xc27fb8`) whatever a later list says. `generation` is the
+    /// abandon generation the app held when it asked: a later Cancel ends the dial however early
+    /// it lands.
+    Enter {
+        realm: benilla_protocol::RealmInfo,
+        generation: u64,
+    },
+    /// Query the realm list (`RequestRealmList`, every 5 s from `RealmList_OnUpdate`); the answer
+    /// is a [`RealmListMessage`], failed when the link gave none.
     Refresh,
-    /// Cancel (`RealmList_OnCancel` only hides the frame): the screen underneath stays, login or
-    /// character select.
-    Abandon,
+    /// `CLoginMgr::Cancel` (`0x5b3320`, from `RealmListDialogCancelled` on the login screen, the
+    /// logon's Cancel and `DisconnectFromServer`): the realmd link closes and the thread parks for
+    /// credentials. At character select, where `RealmListDialogCancelled` is a no-op, nothing.
+    Close,
+    /// `ConnectToRealm` with the world up (`0x46b22b` → `0x5ab1a0`): the session at character
+    /// select drops and the thread returns to the logon park, realmd still up. Elsewhere, nothing.
+    Leave,
 }
 
 /// The credentials channel to the IO thread's pre-logon park, sent by [`crate::login`].
@@ -418,10 +430,17 @@ pub(crate) enum RealmRequest {
 pub(crate) struct LoginSubmit(pub(crate) Sender<io::LoginRequest>);
 
 /// The login abandon generation: Cancel bumps it, and the IO thread drops an
-/// [`io::LoginRequest`] submitted under an older value.
+/// [`io::LoginRequest`] or a [`RealmRequest::Enter`] asked under an older value.
 #[derive(Resource)]
 pub(crate) struct LoginAbandon(pub(crate) std::sync::Arc<std::sync::atomic::AtomicU64>);
 
+impl LoginAbandon {
+    /// The generation an ask is stamped with now.
+    pub(crate) fn now(abandon: Option<&LoginAbandon>) -> u64 {
+        abandon.map_or(0, |a| a.0.load(std::sync::atomic::Ordering::SeqCst))
+    }
+}
+
 /// Guid to entity for every kind, items included, like the reference's one `ClntObjMgr` index.
 /// Written only by `net::objects`.
 #[derive(Resource, Default)]
@@ -1978,10 +1997,12 @@ pub(crate) enum ClientCommand {
     },
 }
 
-/// The realm list (`CMD_REALM_LIST`); the IO thread waits for [`crate::realm_select`] to pick.
+/// The realm list (`CMD_REALM_LIST`); the IO thread waits for a [`RealmRequest`]. `failed` is a
+/// query that got no answer (`REALM_LIST_FAILED`), `realms` then the list last held.
 #[derive(Message)]
 pub(crate) struct RealmListMessage {
     pub(crate) realms: Vec<benilla_protocol::RealmInfo>,
+    pub(crate) failed: bool,
 }
 
 /// The character roster (`SMSG_CHAR_ENUM`); the IO thread waits for [`crate::char_select`] to
diff --git a/crates/benilla-app/src/net/io.rs b/crates/benilla-app/src/net/io.rs
index 9544d3f7..954730aa 100644
--- a/crates/benilla-app/src/net/io.rs
+++ b/crates/benilla-app/src/net/io.rs
@@ -1,7 +1,9 @@
 //! The background networking threads, the socket half of the net bridge.
 //!
-//! [`spawn_net`]'s read thread parks pre-logon for a [`LoginRequest`], walks logon, realm and
-//! world handshake, then parks at character select until the app picks a guid. The pick sends
+//! [`spawn_net`]'s read thread parks pre-logon for a [`LoginRequest`], logs on to realmd, then
+//! holds the realmd link at the logon park, serving realm list queries, until the app names a realm
+//! or closes the logon; a world attempt that fails returns there. Past the world handshake it
+//! parks at character select until the app picks a guid; a new login supersedes either park. The pick sends
 //! `CMSG_PLAYER_LOGIN` and announces the connection without waiting for the verdict, as the
 //! reference's world is already loading when it sends the login (`0x46c272`), so the destination's
 //! tiles stream a round trip early; a later `SMSG_CHARACTER_LOGIN_FAILED` ends the cycle like a
@@ -20,8 +22,8 @@ use std::time::{Duration, Instant};
 use anyhow::{anyhow, Result};
 use benilla_assets::LockRecover;
 use benilla_protocol::{
-    host_port, messages, AuthReject, CharAction, LoginStage, Poll, SessionEnd, SessionEvent,
-    WardenRequired, WorldSession, WorldWriter, WORLD_PORT,
+    messages, AuthReject, CharAction, LoginStage, Poll, SessionEnd, SessionEvent, WardenRequired,
+    WorldSession, WorldWriter,
 };
 use crossbeam_channel::{Receiver, Sender};
 
@@ -74,7 +76,7 @@ pub(super) struct Parks {
     pub(super) pick_rx: Receiver<CharRequest>,
 }
 
-/// How long a realm-list refresh waits for realmd; the park serving the list is deaf that long.
+/// How long a realm-list query waits for realmd; the park serving it is deaf that long.
 const REALM_REFRESH_TIMEOUT: Duration = Duration::from_secs(5);
 
 /// The reference's 30 s ping timer (`0x537ff0`). vmangos kicks a socket whose pings come faster
@@ -153,10 +155,15 @@ enum Parked {
     Acted(CharAction, u8),
     /// Stay parked: a realm-list refresh, or a Cancel over this screen.
     StayPut,
-    /// Drop the parked world session and dial this realm.
-    Realm(benilla_protocol::RealmInfo),
+    /// Drop the parked world session and dial this realm under the abandon generation its ask
+    /// carried.
+    Realm(benilla_protocol::RealmInfo, u64),
+    /// Drop the parked world session and return to the logon park.
+    Leave,
     /// Select's Back: return to the pre-logon park.
     Repark,
+    /// A new login: drop the session and the logon, and run it.
+    Login(LoginRequest),
     /// The app dropped a channel end.
     Exit,
 }
@@ -293,10 +300,147 @@ pub(super) fn spawn_net(connect: bool) -> NetHandles {
     }
 }
 
-/// One connection cycle: park for credentials, logon, park at the realm list, world handshake,
-/// roster, park at character select, enter the world and stream [`SessionEvent`]s until the socket
-/// dies, the character logs out or the app exits. A pre-roster failure emits
-/// [`SessionEvent::LoginFailed`] and re-parks; any retry is the app's.
+/// What the logon park's wait ended with.
+enum LogonAnswer {
+    /// `ChangeRealm` (`0x46f0e0`): dial this realm with the logon's session key, under the abandon
+    /// generation the ask carried.
+    Enter(benilla_protocol::RealmInfo, u64),
+    /// A new login supersedes the logon, as `CGlueMgr::Login` (`0x46afb0`) starts the next logon
+    /// whatever link the last one left.
+    Login(LoginRequest),
+    /// `CLoginMgr::Cancel` (`0x5b3320`): the realmd link closes and the thread parks for
+    /// credentials.
+    Close,
+    /// The app dropped a channel end.
+    Exit,
+}
+
+/// How one world attempt ended.
+enum WorldEnd {
+    /// The cycle is over.
+    Cycle(Cycle),
+    /// It failed before the roster, reported, or was cancelled, or Change Realm left the session at
+    /// character select: the logon park resumes with the realmd link up, as the reference's
+    /// state-2 failure arm (`0x46bea7`-`0x46bf96`) and `ConnectToRealm`'s disconnect (`0x46b22b`)
+    /// drop only the world socket.
+    Failed,
+    /// A new login superseded the session at character select.
+    Login(LoginRequest),
+}
+
+/// Publish a realm list: a fresh one, or with `failed` the last one held, after a query that got
+/// no answer (`REALM_LIST_FAILED`). False once the app is gone.
+fn publish(
+    events_tx: &Sender<SessionEvent>,
+    realms: &[benilla_protocol::RealmInfo],
+    failed: bool,
+) -> bool {
+    events_tx
+        .send(SessionEvent::RealmList {
+            realms: realms.to_vec(),
+            failed,
+        })
+        .is_ok()
+}
+
+/// A realm list query on the realmd link, `RequestRealmList`'s (`0x5ab840`) and the connect's
+/// own (`0x5aab6d`), then the answer published. A request that fails for any reason (the link
+/// realmd closed, the 5 s timeout, a reply that does not parse) dials realmd again and asks once
+/// more; vmangos closes every link after `MaxSessionDuration`, 300 s by default, while a list may
+/// stand longer. False once the app is gone.
+///
+/// Deviation: the reference re-dials only from `RequestRealmList`, and only when the link is down
+/// (`[CLoginMgr+5]` clear, `0x5ab857` → `0x5b2200`), with the reconnect challenge (`0x5b2134`,
+/// `[Logon+0xc]`); the connect's query sends only on a link in state 6 (`0x5bc14c`) and otherwise
+/// nothing, leaving the screen on its connecting dialog for good. Here both queries re-dial on
+/// any failure, with a full logon from the cycle's credentials, because benilla's logon has no
+/// reconnect exchange and a connect that can never complete is a dead end, not a behaviour; the
+/// new session key serves the next world dial as the reconnect's would.
+fn query(
+    logon: &mut benilla_protocol::Logon,
+    req: &LoginRequest,
+    events_tx: &Sender<SessionEvent>,
+) -> bool {
+    let mut ok = logon.refresh_realms(REALM_REFRESH_TIMEOUT);
+    if !ok {
+        match benilla_protocol::logon(&req.host, &req.user, &req.pass) {
+            Ok(fresh) => {
+                *logon = fresh;
+                ok = true;
+            }
+            Err(e) => bevy::log::warn!("net: realm list re-dial failed: {e:#}"),
+        }
+    }
+    publish(events_tx, &logon.realms, !ok)
+}
+
+/// The pre-logon park: waits for credentials. With no realmd link, a realm list query fails at
+/// once and a dial or a close has nothing to act on. `None` once the app is gone.
+fn login_park(parks: &Parks, events_tx: &Sender<SessionEvent>) -> Option<LoginRequest> {
+    bevy::log::info!("net: parked at the login screen — waiting for credentials");
+    let Parks {
+        login_rx, realm_rx, ..
+    } = parks;
+    loop {
+        // No `break` or `continue` inside the `select!` arms: the macro expands into a loop of its
+        // own, which they would bind to.
+        let answer = crossbeam_channel::select! {
+            recv(login_rx) -> req => Some(req.ok()),
+            recv(realm_rx) -> msg => match msg {
+                Err(_) => Some(None),
+                Ok(RealmRequest::Refresh) => (!publish(events_tx, &[], true)).then_some(None),
+                Ok(_) => None,
+            },
+        };
+        if let Some(req) = answer {
+            return req;
+        }
+    }
+}
+
+/// The logon park: the realmd link is up and the list published. Waits for the app's realm,
+/// answering list queries in place on the link (`RequestRealmList`, `0x5ab840`); a new login
+/// supersedes it and a close ends it.
+fn logon_park(
+    logon: &mut benilla_protocol::Logon,
+    req: &LoginRequest,
+    parks: &Parks,
+    events_tx: &Sender<SessionEvent>,
+) -> LogonAnswer {
+    bevy::log::info!(
+        "net: parked at the realm list — {} realm(s) published",
+        logon.realms.len()
+    );
+    let Parks {
+        login_rx, realm_rx, ..
+    } = parks;
+    loop {
+        let answer = crossbeam_channel::select! {
+            recv(realm_rx) -> msg => match msg {
+                Err(_) => Some(LogonAnswer::Exit),
+                Ok(RealmRequest::Refresh) => {
+                    (!query(logon, req, events_tx)).then_some(LogonAnswer::Exit)
+                }
+                Ok(RealmRequest::Enter { realm, generation }) => {
+                    Some(LogonAnswer::Enter(realm, generation))
+                }
+                Ok(RealmRequest::Close) => Some(LogonAnswer::Close),
+                // No world session here to leave.
+                Ok(RealmRequest::Leave) => None,
+            },
+            recv(login_rx) -> msg => Some(msg.map_or(LogonAnswer::Exit, LogonAnswer::Login)),
+        };
+        if let Some(answer) = answer {
+            return answer;
+        }
+    }
+}
+
+/// One connection cycle: park for credentials, logon, the logon park over the realm list, world
+/// handshake, roster, park at character select, enter the world and stream [`SessionEvent`]s
+/// until the socket dies, the character logs out or the app exits. A logon failure emits
+/// [`SessionEvent::LoginFailed`] and re-parks for credentials; a world attempt's failure emits it
+/// and returns to the logon park; any retry is the app's.
 fn run(
     events_tx: &Sender<SessionEvent>,
     writer_tx: &Sender<WorldWriter>,
@@ -305,20 +449,121 @@ fn run(
     ping_clock: &Mutex<PingClock>,
     tails_announced: &mut std::collections::HashSet<u16>,
 ) -> Result<Cycle> {
+    let Some(mut req) = login_park(parks, events_tx) else {
+        return Ok(Cycle::Exit);
+    };
+    'logon: loop {
+        // Checked at every stage boundary; a blocking dial's result is discarded.
+        let generation = req.generation;
+        let canceled = || abandon.load(Ordering::SeqCst) != generation;
+        let stage = |s: LoginStage| {
+            let _ = events_tx.send(SessionEvent::LoginStage { stage: s });
+        };
+
+        // Logon: the dial and the SRP6 exchange against realmd.
+        stage(LoginStage::Connecting);
+        let mut logon = match benilla_protocol::logon(&req.host, &req.user, &req.pass) {
+            Ok(l) => l,
+            Err(e) => {
+                if canceled() {
+                    return Ok(Cycle::Repark);
+                }
+                // A dial that never opened a socket, the one failure the screen can advise on.
+                let dial = e.downcast_ref::<benilla_protocol::DialFailure>().cloned();
+                // A server refusal carries its auth result byte for the `AUTH_*` string; a
+                // transport failure carries none.
+                let refusal = e.downcast_ref::<AuthReject>().map(|r| match r.reply {
+                    benilla_protocol::LogonReply::Challenge => {
+                        benilla_protocol::LoginRefusal::Logon(r.code)
+                    }
+                    benilla_protocol::LogonReply::Proof => {
+                        benilla_protocol::LoginRefusal::LogonProof(r.code)
+                    }
+                });
+                let _ = events_tx.send(SessionEvent::LoginFailed {
+                    refusal: if dial.is_some() { None } else { refusal },
+                    reason: format!("{e:#}"),
+                    terminal: false,
+                    dial,
+                });
+                return Ok(Cycle::Repark);
+            }
+        };
+        if canceled() {
+            return Ok(Cycle::Repark);
+        }
+
+        // ── The logon park ─────────────────────────────────────────────────────────────────────
+        //
+        // The login-side list, an empty one included: `RealmList` is a `frameStrata="DIALOG"`
+        // frame over the current glue screen. Change Realm is served at the character park.
+        //
+        // An answer queued during a dead cycle must not answer this list.
+        while parks.realm_rx.try_recv().is_ok() {}
+        if !publish(events_tx, &logon.realms, false) {
+            return Ok(Cycle::Exit);
+        }
+        let mut pick = match logon_park(&mut logon, &req, parks, events_tx) {
+            LogonAnswer::Enter(realm, generation) => (realm, generation),
+            LogonAnswer::Login(next) => {
+                req = next;
+                continue 'logon;
+            }
+            LogonAnswer::Close => return Ok(Cycle::Repark),
+            LogonAnswer::Exit => return Ok(Cycle::Exit),
+        };
+        loop {
+            let ended = world(
+                &req,
+                &mut logon,
+                pick.clone(),
+                events_tx,
+                writer_tx,
+                parks,
+                abandon,
+                ping_clock,
+                tails_announced,
+            )?;
+            match ended {
+                WorldEnd::Cycle(cycle) => return Ok(cycle),
+                WorldEnd::Login(next) => {
+                    req = next;
+                    continue 'logon;
+                }
+                WorldEnd::Failed => match logon_park(&mut logon, &req, parks, events_tx) {
+                    LogonAnswer::Enter(realm, generation) => pick = (realm, generation),
+                    LogonAnswer::Login(next) => {
+                        req = next;
+                        continue 'logon;
+                    }
+                    LogonAnswer::Close => return Ok(Cycle::Repark),
+                    LogonAnswer::Exit => return Ok(Cycle::Exit),
+                },
+            }
+        }
+    }
+}
+
+/// One world attempt and, past the roster, its session: the dial to `pick`'s realm, the roster,
+/// the character park, then the world stream. Change Realm at the character park dials again from here with the same
+/// session key. A cancel is an abandon generation past the one the pick carried.
+#[allow(clippy::too_many_arguments)]
+fn world(
+    req: &LoginRequest,
+    logon: &mut benilla_protocol::Logon,
+    pick: (benilla_protocol::RealmInfo, u64),
+    events_tx: &Sender<SessionEvent>,
+    writer_tx: &Sender<WorldWriter>,
+    parks: &Parks,
+    abandon: &AtomicU64,
+    ping_clock: &Mutex<PingClock>,
+    tails_announced: &mut std::collections::HashSet<u16>,
+) -> Result<WorldEnd> {
     let Parks {
         login_rx,
         realm_rx,
         pick_rx,
     } = parks;
-    // ── The pre-logon park ──────────────────────────────────────────────────────
-    bevy::log::info!("net: parked at the login screen — waiting for credentials");
-    let req = match login_rx.recv() {
-        Ok(req) => req,
-        Err(_) => return Ok(Cycle::Exit),
-    };
-    // Checked at every stage boundary; a blocking dial's result is discarded.
-    let generation = req.generation;
-    let canceled = move || abandon.load(Ordering::SeqCst) != generation;
     let stage = |s: LoginStage| {
         let _ = events_tx.send(SessionEvent::LoginStage { stage: s });
     };
@@ -329,17 +574,7 @@ fn run(
             terminal: false,
             dial: None,
         });
-        Ok(Cycle::Repark)
-    };
-    // A dial that never opened a socket, the one failure the screen can advise on.
-    let fail_dial = |dial: benilla_protocol::DialFailure, reason: String| {
-        let _ = events_tx.send(SessionEvent::LoginFailed {
-            refusal: None,
-            reason,
-            terminal: false,
-            dial: Some(dial),
-        });
-        Ok(Cycle::Repark)
+        Ok(WorldEnd::Failed)
     };
     // A failure resubmitting cannot fix: the app shows it and does not retry.
     let fail_terminal = |reason: String| {
@@ -349,111 +584,32 @@ fn run(
             terminal: true,
             dial: None,
         });
-        Ok(Cycle::Repark)
-    };
-
-    // Logon: the dial and the SRP6 exchange against realmd.
-    let mut logon = {
-        stage(LoginStage::Connecting);
-        match benilla_protocol::logon(&req.host, &req.user, &req.pass) {
-            Ok(l) => l,
-            Err(e) => {
-                if canceled() {
-                    return Ok(Cycle::Repark);
-                }
-                // A server refusal carries its auth result byte for the `AUTH_*` string; a
-                // transport failure carries none.
-                if let Some(dial) = e.downcast_ref::<benilla_protocol::DialFailure>() {
-                    return fail_dial(dial.clone(), format!("{e:#}"));
-                }
-                let refusal = e.downcast_ref::<AuthReject>().map(|r| match r.reply {
-                    benilla_protocol::LogonReply::Challenge => {
-                        benilla_protocol::LoginRefusal::Logon(r.code)
-                    }
-                    benilla_protocol::LogonReply::Proof => {
-                        benilla_protocol::LoginRefusal::LogonProof(r.code)
-                    }
-                });
-                return fail(refusal, format!("{e:#}"));
-            }
-        }
-    };
-    if canceled() {
-        return Ok(Cycle::Repark);
-    }
-
-    // ── The realm park ─────────────────────────────────────────────────────────────────────────
-    //
-    // The login-side list: `RealmList` is a `frameStrata="DIALOG"` frame over the current glue
-    // screen and `RealmList_OnCancel` only hides it, so Cancel here returns to the login screen.
-    // Change Realm is served at the character park. A server with no realms skips the park and
-    // dials the fallback address.
-    let mut realm = if logon.realms.is_empty() {
-        None
-    } else {
-        // An answer queued during a dead cycle must not answer this list.
-        while realm_rx.try_recv().is_ok() {}
-        loop {
-            if events_tx
-                .send(SessionEvent::RealmList {
-                    realms: logon.realms.clone(),
-                })
-                .is_err()
-            {
-                return Ok(Cycle::Exit);
-            }
-            bevy::log::info!(
-                "net: parked at the realm list — {} realm(s) published",
-                logon.realms.len()
-            );
-            let Ok(req) = realm_rx.recv() else {
-                return Ok(Cycle::Exit);
-            };
-            if canceled() {
-                return Ok(Cycle::Repark);
-            }
-            match req {
-                // Cancel over the login screen.
-                RealmRequest::Abandon => return Ok(Cycle::Repark),
-                // The reference re-requests the list every 5 s while it is up; a failed refresh
-                // keeps the list on screen (`Logon::refresh_realms`).
-                RealmRequest::Refresh => {
-                    logon.refresh_realms(REALM_REFRESH_TIMEOUT);
-                }
-                // By name, so a list that changed under the click cannot enter the wrong realm;
-                // a vanished name re-publishes the list.
-                RealmRequest::Enter(name) => {
-                    if let Some(realm) = logon.realms.iter().find(|r| r.name == name) {
-                        break Some(realm.clone());
-                    }
-                }
-            }
-        }
+        Ok(WorldEnd::Failed)
     };
 
     // ── The world half, once per realm ─────────────────────────────────────────────────────────
     //
     // Change Realm re-enters this loop: the SRP6 session key authenticates against any world
     // server on the account's list, so a switch costs one world dial and no re-authentication.
+    let (mut realm, mut generation) = pick;
     'realm: loop {
-        // Named, since the address alone cannot tell a chosen realm from the fallback.
-        if let Some(r) = &realm {
-            bevy::log::info!(
-                "net: realm {:?} ({} of {})",
-                r.name,
-                r.address,
-                logon.realms.len()
-            );
+        // The generation the app held when it asked for this dial: a Cancel after the ask ends
+        // the attempt, however early it lands, and an earlier attempt's cannot.
+        let canceled = || abandon.load(Ordering::SeqCst) != generation;
+        if canceled() {
+            return Ok(WorldEnd::Failed);
         }
-        let world_addr = realm
-            .as_ref()
-            .map(|r| r.address.clone())
-            // The fallback drops any auth `:port` from the realmlist for the world port.
-            .unwrap_or_else(|| format!("{}:{}", host_port(&req.host, WORLD_PORT).0, WORLD_PORT));
+        bevy::log::info!(
+            "net: realm {:?} ({} of {})",
+            realm.name,
+            realm.address,
+            logon.realms.len()
+        );
+        let world_addr = realm.address.clone();
 
         stage(LoginStage::Handshaking);
         // For the queue dialog to name; the roster that carries it comes after the queue.
-        let realm_name = realm.as_ref().map(|r| r.name.clone());
+        let realm_name = Some(realm.name.clone());
         // A queue can last minutes, so it tests the abandon generation itself; otherwise a Cancel
         // would close the dialog while this thread held its place and entered the world anyway.
         let mut on_queue = |event: benilla_protocol::WorldConnectEvent| {
@@ -477,7 +633,7 @@ fn run(
             Ok(s) => s,
             Err(e) => {
                 if canceled() {
-                    return Ok(Cycle::Repark);
+                    return Ok(WorldEnd::Failed);
                 }
                 // A Warden refusal is the server's answer, not a transport fault.
                 if let Some(w) = e.downcast_ref::<WardenRequired>() {
@@ -495,7 +651,7 @@ fn run(
         };
         // A cancel during the queue must not be overtaken by the roster.
         if canceled() {
-            return Ok(Cycle::Repark);
+            return Ok(WorldEnd::Failed);
         }
 
         // The roster as the account holds it, an empty one included: the reference builds
@@ -505,7 +661,7 @@ fn run(
             Ok(c) => c,
             Err(e) => {
                 if canceled() {
-                    return Ok(Cycle::Repark);
+                    return Ok(WorldEnd::Failed);
                 }
                 if let Some(w) = e.downcast_ref::<WardenRequired>() {
                     return fail_terminal(w.to_string());
@@ -514,7 +670,7 @@ fn run(
             }
         };
         if canceled() {
-            return Ok(Cycle::Repark);
+            return Ok(WorldEnd::Failed);
         }
         // A pick or realm answer queued during a dead cycle must not answer this roster: a logout
         // must land on the list, not bounce back in off a stale pick. The app re-sends its wants.
@@ -523,11 +679,11 @@ fn run(
         if events_tx
             .send(SessionEvent::CharacterList {
                 characters: characters.clone(),
-                realm: realm.clone(),
+                realm: Some(realm.clone()),
             })
             .is_err()
         {
-            return Ok(Cycle::Exit);
+            return Ok(WorldEnd::Cycle(Cycle::Exit));
         }
 
