Paragon: multidot Devouring Plague, stance/presence clones, advancement SLA

- Allow multiple Devouring Plague DoTs on different targets (core + DK script). - Warrior stance and DK presence clone spells for Character Advancement; spellbook SkillLineAbility rows and aura/shapeshift attribute fixes. - World SQL updates 2026_05_12_02 through 07 (mod-paragon db-world). Client patch-enUS-4/5/6 and Wow.exe ship on the matching GitHub Release (not in repo). Co-authored-by: Cursor <cursoragent@cursor.com>
Paragon: Runeforging support (panel-purchasable, no anvil required)
2026-05-12 19:20:13 -04:00 · 2026-05-12 04:49:38 -04:00 · 2026-05-11 23:17:37 -04:00 · 2026-05-11 19:44:03 -05:00 · 2026-05-11 19:09:25 -04:00 · 2026-05-11 18:19:42 -04:00
94 changed files with 18801 additions and 254 deletions
@@ -0,0 +1,161 @@
+# When a release is published on this repo (or manual dispatch):
+#   1. Builds the Electron launcher from that tag (npm run pack:win).
+#   2. Downloads any assets attached to the same release on this repo (patches, Wow exe, …).
+#   3. Merges them (launcher files win on name collision) and creates/updates the matching
+#      release on Fractured-Distro.
+#
+# Setup (GitHub → Settings → Secrets and variables → Actions):
+#   DISTRO_SYNC_TOKEN — PAT with releases write on Fractured-Distro (see repo README).
+#
+# Change DISTRO_REPO or the job `if:` if your GitHub slugs differ.
+
+name: Sync release to Fractured-Distro
+
+on:
+  release:
+    types: [published]
+  workflow_dispatch:
+    inputs:
+      tag:
+        description: 'Release tag on this repo (must exist; e.g. v1.0.0)'
+        required: true
+        type: string
+
+permissions:
+  contents: read
+
+env:
+  DISTRO_REPO: Dawnforger/Fractured-Distro
+
+jobs:
+  meta:
+    runs-on: ubuntu-latest
+    if: github.repository == 'Dawnforger/Fractured'
+    outputs:
+      tag: ${{ steps.t.outputs.tag }}
+    steps:
+      - name: Resolve tag
+        id: t
+        shell: bash
+        run: |
+          if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
+            echo "tag=${{ inputs.tag }}" >> "$GITHUB_OUTPUT"
+          else
+            echo "tag=${{ github.event.release.tag_name }}" >> "$GITHUB_OUTPUT"
+          fi
+
+  build-electron:
+    needs: meta
+    if: github.repository == 'Dawnforger/Fractured'
+    runs-on: windows-latest
+    timeout-minutes: 45
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          ref: ${{ needs.meta.outputs.tag }}
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: '20'
+          cache: npm
+          cache-dependency-path: tools/fractured-launcher-electron/package-lock.json
+
+      - name: Install and pack (NSIS + portable)
+        working-directory: tools/fractured-launcher-electron
+        run: |
+          npm ci
+          npm run pack:win
+
+      - name: Stage launcher files for upload
+        shell: pwsh
+        run: |
+          New-Item -ItemType Directory -Force -Path launcher-publish | Out-Null
+          Copy-Item tools/fractured-launcher-electron/dist/*.exe launcher-publish/
+          if (Test-Path tools/fractured-launcher-electron/dist/latest.yml) {
+            Copy-Item tools/fractured-launcher-electron/dist/latest.yml launcher-publish/
+          }
+
+      - uses: actions/upload-artifact@v4
+        with:
+          name: electron-dist
+          path: launcher-publish/
+
+  sync-distro:
+    needs: [meta, build-electron]
+    if: github.repository == 'Dawnforger/Fractured'
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          ref: ${{ github.event.repository.default_branch }}
+          sparse-checkout: |
+            tools/fractured-launcher-electron/scripts
+          sparse-checkout-cone-mode: true
+
+      - uses: actions/download-artifact@v4
+        with:
+          name: electron-dist
+          path: /tmp/electron
+
+      - name: Merge main release assets + Electron build
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          set -euo pipefail
+          . tools/fractured-launcher-electron/scripts/release-sync-filters.sh
+          TAG="${{ needs.meta.outputs.tag }}"
+          mkdir -p combined
+          mkdir -p /tmp/from-main
+          if gh release download "$TAG" -R "${{ github.repository }}" -D /tmp/from-main 2>/tmp/dl.err; then
+            shopt -s nullglob
+            for f in /tmp/from-main/*; do
+              if [ -f "$f" ]; then
+                bn=$(basename "$f")
+                if should_skip_merge_from_github "$bn"; then
+                  echo "Skipping GitHub release asset (CI launcher or excluded): $bn"
+                  continue
+                fi
+                cp -f "$f" combined/
+              fi
+            done
+            echo "Merged assets from ${{ github.repository }} release $TAG"
+          else
+            echo "Main release download note (continuing with launcher only):"
+            cat /tmp/dl.err || true
+          fi
+          shopt -s nullglob
+          for f in /tmp/electron/*; do
+            if [ -f "$f" ]; then
+              cp -f "$f" combined/
+            fi
+          done
+          echo "Combined directory:"
+          ls -la combined/
+
+      - name: Upload to Fractured-Distro
+        env:
+          GH_TOKEN: ${{ secrets.DISTRO_SYNC_TOKEN }}
+        run: |
+          set -euo pipefail
+          if [ -z "${GH_TOKEN:-}" ]; then
+            echo "Missing secret DISTRO_SYNC_TOKEN (PAT with access to $DISTRO_REPO)."
+            exit 1
+          fi
+          TAG="${{ needs.meta.outputs.tag }}"
+          shopt -s nullglob
+          files=(combined/*)
+          if [ "${#files[@]}" -eq 0 ]; then
+            echo "Nothing to upload (Electron pack produced no files?)."
+            exit 1
+          fi
+          SRC_URL="https://github.com/${{ github.repository }}/releases/tag/${TAG}"
+          if gh release view "$TAG" -R "$DISTRO_REPO" &>/dev/null; then
+            gh release upload "$TAG" -R "$DISTRO_REPO" "${files[@]}" --clobber
+            echo "Uploaded (clobber) to $DISTRO_REPO release $TAG"
+          else
+            gh release create "$TAG" -R "$DISTRO_REPO" \
+              --title "Fractured $TAG" \
+              --notes "Synced from [$TAG]($SRC_URL) on ${{ github.repository }}. Includes CI-built Electron launcher + release assets." \
+              "${files[@]}"
+            echo "Created $DISTRO_REPO release $TAG with ${#files[@]} asset(s)."
+          fi
@@ -0,0 +1,80 @@
+# Verifies Electron launcher Windows pack and uploads installers for testing.
+
+name: Fractured launcher CI
+
+on:
+  workflow_dispatch:
+  push:
+    branches: [master, main]
+    paths:
+      - 'tools/fractured-launcher-electron/**'
+      - '.github/workflows/fractured-launcher-ci.yml'
+  pull_request:
+    paths:
+      - 'tools/fractured-launcher-electron/**'
+      - '.github/workflows/fractured-launcher-ci.yml'
+
+permissions:
+  contents: read
+
+concurrency:
+  group: fractured-launcher-ci-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  electron-launcher-windows:
+    runs-on: windows-latest
+    timeout-minutes: 45
+    defaults:
+      run:
+        working-directory: tools/fractured-launcher-electron
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: '20'
+          cache: npm
+          cache-dependency-path: tools/fractured-launcher-electron/package-lock.json
+
+      - name: Install and pack (NSIS + portable)
+        run: |
+          npm ci
+          npm run pack:win
+
+      - uses: actions/upload-artifact@v4
+        with:
+          name: fractured-launcher-electron-windows-${{ github.run_id }}
+          if-no-files-found: warn
+          path: |
+            tools/fractured-launcher-electron/dist/*.exe
+            tools/fractured-launcher-electron/dist/latest.yml
+
+  electron-launcher-linux:
+    runs-on: ubuntu-latest
+    timeout-minutes: 45
+    defaults:
+      run:
+        working-directory: tools/fractured-launcher-electron
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: '20'
+          cache: npm
+          cache-dependency-path: tools/fractured-launcher-electron/package-lock.json
+
+      - name: Install and pack (AppImage)
+        run: |
+          npm ci
+          npm run pack:linux
+
+      - uses: actions/upload-artifact@v4
+        with:
+          name: fractured-launcher-electron-linux-${{ github.run_id }}
+          if-no-files-found: warn
+          path: |
+            tools/fractured-launcher-electron/dist/*.AppImage
+            tools/fractured-launcher-electron/dist/latest.yml
+            tools/fractured-launcher-electron/dist/latest-linux.yml
@@ -0,0 +1,248 @@
+# Primary path for player-facing binaries: every *published* GitHub Release on this repo
+# is mirrored to your self-hosted Gitea (same tag). No public GitHub distro repo.
+#
+# Triggers:
+#   - release: published / released → GitHub “Release” (not a raw git tag alone).
+#   - workflow_dispatch → Actions → this workflow → “Run workflow” (enter tag).
+#
+# Troubleshooting: “Re-run failed jobs” on an OLD run replays the *original* workflow
+# YAML (e.g. still runs `npm run pack:win` without --publish never). After changing this
+# file on default branch, start a *new* run via “Run workflow”, not Re-run on a pre-fix run.
+#
+# Important: pushing only a git tag does NOT run this — you must create/publish a
+# Release on github.com (Releases → Draft/new release → Publish). The workflow
+# definition must exist on the repo DEFAULT branch (GitHub runs it from there).
+#
+# Steps: Windows (NSIS+portable) + Linux (AppImage) in parallel, launcher from DEFAULT BRANCH
+# overlay on tag checkout → merge with GitHub release assets → upload all to Gitea.
+#
+# Secrets: GITEA_BASE_URL, GITEA_TOKEN, GITEA_OWNER, GITEA_REPO
+# Optional variable: GITEA_TARGET_REF (see tools/fractured-launcher-electron/README.md)
+#
+# Job guard: edit `if:` if github.repository is not Dawnforger/Fractured.
+
+name: Sync release to Gitea
+
+on:
+  release:
+    types: [published, released]
+  workflow_dispatch:
+    inputs:
+      tag:
+        description: 'Git tag only (e.g. v0.7.11-paragon-foo). NOT the release title — open the release and copy the tag next to the title.'
+        required: true
+        type: string
+
+permissions:
+  contents: read
+
+concurrency:
+  group: gitea-release-sync-${{ github.repository }}-${{ github.event_name == 'workflow_dispatch' && github.event.inputs.tag || github.event.release.tag_name }}
+  cancel-in-progress: false
+
+jobs:
+  meta:
+    runs-on: ubuntu-latest
+    if: github.repository == 'Dawnforger/Fractured'
+    outputs:
+      tag: ${{ steps.t.outputs.tag }}
+    steps:
+      - name: Resolve tag
+        id: t
+        shell: bash
+        run: |
+          set -euo pipefail
+          if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
+            RAW="${{ github.event.inputs.tag }}"
+          else
+            RAW="${{ github.event.release.tag_name }}"
+          fi
+          TAG="$(printf '%s' "$RAW" | sed 's/^[[:space:]]*//;s/[[:space:]]*$//')"
+          if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
+            if [ -z "$TAG" ]; then
+              echo '::error::Tag input is empty. Paste the git tag (e.g. v0.7.11-…).'
+              exit 1
+            fi
+            if printf '%s' "$TAG" | grep -q '[[:space:]]'; then
+              echo '::error::Tag contains whitespace — that is usually the **release title**, not the tag. On GitHub → Releases → open the release → copy the **tag** (short ref like v0.7.11-…), not the long title line.'
+              exit 1
+            fi
+          fi
+          {
+            echo "tag<<__TAG_EOF__"
+            echo "$TAG"
+            echo "__TAG_EOF__"
+          } >> "$GITHUB_OUTPUT"
+
+  build-electron:
+    needs: meta
+    if: github.repository == 'Dawnforger/Fractured'
+    runs-on: windows-latest
+    timeout-minutes: 45
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          ref: ${{ needs.meta.outputs.tag }}
+
+      # Release tags often point at server/game commits that predate launcher lib fixes.
+      # Always pack the launcher from default branch so app.asar includes the full tree.
+      - name: Overlay launcher from default branch
+        shell: bash
+        run: |
+          set -euo pipefail
+          DB="${{ github.event.repository.default_branch }}"
+          git fetch --no-tags --depth=1 origin "+refs/heads/${DB}:refs/remotes/origin/${DB}"
+          git checkout "origin/${DB}" -- tools/fractured-launcher-electron
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: '20'
+          cache: npm
+          cache-dependency-path: tools/fractured-launcher-electron/package-lock.json
+
+      - name: Install and pack (NSIS + portable)
+        working-directory: tools/fractured-launcher-electron
+        run: |
+          npm ci
+          node -p "'Launcher package.json version: ' + require('./package.json').version"
+          npm run pack:win
+
+      - name: Stage launcher files for upload
+        shell: pwsh
+        run: |
+          New-Item -ItemType Directory -Force -Path launcher-publish | Out-Null
+          Copy-Item tools/fractured-launcher-electron/dist/*.exe launcher-publish/
+          if (Test-Path tools/fractured-launcher-electron/dist/latest.yml) {
+            Copy-Item tools/fractured-launcher-electron/dist/latest.yml launcher-publish/
+          }
+
+      - uses: actions/upload-artifact@v4
+        with:
+          name: electron-dist-windows
+          path: launcher-publish/
+
+  build-electron-linux:
+    needs: meta
+    if: github.repository == 'Dawnforger/Fractured'
+    runs-on: ubuntu-latest
+    timeout-minutes: 45
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          ref: ${{ needs.meta.outputs.tag }}
+
+      - name: Overlay launcher from default branch
+        shell: bash
+        run: |
+          set -euo pipefail
+          DB="${{ github.event.repository.default_branch }}"
+          git fetch --no-tags --depth=1 origin "+refs/heads/${DB}:refs/remotes/origin/${DB}"
+          git checkout "origin/${DB}" -- tools/fractured-launcher-electron
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: '20'
+          cache: npm
+          cache-dependency-path: tools/fractured-launcher-electron/package-lock.json
+
+      - name: Install and pack (AppImage)
+        working-directory: tools/fractured-launcher-electron
+        run: |
+          npm ci
+          node -p "'Launcher package.json version: ' + require('./package.json').version"
+          npm run pack:linux
+
+      - name: Stage Linux launcher for upload
+        shell: bash
+        run: |
+          set -euo pipefail
+          mkdir -p launcher-linux-publish
+          shopt -s nullglob
+          cp -f tools/fractured-launcher-electron/dist/*.AppImage launcher-linux-publish/ 2>/dev/null || true
+          for f in tools/fractured-launcher-electron/dist/latest.yml tools/fractured-launcher-electron/dist/latest-linux.yml; do
+            if [ -f "$f" ]; then cp -f "$f" launcher-linux-publish/; fi
+          done
+          ls -la launcher-linux-publish/
+          if ! compgen -G "launcher-linux-publish/*.AppImage" > /dev/null; then
+            echo "No AppImage under dist/ — electron-builder linux target failed" >&2
+            exit 1
+          fi
+
+      - uses: actions/upload-artifact@v4
+        with:
+          name: electron-dist-linux
+          path: launcher-linux-publish/
+
+  sync-gitea:
+    needs: [meta, build-electron, build-electron-linux]
+    if: github.repository == 'Dawnforger/Fractured'
+    runs-on: ubuntu-latest
+    env:
+      GITEA_BASE_URL: ${{ secrets.GITEA_BASE_URL }}
+      GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }}
+      GITEA_OWNER: ${{ secrets.GITEA_OWNER }}
+      GITEA_REPO: ${{ secrets.GITEA_REPO }}
+      GITEA_TARGET_REF: ${{ vars.GITEA_TARGET_REF }}
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          # Script may not exist on older release tags; always use default branch.
+          ref: ${{ github.event.repository.default_branch }}
+          sparse-checkout: |
+            tools/fractured-launcher-electron/scripts
+          sparse-checkout-cone-mode: true
+
+      - uses: actions/download-artifact@v4
+        with:
+          name: electron-dist-windows
+          path: /tmp/electron-win
+
+      - uses: actions/download-artifact@v4
+        with:
+          name: electron-dist-linux
+          path: /tmp/electron-linux
+
+      - name: Merge GitHub release assets + Electron build
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          set -euo pipefail
+          . tools/fractured-launcher-electron/scripts/release-sync-filters.sh
+          TAG="${{ needs.meta.outputs.tag }}"
+          mkdir -p combined
+          mkdir -p /tmp/from-main
+          if gh release download "$TAG" -R "${{ github.repository }}" -D /tmp/from-main 2>/tmp/dl.err; then
+            shopt -s nullglob
+            for f in /tmp/from-main/*; do
+              if [ -f "$f" ]; then
+                bn=$(basename "$f")
+                if should_skip_merge_from_github "$bn"; then
+                  echo "Skipping GitHub release asset (CI launcher or excluded): $bn"
+                  continue
+                fi
+                cp -f "$f" combined/
+              fi
+            done
+            echo "Merged assets from ${{ github.repository }} release $TAG"
+          else
+            echo "GitHub release download note (continuing with launcher only):"
+            cat /tmp/dl.err || true
+          fi
+          shopt -s nullglob
+          for f in /tmp/electron-win/* /tmp/electron-linux/*; do
+            if [ -f "$f" ]; then
+              cp -f "$f" combined/
+            fi
+          done
+          ls -la combined/
+
+      - name: Upload to Gitea
+        run: |
+          set -euo pipefail
+          for v in GITEA_BASE_URL GITEA_TOKEN GITEA_OWNER GITEA_REPO; do
+            if [ -z "${!v:-}" ]; then
+              echo "Missing secret $v — add it under repo Settings → Secrets and variables → Actions." >&2
+              exit 1
+            fi
+          done
+          bash tools/fractured-launcher-electron/scripts/upload-release-to-gitea.sh combined "${{ needs.meta.outputs.tag }}"
@@ -0,0 +1,94 @@
+# Fractured / Paragon — Balance Backlog
+
+Open balance / scaling questions surfaced by play-testers that have not yet
+been actioned. Each entry should record the *symptom*, the *suspected cause*
+based on a quick code dive, the *option set* we discussed, and any *links*
+to relevant code. Knock items off as they ship.
+
+---
+
+## Feral Cat scaling feels weak (2026-05-11)
+
+**Reporter feedback:**
+
+> "Weapons don't automatically feature feral AP on this server and nothing
+> is currently rescaled resulting in a super low feral scale. We can either
+> rescale their abilities or add the AP back to all weapons."
+>
+> Resident Feral expert: "this is not a bear issue unfortunately, I have
+> 11k AP" / "Stam > AP and Armor > AP means this is completely a cat issue."
+
+**What's actually happening on the server:**
+
+Feral AP *is* being granted on weapons — `ItemTemplate::getFeralBonus`
+(`src/server/game/Entities/Item/ItemTemplate.h`) synthesises it from the
+weapon's DPS for any weapon with `INVTYPE_WEAPON / 2HWEAPON / WEAPONMAINHAND
+/ WEAPONOFFHAND`:
+
+```cpp
+int32 bonus = int32((extraDPS + getDPS()) * 14.0f) - 767;
+```
+
+That's then routed through `Player::ApplyFeralAPBonus` (Player.cpp ~6896)
+into `m_baseFeralAP`, which `Player::UpdateAttackPowerAndDamage` adds into
+the cat / bear formulas in `src/server/game/Entities/Unit/StatSystem.cpp`
+(~line 477):
+
+```cpp
+case FORM_CAT:
+    val2 = (level * mLevelMult) + STR*2 + AGI - 20 + weapon_bonus + m_baseFeralAP;
+    break;
+case FORM_BEAR:
+case FORM_DIREBEAR:
+    val2 = (level * mLevelMult) + STR*2          - 20 + weapon_bonus + m_baseFeralAP;
+    break;
+```
+
+So bear and cat get the same `m_baseFeralAP` — the only delta is `+ AGI` for
+cat. The "bears feel fine, cats feel weak" complaint is real; it's because
+bear damage is rage / proc / mitigation driven (Lacerate stack, Savage
+Defense, Pulverize-style talents) while cat damage is much more
+AP-coefficient driven (Shred, Mangle, Rake, Rip, FB).
+
+**Options discussed (pick when we revisit):**
+
+| ID | Lever | Pros | Cons |
+|----|-------|------|------|
+| A  | Bump the cat AP formula (e.g. `+ AGI*1.5`) | Cleanest, very tunable, hits both auto-attacks and abilities | Blunt instrument, also affects PvP |
+| B  | Boost cat-form ability coefficients (Shred / Rake / Rip / Mangle / FB) via spellmod auras | Most retail-faithful, surgical | More moving parts, harder to communicate |
+| C  | Increase `getFeralBonus` payout for druid weapons (e.g. `* 18.0f` or drop the `-767` floor) | Single-line change | Buffs bears too — bears are already fine, would over-buff |
+| D  | New Cat-only passive "Predator's Edge" = `+X% physical damage in Cat Form` | Easy to balance, easy to communicate, easy to undo | Adds another aura to track |
+
+**Recommendation when we pick this back up:** start with **D + small A** —
+D is the readable "+15-20% cat damage" knob, A is a backup if AP-scaling
+abilities (Mangle / FB) still feel weak relative to bleeds. Both are
+trivially tunable via a single config knob during play-testing.
+
+Do **not** pick C — it over-buffs bears, which the Feral expert explicitly
+said are already fine.
+
+**Resolution (2026-05-11, second pass):** Per the resident Feral expert
+("instead of adding a new passive, you could probably just increase Cat
+Form's Master Shapeshifter value along with its tooltip, alongside buffing
+the agi scaling") we shipped a hybrid of **A** and a *cat-only* knob that
+sits next to **D** but reuses an existing aura instead of inventing a new
+one:
+
+* `StatSystem.cpp` `UpdateAttackPowerAndDamage` FORM_CAT branch now
+  reads `+ GetStat(STAT_AGILITY) * 2.0f` (stock 1.0). FORM_BEAR /
+  FORM_DIREBEAR / FORM_MOONKIN are untouched, so bear's "already fine"
+  state is preserved.
+* `SpellAuraEffects.cpp` Master Shapeshifter FORM_CAT branch multiplies
+  the talent's value by 2 before triggering 48420 (cat-form aura).
+  Talent ranks: 2% -> 4% (R1), 4% -> 8% (R2) crit chance in Cat Form.
+  Bear / Moonkin / Tree branches still pass `bp` through unchanged.
+* Client tooltip drift handled by
+  `fractured-tooling/from-workspace-root/_patch_spell_dbc_feral_tooltips.py`,
+  which appends a `[Fractured]` paragraph to the Description column of
+  Cat Form (768) and Master Shapeshifter ranks (48411 / 48412).
+
+If field reports after this lands still say cat is weak, the next levers
+are (in order): bump `2.0f` to `2.5f` in StatSystem.cpp, then bump the
+Master Shapeshifter cat multiplier from `* 2` to `* 3` in
+SpellAuraEffects.cpp, then -- only if those are exhausted -- revisit
+**B** (per-ability spellmod coefficients).
@@ -17,17 +17,53 @@ prerequisites; everything here is just the deltas you need on top of it.