         // Park at character select until the app answers. Create and delete are serviced in place.
@@ -541,31 +697,26 @@ fn run(
             // No `break` or `continue` inside the `select!` arms: the macro expands into a loop of
             // its own, which they would bind to. The arms answer with a [`Parked`].
             let answer = crossbeam_channel::select! {
-                recv(realm_rx) -> req => match req {
+                recv(realm_rx) -> msg => match msg {
                     Err(_) => Parked::Exit,
-                    // `RequestRealmList`: refresh on the realmd socket this cycle holds, then
-                    // republish; also Change Realm's first list.
+                    // `RequestRealmList`: a query on the realmd link this cycle holds, then the
+                    // list; also Change Realm's first list.
                     Ok(RealmRequest::Refresh) => {
-                        logon.refresh_realms(REALM_REFRESH_TIMEOUT);
-                        if events_tx
-                            .send(SessionEvent::RealmList { realms: logon.realms.clone() })
-                            .is_err()
-                        {
-                            Parked::Exit
-                        } else {
+                        if query(logon, req, events_tx) {
                             Parked::StayPut
+                        } else {
+                            Parked::Exit
                         }
                     }
-                    // `RealmList_OnCancel` over character select: only the dialog hides.
-                    Ok(RealmRequest::Abandon) => Parked::StayPut,
+                    // `RealmListDialogCancelled` over character select is a no-op (`0x46b810`).
+                    Ok(RealmRequest::Close) => Parked::StayPut,
                     // `ChangeRealm(category, index)`: dial the chosen realm with the session key
-                    // we hold; a vanished name changes nothing.
-                    Ok(RealmRequest::Enter(name)) => logon
-                        .realms
-                        .iter()
-                        .find(|r| r.name == name)
-                        .cloned()
-                        .map_or(Parked::StayPut, Parked::Realm),
+                    // we hold.
+                    Ok(RealmRequest::Enter { realm, generation }) => {
+                        Parked::Realm(realm, generation)
+                    }
+                    // `ConnectToRealm` with the world up drops it first (`0x46b22b`).
+                    Ok(RealmRequest::Leave) => Parked::Leave,
                 },
                 recv(pick_rx) -> pick => match pick {
                     Err(_) => Parked::Exit,
@@ -579,16 +730,19 @@ fn run(
                         Parked::Acted(CharAction::Delete, session.delete_character(target)?)
                     }
                 },
+                recv(login_rx) -> msg => msg.map_or(Parked::Exit, Parked::Login),
             };
             let (action, code) = match answer {
-                Parked::Exit => return Ok(Cycle::Exit),
-                Parked::Repark => return Ok(Cycle::Repark),
+                Parked::Exit => return Ok(WorldEnd::Cycle(Cycle::Exit)),
+                Parked::Repark => return Ok(WorldEnd::Cycle(Cycle::Repark)),
+                Parked::Login(next) => return Ok(WorldEnd::Login(next)),
                 Parked::StayPut => continue,
                 Parked::Play(guid) => break guid,
-                Parked::Realm(chosen) => {
-                    realm = Some(chosen);
+                Parked::Realm(chosen, asked) => {
+                    (realm, generation) = (chosen, asked);
                     continue 'realm;
                 }
+                Parked::Leave => return Ok(WorldEnd::Failed),
                 Parked::Acted(action, code) => (action, code),
             };
             // A success changed the roster: re-emit it before the result, so the screen has the
@@ -602,18 +756,18 @@ fn run(
                 if events_tx
                     .send(SessionEvent::CharacterList {
                         characters: characters.clone(),
-                        realm: realm.clone(),
+                        realm: Some(realm.clone()),
                     })
                     .is_err()
                 {
-                    return Ok(Cycle::Exit);
+                    return Ok(WorldEnd::Cycle(Cycle::Exit));
                 }
             }
             if events_tx
                 .send(SessionEvent::CharActionResult { action, code })
                 .is_err()
             {
-                return Ok(Cycle::Exit);
+                return Ok(WorldEnd::Cycle(Cycle::Exit));
             }
         };
         let name = characters
@@ -657,11 +811,11 @@ fn run(
             })
             .is_err()
         {
-            return Ok(Cycle::Exit);
+            return Ok(WorldEnd::Cycle(Cycle::Exit));
         }
         if writer_tx.send(writer).is_err() {
             // The writer thread ends only on app exit.
-            return Ok(Cycle::Exit);
+            return Ok(WorldEnd::Cycle(Cycle::Exit));
         }
         bevy::log::info!("net: connected to {world_addr}");
 
@@ -714,10 +868,10 @@ fn run(
                         };
                         // Receiver dropped: the app exited.
                         if events_tx.send(ev).is_err() {
-                            return Ok(Cycle::Exit);
+                            return Ok(WorldEnd::Cycle(Cycle::Exit));
                         }
                         if let Some(cycle) = ends {
-                            return Ok(cycle);
+                            return Ok(WorldEnd::Cycle(cycle));
                         }
                     }
                 }
@@ -748,7 +902,7 @@ fn run(
                         })
                         .is_err()
                     {
-                        return Ok(Cycle::Exit);
+                        return Ok(WorldEnd::Cycle(Cycle::Exit));
                     }
                     if skip_run > 1024 {
                         return Err(anyhow!("world stream desynced after 1024 skipped packets"));
@@ -1487,6 +1641,9 @@ mod wire_trace;
 #[cfg(test)]
 mod cycle_tests;
 
+#[cfg(test)]
+pub(crate) mod fake;
+
 #[cfg(test)]
 mod rtt_tests {
     use super::{PingClock, RTT_RING};
diff --git a/crates/benilla-app/src/net/io/cycle_tests.rs b/crates/benilla-app/src/net/io/cycle_tests.rs
index c30a155f..7f02067a 100644
--- a/crates/benilla-app/src/net/io/cycle_tests.rs
+++ b/crates/benilla-app/src/net/io/cycle_tests.rs
@@ -1,206 +1,22 @@
-//! The login cycle, [`super::run`], against a fake realmd and a fake world server on loopback: the
-//! real logon, realm park, world handshake and roster, driven through the parks as the app does.
+//! The login cycle, [`super::run`], against a fake realmd and a fake world server on loopback
+//! ([`super::fake`]): the real logon, the logon park, world handshake and roster, driven through
+//! the parks as the app does.
 
-use std::io::{Read, Write};
-use std::net::{TcpListener, TcpStream};
 use std::sync::atomic::AtomicU64;
-use std::sync::{Arc, Mutex};
+use std::sync::Mutex;
 use std::thread;
-use std::time::Duration;
 
-use benilla_protocol::messages::{self, opcode};
-use benilla_protocol::{SessionEvent, WorldWriter};
-use benilla_srp::vanilla_header::HeaderCrypto;
-use benilla_srp::{
-    password_verifier, NormalizedString, GENERATOR, LARGE_SAFE_PRIME_LITTLE_ENDIAN,
-    SESSION_KEY_LENGTH,
-};
-use crossbeam_channel::{Receiver, Sender};
-use num_bigint::BigUint;
-use sha1::{Digest, Sha1};
+use benilla_protocol::messages::opcode;
+use benilla_protocol::{RealmInfo, SessionEvent, WorldWriter};
 
+use super::fake::{self, FakeRealm, WAIT};
 use super::{run, Cycle, LoginRequest, Parks, PingClock};
 use crate::net::{CharRequest, RealmRequest};
 
-const USER: &str = "empty";
-const PASS: &str = "secret";
 const REALM: &str = "Fake";
-const SALT: [u8; 32] = [0x5a; 32];
-/// Every wait in the test: long enough for a loaded machine, short of a hung gate.
-const WAIT: Duration = Duration::from_secs(20);
-
-fn sha1(parts: &[&[u8]]) -> [u8; 20] {
-    let mut h = Sha1::new();
-    for p in parts {
-        h.update(p);
-    }
-    h.finalize().into()
-}
-
-fn le32(v: &BigUint) -> [u8; 32] {
-    let raw = v.to_bytes_le();
-    let mut out = [0u8; 32];
-    out[..raw.len()].copy_from_slice(&raw);
-    out
-}
-
-/// `SHA1_Interleave` over all 32 bytes of `S`, as vmangos's `SRP6::HashSessionKey` does.
-fn interleave(s: &[u8; 32]) -> [u8; SESSION_KEY_LENGTH] {
-    let even: Vec<u8> = s.iter().step_by(2).copied().collect();
-    let odd: Vec<u8> = s.iter().skip(1).step_by(2).copied().collect();
-    let (g, h) = (sha1(&[&even]), sha1(&[&odd]));
-    let mut out = [0u8; SESSION_KEY_LENGTH];
-    for (i, (gi, hi)) in g.iter().zip(&h).enumerate() {
-        out[i * 2] = *gi;
-        out[i * 2 + 1] = *hi;
-    }
-    out
-}
-
-/// A realmd that logs [`USER`] in with the server half of SRP6 and lists one realm, [`REALM`] at
-/// `world`. The session key goes to the fake world server, which needs it for the header cipher.
-fn fake_realmd(world: String, keys: Sender<[u8; SESSION_KEY_LENGTH]>) -> String {
-    let listener = TcpListener::bind("127.0.0.1:0").unwrap();
-    let addr = listener.local_addr().unwrap().to_string();
-    thread::spawn(move || {
-        let (mut s, _) = listener.accept().unwrap();
-        let n = BigUint::from_bytes_le(&LARGE_SAFE_PRIME_LITTLE_ENDIAN);
-        let g = BigUint::from(GENERATOR);
-        let user = NormalizedString::new(USER).unwrap();
-        let pass = NormalizedString::new(PASS).unwrap();
-        let v = BigUint::from_bytes_le(&password_verifier(&user, &pass, &SALT));
-
-        // CMD_AUTH_LOGON_CHALLENGE_Client: opcode, protocol, u16 size, then the body.
-        let mut head = [0u8; 4];
-        s.read_exact(&mut head).unwrap();
-        let mut body = vec![0u8; usize::from(u16::from_le_bytes([head[2], head[3]]))];
-        s.read_exact(&mut body).unwrap();
-
-        // B = k·v + g^b, with k = 3; `b` walks until `B`'s top byte is non-zero, since the client
-        // redials on a zero one.
-        let (b, b_pub) = (1u32..)
-            .map(|i| {
-                let b = BigUint::from_bytes_le(&[0x3c; 32]) + i;
-                let b_pub = le32(&((BigUint::from(3u8) * &v + g.modpow(&b, &n)) % &n));
-                (b, b_pub)
-            })
-            .find(|(_, b_pub)| b_pub[31] != 0)
-            .unwrap();
-        let mut reply = vec![0x00, 0x00, 0x00];
-        reply.extend_from_slice(&b_pub);
-        reply.extend_from_slice(&[1, GENERATOR, 32]);
-        reply.extend_from_slice(&LARGE_SAFE_PRIME_LITTLE_ENDIAN);
-        reply.extend_from_slice(&SALT);
-        reply.extend_from_slice(&[0u8; 16]); // crc_salt
-        reply.push(0); // security_flag
-        s.write_all(&reply).unwrap();
-
-        // CMD_AUTH_LOGON_PROOF_Client: opcode, A, M1, crc_hash, key count, security flag.
-        let mut proof = [0u8; 75];
-        s.read_exact(&mut proof).unwrap();
-        let (a_pub, m1) = (&proof[1..33], &proof[33..53]);
-        let u = BigUint::from_bytes_le(&sha1(&[a_pub, &b_pub]));
-        let a = BigUint::from_bytes_le(a_pub);
-        let big_s = (a * v.modpow(&u, &n) % &n).modpow(&b, &n);
-        let key = interleave(&le32(&big_s));
-        let mut reply = vec![0x01, 0x00];
-        reply.extend_from_slice(&sha1(&[a_pub, m1, &key]));
-        reply.extend_from_slice(&0u32.to_le_bytes()); // hardware_survey_id
-        s.write_all(&reply).unwrap();
-        keys.send(key).unwrap();
-
-        // CMD_REALM_LIST_Client, answered with the one realm.
-        s.read_exact(&mut [0u8; 5]).unwrap();
-        let mut realm = Vec::new();
-        realm.extend_from_slice(&0u32.to_le_bytes()); // realm_type
-        realm.push(0); // flags
-        realm.extend_from_slice(format!("{REALM}\0{world}\0").as_bytes());
-        realm.extend_from_slice(&0f32.to_le_bytes()); // population
-        realm.extend_from_slice(&[0, 1, 1]); // characters, category, id
-        let mut list = vec![0x10];
-        list.extend_from_slice(&((4 + 1 + realm.len() + 2) as u16).to_le_bytes());
-        list.extend_from_slice(&0u32.to_le_bytes());
-        list.push(1);
-        list.extend_from_slice(&realm);
-        list.extend_from_slice(&0u16.to_le_bytes());
-        s.write_all(&list).unwrap();
-
-        // Held until the cycle drops the logon, as realmd keeps it for the list refresh.
-        let _ = s.read(&mut [0u8; 1]);
-    });
-    addr
-}
-
-/// A server packet: `u16` BE size counting the opcode, `u16` LE opcode, the body.
-fn send(s: &mut TcpStream, crypto: Option<&mut HeaderCrypto>, op: u16, body: &[u8]) {
-    let size = ((body.len() + 2) as u16).to_be_bytes();
-    let op = op.to_le_bytes();
-    let mut header = [size[0], size[1], op[0], op[1]];
-    if let Some(c) = crypto {
-        c.encrypter().encrypt(&mut header);
-    }
-    s.write_all(&header).unwrap();
-    s.write_all(body).unwrap();
-}
-
-/// A client packet's opcode, reading past its body: `u16` BE size counting the 4-byte opcode.
-fn recv(s: &mut TcpStream, crypto: Option<&mut HeaderCrypto>) -> Option<u16> {
-    let mut header = [0u8; 6];
-    s.read_exact(&mut header).ok()?;
-    if let Some(c) = crypto {
-        c.decrypter().decrypt(&mut header);
-    }
-    let size = usize::from(u16::from_be_bytes([header[0], header[1]]));
-    s.read_exact(&mut vec![0u8; size.saturating_sub(4)]).ok()?;
-    Some(u16::from_le_bytes([header[2], header[3]]))
-}
-
-/// A world server whose account has no characters: it admits the session under realmd's key,
-/// answers every `CMSG_CHAR_ENUM` with an empty roster and a `CMSG_CHAR_CREATE` with success, and
-/// logs every opcode the client sends.
-fn fake_world(
-    listener: TcpListener,
-    keys: Receiver<[u8; SESSION_KEY_LENGTH]>,
-) -> Arc<Mutex<Vec<u16>>> {
-    let sent = Arc::new(Mutex::new(Vec::new()));
-    let log = Arc::clone(&sent);
-    thread::spawn(move || {
-        let (mut s, _) = listener.accept().unwrap();
-        send(
-            &mut s,
-            None,
-            opcode::SMSG_AUTH_CHALLENGE,
-            &0xDEAD_BEEFu32.to_le_bytes(),
-        );
-        assert_eq!(recv(&mut s, None), Some(opcode::CMSG_AUTH_SESSION));
-        let mut crypto = HeaderCrypto::from_session_key(keys.recv_timeout(WAIT).unwrap());
-        send(
-            &mut s,
-            Some(&mut crypto),
-            opcode::SMSG_AUTH_RESPONSE,
-            &[messages::AUTH_OK],
-        );
-        while let Some(op) = recv(&mut s, Some(&mut crypto)) {
-            log.lock().unwrap().push(op);
-            match op {
-                opcode::CMSG_CHAR_ENUM => {
-                    send(&mut s, Some(&mut crypto), opcode::SMSG_CHAR_ENUM, &[0]);
-                }
-                opcode::CMSG_CHAR_CREATE => send(
-                    &mut s,
-                    Some(&mut crypto),
-                    opcode::SMSG_CHAR_CREATE,
-                    &[messages::CHAR_CREATE_SUCCESS],
-                ),
-                _ => {}
-            }
-        }
-    });
-    sent
-}
 
 /// The next event, skipping the stage announcements; a login failure fails the test by name.
-fn next_event(events: &Receiver<SessionEvent>) -> SessionEvent {
+fn next_event(events: &crossbeam_channel::Receiver<SessionEvent>) -> SessionEvent {
     loop {
         match events.recv_timeout(WAIT).expect("the cycle went quiet") {
             SessionEvent::LoginStage { .. } => continue,
@@ -210,16 +26,28 @@ fn next_event(events: &Receiver<SessionEvent>) -> SessionEvent {
     }
 }
 
+/// A dial of `realm` asked under generation 0, the cycles' start.
+fn enter(realm: RealmInfo) -> RealmRequest {
+    RealmRequest::Enter {
+        realm,
+        generation: 0,
+    }
+}
+
+/// The next realm list, its realms and whether the query failed.
+fn next_list(events: &crossbeam_channel::Receiver<SessionEvent>) -> (Vec<RealmInfo>, bool) {
+    match next_event(events) {
+        SessionEvent::RealmList { realms, failed } => (realms, failed),
+        other => panic!("expected the realm list, got {other:?}"),
+    }
+}
+
 /// The reference builds `CMSG_CHAR_CREATE` in one place (`0x5aac50`), reached only from the glue's
 /// `CreateCharacter`, which the stock glue calls only from the create screen's Okay; so a login to
 /// an account with no characters parks at select on the empty list and creates nothing.
 #[test]
 fn an_empty_account_parks_at_select_without_creating_a_character() {
-    let world_listener = TcpListener::bind("127.0.0.1:0").unwrap();
-    let world = world_listener.local_addr().unwrap().to_string();
-    let (keys_tx, keys_rx) = crossbeam_channel::unbounded();
-    let sent = fake_world(world_listener, keys_rx);
-    let realmd = fake_realmd(world, keys_tx);
+    let (realmd, world) = fake::servers(|world| vec![FakeRealm::new(REALM, world)]);
 
     let (events_tx, events) = crossbeam_channel::unbounded();
     let (writer_tx, _writer_rx) = crossbeam_channel::unbounded::<WorldWriter>();
@@ -245,17 +73,16 @@ fn an_empty_account_parks_at_select_without_creating_a_character() {
 