 ## Fractured client + network defaults

-Production Fractured uses a non-default **auth** port so the client realmlist can be:
+Stock-friendly defaults for fresh local installs. A `git clone` ->
+`docker compose up` (or native install) lets a single developer log in
+from the same machine without any post-install config tweaks.
+
+- **`authserver.conf` -> `RealmServerPort`** = **3724** (stock WoW). A
+  patched `Wow.exe` with `set realmlist 127.0.0.1` (no port) reaches
+  the auth handshake.
+- **`realmlist` table -> `port`** is the **world** port (default
+  **8085**, matches `WorldServerPort` in `worldserver.conf.dist`).
+  Auth tells the client to handshake to this port for the world hand-off.
+- **`realmlist` table -> `address`** defaults to **`127.0.0.1`** in the
+  base SQL. The auth server hands this address to clients after login,
+  so 127.0.0.1 means "talk to the world server on the same machine
+  auth is running on" -- correct for solo dev. **Override on production
+  deploys**, see *Production deployment overrides* below.
+
+### Production deployment overrides
+
+Production Fractured runs on a remote VPS at `hsrwow.net` with auth
+bound to a non-stock port (47497 -- 3724 was unavailable on that host).
+Apply the overrides **once per fresh dbimport** on the production box.
+
+```sql
+-- Run against acore_auth on the production database after first dbimport:
+UPDATE realmlist
+   SET address = 'hsrwow.net',
+       port    = 8085          -- world port; leave at 8085 unless changed
+ WHERE id = 1;
+```
+
+Edit the production `authserver.conf` (NOT `authserver.conf.dist`)
+to bind the auth listener to the production port:
+
+```ini
+RealmServerPort = 47497
+```
+
+Restart the auth server. Production clients connect with:

 ```text
 set realmlist hsrwow.net:47497
 ```

-(Patched 3.3.5 clients that support `host:port`; otherwise use port forwarding to **3724**.)
-
- **`authserver.conf` → `RealmServerPort`** must be **`47497`** (matches `authserver.conf.dist` in this repo).
- **`realmlist` table → `port`** is the **world** port (default **8085**, same as `WorldServerPort` in `worldserver.conf.dist`), **not** 47497.
- **`realmlist` → `address`** defaults to **`hsrwow.net`** in base SQL; change if your public hostname differs.
+The Fractured-patched 3.3.5 client supports the `host:port` syntax;
+stock 3.3.5 clients do not, so any contributor distributing the
+client bundle for production must include the patched `Wow.exe` from
+the GitHub release.

 ---

@@ -7,22 +7,35 @@ re-downloaded without bloating `git clone`.

 This file is the table of contents and install guide.

+**Launcher (Windows):** The maintained client launcher lives in
+[`tools/fractured-launcher-electron/`](../../tools/fractured-launcher-electron/)
+(see its README for build and config). **Public downloads** for the launcher
+and mirrored patch assets are pushed to
+[Fractured-Distro releases](https://github.com/Dawnforger/Fractured-Distro/releases)
+when a release is published here (workflow **Sync release to Fractured-Distro**).
+
 ---

 ## What ships in a release

 | Artifact | Size | Purpose |
 |---|---|---|
-| `patch-enUS-4.MPQ` | ~5 MB | DBC + GlueXML bake. Adds `CLASS_PARAGON` (id 12), the character-create slot, glue strings, talent-tab DBC entries, and the Paragon resource bar definitions. Required for character creation as Paragon to even show up. |
-| `patch-enUS-5.MPQ` | ~40 KB | FrameXML overrides. Replaces stock `PlayerFrame.lua` / `RuneFrame.lua` / `ComboFrame.lua` / `UnitFrame.lua` with Paragon-aware versions: rune simulator, combo-point simulator, server-authoritative resource sync over the `PARAA` addon channel, action-button usability + click guards. |
-| `patch-enUS-6.MPQ` | ~160 KB | The `ParagonAdvancement` addon. Replaces the talent pane (`N` key) for Paragon characters with the Character Advancement panel: per-class spell tabs, talent grid, Overview/Search tabs, AE/TE currency, commit / reset / preview, login-time toast suppression. |
+| `patch-enUS-4.MPQ` | ~5 MB | DBC + GlueXML bake. Adds `CLASS_PARAGON` (id 12), the character-create slot, glue strings, game-table DBCs, and a patched `Spell.dbc`: **(1)** `RuneCostID` zeroed on every rune-cost spell so non–Death Knight clients still send DK casts (rune costs are shown via `RuneFrame.lua`); **(2)** `Reagent[]` / `ReagentCount[]` zeroed on every spell whose `SpellFamilyName` is non-zero (all class abilities), while profession crafts (`SpellFamilyName == 0`) keep their materials. Both edits mirror server load-time corrections so client preflight and server validation stay aligned. Required for character creation as Paragon to even show up. |
+| `patch-enUS-5.MPQ` | ~64 KB | FrameXML overrides. Replaces stock `PlayerFrame.lua` / `RuneFrame.lua` / `ComboFrame.lua` / `UnitFrame.lua` / `SpellBookFrame.lua` + `SpellBookFrame.xml` with Paragon-aware versions: rune simulator, combo-point simulator, server-authoritative resource sync over the `PARAA` addon channel, action-button usability + click guards, an expanded spellbook (higher `MAX_SPELLS`, 24 skill-line tabs instead of stock 8) so all-class spells render, Paragon stat tooltips on the character sheet (including filtering duplicate “attack power from strength” lines so the paper doll matches server AP), a tooltip post-processor that appends ", Paragon" to the "Classes:" line on class-restricted gear / glyphs (the server bypasses `AllowableClass` for class 12, but the engine paints the line red and omits Paragon — the Lua hook recolors it green and adds the name so the player can tell it's wearable), a **spell-tooltip post-processor** that (1) recolors and appends "(Paragon: bypassed)" to "Requires *Stance*" lines on Warrior abilities (server-side `SpellInfo::CheckShapeshift` skips stance enforcement for Paragons on `SPELLFAMILY_WARRIOR` spells, but the client still renders the requirement from the stock `Stances` DBC field which we deliberately leave unzeroed so stock Warriors keep enforcement), (2) appends a Paragon line to **Maelstrom Weapon** (53817) noting that Fireball / Frostbolt / Arcane Blast also benefit, and (3) appends a Paragon line to **Mirror Image** (55342) noting that the images cast random damage spells with a cast time from the caster's spellbook instead of Frostbolt — all three patches gate on `UnitClass("player") == "PARAGON"` so stock-class tooltips are byte-identical to vanilla, and **PetFrame** re-anchored so the **pet unit frame sits below the rune row** for Paragon (stock layout had runes overlapping the pet portrait). A **Warrior stance click bypass** wraps `UseAction` so that for Paragon characters, clicking an action slot bound to a stance-gated Warrior ability (Whirlwind, Charge, Pummel, Shield Slam, Hamstring, Overpower, Shield Bash, Shield Block, Disarm, Revenge, Spell Reflection, Recklessness, Bladestorm, Shockwave, Concussion Blow, Last Stand, Sweeping Strikes, Mocking Blow, Heroic Fury, Slam, Devastate, Intercept) routes through `CastSpellByName(name)` instead of the engine's stance-gated `UseAction` path; the engine's stance pre-check inside `UseAction` would otherwise drop the cast packet client-side and our server-side `CheckShapeshift` bypass would never get to run. Stock classes never enter the bypass branch. The paper-doll **ammo slot** follows stock visibility rules (shown for hunters / ranged weapons; hidden when `UnitHasRelicSlot` applies). |
+| `patch-enUS-6.MPQ` | ~134 KB | The `ParagonAdvancement` addon. Replaces the talent pane (`N` key) for Paragon characters with the Character Advancement panel: per-class spell tabs, talent grid, Overview/Search tabs, AE/TE currency, commit / reset / preview, login-time toast suppression, a **PETS** tab with live hunter pet talent trees (preview learn, no TE/AE cost), a dedicated **Reset Pet Talents** control (server `PARAA` `C RESET PET TALENTS` — instant, no gold, no confirmation; requires matching worldserver), bottom-row **Reset all Abilities / Reset Build / Reset all Talents** disabled while on the PETS tab so those paths cannot dismiss the pet or unlearn Tame Beast, and a **Builds** page (full-pane overlay opened from the bottom-row Builds button) for saving named, icon-tagged loadouts: New Build (+) icon picker reuses `MACRO_ICON_FILENAMES`, right-click for edit/delete, shift-left-click to favorite (favorites bubble to the top), left-click pops a Load Build confirm. Build swaps reset + refund AE/TE, re-spend on the saved recipe, and **park hunter pets** to `PET_SAVE_NOT_IN_SLOT` so their name/talents/exp are preserved across swaps. |
 | `Wow.exe` | ~7.5 MB | 3.3.5a (build 12340) client byte-patched to skip the MPQ signature check so custom `patch-enUS-N.MPQ` files load. Diff against stock is a few bytes; everything else is unchanged. |

 Server and client work as a pair: the addon talks to `mod-paragon` on the
 worldserver via `WHISPER` addon-channel messages with the `PARAA` prefix
 (currency push, spell/talent snapshot, commit, combo points, rune
-cooldowns, learn-toast silence window). Mismatched versions usually
-manifest as the panel rendering blank or AE/TE reading 0/0.
+cooldowns, learn-toast silence window, **`C RESET PET TALENTS`**
+for hunter pet talent resets from the Character Advancement PETS tab,
+and the **build catalog** verbs `Q BUILDS` / `C BUILD NEW` / `C BUILD
+EDIT` / `C BUILD DELETE` / `C BUILD FAVORITE` / `C BUILD LOAD` for the
+saved-loadout system on the Builds page). Build swaps require the
+matching worldserver image because the swap path is server-driven
+(snapshot → reset → re-spend → pet park/unpark). Mismatched versions
+usually manifest as the panel rendering blank or AE/TE reading 0/0.

 ---

@@ -52,6 +65,171 @@ worldserver image is older than commit `4d2a80d` (the
 `character_paragon_panel_spell_revoked` migration). Pull both ends to
 the same release tag and rebuild the worldserver image.

+If the **client** shows the Paragon class on the create screen but the
+server replies **Character Creation Failed** (sometimes shown as
+"Error creating character") when you pick it -- **or** the character
+is created but spawns with no weapon / armor proficiencies (auto-attack
+greys out, can't equip anything beyond a fist), or with the proficiency
+**skills** but no **passive spells** like Block, Parry, Dual Wield --
+the worldserver is missing one of four pieces of class-12 data. All
+ship as SQL migrations under
+`modules/mod-paragon/data/sql/db-world/updates/` and are auto-applied
+by AzerothCore's DBUpdater on every `ac-db-import` run, but the SQL
+files are baked into the dbimport Docker image at build time -- so a
+stale image won't pick up new migrations. Fix:
+
+```bash
+git pull origin main
+docker compose build ac-db-import ac-worldserver
+docker compose up -d ac-db-import
+docker compose restart ac-worldserver
+```
+
+Existing class-12 characters created before these migrations will
+keep their broken state -- the cascade only fires inside
+`Player::Create` and `Player::LearnDefaultSkill` at character spawn.
+Delete the old Paragon and re-roll after the rebuild.
+
+The four migrations:
+
+- `2026_05_09_00.sql` -- DBC overlay rows for `chrclasses_dbc` and
+  `skillraceclassinfo_dbc`. Without this the server can't even
+  resolve class 12 in `sChrClassesStore`. See **Server-side Paragon
+  DBC overlay** below.
+- `2026_05_10_00.sql` -- `playercreateinfo`, `playercreateinfo_action`,
+  and `player_class_stats` rows for class 12. Without this
+  `Player::Create` rejects every (race, class=12) pair as an
+  "invalid race/class pair" and the worldserver prints
+  `class-N Level-L does not have stats data!` integrity warnings on
+  load.
+- `2026_05_10_01.sql` -- 20 `playercreateinfo_skills` rows
+  (`classMask = 2048` = class 12) granting every weapon /
+  armor proficiency at level 1. Without this a Paragon spawns with
+  only the universal `classMask = 0` skills (Defense, Unarmed,
+  Cloth, languages, Mounts) -- no Swords, no Mail, no Shield, etc.
+- `2026_05_10_02.sql` -- 3,314 `skilllineability_dbc` rows opening
+  the class-12 bit on every SkillLineAbility row our patched
+  `SkillLineAbility.dbc` modified. AC reads these rows in
+  `Player::LearnDefaultSkill` to drive the `skill -> passive spell`
+  cascade. Without it the proficiency *skills* from `_01.sql` exist
+  but the *passive spells* (Block, Parry, Dual Wield, Defense,
+  weapon Shoot, racial Mace/Sword Specialization, etc.) never auto-
+  learn, so the spellbook past the racials looks empty.
+
+After the rebuild + restart, `ac-worldserver` should log
+`>> Loaded 72 Player Create Definitions` (was 62 pre-Paragon),
+`>> Loaded 1391 Player Create Skills` (was 1371),
+`>> Loaded 10219 SkillLineAbility MultiMap Data` (unchanged total --
+the SQL overlay replaces existing rows by ID, doesn't add new ones),
+and character creation succeeds for any DK-eligible race with a full
+weapon / armor kit and the matching passive spells.
+
+If the client **logs in** successfully but **disconnects immediately**
+when entering the realm: the auth server is handing your client the
+wrong world-server address. On a fresh local install the seed defaults
+to `127.0.0.1` (commit landing this paragraph). If your DB was
+imported from an older Fractured checkout, the seed may still point at
+`hsrwow.net`, which sends the client to our production world server
+instead of yours. Fix:
+
+```bash
+# Docker:
+docker exec ac-database mysql -uroot -ppassword \
+  -e "UPDATE acore_auth.realmlist SET address='127.0.0.1' WHERE id=1;"
+docker compose restart ac-authserver
+```
+
+Substitute your public hostname/IP for `127.0.0.1` if remote players
+will be connecting. See `BUILD-NATIVE.md` -> *Production deployment
+overrides* for the full list of values to set on a production box.
+
+---
+
+## Server-side Paragon DBC overlay (automatic)
+
+The Fractured **client** learns about Paragon from `patch-enUS-4.MPQ`
+(DBC + GlueXML). The **worldserver** never reads your MPQs — it reads
+plain `.dbc` files under its `DataDir` (`.../data/dbc/` by default).
+
+Stock Docker installs populate `data/dbc/` from a vanilla 3.3.5a
+extract (`ac-client-data-init` in `docker-compose.yml`). That tree has
+no `ChrClasses` row for id **12** and no class-12 bit on
+`SkillRaceClassInfo` rows, which would normally trigger:
+
+`Class (12) not found in DBC while creating new char ... wrong DBC files or cheater?`
+
+…and reject the create with `CHAR_CREATE_FAILED`.
+
+To remove that gap, the repo ships
+`modules/mod-paragon/data/sql/db-world/updates/2026_05_09_00.sql`,
+which `INSERT`s the Paragon class-12 deltas into:
+
+- `chrclasses_dbc` — 1 row defining class 12 ("Paragon", power=Mana,
+  family=Warrior, expansion=2).
+- `skillraceclassinfo_dbc` — 235 rows replacing stock entries with the
+  patched ClassMask (class-12 bit OR'd in) so every baseline skill is
+  available to Paragon characters.
+
+`AzerothCore`'s DBC loader (`DBCStores.cpp::LoadDBC` -> `LoadFromDB`)
+merges these rows on top of whatever `data/dbc/` contains at every
+worldserver boot. The DBUpdater in `ac-db-import` (Docker) or the
+worldserver itself (native) applies the migration automatically — so
+the **only** steps a fresh contributor needs are `git clone` and
+`docker compose up -d`.
+
+### Regenerating the migration
+
+The SQL is auto-generated from the patched DBCs that already live
+inside `patch-enUS-4.MPQ`. The bake script lives outside this repo
+(per the repo-tidy policy) at:
+
+`fractured-tooling/from-workspace-root/_gen_paragon_dbc_overlay_sql.py`
+
+Re-run it whenever you change the Paragon DBC bake — for example,
+adding a new race to the Paragon class mask. It diffs the patched
+DBCs against a stock 3.3.5a DBC extract and emits a fresh
+`2026_05_09_00.sql` (or successor migration with a new timestamp if
+deltas change). Workflow:
+
+```powershell
+# Extract the patched DBCs once:
+.\tools\mpq\mpqcli.exe extract `
+    "ChromieCraft_3.3.5a\Data\enUS\patch-enUS-4.MPQ" `
+    -o "$env:TEMP\paragon-dbc-extract"
+
+# Regenerate the SQL migration:
+python fractured-tooling\from-workspace-root\_gen_paragon_dbc_overlay_sql.py
+```
+
+If the regenerated SQL has new content, commit it as a **new** dated
+migration filename (e.g. `2026_06_01_00.sql`) — never edit a file that
+has already been applied to live databases, AC's DBUpdater will detect
+the hash change and re-run the SQL, which can be fine but is best
+reserved for emergencies.
+
+### Manual DBC overlay (rare, fallback)
+
+If you ever need the patched DBCs *on disk* — e.g. for a tool that
+reads `data/dbc/` directly outside the worldserver, or to verify a
+client-vs-server DBC mismatch — extract `patch-enUS-4.MPQ` and copy
+its `DBFilesClient/*.dbc` into `data/dbc/`:
+
+**Docker:**
+
+```powershell
+docker run --rm `
+  -v ac-client-data:/data `
+  -v ${PWD}\paragon-dbc-extract:/patch:ro `
+  alpine sh -c "cp -f /patch/*.dbc /data/dbc/"
+docker compose restart ac-worldserver
+```
+
+**Native:** copy into `<CMAKE_INSTALL_PREFIX>/data/dbc/` and restart.
+
+This is **not required** for normal operation — the SQL migration
+covers everything `mod-paragon` needs at runtime. Use the manual
+overlay only when you're consciously bypassing the SQL merge layer.
+
 ---

 ## Building the patches yourself
@@ -68,7 +246,13 @@ tools\build_paragon_advancement_patch.ps1 -Deploy   # -> patch-enUS-6.MPQ

 `patch-enUS-4.MPQ` is the DBC + GlueXML bake; the bake scripts live with
 the rest of the dev tooling and are not part of this repo by design
-(see the repo-tidy policy in `README.txt` next to this file).
+(see the repo-tidy policy in `README.txt` next to this file). Typical
+order on a maintainer machine:
+
+1. `fractured-tooling/from-workspace-root/_patch_spell_dbc_runes.py` — stage `Spell.dbc` with `RuneCostID` cleared.
+2. `fractured-tooling/from-workspace-root/_patch_spell_dbc_reagents.py` — same staged `Spell.dbc`, clear class-spell reagents for client preflight.
+3. `fractured-tooling/from-workspace-root/_patch_spell_dbc_stances.py` — same staged `Spell.dbc`, zero the `Stances` field on every `SpellFamilyName == 4` (Warrior) row so the client engine's "Must be in Battle/Defensive/Berserker Stance" pre-cast check stops eating `CMSG_CAST_SPELL` packets for Paragon casters who never picked the stance form. The server's `SpellInfo::CheckShapeshift` Paragon bypass takes over from there. Stock Warriors still see the server-side stance error mid-cast if they actually click while out of stance.
+4. `fractured-tooling/from-workspace-root/_make_paragon_dbc_patch.py` — rebuild `ChrClasses` / `CharBaseInfo` / game tables, then pack `patch-enUS-4.MPQ`.

 The patched `Wow.exe` is a one-time hex-edit of the stock 3.3.5a
 client. The diff is publicly documented in the WoW emulation community
@@ -6,6 +6,9 @@ AzerothCore. Upstream AzerothCore does not ship these paths.

 Contents:
 - BUILD-NATIVE.md — fork-specific native build notes (moved from repo root).
+- BALANCE-TODO.md — open balance / scaling questions raised by play-testers
+  that have not yet been actioned (e.g. Feral Cat scaling). Knock items off
+  as they ship.
 - CLAUDE.md — optional AI assistant context (moved from repo root).
 - CLIENT-PATCHES.md — what ships in a Fractured client release (MPQs +
  patched Wow.exe), where to download them (Releases page), and how
@@ -42,15 +42,26 @@ CREATE TABLE `realmlist` (
 --
 -- Dumping data for table `realmlist`
 --
-- Fractured defaults: `address` / `port` are the WORLD server (must match
-- WorldServerPort in worldserver.conf). Client auth uses RealmServerPort from
-- authserver.conf (Fractured dist: 47497), e.g. set realmlist hsrwow.net:47497
-- Adjust `localAddress` if your LAN/internal routing differs.
+-- Defaults are tuned for fresh local installs: `address` is what the auth
+-- server hands clients after login as the WORLD server endpoint. Stock
+-- 127.0.0.1 means "the same box auth is running on", so a fresh
+-- `git clone` -> `docker compose up` works without any post-install
+-- tweaks for a developer hosting on their own machine.
+--
+-- Production deployments must override `address` after first dbimport,
+-- e.g.:
+--     UPDATE realmlist SET address = 'your.public.host', port = 8085 WHERE id = 1;
+-- See contrib/fractured-dev-extras/BUILD-NATIVE.md for the full deploy
+-- checklist (auth/world ports, firewall, public hostnames).
+--
+-- `port` is the WORLD server port (must match WorldServerPort in
+-- worldserver.conf). The auth-server LISTEN port is separately configured
+-- via RealmServerPort in authserver.conf (stock default 3724).

 LOCK TABLES `realmlist` WRITE;
 /*!40000 ALTER TABLE `realmlist` DISABLE KEYS */;
 INSERT INTO `realmlist` VALUES
-(1,'Fractured WoW','hsrwow.net','127.0.0.1','255.255.255.0',8085,0,0,1,0,0,12340);
+(1,'Fractured WoW','127.0.0.1','127.0.0.1','255.255.255.0',8085,0,0,1,0,0,12340);
 /*!40000 ALTER TABLE `realmlist` ENABLE KEYS */;
 UNLOCK TABLES;

@@ -24,7 +24,7 @@ CREATE TABLE `world_state` (
  `Id` int unsigned NOT NULL COMMENT 'Internal save ID',
  `Data` longtext,
  PRIMARY KEY (`Id`)
-) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_0900_ai_ci COMMENT='WorldState save system';
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci COMMENT='WorldState save system';
 /*!40101 SET character_set_client = @saved_cs_client */;

 --
@@ -27,7 +27,7 @@ CREATE TABLE `player_shapeshift_model` (
  `GenderID` tinyint unsigned NOT NULL,
  `ModelID` int unsigned NOT NULL,
  PRIMARY KEY (`ShapeshiftID`,`RaceID`,`CustomizationID`,`GenderID`)
-) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_0900_ai_ci PACK_KEYS=0;
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci PACK_KEYS=0;
 /*!40101 SET character_set_client = @saved_cs_client */;

 --
@@ -25,7 +25,7 @@ CREATE TABLE `player_totem_model` (
  `RaceID` tinyint unsigned NOT NULL,
  `ModelID` int unsigned NOT NULL,
  PRIMARY KEY (`TotemID`,`RaceID`)
-) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_0900_ai_ci PACK_KEYS=0;
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci PACK_KEYS=0;
 /*!40101 SET character_set_client = @saved_cs_client */;

 --
@@ -12,6 +12,11 @@ Paragon.StickyComboPoints = 1
 # in addition to runes/runic power. Required for the patch-enUS-5.MPQ player
 # frame to populate Mana/Rage/Energy bars - otherwise the server treats those
 # powers as inactive and never sends max values, leaving the bars empty.
+# Also required for core rage generation: Unit::DealDamage only calls
+# RewardRage() when the attacker HasActivePowerType(POWER_RAGE); if this is off,
+# Paragon white swings never grant rage (users without this line in any loaded
+# config used to hit the C++ fallback default of false). Default is on; set 0
+# only if you intentionally want a stripped-down Paragon test build.
 Paragon.MultiResource.HasActivePowers = 1

 # Ability / Talent Essence (AE/TE) — Ascension-inspired currency
@@ -0,0 +1,62 @@
+-- mod-paragon Character Advancement: Build catalog (saved loadouts).
+-- ----------------------------------------------------------------------------
+-- A "build" is a named, icon-tagged loadout of panel-purchased spells and
+-- talent ranks. Each Paragon character can save many builds and swap
+-- between them via the Builds page in the Character Advancement panel.
+--
+-- Swap workflow (see HandleBuildLoad in Paragon_Builds.cpp):
+--   1. If a build is currently active, snapshot the player's current
+--      panel-purchased spells + per-spec talent ranks into that build's
+--      recipe rows (overwriting the stored recipe).
+--   2. If the active build's hunter pet is currently summoned, unsummon
+--      it to PET_SAVE_NOT_IN_SLOT and store its `pet_number` on the
+--      active build row so it can be restored on swap-back.
+--   3. Reset all panel-bought abilities and talents (refunding AE/TE).
+--   4. Re-buy each spell + talent in the target build's recipe (charging
+--      AE/TE; aborts if insufficient AE/TE -- player keeps refunded
+--      currency in that case and active becomes NULL).
+--   5. Move the target build's parked pet (if any) back to current.
+--   6. Update active_build pointer.
+--
+-- Pet ownership: a parked pet sits in `character_pet` with slot=100
+-- (PET_SAVE_NOT_IN_SLOT), exactly like the engine's stable-master
+-- offload, but tied to the build via `pet_number` instead of any
+-- in-game stable slot. Build deletion drops the parked pet rows
+-- entirely (PET_SAVE_AS_DELETED equivalent) -- player is warned.
+-- ----------------------------------------------------------------------------
+
+CREATE TABLE IF NOT EXISTS `character_paragon_builds` (
+    `build_id`    INT UNSIGNED   NOT NULL AUTO_INCREMENT,
+    `guid`        INT UNSIGNED   NOT NULL COMMENT 'characters.guid',
+    `name`        VARCHAR(32)    NOT NULL,
+    `icon`        VARCHAR(64)    NOT NULL DEFAULT 'INV_Misc_QuestionMark',
+    `is_favorite` TINYINT UNSIGNED NOT NULL DEFAULT 0,
+    `pet_number`  INT UNSIGNED   NULL COMMENT 'character_pet.id of parked hunter pet, NULL when no pet bound to this build',
+    `created_at`  TIMESTAMP      NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    PRIMARY KEY (`build_id`),
+    KEY `idx_guid` (`guid`)
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci
+    COMMENT='mod-paragon: saved Character Advancement build catalog';
+
+CREATE TABLE IF NOT EXISTS `character_paragon_build_spells` (
+    `build_id` INT UNSIGNED NOT NULL,
+    `spell_id` INT UNSIGNED NOT NULL,
+    PRIMARY KEY (`build_id`, `spell_id`)
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci
+    COMMENT='mod-paragon: per-build recipe -- panel-purchased spells';
+
+CREATE TABLE IF NOT EXISTS `character_paragon_build_talents` (
+    `build_id`  INT UNSIGNED      NOT NULL,
+    `spec`      TINYINT UNSIGNED  NOT NULL COMMENT '0 = primary spec, 1 = secondary (dual spec)',
+    `talent_id` SMALLINT UNSIGNED NOT NULL,
+    `rank`      TINYINT UNSIGNED  NOT NULL,
+    PRIMARY KEY (`build_id`, `spec`, `talent_id`)
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci
+    COMMENT='mod-paragon: per-build recipe -- panel-purchased talent ranks per spec';
+
+CREATE TABLE IF NOT EXISTS `character_paragon_active_build` (
+    `guid`     INT UNSIGNED NOT NULL COMMENT 'characters.guid',
+    `build_id` INT UNSIGNED NOT NULL COMMENT 'character_paragon_builds.build_id (per-character active pointer)',
+    PRIMARY KEY (`guid`)
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci
+    COMMENT='mod-paragon: pointer to whichever build is currently loaded (one row per Paragon character)';
@@ -0,0 +1,30 @@
+-- mod-paragon Character Advancement: Builds catalog schema cleanup.
+-- ----------------------------------------------------------------------------
+-- Two changes:
+--   1. Drop `is_favorite` -- the favorite flag and shift-click-to-favorite
+--      flow are removed. Builds are now ordered solely by build_id ASC.
+--   2. Add `share_code` CHAR(6) -- a random alphanumeric token generated
+--      server-side at build creation that uniquely identifies a saved
+--      build across the realm. Players exchange codes out-of-band and
+--      use the BuildsPane "Load Build!" share box to import a copy of
+--      the build (name + icon + spell + talent recipe) into their own
+--      catalog. The copy gets a fresh share_code so re-sharing is
+--      always traceable to the latest owner; the original isn't touched.
+--
+-- The column is NULL-tolerant so any rows that pre-date this migration
+-- (created under 2026_05_10_03's schema) coexist cleanly. The server
+-- backfills NULLs lazily in PushBuildCatalog -- the next time a player
+-- opens the BuildsPane on a Paragon character, any of their builds that
+-- still have a NULL share_code will get one generated and persisted.
+--
+-- Charset: 31 unambiguous chars (A-Z minus I/O minus 0/1) gives 31^6 ~=
+-- 887M codes; collision retry on insert keeps probability of a duplicate
+-- vanishing for any realistic catalog size.
+-- ----------------------------------------------------------------------------
+
+ALTER TABLE `character_paragon_builds`
+    DROP COLUMN `is_favorite`,
+    ADD COLUMN `share_code` CHAR(6) NULL DEFAULT NULL
+        COMMENT 'random alphanumeric token for import-by-code; lazily generated'
+        AFTER `icon`,
+    ADD UNIQUE INDEX `uk_share_code` (`share_code`);
@@ -0,0 +1,34 @@
+-- mod-paragon: preserve superseded share codes as importable snapshots.
+-- ----------------------------------------------------------------------------
+-- When an active build is updated (Learn All), the live row gets a new
+-- share_code and a fresh recipe. Older codes the player posted to Discord
+-- must keep working: each retired code is frozen here with its spell/talent
+-- recipe so `C BUILD IMPORT <code>` still materializes that exact loadout.
+-- ----------------------------------------------------------------------------
+
+CREATE TABLE IF NOT EXISTS `character_paragon_build_share_archive` (
+    `share_code` CHAR(6) NOT NULL COMMENT 'retired code (same charset as live builds)',
+    `name`       VARCHAR(32)  NOT NULL,
+    `icon`       VARCHAR(64)  NOT NULL DEFAULT 'INV_Misc_QuestionMark',
+    `archived_at` TIMESTAMP   NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    PRIMARY KEY (`share_code`)
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci
+    COMMENT='mod-paragon: frozen build metadata for retired share codes';
+
+CREATE TABLE IF NOT EXISTS `character_paragon_build_share_archive_spells` (
+    `share_code` CHAR(6)      NOT NULL,
+    `spell_id`   INT UNSIGNED NOT NULL,
+    PRIMARY KEY (`share_code`, `spell_id`),
+    KEY `idx_share` (`share_code`)
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci
+    COMMENT='mod-paragon: spell recipe rows for an archived share code';
+
+CREATE TABLE IF NOT EXISTS `character_paragon_build_share_archive_talents` (
+    `share_code` CHAR(6)       NOT NULL,
+    `spec`       TINYINT UNSIGNED NOT NULL,
+    `talent_id`  SMALLINT UNSIGNED NOT NULL,
+    `rank`       TINYINT UNSIGNED NOT NULL,
+    PRIMARY KEY (`share_code`, `spec`, `talent_id`),
+    KEY `idx_share` (`share_code`)
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci
+    COMMENT='mod-paragon: talent recipe rows for an archived share code';
@@ -21,6 +21,7 @@ INSERT INTO `paragon_spell_ae_cost` (`spell_id`, `ae_cost`) VALUES
    (10, 1),
    (17, 1),
    (53, 1),
+    (66, 1),
    (72, 1),
    (75, 1),
    (78, 1),
@@ -30,6 +31,7 @@ INSERT INTO `paragon_spell_ae_cost` (`spell_id`, `ae_cost`) VALUES
    (118, 1),
    (120, 1),
    (122, 1),
+    (126, 1),
    (130, 1),
    (131, 1),
    (132, 1),
@@ -52,6 +54,7 @@ INSERT INTO `paragon_spell_ae_cost` (`spell_id`, `ae_cost`) VALUES
    (469, 1),
    (475, 1),
    (498, 1),
+    (526, 1),
    (527, 1),
    (528, 1),
    (543, 1),
@@ -73,22 +76,28 @@ INSERT INTO `paragon_spell_ae_cost` (`spell_id`, `ae_cost`) VALUES
    (676, 1),
    (686, 1),
    (687, 1),
+    (688, 1),
    (689, 1),
+    (691, 1),
    (693, 1),
    (694, 1),
+    (697, 1),
    (698, 1),
    (702, 1),
    (703, 1),
    (706, 1),
    (710, 1),
+    (712, 1),
    (740, 1),
    (755, 1),
    (759, 1),
+    (768, 1),
    (770, 1),
    (772, 1),
    (774, 1),
    (779, 1),
    (781, 1),
+    (783, 1),
    (845, 1),
    (853, 1),
    (871, 1),
@@ -104,6 +113,7 @@ INSERT INTO `paragon_spell_ae_cost` (`spell_id`, `ae_cost`) VALUES
    (1038, 1),
    (1044, 1),
    (1064, 1),
+    (1066, 1),
    (1079, 1),
    (1082, 1),
    (1098, 1),
@@ -176,6 +186,7 @@ INSERT INTO `paragon_spell_ae_cost` (`spell_id`, `ae_cost`) VALUES
    (2812, 1),
    (2825, 1),
    (2893, 1),
+    (2894, 1),
    (2908, 1),
    (2912, 1),
    (2944, 1),
@@ -194,6 +205,7 @@ INSERT INTO `paragon_spell_ae_cost` (`spell_id`, `ae_cost`) VALUES
    (3565, 1),
    (3566, 1),
    (3567, 1),
+    (3714, 1),
    (3738, 1),
    (4987, 1),
    (5116, 1),
@@ -205,7 +217,9 @@ INSERT INTO `paragon_spell_ae_cost` (`spell_id`, `ae_cost`) VALUES
    (5185, 1),
    (5209, 1),
    (5211, 1),
-    (5215, 1),
+    (5215, 1);
+
+INSERT INTO `paragon_spell_ae_cost` (`spell_id`, `ae_cost`) VALUES
    (5217, 1),
    (5221, 1),
    (5225, 1),
@@ -215,11 +229,10 @@ INSERT INTO `paragon_spell_ae_cost` (`spell_id`, `ae_cost`) VALUES
    (5308, 1),
    (5384, 1),
    (5484, 1),
+    (5487, 1),
    (5500, 1),
    (5502, 1),
-    (5504, 1);
-
-INSERT INTO `paragon_spell_ae_cost` (`spell_id`, `ae_cost`) VALUES
+    (5504, 1),
    (5675, 1),
    (5676, 1),
    (5697, 1),
@@ -244,6 +257,8 @@ INSERT INTO `paragon_spell_ae_cost` (`spell_id`, `ae_cost`) VALUES
    (6770, 1),
    (6785, 1),
    (6789, 1),
+    (6795, 1),
+    (6807, 1),
    (6940, 1),
    (7294, 1),
    (7302, 1),
@@ -283,6 +298,7 @@ INSERT INTO `paragon_spell_ae_cost` (`spell_id`, `ae_cost`) VALUES
    (11418, 1),
    (11419, 1),
    (11420, 1),
+    (12051, 1),
    (13159, 1),
    (13161, 1),
    (13163, 1),
@@ -297,6 +313,7 @@ INSERT INTO `paragon_spell_ae_cost` (`spell_id`, `ae_cost`) VALUES
    (16857, 1),
    (16914, 1),
    (18499, 1),
+    (19263, 1),
    (19740, 1),
    (19742, 1),
    (19746, 1),
@@ -323,7 +340,6 @@ INSERT INTO `paragon_spell_ae_cost` (`spell_id`, `ae_cost`) VALUES
    (20252, 1),
    (20484, 1),
    (20736, 1),
-    (21084, 1),
    (21562, 1),
    (21849, 1),
    (22568, 1),
@@ -331,6 +347,8 @@ INSERT INTO `paragon_spell_ae_cost` (`spell_id`, `ae_cost`) VALUES
    (22812, 1),
    (22842, 1),
    (23028, 1),
+    (23161, 1),
+    (23214, 1),
    (23920, 1),
    (23922, 1),
    (24275, 1),
@@ -349,6 +367,7 @@ INSERT INTO `paragon_spell_ae_cost` (`spell_id`, `ae_cost`) VALUES
    (29722, 1),
    (29858, 1),
    (29893, 1),
+    (30449, 1),
    (30451, 1),
    (30455, 1),
    (30482, 1),
@@ -372,12 +391,14 @@ INSERT INTO `paragon_spell_ae_cost` (`spell_id`, `ae_cost`) VALUES
    (33745, 1),
    (33763, 1),
    (33786, 1),
+    (33943, 1),
    (34026, 1),
    (34074, 1),
    (34428, 1),
    (34433, 1),
    (34477, 1),
    (34600, 1),
+    (34767, 1),
    (35715, 1),
    (35717, 1),
    (36936, 1),
@@ -398,7 +419,9 @@ INSERT INTO `paragon_spell_ae_cost` (`spell_id`, `ae_cost`) VALUES
    (47541, 1),
    (47568, 1),
    (47897, 1),
-    (48018, 1),
+    (48018, 1);
+
+INSERT INTO `paragon_spell_ae_cost` (`spell_id`, `ae_cost`) VALUES
    (48020, 1),
    (48045, 1),
    (48263, 1),
@@ -416,14 +439,19 @@ INSERT INTO `paragon_spell_ae_cost` (`spell_id`, `ae_cost`) VALUES
    (49576, 1),
    (49998, 1),
    (50464, 1),
+    (50769, 1),
    (50842, 1),
+    (51505, 1),
+    (51514, 1),
    (51722, 1),
    (51723, 1),
-    (52610, 1);
-
-INSERT INTO `paragon_spell_ae_cost` (`spell_id`, `ae_cost`) VALUES
+    (51730, 1),
+    (52127, 1),
+    (52610, 1),
    (53140, 1),
    (53142, 1),
+    (53271, 1),
+    (53351, 1),
    (53407, 1),
    (53408, 1),
    (53600, 1),
@@ -432,15 +460,24 @@ INSERT INTO `paragon_spell_ae_cost` (`spell_id`, `ae_cost`) VALUES
    (54428, 1),
    (55342, 1),
    (55694, 1),
+    (56222, 1),
    (56641, 1),
+    (56815, 1),
+    (57330, 1),
    (57755, 1),
    (57934, 1),
    (57994, 1),
    (60192, 1),
    (61846, 1),
+    (61999, 1),
    (62078, 1),
    (62124, 1),
+    (62600, 1),
    (62757, 1),
    (64382, 1),
-    (64843, 1);
+    (64843, 1),
+    (64901, 1),
+    (66842, 1),
+    (66843, 1),
+    (66844, 1);