     login_tx
         .send(LoginRequest {
-            user: USER.into(),
-            pass: PASS.into(),
-            host: realmd,
+            user: fake::USER.into(),
+            pass: fake::PASS.into(),
+            host: realmd.addr.clone(),
             generation: 0,
         })
         .unwrap();
-    match next_event(&events) {
-        SessionEvent::RealmList { realms } => assert_eq!(realms[0].name, REALM),
-        other => panic!("expected the realm list, got {other:?}"),
-    }
-    realm_tx.send(RealmRequest::Enter(REALM.into())).unwrap();
+    let (realms, failed) = next_list(&events);
+    assert!(!failed);
+    assert_eq!(realms[0].name, REALM);
+    realm_tx.send(enter(realms[0].clone())).unwrap();
     match next_event(&events) {
         SessionEvent::CharacterList { characters, .. } => assert!(
             characters.is_empty(),
@@ -266,9 +93,181 @@ fn an_empty_account_parks_at_select_without_creating_a_character() {
     // Select's Back ends the cycle, so the socket is done and its log complete.
     pick_tx.send(CharRequest::Abandon).unwrap();
     assert!(cycle.join().unwrap(), "Back returns to the login park");
-    let sent = sent.lock().unwrap().clone();
+    let sent = world.sent.lock().unwrap().clone();
     assert!(
         !sent.contains(&opcode::CMSG_CHAR_CREATE),
         "the login sent CMSG_CHAR_CREATE on its own: {sent:#06x?}"
     );
 }
+
+/// The logon park takes the next login (#833): closing the list ends the logon and the thread
+/// parks for credentials; a login while the list stands supersedes it. Either way the next login
+/// reaches realmd and its list.
+#[test]
+fn the_next_login_is_accepted_after_the_realm_list_closes_or_stands() {
+    let (realmd, _) = fake::servers(|world| vec![FakeRealm::new(REALM, world)]);
+    let cycles = fake::spawn_cycles();
+
+    fake::login(&cycles, &realmd.addr);
+    assert!(!next_list(&cycles.events).1);
+    // `RealmListDialogCancelled` on the login screen: `CLoginMgr::Cancel`.
+    cycles.realm.send(RealmRequest::Close).unwrap();
+    fake::login(&cycles, &realmd.addr);
+    let (realms, failed) = next_list(&cycles.events);
+    assert!(!failed && realms[0].name == REALM);
+    assert_eq!(realmd.logons(), 2, "the second login logged on");
+
+    // The close button leaves the list's link up; Login again supersedes it.
+    fake::login(&cycles, &realmd.addr);
+    assert!(!next_list(&cycles.events).1);
+    assert_eq!(realmd.logons(), 3);
+    let deadline = std::time::Instant::now() + WAIT;
+    while realmd.open() > 1 {
+        assert!(
+            std::time::Instant::now() < deadline,
+            "the superseded links stay open: {}",
+            realmd.open()
+        );
+        thread::sleep(std::time::Duration::from_millis(10));
+    }
+}
+
+/// A world attempt that fails returns to the logon park with the realmd link up, as the
+/// reference's state-2 failure arm drops only the world socket: the list is queried on the same
+/// link and another realm dialled, with no second logon.
+#[test]
+fn a_failed_world_dial_keeps_the_logon_for_the_next_realm() {
+    let (realmd, _) = fake::servers(|world| {
+        vec![
+            FakeRealm::new("Down", &fake::dead_address()),
+            FakeRealm::new(REALM, world),
+        ]
+    });
+    let cycles = fake::spawn_cycles();
+    fake::login(&cycles, &realmd.addr);
+    let (realms, _) = next_list(&cycles.events);
+    let down = realms.iter().find(|r| r.name == "Down").unwrap().clone();
+    let up = realms.iter().find(|r| r.name == REALM).unwrap().clone();
+
+    cycles.realm.send(enter(down)).unwrap();
+    loop {
+        match cycles
+            .events
+            .recv_timeout(WAIT)
+            .expect("the dial went quiet")
+        {
+            SessionEvent::LoginFailed { refusal, dial, .. } => {
+                assert!(
+                    refusal.is_none() && dial.is_none(),
+                    "a world transport failure"
+                );
+                break;
+            }
+            SessionEvent::LoginStage { .. } => {}
+            other => panic!("expected the dial to fail, got {other:?}"),
+        }
+    }
+    cycles.realm.send(RealmRequest::Refresh).unwrap();
+    assert!(!next_list(&cycles.events).1, "the link answers the query");
+    assert_eq!(realmd.lists(), 2);
+    cycles.realm.send(enter(up)).unwrap();
+    assert!(matches!(
+        next_event(&cycles.events),
+        SessionEvent::CharacterList { .. }
+    ));
+    assert_eq!(realmd.logons(), 1, "one logon throughout");
+}
+
+/// With no logon a realm list query fails at once (`REALM_LIST_FAILED`); the dial and the close
+/// have nothing to act on.
+#[test]
+fn a_query_without_a_logon_fails_at_once() {
+    let cycles = fake::spawn_cycles();
+    cycles.realm.send(RealmRequest::Close).unwrap();
+    cycles.realm.send(RealmRequest::Refresh).unwrap();
+    let (realms, failed) = next_list(&cycles.events);
+    assert!(failed && realms.is_empty());
+}
+
+/// A query on a link realmd has closed dials again and answers (`0x5b2200`), so a list left up
+/// past vmangos's `MaxSessionDuration` still refreshes.
+#[test]
+fn a_query_on_a_closed_link_dials_again() {
+    let (realmd, _) = fake::servers(|world| vec![FakeRealm::new(REALM, world)]);
+    let cycles = fake::spawn_cycles();
+    fake::login(&cycles, &realmd.addr);
+    assert!(!next_list(&cycles.events).1);
+    realmd.drop_links();
+    cycles.realm.send(RealmRequest::Refresh).unwrap();
+    let (realms, failed) = next_list(&cycles.events);
+    assert!(!failed, "the re-dial answers");
+    assert_eq!(realms[0].name, REALM);
+    assert_eq!(realmd.logons(), 2);
+}
+
+/// A Cancel after the dial was asked ends it, however early it lands: the dial carries the
+/// generation the app held when it asked, so the thread drops it and stays at the logon park.
+#[test]
+fn a_cancel_after_the_dial_was_asked_drops_it() {
+    let (realmd, _) = fake::servers(|world| vec![FakeRealm::new(REALM, world)]);
+    let cycles = fake::spawn_cycles();
+    fake::login(&cycles, &realmd.addr);
+    let (realms, _) = next_list(&cycles.events);
+    // The dial was asked under 0, and the Cancel's bump landed before the thread read it.
+    cycles
+        .abandon
+        .fetch_add(1, std::sync::atomic::Ordering::SeqCst);
+    cycles.realm.send(enter(realms[0].clone())).unwrap();
+    cycles.realm.send(RealmRequest::Refresh).unwrap();
+    assert!(
+        !next_list(&cycles.events).1,
+        "the logon park answers, with no roster before it"
+    );
+}
+
+/// A server that lists no realm gets its empty list published and the logon parked, and the
+/// screens show it empty, as the reference does.
+#[test]
+fn an_empty_realm_list_is_published_and_parked() {
+    let (realmd, _) = fake::servers(|_| Vec::new());
+    let cycles = fake::spawn_cycles();
+    fake::login(&cycles, &realmd.addr);
+    let (realms, failed) = next_list(&cycles.events);
+    assert!(realms.is_empty() && !failed);
+    cycles.realm.send(RealmRequest::Refresh).unwrap();
+    assert!(!next_list(&cycles.events).1, "parked at the logon park");
+    assert_eq!(realmd.lists(), 2);
+}
+
+/// Change Realm with the world up drops the session first (`0x46b22b`) and returns to the logon
+/// park, realmd still up: the world socket closes before any query.
+#[test]
+fn leave_drops_the_world_session_and_keeps_the_logon() {
+    let (realmd, world) = fake::servers(|world| vec![FakeRealm::new(REALM, world)]);
+    let cycles = fake::spawn_cycles();
+    fake::login(&cycles, &realmd.addr);
+    let (realms, _) = next_list(&cycles.events);
+    cycles.realm.send(enter(realms[0].clone())).unwrap();
+    assert!(matches!(
+        next_event(&cycles.events),
+        SessionEvent::CharacterList { .. }
+    ));
+    assert_eq!(world.open(), 1);
+    cycles.realm.send(RealmRequest::Leave).unwrap();
+    let deadline = std::time::Instant::now() + WAIT;
+    while world.open() != 0 {
+        assert!(
+            std::time::Instant::now() < deadline,
+            "the world session is still open"
+        );
+        thread::sleep(std::time::Duration::from_millis(10));
+    }
+    cycles.realm.send(RealmRequest::Refresh).unwrap();
+    assert!(!next_list(&cycles.events).1);
+    cycles.realm.send(enter(realms[0].clone())).unwrap();
+    assert!(matches!(
+        next_event(&cycles.events),
+        SessionEvent::CharacterList { .. }
+    ));
+    assert_eq!(realmd.logons(), 1, "one logon throughout");
+}
diff --git a/crates/benilla-app/src/net/io/fake.rs b/crates/benilla-app/src/net/io/fake.rs
new file mode 100644
index 00000000..9a8815d5
--- /dev/null
+++ b/crates/benilla-app/src/net/io/fake.rs
@@ -0,0 +1,443 @@
+//! A fake realmd and a fake world server on loopback, for the login cycle's tests: the real SRP6
+//! logon, the realm list as often as it is asked for, the world handshake and the roster. Both take
+//! any number of connections, so a test can log in again.
+
+use std::io::{Read, Write};
+use std::net::{TcpListener, TcpStream};
+use std::sync::atomic::{AtomicU64, AtomicUsize, Ordering};
+use std::sync::{Arc, Mutex};
+use std::thread;
+use std::time::Duration;
+
+use benilla_protocol::messages::{self, opcode};
+use benilla_protocol::{SessionEnd, SessionEvent, WorldWriter};
+use benilla_srp::vanilla_header::HeaderCrypto;
+use benilla_srp::{
+    password_verifier, NormalizedString, GENERATOR, LARGE_SAFE_PRIME_LITTLE_ENDIAN,
+    SESSION_KEY_LENGTH,
+};
+use crossbeam_channel::{Receiver, Sender};
+use num_bigint::BigUint;
+use sha1::{Digest, Sha1};
+
+use super::{run, Cycle, LoginRequest, Parks, PingClock};
+use crate::net::{CharRequest, RealmRequest};
+
+pub(crate) const USER: &str = "empty";
+pub(crate) const PASS: &str = "secret";
+const SALT: [u8; 32] = [0x5a; 32];
+/// Every wait in the tests: long enough for a loaded machine, short of a hung gate.
+pub(crate) const WAIT: Duration = Duration::from_secs(20);
+
+/// A session key, realmd to the world server.
+type Key = [u8; SESSION_KEY_LENGTH];
+
+fn sha1(parts: &[&[u8]]) -> [u8; 20] {
+    let mut h = Sha1::new();
+    for p in parts {
+        h.update(p);
+    }
+    h.finalize().into()
+}
+
+fn le32(v: &BigUint) -> [u8; 32] {
+    let raw = v.to_bytes_le();
+    let mut out = [0u8; 32];
+    out[..raw.len()].copy_from_slice(&raw);
+    out
+}
+
+/// `SHA1_Interleave` over all 32 bytes of `S`, as vmangos's `SRP6::HashSessionKey` does.
+fn interleave(s: &[u8; 32]) -> Key {
+    let even: Vec<u8> = s.iter().step_by(2).copied().collect();
+    let odd: Vec<u8> = s.iter().skip(1).step_by(2).copied().collect();
+    let (g, h) = (sha1(&[&even]), sha1(&[&odd]));
+    let mut out = [0u8; SESSION_KEY_LENGTH];
+    for (i, (gi, hi)) in g.iter().zip(&h).enumerate() {
+        out[i * 2] = *gi;
+        out[i * 2 + 1] = *hi;
+    }
+    out
+}
+
+/// One realm the fake realmd lists.
+#[derive(Clone)]
+pub(crate) struct FakeRealm {
+    pub(crate) name: String,
+    /// `host:port` the realm's world server answers on.
+    pub(crate) address: String,
+    pub(crate) realm_type: u32,
+    pub(crate) flags: u8,
+    pub(crate) characters: u8,
+    pub(crate) category: u8,
+}
+
+impl FakeRealm {
+    /// A Normal realm in category 1 at `address`.
+    pub(crate) fn new(name: &str, address: &str) -> Self {
+        FakeRealm {
+            name: name.into(),
+            address: address.into(),
+            realm_type: 0,
+            flags: 0,
+            characters: 0,
+            category: 1,
+        }
+    }
+}
+
+/// A realmd that logs [`USER`] in with the server half of SRP6 and answers every
+/// `CMD_REALM_LIST` with its realms, on every connection, until the client closes it.
+pub(crate) struct Realmd {
+    pub(crate) addr: String,
+    logons: Arc<AtomicUsize>,
+    lists: Arc<AtomicUsize>,
+    open: Arc<AtomicUsize>,
+    links: Arc<Mutex<Vec<TcpStream>>>,
+}
+
+impl Realmd {
+    /// Listen on loopback; each session key goes to `keys`, for the world server's header cipher.
+    pub(crate) fn start(realms: Vec<FakeRealm>, keys: Sender<Key>) -> Realmd {
+        let listener = TcpListener::bind("127.0.0.1:0").unwrap();
+        let addr = listener.local_addr().unwrap().to_string();
+        let logons = Arc::new(AtomicUsize::new(0));
+        let lists = Arc::new(AtomicUsize::new(0));
+        let open = Arc::new(AtomicUsize::new(0));
+        let links = Arc::new(Mutex::new(Vec::new()));
+        let (l, n, o) = (logons.clone(), lists.clone(), open.clone());
+        let held = links.clone();
+        thread::spawn(move || {
+            for stream in listener.incoming() {
+                let Ok(s) = stream else { return };
+                if let Ok(c) = s.try_clone() {
+                    held.lock().unwrap().push(c);
+                }
+                let (realms, keys) = (realms.clone(), keys.clone());
+                let (l, n, o) = (l.clone(), n.clone(), o.clone());
+                thread::spawn(move || {
+                    o.fetch_add(1, Ordering::SeqCst);
+                    serve_realmd(s, &realms, &keys, &l, &n);
+                    o.fetch_sub(1, Ordering::SeqCst);
+                });
+            }
+        });
+        Realmd {
+            addr,
+            logons,
+            lists,
+            open,
+            links,
+        }
+    }
+
+    /// Close every link from the server's side, as vmangos does at `MaxSessionDuration`.
+    pub(crate) fn drop_links(&self) {
+        for s in self.links.lock().unwrap().drain(..) {
+            let _ = s.shutdown(std::net::Shutdown::Both);
+        }
+    }
+
+    /// Logons completed so far.
+    pub(crate) fn logons(&self) -> usize {
+        self.logons.load(Ordering::SeqCst)
+    }
+
+    /// Realm lists sent so far.
+    pub(crate) fn lists(&self) -> usize {
+        self.lists.load(Ordering::SeqCst)
+    }
+
+    /// Connections the client still holds.
+    pub(crate) fn open(&self) -> usize {
+        self.open.load(Ordering::SeqCst)
+    }
+}
+
+/// One realmd connection: the logon, then the realm list for every request until EOF.
+fn serve_realmd(
+    mut s: TcpStream,
+    realms: &[FakeRealm],
+    keys: &Sender<Key>,
+    logons: &AtomicUsize,
+    lists: &AtomicUsize,
+) {
+    let n = BigUint::from_bytes_le(&LARGE_SAFE_PRIME_LITTLE_ENDIAN);
+    let g = BigUint::from(GENERATOR);
+    let user = NormalizedString::new(USER).unwrap();
+    let pass = NormalizedString::new(PASS).unwrap();
+    let v = BigUint::from_bytes_le(&password_verifier(&user, &pass, &SALT));
+
+    // CMD_AUTH_LOGON_CHALLENGE_Client: opcode, protocol, u16 size, then the body.
+    let mut head = [0u8; 4];
+    if s.read_exact(&mut head).is_err() {
+        return;
+    }
+    let mut body = vec![0u8; usize::from(u16::from_le_bytes([head[2], head[3]]))];
+    if s.read_exact(&mut body).is_err() {
+        return;
+    }
+
+    // B = k·v + g^b, with k = 3; `b` walks until `B`'s top byte is non-zero, since the client
+    // redials on a zero one.
+    let (b, b_pub) = (1u32..)
+        .map(|i| {
+            let b = BigUint::from_bytes_le(&[0x3c; 32]) + i;
+            let b_pub = le32(&((BigUint::from(3u8) * &v + g.modpow(&b, &n)) % &n));
+            (b, b_pub)
+        })
+        .find(|(_, b_pub)| b_pub[31] != 0)
+        .unwrap();
+    let mut reply = vec![0x00, 0x00, 0x00];
+    reply.extend_from_slice(&b_pub);
+    reply.extend_from_slice(&[1, GENERATOR, 32]);
+    reply.extend_from_slice(&LARGE_SAFE_PRIME_LITTLE_ENDIAN);
+    reply.extend_from_slice(&SALT);
+    reply.extend_from_slice(&[0u8; 16]); // crc_salt
+    reply.push(0); // security_flag
+    if s.write_all(&reply).is_err() {
+        return;
+    }
+
+    // CMD_AUTH_LOGON_PROOF_Client: opcode, A, M1, crc_hash, key count, security flag.
+    let mut proof = [0u8; 75];
+    if s.read_exact(&mut proof).is_err() {
+        return;
+    }
+    let (a_pub, m1) = (&proof[1..33], &proof[33..53]);
+    let u = BigUint::from_bytes_le(&sha1(&[a_pub, &b_pub]));
+    let a = BigUint::from_bytes_le(a_pub);
+    let big_s = (a * v.modpow(&u, &n) % &n).modpow(&b, &n);
+    let key = interleave(&le32(&big_s));
+    let mut reply = vec![0x01, 0x00];
+    reply.extend_from_slice(&sha1(&[a_pub, m1, &key]));
+    reply.extend_from_slice(&0u32.to_le_bytes()); // hardware_survey_id
+    if s.write_all(&reply).is_err() {
+        return;
+    }
+    let _ = keys.send(key);
+    logons.fetch_add(1, Ordering::SeqCst);
+
+    // CMD_REALM_LIST_Client (0x10 and a u32), answered every time, until the client closes the
+    // link.
+    let mut request = [0u8; 5];
+    while s.read_exact(&mut request).is_ok() {
+        assert_eq!(request[0], 0x10, "a realm list request");
+        let mut records = Vec::new();
+        for r in realms {
+            records.extend_from_slice(&r.realm_type.to_le_bytes());
+            records.push(r.flags);
+            records.extend_from_slice(format!("{}\0{}\0", r.name, r.address).as_bytes());
+            records.extend_from_slice(&1f32.to_le_bytes()); // population
+            records.extend_from_slice(&[r.characters, r.category, 1]); // characters, category, id
+        }
+        let mut list = vec![0x10];
+        list.extend_from_slice(&((4 + 1 + records.len() + 2) as u16).to_le_bytes());
+        list.extend_from_slice(&0u32.to_le_bytes());
+        list.push(realms.len() as u8);
+        list.extend_from_slice(&records);
+        // vmangos's trailer (`AuthSocket.cpp:1088`).
+        list.extend_from_slice(&0x0002u16.to_le_bytes());
+        if s.write_all(&list).is_err() {
+            return;
+        }
+        lists.fetch_add(1, Ordering::SeqCst);
+    }
+}
+
+/// A server packet: `u16` BE size counting the opcode, `u16` LE opcode, the body.
+fn send(s: &mut TcpStream, crypto: Option<&mut HeaderCrypto>, op: u16, body: &[u8]) {
+    let size = ((body.len() + 2) as u16).to_be_bytes();
+    let op = op.to_le_bytes();
+    let mut header = [size[0], size[1], op[0], op[1]];
+    if let Some(c) = crypto {
+        c.encrypter().encrypt(&mut header);
+    }
+    let _ = s.write_all(&header);
+    let _ = s.write_all(body);
+}
+
+/// A client packet's opcode, reading past its body: `u16` BE size counting the 4-byte opcode.
+fn recv(s: &mut TcpStream, crypto: Option<&mut HeaderCrypto>) -> Option<u16> {
+    let mut header = [0u8; 6];
+    s.read_exact(&mut header).ok()?;
+    if let Some(c) = crypto {
+        c.decrypter().decrypt(&mut header);
+    }
+    let size = usize::from(u16::from_be_bytes([header[0], header[1]]));
+    s.read_exact(&mut vec![0u8; size.saturating_sub(4)]).ok()?;
+    Some(u16::from_le_bytes([header[2], header[3]]))
+}
+
+/// The fake world server's record: every opcode the client sent, and the sessions still open.
+pub(crate) struct World {
+    pub(crate) sent: Arc<Mutex<Vec<u16>>>,
+    open: Arc<AtomicUsize>,
+}
+
+impl World {
+    /// Sessions the client still holds.
+    pub(crate) fn open(&self) -> usize {
+        self.open.load(Ordering::SeqCst)
+    }
+}
+
+/// A world server whose account has no characters: it admits each session under the latest key
+/// realmd made, answers every `CMSG_CHAR_ENUM` with an empty roster and a `CMSG_CHAR_CREATE` with
+/// success, and logs every opcode the client sends.
+pub(crate) fn world(listener: TcpListener, keys: Receiver<Key>) -> World {
+    let sent = Arc::new(Mutex::new(Vec::new()));
+    let log = Arc::clone(&sent);
+    let open = Arc::new(AtomicUsize::new(0));
+    let sessions = Arc::clone(&open);
+    thread::spawn(move || {
+        let mut last: Option<Key> = None;
+        for stream in listener.incoming() {
+            let Ok(mut s) = stream else { return };
+            send(
+                &mut s,
+                None,
+                opcode::SMSG_AUTH_CHALLENGE,
+                &0xDEAD_BEEFu32.to_le_bytes(),
+            );
+            if recv(&mut s, None) != Some(opcode::CMSG_AUTH_SESSION) {
+                continue;
+            }
+            // The account's latest session key, as realmd stores it for the world server: a newer
+            // logon's replaces it, and a second dial on the same logon reuses it.
+            while let Ok(k) = keys.try_recv() {
+                last = Some(k);
+            }
+            if last.is_none() {
+                last = keys.recv_timeout(WAIT).ok();
+            }
+            let Some(key) = last else {
+                return;
+            };
+            let mut crypto = HeaderCrypto::from_session_key(key);
+            send(
+                &mut s,
+                Some(&mut crypto),
+                opcode::SMSG_AUTH_RESPONSE,
+                &[messages::AUTH_OK],
+            );
+            let log = Arc::clone(&log);
+            let sessions = Arc::clone(&sessions);
+            sessions.fetch_add(1, Ordering::SeqCst);
+            thread::spawn(move || {
+                while let Some(op) = recv(&mut s, Some(&mut crypto)) {
+                    log.lock().unwrap().push(op);
+                    match op {
+                        opcode::CMSG_CHAR_ENUM => {
+                            send(&mut s, Some(&mut crypto), opcode::SMSG_CHAR_ENUM, &[0]);
+                        }
+                        opcode::CMSG_CHAR_CREATE => send(
+                            &mut s,
+                            Some(&mut crypto),
+                            opcode::SMSG_CHAR_CREATE,
+                            &[messages::CHAR_CREATE_SUCCESS],
+                        ),
+                        _ => {}
+                    }
+                }
+                sessions.fetch_sub(1, Ordering::SeqCst);
+            });
+        }
+    });
+    World { sent, open }
+}
+
+/// A fake realmd listing `realms` and the world server they point at. `realms` takes the world's
+/// address.
+pub(crate) fn servers(realms: impl FnOnce(&str) -> Vec<FakeRealm>) -> (Realmd, World) {
+    let world_listener = TcpListener::bind("127.0.0.1:0").unwrap();
+    let addr = world_listener.local_addr().unwrap().to_string();
+    let (keys_tx, keys_rx) = crossbeam_channel::unbounded();
+    let sent = world(world_listener, keys_rx);
+    (Realmd::start(realms(&addr), keys_tx), sent)
+}
+
+/// An address nothing answers on: a port bound and released.
+pub(crate) fn dead_address() -> String {
+    let l = TcpListener::bind("127.0.0.1:0").unwrap();
+    l.local_addr().unwrap().to_string()
+}
+
+/// The app's ends of the IO thread's channels.
+pub(crate) struct Cycles {
+    pub(crate) events: Receiver<SessionEvent>,
+    pub(crate) login: Sender<LoginRequest>,
+    pub(crate) realm: Sender<RealmRequest>,
+    pub(crate) pick: Sender<CharRequest>,
+    pub(crate) abandon: Arc<AtomicU64>,
+}
+
+/// The read thread's cycle loop, as [`super::spawn_net`] runs it, with the world writer dropped.
+pub(crate) fn spawn_cycles() -> Cycles {
+    let (events_tx, events) = crossbeam_channel::unbounded();
+    let (login, login_rx) = crossbeam_channel::unbounded();
+    let (realm, realm_rx) = crossbeam_channel::unbounded();
+    let (pick, pick_rx) = crossbeam_channel::unbounded();
+    let abandon = Arc::new(AtomicU64::new(0));
+    let thread_abandon = Arc::clone(&abandon);
+    thread::spawn(move || {
+        let (writer_tx, _writer_rx) = crossbeam_channel::unbounded::<WorldWriter>();
+        let parks = Parks {
+            login_rx,
+            realm_rx,
+            pick_rx,
+        };
+        let clock = Mutex::new(PingClock::default());
+        let mut tails = Default::default();
+        loop {
+            match run(
+                &events_tx,
+                &writer_tx,
+                &parks,
+                &thread_abandon,
+                &clock,
+                &mut tails,
+            ) {
+                Ok(Cycle::Exit) => return,
+                Ok(Cycle::Repark) => {}
+                Ok(Cycle::LoggedOut | Cycle::LoginRefused) => {
+                    let _ = events_tx.send(SessionEvent::Disconnected {
+                        reason: "logged out".into(),
+                        end: SessionEnd::LoggedOut,
+                    });
+                }
+                Err(e) => {
+                    if events_tx
+                        .send(SessionEvent::Disconnected {
+                            reason: format!("disconnected: {e:#}"),
+                            end: SessionEnd::Lost,
+                        })
+                        .is_err()
+                    {
+                        return;
+                    }
+                }
+            }
+        }
+    });
+    Cycles {
+        events,
+        login,
+        realm,
+        pick,
+        abandon,
+    }
+}
+
+/// A login attempt for [`USER`] at `host` under the current abandon generation.
+pub(crate) fn login(cycles: &Cycles, host: &str) {
+    cycles
+        .login
+        .send(LoginRequest {
+            user: USER.into(),
+            pass: PASS.into(),
+            host: host.into(),
+            generation: cycles.abandon.load(Ordering::SeqCst),
+        })
+        .unwrap();
+}
diff --git a/crates/benilla-app/src/net/session.rs b/crates/benilla-app/src/net/session.rs
index 81537835..d5e8c5a3 100644
--- a/crates/benilla-app/src/net/session.rs
+++ b/crates/benilla-app/src/net/session.rs
@@ -108,8 +108,8 @@ fn on_login_edge(In(ev): In<SessionEvent>, mut e: Edges) {
             terminal,
             dial,
         } => login_failed(refusal, reason, terminal, dial, &mut e.login_failures),
-        SessionEvent::RealmList { realms } => {
-            e.realm_lists.write(RealmListMessage { realms });
+        SessionEvent::RealmList { realms, failed } => {
+            e.realm_lists.write(RealmListMessage { realms, failed });
         }
         SessionEvent::CharActionResult { action, code } => {
             char_action_result(action, code, &mut e.char_actions)
diff --git a/crates/benilla-app/src/realm_select/input.rs b/crates/benilla-app/src/realm_select/input.rs
index 2c2172dd..f1e35516 100644
--- a/crates/benilla-app/src/realm_select/input.rs
+++ b/crates/benilla-app/src/realm_select/input.rs
@@ -6,7 +6,9 @@ use bevy::input::mouse::MouseWheel;
 use bevy::prelude::*;
 
 use crate::bindings::WheelNotches;
-use crate::net::{RealmChoice, RealmRequest};
+use crate::char_select::ClientState;
+use crate::login::GlueLogin;
+use crate::net::RealmChoice;
 use crate::sound::GlueSound;
 
 use super::screen::{RealmAction, MAX_ROWS};
@@ -17,12 +19,14 @@ const DOUBLE_CLICK_SECS: f32 = 0.4;
 
 /// Clicks: a row selects (a second one enters), a tab fronts its category, the column headers
 /// sort, Okay enters, Cancel and the close X leave.
+#[allow(clippy::too_many_arguments)]
 pub(super) fn clicks(
     buttons: Query<(Entity, &RealmAction)>,
     hits: Res<crate::glue::GlueClicks>,
     mut realms: ResMut<Realms>,
     choice: Res<RealmChoice>,
     mut sounds: MessageWriter<GlueSound>,
+    mut cancels: Cancels,
     time: Res<Time>,
     mut last_click: Local<Option<(String, f32)>>,
 ) {
@@ -60,13 +64,22 @@ pub(super) fn clicks(
         }
     }
     if enter {
-        try_enter(&mut realms, &choice, &mut sounds);
+        try_enter(&mut realms, &choice, &mut sounds, &cancels);
     }
     if let Some(with_sound) = leave {
-        do_cancel(&mut realms, &choice, &mut sounds, with_sound);
+        do_cancel(&mut realms, &mut cancels, &mut sounds, with_sound);
     }
 }
 
+/// What Okay and Cancel need beyond the list: the screen under it, the login engine's ask, and
+/// the abandon generation a dial is stamped with.
+#[derive(bevy::ecs::system::SystemParam)]
+pub(crate) struct Cancels<'w> {
+    state: Option<Res<'w, State<ClientState>>>,
+    login: MessageWriter<'w, GlueLogin>,
+    abandon: Option<Res<'w, crate::net::LoginAbandon>>,
+}
+
 /// `RealmList_OnKeyDown` (ESCAPE / ENTER), plus arrow-key row cycling and the wheel.
 pub(crate) fn keys(
     keys: Res<ButtonInput<KeyCode>>,
@@ -74,13 +87,14 @@ pub(crate) fn keys(
     mut realms: ResMut<Realms>,
     choice: Res<RealmChoice>,
     mut sounds: MessageWriter<GlueSound>,
+    mut cancels: Cancels,
 ) {
     if keys.just_pressed(KeyCode::Escape) {
-        do_cancel(&mut realms, &choice, &mut sounds, true);
+        do_cancel(&mut realms, &mut cancels, &mut sounds, true);
         return;
     }
     if keys.just_pressed(KeyCode::Enter) || keys.just_pressed(KeyCode::NumpadEnter) {
-        try_enter(&mut realms, &choice, &mut sounds);
+        try_enter(&mut realms, &choice, &mut sounds, &cancels);
         return;
     }
 
@@ -146,16 +160,16 @@ fn scroll_into_view(realms: &mut Realms, row: usize, total: usize) {
 }
 
 /// `RealmList_OnCancel`, and the close X without the sound. `RealmListDialogCancelled`
-/// (`0x46ed20` -> `0x46b810`) does nothing off the login screen and there closes the realmd
-/// socket (`0x5b3320`) with no screen change; the character park ignores `Abandon` and the login
-/// park re-parks, dropping the socket.
+/// (`0x46ed20` -> `0x46b810`) does nothing off the login screen and there closes the realmd link
+/// (`CLoginMgr::Cancel`, `0x5b3320`) with no screen change, which ends the attempt: the login
+/// engine closes the logon park and takes the next Login.
 ///
-/// Deviation: the reference's X only cancels the pending realm query (`0x46ed10` -> `0x46b7e0`)
-/// and leaves the realmd link up; ours abandons, because the IO thread blocks at the realm park
-/// until answered.
+/// Deviation: the reference's X only cancels a pending realm query (`0x46ed10` -> `0x46b7e0`) and
+/// leaves the realmd link up; ours closes it as Cancel does, because the native login screen takes
+/// a new Login only once the attempt has ended.
 fn do_cancel(
     realms: &mut Realms,
-    choice: &RealmChoice,
+    cancels: &mut Cancels,
     sounds: &mut MessageWriter<GlueSound>,
     with_sound: bool,
 ) {
@@ -163,14 +177,25 @@ fn do_cancel(
         sounds.write(GlueSound("gsLoginChangeRealmCancel"));
     }
     realms.hide();
-    let _ = choice.0.send(RealmRequest::Abandon);
+    if cancels
+        .state
+        .as_ref()
+        .is_none_or(|s| *s.get() == ClientState::Login)
+    {
+        cancels.login.write(GlueLogin::Abandon);
+    }
 }
 
 /// `RealmList_OnOk`: play the click, hide the frame, answer the park.
 ///
 /// Not built: the reference's `REALM_IS_FULL` Yes/No confirm for a `Full` realm with no characters
 /// on it; ours enters directly. `Full` is the `0x80` flag, which vmangos never sets.
-fn try_enter(realms: &mut Realms, choice: &RealmChoice, sounds: &mut MessageWriter<GlueSound>) {
+fn try_enter(
+    realms: &mut Realms,
+    choice: &RealmChoice,
+    sounds: &mut MessageWriter<GlueSound>,
+    cancels: &Cancels,
+) {
     let Some(realm) = realms.selected() else {
         return; // the reference disables Okay with nothing highlighted
     };
@@ -181,7 +206,11 @@ fn try_enter(realms: &mut Realms, choice: &RealmChoice, sounds: &mut MessageWrit
     sounds.write(GlueSound("gsLoginChangeRealmOK"));
     realms.hide();
     realms.store_front_category();
-    realms.enter(choice, name);
+    realms.enter(
+        choice,
+        name,
+        crate::net::LoginAbandon::now(cancels.abandon.as_deref()),
+    );
 }
 
 #[cfg(test)]
diff --git a/crates/benilla-app/src/realm_select/load.rs b/crates/benilla-app/src/realm_select/load.rs
index d8b9dc60..3f083410 100644
--- a/crates/benilla-app/src/realm_select/load.rs
+++ b/crates/benilla-app/src/realm_select/load.rs
@@ -2,8 +2,8 @@
 //!
 //! The load word is a band, not the population the auth server sent: the reference takes the
 //! mean and a scaled standard deviation over every realm it knows (all categories) and places each
-//! realm in that distribution. Ports of `CGlue::RealmLoadStats` `0x46e510` and
-//! `CGlue::RealmLoadClassify` `0x46ec60`, with their x87 rounding, since the band edges are where a
+//! realm in that distribution: `realm_load_stats` `0x46e510` and `realm_load_classify` `0x46ec60`,
+//! ported with their x87 rounding in [`benilla_ui::script`], since the band edges are where a
 //! rounding difference flips the word. The band to string to colour mapping is `RealmListUpdate`
 //! in `GlueXML/RealmList.lua`.
 