@@ -0,0 +1,270 @@
+-- mod-paragon: server-side DBC overlay for class 12 (Paragon).
+-- Auto-generated by fractured-tooling/from-workspace-root/
+--   _gen_paragon_dbc_overlay_sql.py
+--
+-- AzerothCore's DBCStores.cpp::LoadDBC merges every <table>_dbc
+-- world-DB row on top of the on-disk DBC store at startup
+-- (storage.LoadFromDB). We use that to ship Paragon's class-12
+-- DBC deltas in SQL form so a stock data/dbc/ tree (e.g. the
+-- vanilla `ac-wotlk-client-data` Docker image) still resolves
+-- class 12 in sChrClassesStore and class-12 entries in
+-- sSkillRaceClassInfoStore.
+--
+-- Without this migration, fresh installs hit:
+--     CHAR_CREATE_FAILED  -- "Class (12) not found in DBC ..."
+-- the moment a contributor tries to roll a Paragon character.
+--
+-- This file is regenerated end-to-end from patch-enUS-4.MPQ;
+-- do not hand-edit. Update the patched DBC source and rerun
+-- the bake script.
+
+-- chrclasses_dbc: classes added or modified by patch-enUS-4.MPQ.
+-- AzerothCore merges this on top of the on-disk ChrClasses.dbc
+-- so a stock data/dbc tree still gets class 12 at runtime.
+DELETE FROM `chrclasses_dbc` WHERE `ID` IN (12);
+INSERT INTO `chrclasses_dbc` (`ID`,`Field01`,`DisplayPower`,`PetNameToken`,`Name_Lang_enUS`,`Name_Lang_Mask`,`Name_Female_Lang_Mask`,`Name_Male_Lang_Mask`,`Filename`,`SpellClassSet`,`Flags`,`CinematicSequenceID`,`Required_Expansion`) VALUES
+  (12, 0, 0, 0, 'Paragon', 0, 0, 0, 'PARAGON', 4, 50, 0, 2);
+
+-- skillraceclassinfo_dbc: rows where patch-enUS-4 OR'd the
+-- class-12 bit (0x800) into ClassMask, opening every
+-- baseline skill to Paragon. Replaces the stock row by ID so
+-- AzerothCore picks the patched mask on the SQL merge pass.
+DELETE FROM `skillraceclassinfo_dbc` WHERE `ID` IN (
+  57,301,107,82,75,140,328,638,872,880,881,885,886,910,117,335,628,629,630,912,126,127,133,134,635,31,39,135,325,636,637,643,644,888,889,914,125,626,884,898,901,58,60,916,59,40,41,68,48,49,44,45,42,43,50,51,131,132,883,913,105,71,70,69,925,54,25,138,139,91,882,85,84,93,88,865,87,441,94,443,92,481,89,442,123,124,624,625,702,908,6,922,33,243,899,241,122,621,622,701,907,970,129,323,631,632,633,634,641,642,142,143,639,640,28,63,282,29,284,65,97,244,940,72,128,878,879,137,144,136,915,55,79,81,76,149,112,111,106,66,26,83,74,73,108,109,110,113,38,35,36,37,61,62,64,24,34,21,906,46,47,52,53,281,104,102,101,27,95,98,96,30,145,146,147,148,151,155,158,159,271,175,178,183,186,270,189,191,193,198,200,265,266,203,204,205,268,269,246,272,330,381,403,445,446,461,501,463,464,521,522,541,544,581,601,741,742,781,841,861,862,866,867,877,934,892,896,897,951,895,900,936,938,939,947
+);
+INSERT INTO `skillraceclassinfo_dbc` (`ID`,`SkillID`,`RaceMask`,`ClassMask`,`Flags`,`MinLevel`,`SkillTierID`,`SkillCostIndex`) VALUES
+  (57,6,-1,2176,1040,0,0,0),
+  (301,8,-1,2176,1040,0,0,0),
+  (107,26,-1,2049,1040,0,0,0),
+  (82,38,-1,2056,1040,0,0,0),
+  (75,39,-1,2056,1040,0,0,0),
+  (140,43,1115,2049,128,0,0,0),
+  (328,43,3071,2052,128,0,0,0),
+  (638,43,164,2049,128,0,0,0),
+  (872,43,32767,2056,128,0,0,0),
+  (880,43,1024,2052,128,0,0,0),
+  (881,43,32767,2432,128,0,0,0),
+  (885,43,1029,2050,128,0,0,0),
+  (886,43,512,2050,128,0,0,0),
+  (910,43,262143,2080,128,0,0,0),
+  (117,44,166,2052,128,0,0,0),
+  (335,44,2147483647,2122,128,0,0,0),
+  (628,44,1544,2052,128,0,0,0),
+  (629,44,167,2049,128,0,0,0),
+  (630,44,1112,2049,128,0,0,0),
+  (912,44,262143,2080,128,0,0,0),
+  (126,45,650,2052,128,0,0,0),
+  (127,45,32767,2061,128,0,0,0),
+  (133,46,36,2052,128,0,0,0),
+  (134,46,32767,2057,128,0,0,0),
+  (635,46,1674,2052,128,0,0,0),
+  (31,50,-1,2052,1040,0,0,0),
+  (39,51,-1,2052,1040,0,0,0),
+  (135,54,2147483647,2128,128,0,0,0),
+  (325,54,-1,2056,128,0,0,0),
+  (636,54,1133,2049,128,0,0,0),
+  (637,54,658,2049,128,0,0,0),
+  (643,54,8,3072,128,0,0,0),
+  (644,54,32,3072,128,0,0,0),
+  (888,54,261631,2050,128,0,0,0),
+  (889,54,512,2050,128,0,0,0),
+  (914,54,262143,2080,128,0,0,0),
+  (125,55,262143,2052,128,0,0,0),
+  (626,55,163839,2049,128,0,0,0),
+  (884,55,512,2050,128,0,0,0),
+  (898,55,262143,2080,128,0,0,0),
+  (901,55,261631,2050,128,0,0,0),
+  (58,56,-1,2064,1040,0,0,0),
+  (60,78,-1,2064,1040,0,0,0),
+  (916,95,524287,2080,640,0,0,0),
+  (59,96,2047,3072,1168,0,0,0),
+  (40,98,1101,3583,128,0,0,0),
+  (41,98,674,3551,160,0,21,0),
+  (68,101,4,3583,1170,0,0,0),
+  (48,109,690,3583,128,0,0,0),
+  (49,109,1101,3551,160,0,21,0),
+  (44,111,4,3583,128,0,0,0),
+  (45,111,2043,3551,160,0,21,0),
+  (42,113,8,3583,128,0,0,0),
+  (43,113,2039,3551,160,0,21,0),
+  (50,115,32,3583,128,0,0,0),
+  (51,115,2015,3551,160,0,21,0),
+  (131,118,32767,2056,146,1,0,0),
+  (132,118,32767,2053,146,20,0,0),
+  (883,118,32767,2112,402,0,0,0),
+  (913,118,262143,2080,146,0,0,0),
+  (105,120,2047,2304,1170,0,0,0),
+  (71,124,32,3583,1170,0,0,0),
+  (70,125,2,3583,146,0,0,0),
+  (69,126,8,3583,1170,0,0,0),
+  (925,129,-1,2080,128,0,63,0),
+  (54,130,2047,2176,1168,4,0,0),
+  (25,134,-1,3072,1040,10,0,0),
+  (138,136,32767,3536,128,0,0,0),
+  (139,136,32767,2053,128,0,0,0),
+  (91,137,1535,3551,160,0,21,0),
+  (882,137,512,3583,128,0,0,0),
+  (85,138,2047,3583,128,0,0,0),
+  (84,139,2047,3583,160,0,21,0),
+  (93,140,2047,3583,128,0,0,0),
+  (88,141,2047,3583,160,0,21,0),
+  (865,142,2047,3583,0,0,0,0),
+  (87,148,1,3551,1170,0,181,0),
+  (441,148,222,3583,1170,0,182,0),
+  (94,149,2,3551,1170,0,181,0),
+  (443,149,509,3583,1170,0,182,0),
+  (92,150,8,3551,1170,0,181,0),
+  (481,150,215,3583,1170,0,182,0),
+  (89,152,4,3551,1170,0,181,0),
+  (442,152,219,3583,1170,0,182,0),
+  (123,160,262143,2050,128,0,0,0),
+  (124,160,-1,3072,128,0,0,0),
+  (624,160,32,2049,128,0,0,0),
+  (625,160,262111,2049,128,0,0,0),
+  (702,160,-1,2112,128,0,0,0),
+  (908,160,262143,2080,128,0,0,0),
+  (6,162,2147483647,3551,128,0,0,0),
+  (922,162,262143,2080,128,0,0,0),
+  (33,163,-1,2052,1040,0,0,0),
+  (243,164,2047,3583,160,0,41,0),
+  (899,165,2047,3583,160,0,41,0),
+  (241,171,2047,3583,160,0,41,0),
+  (122,172,163839,2050,128,0,0,0),
+  (621,172,6,2049,128,0,0,0),
+  (622,172,1529,2049,128,0,0,0),
+  (701,172,163839,2112,128,0,0,0),
+  (907,172,524287,2080,128,0,0,0),
+  (970,172,163839,2052,128,0,0,0),
+  (129,173,32767,2312,128,0,0,0),
+  (323,173,32767,2256,128,0,0,0),
+  (631,173,520,2052,128,0,0,0),
+  (632,173,1190,2052,128,0,0,0),
+  (633,173,216,2049,128,0,0,0),
+  (634,173,1063,2049,128,0,0,0),
+  (641,173,32,3072,128,0,0,0),
+  (642,173,8,3072,128,0,0,0),
+  (142,176,-1,2056,128,0,0,0),
+  (143,176,-1,2052,128,0,0,0),
+  (639,176,128,2049,128,0,0,0),
+  (640,176,262015,2049,128,0,0,0),
+  (28,182,2047,3583,160,0,2,0),
+  (63,184,-1,2050,1040,0,0,0),
+  (282,185,2047,3583,128,0,61,0),
+  (29,186,2047,3583,160,0,2,0),
+  (284,197,2047,3583,160,0,62,0),
+  (65,198,2047,2050,1168,0,0,0),
+  (97,199,2047,2112,1168,0,0,0),
+  (244,202,2047,3583,160,0,41,0),
+  (940,205,524287,2176,2048,0,0,0),
+  (72,220,16,3583,1170,0,0,0),
+  (128,226,32767,2057,128,0,0,0),
+  (878,226,1024,2052,128,0,0,0),
+  (879,226,31743,2052,128,0,0,0),
+  (137,227,2047,3077,128,0,0,0),
+  (144,228,-1,2448,128,0,0,0),
+  (136,229,32767,3079,128,20,0,0),
+  (915,229,262143,2080,128,0,0,0),
+  (55,237,-1,2176,1040,0,0,0),
+  (79,238,2047,2056,1168,4,0,0),
+  (81,239,2047,2056,1168,0,0,0),
+  (76,241,2047,2056,128,40,0,0),
+  (149,242,2047,2056,1168,16,0,0),
+  (112,243,2047,2049,1170,0,0,0),
+  (111,244,2047,2049,1168,0,0,0),
+  (106,245,2047,2049,1168,0,0,0),
+  (66,246,2047,2050,1168,0,0,0),
+  (26,247,2047,3072,1168,20,0,0),
+  (83,252,2047,2057,128,0,0,0),
+  (74,253,-1,2056,1040,0,0,0),
+  (73,254,2047,2056,1168,10,0,0),
+  (108,255,2047,2049,1168,0,0,0),
+  (109,256,-1,2049,1040,0,0,0),
+  (110,257,-1,2049,1040,0,0,0),
+  (113,258,2047,2049,1168,10,0,0),
+  (38,260,2047,2052,128,0,0,0),
+  (35,262,2047,2052,128,0,0,0),
+  (36,263,2047,2052,128,0,0,0),
+  (37,264,2047,2052,128,0,0,0),
+  (61,267,-1,2050,1040,0,0,0),
+  (62,268,2047,2050,1170,0,0,0),
+  (64,269,2047,2050,1168,0,0,0),
+  (24,272,2047,3072,1168,10,0,0),
+  (34,273,2047,2052,128,0,0,0),
+  (21,293,2047,2051,128,40,0,0),
+  (906,293,262143,2080,128,0,0,0),
+  (46,313,64,3583,128,0,0,0),
+  (47,313,1983,3551,160,0,21,0),
+  (52,315,128,3583,128,0,0,0),
+  (53,315,1919,3551,160,0,21,0),
+  (281,333,2047,3583,160,0,62,0),
+  (104,353,2047,2304,1170,0,0,0),
+  (102,354,-1,2304,1040,0,0,0),
+  (101,355,-1,2304,1040,0,0,0),
+  (27,356,2047,3583,128,0,23,0),
+  (95,373,-1,2112,1040,0,0,0),
+  (98,374,262143,2112,1040,0,0,0),
+  (96,375,262143,2112,1040,0,0,0),
+  (30,393,2047,3583,160,0,161,0),
+  (145,413,2047,2116,128,40,0,0),
+  (146,413,2047,2083,128,0,0,0),
+  (147,414,2047,3183,128,0,0,0),
+  (148,415,2047,3583,128,0,0,0),
+  (151,416,2047,2049,192,0,0,0),
+  (155,416,2047,2050,192,0,0,1),
+  (158,416,2047,3136,192,0,0,1),
+  (159,416,2047,2060,192,0,0,1),
+  (271,416,2047,2448,192,0,0,2),
+  (175,418,2047,2049,384,0,0,0),
+  (178,418,2047,2050,384,0,0,0),
+  (183,418,2047,3332,384,0,0,1),
+  (186,418,2047,2192,384,0,0,1),
+  (270,418,2047,2120,384,0,0,1),
+  (189,419,2047,2060,640,0,0,2),
+  (191,419,2047,3072,640,0,0,1),
+  (193,419,2047,2192,640,0,0,0),
+  (198,419,2047,2050,640,0,0,1),
+  (200,419,2047,2049,640,0,0,2),
+  (265,419,2047,2304,640,0,0,0),
+  (266,419,2047,2112,640,0,0,1),
+  (203,420,2047,2061,1152,0,0,2),
+  (204,420,2047,3074,1152,0,0,1),
+  (205,420,2047,2320,1152,0,0,0),
+  (268,420,2047,2176,1152,0,0,0),
+  (269,420,2047,2112,1152,0,0,1),
+  (246,433,2047,2115,128,0,0,0),
+  (272,453,2047,2051,128,0,0,0),
+  (330,473,4095,3149,130,0,0,0),
+  (381,493,8,3583,164,0,0,0),
+  (403,515,2047,3551,128,0,0,0),
+  (445,533,128,3583,1170,0,181,0),
+  (446,533,95,3551,1170,0,182,0),
+  (461,553,64,3551,1170,0,181,0),
+  (501,553,4,3583,1170,0,182,0),
+  (463,554,16,3551,1170,0,181,0),
+  (464,554,207,3583,1170,0,182,0),
+  (521,573,-1,3072,1040,0,0,0),
+  (522,574,-1,3072,1040,0,0,0),
+  (541,593,-1,2304,1040,0,0,0),
+  (544,594,-1,2050,1040,0,0,0),
+  (581,613,-1,2064,1040,0,0,0),
+  (601,633,-1,2056,128,0,0,0),
+  (741,673,16,3583,128,0,0,0),
+  (742,673,2031,3551,160,0,21,0),
+  (781,713,255,3583,1170,0,181,0),
+  (841,733,128,3583,1170,0,0,0),
+  (861,753,64,3583,1170,0,0,0),
+  (862,754,1,3583,1170,0,0,0),
+  (866,755,2047,3583,160,0,41,0),
+  (867,756,512,3583,146,0,0,0),
+  (877,760,1024,3583,146,0,0,0),
+  (934,762,524287,2080,144,0,223,0),
+  (892,769,32767,3583,1040,0,0,0),
+  (896,770,-1,2080,1040,0,0,0),
+  (897,771,262143,2080,1040,0,0,0),
+  (951,771,2097151,3583,0,0,0,0),
+  (895,772,-1,2080,1040,0,0,0),
+  (900,773,262143,3583,160,0,41,0),
+  (936,776,262143,2080,128,0,0,0),
+  (938,777,524287,3583,2,0,0,0),
+  (939,778,524287,3583,2,0,0,0),
+  (947,778,2097151,3583,0,0,0,0);
@@ -0,0 +1,179 @@
+-- mod-paragon: starter spawn data for class 12 (Paragon).
+--
+-- Companion to 2026_05_09_00.sql. The DBC overlay teaches the world
+-- server that class 12 exists; this migration teaches it WHERE
+-- characters of that class spawn, what action bar they boot with,
+-- and what per-level base stats to integrity-check against.
+--
+-- Without these rows, character creation fails inside Player::Create:
+--
+--   PlayerInfo const* info = sObjectMgr->GetPlayerInfo(race, class);
+--   if (!info) {
+--       LOG_ERROR("entities.player",
+--           "Player::Create: ... invalid race/class pair ({}/{})"
+--           " - refusing to do so.", ..., race, class);
+--       return false;          // -> client sees "Error creating character"
+--   }
+--
+-- and on world load the player_class_stats integrity check trips:
+--
+--   "Class N Level L does not have stats data!"
+--
+-- Tables touched:
+--   - playercreateinfo         : (race, class=12) -> map/zone/x/y/z
+--                                Race-specific starting zones (Paragon
+--                                spawns in each race's standard newbie
+--                                area, NOT Acherus, since it is a
+--                                from-level-1 class).
+--   - playercreateinfo_action  : (race, class=12, button) -> action,type
+--                                Default action bar layout per race.
+--   - player_class_stats       : (class=12, level 1..80) -> base stats
+--                                Per-level HP/Mana/STR/AGI/STA/INT/SPI
+--                                used by Player::InitStatsForLevel.
+--
+-- Tables intentionally NOT touched here:
+--   - playercreateinfo_item    : Paragon ships no per-class starting
+--                                items; gear comes from the racial
+--                                kit only.
+--   - playercreateinfo_skills  / _cast_spell / _spell_custom :
+--                                These are mask-based. Class-12 baseline
+--                                weapon/defense skills come through
+--                                classMask=0 ("all classes") rows that
+--                                already cover Paragon. The DBC overlay
+--                                in 2026_05_09_00.sql opens
+--                                SkillRaceClassInfo for class 12.
+
+-- Idempotent: blow away any pre-existing class-12 rows first so this
+-- migration can be replayed cleanly on a partially-seeded DB (e.g.
+-- after a contributor manually patched their local DB before this
+-- migration landed).
+DELETE FROM `playercreateinfo`        WHERE `class` = 12;
+DELETE FROM `playercreateinfo_action` WHERE `class` = 12;
+DELETE FROM `player_class_stats`      WHERE `Class` = 12;
+
+-- ---------------------------------------------------------------
+-- playercreateinfo (10 rows: every DK-eligible race, racial start)
+-- ---------------------------------------------------------------
+INSERT INTO `playercreateinfo` (`race`, `class`, `map`, `zone`, `position_x`, `position_y`, `position_z`, `orientation`) VALUES
+  ( 1, 12,   0,   12,  -8949.95,   -132.493,    83.5312,  0       ), -- Human       -> Northshire, Elwynn Forest
+  ( 2, 12,   1,   14,   -618.518, -4251.67,     38.718,   0       ), -- Orc         -> Valley of Trials, Durotar
+  ( 3, 12,   0,    1,  -6240.32,   331.033,    382.758,   6.17716 ), -- Dwarf       -> Coldridge Valley, Dun Morogh
+  ( 4, 12,   1,  141,  10311.3,    832.463,   1326.41,    5.69632 ), -- Night Elf   -> Shadowglen, Teldrassil
+  ( 5, 12,   0,   85,   1676.71,  1678.31,    121.67,     2.70526 ), -- Undead      -> Deathknell, Tirisfal
+  ( 6, 12,   1,  215,  -2917.58,  -257.98,     52.9968,   0       ), -- Tauren      -> Camp Narache, Mulgore
+  ( 7, 12,   0,    1,  -6240.32,   331.033,    382.758,   0       ), -- Gnome       -> Coldridge Valley (shared)
+  ( 8, 12,   1,   14,   -618.518, -4251.67,     38.718,   0       ), -- Troll       -> Valley of Trials (shared)
+  (10, 12, 530, 3431,  10349.6,  -6357.29,     33.4026,   5.31605 ), -- Blood Elf   -> Sunstrider Isle, Eversong
+  (11, 12, 530, 3526,  -3961.64,-13931.2,     100.615,    2.08364 ); -- Draenei     -> Ammen Vale, Azuremyst Isle
+
+-- ---------------------------------------------------------------
+-- playercreateinfo_action (46 rows)
+-- Buttons: 72=Attack(6603), 73=Eat(78), 74=racial, 75=race-extra,
+--          82=Skinning(59752, Tauren only), 84=Attack, 96=Attack
+-- ---------------------------------------------------------------
+INSERT INTO `playercreateinfo_action` (`race`, `class`, `button`, `action`, `type`) VALUES
+  ( 1, 12, 72,  6603, 0), ( 1, 12, 73,    78, 0), ( 1, 12, 82, 59752, 0),
+  ( 1, 12, 84,  6603, 0), ( 1, 12, 96,  6603, 0),
+  ( 2, 12, 72,  6603, 0), ( 2, 12, 73,    78, 0), ( 2, 12, 74, 20572, 0),
+  ( 2, 12, 84,  6603, 0), ( 2, 12, 96,  6603, 0),
+  ( 3, 12, 72,  6603, 0), ( 3, 12, 73,    78, 0), ( 3, 12, 74, 20594, 0),
+  ( 3, 12, 75,  2481, 0), ( 3, 12, 84,  6603, 0), ( 3, 12, 96,  6603, 0),
+  ( 4, 12, 72,  6603, 0), ( 4, 12, 73,    78, 0), ( 4, 12, 74, 58984, 0),
+  ( 4, 12, 84,  6603, 0), ( 4, 12, 96,  6603, 0),
+  ( 5, 12, 72,  6603, 0), ( 5, 12, 73,    78, 0), ( 5, 12, 74, 20577, 0),
+  ( 5, 12, 84,  6603, 0), ( 5, 12, 96,  6603, 0),
+  ( 6, 12, 72,  6603, 0), ( 6, 12, 73,    78, 0), ( 6, 12, 74, 20549, 0),
+  ( 6, 12, 84,  6603, 0), ( 6, 12, 96,  6603, 0),
+  ( 7, 12, 72,  6603, 0), ( 7, 12, 73,    78, 0), ( 7, 12, 84,  6603, 0),
+  ( 7, 12, 96,  6603, 0),
+  ( 8, 12, 72,  6603, 0), ( 8, 12, 73,    78, 0), ( 8, 12, 74,  2764, 0),
+  ( 8, 12, 75, 26297, 0), ( 8, 12, 84,  6603, 0), ( 8, 12, 96,  6603, 0),
+  (11, 12, 72,  6603, 0), (11, 12, 73,    78, 0), (11, 12, 74, 28880, 0),
+  (11, 12, 84,  6603, 0), (11, 12, 96,  6603, 0);
+
+-- ---------------------------------------------------------------
+-- player_class_stats (80 rows: levels 1..80 per-class base stats)
+-- Curve mirrors Warrior baseline -> Paladin past 60 (vehicle-style HP
+-- inflation past 60 to keep Paragon competitive in Wrath content).