@@ -27,56 +27,8 @@ pub(super) const RED: Color = Color::srgb(1.0, 0.1, 0.1);
 /// `BLUE_FONT_COLOR`.
 pub(super) const BLUE: Color = Color::srgb(0.0, 0.749, 0.953);
 
-/// The std-dev scale, 0.6 (`[0x8038d8]`).
-const STDDEV_MULT: f32 = f32::from_bits(0x3f19_999a);
-
-/// `CGlue::RealmLoadStats` (`0x46e510`): `(mean, sqrt(Σ(pop − mean)² / (n − 1)) · 0.6)` over every
-/// realm's population. Both accumulators round to `f32` each iteration; the divide, sqrt and scale
-/// run at 53 bits. `n <= 1` gives `(1.0, 0.0)`, so a lone realm is banded against the literal 1.0.
-pub(super) fn realm_load_stats(populations: &[f32]) -> (f32, f32) {
-    let n = populations.len();
-    if n <= 1 {
-        return (1.0, 0.0);
-    }
-    // `fld sum; fadd pop; fstp sum`: stored as f32 each step.
-    let mut sum: f32 = 0.0;
-    for &pop in populations {
-        sum = (f64::from(sum) + f64::from(pop)) as f32;
-    }
-    // `fild n; fdivr sum; fstp mean`.
-    let mean = (f64::from(sum) / n as f64) as f32;
-    // Stored as f32 each step.
-    let mut acc: f32 = 0.0;
-    for &pop in populations {
-        let d = f64::from(pop) - f64::from(mean);
-        acc = (d * d + f64::from(acc)) as f32;
-    }
-    // `fild n-1; fdivr acc; fsqrt; fmul 0.6; fstp stddev`.
-    let stddev = ((f64::from(acc) / (n - 1) as f64).sqrt() * f64::from(STDDEV_MULT)) as f32;
-    (mean, stddev)
-}
-
-/// `CGlue::RealmLoadClassify` (`0x46ec60`): the load indicator `GetRealmInfo` returns. The three
-/// sentinel bits, synthesized by the parser from magic populations as the reference's does, win in
-/// this order; then the band, whose 53-bit comparisons are strict, so an edge reads normal.
-pub(super) fn realm_load_classify(flags: u8, population: f32, mean: f32, stddev: f32) -> f32 {
-    if flags & 0x20 != 0 {
-        return -3.0;
-    }
-    if flags & 0x40 != 0 {
-        return -2.0;
-    }
-    if flags & 0x80 != 0 {
-        return 2.0;
-    }
-    if (f64::from(mean) - f64::from(stddev)) > f64::from(population) {
-        return -1.0;
-    }
-    if (f64::from(mean) + f64::from(stddev)) < f64::from(population) {
-        return 1.0;
-    }
-    0.0
-}
+/// The load band's two primitives, shared with the stock glue's `GetRealmInfo`.
+pub(super) use benilla_ui::script::{realm_load_classify, realm_load_stats};
 
 /// The Population column's key and colour: `RealmListUpdate`'s ladder, offline first, then the
 /// sentinels by exact comparison, then the sign.
diff --git a/crates/benilla-app/src/realm_select/mod.rs b/crates/benilla-app/src/realm_select/mod.rs
index 9ae0db7a..bc3fd388 100644
--- a/crates/benilla-app/src/realm_select/mod.rs
+++ b/crates/benilla-app/src/realm_select/mod.rs
@@ -5,8 +5,8 @@
 //! `GlueScreenInfo` has no entry for it): it is shown over the current screen and hidden again,
 //! and that screen is where the player returns.
 //!
-//! The IO thread publishes the list from two parks (`crate::net::io`), the login-side realm park
-//! and the character park, and takes one answer. The policy, in order:
+//! The IO thread publishes the list from two parks (`crate::net::io`), the logon park and the
+//! character park, and takes one answer. The policy, in order:
 //!
 //! 1. `WOW_REALM`, matched case-insensitively; a name not on the list falls through.
 //! 2. The realm this session is on, so a logout or a dropped connection returns to it.
@@ -18,6 +18,9 @@
 //! begins a realm query on the realmd socket, which stays open until world entry (`0x46b70c`), and
 //! names no screen; only `ConnectToRealm` (`0x46b210`) drops the world connection, once a realm is
 //! chosen. So the character park serves the list in place and Cancel there does nothing.
+//!
+//! Under `WOW_GLUE_STOCK=1` the stock `RealmList` and its verbs take the list instead
+//! ([`crate::ui_script::glue_mgr`]), and this policy stands down.
 
 mod category;
 mod input;
@@ -94,7 +97,8 @@ pub(super) enum SortKey {
     Load,
     /// `SortRealms("name")`, case 2: a case-folding compare.
     Name,
-    /// `SortRealms("mode")`, case 3: the `(pvp, rp)` pair.
+    /// `SortRealms("mode")`, case 3: the `Cfg_Configs` pair, RP before PvP, so Normal, PvP, RP,
+    /// RP-PvP ascending.
     Type,
 }
 
@@ -164,7 +168,14 @@ impl Realms {
                         la.total_cmp(&lb)
                     }
                     SortKey::Name => ra.name.to_lowercase().cmp(&rb.name.to_lowercase()),
-                    SortKey::Type => self.pvp_rp(ra.realm_type).cmp(&self.pvp_rp(rb.realm_type)),
+                    // RP decides before PvP (`0x46e92c`-`0x46e978`).
+                    SortKey::Type => {
+                        let rp_pvp = |t: u32| {
+                            let (pvp, rp) = self.pvp_rp(t);
+                            (rp, pvp)
+                        };
+                        rp_pvp(ra.realm_type).cmp(&rp_pvp(rb.realm_type))
+                    }
                 };
                 if ord != std::cmp::Ordering::Equal {
                     return if descending { ord.reverse() } else { ord };
@@ -177,6 +188,36 @@ impl Realms {
         rows
     }
 
+    /// The client Region's categories and the realm types, as the stock glue's realm verbs read
+    /// them; no categories until the DBC is read.
+    pub(crate) fn glue_setup(
+        &self,
+    ) -> (
+        Vec<benilla_ui::script::GlueRealmCategory>,
+        Vec<benilla_ui::script::GlueRealmType>,
+    ) {
+        let categories = self
+            .categories
+            .iter()
+            .flatten()
+            .map(|c| benilla_ui::script::GlueRealmCategory {
+                id: c.id,
+                name: c.name.clone(),
+            })
+            .collect();
+        let types = self
+            .types
+            .rows()
+            .iter()
+            .map(|t| benilla_ui::script::GlueRealmType {
+                realm_type: t.realm_type,
+                pvp: t.pvp,
+                rp: t.rp,
+            })
+            .collect();
+        (categories, types)
+    }
+
     /// A realm type's `(pvp, rp)` in `Cfg_Configs.dbc`, `(false, false)` for a type with no row.
     pub(crate) fn pvp_rp(&self, realm_type: u32) -> (bool, bool) {
         load::pvp_rp(&self.types, realm_type)
@@ -240,10 +281,16 @@ impl Realms {
         self.offset = self.offset.min(max);
     }
 
-    /// Answer a park with a realm and remember it as [`Self::current`].
-    pub(super) fn enter(&mut self, choice: &RealmChoice, name: String) {
-        self.current = Some(name.clone());
-        let _ = choice.0.send(RealmRequest::Enter(name));
+    /// Answer a park with a realm, by the record the list holds, stamped with the abandon
+    /// generation `generation` the app holds now, and remember it as [`Self::current`].
+    pub(super) fn enter(&mut self, choice: &RealmChoice, name: String, generation: u64) {
+        if let Some(realm) = self.realms.iter().find(|r| r.name == name) {
+            let _ = choice.0.send(RealmRequest::Enter {
+                realm: realm.clone(),
+                generation,
+            });
+        }
+        self.current = Some(name);
     }
 
     /// `RealmList:Hide()`, and nothing else.
@@ -252,8 +299,33 @@ impl Realms {
     }
 }
 
-/// `GetRealmInfo`'s `realmDown`: flag bit 0x02, greyed and not enterable; the reference's
-/// auto-pick (`0x46ea20`) skips a realm on these low bits.
+#[cfg(test)]
+impl Realms {
+    /// A US client's state at startup, read without an install: Region 1's two categories and the
+    /// shipped `Cfg_Configs.dbc` types 0, 1, 6 and 8.
+    pub(crate) fn us_client() -> Realms {
+        let ty = |realm_type, pvp, rp| benilla_formats::RealmConfig {
+            realm_type,
+            pvp,
+            rp,
+        };
+        Realms {
+            categories: Some(category::tests::us()),
+            types: RealmConfigs::from_rows(vec![
+                ty(0, false, false),
+                ty(1, true, false),
+                ty(6, false, true),
+                ty(8, true, true),
+            ]),
+            ..Realms::default()
+        }
+    }
+}
+
+/// `GetRealmInfo`'s `realmDown`: flag bit 0x02 of the record's flags byte (`+0x08`, `0x46ef83`),
+/// greyed and not enterable. The reference's own pick, `SetPreferredInfo`'s `0x46ea20`, skips only
+/// bit 0x01 (`0x46ea7c`), so it can suggest a realm that is down; `auto_answer` skipping one is
+/// benilla's policy ladder, not the reference's.
 pub(crate) fn is_down(realm: &RealmInfo) -> bool {
     realm.flags & 0x02 != 0
 }
@@ -291,7 +363,7 @@ impl Plugin for RealmSelectPlugin {
             .add_systems(
                 Update,
                 (
-                    apply_realm_policy,
+                    apply_realm_policy.run_if(crate::ui_script::glue::native_glue),
                     // Ungated by state: the dialog stands over login and character select alike.
                     screen::drive_screen,
                     // Input before the row refresh, so a click shows on the frame it landed.
@@ -321,12 +393,18 @@ fn apply_realm_policy(
     mut realms: ResMut<Realms>,
     choice: Res<RealmChoice>,
     cvars: Res<crate::cvars::Cvars>,
+    abandon: Option<Res<crate::net::LoginAbandon>>,
 ) {
+    let generation = crate::net::LoginAbandon::now(abandon.as_deref());
     if !realms.env_read {
         realms.env_read = true;
         realms.env_realm = std::env::var("WOW_REALM").ok().filter(|s| !s.is_empty());
     }
     for msg in msgs.read() {
+        // A query that got no answer leaves the list as it stands.
+        if msg.failed {
+            continue;
+        }
         realms.realms = msg.realms.clone();
         realms.refresh_in = REFRESH_SECS;
         // The registered default is empty: a client that has never connected.
@@ -345,6 +423,9 @@ fn apply_realm_policy(
         if realms.shown {
             continue;
         }
+        // A server that lists no realm gets the empty list, as the reference shows it once the
+        // connect fails `REALM_LIST_REALM_NOT_FOUND` with no realm held (`0x46bf86` → `0x46c06e`):
+        // no realm answers it.
         match auto_answer(
             &realms,
             remembered.as_deref(),
@@ -352,7 +433,7 @@ fn apply_realm_policy(
         ) {
             Some(name) => {
                 realms.select(&name);
-                realms.enter(&choice, name);
+                realms.enter(&choice, name, generation);
             }
             None => realms.open(),
         }
@@ -675,6 +756,44 @@ mod tests {
         );
     }
 
+    /// A server that lists no realm: nothing is dialled, and the list goes up empty, as the
+    /// reference shows it (`0x46bf86` → `0x46c06e`).
+    #[test]
+    fn an_empty_list_dials_nothing_and_shows_the_list() {
+        let (tx, rx) = crossbeam_channel::unbounded();
+        let mut app = App::new();
+        app.init_resource::<Realms>()
+            .init_resource::<crate::cvars::Cvars>()
+            .insert_resource(RealmChoice(tx))
+            .add_message::<RealmListMessage>()
+            .add_systems(Update, apply_realm_policy);
+        app.world_mut().write_message(RealmListMessage {
+            realms: Vec::new(),
+            failed: false,
+        });
+        app.update();
+        assert!(rx.try_recv().is_err(), "no dial");
+        assert!(
+            app.world().resource::<Realms>().shown,
+            "the empty list is up"
+        );
+        assert_eq!(auto_answer(&list(Vec::new()), None, true), None);
+    }
+
+    /// Mode ascending is Normal, PvP, RP, RP-PvP: RP decides before PvP (`0x46e92c`-`0x46e978`).
+    #[test]
+    fn the_mode_sort_puts_rp_after_pvp() {
+        let mut r = Realms::us_client();
+        r.realms = vec![
+            realm("RpPvp", 1, 8, 0, 0, 1.0),
+            realm("Rp", 1, 6, 0, 0, 1.0),
+            realm("Pvp", 1, 1, 0, 0, 1.0),
+            realm("Normal", 1, 0, 0, 0, 1.0),
+        ];
+        r.sort.click(SortKey::Type);
+        assert_eq!(names(&r), ["Normal", "Pvp", "Rp", "RpPvp"]);
+    }
+
     /// The reference disables an offline realm's Okay.
     #[test]
     fn an_offline_realm_cannot_be_entered() {
diff --git a/crates/benilla-app/src/realm_select/screen.rs b/crates/benilla-app/src/realm_select/screen.rs
index 1bb17e09..cbf070d7 100644
--- a/crates/benilla-app/src/realm_select/screen.rs
+++ b/crates/benilla-app/src/realm_select/screen.rs
@@ -852,6 +852,7 @@ mod tests {
             .init_resource::<GlueClicks>()
             .insert_resource(crate::net::RealmChoice(tx))
             .add_message::<crate::sound::GlueSound>()
+            .add_message::<crate::login::GlueLogin>()
             .insert_resource(Realms {
                 realms: list.iter().map(|&(n, c)| realm(n, c)).collect(),
                 categories: Some(super::super::category::tests::us()),
diff --git a/crates/benilla-app/src/realm_select/smoke.rs b/crates/benilla-app/src/realm_select/smoke.rs
index 9337728a..883da7b5 100644
--- a/crates/benilla-app/src/realm_select/smoke.rs
+++ b/crates/benilla-app/src/realm_select/smoke.rs
@@ -12,7 +12,7 @@
 use bevy::prelude::*;
 
 use crate::char_select::{ClientState, Roster};
-use crate::net::{RealmChoice, RealmRequest};
+use crate::net::RealmChoice;
 
 use super::Realms;
 
@@ -41,6 +41,7 @@ pub(super) fn debug_realm_smoke(
     roster: Res<Roster>,
     state: Res<State<ClientState>>,
     choice: Res<RealmChoice>,
+    abandon: Option<Res<crate::net::LoginAbandon>>,
     time: Res<Time>,
     mut walk: Local<Walk>,
     mut exit: MessageWriter<AppExit>,
@@ -110,7 +111,11 @@ pub(super) fn debug_realm_smoke(
                 return;
             }
             info!("realm-smoke: dialog up, character select still underneath → Okay");
-            okay(realms, &choice);
+            okay(
+                realms,
+                &choice,
+                crate::net::LoginAbandon::now(abandon.as_deref()),
+            );
             (walk.phase, walk.mark, walk.rosters) = (2, now, walk.seen + 1);
         }
         // ── 2 · Okay has to land: a fresh roster, dialog down, still at select. ──────────────
@@ -122,7 +127,7 @@ pub(super) fn debug_realm_smoke(
         // ── 3 · Cancel changes nothing. ──────────────────────────────────────────────────────
         3 if realms.shown && now - walk.mark > DWELL => {
             info!("realm-smoke: dialog up → Cancel");
-            cancel(realms, &choice);
+            cancel(realms);
             (walk.phase, walk.mark) = (4, now);
         }
         4 if !realms.shown && now - walk.mark > DWELL => {
@@ -137,7 +142,11 @@ pub(super) fn debug_realm_smoke(
             (walk.phase, walk.mark) = (5, now);
         }
         5 if realms.shown && now - walk.mark > DWELL => {
-            okay(realms, &choice);
+            okay(
+                realms,
+                &choice,
+                crate::net::LoginAbandon::now(abandon.as_deref()),
+            );
             (walk.phase, walk.mark, walk.rosters) = (6, now, walk.seen + 1);
         }
         6 if walk.seen >= walk.rosters && !realms.shown && at_select => {
@@ -159,7 +168,7 @@ fn open(mut realms: ResMut<Realms>, choice: &RealmChoice) {
 }
 
 /// `RealmList_OnOk` on whatever the dialog opened with highlighted, or the first row.
-fn okay(mut realms: ResMut<Realms>, choice: &RealmChoice) {
+fn okay(mut realms: ResMut<Realms>, choice: &RealmChoice, generation: u64) {
     let name = realms.selected().map(|r| r.name.clone()).or_else(|| {
         realms
             .rows()
@@ -170,11 +179,10 @@ fn okay(mut realms: ResMut<Realms>, choice: &RealmChoice) {
         return;
     };
     realms.hide();
-    let _ = choice.0.send(RealmRequest::Enter(name));
+    realms.enter(choice, name, generation);
 }
 
-/// `RealmList_OnCancel`.
-fn cancel(mut realms: ResMut<Realms>, choice: &RealmChoice) {
+/// `RealmList_OnCancel` over character select, where it only hides the list.
+fn cancel(mut realms: ResMut<Realms>) {
     realms.hide();
-    let _ = choice.0.send(RealmRequest::Abandon);
 }
diff --git a/crates/benilla-app/src/ui_script/glue_mgr.rs b/crates/benilla-app/src/ui_script/glue_mgr.rs
index efb30589..ebdd1a88 100644
--- a/crates/benilla-app/src/ui_script/glue_mgr.rs
+++ b/crates/benilla-app/src/ui_script/glue_mgr.rs
@@ -30,7 +30,35 @@
 //!    for the five codes of `0x803740` (`0x46bf63`), and goes to 0.
 //!
 //! `StatusDialogClick` (`0x46b720`) is the dialog button's verb, a jump on the state: state 1
-//! cancels the logon (`0x5b3320`), state 2 cancels the world operation (`RESPONSE_CANCELLED`).
+//! cancels the logon (`0x5b3320`), states 2 and 4 complete the operation `RESPONSE_CANCELLED`.
+//!
+//! The realm list, the same machine's other half:
+//!
+//! 1. The connect's first act is a realm list query (`0x5aab20`; after the logon the logon's own
+//!    list is the reply). On the reply (`0x5ab800`) a realm already selected this process
+//!    (`[0xc28134]`, the record copied to `0xc27fb8`) is dialled; else the `realmName` CVar names
+//!    one, first match by name, case folded (`0x5ab6f0`); else the connect fails
+//!    `REALM_LIST_REALM_NOT_FOUND`. A query with no answer fails it `REALM_LIST_FAILED`.
+//! 2. State 2's failure arm, for any status but `AUTH_FAILED`, raises the list over the screen
+//!    (`0x46bf1f`-`0x46bf96`): `CLOSE_STATUS_DIALOG`, which takes the failure's `OKAY` back down,
+//!    then the rebuild (`0x46e510`), whose tail fires `GET_PREFERRED_REALM_INFO` (`GlueParent`'s
+//!    `SetGlueScreen("realmwizard")`) for an account with no characters that has chosen no realm
+//!    this session, else `OPEN_REALM_LIST`. With no realm held it asks for the list instead
+//!    (`0x46c06e`). `RESPONSE_CANCELLED` shows no dialog and drops the world socket alone
+//!    (`0x46befd`), so the realmd link stays up for the next pick.
+//! 3. `RequestRealmList` (`0x46b8d0`) is state 4 and a query, with the `CANCEL` dialog
+//!    `REALM_LIST_IN_PROGRESS` when asked. State 4's frame (`0x46c0a5`) re-texts the dialog; a
+//!    success goes to 0, closes the dialog and rebuilds (`0x46c0d2`-`0x46c0e2`), which is how the
+//!    stock list's five-second refresh redraws; a failure opens `OKAY` and goes to 0.
+//! 4. `ChangeRealm` reaches `ConnectToRealm` (`0x46b210`): the realm selected, state 2, the
+//!    `CANCEL` dialog `GAME_SERVER_LOGIN`, and the connect. `RealmListDialogCancelled` closes the
+//!    realmd link on the login screen only; `CancelRealmListQuery` cancels state 4 only.
+//!
+//! The list itself, its categories, sort and the verbs that read it are the glue VM's
+//! ([`benilla_ui::script::GlueRealm`]); the manager fills its holder and runs its rebuild where
+//! `CGlueMgr::Update` does. `SUGGEST_REALM_WRONG_PVP` and `SUGGEST_REALM_WRONG_CATEGORY` are in the
+//! event table (`0xb41ebc`, `0xb41ec0`) but no glue code fires them: no `SignalEvent`
+//! (`0x703e50`, `0x703f50`) site in `[0x46a400, 0x476020)` passes 19 or 20.
 //!
 //! The native login reports a logon as one blocking step, so of the logon's states only
 //! `CONNECTING` and `AUTHENTICATED` are seen; its refusals map through the reference's own
@@ -38,24 +66,24 @@
 
 use bevy::prelude::*;
 
-use benilla_protocol::{LoginRefusal, LoginStage};
+use benilla_protocol::{LoginRefusal, LoginStage, RealmInfo};
 use benilla_ui::script::{
-    GlueNotice, GlueRequest, GlueServer, NoticeState, ScriptValue, UiScript, VmKind,
+    GlueNotice, GlueRealm, GlueRealmCells, GlueRequest, GlueServer, NoticeState, ScriptValue,
+    UiScript, VmKind,
 };
 
 use crate::login::queue::QueueEstimate;
 use crate::login::GlueLogin;
 use crate::net::{
     CharListMessage, DisconnectedMessage, LoginFailedMessage, LoginQueuedMessage,
-    LoginStageMessage, RealmListMessage,
+    LoginStageMessage, RealmListMessage, RealmRequest,
 };
 
 /// `CGlueMgr`'s `screenState` (`0xb41da0`), named by the functions that set each value: the
-/// states the login reaches. The reference's others are the character list (3, `0x46b893`), the
-/// realm list (4, `0x46b8d2`), create, delete and rename (5-7, `0x46b29e`, `0x46b2f8`,
-/// `0x46b3a4`), `EnterWorld` (8, `0x46b711`), a refused character login (9, `0x402075`) and the
-/// patch and survey downloads (10 and 11, `0x473c40`, `0x473da8`), each set by a verb these screens
-/// do not have yet.
+/// states the login and the realm list reach. The reference's others are the character list (3,
+/// `0x46b893`), create, delete and rename (5-7, `0x46b29e`, `0x46b2f8`, `0x46b3a4`), `EnterWorld`
+/// (8, `0x46b711`), a refused character login (9, `0x402075`) and the patch and survey downloads
+/// (10 and 11, `0x473c40`, `0x473da8`), each set by a verb these screens do not have yet.
 #[derive(Clone, Copy, Debug, Default, PartialEq, Eq)]
 pub(crate) enum ScreenState {
     /// No operation (`0x46a7ce`, and every terminal arm).
@@ -65,6 +93,8 @@ pub(crate) enum ScreenState {
     Logon = 1,
     /// The world connect: realm list, dial and authentication (`0x46b1f9`, `0x46b250`).
     Connect = 2,
+    /// A realm list query (`RequestRealmList`, `0x46b8d2`).
+    RealmList = 4,
 }
 