+-- ---------------------------------------------------------------
+INSERT INTO `player_class_stats` (`Class`, `Level`, `BaseHP`, `BaseMana`, `Strength`, `Agility`, `Stamina`, `Intellect`, `Spirit`) VALUES
+  (12,  1,   20,   60,  23,  20,  22, 20, 20),
+  (12,  2,   29,   66,  24,  21,  23, 20, 20),
+  (12,  3,   38,   73,  25,  21,  24, 20, 21),
+  (12,  4,   47,   81,  26,  22,  25, 20, 21),
+  (12,  5,   56,   90,  28,  23,  26, 20, 21),
+  (12,  6,   65,  100,  29,  24,  27, 21, 21),
+  (12,  7,   74,  111,  30,  24,  28, 21, 22),
+  (12,  8,   83,  123,  31,  25,  29, 21, 22),
+  (12,  9,   92,  136,  32,  26,  30, 21, 22),
+  (12, 10,   97,  150,  33,  26,  31, 21, 23),
+  (12, 11,  103,  165,  35,  27,  33, 21, 23),
+  (12, 12,  109,  182,  36,  28,  34, 21, 23),
+  (12, 13,  118,  200,  37,  29,  35, 21, 24),
+  (12, 14,  128,  219,  39,  30,  36, 22, 24),
+  (12, 15,  139,  239,  40,  30,  37, 22, 24),
+  (12, 16,  151,  260,  41,  31,  38, 22, 25),
+  (12, 17,  154,  282,  42,  32,  40, 22, 25),
+  (12, 18,  168,  305,  44,  33,  41, 22, 25),
+  (12, 19,  183,  329,  45,  34,  42, 22, 26),
+  (12, 20,  199,  354,  47,  35,  43, 22, 26),
+  (12, 21,  206,  380,  48,  35,  45, 23, 26),
+  (12, 22,  224,  392,  49,  36,  46, 23, 27),
+  (12, 23,  243,  420,  51,  37,  47, 23, 27),
+  (12, 24,  253,  449,  52,  38,  49, 23, 28),
+  (12, 25,  274,  479,  54,  39,  50, 23, 28),
+  (12, 26,  296,  509,  55,  40,  51, 23, 28),
+  (12, 27,  309,  524,  57,  41,  53, 23, 29),
+  (12, 28,  333,  554,  58,  42,  54, 24, 29),
+  (12, 29,  348,  584,  60,  43,  56, 24, 30),
+  (12, 30,  374,  614,  62,  44,  57, 24, 30),
+  (12, 31,  401,  629,  63,  45,  58, 24, 30),
+  (12, 32,  419,  659,  65,  46,  60, 24, 31),
+  (12, 33,  448,  689,  66,  47,  61, 24, 31),
+  (12, 34,  468,  704,  68,  48,  63, 25, 32),
+  (12, 35,  499,  734,  70,  49,  64, 25, 32),
+  (12, 36,  521,  749,  72,  50,  66, 25, 33),
+  (12, 37,  545,  779,  73,  51,  68, 25, 33),
+  (12, 38,  581,  809,  75,  52,  69, 25, 33),
+  (12, 39,  609,  824,  77,  53,  71, 26, 34),
+  (12, 40,  649,  854,  79,  54,  72, 26, 34),
+  (12, 41,  681,  869,  80,  56,  74, 26, 35),
+  (12, 42,  715,  899,  82,  57,  76, 26, 35),
+  (12, 43,  761,  914,  84,  58,  77, 26, 36),
+  (12, 44,  799,  944,  86,  59,  79, 26, 36),
+  (12, 45,  839,  959,  88,  60,  81, 27, 37),
+  (12, 46,  881,  989,  90,  61,  83, 27, 37),
+  (12, 47,  935, 1004,  92,  63,  84, 27, 38),
+  (12, 48,  981, 1019,  94,  64,  86, 27, 38),
+  (12, 49, 1029, 1049,  96,  65,  88, 28, 39),
+  (12, 50, 1079, 1064,  98,  66,  90, 28, 39),
+  (12, 51, 1131, 1079, 100,  68,  92, 28, 40),
+  (12, 52, 1185, 1109, 102,  69,  94, 28, 40),
+  (12, 53, 1241, 1124, 104,  70,  96, 28, 41),
+  (12, 54, 1299, 1139, 106,  72,  98, 29, 42),
+  (12, 55, 1359, 1154, 109,  73, 100, 29, 42),
+  (12, 56, 1421, 1169, 111,  74, 102, 29, 43),
+  (12, 57, 1485, 1199, 113,  76, 104, 29, 43),
+  (12, 58, 1551, 1214, 115,  77, 106, 30, 44),
+  (12, 59, 1619, 1229, 118,  79, 108, 30, 44),
+  (12, 60, 1689, 1244, 120,  80, 110, 30, 45),
+  (12, 61, 1902, 1357, 122,  81, 112, 30, 46),
+  (12, 62, 2129, 1469, 125,  83, 114, 30, 46),
+  (12, 63, 2357, 1582, 127,  84, 117, 31, 47),
+  (12, 64, 2612, 1694, 130,  86, 119, 31, 47),
+  (12, 65, 2883, 1807, 132,  88, 121, 31, 48),
+  (12, 66, 3169, 1919, 135,  89, 123, 32, 49),
+  (12, 67, 3455, 2032, 137,  91, 126, 32, 49),
+  (12, 68, 3774, 2145, 140,  92, 128, 32, 50),
+  (12, 69, 4109, 2257, 142,  94, 130, 32, 51),
+  (12, 70, 4444, 2370, 145,  96, 133, 33, 51),
+  (12, 71, 4720, 2482, 148,  97, 135, 33, 52),
+  (12, 72, 5013, 2595, 150,  99, 138, 33, 53),
+  (12, 73, 5325, 2708, 153, 101, 140, 33, 54),
+  (12, 74, 5656, 2820, 156, 102, 143, 34, 54),
+  (12, 75, 6008, 2933, 159, 104, 145, 34, 55),
+  (12, 76, 6381, 3045, 162, 106, 148, 34, 56),
+  (12, 77, 6778, 3158, 165, 108, 151, 35, 57),
+  (12, 78, 7198, 3270, 168, 109, 153, 35, 57),
+  (12, 79, 7646, 3383, 171, 111, 156, 35, 58),
+  (12, 80, 8121, 3496, 174, 113, 159, 36, 59);
@@ -0,0 +1,50 @@
+-- mod-paragon: starter weapon / armor skills for class 12 (Paragon).
+--
+-- Companion to 2026_05_10_00.sql. The spawn-data migration teaches
+-- Player::Create *that* class 12 exists at a given race; this one
+-- teaches it which weapon and armor skill lines to grant on first
+-- character login.
+--
+-- Without these rows a fresh Paragon character lands in their newbie
+-- zone with **no** weapon or armor proficiencies (auto-attack greys
+-- out the moment they equip anything beyond a fist). The classMask=0
+-- "all classes" rows in playercreateinfo_skills only cover Defense,
+-- Unarmed, Cloth, the racial / language skills, Mounts and
+-- Companion Pets -- which is exactly what bare-fisted, naked
+-- characters look like.
+--
+-- Paragon plays every class, so it grants every weapon / armor
+-- proficiency at level 1. The skillline rows themselves are still
+-- gated by skillraceclassinfo_dbc (handled in 2026_05_09_00.sql),
+-- so the client/server agree on what's allowed.
+--
+-- Idempotent: deletes any pre-existing classMask=2048 rows first
+-- (class 12 owns this bitmask on Fractured) so the migration can
+-- replay cleanly on a partially-seeded DB.
+
+DELETE FROM `playercreateinfo_skills` WHERE `classMask` = 2048;
+
+INSERT INTO `playercreateinfo_skills`
+  (`raceMask`, `classMask`, `skill`, `rank`, `comment`) VALUES
+  -- Weapon proficiencies
+  (0, 2048,  43, 0, 'Paragon - Swords'),
+  (0, 2048,  44, 0, 'Paragon - Axes'),
+  (0, 2048,  45, 0, 'Paragon - Bows'),
+  (0, 2048,  46, 0, 'Paragon - Guns'),
+  (0, 2048,  54, 0, 'Paragon - Maces'),
+  (0, 2048,  55, 0, 'Paragon - Two-Handed Swords'),
+  (0, 2048, 118, 0, 'Paragon - Dual Wield'),
+  (0, 2048, 136, 0, 'Paragon - Staves'),
+  (0, 2048, 160, 0, 'Paragon - Two-Handed Maces'),
+  (0, 2048, 172, 0, 'Paragon - Two-Handed Axes'),
+  (0, 2048, 173, 0, 'Paragon - Daggers'),
+  (0, 2048, 176, 0, 'Paragon - Thrown'),
+  (0, 2048, 226, 0, 'Paragon - Crossbows'),
+  (0, 2048, 228, 0, 'Paragon - Wands'),
+  (0, 2048, 229, 0, 'Paragon - Polearms'),
+  (0, 2048, 473, 0, 'Paragon - Fist Weapons'),
+  -- Armor proficiencies (Cloth is in a classMask=0 row already)
+  (0, 2048, 293, 0, 'Paragon - Plate Mail'),
+  (0, 2048, 413, 0, 'Paragon - Mail'),
+  (0, 2048, 414, 0, 'Paragon - Leather'),
+  (0, 2048, 433, 0, 'Paragon - Shield');
@@ -0,0 +1,27 @@
+-- mod-paragon: Blood Elf "Arcane Torrent" uses three spell IDs in WotLK
+-- (28730 mana/casters, 25046 rogue energy, 50613 death knight runic power),
+-- all on racial skill line 756. Migration 2026_05_10_02 OR'd class 12 into
+-- every SkillLineAbility delta from patch-enUS-4, so Paragon Blood Elves
+-- auto-learned all three and the spellbook showed three identical entries.
+--
+-- Paragon should learn a single combined Arcane Torrent that refunds mana,
+-- energy, AND runic power -- whichever pool the character is using at the
+-- moment. We keep spell 28730 as the in-book entry for class 12 and attach
+-- the SpellScript spell_paragon_arcane_torrent (modules/mod-paragon/src/
+-- Paragon_SC.cpp) so casts by a Paragon also EnergizeBySpell energy + RP on
+-- top of the stock mana effect. Other classes' Blood Elves are unaffected.
+--
+-- IDs 13338 / 17510 match stock WotLK SkillLineAbility rows for spells 25046
+-- / 50613 on skill line 756.
+
+UPDATE `skilllineability_dbc`
+SET `ClassMask` = `ClassMask` & ~2048
+WHERE `ID` IN (13338, 17510);
+
+-- Bind spell_paragon_arcane_torrent (defined in Paragon_SC.cpp) to spell
+-- 28730. AC's `spell_script_names` is the standard mapping: script name on
+-- the right, spell id on the left. Idempotent via DELETE + INSERT.
+DELETE FROM `spell_script_names`
+WHERE `spell_id` = 28730 AND `ScriptName` = 'spell_paragon_arcane_torrent';
+INSERT INTO `spell_script_names` (`spell_id`, `ScriptName`) VALUES
+  (28730, 'spell_paragon_arcane_torrent');
@@ -0,0 +1,30 @@
+-- mod-paragon: extend ItemTemplate::AllowableClass to include class 12
+-- (Paragon, bit 1<<11 = 2048) for every class-restricted item.
+--
+-- Server-side, Player::CanUseItem (PlayerStorage.cpp) already short-
+-- circuits the AllowableClass check for class 12. That's enough for any
+-- code path the server controls (vendor list filter, AH "usable" filter,
+-- CanRollForItemInLFG, CanBuyItem). It is NOT enough on the 3.3.5 client:
+-- the WoW.exe binary independently pre-checks AllowableClass against the
+-- player's class on right-click of a bag item and refuses *locally* with
+-- the red "You can't use that item." text in UIErrorsFrame, never sending
+-- CMSG_USE_ITEM at all. Server logs stay silent; only client knows it
+-- refused.
+--
+-- Fix: OR class 12's bit into AllowableClass on every class-restricted
+-- row so the client engine's pre-check passes for Paragon. Other
+-- classes' bits are unchanged, so e.g. a warrior-only item is still
+-- warrior-only for everyone except Paragon. Items with AllowableClass
+-- == -1 ("all classes") or 0 ("no restriction recorded") already pass
+-- the client engine's check and are not touched.
+--
+-- After applying this migration the *client* still caches item info in
+-- Cache/<locale>/itemcache.wdb. Players who already inspected the item
+-- before the change must delete that file (or the whole Cache folder)
+-- and reconnect to repopulate it from the worldserver, otherwise the
+-- stale cached AllowableClass keeps the engine pre-check failing.
+
+UPDATE `item_template`
+   SET `AllowableClass` = `AllowableClass` | 2048
+ WHERE `AllowableClass` > 0
+   AND (`AllowableClass` & 2048) = 0;
@@ -0,0 +1,62 @@
+-- mod-paragon: backfill paragon_spell_ae_cost rows for spells newly exposed
+-- by the Character Advancement panel after removing the over-aggressive
+-- ClassMask=0 filter from tools/_gen_paragon_advancement_spells_lua.py.
+--
+-- The base file (data/sql/db-world/base/paragon_spell_ae_cost.sql) was
+-- regenerated alongside this migration so fresh deployments already have
+-- these rows. Existing servers do not re-run base files on content change,
+-- so this update inserts the new (spell_id, ae_cost) pairs idempotently.
+-- INSERT IGNORE keeps any per-row tuning a server operator may have already
+-- applied to spell_ids that happen to overlap.
+--
+-- New ids include: 51505 Lava Burst (Shaman), 12051 Evocation / 1066 Aqueous
+-- Form / Hex / Mage Ward / Spellsteal (Mage), 53351 Kill Shot / 19263
+-- Deterrence / 53271 Master's Call (Hunter), 3714 Path of Frost / 57330
+-- Horn of Winter / 56815 Rune Strike / 61999 Raise Ally / 56222 Dark Command
+-- (DK), and 39 other trainer-taught class abilities whose stock
+-- SkillLineAbility.dbc rows have ClassMask=0 (the skill line itself pins the
+-- class for these rows; ClassMask is redundant on class-spec lines).
+
+INSERT IGNORE INTO `paragon_spell_ae_cost` (`spell_id`, `ae_cost`) VALUES
+    (66, 1),     -- Invisibility (Mage)
+    (126, 1),    -- Eye of Kilrogg (Warlock)
+    (526, 1),    -- Cure Toxins (Shaman)
+    (688, 1),    -- Summon Imp (Warlock)
+    (691, 1),    -- Summon Felhunter (Warlock)
+    (697, 1),    -- Summon Voidwalker (Warlock)
+    (712, 1),    -- Summon Succubus (Warlock)
+    (768, 1),    -- Cat Form (Druid)
+    (783, 1),    -- Travel Form (Druid)
+    (1066, 1),   -- Aqueous Form (Mage)
+    (2894, 1),   -- Fire Resistance Totem (Shaman)
+    (3714, 1),   -- Path of Frost (DK)
+    (5215, 1),   -- Prowl (Druid)
+    (5487, 1),   -- Bear Form (Druid)
+    (5504, 1),   -- Conjure Refreshment (Mage)
+    (6795, 1),   -- Growl (Druid)
+    (6807, 1),   -- Maul (Druid)
+    (12051, 1),  -- Evocation (Mage)
+    (19263, 1),  -- Deterrence (Hunter)
+    (23161, 1),  -- Summon Dreadsteed (Warlock)
+    (23214, 1),  -- Summon Charger (Paladin)
+    (30449, 1),  -- Spellsteal (Mage)
+    (33943, 1),  -- Flight Form (Druid)
+    (34767, 1),  -- Summon Felguard (Warlock)
+    (48018, 1),  -- Demonic Circle: Summon (Warlock)
+    (50769, 1),  -- Revive (Druid)
+    (51505, 1),  -- Lava Burst (Shaman)
+    (51514, 1),  -- Hex (Shaman)
+    (51730, 1),  -- Earthliving Weapon (Shaman)
+    (52127, 1),  -- Water Shield (Shaman)
+    (52610, 1),  -- Savage Roar (Druid)
+    (53271, 1),  -- Master's Call (Hunter)
+    (53351, 1),  -- Kill Shot (Hunter)
+    (56222, 1),  -- Dark Command (DK)
+    (56815, 1),  -- Rune Strike (DK)
+    (57330, 1),  -- Horn of Winter (DK)
+    (61999, 1),  -- Raise Ally (DK)
+    (64843, 1),  -- Divine Hymn (Priest)
+    (64901, 1),  -- Hymn of Hope (Priest)
+    (66842, 1),  -- Call of the Elements (Shaman totem set)
+    (66843, 1),  -- Call of the Ancestors (Shaman totem set)
+    (66844, 1);  -- Call of the Spirits (Shaman totem set)
@@ -0,0 +1,60 @@
+-- mod-paragon: Predatory Strikes (16972 / 16974 / 16975) Cataclysm-style
+-- finisher proc for CLASS_PARAGON characters.
+--
+-- The 3.3.5 Predatory Strikes is a passive AP / ranged-attack-power talent
+-- with no proc payload. The Cataclysm redesign added "Predator's Swiftness"
+-- (69369), which makes the next Nature spell <10s base cast time instant.
+-- That buff already exists in the WotLK Spell.dbc (because Blizzard reused
+-- the spell id), but no server-side trigger ever calls CastSpell(69369) on
+-- a 3.3.5 server. We need both halves: the proc handler AND a spell_proc
+-- row so the proc evaluator actually invokes our AuraScript.
+--
+-- AuraScript binding: spell_paragon_predatory_strikes is registered in
+-- modules/mod-paragon/src/Paragon_SC.cpp. It checks
+--   (a) caster is CLASS_PARAGON,
+--   (b) source spell consumes combo points (NeedsComboPoints),
+--   (c) source spell deals damage (DmgClass MELEE/RANGED + at least one
+--       damage effect or periodic-damage aura -- filters Slice and Dice,
+--       Savage Roar, Maim, Kidney Shot, Expose Armor, Recuperate),
+-- then rolls a per-rank chance of (CP * 3 / 5 / 7)% to cast 69369 on
+-- the caster.
+--
+-- spell_proc row params:
+--   ProcFlags        = 0x40000 = PROC_FLAG_DONE_SPELL_MELEE_DMG_CLASS
+--   SpellTypeMask    = 0x3 (DAMAGE | HEAL bitmask in proc engine; we
+--                            filter precisely in CheckProc anyway, the
+--                            mask just gates "spell-type events" through)
+--   SpellPhaseMask   = 0x2 = PROC_SPELL_PHASE_CAST -- fires DURING cast
+--                            so player->GetComboPoints() inside HandleProc
+--                            still returns the pre-_handle_finish_phase
+--                            value.
+--   Chance           = 100  (the per-CP chance is rolled inside the script)
+--
+-- Note: this row's SpellFamilyName / SpellFamilyMask are 0 so the proc
+-- engine's IsAffected check is a wildcard at the entry-level. The
+-- AuraScript's CheckProc owns all real filtering. Combined with Phase A
+-- (Paragon SpellFamilyName wildcard) this is harmless on stock classes
+-- because non-Paragon characters cannot learn Predatory Strikes via the
+-- Character Advancement panel.
+
+DELETE FROM `spell_script_names`
+ WHERE `spell_id` IN (16972, 16974, 16975)
+   AND `ScriptName` = 'spell_paragon_predatory_strikes';
+
+INSERT INTO `spell_script_names` (`spell_id`, `ScriptName`) VALUES
+    (16972, 'spell_paragon_predatory_strikes'),
+    (16974, 'spell_paragon_predatory_strikes'),
+    (16975, 'spell_paragon_predatory_strikes');
+
+DELETE FROM `spell_proc` WHERE `SpellId` IN (16972, 16974, 16975);
+
+INSERT INTO `spell_proc`
+    (`SpellId`, `SchoolMask`, `SpellFamilyName`,
+     `SpellFamilyMask0`, `SpellFamilyMask1`, `SpellFamilyMask2`,
+     `ProcFlags`, `SpellTypeMask`, `SpellPhaseMask`, `HitMask`,
+     `AttributesMask`, `DisableEffectsMask`, `ProcsPerMinute`,
+     `Chance`, `Cooldown`, `Charges`)
+VALUES
+    (16972, 0, 0, 0, 0, 0, 0x40000, 0x3, 0x2, 0, 0, 0, 0, 100.0, 0, 0),
+    (16974, 0, 0, 0, 0, 0, 0x40000, 0x3, 0x2, 0, 0, 0, 0, 100.0, 0, 0),
+    (16975, 0, 0, 0, 0, 0, 0x40000, 0x3, 0x2, 0, 0, 0, 0, 100.0, 0, 0);
@@ -0,0 +1,46 @@
+-- mod-paragon: Vampiric Embrace (15286) cross-family wildcard.
+--
+-- Stock 3.3.5 spell_proc row for Vampiric Embrace gates by SpellFamilyName=6
+-- (PRIEST) plus a Priest-Shadow-damage SpellFamilyMask. That blocks the proc
+-- engine from ever calling the AuraScript's CheckProc when a Paragon casts a
+-- non-Priest Shadow-school spell (e.g. Warlock Shadow Bolt, Death Knight
+-- Death Coil, etc.), because IsAffected's familyFlags gate fails before
+-- CheckProc runs even though the Phase A wildcard already loosens the
+-- familyName equality test (see SpellInfo::IsAffected, listenerOwner overload).
+--
+-- We relax this row so:
+--   * SchoolMask=32 (SHADOW)        kept -- proc-engine still gates by school
+--   * SpellTypeMask=1 (DAMAGE)       kept -- only damage events trigger CheckProc