 /// The logon's `LOGIN_STATE_*` keys by login state (`0x836b40`, 13 entries).
@@ -220,6 +250,7 @@ const RESULT_DISCONNECTED: i32 = 0x14;
 
 /// World statuses.
 const STATUS_RESPONSE_FAILURE: u8 = 0x01;
+const STATUS_CANCELLED: u8 = 0x02;
 const STATUS_FAILED_TO_CONNECT: u8 = 0x04;
 const STATUS_RESPONSE_CONNECTED: u8 = 0x05;
 const STATUS_CONNECTING: u8 = 0x07;
@@ -227,6 +258,10 @@ const STATUS_AUTHENTICATING: u8 = 0x0b;
 const STATUS_AUTH_OK: u8 = 0x0c;
 const STATUS_AUTH_FAILED: u8 = 0x0d;
 const STATUS_WAIT_QUEUE: u8 = 0x1b;
+const STATUS_REALM_LIST_IN_PROGRESS: u8 = 0x22;
+const STATUS_REALM_LIST_SUCCESS: u8 = 0x23;
+const STATUS_REALM_LIST_FAILED: u8 = 0x24;
+const STATUS_REALM_LIST_REALM_NOT_FOUND: u8 = 0x26;
 
 /// What a realmd result byte becomes, `(login state, result)`: `Logon::OnAuthResult`'s
 /// dispatch (`0x5b2c90`, byte index `0x5b2ea4`, jumps `0x5b2e78`) after the handlers' clamp of a
@@ -258,7 +293,7 @@ pub(crate) fn realmd_result(byte: u8, reply: benilla_protocol::LogonReply) -> Op
     Some((LOGIN_FAILED_STATE, result))
 }
 
-/// A `ClientServices` operation of state 2 (`[svc+0x1b10]`).
+/// A `ClientServices` operation (`[svc+0x1b10]`).
 #[derive(Clone, Copy, Debug, Default, PartialEq, Eq)]
 enum OpKind {
     /// `COP_CONNECT` (2, `0x5aab20`).
@@ -266,6 +301,8 @@ enum OpKind {
     Connect,
     /// The authentication (3, `0x5aaba0`).
     Auth,
+    /// `COP_GET_REALMS` (9, `0x5ab840`).
+    GetRealms,
 }
 
 /// The operation record (`BeginOperation` `0x5aa400`, `SetStatus` `0x5aa920`): its status code
@@ -278,6 +315,9 @@ struct Operation {
     ok: bool,
     /// The text of a failure the reference has no status for, shown in place of the status's.
     raw: Option<String>,
+    /// A connect or a query whose realm list reply has not come (`0x5abb90` dispatches the reply
+    /// on the operation pending).
+    awaiting_list: bool,
 }
 
 impl Operation {
@@ -285,6 +325,7 @@ impl Operation {
         Operation {
             kind,
             status,
+            awaiting_list: matches!(kind, OpKind::Connect | OpKind::GetRealms),
             ..Default::default()
         }
     }
@@ -331,6 +372,11 @@ enum Outgoing {
     Screen(&'static str),
     /// `DISCONNECTED_FROM_SERVER` (event 2, `0x46c62e`).
     Disconnected,
+    /// `CLOSE_STATUS_DIALOG` (event 5).
+    Close,
+    /// The realm list rebuild (`0x46e510`) over the holder, which fires `OPEN_REALM_LIST` or
+    /// `GET_PREFERRED_REALM_INFO`.
+    Rebuild,
 }
 
 /// The logon's notification cells: the latest `(state, result)` (`0x836b28`, `0x836b24`) and the
@@ -376,6 +422,23 @@ pub(crate) struct GlueMgr {
     outbox: Vec<Outgoing>,
     /// The glue VM this manager last served, by session.
     vm: Option<u64>,
+    /// The realm holder (`[0xc28118]`): the realms the last list reply carried.
+    holder: Vec<RealmInfo>,
+    /// The holder changed since the VM was last seeded.
+    holder_moved: bool,
+    /// `[0xc28134]` and its copy at `0xc27fb8`: the realm the next connect dials, set by the first
+    /// selection and kept for the process.
+    selected: Option<RealmInfo>,
+    /// `[svc+0x1ae4]`: the last roster's character count.
+    characters: u16,
+    /// The realm list's sort and selection cells, carried from one glue VM to the next.
+    realm_cells: GlueRealmCells,
+    /// The manager moved [`Self::realm_cells`], for the next seed.
+    cells_moved: bool,
+    /// Realm requests for the IO thread, sent at the end of the frame.
+    realm_out: Vec<RealmRequest>,
+    /// Asks of the login engine the per-frame arms made, sent with the verbs' own.
+    login_out: Vec<GlueLogin>,
 }
 
 impl GlueMgr {
@@ -420,7 +483,7 @@ impl GlueMgr {
         self.open("CANCEL", None);
     }
 
-    /// `StatusDialogClick` (`0x46b720`).
+    /// `StatusDialogClick` (`0x46b720`, jump table `0x46b7a8`).
     fn status_dialog_click(&mut self, asks: &mut Vec<GlueLogin>) {
         match self.state {
             // `0x46b731`: the pending operation's callback; none is pending outside an operation.
@@ -430,18 +493,111 @@ impl GlueMgr {
                 asks.push(GlueLogin::Abandon);
                 self.state = ScreenState::Idle;
             }
-            // `0x46b754`: the operation completes as `RESPONSE_CANCELLED`, which the next tick's
-            // failure arm takes without a dialog (`0x46bef2`), dropping the connection; the realm
-            // list it then raises (`0x46bf8c`, `0x46c073`) is not built on these screens yet.
-            ScreenState::Connect => {
-                asks.push(GlueLogin::Abandon);
-                self.op = Operation::default();
-                self.connected = false;
+            // `0x46b754`: the operation completes `RESPONSE_CANCELLED`, which the next tick's
+            // failure arm takes without a dialog (`0x46bef2`), dropping the world socket and
+            // raising the realm list. Its `0x472580` tears the glue character list down, which
+            // these screens do not have yet.
+            ScreenState::Connect => self.op.complete(false, STATUS_CANCELLED),
+            // `0x46b776`: the query cancelled, state 0, nothing sent.
+            ScreenState::RealmList => {
+                self.op.complete(false, STATUS_CANCELLED);
                 self.state = ScreenState::Idle;
             }
         }
     }
 
+    /// The asks the per-frame arms made of the login engine and of the IO thread.
+    fn take_asks(&mut self) -> (Vec<GlueLogin>, Vec<RealmRequest>) {
+        (
+            std::mem::take(&mut self.login_out),
+            std::mem::take(&mut self.realm_out),
+        )
+    }
+
+    /// `0x46b8d0`, `RequestRealmList`'s body: state 4, the dialog when asked, and the query
+    /// (`0x5ab840`, `COP_GET_REALMS` at `REALM_LIST_IN_PROGRESS`).
+    fn request_realm_list(&mut self, dialog: bool) {
+        self.state = ScreenState::RealmList;
+        if dialog {
+            self.open("CANCEL", Some(Text::Key("REALM_LIST_IN_PROGRESS")));
+        }
+        self.op = Operation::begin(OpKind::GetRealms, STATUS_REALM_LIST_IN_PROGRESS);
+        self.realm_out.push(RealmRequest::Refresh);
+    }
+
+    /// `CancelRealmListQuery` (`0x46b7e0`): in state 4 only, the query completes cancelled and the
+    /// state goes to 0; nothing is sent, so a late reply only fills the holder.
+    fn cancel_realm_list_query(&mut self) {
+        if self.state == ScreenState::RealmList {
+            self.op.complete(false, STATUS_CANCELLED);
+            self.state = ScreenState::Idle;
+        }
+    }
+
+    /// `ConnectToRealm` (`0x46b210`) for the realm `ChangeRealm` named, `realmName` already set to
+    /// it: the selection (`0x5ab7b0`'s tail, `0x5ab6f0`), state 2, the `GAME_SERVER_LOGIN` dialog
+    /// and the connect. With a world connection up the reference drops it first (`0x46b22b` →
+    /// `0x5ab1a0`) and begins the same connect from the disconnect handler (`0x46c5bf`); here the
+    /// drop is asked first and the connect follows at once, so a failed query finds no session.
+    fn connect_to_realm(&mut self, name: &str) {
+        if let Some(r) = select_by_name(&self.holder, name) {
+            self.selected = Some(r);
+        }
+        if self.connected {
+            // `0x46b22b`: the world connection drops before anything is asked of realmd.
+            self.realm_out.push(RealmRequest::Leave);
+        }
+        self.connected = false;
+        self.state = ScreenState::Connect;
+        self.open("CANCEL", Some(Text::Key("GAME_SERVER_LOGIN")));
+        self.op = Operation::begin(OpKind::Connect, STATUS_CONNECTING);
+        self.queue = QueueEstimate::default();
+        // The connect's own query (`0x5aab20` → `0x5b2220`).
+        self.realm_out.push(RealmRequest::Refresh);
+    }
+
+    /// A realm list reply: the holder filled (`0x5b2230`), then the pending operation's arm of
+    /// `0x5abb90`. A query's success is `REALM_LIST_SUCCESS`; a connect's dials the selected realm,
+    /// or the one `realm_name` names, and completes only through the dial (`0x5ab823` calls no
+    /// `SetStatus`); no answer fails either `REALM_LIST_FAILED`.
+    fn on_realm_list(&mut self, realms: Vec<RealmInfo>, failed: bool, realm_name: &str) {
+        if !failed {
+            self.holder = realms;
+            self.holder_moved = true;
+        }
+        if !self.op.awaiting_list || self.op.done {
+            return;
+        }
+        self.op.awaiting_list = false;
+        if failed {
+            self.op.complete(false, STATUS_REALM_LIST_FAILED);
+            return;
+        }
+        match self.op.kind {
+            OpKind::GetRealms => self.op.complete(true, STATUS_REALM_LIST_SUCCESS),
+            OpKind::Connect => {
+                if self.selected.is_none() {
+                    self.selected = select_by_name(&self.holder, realm_name);
+                }
+                match &self.selected {
+                    Some(r) => {
+                        info!("glue: the connect dials {:?}", r.name);
+                        // Stamped with the abandon generation as it is sent.
+                        self.realm_out.push(RealmRequest::Enter {
+                            realm: r.clone(),
+                            generation: 0,
+                        });
+                    }
+                    None => {
+                        info!("glue: realmName {realm_name:?} names no listed realm");
+                        self.op.complete(false, STATUS_REALM_LIST_REALM_NOT_FOUND);
+                    }
+                }
+            }
+            OpKind::Auth => {}
+        }
+    }
+
     /// A login stage off the IO thread. `glue_up` is whether the stock screens stand: a stage of
     /// an attempt the native policy made on its own (the `WOW_USER` fast path, a resubmit) shows
     /// as a login only there.
@@ -520,27 +676,43 @@ impl GlueMgr {
         }
     }
 
-    /// State 2's failure arm (`0x46bea7`-`0x46bfc8`): the dialog, state 0, and `AUTH_FAILED` from
-    /// the character screen goes back to login. The realm list the arm raises for every other
-    /// code (`0x46bf1f`-`0x46bf96`, `0x46c073`) is not built on these screens yet, so the dialog
-    /// stays.
+    /// State 2's failure arm (`0x46bea7`-`0x46bfc8`): the dialog unless cancelled, state 0, a
+    /// cancel's world socket dropped (`0x46befd`); `AUTH_FAILED` from the character screen goes
+    /// back to login (`0x46bfa7`); every other status raises the realm list (`0x46bf1f`-`0x46bf96`),
+    /// or with no realm held asks for one (`0x46c06e`). The arm's `0x472580` tears the glue
+    /// character list down, which these screens do not have yet.
     fn world_failed(&mut self) {
-        let (text, code) = match self.op.text() {
-            Some(Text::Raw(t)) => (Text::Raw(t), None),
-            _ => status_text(self.op.status),
-        };
-        match code.and_then(|c| URL_STATUSES.iter().find(|(s, _)| *s == c)) {
-            Some((_, url)) => self.outbox.push(Outgoing::Open {
-                which: "OKAY_WITH_URL",
-                text: Some(text),
-                data: Some(url.to_string()),
-            }),
-            None => self.open("OKAY", Some(text)),
+        let status = self.op.status;
+        if status != STATUS_CANCELLED {
+            let (text, code) = match self.op.text() {
+                Some(Text::Raw(t)) => (Text::Raw(t), None),
+                _ => status_text(status),
+            };
+            match code.and_then(|c| URL_STATUSES.iter().find(|(s, _)| *s == c)) {
+                Some((_, url)) => self.outbox.push(Outgoing::Open {
+                    which: "OKAY_WITH_URL",
+                    text: Some(text),
+                    data: Some(url.to_string()),
+                }),
+                None => self.open("OKAY", Some(text)),
+            }
         }
         self.state = ScreenState::Idle;
         self.connected = false;
-        if code == Some(STATUS_AUTH_FAILED) && self.screen.eq_ignore_ascii_case("charselect") {
-            self.outbox.push(Outgoing::Screen("login"));
+        if status == STATUS_CANCELLED {
+            self.login_out.push(GlueLogin::CancelWorld);
+        }
+        if status == STATUS_AUTH_FAILED {
+            if self.screen.eq_ignore_ascii_case("charselect") {
+                self.outbox.push(Outgoing::Screen("login"));
+            }
+            return;
+        }
+        if self.holder.is_empty() {
+            self.request_realm_list(true);
+        } else {
+            self.outbox.push(Outgoing::Close);
+            self.outbox.push(Outgoing::Rebuild);
         }
     }
 
@@ -610,7 +782,8 @@ impl GlueMgr {
                 }
                 if self.auth_final {
                     // `0x46ba8d`-`0x46ba98`, then `0x46b1f0`'s idle test passes and the connect
-                    // begins at `CSTATUS_CONNECTING` (`0x5aab4a`), its ring cleared (`0x5aab30`).
+                    // begins at `CSTATUS_CONNECTING` (`0x5aab4a`), its ring cleared (`0x5aab30`),
+                    // with no dialog of its own; the logon's list is its query's reply.
                     self.state = ScreenState::Connect;
                     self.auth_final = false;
                     self.op = Operation::begin(OpKind::Connect, STATUS_CONNECTING);
@@ -625,7 +798,28 @@ impl GlueMgr {
                 }
             }
             ScreenState::Connect => self.tick_connect(),
-            _ => {}
+            ScreenState::RealmList => self.tick_realm_list(),
+            ScreenState::Idle => {}
+        }
+    }
+
+    /// State 4's frame (`0x46c0a5`): the dialog re-texted, then a completed query's arm, success
+    /// to state 0, the dialog closed and the rebuild (`0x46c0d2`-`0x46c0e2`), failure to `OKAY`
+    /// with its text and state 0 (`0x46c0c9` → `0x46c177`).
+    fn tick_realm_list(&mut self) {
+        if let Some(text) = self.op.text() {
+            self.outbox.push(Outgoing::Update { text, button: None });
+        }
+        if !self.op.done {
+            return;
+        }
+        self.state = ScreenState::Idle;
+        if self.op.ok {
+            self.outbox.push(Outgoing::Close);
+            self.outbox.push(Outgoing::Rebuild);
+        } else {
+            let text = self.op.text();
+            self.open("OKAY", text);
         }
     }
 
@@ -651,6 +845,20 @@ impl GlueMgr {
             self.op = Operation::default();
             self.queue = QueueEstimate::default();
             self.outbox.push(Outgoing::Screen("charselect"));
+            self.roster_arm();
+        }
+    }
+
+    /// The roster's arm (`0x4724d0`), which the reference reaches from the character list query
+    /// that `charselect` asks for (`0x46c094`); benilla's roster comes with the authentication.
+    /// Characters mark a realm chosen (`0x472556`); an empty roster with no realm chosen asks for
+    /// the list with its dialog (`0x47253d` → `0x46b8d0`), skipping `CHARACTER_LIST_UPDATE`.
+    fn roster_arm(&mut self) {
+        if self.characters != 0 {
+            self.realm_cells.chosen = Some(0);
+            self.cells_moved = true;
+        } else if self.realm_cells.chosen.is_none() {
+            self.request_realm_list(true);
         }
     }
 
@@ -692,6 +900,27 @@ impl GlueMgr {
     }
 }
 
+/// `SelectRealmByName` (`0x5ab6f0`): the first realm in the holder whose name matches, case
+/// folded (`0x64a4c0`), whatever its flags.
+fn select_by_name(holder: &[RealmInfo], name: &str) -> Option<RealmInfo> {
+    holder
+        .iter()
+        .find(|r| r.name.eq_ignore_ascii_case(name))
+        .cloned()
+}
+
+/// A realm record as the glue VM's holder takes it.
+fn glue_realm(r: &RealmInfo) -> GlueRealm {
+    GlueRealm {
+        name: r.name.clone(),
+        realm_type: r.realm_type,
+        flags: r.flags,
+        population: r.population,
+        characters: r.characters,
+        category: r.category,
+    }
+}
+
 /// A world status's text and its code for the URL walk; a code past the table reads
 /// `RESPONSE_FAILURE`.
 fn status_text(code: u8) -> (Text, Option<u8>) {
@@ -720,6 +949,8 @@ pub(crate) struct LoginNews<'w, 's> {
 pub(crate) struct GlueAsks<'w> {
     login: MessageWriter<'w, GlueLogin>,
     music: MessageWriter<'w, crate::sound::GlueMusicRequest>,
+    realm: Option<Res<'w, crate::net::RealmChoice>>,
+    abandon: Option<Res<'w, crate::net::LoginAbandon>>,
 }
 
 /// The CVars each agreement is read from and written to.
@@ -768,7 +999,9 @@ pub(crate) fn drive_glue_mgr(
         }
     }
 
-    // A new glue VM is the glue build (`0x46a7b0`): state 0, its slots seeded.
+    // A new glue VM is the glue build (`0x46a7b0`): state 0, its slots seeded, and the realm
+    // list's C globals carried over, which outlive the Lua state.
+    let mut fresh_vm = false;
     if let Some(s) = script.as_deref_mut() {
         if mgr.vm != Some(s.session()) {
             mgr.vm = Some(s.session());
@@ -776,12 +1009,26 @@ pub(crate) fn drive_glue_mgr(
             mgr.cells = LoginCells::default();
             mgr.auth_final = false;
             s.set_glue_saved_account(&crate::login::load_saved_account());
+            s.set_glue_realm_cells(mgr.realm_cells);
+            mgr.holder_moved = true;
+            fresh_vm = true;
         }
     } else if in_world {
         // In the world the glue is torn down, and the entry's second phase leaves state 0
         // (`0x46c252`).
         mgr.state = ScreenState::Idle;
     }
+    if let (Some(s), Some(r)) = (script.as_deref_mut(), realms.as_ref()) {
+        if fresh_vm || r.is_changed() {
+            let (categories, types) = r.glue_setup();
+            s.set_glue_realm_setup(categories, types);
+        }
+    }
+    // The name a connect resolves (`0x5ab7d0`).
+    let realm_name = script
+        .as_deref()
+        .and_then(|s| s.cvar(crate::realm_select::CVAR_REALM_NAME))
+        .unwrap_or_default();
 
     // The verbs the last tick's Lua called.
     let mut logins = Vec::new();
@@ -812,15 +1059,27 @@ pub(crate) fn drive_glue_mgr(
                     logins.push(GlueLogin::Disconnect);
                 }
                 GlueRequest::QuitGame => logins.push(GlueLogin::Quit),
+                GlueRequest::RequestRealmList { dialog } => mgr.request_realm_list(dialog),
+                GlueRequest::CancelRealmListQuery => mgr.cancel_realm_list_query(),
+                // `CLoginMgr::Cancel` (`0x5b3320`): nothing else moves, so no dialog shows.
+                GlueRequest::CancelLogon => logins.push(GlueLogin::Abandon),
+                GlueRequest::ChangeRealm(name) => mgr.connect_to_realm(&name),
             }
         }
+        mgr.realm_cells = s.glue_realm_cells();
     }
 
     // The native login's news.
     for msg in news.stages.read() {
         mgr.on_stage(msg.stage, glue_up);
     }
-    for _ in news.realm_lists.read() {
+    // The logon's list ends the logon, then answers the connect its latch begins.
+    let lists: Vec<(Vec<RealmInfo>, bool)> = news
+        .realm_lists
+        .read()
+        .map(|m| (m.realms.clone(), m.failed))
+        .collect();
+    if !lists.is_empty() {
         mgr.on_logon_done();
     }
     for msg in news.queued.read() {
@@ -830,19 +1089,33 @@ pub(crate) fn drive_glue_mgr(
     if mgr.auth_final {
         mgr.tick();
     }
+    for (realms, failed) in lists {
+        mgr.on_realm_list(realms, failed, &realm_name);
+    }
     for msg in news.failures.read() {
         mgr.on_failed(msg);
     }
     for msg in news.rosters.read() {
+        mgr.characters = msg.characters.len().min(usize::from(u16::MAX)) as u16;
         mgr.on_roster(msg.realm.clone());
     }
     for msg in news.disconnects.read() {
         mgr.on_disconnected(msg.session_over);
     }
     mgr.tick();
-    for ask in logins {
+    let (arms, realm_asks) = mgr.take_asks();
+    for ask in logins.into_iter().chain(arms) {
         asks.login.write(ask);
     }
+    let now = crate::net::LoginAbandon::now(asks.abandon.as_deref());
+    if let Some(choice) = asks.realm.as_deref() {
+        for mut ask in realm_asks {
+            if let RealmRequest::Enter { generation, .. } = &mut ask {
+                *generation = now;
+            }
+            let _ = choice.0.send(ask);
+        }
+    }
 
     let Some(mut script) = script else {
         return;
@@ -855,13 +1128,18 @@ pub(crate) fn drive_glue_mgr(
             data: Some(typed),
         });
     }
-    seed(&mgr, &mut script, realms.as_deref(), realmlist.as_deref());
+    seed(
+        &mut mgr,
+        &mut script,
+        realms.as_deref(),
+        realmlist.as_deref(),
+    );
     flush(&mut mgr, &mut script, now_ms);
 }
 
 /// The glue VM's slots, from the manager's state.
 fn seed(
-    mgr: &GlueMgr,
+    mgr: &mut GlueMgr,
     script: &mut UiScript,
     realms: Option<&crate::realm_select::Realms>,
     realmlist: Option<&crate::realmlist::Realmlist>,
@@ -873,6 +1151,13 @@ fn seed(
         }
     }
     script.set_glue_connected(mgr.connected);
+    if std::mem::take(&mut mgr.cells_moved) {
+        script.set_glue_realm_cells(mgr.realm_cells);
+    }
+    if std::mem::take(&mut mgr.holder_moved) {
+        script.set_glue_realms(mgr.holder.iter().map(glue_realm).collect());
+    }
+    script.set_glue_realm_characters(mgr.characters);
     // `realmName` names the realm the session dials (`0x5ab7b0` writes it on the connect); the
     // flags come off the connected realm's `Cfg_Configs` row.
     let (name, pvp, rp) = match &mgr.realm {
@@ -962,6 +1247,11 @@ fn flush(mgr: &mut GlueMgr, script: &mut UiScript, now_ms: u32) {
                 script.fire_event("SET_GLUE_SCREEN", vec![ScriptValue::Str(name.to_string())]);
             }
             Outgoing::Disconnected => script.fire_event("DISCONNECTED_FROM_SERVER", Vec::new()),
+            Outgoing::Close => script.fire_event("CLOSE_STATUS_DIALOG", Vec::new()),
+            Outgoing::Rebuild => {
+                script.rebuild_glue_realms();
+                mgr.realm_cells = script.glue_realm_cells();
+            }
         }
     }
 }
diff --git a/crates/benilla-app/src/ui_script/glue_mgr_tests.rs b/crates/benilla-app/src/ui_script/glue_mgr_tests.rs
index 848d5c8a..4b343ddf 100644
--- a/crates/benilla-app/src/ui_script/glue_mgr_tests.rs
+++ b/crates/benilla-app/src/ui_script/glue_mgr_tests.rs
@@ -4,6 +4,7 @@ use std::sync::Arc;
 use super::*;
 use crate::char_select::ClientState;
 use crate::net::{LoginAbandon, LoginRequest, LoginSubmit};
+use benilla_protocol::RealmInfo;
 
 /// The manager with both agreements accepted, the way a returning player's CVars seed it.
 fn accepted() -> GlueMgr {
@@ -168,13 +169,29 @@ fn a_logon_refusal_opens_its_result_and_ends_the_logon() {
     }
 }
 
+/// One realm, `name`, as realmd lists it.
+fn realm(name: &str) -> RealmInfo {
+    RealmInfo {
+        name: name.into(),
+        address: "127.0.0.1:8085".into(),
+        population: 1.0,
+        characters: 0,
+        realm_type: 0,
+        flags: 0,
+        category: 1,
+        id: 1,
+    }
+}
+
 /// The world connect's failure arm: the status text, `OKAY_WITH_URL` with the URL key for the
-/// five codes of `0x803740`, and `AUTH_FAILED` from the character screen back to login.
+/// five codes of `0x803740`, then the realm list over it (`CLOSE_STATUS_DIALOG` and the rebuild);
+/// `AUTH_FAILED` instead goes from the character screen back to login.
 #[test]
 fn a_world_refusal_opens_its_status_and_url() {
     let connected = || {
         let mut m = accepted();
         m.state = ScreenState::Connect;
+        m.holder = vec![realm("Fake")];
         m
     };
     let update = |key| Outgoing::Update {
@@ -192,7 +209,9 @@ fn a_world_refusal_opens_its_status_and_url() {
                 which: "OKAY_WITH_URL",
                 text: Some(Text::Key("AUTH_BANNED")),
                 data: Some("AUTH_BANNED_URL".into()),
-            }
+            },
+            Outgoing::Close,
+            Outgoing::Rebuild,
         ]
     );
     assert_eq!(m.state, ScreenState::Idle);
@@ -217,9 +236,31 @@ fn a_world_refusal_opens_its_status_and_url() {
         m.outbox,
         [
             update("RESPONSE_FAILED_TO_CONNECT"),
-            open("OKAY", Some("RESPONSE_FAILED_TO_CONNECT"))
+            open("OKAY", Some("RESPONSE_FAILED_TO_CONNECT")),
+            Outgoing::Close,
+            Outgoing::Rebuild,
         ]
     );
+    assert!(
+        m.realm_out.is_empty(),
+        "the held list is raised, not asked for"
+    );
+
+    // With no realm held the arm asks for the list (`0x46c06e` → `0x46b8d0` with 1).
+    let mut m = connected();
+    m.holder.clear();
+    m.on_failed(&failed(None, false));
+    m.tick();
+    assert_eq!(
+        m.outbox,
+        [
+            update("RESPONSE_FAILED_TO_CONNECT"),
+            open("OKAY", Some("RESPONSE_FAILED_TO_CONNECT")),
+            open("CANCEL", Some("REALM_LIST_IN_PROGRESS")),
+        ]
+    );
+    assert_eq!(m.state, ScreenState::RealmList);
+    assert!(matches!(m.realm_out.as_slice(), [RealmRequest::Refresh]));
 }
 
 /// The world connect re-texts the dialog from its operation each frame: nothing while the connect
@@ -250,6 +291,7 @@ fn the_world_connect_shows_each_completion() {
         m.outbox.is_empty(),
         "the running authentication's text is empty"
     );
+    m.characters = 2;
     m.on_roster(None);
     m.tick();
     assert_eq!(
@@ -264,25 +306,70 @@ fn the_world_connect_shows_each_completion() {
     );
 }
 
-/// The roster ends the world connect: the status text, state 0, the character screen.
+/// The roster ends the world connect: the status text, state 0, the character screen, then the
+/// roster's arm (`0x4724d0`): characters mark a realm chosen (`0x472556`); an empty roster with
+/// no realm chosen asks for the list (`0x47253d` → `0x46b8d0`); one with a choice asks nothing.
 #[test]
 fn the_roster_puts_the_character_screen_up() {
+    let up = [
+        Outgoing::Update {
+            text: Text::Key("AUTH_OK"),
+            button: None,
+        },
+        Outgoing::Screen("charselect"),
+    ];
+    let mut m = accepted();
+    m.state = ScreenState::Connect;
+    m.characters = 3;
+    m.on_roster(None);
+    m.tick();
+    assert_eq!(m.outbox, up);
+    assert_eq!(m.state, ScreenState::Idle);
+    assert!(m.connected);
+    assert_eq!(m.realm_cells.chosen, Some(0));
+    assert!(m.cells_moved && m.realm_out.is_empty());
+
     let mut m = accepted();
     m.state = ScreenState::Connect;
     m.on_roster(None);
     m.tick();
+    let mut want = up.to_vec();
+    want.push(open("CANCEL", Some("REALM_LIST_IN_PROGRESS")));
     assert_eq!(
-        m.outbox,
-        [
-            Outgoing::Update {
-                text: Text::Key("AUTH_OK"),
-                button: None
-            },
-            Outgoing::Screen("charselect")
-        ]
+        m.outbox, want,
+        "an empty roster with no choice asks for the list"
     );
-    assert_eq!(m.state, ScreenState::Idle);
-    assert!(m.connected);
+    assert_eq!(m.state, ScreenState::RealmList);
+    assert!(matches!(m.realm_out.as_slice(), [RealmRequest::Refresh]));
+
+    let mut m = accepted();
+    m.state = ScreenState::Connect;
+    m.realm_cells.chosen = Some(5);
+    m.on_roster(None);
+    m.tick();
+    assert_eq!(m.outbox, up, "a realm was chosen: nothing more");
+    assert!(m.realm_out.is_empty());
+}
+
+/// Change Realm with the world up drops the session before the connect's query (`0x46b22b`).
+#[test]
+fn change_realm_with_the_world_up_leaves_it_first() {
+    let mut m = accepted();
+    m.holder = vec![realm("Fake")];
+    m.connected = true;
+    m.connect_to_realm("fake");
+    assert!(matches!(
+        m.realm_out.as_slice(),
+        [RealmRequest::Leave, RealmRequest::Refresh]
+    ));
+    assert_eq!(m.state, ScreenState::Connect);
+    assert!(!m.connected);
+    assert_eq!(m.selected.as_ref().map(|r| r.name.as_str()), Some("Fake"));
+
+    let mut m = accepted();
+    m.holder = vec![realm("Fake")];
+    m.connect_to_realm("Fake");
+    assert!(matches!(m.realm_out.as_slice(), [RealmRequest::Refresh]));
 }
 
 /// The queue re-texts the dialog every frame while the world connect waits.
@@ -296,22 +383,51 @@ fn the_queue_retexts_every_frame() {
     assert_eq!(m.outbox, [Outgoing::Queue, Outgoing::Queue]);
 }
 
-/// `StatusDialogClick` by state: the logon and the world connect are abandoned; idle does nothing.
+/// `StatusDialogClick` by state (`0x46b7a8`): the logon is cancelled; the world connect completes
+/// `RESPONSE_CANCELLED`, whose failure arm shows no dialog, drops the world attempt alone and
+/// raises the realm list; a query is cancelled to state 0; idle does nothing.
 #[test]
 fn status_dialog_click_cancels_by_state() {
     let mut asks = Vec::new();
     let mut m = accepted();
     m.status_dialog_click(&mut asks);
     assert!(asks.is_empty());
-    for state in [ScreenState::Logon, ScreenState::Connect] {
-        m.state = state;
-        m.status_dialog_click(&mut asks);
-        assert_eq!(m.state, ScreenState::Idle);
-    }
-    assert!(matches!(
-        asks.as_slice(),
-        [GlueLogin::Abandon, GlueLogin::Abandon]
-    ));
+    m.state = ScreenState::Logon;
+    m.status_dialog_click(&mut asks);
+    assert_eq!(m.state, ScreenState::Idle);
+    assert!(matches!(asks.as_slice(), [GlueLogin::Abandon]));
+
+    let mut asks = Vec::new();
+    let mut m = accepted();
+    m.holder = vec![realm("Fake")];
+    m.state = ScreenState::Connect;
+    m.op = Operation::begin(OpKind::Auth, STATUS_AUTHENTICATING);
+    m.status_dialog_click(&mut asks);
+    assert!(asks.is_empty(), "the logon stays up");
+    assert_eq!(m.state, ScreenState::Connect, "the next tick takes it");
+    m.tick();
+    assert_eq!(
+        m.outbox,
+        [
+            Outgoing::Update {
+                text: Text::Key("RESPONSE_CANCELLED"),
+                button: None
+            },
+            Outgoing::Close,
+            Outgoing::Rebuild
+        ],
+        "no failure dialog for a cancel"
+    );
+    assert!(matches!(m.login_out.as_slice(), [GlueLogin::CancelWorld]));
+    assert_eq!(m.state, ScreenState::Idle);
+
+    let mut m = accepted();
+    m.request_realm_list(false);
+    assert_eq!(m.state, ScreenState::RealmList);
+    m.status_dialog_click(&mut asks);
+    assert_eq!(m.state, ScreenState::Idle);
+    m.tick();
+    assert!(m.outbox.is_empty(), "a cancelled query reports nothing");
 }
 
 /// A session that is over fires `DISCONNECTED_FROM_SERVER`; a logout's relist does not; in the
@@ -525,3 +641,308 @@ fn the_realmlist_button_writes_realmlist() {
     );
     assert!(vm(&app).errors().is_empty(), "{:?}", vm(&app).errors());
 }
+
+// ── The stock screens over the IO thread and a fake realmd ──────────────────────────────────────
+
+use crate::net::io::fake::{self, FakeRealm};
+
+/// The IO thread's events, pumped into the app's messages as `net::session` does.
+#[derive(Resource)]
+struct IoEvents(crossbeam_channel::Receiver<benilla_protocol::SessionEvent>);
+
+/// World dials the IO thread began (`LoginStage::Handshaking`).
+#[derive(Resource, Default)]
+struct WorldDials(usize);
+
+fn pump(
+    events: Res<IoEvents>,
+    mut dials: ResMut<WorldDials>,
+    mut stages: MessageWriter<LoginStageMessage>,
+    mut lists: MessageWriter<RealmListMessage>,
+    mut failures: MessageWriter<LoginFailedMessage>,
+    mut rosters: MessageWriter<CharListMessage>,
+    mut queued: MessageWriter<LoginQueuedMessage>,
+) {
+    use benilla_protocol::SessionEvent as E;
+    for ev in events.0.try_iter() {
+        match ev {
+            E::LoginStage { stage } => {
+                if stage == LoginStage::Handshaking {
+                    dials.0 += 1;
+                }
+                stages.write(LoginStageMessage { stage });
+            }
+            E::RealmList { realms, failed } => {
+                lists.write(RealmListMessage { realms, failed });
+            }
+            E::LoginFailed {
+                refusal,
+                reason,
+                terminal,
+                dial,
+            } => {
+                failures.write(LoginFailedMessage {
+                    refusal,
+                    reason,
+                    terminal,
+                    dial,
+                });
+            }
+            E::CharacterList { characters, realm } => {
+                rosters.write(CharListMessage { characters, realm });
+            }
+            E::LoginQueued { position, realm } => {
+                queued.write(LoginQueuedMessage { position, realm });
+            }
+            _ => {}
+        }
+    }
+}
+
+/// The stock login screen, agreements accepted, over the IO thread's cycle and a fake realmd
+/// listing `realms`; `realm_name` is the persisted `realmName`.
+fn live_app(realms: impl FnOnce(&str) -> Vec<FakeRealm>, realm_name: &str) -> (App, fake::Realmd) {
+    let (realmd, _) = fake::servers(realms);
+    let cycles = fake::spawn_cycles();
+    let mut app = App::new();
+    app.init_resource::<Time>()
+        .init_resource::<GlueMgr>()
+        .init_resource::<crate::login::LoginIntent>()
+        .insert_resource(crate::realmlist::Realmlist::unpinned(&realmd.addr))
+        .insert_resource(LoginSubmit(cycles.login.clone()))
+        .insert_resource(LoginAbandon(cycles.abandon.clone()))
+        .insert_resource(crate::net::RealmChoice(cycles.realm.clone()))
+        .insert_resource(crate::net::CharPick(cycles.pick.clone()))
+        .insert_resource(crate::realm_select::Realms::us_client())
+        .insert_resource(IoEvents(cycles.events.clone()))
+        .init_resource::<WorldDials>()
+        .insert_resource(State::new(ClientState::Login))
+        .init_resource::<NextState<ClientState>>()
+        .add_message::<LoginStageMessage>()
+        .add_message::<LoginQueuedMessage>()
+        .add_message::<LoginFailedMessage>()
+        .add_message::<CharListMessage>()
+        .add_message::<RealmListMessage>()
+        .add_message::<DisconnectedMessage>()
+        .add_message::<GlueLogin>()
+        .add_message::<crate::sound::GlueMusicRequest>()
+        .add_message::<AppExit>()
+        .add_systems(
+            Update,
+            (pump, drive_glue_mgr, crate::login::answer_glue).chain(),
+        );
+    let mut s = UiScript::new_glue().unwrap();
+    s.set_screen_size(1024.0, 768.0);
+    s.register_cvars(crate::cvars::registered_pairs());
+    s.set_cvar_host(crate::realm_select::CVAR_REALM_NAME, realm_name);
+    let _ = super::super::glue::load_glue(&mut s);
+    super::super::glue::set_glue_screen(&mut s, super::super::glue::GlueScreen::Login);
+    s.run("AcceptEULA() AcceptTOS() AccountLogin_ShowUserAgreements()")
+        .unwrap();
+    let _ = s.take_errors();
+    app.insert_non_send_resource(s);
+    app.update();
+    // The cycles' ends stay alive with the app's resources.
+    std::mem::forget(cycles);
+    (app, realmd)
+}
+
+/// Run frames, the VM's own tick between them, until `done` holds.
+fn until(app: &mut App, what: &str, done: impl Fn(&App) -> bool) {
+    let deadline = std::time::Instant::now() + fake::WAIT;
+    while !done(app) {
+        if std::time::Instant::now() >= deadline {
+            let m = app.world().resource::<GlueMgr>();
+            panic!(
+                "timed out waiting for {what}: state {:?}, op {:?}, holder {}, screen {:?}, \
+                 dialog {:?}, errors {:?}",
+                m.state,
+                m.op,
+                m.holder.len(),
+                m.screen,
+                dialog(app),
+                vm(app).errors()
+            );
+        }
+        app.update();
+        app.world_mut()
+            .non_send_resource_mut::<UiScript>()
+            .tick(0.01);
+        std::thread::sleep(std::time::Duration::from_millis(2));
+    }
+}
+
+/// Type the fake realmd's account into the stock boxes and press Login.
+fn log_in(app: &mut App) {
+    vm(app)
+        .run(&format!(
+            "AccountLoginAccountEdit:SetText('{}') AccountLoginPasswordEdit:SetText('{}') \
+             AccountLogin_Login()",
+            fake::USER,
+            fake::PASS
+        ))
+        .unwrap();
+    app.update();
+}
+
+fn shown(app: &App, frame: &str) -> bool {
+    vm(app)
+        .eval::<bool>(&format!("return {frame}:IsShown() == 1"))
+        .unwrap()
+}
+
+fn screen_up(app: &App) -> bool {
+    let m = app.world().resource::<GlueMgr>();
+    m.state == ScreenState::Idle && m.connected
+}
+
+/// A launch whose `realmName` names no realm, for an account the session has seen no roster of
+/// and with no realm chosen: the connect fails `REALM_LIST_REALM_NOT_FOUND`, its `OKAY` comes
+/// down, and `GET_PREFERRED_REALM_INFO` puts the realm wizard up (#834). Its location buttons are
+/// the Region's categories holding a realm; Suggest with PvP asks `SetPreferredInfo`, whose
+/// `SUGGEST_REALM` the character screen turns into the suggestion dialog, and Accept connects.
+#[test]
+fn a_fresh_account_is_asked_for_a_realm_and_suggested_one() {
+    let _ = benilla_formats::wow_data_or_skip!();
+    let (mut app, realmd) = live_app(
+        |world| {
+            let mut pvp = FakeRealm::new("Bravo", world);
+            pvp.realm_type = 1;
+            let mut oz = FakeRealm::new("Oz", world);
+            oz.category = 5;
+            vec![FakeRealm::new("Alpha", world), pvp, oz]
+        },
+        "",
+    );
+    log_in(&mut app);
+    until(&mut app, "the realm wizard", |app| {
+        shown(app, "RealmWizard")
+    });
+    assert_eq!(dialog(&app), None, "the not-found OKAY is taken back down");
+    assert_eq!(app.world().resource::<GlueMgr>().state, ScreenState::Idle);
+    assert_eq!(
+        vm(&app)
+            .eval::<(String, String, bool)>(
+                "return RealmWizardLocationButton1Text:GetText(), \
+                 RealmWizardLocationButton2Text:GetText(), \
+                 RealmWizardLocationButton3:IsShown() == 1"
+            )
+            .unwrap(),
+        ("United States".into(), "Oceanic".into(), false),
+        "one location per category holding a realm"
+    );
+
+    vm(&app)
+        .run(
+            "RealmWizardLocationButton1:Click() RealmWizardGameTypeButton2:Click() \
+             RealmWizardSuggest:Click()",
+        )
+        .unwrap();
+    let (which, text) = dialog(&app).expect("the suggestion dialog");
+    assert_eq!(which, "SUGGEST_REALM");
+    assert!(
+        text.contains("Bravo"),
+        "the PvP realm is suggested: {text:?}"
+    );
+
+    vm(&app).run("GlueDialogButton1:Click()").unwrap();
+    until(&mut app, "the character screen", screen_up);
+    assert_eq!(
+        vm(&app)
+            .cvar(crate::realm_select::CVAR_REALM_NAME)
+            .as_deref(),
+        Some("Bravo"),
+        "ChangeRealm sets realmName"
+    );
+    assert_eq!(
+        realmd.logons(),
+        1,
+        "the realm was dialled on the logon's link"
+    );
+}
+
+/// A launch whose `realmName` names no realm, once a realm has been chosen this session, raises
+/// the realm list over the login screen, its tabs the two categories. Cancel there closes the
+/// realmd link and the next login is taken (#833); the close button leaves the link up, and the
+/// next login is taken too; a row and Okay then reach the character screen.
+#[test]
+fn closing_the_realm_list_lets_the_next_login_through() {
+    let _ = benilla_formats::wow_data_or_skip!();
+    let (mut app, realmd) = live_app(
+        |world| {
+            let mut oz = FakeRealm::new("Oz", world);
+            oz.category = 5;
+            vec![FakeRealm::new("Alpha", world), oz]
+        },
+        "Gone",
+    );
+    app.world_mut().resource_mut::<GlueMgr>().realm_cells.chosen = Some(0);
+    // The fresh VM takes the cells on the next frame.
+    app.world_mut().resource_mut::<GlueMgr>().vm = None;
+    app.update();
+
+    log_in(&mut app);
+    until(&mut app, "the realm list", |app| shown(app, "RealmList"));
+    assert!(
+        shown(&app, "AccountLogin"),
+        "the list stands over the login screen"
+    );
+    assert_eq!(dialog(&app), None);
+    assert_eq!(
+        vm(&app)
+            .eval::<(String, String, bool)>(
+                "return RealmListTab1:GetText(), RealmListTab2:GetText(), \
+                 RealmListTab2:IsShown() == 1"
+            )
+            .unwrap(),
+        ("United States".into(), "Oceanic".into(), true)
+    );
+
+    vm(&app).run("RealmListCancelButton:Click()").unwrap();
+    until(&mut app, "the realmd link to close", |_| realmd.open() == 0);
+    assert!(!shown(&app, "RealmList") && shown(&app, "AccountLogin"));
+    log_in(&mut app);
+    until(&mut app, "the list after the second login", |app| {
+        shown(app, "RealmList")
+    });
+    assert_eq!(realmd.logons(), 2);
+
+    vm(&app).run("RealmListCloseButton:Click()").unwrap();
+    app.update();
+    assert_eq!(realmd.open(), 1, "the close button leaves the link up");
+    log_in(&mut app);
+    until(&mut app, "the list after the third login", |app| {
+        shown(app, "RealmList")
+    });
+    assert_eq!(realmd.logons(), 3);
+
+    vm(&app)
+        .run("RealmListRealmButton1:Click() RealmListOkButton:Click()")
+        .unwrap();
+    until(&mut app, "the character screen", screen_up);
+    assert_eq!(
+        vm(&app)
+            .cvar(crate::realm_select::CVAR_REALM_NAME)
+            .as_deref(),
+        Some("Alpha")
+    );
+}
+
+/// A server that lists no realm: the connect fails `REALM_LIST_REALM_NOT_FOUND`, the failure arm
+/// finds the holder empty and asks for the list (`0x46bf86` → `0x46c06e`), and the empty reply's
+/// rebuild puts the wizard up; nothing dials a fallback.
+#[test]
+fn an_empty_realm_list_asks_again_and_shows_it() {
+    let _ = benilla_formats::wow_data_or_skip!();
+    let (mut app, realmd) = live_app(|_| Vec::new(), "");
+    log_in(&mut app);
+    until(&mut app, "the realm wizard", |app| {
+        shown(app, "RealmWizard")
+    });
+    assert_eq!(realmd.lists(), 2, "the logon's list and the arm's query");
+    assert_eq!(
+        app.world().resource::<WorldDials>().0,
+        0,
+        "no fallback dial"
+    );
+}
diff --git a/crates/benilla-protocol/src/events.rs b/crates/benilla-protocol/src/events.rs
index 93f5be21..cc0b5480 100644
--- a/crates/benilla-protocol/src/events.rs
+++ b/crates/benilla-protocol/src/events.rs
@@ -117,9 +117,13 @@ impl LoginRefusal {
 pub enum SessionEvent {
     /// A login attempt reached `stage`; emitted by the IO thread, never wire-decoded.
     LoginStage { stage: LoginStage },
-    /// The account's realms (`CMD_REALM_LIST`); the IO thread blocks for the app's pick. Re-sent on
-    /// each refresh (the reference re-requests every 5 s) and on a realm change.
-    RealmList { realms: Vec<crate::RealmInfo> },
+    /// The account's realms (`CMD_REALM_LIST`); emitted by the IO thread after the logon and for
+    /// each query (the reference re-requests every 5 s). `failed` is a query that got no answer
+    /// (`REALM_LIST_FAILED`); `realms` is then the list last held, empty with no logon.
+    RealmList {
+        realms: Vec<crate::RealmInfo>,
+        failed: bool,
+    },
     /// Queued for a full realm (`AUTH_WAIT_QUEUE`), per queue packet: a wait, not an outcome.
     LoginQueued {
         position: Option<u32>,
diff --git a/crates/benilla-ui/src/script/glue.rs b/crates/benilla-ui/src/script/glue.rs
index 35b75a53..1e5c0cd1 100644
--- a/crates/benilla-ui/src/script/glue.rs
+++ b/crates/benilla-ui/src/script/glue.rs
@@ -115,5 +115,6 @@ pub(super) fn install(lua: &Lua) -> mlua::Result<()> {
             Ok(model.cursor_pos)
         })?,
     )?;
-    super::glue_core::install(lua)
+    super::glue_core::install(lua)?;
+    super::glue_realm::install(lua)
 }
diff --git a/crates/benilla-ui/src/script/glue_core.rs b/crates/benilla-ui/src/script/glue_core.rs
index f9160842..7b3fdaa3 100644
--- a/crates/benilla-ui/src/script/glue_core.rs
+++ b/crates/benilla-ui/src/script/glue_core.rs
@@ -106,6 +106,18 @@ pub enum GlueRequest {
     DisconnectFromServer,
     /// `QuitGame()` (`0x46cea0` → `0x46b870` → `0x401560(0)`).
     QuitGame,
+    /// `RequestRealmList([dialog])` (`0x46ecf0` → `0x46b8d0`): screen state 4, the status dialog
+    /// when `dialog`, and a realm list query (`0x5ab840`).
+    RequestRealmList { dialog: bool },
+    /// `CancelRealmListQuery()` (`0x46ed10` → `0x46b7e0`): in screen state 4 only, the query
+    /// completes cancelled and the state goes to 0; nothing is sent.
+    CancelRealmListQuery,
+    /// `RealmListDialogCancelled()` on the login screen (`0x46b810` → `CLoginMgr::Cancel`
+    /// `0x5b3320`): the realmd link closes, with no dialog and no screen change.
+    CancelLogon,
+    /// `ChangeRealm` reaching `ConnectToRealm` (`0x46b210`) with this realm, `realmName` already
+    /// set to it (`0x5ab7b0`).
+    ChangeRealm(String),
 }
 
 /// The realm `GetServerName` (`0x46d280`) answers: the `realmName` CVar's text, and the
@@ -130,7 +142,9 @@ pub(crate) struct GlueCore {
     server: GlueServer,
     /// The current glue screen's name (`[0xb41478]`), which `SetCurrentScreen` (`0x46ce60` →
     /// `0x46b860`) copies into a 0x40-byte buffer.
-    screen: String,
+    pub(super) screen: String,
+    /// The realm list the realm verbs read ([`super::glue_realm`]).
+    pub(super) realms: super::glue_realm::GlueRealmList,
 }
 
 /// `SetCurrentScreen`'s buffer, 0x40 bytes with its terminator (`0x46b860`, `SStrCopy`).
@@ -180,7 +194,7 @@ impl super::UiScript {
     }
 }
 