+--   * SpellPhaseMask=2 (HIT)         kept -- post-hit phase
+--   * AttributesMask=2 (TRIGGERED)   kept -- triggered-spell payloads still proc
+--   * SpellFamilyName=0              wildcard -- IsAffected short-circuits to true
+--   * SpellFamilyMask{0,1,2}=0       wildcard -- no flag-bit gating at this layer
+--
+-- Real filtering moves into spell_pri_vampiric_embrace::CheckProc, which
+-- branches on IsParagonWildcardCaller(GetTarget()):
+--
+--   * For Paragon owners with `Paragon.WildcardFamilyMatching = 1`, accept any
+--     single-target Shadow-school spell (Mind Sear / AoE shadow spells like
+--     Seed of Corruption / Hellfire are filtered there via IsAffectingArea
+--     and the existing Mind Sear bit-mask).
+--
+--   * For stock Priest owners (and for the non-wildcard runtime path), the
+--     CheckProc re-enforces the EXACT original gate -- SpellFamilyName=6 plus
+--     the original 0x0280A010 / 0x00002402 / 0x00000008 SpellFamilyMask bits
+--     -- so behavior is byte-identical to before this change for any caster
+--     that is not a Paragon.
+--
+-- Net effect: Paragon characters with VE learned now leech-heal off any
+-- single-target Shadow spell they cast (Death Coil, Shadow Bolt, Searing
+-- Pain, Drain Soul, etc.); stock Shadow Priests are unchanged.
+
+DELETE FROM `spell_proc` WHERE `SpellId` = 15286;
+
+INSERT INTO `spell_proc`
+    (`SpellId`, `SchoolMask`, `SpellFamilyName`,
+     `SpellFamilyMask0`, `SpellFamilyMask1`, `SpellFamilyMask2`,
+     `ProcFlags`, `SpellTypeMask`, `SpellPhaseMask`, `HitMask`,
+     `AttributesMask`, `DisableEffectsMask`, `ProcsPerMinute`,
+     `Chance`, `Cooldown`, `Charges`)
+VALUES
+    (15286, 32, 0, 0, 0, 0, 0, 1, 2, 0, 2, 0, 0, 0, 0, 0);
@@ -0,0 +1,51 @@
+-- mod-paragon: Maelstrom Weapon (53817) cross-family wildcard.
+--
+-- Stock 3.3.5 spell_proc row for Maelstrom Weapon gates by SpellFamilyName=11
+-- (SHAMAN) plus a Shaman SpellFamilyMask covering Lightning Bolt, Chain
+-- Lightning, Lesser Healing Wave, Healing Wave and Hex (Mask0=451,
+-- Mask1=32768). The proc engine therefore never delivers an event to the
+-- AuraScript when a Paragon casts a non-Shaman cast-time spell, even if the
+-- IsAffected wildcard relaxes SpellFamilyName equality (the SpellFamilyMask
+-- AND-with-target-FamilyFlags check still fails because Mage / Warlock /
+-- Druid spell-class bits do not overlap with Shaman bits).
+--
+-- We relax this row so:
+--   * SchoolMask=0                 wildcard -- proc engine no longer gates by school
+--   * SpellTypeMask=1 (DAMAGE)     kept     -- only damage spells trigger CheckProc
+--   * SpellPhaseMask=8 (FINISH)    kept     -- post-cast phase, on cast finish
+--   * SpellFamilyName=0            wildcard -- IsAffected short-circuits to true
+--   * SpellFamilyMask{0,1,2}=0     wildcard -- no flag-bit gating at this layer
+--
+-- Real filtering moves into spell_sha_maelstrom_weapon::CheckProc:
+--
+--   * For stock Shaman owners (and for the non-wildcard runtime path), the
+--     CheckProc re-enforces the EXACT original gate -- SpellFamilyName=11
+--     plus the original Mask0=451 / Mask1=32768 bits -- so behavior is
+--     byte-identical to before this change for any caster that is not a
+--     Paragon.
+--
+--   * For Paragon owners with `Paragon.WildcardFamilyMatching = 1`, the
+--     stock allowlist still passes, AND we additionally accept the curated
+--     Mage cast-time nukes Fireball / Frostbolt / Arcane Blast (any rank,
+--     matched via GetFirstRankSpell).
+--
+-- The matching IsAffectedBySpellMod hook in SpellInfo.cpp ensures the cast
+-- time + power cost spellmods on aura 53817 also bridge across families for
+-- the same Mage spell allowlist, so Paragons get the full Maelstrom Weapon
+-- experience (instant cast at 5 stacks + reduced mana cost) on Fireball,
+-- Frostbolt and Arcane Blast.
+--
+-- Net effect: Paragon characters with Maelstrom Weapon learned now spend
+-- stacks on Mage cast-time nukes in addition to the stock Shaman list;
+-- stock Enhancement Shamans are unchanged.
+
+DELETE FROM `spell_proc` WHERE `SpellId` = 53817;
+
+INSERT INTO `spell_proc`
+    (`SpellId`, `SchoolMask`, `SpellFamilyName`,
+     `SpellFamilyMask0`, `SpellFamilyMask1`, `SpellFamilyMask2`,
+     `ProcFlags`, `SpellTypeMask`, `SpellPhaseMask`, `HitMask`,
+     `AttributesMask`, `DisableEffectsMask`, `ProcsPerMinute`,
+     `Chance`, `Cooldown`, `Charges`)
+VALUES
+    (53817, 0, 0, 0, 0, 0, 0, 1, 8, 0, 0, 0, 0, 0, 0, 0);
@@ -0,0 +1,66 @@
+-- mod-paragon: Frostbite + Fingers of Frost cross-family wildcard.
+--
+-- Both talents are normally gated by SpellFamilyName=3 (MAGE) plus a Mage
+-- SpellFamilyMask covering specific Mage Frost spells (Frostbolt / Frost Nova
+-- / Cone of Cold / Blizzard / Frostfire Bolt / Deep Freeze for FoF; Frost
+-- slow-applying spells for Frostbite). That blocks the proc engine from
+-- delivering an event to the AuraScript when a Paragon casts a non-Mage
+-- Frost-school chill effect (DK Howling Blast / Icy Touch / Chains of Ice,
+-- Hunter Frost Trap, Shaman Frost Shock, etc.), because IsAffected's
+-- familyFlags AND-with-target-FamilyFlags check fails before CheckProc runs
+-- even after the Paragon family-name wildcard.
+--
+-- We relax these rows so:
+--   * SchoolMask=16 (FROST)        gate by Frost school at the proc engine
+--   * SpellTypeMask=1 (DAMAGE)     only damage events trigger CheckProc
+--   * SpellPhaseMask=2 (HIT)       post-hit phase
+--   * AttributesMask=2 (TRIGGERED) triggered chill payloads still proc
+--   * SpellFamilyName=0            wildcard -- IsAffected short-circuits to true
+--   * SpellFamilyMask{0,1,2}=0     wildcard -- no flag-bit gating at this layer
+--
+-- Real filtering moves into the Mage AuraScripts:
+--
+--   spell_mage_fingers_of_frost_talent  attached to 44543 / 44545
+--     stock Mage : SpellFamilyName=MAGE AND original Mask0 0x100120 / Mask1 0x1000
+--     Paragon    : accept (FROST + DAMAGE gate already enforced)
+--
+--   spell_mage_frostbite                attached to 11071 / 12496 / 12497
+--     stock Mage : SpellFamilyName=MAGE AND original Mage Frost-slow Mask
+--                  (Frostbolt / Frost Nova / Cone of Cold / Blizzard / FFB)
+--     Paragon    : accept iff proc spell applies SPELL_AURA_MOD_DECREASE_SPEED
+--                  OR the Paragon already has a slow on the proc target
+--                  (covers the Improved-Blizzard-style "chill via separate
+--                  triggered aura" cross-class case)
+--
+-- Net effect: Paragon characters with these talents now have FoF / Frostbite
+-- proc off cross-class Frost-school chill effects; stock Mages are unchanged.
+
+DELETE FROM `spell_proc` WHERE `SpellId` IN (44543, 44545, 11071, 12496, 12497);
+
+INSERT INTO `spell_proc`
+    (`SpellId`, `SchoolMask`, `SpellFamilyName`,
+     `SpellFamilyMask0`, `SpellFamilyMask1`, `SpellFamilyMask2`,
+     `ProcFlags`, `SpellTypeMask`, `SpellPhaseMask`, `HitMask`,
+     `AttributesMask`, `DisableEffectsMask`, `ProcsPerMinute`,
+     `Chance`, `Cooldown`, `Charges`)
+VALUES
+    -- Fingers of Frost talent ranks (Chance 7% / 15% preserved from stock row).
+    (44543, 16, 0, 0, 0, 0, 0, 1, 2, 0, 2, 0, 0,  7, 0, 0),
+    (44545, 16, 0, 0, 0, 0, 0, 1, 2, 0, 2, 0, 0, 15, 0, 0),
+    -- Frostbite talent ranks (5% / 10% / 15% per rank, leave Chance=0 to use
+    -- the DBC ProcChance which already encodes the per-rank percentage).
+    (11071, 16, 0, 0, 0, 0, 0, 1, 2, 0, 2, 0, 0, 0, 0, 0),
+    (12496, 16, 0, 0, 0, 0, 0, 1, 2, 0, 2, 0, 0, 0, 0, 0),
+    (12497, 16, 0, 0, 0, 0, 0, 1, 2, 0, 2, 0, 0, 0, 0, 0);
+
+-- Bind the new AuraScripts (defined in src/server/scripts/Spells/spell_mage.cpp).
+DELETE FROM `spell_script_names`
+    WHERE `spell_id` IN (44543, 44545, 11071, 12496, 12497)
+      AND `ScriptName` IN ('spell_mage_fingers_of_frost_talent', 'spell_mage_frostbite');
+
+INSERT INTO `spell_script_names` (`spell_id`, `ScriptName`) VALUES
+    (44543, 'spell_mage_fingers_of_frost_talent'),
+    (44545, 'spell_mage_fingers_of_frost_talent'),
+    (11071, 'spell_mage_frostbite'),
+    (12496, 'spell_mage_frostbite'),
+    (12497, 'spell_mage_frostbite');
@@ -0,0 +1,51 @@
+-- mod-paragon: Maelstrom Weapon (53817) spell_proc fixup.
+--
+-- The previous migration (2026_05_11_02.sql) had two bugs in the rewritten
+-- spell_proc row that prevented stack consumption from firing at all -- not
+-- just for our new Mage targets, but also for the stock Shaman cast-time
+-- spells (Lightning Bolt, Chain Lightning, Lesser Healing Wave, etc.).
+--
+-- Bugs:
+--
+--   * SpellPhaseMask was set to 8. The valid values for SpellPhaseMask are
+--       PROC_SPELL_PHASE_CAST   = 1
+--       PROC_SPELL_PHASE_HIT    = 2
+--       PROC_SPELL_PHASE_FINISH = 4
+--     (see SpellMgr.h). Anything else, including 8, never matches a real
+--     proc event, so the proc engine silently dropped every event before it
+--     reached the AuraScript. The original stock row uses 1 (CAST), which
+--     is what fires when the cast packet's setup phase completes -- exactly
+--     when we want the spellmod-affected cast to consume the buff.
+--
+--   * AttributesMask was set to 0. The original stock row uses 8
+--       PROC_ATTR_REQ_SPELLMOD = 0x8
+--     which says "only proc on spells that were affected by one of this
+--     aura's spellmods". This is the bridge between IsAffectedBySpellMod
+--     (which records the aura into Spell::m_appliedMods when calculating
+--     cast time / cost) and the proc system (which then knows that the cast
+--     used the buff and should consume a charge). Without this attribute,
+--     the proc would either fire too aggressively or not at all depending
+--     on subsequent gating, but in practice the engine relies on it to
+--     correlate spellmod use with stack consumption.
+--
+-- Fixed row keeps the same family/mask wildcards from the previous
+-- migration (so the Paragon Mage allowlist in spell_sha_maelstrom_weapon's
+-- CheckProc still gets the chance to filter), restores SpellPhaseMask=1
+-- (CAST) and AttributesMask=8 (REQ_SPELLMOD) to match stock semantics, and
+-- resets SpellTypeMask to 0 (any spell type -- the REQ_SPELLMOD attribute
+-- already gates by "was the buff actually used", so an extra DAMAGE filter
+-- is redundant and would block e.g. Lesser Healing Wave on stock Shamans).
+--
+-- This restores stock Shaman behavior byte-identically and lets Paragon
+-- Mage casts also consume stacks via the IsAffectedBySpellMod allowlist.
+
+DELETE FROM `spell_proc` WHERE `SpellId` = 53817;
+
+INSERT INTO `spell_proc`
+    (`SpellId`, `SchoolMask`, `SpellFamilyName`,
+     `SpellFamilyMask0`, `SpellFamilyMask1`, `SpellFamilyMask2`,
+     `ProcFlags`, `SpellTypeMask`, `SpellPhaseMask`, `HitMask`,
+     `AttributesMask`, `DisableEffectsMask`, `ProcsPerMinute`,
+     `Chance`, `Cooldown`, `Charges`)
+VALUES
+    (53817, 0, 0, 0, 0, 0, 0, 0, 1, 0, 8, 0, 0, 0, 0, 0);
@@ -0,0 +1,19 @@
+-- mod-paragon: surface Savage Defense (62600) on the Druid Feral spell tab
+-- of the Character Advancement panel.
+--
+-- The bake (tools/_gen_paragon_advancement_spells_lua.py) used to drop every
+-- SPELL_ATTR0_PASSIVE spell up front, even when the trainer explicitly sells
+-- it. That filter was correct for class-internal triggers (Feline Grace, etc.)
+-- but kicked out Savage Defense -- a passive that DRUID trainer 33 sells at
+-- level 40 (trainer_spell.sql line 2457). Bake now carves out a small
+-- PASSIVE_TRAINER_ALLOWLIST so legitimate trainer-taught passives survive.
+--
+-- The base file (data/sql/db-world/base/paragon_spell_ae_cost.sql) was
+-- regenerated alongside this migration so fresh deployments already have
+-- this row. Existing servers do not re-run base files on content change,
+-- so this update inserts the new (spell_id, ae_cost) pair idempotently.
+-- INSERT IGNORE keeps any per-row tuning a server operator may have already
+-- applied.
+
+INSERT IGNORE INTO `paragon_spell_ae_cost` (`spell_id`, `ae_cost`) VALUES
+    (62600, 1);  -- Savage Defense (Druid, trainer 33, level 40)
@@ -0,0 +1,21 @@
+-- Fractured / Paragon: multidot Devouring Plague clone (spell IDs 951000-951008).
+-- Spell rows live in the patched client Spell.dbc (see fractured-tooling
+--   from-workspace-root/_patch_spell_dbc_paragon_multidot_devouring_plague.py).
+-- Deploy the same Spell.dbc into the worldserver `data/dbc/` folder OR import
+-- equivalent `spell_dbc` rows from a full exporter; stock SQL cannot express
+-- the SpellEntryfmt NA padding columns safely in one INSERT here.
+
+DELETE FROM `spell_ranks` WHERE `first_spell_id` = 951000;
+INSERT INTO `spell_ranks` (`first_spell_id`,`spell_id`,`rank`) VALUES
+(951000,951000,1),
+(951000,951001,2),
+(951000,951002,3),
+(951000,951003,4),
+(951000,951004,5),
+(951000,951005,6),
+(951000,951006,7),
+(951000,951007,8),
+(951000,951008,9);
+
+DELETE FROM `paragon_spell_ae_cost` WHERE `spell_id` IN (2944,951000);
+INSERT INTO `paragon_spell_ae_cost` (`spell_id`,`ae_cost`) VALUES (951000, 1);
@@ -0,0 +1,15 @@
+-- Fractured / Paragon: spellbook tab for multidot Devouring Plague (951000 chain).
+-- Shadow priest skill line (78); ClassMask 2064 matches mod-paragon SLA overlay.
+-- Client: patched SkillLineAbility.dbc in patch-enUS-4 from the same script.
+
+DELETE FROM `skilllineability_dbc` WHERE `ID` IN (1951000, 1951001, 1951002, 1951003, 1951004, 1951005, 1951006, 1951007, 1951008);
+INSERT INTO `skilllineability_dbc` (`ID`,`SkillLine`,`Spell`,`RaceMask`,`ClassMask`,`ExcludeRace`,`ExcludeClass`,`MinSkillLineRank`,`SupercededBySpell`,`AcquireMethod`,`TrivialSkillLineRankHigh`,`TrivialSkillLineRankLow`,`CharacterPoints_1`,`CharacterPoints_2`) VALUES
+  (1951000,78,951000,0,2064,0,0,1,0,0,0,0,0,0),
+  (1951001,78,951001,0,2064,0,0,1,0,0,0,0,0,0),
+  (1951002,78,951002,0,2064,0,0,1,0,0,0,0,0,0),
+  (1951003,78,951003,0,2064,0,0,1,0,0,0,0,0,0),
+  (1951004,78,951004,0,2064,0,0,1,0,0,0,0,0,0),
+  (1951005,78,951005,0,2064,0,0,1,0,0,0,0,0,0),
+  (1951006,78,951006,0,2064,0,0,1,0,0,0,0,0,0),
+  (1951007,78,951007,0,2064,0,0,1,0,0,0,0,0,0),
+  (1951008,78,951008,0,2064,0,0,1,0,0,0,0,0,0);
@@ -0,0 +1,21 @@
+-- Fractured / Paragon: Character Advancement stance/presence clones (951010-951015).
+-- Client: patched Spell.dbc + SpellShapeshiftForm.dbc + SkillLineAbility.dbc in patch-enUS-4.MPQ.
+-- Server: copy Spell.dbc + SpellShapeshiftForm.dbc into `data/dbc/` (SpellShapeshiftForm is not in stock MPQ); SkillLineAbility is DB-driven on server.
+
+DELETE FROM `paragon_spell_ae_cost` WHERE `spell_id` IN (951010,951011,951012,951013,951014,951015);
+INSERT INTO `paragon_spell_ae_cost` (`spell_id`,`ae_cost`) VALUES
+  (951010, 1),
+  (951011, 1),
+  (951012, 1),
+  (951013, 1),
+  (951014, 1),
+  (951015, 1);
+
+DELETE FROM `skilllineability_dbc` WHERE `ID` IN (1951020,1951021,1951022,1951023,1951024,1951025);
+INSERT INTO `skilllineability_dbc` (`ID`,`SkillLine`,`Spell`,`RaceMask`,`ClassMask`,`ExcludeRace`,`ExcludeClass`,`MinSkillLineRank`,`SupercededBySpell`,`AcquireMethod`,`TrivialSkillLineRankHigh`,`TrivialSkillLineRankLow`,`CharacterPoints_1`,`CharacterPoints_2`) VALUES
+  (1951020,26,951010,0,2049,0,0,1,0,2,0,0,0,0),
+  (1951021,257,951011,0,2049,0,0,1,0,0,0,0,0,0),
+  (1951022,256,951012,0,2049,0,0,1,0,0,0,0,0,0),
+  (1951023,770,951013,0,2080,0,0,1,0,2,0,0,0,0),
+  (1951024,771,951014,0,2080,0,0,1,0,0,0,0,0,0),
+  (1951025,772,951015,0,2080,0,0,1,0,0,0,0,0,0);
@@ -0,0 +1,9 @@
+-- Fractured / Paragon: run spell_dk_presence on Character Advancement DK presence clones (951013-951015).
+-- Spell.dbc sets SpellFamilyName=0 on these rows (see fractured-tooling/_patch_spell_dbc_paragon_stance_presence_clones.py)
+-- so the stock client does not map them onto DK stance buttons; core still needs the aura script for Improved Presence.
+
+DELETE FROM `spell_script_names` WHERE `spell_id` IN (951013, 951014, 951015);
+INSERT INTO `spell_script_names` (`spell_id`, `ScriptName`) VALUES
+(951013, 'spell_dk_presence'),
+(951014, 'spell_dk_presence'),
+(951015, 'spell_dk_presence');
@@ -0,0 +1,8 @@
+-- Fractured / Paragon: Character Advancement stance/presence clones — spellbook + client bits.
+-- 1) SkillLineAbility: DK presence clones belong on 770/771/772 (Blood/Frost/Unholy tabs), not 760 (General).
+--    (760 was an experiment; stance bar visibility is driven by Spell.dbc AttributesEx2 USE_SHAPESHIFT_BAR.)
+-- 2) Idempotent if rows already match.
+
+UPDATE `skilllineability_dbc` SET `SkillLine` = 770 WHERE `ID` = 1951023 AND `Spell` = 951013;
+UPDATE `skilllineability_dbc` SET `SkillLine` = 771 WHERE `ID` = 1951024 AND `Spell` = 951014;
+UPDATE `skilllineability_dbc` SET `SkillLine` = 772 WHERE `ID` = 1951025 AND `Spell` = 951015;
@@ -7,13 +7,17 @@

 #include "Chat.h"
 #include "Config.h"
+#include "Creature.h"
+#include "CreatureData.h"
 #include "GameTime.h"
 #include "Log.h"
 #include "ObjectGuid.h"
+#include "Pet.h"
 #include "Player.h"
 #include "ScriptMgr.h"
 #include "SharedDefines.h"
-#include "UnitDefines.h"
+#include "SpellScript.h"
+#include "SpellScriptLoader.h"
 #include "WorldPacket.h"
 #include "WorldSession.h"

@@ -35,7 +39,7 @@ public:
    {
        LOG_INFO("module", "[paragon] Paragon_PlayerScript registered "
                           "(MultiResource.HasActivePowers={})",
-                 sConfigMgr->GetOption<bool>("Paragon.MultiResource.HasActivePowers", false));
+                 sConfigMgr->GetOption<bool>("Paragon.MultiResource.HasActivePowers", true));
    }

    [[nodiscard]] Optional<bool> OnPlayerIsClass(Player const* player, Classes unitClass, ClassContext context) override
@@ -43,27 +47,218 @@ public:
        if (!player || player->getClass() != CLASS_PARAGON)
            return std::nullopt;

-        // Death Knight rune / runic power ability stack (narrow on purpose).
-        if (unitClass == CLASS_DEATH_KNIGHT && context == CLASS_CONTEXT_ABILITY)
+        // ============================================================
+        // Ability stack -- claim ALL nine vanilla classes.
+        // ============================================================
+        // CLASS_CONTEXT_ABILITY is read by every class-specific spell
+        // gate in core / scripts: DK rune mechanics (Spell.cpp,
+        // SpellEffects.cpp, spell_dk.cpp, SpellAuraEffects.cpp),
+        // Warrior Titan's Grip / Bladestorm (Player.cpp 3783, 15432,
+        // PlayerUpdates.cpp 1547), Paladin Rebuke (Player.cpp 15441),
+        // Shaman dual-wield bookkeeping (Player.cpp 5028), Hunter pet
+        // / Hunter's Mark gates (spell_item.cpp 3718), Druid Insect
+        // Swarm / Wild Growth (SpellAuraEffects.cpp 2153, 2232),
+        // Priest Spirit of Redemption out-of-bounds check (Unit.cpp
+        // 14238), Rogue pickpocketing (LootHandler.cpp 86/165/385,
+        // Vehicle.cpp 80). Paragon learns abilities from every class
+        // through Character Advancement, so claiming all of them lets
+        // every gated spell script execute its class-specific branch
+        // for our players. The only downside is double-pathed scripts
+        // (e.g. a spell with both warrior and rogue branches) will
+        // pick whichever the script tests first -- acceptable.
+        if (context == CLASS_CONTEXT_ABILITY)
            return true;

-        // Warrior ability stack: enables warrior-spec ability gates anywhere
-        // they're checked. None of the currently-traced sites in core/scripts
-        // gate on (CLASS_WARRIOR, CLASS_CONTEXT_ABILITY), so this is a safe
-        // forward-compatible claim. Rage generation itself is gated on
-        // HasActivePowerType(POWER_RAGE) and is wired below.
-        if (unitClass == CLASS_WARRIOR && context == CLASS_CONTEXT_ABILITY)
-            return true;
-
-        // Reactive melee states: Overpower-on-dodge (warrior), Counterattack window (hunter).
-        // We intentionally do NOT claim CLASS_ROGUE here: that context skips the generic
-        // AURA_STATE_DEFENSE update on dodge (Riposte path) in Unit::ProcDamageAndSpellFor.
+        // ============================================================
+        // Reactive melee states.
+        // ============================================================
+        // Warrior dodge -> AURA_STATE_DEFENSE (Overpower window).
+        // Hunter parry -> AURA_STATE_HUNTER_PARRY (Counterattack).
+        // We intentionally do NOT claim CLASS_ROGUE here:
+        // Unit::ProcDamageAndSpellFor (Unit.cpp 12824) skips the
+        // generic AURA_STATE_DEFENSE update on dodge for rogues so
+        // Riposte can take over. Claiming rogue would silently kill
+        // Overpower for Paragon, and Riposte already works for us via
+        // the warrior-style state we already grant.
        if (context == CLASS_CONTEXT_ABILITY_REACTIVE)
        {
            if (unitClass == CLASS_WARRIOR || unitClass == CLASS_HUNTER)
                return true;
        }

+        // ============================================================
+        // Pet ownership contexts.
+        // ============================================================
+        // CLASS_CONTEXT_PET is read by Pet::AddToWorld, Pet::CreateBase
+        // AtCreatureInfo, Pet::InitStatsForLevel (twice -- the
+        // MAX_PET_TYPE bootstrap branch and the per-class attack-time
+        // scaling), Pet::IsPermanentPetFor, Player::SummonPet,
+        // Player::CanResummonPet, Spell::EffectTameCreature,
+        // SpellEffects.cpp (CreateTamedPet debug effects, Eyes of the
+        // Beast), spell_generic.cpp 1760 (charm-as-pet conversion),
+        // and PlayerGossip.cpp's hunter stable check.
+        //
+        // The cleanest disambiguation is by the *active pet's* shape:
+        //   HUNTER_PET                    -> hunter (beast tame)
+        //   SUMMON_PET + DEMON  type      -> warlock (Imp/VW/Succ/...)
+        //   SUMMON_PET + UNDEAD type      -> DK ghoul / Army of Dead
+        //   SUMMON_PET + ELEMENTAL type   -> mage water / shaman fire
+        // For HUNTER specifically the no-pet case is also claimed so
+        // Tame Beast's EffectTameCreature gate passes during cast.
+        if (context == CLASS_CONTEXT_PET)
+        {
+            Pet const* activePet = const_cast<Player*>(player)->GetPet();
+
+            // Hunter beast: claim during taming OR when a HUNTER_PET is
+            // already active. This is what makes Tame Beast / Call Pet
+            // / pet stable / Counterattack pet aura feedback work.
+            if (unitClass == CLASS_HUNTER)
+            {
+                if (!activePet || activePet->getPetType() == HUNTER_PET)
+                    return true;
+                return std::nullopt;
+            }
+
+            // All other classes only claim when an active SUMMON_PET is
+            // present. We then disambiguate by the creature's type
+            // because warlock / DK / mage / shaman all use SUMMON_PET.
+            if (!activePet || activePet->getPetType() != SUMMON_PET)
+                return std::nullopt;
+
+            CreatureTemplate const* tmpl = activePet->GetCreatureTemplate();
+            if (!tmpl)
+                return std::nullopt;
+
+            switch (unitClass)
+            {
+                case CLASS_WARLOCK:
+                    // Drives Master Demonologist / Demonic Knowledge /
+                    // Demonic Pact propagation, last-pet-spell tracking
+                    // (Pet.cpp 112), and IsPermanentPetFor (Pet.cpp
+                    // 2288) so demon pets persist across logins.
+                    if (tmpl->type == CREATURE_TYPE_DEMON)
+                        return true;
+                    break;
+                case CLASS_DEATH_KNIGHT:
+                    // Risen Ghoul + Army of the Dead. Player.cpp 14354
+                    // and Pet.cpp 243 / 1046 / 2290 read this; without
+                    // it the ghoul is invisible to the owner mid-load
+                    // and ScriptedAI hooks on the ghoul mis-route.
+                    if (tmpl->type == CREATURE_TYPE_UNDEAD)
+                        return true;
+                    break;
+                case CLASS_MAGE:
+                    // Glyph-of-Eternal-Water permanent Water Elemental
+                    // (entry 510, 37994). Used by Pet.cpp 1047/2292.
+                    if (tmpl->type == CREATURE_TYPE_ELEMENTAL)
+                        return true;
+                    break;
+                case CLASS_SHAMAN:
+                    // Fire Elemental / Earth Elemental. The base
+                    // engine spawns these as creatures rather than
+                    // proper Pet instances in most code paths, so the
+                    // claim mostly matters for the Pet.cpp 1045 stat
+                    // bootstrap when one is loaded as a SUMMON_PET.
+                    if (tmpl->type == CREATURE_TYPE_ELEMENTAL)
+                        return true;
+                    break;
+                default:
+                    break;
+            }
+            return std::nullopt;
+        }
+
+        // Warlock pet-charm context (Enslave Demon -- Unit.cpp 14828,
+        // 14894, 15025). Without this claim, charming a demon as a
+        // Paragon doesn't get the warlock-flavor charm semantics
+        // (faction-set-on-charm, action-bar layout, charm-break logic).
+        if (unitClass == CLASS_WARLOCK && context == CLASS_CONTEXT_PET_CHARM)
+            return true;
+
+        // ============================================================
+        // Equipment contexts.
+        // ============================================================
+        // CLASS_CONTEXT_EQUIP_RELIC: PlayerStorage.cpp 224-240 +
+        // 2475-2493. Routes Librams/Idols/Totems/Misc/Sigils into
+        // EQUIPMENT_SLOT_RANGED for the matching class. Claim every
+        // relic-bearing class so a Paragon can drop any of them into
+        // the ranged slot.
+        if (context == CLASS_CONTEXT_EQUIP_RELIC)
+        {
+            switch (unitClass)
+            {
+                case CLASS_PALADIN:
+                case CLASS_DRUID:
+                case CLASS_SHAMAN:
+                case CLASS_WARLOCK:
+                case CLASS_DEATH_KNIGHT:
+                    return true;
+                default:
+                    break;
+            }
+        }
+
+        // CLASS_CONTEXT_EQUIP_ARMOR_CLASS: PlayerStorage.cpp 2326,
+        // 2330, 2503-2523. At level 40 each class auto-learns its
+        // top armor proficiency. Paragon should pick up plate (via
+        // paladin/DK), shields (paladin/warrior/shaman), mail
+        // (hunter/shaman), and leather (rogue) so the level-40 train
+        // event grants Paragon full proficiency and we don't have to
+        // hand-curate it through the Paragon proficiency SQL.
+        if (context == CLASS_CONTEXT_EQUIP_ARMOR_CLASS)
+        {
+            switch (unitClass)
+            {
+                case CLASS_PALADIN:
+                case CLASS_WARRIOR:
+                case CLASS_DEATH_KNIGHT:
+                case CLASS_HUNTER:
+                case CLASS_SHAMAN:
+                case CLASS_DRUID:
+                case CLASS_ROGUE:
+                    return true;
+                default:
+                    break;
+            }
+        }
+
+        // CLASS_CONTEXT_EQUIP_SHIELDS: PlayerStorage.cpp 2467-2469.
+        // Lets a Paragon equip shields without a paladin/warrior/
+        // shaman skill gate.
+        if (context == CLASS_CONTEXT_EQUIP_SHIELDS)
+        {
+            switch (unitClass)
+            {
+                case CLASS_PALADIN:
+                case CLASS_WARRIOR:
+                case CLASS_SHAMAN:
+                    return true;
+                default:
+                    break;
+            }
+        }
+
+        // CLASS_CONTEXT_WEAPON_SWAP: PlayerStorage.cpp 1920, 2838 --
+        // rogue uses cooldown spell 6123 instead of 6119 on weapon
+        // swap (Quick Draw / Combat Potency interactions). Claim
+        // rogue so Paragon picks up the same cooldown spell.
+        if (context == CLASS_CONTEXT_WEAPON_SWAP && unitClass == CLASS_ROGUE)
+            return true;
+
+        // ============================================================
+        // Contexts we DELIBERATELY DO NOT claim:
+        // ============================================================
+        //   CLASS_CONTEXT_STATS  -- Paragon has its own STR/AGI->AP and
+        //   INT/SPI->SP curves wired in StatSystem.cpp's CLASS_PARAGON
+        //   branch (level*2 + STR + AGI - 20 etc.). Claiming any
+        //   vanilla class here would override our curves with theirs.
+        //
+        //   CLASS_CONTEXT_INIT, _TELEPORT, _QUEST, _TAXI, _SKILL,
+        //   _GRAVEYARD, _CLASS_TRAINER, _TALENT_POINT_CALC -- all
+        //   used by DK Ebon Hold / druid Moonglade starting-zone
+        //   scripts. Paragon doesn't go through those zones and we
+        //   don't want our players bound to Acherus or trapped in
+        //   the DK starting quest gates.
        return std::nullopt;
    }

@@ -75,7 +270,7 @@ public:
        if (power == POWER_RUNIC_POWER || power == POWER_RUNE)
            return true;

-        if (sConfigMgr->GetOption<bool>("Paragon.MultiResource.HasActivePowers", false))
+        if (sConfigMgr->GetOption<bool>("Paragon.MultiResource.HasActivePowers", true))
        {
            switch (power)
            {
@@ -268,7 +463,187 @@ private:

 std::unordered_map<ObjectGuid, Paragon_PlayerScript::ParagonRuneSyncState> Paragon_PlayerScript::runeSyncByGuid;