-fn queue(lua: &Lua, request: GlueRequest) {
+pub(super) fn queue(lua: &Lua, request: GlueRequest) {
     lua.app_data_mut::<Model>()
         .expect("model app_data")
         .glue
diff --git a/crates/benilla-ui/src/script/glue_realm.rs b/crates/benilla-ui/src/script/glue_realm.rs
new file mode 100644
index 00000000..d57b90fa
--- /dev/null
+++ b/crates/benilla-ui/src/script/glue_realm.rs
@@ -0,0 +1,1160 @@
+//! The realm list's glue verbs (`RealmList.cpp`, registrar `0x46f480`, table `0x837ea0`) and the
+//! list they read: the realm holder the `CMD_REALM_LIST` parser fills (`0x5b2230`), the client
+//! Region's categories (`0x46e300`), the sort (`0xb41f40`) and the two selection cells
+//! (`0x837e98`, `0x837e9c`). The host's glue manager seeds the holder and runs the rebuild
+//! (`0x46e510`) where `CGlueMgr::Update` does; the verbs that only read or re-sort the list answer
+//! here, firing their events as they return, and the ones that reach the network queue a
+//! [`GlueRequest`].
+//!
+//! Every category argument that crosses the Lua boundary is a 1-based ordinal over the categories
+//! holding a realm, mapped to the stored index by `0x46edf0`, which has no sentinel: an ordinal
+//! past the last one, or below 1, reads stored category 0.
+
+use mlua::{Lua, MultiValue, Value};
+
+use super::binding_abi::{bool_or_default, flag, ftol, string_arg};
+use super::glue_core::{queue, GlueRequest};
+use super::{Model, ScriptValue};
+
+/// One realm of the holder, a `CMD_REALM_LIST` record (`0x5b2230`, stride `0x134`) as the parser
+/// leaves it, the population sentinels already remapped into flag bits `0x20`/`0x40`/`0x80`.
+#[derive(Clone, Debug, PartialEq)]
+pub struct GlueRealm {
+    /// `+0x09`.
+    pub name: String,
+    /// `+0x04`, the `Cfg_Configs.dbc` key.
+    pub realm_type: u32,
+    /// `+0x08`: bit `0x01` invalid, `0x02` down, `0x20`/`0x40`/`0x80` recommended, new, full.
+    pub flags: u8,
+    /// `+0x12c`.
+    pub population: f32,
+    /// `+0x130`, the account's characters there.
+    pub characters: u8,
+    /// `+0x131`, matched by equality against a category's id; 0 takes the first category's.
+    pub category: u8,
+}
+
+/// One `Cfg_Categories.dbc` row of the client's Region, the category set `0x46e300` builds once
+/// per process.
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub struct GlueRealmCategory {
+    /// Column 0, the id a realm's category byte is matched against (`0x46e60b`).
+    pub id: u32,
+    /// The locale's `Name_Lang` slot (`[row + 8 + 4·locale]`, `0x46f238`).
+    pub name: String,
+}
+
+/// One `Cfg_Configs.dbc` row (the store `0xc0dfa0`): a realm type and its PvP and RP flags.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub struct GlueRealmType {
+    pub realm_type: u32,
+    pub pvp: bool,
+    pub rp: bool,
+}
+
+/// A sort column, `SortRealms`' string argument (`0x46f330`) and the comparator's case
+/// (`0x46e790`, jump table `0x46e998`).
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub enum RealmSortKey {
+    /// `"characters"` (`0x83807c`), case 0: more characters first.
+    Characters,
+    /// `"load"` (`0x838088`), case 1: the load band.
+    Load,
+    /// `"name"` (`0x838090`), case 2, and any string that names no column.
+    Name,
+    /// `"mode"` (`0x838074`), case 3: the `Cfg_Configs` `(rp, pvp)` pair.
+    Mode,
+}
+
+/// The cells that outlive a glue VM: the reference keeps them in C globals, so a glue rebuild
+/// (`0x46a7b0`, back from the world) finds them as they were. The host carries them from one glue
+/// VM to the next.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub struct GlueRealmCells {
+    /// The four `{key, descending}` records at `0xb41f40`, written once per process by
+    /// `0x46e300`'s tail to characters, load, name, mode, all ascending.
+    pub sort: [(RealmSortKey, bool); 4],
+    /// `[0x837e98]`, the stored category `GetSelectedCategory` reads; -1 at load.
+    pub category: i32,
+    /// `[0x837e9c]`, "a realm has been chosen this session": -1 (`None`) at load, then 0 from
+    /// `ChangeRealm` (`0x46f1d1`) or a roster with characters (`0x472556`, the host's), or a
+    /// category id from `SetPreferredInfo` (`0x46ea52`).
+    pub chosen: Option<u32>,
+    /// The type `SetPreferredInfo` last asked for (`[0xb41fa8]`, `[0xb41fac]`).
+    pub preferred: (bool, bool),
+}
+
+impl Default for GlueRealmCells {
+    fn default() -> Self {
+        GlueRealmCells {
+            sort: [
+                (RealmSortKey::Characters, false),
+                (RealmSortKey::Load, false),
+                (RealmSortKey::Name, false),
+                (RealmSortKey::Mode, false),
+            ],
+            category: -1,
+            chosen: None,
+            preferred: (false, false),
+        }
+    }
+}
+
+/// A category as the list holds it: its id, `None` for the one benilla makes when the Region has
+/// no rows, which every realm joins.
+#[derive(Clone, Debug)]
+struct Category {
+    id: Option<u32>,
+    name: Option<String>,
+}
+
+impl Category {
+    fn holds(&self, id: Option<u32>) -> bool {
+        self.id.is_none() || self.id == id
+    }
+}
+
+/// The list the realm verbs read.
+#[derive(Default)]
+pub(crate) struct GlueRealmList {
+    holder: Vec<GlueRealm>,
+    /// The Region's rows; empty until seeded.
+    rows: Vec<GlueRealmCategory>,
+    /// Each category's realms as the last rebuild left them, indices into the holder (`[cat+0x10]`,
+    /// counted by `[cat+0x18]`), each sorted by [`GlueRealmCells::sort`].
+    buckets: Vec<Vec<usize>>,
+    types: Vec<GlueRealmType>,
+    /// `[0xb41fb0]` and `[0xb41fb4]`, the load band's mean and scaled deviation.
+    mean: f32,
+    stddev: f32,
+    cells: GlueRealmCells,
+    /// `[svc+0x1ae4]`, the last `SMSG_CHAR_ENUM`'s character count.
+    characters: u16,
+}
+
+/// The std-dev scale, 0.6 (`[0x8038d8]`).
+const STDDEV_MULT: f32 = f32::from_bits(0x3f19_999a);
+
+/// `realm_load_stats` (`0x46e510`): `(mean, sqrt(Σ(pop − mean)² / (n − 1)) · 0.6)` over every
+/// realm's population. Both accumulators round to `f32` each iteration; the divide, sqrt and scale
+/// run at 53 bits. `n <= 1` gives `(1.0, 0.0)`, so a lone realm is banded against the literal 1.0.
+pub fn realm_load_stats(populations: &[f32]) -> (f32, f32) {
+    let n = populations.len();
+    if n <= 1 {
+        return (1.0, 0.0);
+    }
+    // `fld sum; fadd pop; fstp sum`: stored as f32 each step.
+    let mut sum: f32 = 0.0;
+    for &pop in populations {
+        sum = (f64::from(sum) + f64::from(pop)) as f32;
+    }
+    // `fild n; fdivr sum; fstp mean`.
+    let mean = (f64::from(sum) / n as f64) as f32;
+    let mut acc: f32 = 0.0;
+    for &pop in populations {
+        let d = f64::from(pop) - f64::from(mean);
+        acc = (d * d + f64::from(acc)) as f32;
+    }
+    // `fild n-1; fdivr acc; fsqrt; fmul 0.6; fstp stddev`.
+    let stddev = ((f64::from(acc) / (n - 1) as f64).sqrt() * f64::from(STDDEV_MULT)) as f32;
+    (mean, stddev)
+}
+
+/// `realm_load_classify` (`0x46ec60`): `GetRealmInfo`'s load. The three sentinel bits, which the
+/// parser synthesizes from magic populations, win in this order; then the band, whose 53-bit
+/// comparisons are strict, so a population on an edge reads 0.
+pub fn realm_load_classify(flags: u8, population: f32, mean: f32, stddev: f32) -> f32 {
+    if flags & 0x20 != 0 {
+        return -3.0;
+    }
+    if flags & 0x40 != 0 {
+        return -2.0;
+    }
+    if flags & 0x80 != 0 {
+        return 2.0;
+    }
+    if (f64::from(mean) - f64::from(stddev)) > f64::from(population) {
+        return -1.0;
+    }
+    if (f64::from(mean) + f64::from(stddev)) < f64::from(population) {
+        return 1.0;
+    }
+    0.0
+}
+
+/// `SStrCmpI` (`0x64a4c0` → the CRT's `_strnicmp`): bytes folded to lower case.
+fn cmp_folded(a: &str, b: &str) -> std::cmp::Ordering {
+    a.bytes()
+        .map(|c| c.to_ascii_lowercase())
+        .cmp(b.bytes().map(|c| c.to_ascii_lowercase()))
+}
+
+impl GlueRealmList {
+    /// The categories: the Region's rows, or one that holds every realm when there are none.
+    ///
+    /// Deviation: with no Region rows the reference reads a NULL category (`0x46e5b8`,
+    /// `0x46f26a`) and faults; benilla lists every realm under one category, so a client whose
+    /// `Wow.ini` names another Region still reaches a realm.
+    fn categories(&self) -> Vec<Category> {
+        if self.rows.is_empty() {
+            return vec![Category {
+                id: None,
+                name: None,
+            }];
+        }
+        self.rows
+            .iter()
+            .map(|r| Category {
+                id: Some(r.id),
+                name: Some(r.name.clone()),
+            })
+            .collect()
+    }
+
+    /// `GetRealm` (`0x5ab930`): a holder index, or NULL past its end.
+    fn realm(&self, index: usize) -> Option<&GlueRealm> {
+        self.holder.get(index)
+    }
+
+    /// A category's realm count, `[cat+0x18]`: 0 before the first rebuild.
+    fn count(&self, at: usize) -> usize {
+        self.buckets.get(at).map_or(0, Vec::len)
+    }
+
+    /// `0x46edf0`: the stored index of the `visible`-th (0-based) category holding a realm, else 0.
+    fn stored_index(&self, visible: i32) -> usize {
+        let n = self.categories().len();
+        (0..n)
+            .filter(|&i| self.count(i) != 0)
+            .nth(usize::try_from(visible).unwrap_or(usize::MAX))
+            .unwrap_or(0)
+    }
+
+    /// The first `Cfg_Configs` row of a realm type, `(pvp, rp)`; `(false, false)` with none, as
+    /// `GetRealmInfo` (`0x46efda`) and `realm_select` (`0x46ea98`) scan it.
+    fn type_of(&self, realm_type: u32) -> (bool, bool) {
+        self.types
+            .iter()
+            .find(|t| t.realm_type == realm_type)
+            .map_or((false, false), |t| (t.pvp, t.rp))
+    }
+
+    /// The comparator (`0x46e790`) over two holder indices: the sort records in order, the first
+    /// that does not tie decides, negated by its own `descending`.
+    fn compare(&self, a: usize, b: usize) -> std::cmp::Ordering {
+        use std::cmp::Ordering;
+        let (Some(ra), Some(rb)) = (self.realm(a), self.realm(b)) else {
+            return Ordering::Equal;
+        };
+        for (key, descending) in self.cells.sort {
+            let ord = match key {
+                // Case 0: two empty counts tie (`0x46e826`); otherwise more characters first.
+                // Deviation: equal nonzero counts tie here, where the reference answers +1 both
+                // ways (its name tie-break at `0x46e841` is clobbered by `0x46e846`), because a
+                // comparator that is not a total order has no defined sort.
+                RealmSortKey::Characters => rb.characters.cmp(&ra.characters),
+                // Case 1: the bands, ascending (`0x46e871`-`0x46e88b`).
+                RealmSortKey::Load => {
+                    let la = realm_load_classify(ra.flags, ra.population, self.mean, self.stddev);
+                    let lb = realm_load_classify(rb.flags, rb.population, self.mean, self.stddev);
+                    la.partial_cmp(&lb).unwrap_or(Ordering::Equal)
+                }
+                RealmSortKey::Name => cmp_folded(&ra.name, &rb.name),
+                // Case 3: the last `Cfg_Configs` row of each type (the scan at `0x46e8d3` has no
+                // break), RP first, then PvP (`0x46e92c`-`0x46e978`).
+                RealmSortKey::Mode => {
+                    let pair = |t: u32| {
+                        self.types
+                            .iter()
+                            .rev()
+                            .find(|r| r.realm_type == t)
+                            .map_or((false, false), |r| (r.rp, r.pvp))
+                    };
+                    pair(ra.realm_type).cmp(&pair(rb.realm_type))
+                }
+            };
+            if ord != Ordering::Equal {
+                return if descending { ord.reverse() } else { ord };
+            }
+        }
+        Ordering::Equal
+    }
+
+    /// `0x46e750`: every category's realms re-sorted.
+    fn sort(&mut self) {
+        let mut buckets = std::mem::take(&mut self.buckets);
+        for b in &mut buckets {
+            b.sort_by(|&x, &y| self.compare(x, y));
+        }
+        self.buckets = buckets;
+    }
+
+    /// The realm list rebuild (`0x46e510`): every category emptied and refilled from the holder by
+    /// category byte, the load statistics over every realm, the sort, and the stored category moved
+    /// to the one holding the realm `realm_name` names. Returns the event its tail fires
+    /// (`0x46e718`-`0x46e73d`): `GET_PREFERRED_REALM_INFO` for an account with no characters that
+    /// has chosen no realm this session, else `OPEN_REALM_LIST`.
+    fn rebuild(&mut self, realm_name: &str) -> &'static str {
+        let cats = self.categories();
+        let mut buckets = vec![Vec::new(); cats.len()];
+        // `[ebp-0x14]`, -1 until a realm of that name is met; the last one met decides.
+        let mut named: Option<Option<u32>> = None;
+        for (i, realm) in self.holder.iter().enumerate() {
+            // A 0 byte takes the first category's id (`0x46e5b8`).
+            let id = match realm.category {
+                0 => cats[0].id,
+                b => Some(u32::from(b)),
+            };
+            if cmp_folded(&realm.name, realm_name).is_eq() {
+                named = Some(id);
+            }
+            // No break: a realm joins every category of its id (`0x46e600`-`0x46e65c`).
+            for (bucket, cat) in buckets.iter_mut().zip(&cats) {
+                if cat.holds(id) {
+                    bucket.push(i);
+                }
+            }
+        }
+        let pops: Vec<f32> = self.holder.iter().map(|r| r.population).collect();
+        (self.mean, self.stddev) = realm_load_stats(&pops);
+        self.buckets = buckets;
+        self.sort();
+        if let Some(id) = named {
+            if let Some(at) = cats.iter().position(|c| c.holds(id)) {
+                self.cells.category = at as i32;
+            }
+        }
+        if self.characters == 0 && self.cells.chosen.is_none() {
+            "GET_PREFERRED_REALM_INFO"
+        } else {
+            "OPEN_REALM_LIST"
+        }
+    }
+
+    /// `0x46e9b0`: a sort click. The front record's key toggles its direction; any other moves to
+    /// the front keeping its own, the records it passes shifting down; a key on no record only
+    /// re-sorts.
+    fn set_primary(&mut self, key: RealmSortKey) {
+        let sort = &mut self.cells.sort;
+        if let Some(at) = sort.iter().position(|(k, _)| *k == key) {
+            let descending = if at == 0 { !sort[0].1 } else { sort[at].1 };
+            sort.copy_within(0..at, 1);
+            sort[0] = (key, descending);
+        }
+        self.sort();
+    }
+
+    /// The realm a `(category, index)` pair names (`0x46eee0`-`0x46ef35`): the 1-based ordinal
+    /// through `0x46edf0`, then the 1-based index into that category, compared unsigned.
+    fn by_pair(&self, category: i32, index: i32) -> (usize, Option<&GlueRealm>) {
+        let at = self.stored_index(category.wrapping_sub(1));
+        let index = index.wrapping_sub(1) as u32 as usize;
+        let realm = self
+            .buckets
+            .get(at)
+            .and_then(|b| b.get(index))
+            .and_then(|&h| self.realm(h));
+        (at, realm)
+    }
+
+    /// The realm a flat 1-based index names over every category in turn (`0x46ee8c`-`0x46eede`).
+    /// The walk has no break, so a later category whose count still exceeds the residual answers
+    /// again, and the last answer stands.
+    fn by_flat(&self, index: i32) -> Option<&GlueRealm> {
+        let mut residual = index.wrapping_sub(1) as u32;
+        let mut found = None;
+        for bucket in &self.buckets {
+            let count = bucket.len() as u32;
+            if count > residual {
+                // Stored unconditionally, a NULL from `GetRealm` included (`0x46eed3`, `0x46f167`).
+                found = bucket.get(residual as usize).and_then(|&h| self.realm(h));
+            } else {
+                residual = residual.wrapping_sub(count);
+            }
+        }
+        found
+    }
+
+    /// `realm_select` (`0x46ea20`), `SetPreferredInfo`'s body: the first valid realm of the asked
+    /// category with the asked type, else the category's first valid realm, else the first valid
+    /// realm of the type in any category; `None` when there is none. "Valid" skips flag `0x01`
+    /// only (`0x46ea7c`), so a realm that is down can be suggested. Returns the pair
+    /// `SUGGEST_REALM` carries: the stored category index plus 1, and the index plus 1.
+    fn select(&mut self, stored: usize, pvp: bool, rp: bool) -> Option<(usize, usize)> {
+        let cats = self.categories();
+        // `cmp edi,eax ; jbe`: an index past the count reads 0; the count itself is never reached
+        // through `0x46edf0`.
+        let stored = if stored < cats.len() { stored } else { 0 };
+        self.cells.category = stored as i32;
+        self.cells.chosen = Some(cats[stored].id.unwrap_or(0));
+        self.cells.preferred = (pvp, rp);
+        let valid = |list: &Self, h: usize| list.realm(h).is_some_and(|r| r.flags & 0x01 == 0);
+        let fits = |list: &Self, h: usize| {
+            list.realm(h)
+                .is_some_and(|r| r.flags & 0x01 == 0 && list.type_of(r.realm_type) == (pvp, rp))
+        };
+        let own = self.buckets.get(stored).cloned().unwrap_or_default();
+        if let Some(i) = own.iter().position(|&h| fits(self, h)) {
+            return Some((stored + 1, i + 1));
+        }
+        if let Some(i) = own.iter().position(|&h| valid(self, h)) {
+            return Some((stored + 1, i + 1));
+        }
+        for (c, bucket) in self.buckets.iter().enumerate() {
+            if let Some(j) = bucket.iter().position(|&h| fits(self, h)) {
+                return Some((c + 1, j + 1));
+            }
+        }
+        None
+    }
+}
+
+impl super::UiScript {
+    /// Seed the client Region's categories and the realm types, read once per process
+    /// (`0x46e300`, `0x5413f0`).
+    pub fn set_glue_realm_setup(
+        &mut self,
+        categories: Vec<GlueRealmCategory>,
+        types: Vec<GlueRealmType>,
+    ) {
+        let mut model = self.model_mut();
+        model.glue.realms.rows = categories;
+        model.glue.realms.types = types;
+    }
+
+    /// Fill the holder from a realm list reply, as the parser does (`0x5b2230`): the categories
+    /// keep what the last rebuild put in them.
+    pub fn set_glue_realms(&mut self, holder: Vec<GlueRealm>) {
+        self.model_mut().glue.realms.holder = holder;
+    }
+
+    /// The character count of the last `SMSG_CHAR_ENUM` (`[svc+0x1ae4]`).
+    pub fn set_glue_realm_characters(&mut self, characters: u16) {
+        self.model_mut().glue.realms.characters = characters;
+    }
+
+    /// The cells the next glue VM must start from.
+    pub fn glue_realm_cells(&self) -> GlueRealmCells {
+        self.model_ref().glue.realms.cells
+    }
+
+    /// Carry the cells over from the last glue VM.
+    pub fn set_glue_realm_cells(&mut self, cells: GlueRealmCells) {
+        self.model_mut().glue.realms.cells = cells;
+    }
+
+    /// The realm list rebuild (`0x46e510`) and the event its tail fires.
+    pub fn rebuild_glue_realms(&mut self) {
+        let event = {
+            let mut model = self.model_mut();
+            let name = realm_name(&model);
+            model.glue.realms.rebuild(&name)
+        };
+        self.fire_event(event, Vec::new());
+    }
+}
+
+/// The `realmName` CVar's value (`0x5ab7d0`), empty when unregistered.
+fn realm_name(model: &Model) -> String {
+    model
+        .cvars
+        .get("realmname")
+        .map(|s| s.value.clone())
+        .unwrap_or_default()
+}
+
+fn model(lua: &Lua) -> mlua::AppDataRefMut<'_, Model> {
+    lua.app_data_mut::<Model>().expect("model app_data")
+}
+
+/// `is-number` (`0x6f34d0`) on an argument, then `tonumber` and `0x40a2b0`.
+fn number_at(lua: &Lua, args: &MultiValue, i: usize) -> Option<i32> {
+    let v = args.get(i)?.clone();
+    lua.coerce_number(v).ok().flatten().map(ftol)
+}
+
+/// `GetRealmInfo`'s eight returns for a realm, or its not-found leg (`0x46f090`).
+fn realm_info(
+    lua: &Lua,
+    list: &GlueRealmList,
+    realm: Option<&GlueRealm>,
+    current: &str,
+) -> mlua::Result<MultiValue> {
+    let Some(r) = realm else {
+        return Ok(MultiValue::from_vec(vec![
+            Value::Nil,
+            Value::Number(0.0),
+            Value::Nil,
+            Value::Nil,
+            Value::Nil,
+            Value::Nil,
+            Value::Nil,
+            Value::Number(0.0),
+        ]));
+    };
+    let (pvp, rp) = list.type_of(r.realm_type);
+    Ok(MultiValue::from_vec(vec![
+        Value::String(lua.create_string(&r.name)?),
+        Value::Number(f64::from(r.characters)),
+        flag(r.flags & 0x01 != 0),
+        flag(r.flags & 0x02 != 0),
+        flag(cmp_folded(&r.name, current).is_eq()),
+        flag(pvp),
+        flag(rp),
+        Value::Number(f64::from(realm_load_classify(
+            r.flags,
+            r.population,
+            list.mean,
+            list.stddev,
+        ))),
+    ]))
+}
+
+pub(super) fn install(lua: &Lua) -> mlua::Result<()> {
+    let g = lua.globals();
+
+    // An optional flag (`0x6f1c10`, default 0) into `0x46b8d0`, which raises the status dialog
+    // only for a nonzero one; the stock five-second refresh passes none.
+    g.set(
+        "RequestRealmList",
+        lua.create_function(|lua, args: MultiValue| {
+            let dialog = bool_or_default(args.front(), false);
+            queue(lua, GlueRequest::RequestRealmList { dialog });
+            Ok(())
+        })?,
+    )?;
+    g.set(
+        "CancelRealmListQuery",
+        lua.create_function(|lua, _: MultiValue| {
+            queue(lua, GlueRequest::CancelRealmListQuery);
+            Ok(())
+        })?,
+    )?;
+    // `0x46b810`: the current glue screen (`[0xb41478]`, `SetCurrentScreen`'s buffer) against
+    // "login" (`0x82e3e0`, `SStrCmpI`); anywhere else a no-op, on login `CLoginMgr::Cancel`
+    // (`0x5b3320`).
+    g.set(
+        "RealmListDialogCancelled",
+        lua.create_function(|lua, _: MultiValue| {
+            let on_login = cmp_folded(&model(lua).glue.screen, "login").is_eq();
+            if on_login {
+                queue(lua, GlueRequest::CancelLogon);
+            }
+            Ok(())
+        })?,
+    )?;
+
+    // One numeric argument counts one category, 0 off the end (`0x46ed94`); none, or a
+    // non-number, sums every category (`0x46ed47`).
+    g.set(
+        "GetNumRealms",
+        lua.create_function(|lua, args: MultiValue| {
+            let at = number_at(lua, &args, 0);
+            let m = model(lua);
+            let list = &m.glue.realms;
+            let n = match at {
+                Some(ordinal) => list.count(list.stored_index(ordinal.wrapping_sub(1))),
+                None => list.buckets.iter().map(Vec::len).sum(),
+            };
+            Ok(n as f64)
+        })?,
+    )?;
+
+    // Eight values on every returning path (`0x46ee40`).
+    g.set(
+        "GetRealmInfo",
+        lua.create_function(|lua, args: MultiValue| {
+            const USAGE: &str = "Usage: GetRealmInfo(category, index)";
+            let Some(first) = number_at(lua, &args, 0) else {
+                return Err(mlua::Error::RuntimeError(USAGE.into()));
+            };
+            let second = number_at(lua, &args, 1);
+            let m = model(lua);
+            let list = &m.glue.realms;
+            let current = realm_name(&m);
+            let realm = match second {
+                Some(index) => list.by_pair(first, index).1,
+                None => list.by_flat(first),
+            };
+            realm_info(lua, list, realm, &current)
+        })?,
+    )?;
+
+    // `0x46f0e0`: the pair leg stores the category (`0x46f188`) before its range check; a realm
+    // found marks the session's choice (`0x46f1d1`) and reaches `ConnectToRealm` (`0x46b210`),
+    // whose first act sets `realmName` (`0x5ab7b0`).
+    g.set(
+        "ChangeRealm",
+        lua.create_function(|lua, args: MultiValue| {
+            const USAGE: &str = "Usage: ChangeRealm(category, index)";
+            let Some(first) = number_at(lua, &args, 0) else {
+                return Err(mlua::Error::RuntimeError(USAGE.into()));
+            };
+            let second = number_at(lua, &args, 1);
+            let name = {
+                let mut m = model(lua);
+                let list = &mut m.glue.realms;
+                let name = match second {
+                    Some(index) => {
+                        let (at, realm) = list.by_pair(first, index);
+                        let name = realm.map(|r| r.name.clone());
+                        list.cells.category = at as i32;
+                        name
+                    }
+                    None => list.by_flat(first).map(|r| r.name.clone()),
+                };
+                if name.is_some() && list.cells.chosen.is_none() {
+                    list.cells.chosen = Some(0);
+                }
+                if let Some(name) = &name {
+                    super::cvars::set_from_engine(&mut m, "realmName", name.clone());
+                }
+                name
+            };
+            if let Some(name) = name {
+                queue(lua, GlueRequest::ChangeRealm(name));
+            }
+            Ok(())
+        })?,
+    )?;
+
+    // The names of the categories holding a realm (`0x46f1f0`); with none, the first category's
+    // name alone (`0x46f255`). A category with no row reads "UNKNOWN" (`0x838044`).
+    g.set(
+        "GetRealmCategories",
+        lua.create_function(|lua, _: MultiValue| {
+            let m = model(lua);
+            let list = &m.glue.realms;
+            let cats = list.categories();
+            let name = |c: &Category| c.name.clone().unwrap_or_else(|| "UNKNOWN".into());
+            let mut names: Vec<String> = cats
+                .iter()
+                .enumerate()
+                .filter(|(i, _)| list.count(*i) != 0)
+                .map(|(_, c)| name(c))
+                .collect();
+            if names.is_empty() {
+                names.push(name(&cats[0]));
+            }
+            let values = names
+                .into_iter()
+                .map(|n| lua.create_string(n).map(Value::String))
+                .collect::<mlua::Result<Vec<_>>>()?;
+            Ok(MultiValue::from_vec(values))
+        })?,
+    )?;
+
+    // `0x46f2c0`: the category through `0x46edf0`, the two flags through `0x6f1c10` with default
+    // 0, then `realm_select` (`0x46ea20`), which fires `SUGGEST_REALM` with `"%d%d"` or, with no
+    // realm to suggest, `OPEN_REALM_LIST` (`0x46ec21`).
+    g.set(
+        "SetPreferredInfo",
+        lua.create_function(|lua, args: MultiValue| {
+            const USAGE: &str = "Usage: SetPreferredInfo(index, pvp, rp)";
+            let Some(first) = number_at(lua, &args, 0) else {
+                return Err(mlua::Error::RuntimeError(USAGE.into()));
+            };
+            let pvp = bool_or_default(args.get(1), false);
+            let rp = bool_or_default(args.get(2), false);
+            let suggested = {
+                let mut m = model(lua);
+                let list = &mut m.glue.realms;
+                let at = list.stored_index(first.wrapping_sub(1));
+                list.select(at, pvp, rp)
+            };
+            match suggested {
+                Some((category, index)) => super::tick::fire_event_into(
+                    lua,
+                    "SUGGEST_REALM",
+                    vec![
+                        ScriptValue::Number(category as f64),
+                        ScriptValue::Number(index as f64),
+                    ],
+                ),
+                None => super::tick::fire_event_into(lua, "OPEN_REALM_LIST", Vec::new()),
+            }
+            Ok(())
+        })?,
+    )?;
+
+    // `0x46f330`: a string (or number) argument, matched case-insensitively; anything else sorts by
+    // name. The usage string is the binary's own spelling (`0x838098`).
+    g.set(
+        "SortRealms",
+        lua.create_function(|lua, args: MultiValue| {
+            const USAGE: &str = "Usgae: SortRealms(\"type\")";
+            let arg = args.front().cloned().unwrap_or(Value::Nil);
+            if !matches!(arg, Value::String(_) | Value::Integer(_) | Value::Number(_)) {
+                return Err(mlua::Error::RuntimeError(USAGE.into()));
+            }
+            let s = string_arg(lua, arg, USAGE)?;
+            let key = [
+                ("name", RealmSortKey::Name),
+                ("load", RealmSortKey::Load),
+                ("characters", RealmSortKey::Characters),
+                ("mode", RealmSortKey::Mode),
+            ]
+            .into_iter()
+            .find(|(k, _)| cmp_folded(&s, k).is_eq())
+            .map_or(RealmSortKey::Name, |(_, key)| key);
+            model(lua).glue.realms.set_primary(key);
+            // Both exits of `0x46e9b0` tail-jump the event (`0x46e9cb`, `0x46ea1a`).
+            super::tick::fire_event_into(lua, "OPEN_REALM_LIST", Vec::new());
+            Ok(())
+        })?,
+    )?;
+
+    // `0x46f400`: the ordinal of the first category holding a realm at or past the stored index
+    // (a signed compare, so -1 reads the first), else 1.
+    g.set(
+        "GetSelectedCategory",
+        lua.create_function(|lua, _: MultiValue| {
+            let m = model(lua);
+            let list = &m.glue.realms;
+            let from = list.cells.category;
+            let n = list.categories().len();
+            let ordinal = (0..n)
+                .filter(|&i| list.count(i) != 0)
+                .enumerate()
+                .find(|(_, i)| *i as i64 >= i64::from(from))
+                .map_or(1, |(o, _)| o + 1);
+            Ok(ordinal as f64)
+        })?,
+    )?;
+    Ok(())
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::script::UiScript;
+
+    fn realm(
+        name: &str,
+        category: u8,
+        realm_type: u32,
+        flags: u8,
+        chars: u8,
+        pop: f32,
+    ) -> GlueRealm {
+        GlueRealm {
+            name: name.into(),
+            realm_type,
+            flags,
+            population: pop,
+            characters: chars,
+            category,
+        }
+    }
+
+    /// Region 1's rows and the shipped `Cfg_Configs.dbc` types 0, 1, 6, 8.
+    fn vm(holder: Vec<GlueRealm>) -> UiScript {
+        let mut s = UiScript::new_glue().unwrap();
+        s.set_glue_realm_setup(
+            vec![
+                GlueRealmCategory {
+                    id: 1,
+                    name: "United States".into(),
+                },
+                GlueRealmCategory {
+                    id: 5,
+                    name: "Oceanic".into(),
+                },
+            ],
+            vec![
+                GlueRealmType {
+                    realm_type: 0,
+                    pvp: false,
+                    rp: false,
+                },
+                GlueRealmType {
+                    realm_type: 1,
+                    pvp: true,
+                    rp: false,
+                },
+                GlueRealmType {
+                    realm_type: 6,
+                    pvp: false,
+                    rp: true,
+                },
+                GlueRealmType {
+                    realm_type: 8,
+                    pvp: true,
+                    rp: true,
+                },
+            ],
+        );
+        s.register_cvars([("realmName", "")]);
+        s.set_glue_realms(holder);
+        s
+    }
+
+    /// Record every firing of `events` as `"EVENT a b"` in `FIRED`.
+    fn listen(s: &UiScript, events: &[&str]) {
+        let mut chunk = String::from(
+            "FIRED = {} local f = CreateFrame('Frame', 'Listener') \
+             f:SetScript('OnEvent', function() \
+               table.insert(FIRED, event .. ' ' .. tostring(arg1) .. ' ' .. tostring(arg2)) end) ",
+        );
+        for e in events {
+            chunk.push_str(&format!("f:RegisterEvent('{e}') "));
+        }
+        s.run(&chunk).unwrap();
+    }
+
+    fn fired(s: &UiScript) -> Vec<String> {
+        let v = s.eval::<Vec<String>>("return FIRED").unwrap();
+        s.run("FIRED = {}").unwrap();
+        v
+    }
+
+    /// `GetRealmInfo`'s eight returns.
+    type Info = (
+        Option<String>,
+        f64,
+        Option<i64>,
+        Option<i64>,
+        Option<i64>,
+        Option<i64>,
+        Option<i64>,
+        f64,
+    );
+
+    fn info(s: &UiScript, call: &str) -> Info {
+        s.eval(&format!("return {call}")).unwrap()
+    }
+
+    /// The rebuild fires `GET_PREFERRED_REALM_INFO` for a fresh account with no choice made, and
+    /// `OPEN_REALM_LIST` once it has characters or has chosen (`0x46e718`-`0x46e73d`).
+    #[test]
+    fn the_rebuild_asks_for_a_preference_only_with_no_characters_and_no_choice() {
+        let mut s = vm(vec![realm("Alpha", 1, 0, 0, 0, 1.0)]);
+        listen(&s, &["OPEN_REALM_LIST", "GET_PREFERRED_REALM_INFO"]);
+        s.rebuild_glue_realms();
+        assert_eq!(fired(&s), ["GET_PREFERRED_REALM_INFO nil nil"]);
+        s.set_glue_realm_characters(2);
+        s.rebuild_glue_realms();
+        assert_eq!(fired(&s), ["OPEN_REALM_LIST nil nil"]);
+        s.set_glue_realm_characters(0);
+        s.run("ChangeRealm(1, 1)").unwrap();
+        let _ = s.take_glue_requests();
+        s.rebuild_glue_realms();
+        assert_eq!(fired(&s), ["OPEN_REALM_LIST nil nil"], "a choice was made");
+    }
+
+    /// The categories come from the rebuild: none before it, and a byte no Region row carries is
+    /// on no tab.
+    #[test]
+    fn the_categories_are_the_ones_holding_a_realm_after_the_rebuild() {
+        let mut s = vm(vec![
+            realm("Alpha", 1, 0, 0, 0, 1.0),
+            realm("Down Under", 5, 0, 0, 0, 1.0),
+            realm("Nowhere", 9, 0, 0, 0, 1.0),
+        ]);
+        assert_eq!(
+            s.eval::<Vec<String>>("return {GetRealmCategories()}")
+                .unwrap(),
+            ["United States"],
+            "before the rebuild no category holds a realm: the first one's name alone"
+        );
+        assert_eq!(s.eval::<f64>("return GetNumRealms()").unwrap(), 0.0);
+        s.rebuild_glue_realms();
+        assert_eq!(
+            s.eval::<Vec<String>>("return {GetRealmCategories()}")
+                .unwrap(),
+            ["United States", "Oceanic"]
+        );
+        assert_eq!(s.eval::<f64>("return GetNumRealms()").unwrap(), 2.0);
+        assert_eq!(s.eval::<f64>("return GetNumRealms(2)").unwrap(), 1.0);
+        assert_eq!(
+            s.eval::<f64>("return GetNumRealms(9)").unwrap(),
+            1.0,
+            "an ordinal past the last reads stored category 0"
+        );
+        assert_eq!(
+            info(&s, "GetRealmInfo(2, 1)").0.as_deref(),
+            Some("Down Under")
+        );
+    }
+
+    /// Eight values on every path; the not-found leg is `nil, 0, nil ×5, 0`.
+    #[test]
+    fn get_realm_info_returns_eight_values_in_the_references_order() {
+        let mut s = vm(vec![
+            realm("Alpha", 1, 1, 0x01, 3, 1.0),
+            realm("Beta", 1, 8, 0x02 | 0x20, 0, 1.0),
+        ]);
+        s.set_cvar_host("realmName", "ALPHA");
+        s.rebuild_glue_realms();
+        assert_eq!(
+            s.eval::<usize>("return (function(...) return arg.n end)(GetRealmInfo(1, 1))")
+                .unwrap(),
+            8
+        );
+        assert_eq!(
+            info(&s, "GetRealmInfo(1, 1)"),
+            (
+                Some("Alpha".into()),
+                3.0,
+                Some(1),
+                None,
+                Some(1),
+                Some(1),
+                None,
+                0.0
+            )
+        );
+        assert_eq!(
+            info(&s, "GetRealmInfo(1, 2)"),
+            (
+                Some("Beta".into()),
+                0.0,
+                None,
+                Some(1),
+                None,
+                Some(1),
+                Some(1),
+                -3.0
+            )
+        );
+        assert_eq!(
+            info(&s, "GetRealmInfo(1, 3)"),
+            (None, 0.0, None, None, None, None, None, 0.0)
+        );
+        assert_eq!(
+            s.eval::<usize>("return (function(...) return arg.n end)(GetRealmInfo(1, 3))")
+                .unwrap(),
+            8
+        );
+        let err = s.run("GetRealmInfo()").unwrap_err().to_string();
+        assert!(
+            err.contains("Usage: GetRealmInfo(category, index)"),
+            "{err}"
+        );
+        assert_eq!(
+            info(&s, "GetRealmInfo(2)").0.as_deref(),
+            Some("Beta"),
+            "the flat leg"
+        );
+    }
+
+    /// The default order is characters, load, name, mode; a click moves its column to the front
+    /// and fires `OPEN_REALM_LIST`; mode sorts RP ahead of PvP (`0x46e92c`).
+    #[test]
+    fn sort_realms_rotates_the_keys_and_fires_the_list() {
+        let mut s = vm(vec![
+            realm("Zeta", 1, 6, 0, 0, 1.0),
+            realm("Alpha", 1, 1, 0, 0, 1.0),
+            realm("Mu", 1, 0, 0, 3, 1.0),
+            realm("Kappa", 1, 8, 0, 0, 1.0),
+        ]);
+        s.rebuild_glue_realms();
+        let names = |s: &UiScript| {
+            s.eval::<Vec<String>>(
+                "local t = {} for i = 1, GetNumRealms(1) do t[i] = GetRealmInfo(1, i) end return t",
+            )
+            .unwrap()
+        };
+        assert_eq!(names(&s), ["Mu", "Alpha", "Kappa", "Zeta"]);
+        listen(&s, &["OPEN_REALM_LIST"]);
+        s.run("SortRealms('NAME')").unwrap();
+        assert_eq!(fired(&s), ["OPEN_REALM_LIST nil nil"]);
+        assert_eq!(names(&s), ["Alpha", "Kappa", "Mu", "Zeta"]);
+        s.run("SortRealms('name')").unwrap();
+        assert_eq!(
+            names(&s),
+            ["Zeta", "Mu", "Kappa", "Alpha"],
+            "a re-click flips it"
+        );
+        s.run("SortRealms('mode')").unwrap();
+        assert_eq!(
+            names(&s),
+            ["Mu", "Alpha", "Zeta", "Kappa"],
+            "Normal, PvP, RP, RP-PvP: RP decides before PvP"
+        );
+        assert_eq!(
+            s.glue_realm_cells().sort,
+            [
+                (RealmSortKey::Mode, false),
+                (RealmSortKey::Name, true),
+                (RealmSortKey::Characters, false),
+                (RealmSortKey::Load, false),
+            ]
+        );
+        s.run("SortRealms('nonsense')").unwrap();
+        assert_eq!(s.glue_realm_cells().sort[0], (RealmSortKey::Name, true));
+        let err = s.run("SortRealms()").unwrap_err().to_string();
+        assert!(err.contains("Usgae: SortRealms(\"type\")"), "{err}");
+    }
+
+    /// `SetPreferredInfo` suggests the first valid realm of the asked type in the asked category,
+    /// else the category's first valid realm, else the type in any category, else opens the list;
+    /// it marks the choice, so the next rebuild opens the list.
+    #[test]
+    fn set_preferred_info_suggests_a_realm_or_opens_the_list() {
+        let mut s = vm(vec![
+            realm("Invalid", 1, 1, 0x01, 0, 1.0),
+            realm("Normal", 1, 0, 0, 0, 1.0),
+            realm("Pvp", 1, 1, 0, 0, 1.0),
+            realm("Rp", 1, 6, 0x02, 0, 1.0),
+            realm("Oz", 5, 6, 0x01, 0, 1.0),
+        ]);
+        s.rebuild_glue_realms();
+        listen(
+            &s,
+            &[
+                "SUGGEST_REALM",
+                "OPEN_REALM_LIST",
+                "GET_PREFERRED_REALM_INFO",
+            ],
+        );
+        s.run("SetPreferredInfo(1, 1, nil)").unwrap();
+        assert_eq!(fired(&s), ["SUGGEST_REALM 1 3"], "the type in the category");
+        assert_eq!(info(&s, "GetRealmInfo(1, 3)").0.as_deref(), Some("Pvp"));
+        s.run("SetPreferredInfo(1, 1, 1)").unwrap();
+        assert_eq!(
+            fired(&s),
+            ["SUGGEST_REALM 1 2"],
+            "no RP-PvP realm: the category's first valid one"
+        );
+        s.run("SetPreferredInfo(2, nil, 1)").unwrap();
+        assert_eq!(
+            fired(&s),
+            ["SUGGEST_REALM 1 4"],
+            "Oceanic holds nothing valid: the type in any category, a realm that is down included"
+        );
+        let cells = s.glue_realm_cells();
+        assert_eq!(
+            (cells.category, cells.chosen, cells.preferred),
+            (1, Some(5), (false, true))
+        );
+        s.set_glue_realms(vec![realm("Invalid", 1, 1, 0x01, 0, 1.0)]);
+        s.rebuild_glue_realms();
+        assert_eq!(fired(&s), ["OPEN_REALM_LIST nil nil"], "a choice was made");
+        s.run("SetPreferredInfo(1, 1, nil)").unwrap();
+        assert_eq!(
+            fired(&s),
+            ["OPEN_REALM_LIST nil nil"],
+            "nothing valid to suggest"
+        );
+        let err = s.run("SetPreferredInfo()").unwrap_err().to_string();
+        assert!(
+            err.contains("Usage: SetPreferredInfo(index, pvp, rp)"),
+            "{err}"
+        );
+    }
+
+    /// `ChangeRealm` stores the category before its range check, sets `realmName`, and asks the
+    /// host to connect by name.
+    #[test]
+    fn change_realm_names_the_realm_and_stores_the_category() {
+        let mut s = vm(vec![
+            realm("Alpha", 1, 0, 0, 0, 1.0),
+            realm("Oz", 5, 0, 0, 0, 1.0),
+        ]);
+        s.rebuild_glue_realms();
+        s.run("ChangeRealm(2, 7)").unwrap();
+        assert!(s.take_glue_requests().is_empty(), "no realm, no connect");
+        assert_eq!(
+            s.glue_realm_cells().category,
+            1,
+            "stored before the range check"
+        );
+        assert_eq!(s.glue_realm_cells().chosen, None);
+        assert_eq!(s.eval::<f64>("return GetSelectedCategory()").unwrap(), 2.0);
+        s.run("ChangeRealm(2, 1)").unwrap();
+        assert!(matches!(
+            s.take_glue_requests().as_slice(),
+            [GlueRequest::ChangeRealm(n)] if n == "Oz"
+        ));
+        assert_eq!(s.cvar("realmName").as_deref(), Some("Oz"));
+        assert_eq!(s.glue_realm_cells().chosen, Some(0));
+        assert_eq!(
+            info(&s, "GetRealmInfo(2, 1)").4,
+            Some(1),
+            "now the current realm"
+        );
+        let err = s.run("ChangeRealm()").unwrap_err().to_string();
+        assert!(err.contains("Usage: ChangeRealm(category, index)"), "{err}");
+    }
+
+    /// `GetSelectedCategory` is the stored category's ordinal, 1 at load; the rebuild moves it to
+    /// the category of the realm `realmName` names.
+    #[test]
+    fn the_selected_category_follows_the_named_realm() {
+        let mut s = vm(vec![
+            realm("Alpha", 1, 0, 0, 0, 1.0),
+            realm("Oz", 5, 0, 0, 0, 1.0),
+        ]);
+        assert_eq!(s.eval::<f64>("return GetSelectedCategory()").unwrap(), 1.0);
+        s.set_cvar_host("realmName", "oz");
+        s.rebuild_glue_realms();
+        assert_eq!(s.eval::<f64>("return GetSelectedCategory()").unwrap(), 2.0);
+    }
+
+    /// The network verbs queue for the host; `RealmListDialogCancelled` only on the login screen.
+    #[test]
+    fn the_request_verbs_queue_and_the_cancel_is_screen_conditional() {
+        let mut s = vm(Vec::new());
+        s.run("RequestRealmList() RequestRealmList(1) CancelRealmListQuery()")
+            .unwrap();
+        assert!(matches!(
+            s.take_glue_requests().as_slice(),
+            [
+                GlueRequest::RequestRealmList { dialog: false },
+                GlueRequest::RequestRealmList { dialog: true },
+                GlueRequest::CancelRealmListQuery
+            ]
+        ));
+        s.run("SetCurrentScreen('charselect') RealmListDialogCancelled()")
+            .unwrap();
+        assert!(
+            s.take_glue_requests().is_empty(),
+            "a no-op off the login screen"
+        );
+        s.run("SetCurrentScreen('LOGIN') RealmListDialogCancelled()")
+            .unwrap();
+        assert!(matches!(
+            s.take_glue_requests().as_slice(),
+            [GlueRequest::CancelLogon]
+        ));
+    }
+
+    /// The flat leg keeps walking after a hit and stores each later hit unconditionally, a NULL
+    /// from `GetRealm` included (`0x46eed3`): a holder that lost the realm since the rebuild
+    /// answers nil, not the earlier hit.
+    #[test]
+    fn the_flat_leg_keeps_the_last_hit_even_when_it_is_gone() {
+        let mut s = vm(vec![
+            realm("Alpha", 1, 0, 0, 0, 1.0),
+            realm("Oz", 5, 0, 0, 0, 1.0),
+            realm("Perth", 5, 0, 0, 0, 1.0),
+        ]);
+        s.rebuild_glue_realms();
+        assert_eq!(
+            info(&s, "GetRealmInfo(1)").0.as_deref(),
+            Some("Oz"),
+            "both categories hold index 0, and the later one answers"
+        );
+        // A reply fills the holder; the categories keep the last rebuild's indices.
+        s.set_glue_realms(vec![realm("Alpha", 1, 0, 0, 0, 1.0)]);
+        assert_eq!(info(&s, "GetRealmInfo(1)").0, None);
+    }
+
+    /// With no Region rows every realm lists under one category named "UNKNOWN".
+    #[test]
+    fn no_region_rows_list_every_realm_under_one_category() {
+        let mut s = UiScript::new_glue().unwrap();
+        s.set_glue_realms(vec![
+            realm("Alpha", 3, 0, 0, 0, 1.0),
+            realm("Beta", 0, 0, 0, 0, 1.0),
+        ]);
+        s.rebuild_glue_realms();
+        assert_eq!(
+            s.eval::<Vec<String>>("return {GetRealmCategories()}")
+                .unwrap(),
+            ["UNKNOWN"]
+        );
+        assert_eq!(s.eval::<f64>("return GetNumRealms(1)").unwrap(), 2.0);
+    }
+}
diff --git a/crates/benilla-ui/src/script/mod.rs b/crates/benilla-ui/src/script/mod.rs
index db0cb085..46547755 100644
--- a/crates/benilla-ui/src/script/mod.rs
+++ b/crates/benilla-ui/src/script/mod.rs
@@ -66,8 +66,13 @@ mod font_block;
 mod frame_enum;
 mod glue;
 mod glue_core;
+mod glue_realm;
 pub use glue::{VmKind, GLUE_EVENTS};
 pub use glue_core::{GlueCredentials, GlueNotice, GlueRequest, GlueServer, NoticeState};
+pub use glue_realm::{
+    realm_load_classify, realm_load_stats, GlueRealm, GlueRealmCategory, GlueRealmCells,
+    GlueRealmType, RealmSortKey,
+};
 mod gm_ticket;
 mod gossip;
 mod guild;
@@ -649,8 +654,8 @@ impl UiScript {
     /// The glue screens' VM, as the glue builder (`0x46a7b0`) leaves its state before GlueXML
     /// loads: the base set and the shared registrars, with the glue event table and the glue frame
     /// types ([`glue`]), and none of the in-game surface. Of the glue registrar's own four tables
-    /// (`0x46ddf0`, `0x4736c0`, `0x471a20`, `0x46f480`) only the screen verbs are built
-    /// ([`glue::install`]).
+    /// (`0x46ddf0`, `0x4736c0`, `0x471a20`, `0x46f480`) the screen verbs and the realm list are
+    /// built ([`glue::install`]).
     pub fn new_glue() -> mlua::Result<UiScript> {
         let lua = install_framescript(VmKind::Glue)?;
         glue::install(&lua)?;
diff --git a/crates/benilla-ui/src/script/tests/glue_surface.rs b/crates/benilla-ui/src/script/tests/glue_surface.rs
index d1eaf463..a8917c73 100644
--- a/crates/benilla-ui/src/script/tests/glue_surface.rs
+++ b/crates/benilla-ui/src/script/tests/glue_surface.rs
@@ -222,21 +222,6 @@ const NOT_YET: &[(&str, &[&str])] = &[
             "UpdateCustomizationScene",
         ],
     ),
-    (
-        "the realm list (0x46f480, table 0x837ea0)",
-        &[
-            "CancelRealmListQuery",
-            "ChangeRealm",
-            "GetNumRealms",
-            "GetRealmCategories",
-            "GetRealmInfo",
-            "GetSelectedCategory",
-            "RealmListDialogCancelled",
-            "RequestRealmList",
-            "SetPreferredInfo",
-            "SortRealms",
-        ],
-    ),
 ];
 
 /// The glue VM's globals by Lua type name.