+// Arcane Torrent (28730) for Paragon: Blood Elf racial skill line 756 has
+// three Arcane Torrent variants in stock WotLK (28730 mana, 25046 rogue
+// energy, 50613 DK runic power). For Paragon Blood Elves we keep only 28730
+// (see migration 2026_05_10_03.sql) and turn it into a "combined" version:
+// the stock spell already silences nearby enemies and energizes mana via its
+// own effects; this script adds energy, rage, and runic power energize on
+// top when the caster is class 12, so a single button refunds whichever
+// resource pool the player is actually using. Non-Paragon casters are
+// untouched and keep learning their stock racial variant.
+class spell_paragon_arcane_torrent : public SpellScript
+{
+    PrepareSpellScript(spell_paragon_arcane_torrent);
+
+    void HandleAfterCast()
+    {
+        Unit* caster = GetCaster();
+        if (!caster || !caster->IsPlayer())
+            return;
+
+        Player* player = caster->ToPlayer();
+        if (player->getClass() != CLASS_PARAGON)
+            return;
+
+        // Stock energize amounts from spell_dbc:
+        //   25046 Arcane Torrent (Energy)      -> 15 energy
+        //   50613 Arcane Torrent (Runic Power) -> 15 displayed RP (= 150
+        //   internal; AC stores RP scaled 10x, see Player::SetMaxPower
+        //   POWER_RUNIC_POWER, 1000).
+        // Rage uses the same 10x internal scaling as runic power (see
+        // Player.cpp:Regenerate where rage decay is `-20` for "2 rage by
+        // tick"), so 15 displayed rage = 150 internal.
+        // ModifyPower no-ops on pools the player has no max for, so this is
+        // safe even before the Paragon picks up energy/rage/RP abilities.
+        constexpr int32 kEnergyGain     = 15;
+        constexpr int32 kRageGain       = 150;
+        constexpr int32 kRunicPowerGain = 150;
+
+        SpellInfo const* spellInfo = GetSpellInfo();
+        uint32 const spellId = spellInfo ? spellInfo->Id : 28730u;
+
+        caster->EnergizeBySpell(player, spellId, kEnergyGain, POWER_ENERGY);
+        caster->EnergizeBySpell(player, spellId, kRageGain, POWER_RAGE);
+        caster->EnergizeBySpell(player, spellId, kRunicPowerGain, POWER_RUNIC_POWER);
+    }
+
+    void Register() override
+    {
+        AfterCast += SpellCastFn(spell_paragon_arcane_torrent::HandleAfterCast);
+    }
+};
+
+// Predatory Strikes (16972 / 16974 / 16975) for Paragon: re-implements the
+// Cataclysm-era proc behavior of the talent so a Paragon's damaging
+// finishers (Eviscerate / Envenom / Ferocious Bite / Rip / Rupture) can
+// roll Predator's Swiftness (69369) -- the same buff that real druids
+// get from the Cata redesign of this talent. Combined with the
+// Spell::prepare interception in core (Spell.cpp), 69369 makes the
+// Paragon's NEXT Nature-school spell with a base cast time below 10s
+// instant cast: Chain Lightning, Lightning Bolt, Healing Touch, Wrath,
+// Nourish, etc. -- not just the Druid-family Nature subset that the
+// stock SPELLMOD_CASTING_TIME mask on 69369 covers.
+//
+// Filter logic:
+//   - Source spell must consume combo points (NeedsComboPoints() — gates
+//     out non-finisher combo-point builders).
+//   - "Damaging finisher": SPELL_ATTR1_FINISHING_MOVE_DAMAGE (Eviscerate,
+//     Envenom, Ferocious Bite, ...) OR a SPELL_ATTR1_FINISHING_MOVE_DURATION
+//     finisher that applies periodic damage (Rip, Rupture). Duration
+//     finishers that only heal (Recuperate) or only buff / CC / armor shred
+//     (Slice and Dice, Savage Roar, Kidney Shot, Maim, Expose Armor) are
+//     rejected.
+//
+// Chance per combo point matches the Cataclysm tuning that the user's
+// client tooltip text reflects: rank 1 = 3% per CP, rank 2 = 5% per CP,
+// rank 3 = 7% per CP. At 5 CP that is 15% / 25% / 35%, capped at 100%.
+//
+// Combo-point read happens during PROC_SPELL_PHASE_CAST, which fires in
+// Spell::cast → Spell::ProcReflectProcs / Unit::ProcDamageAndSpellFor
+// BEFORE Spell::_handle_finish_phase clears the player's combo points
+// (see Spell.cpp:_handle_finish_phase clearing combo points). So
+// player->GetComboPoints() inside HandleProc returns the pre-clear value.
+class spell_paragon_predatory_strikes : public AuraScript
+{
+    PrepareAuraScript(spell_paragon_predatory_strikes);
+
+    static constexpr uint32 SPELL_PARAGON_PREDATORS_SWIFTNESS = 69369;
+
+    bool Validate(SpellInfo const* /*spellInfo*/) override
+    {
+        return ValidateSpellInfo({ SPELL_PARAGON_PREDATORS_SWIFTNESS });
+    }
+
+    bool CheckProc(ProcEventInfo& eventInfo)
+    {
+        SpellInfo const* spellInfo = eventInfo.GetSpellInfo();
+        if (!spellInfo || !spellInfo->NeedsComboPoints())
+            return false;
+
+        if (spellInfo->HasAttribute(SPELL_ATTR1_FINISHING_MOVE_DAMAGE))
+            return true;
+
+        if (spellInfo->HasAttribute(SPELL_ATTR1_FINISHING_MOVE_DURATION))
+        {
+            bool periodicHeal = false;
+            bool periodicDamage = false;
+            for (SpellEffectInfo const& eff : spellInfo->Effects)
+            {
+                if (eff.Effect != SPELL_EFFECT_APPLY_AURA && eff.Effect != SPELL_EFFECT_APPLY_AREA_AURA_PARTY
+                    && eff.Effect != SPELL_EFFECT_PERSISTENT_AREA_AURA)
+                    continue;
+
+                switch (eff.ApplyAuraName)
+                {
+                    case SPELL_AURA_PERIODIC_HEAL:
+                    case SPELL_AURA_PERIODIC_HEALTH_FUNNEL:
+                    case SPELL_AURA_OBS_MOD_HEALTH:
+                        periodicHeal = true;
+                        break;
+                    case SPELL_AURA_PERIODIC_DAMAGE:
+                    case SPELL_AURA_PERIODIC_DAMAGE_PERCENT:
+                    case SPELL_AURA_PERIODIC_LEECH:
+                        periodicDamage = true;
+                        break;
+                    default:
+                        break;
+                }
+            }
+
+            if (periodicHeal)
+                return false;
+
+            return periodicDamage;
+        }
+
+        return false;
+    }
+
+    void HandleProc(ProcEventInfo& eventInfo)
+    {
+        PreventDefaultAction();
+
+        Unit* actor = eventInfo.GetActor();
+        Player* player = actor ? actor->ToPlayer() : nullptr;
+        if (!player || player->getClass() != CLASS_PARAGON)
+            return;
+
+        uint8 const cp = player->GetComboPoints();
+        if (cp == 0)
+            return;
+
+        SpellInfo const* talent = GetSpellInfo();
+        if (!talent)
+            return;
+
+        uint32 pctPerCP = 0;
+        switch (talent->Id)
+        {
+            case 16972: pctPerCP = 3; break;
+            case 16974: pctPerCP = 5; break;
+            case 16975: pctPerCP = 7; break;
+            default:
+                return;
+        }
+
+        uint32 const chance = std::min<uint32>(100u, pctPerCP * uint32(cp));
+        if (!roll_chance_i(int32(chance)))
+            return;
+
+        player->CastSpell(player, SPELL_PARAGON_PREDATORS_SWIFTNESS, true);
+    }
+
+    void Register() override
+    {
+        DoCheckProc += AuraCheckProcFn(spell_paragon_predatory_strikes::CheckProc);
+        OnProc      += AuraProcFn(spell_paragon_predatory_strikes::HandleProc);
+    }
+};
+
 void AddSC_paragon()
 {
    new Paragon_PlayerScript();
+    RegisterSpellScript(spell_paragon_arcane_torrent);
+    RegisterSpellScript(spell_paragon_predatory_strikes);
 }
@@ -0,0 +1,52 @@
+#!/usr/bin/env bash
+# Start AzerothCore authserver + worldserver detached from the SSH session (nohup + disown).
+# Stops any already-running authserver/worldserver processes first.
+#
+# Usage:
+#   sudo bash scripts/start-azeroth-servers.sh
+#   AZEROTH_BIN=/path/to/azeroth-server/bin bash scripts/start-azeroth-servers.sh
+#
+# Environment:
+#   AZEROTH_BIN      — directory with authserver and worldserver (default: /home/fractured-panel/azeroth-server/bin)
+#   AZEROTH_LOG_DIR  — log directory (default: <parent of bin>/logs)
+
+set -euo pipefail
+
+BIN_DIR="${AZEROTH_BIN:-/home/fractured-panel/azeroth-server/bin}"
+BASE_DIR="$(cd "$(dirname "$BIN_DIR")" && pwd)"
+LOG_DIR="${AZEROTH_LOG_DIR:-${BASE_DIR}/logs}"
+CONF_DIR="${BASE_DIR}/etc"
+
+AUTH_BIN="${BIN_DIR}/authserver"
+WORLD_BIN="${BIN_DIR}/worldserver"
+
+if [[ ! -x "$AUTH_BIN" ]]; then
+  echo "error: not found or not executable: $AUTH_BIN" >&2
+  exit 1
+fi
+if [[ ! -x "$WORLD_BIN" ]]; then
+  echo "error: not found or not executable: $WORLD_BIN" >&2
+  exit 1
+fi
+
+pkill -x authserver 2>/dev/null || true
+pkill -x worldserver 2>/dev/null || true
+sleep 1
+
+mkdir -p "$LOG_DIR"
+
+cd "$BIN_DIR"
+
+nohup "$AUTH_BIN" -c "${CONF_DIR}/authserver.conf" >>"$LOG_DIR/authserver.log" 2>&1 &
+disown || true
+
+sleep 2
+
+nohup "$WORLD_BIN" -c "${CONF_DIR}/worldserver.conf" >>"$LOG_DIR/worldserver.log" 2>&1 &
+disown || true
+
+echo "Started authserver and worldserver (survives SSH disconnect)."
+echo "Bin:    $BIN_DIR"
+echo "Config: $CONF_DIR"
+echo "Logs:   $LOG_DIR/authserver.log"
+echo "        $LOG_DIR/worldserver.log"
@@ -0,0 +1,29 @@
+#!/usr/bin/env bash
+# Clone Dawnforger/Fractured and omit Docker-only paths. Use when this script is
+# already on disk (e.g. scp). Otherwise: git clone … && cd Fractured && bash scripts/vps-sparse-checkout-no-docker.sh
+#
+# Usage:
+#   bash scripts/vps-clone-without-docker.sh /path/to/Fractured git@github.com:Dawnforger/Fractured.git
+
+set -euo pipefail
+
+TARGET="${1:?usage: $0 /path/to/Fractured <git-remote-url>}"
+REMOTE="${2:?usage: $0 /path/to/Fractured <git-remote-url>}"
+
+if [[ -e "$TARGET" ]]; then
+  echo "error: $TARGET already exists; remove it or pick another path." >&2
+  exit 1
+fi
+
+mkdir -p "$(dirname "$TARGET")"
+git clone "$REMOTE" "$TARGET"
+
+cd "$TARGET"
+if [[ ! -f scripts/vps-sparse-checkout-no-docker.sh ]]; then
+  echo "error: clone missing scripts/vps-sparse-checkout-no-docker.sh — pull latest main." >&2
+  exit 1
+fi
+
+bash scripts/vps-sparse-checkout-no-docker.sh
+
+echo "Done. Next: docs/DEPLOY_LINUX_VPS.md"
@@ -0,0 +1,336 @@
+#!/usr/bin/env bash
+# Collect VPS evidence for Paragon / DBUpdater / binary staleness triage.
+# Run ON the VPS (Linux). Safe: read-only; does not restart services.
+#
+# Usage (from clone):
+#   bash scripts/vps-paragon-diagnostics.sh
+#
+# Optional environment:
+#   FRACTURED_REPO           — absolute path to Fractured git root (default: parent of scripts/)
+#   FRACTURED_WS_BIN         — path to worldserver binary (default: auto-detect)
+#   FRACTURED_WORLDSERVER_CONF — path to worldserver.conf (default: guess from BIN + common layouts)
+#   FRACTURED_SYSTEMD_UNITS  — space-separated units to try (default: "fractured-world worldserver ac-worldserver")
+#   FRACTURED_MYSQL          — prefix to invoke mysql, e.g. 'mysql -uacore -pacore -h127.0.0.1'
+#                              (default Fractured local DB user/password are often both "acore"; use ~/.my.cnf if you prefer not to pass -p on the command line)
+#                              If unset, SQL blocks are printed for manual copy-paste only.
+#   FRACTURED_SPELL_IDS      — space-separated spell IDs for spell_dbc spot-check (defaults to common DK rune spenders)
+#   FRACTURED_DIAG_OUTPUT    — full log file path (default: <repo>/var/vps-paragon-diagnostics-last.txt)
+#
+# All output is mirrored to the log file (tee) while still printing to the terminal.
+# Default path lives under var/ (gitignored in this repo). Open that file in Cursor,
+# scp it down, or: git add -f var/vps-paragon-diagnostics-last.txt  if you intend to commit it.
+
+set -u
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+REPO="${FRACTURED_REPO:-$(cd "$SCRIPT_DIR/.." && pwd)}"
+
+DIAG_OUT="${FRACTURED_DIAG_OUTPUT:-$REPO/var/vps-paragon-diagnostics-last.txt}"
+mkdir -p "$(dirname "$DIAG_OUT")"
+exec > >(tee "$DIAG_OUT") 2>&1
+echo "Logging to: $DIAG_OUT"
+
+hr() { printf '\n%s\n' "================================================================================"; }
+sub() { printf '\n-- %s\n' "$1"; }
+
+detect_worldserver_bin() {
+  local bin="" es path u units
+  if [[ -n "${FRACTURED_WS_BIN:-}" ]]; then
+    readlink -f "$FRACTURED_WS_BIN" 2>/dev/null && return
+    echo "$FRACTURED_WS_BIN"
+    return
+  fi
+
+  units="${FRACTURED_SYSTEMD_UNITS:-fractured-world worldserver ac-worldserver}"
+  for u in $units; do
+    if systemctl is-active --quiet "$u" 2>/dev/null || systemctl is-enabled --quiet "$u" 2>/dev/null; then
+      es=$(systemctl show "$u" -p ExecStart --value 2>/dev/null || true)
+      if [[ -n "$es" ]]; then
+        if [[ "$es" == \{*path=* ]]; then
+          path=$(printf '%s' "$es" | sed -n 's/.*path=\([^;]*\).*/\1/p')
+        else
+          path=$(printf '%s' "$es" | awk '{print $1}' | sed 's/^path=//')
+        fi
+        if [[ -n "$path" && -x "$path" ]]; then
+          readlink -f "$path" 2>/dev/null && return
+        fi
+      fi
+    fi
+  done
+
+  local pid
+  pid=$(pgrep -xo worldserver 2>/dev/null || true)
+  if [[ -n "$pid" ]]; then
+    readlink -f "/proc/$pid/exe" 2>/dev/null && return
+  fi
+
+  if command -v worldserver >/dev/null 2>&1; then
+    readlink -f "$(command -v worldserver)" 2>/dev/null && return
+  fi
+
+  echo ""
+}
+
+guess_worldserver_conf() {
+  local bin="$1"
+  local d cands=()
+  [[ -z "$bin" ]] && return
+  d=$(dirname "$bin")
+  cands+=("$d/../etc/worldserver.conf")
+  cands+=("$d/../../etc/worldserver.conf")
+  cands+=("$HOME/azeroth-server/etc/worldserver.conf")
+  cands+=("$HOME/env/dist/etc/worldserver.conf")
+  for f in "${cands[@]}"; do
+    f=$(readlink -f "$f" 2>/dev/null || true)
+    if [[ -n "$f" && -f "$f" ]]; then
+      echo "$f"
+      return
+    fi
+  done
+  echo ""
+}
+
+binary_strings_paths() {
+  local ws="$1"
+  [[ -z "$ws" || ! -f "$ws" ]] && return
+  strings "$ws" 2>/dev/null | grep -iE '/(home|root|opt|srv|var)[^[:space:]]*/(Fractured|fractured|azeroth|AzerothCore|acore)' | sort -u | head -40
+}
+
+hr
+echo "Fractured Paragon / native VPS diagnostics"
+echo "Date (UTC): $(date -u '+%Y-%m-%d %H:%M:%S UTC')"
+echo "Repo (expected): $REPO"
+
+sub "1A — worldserver binary"
+WS=$(detect_worldserver_bin || true)
+if [[ -z "$WS" ]]; then
+  echo "ERROR: Could not find worldserver. Set FRACTURED_WS_BIN=/full/path/to/worldserver and re-run."
+else
+  echo "Binary: $WS"
+  if stat -c 'binary mtime: %y' "$WS" 2>/dev/null; then
+    :
+  else
+    stat -f 'binary mtime: %Sm' -t '%Y-%m-%d %H:%M:%S %z' "$WS" 2>/dev/null || stat "$WS"
+  fi
+fi
+
+sub "1B — repo HEAD + Paragon_Essence.cpp mtime"
+if [[ -d "$REPO/.git" ]]; then
+  (cd "$REPO" && git log -1 --format='HEAD commit: %h %ci %s')
+else
+  echo "WARN: not a git repo: $REPO (set FRACTURED_REPO)"
+fi
+PE="$REPO/modules/mod-paragon/src/Paragon_Essence.cpp"
+if [[ -f "$PE" ]]; then
+  if stat -c 'Paragon_Essence.cpp mtime: %y' "$PE" 2>/dev/null; then
+    :
+  else
+    stat -f 'Paragon_Essence.cpp mtime: %Sm' -t '%Y-%m-%d %H:%M:%S %z' "$PE" 2>/dev/null || stat "$PE"
+  fi
+else
+  echo "WARN: missing $PE"
+fi
+
+sub "1C — strings heuristics (0 can mean stripped binary — use 1A+1B)"
+if [[ -n "$WS" && -f "$WS" ]]; then
+  c1=$(strings "$WS" 2>/dev/null | grep -c 'CLASS_PARAGON' || true)
+  c2=$(strings "$WS" 2>/dev/null | grep -c 'C BUILD SAVE_CURRENT' || true)
+  c3=$(strings "$WS" 2>/dev/null | grep -c 'character_paragon_build_share_archive' || true)
+  echo "CLASS_PARAGON count: $c1"
+  echo "C BUILD SAVE_CURRENT count: $c2"
+  echo "character_paragon_build_share_archive count: $c3"
+else
+  echo "(skipped — no binary)"
+fi
+
+sub "1D — binary fingerprint (compare sha256 across dev vs VPS)"
+if [[ -n "$WS" && -f "$WS" ]]; then
+  if command -v sha256sum >/dev/null 2>&1; then
+    sha256sum "$WS"
+  elif command -v shasum >/dev/null 2>&1; then
+    shasum -a 256 "$WS"
+  else
+    echo "(no sha256sum — install coreutils)"
+  fi
+  echo "Embedded revision / version strings (first matches):"
+  strings "$WS" 2>/dev/null | grep -iE 'azerothcore|revision|git|commit|build.*20[0-9]{2}' | head -25 || echo "(none matched)"
+else
+  echo "(skipped — no binary)"
+fi
+
+CONF="${FRACTURED_WORLDSERVER_CONF:-}"
+if [[ -z "$CONF" && -n "$WS" ]]; then
+  CONF=$(guess_worldserver_conf "$WS")
+fi
+
+sub "2B — worldserver.conf (updater / source / rates / paragon)"
+if [[ -n "$CONF" && -f "$CONF" ]]; then
+  echo "Using conf: $CONF"
+  grep -E '^SourceDirectory|^Updates\.EnableDatabases|^Updates\.AutoSetup|^[[:space:]]*SourceDirectory|^[[:space:]]*Updates\.EnableDatabases|^[[:space:]]*Updates\.AutoSetup' "$CONF" 2>/dev/null || echo "(no matching lines or unreadable)"
+  echo "--- Rate.RunicPower (if set) ---"
+  grep -iE '^Rate\.RunicPower|^[[:space:]]*Rate\.RunicPower' "$CONF" 2>/dev/null || echo "(not set — server uses default)"
+  echo "--- Paragon.* module options (if any) ---"
+  grep -iE '^Paragon\.|^[[:space:]]*Paragon\.' "$CONF" 2>/dev/null || echo "(no Paragon.* keys in worldserver.conf — check etc/modules/mod_paragon.conf)"
+else
+  echo "WARN: worldserver.conf not found. Set FRACTURED_WORLDSERVER_CONF=/path/to/worldserver.conf"
+fi
+
+if [[ -n "$WS" && -f "$WS" ]]; then
+  ETCGuess=$(readlink -f "$(dirname "$WS")/../etc" 2>/dev/null || true)
+  MPC="$ETCGuess/modules/mod_paragon.conf"
+  if [[ -f "$MPC" ]]; then
+    sub "2B2 — mod_paragon.conf Paragon.* toggles (non-comment)"
+    grep -E '^Paragon\.' "$MPC" 2>/dev/null | head -40 || echo "(no uncommented Paragon.* lines)"
+  fi
+fi
+
+sub "2A — path-like strings from binary (candidate source roots)"
+if [[ -n "$WS" && -f "$WS" ]]; then
+  binary_strings_paths "$WS" || true
+else
+  echo "(skipped)"
+fi
+
+sub "Resolved source root for 2D"
+RESOLVED=""
+if [[ -n "$CONF" && -f "$CONF" ]]; then
+  sd=$(awk -F= '/^[[:space:]]*SourceDirectory[[:space:]]*=/ {
+    gsub(/^[[:space:]]+|[[:space:]]+$/, "", $2);
+    gsub(/^["'\'']|["'\'']$/, "", $2);
+    print $2; exit }' "$CONF" 2>/dev/null || true)
+  if [[ -n "${sd:-}" ]]; then
+    RESOLVED="$sd"
+  fi
+fi
+if [[ -z "$RESOLVED" ]]; then
+  RESOLVED="$REPO"
+fi
+echo "Using RESOLVED=$RESOLVED (from SourceDirectory if set in conf, else FRACTURED_REPO)"
+
+sub "2D — Paragon SQL dirs under RESOLVED"
+for subdir in \
+  "$RESOLVED/modules/mod-paragon/data/sql/db-world/updates/" \
+  "$RESOLVED/modules/mod-paragon/data/sql/db-characters/updates/"; do
+  if [[ -d "$subdir" ]]; then
+    echo "Listing: $subdir"
+    ls -la "$subdir" 2>/dev/null | tail -15
+  else
+    echo "MISSING: $subdir"
+  fi
+done
+
+sub "CMake build dir hints (common Fractured layouts)"
+for cand in "$REPO/var/build/obj" "$REPO/build" "$REPO/../build"; do
+  if [[ -f "$cand/CMakeCache.txt" ]]; then
+    echo "Found CMakeCache: $cand/CMakeCache.txt"
+    grep -E '^CMAKE_HOME_DIRECTORY:|^MODULES:|^CMAKE_INSTALL_PREFIX:' "$cand/CMakeCache.txt" 2>/dev/null | head -5
+  fi
+done
+
+sub "DATABASE — updates rows (2026_05_10 / paragon)"
+SQL_WORLD=$(cat <<'EOS'
+SELECT name, hash, speed FROM updates
+ WHERE name LIKE '2026_05_10%' OR name LIKE '%paragon%'
+ ORDER BY name DESC LIMIT 30;
+EOS
+)
+SQL_CHAR="$SQL_WORLD"
+
+if [[ -n "${FRACTURED_MYSQL:-}" ]]; then
+  echo "--- acore_world ---"
+  $FRACTURED_MYSQL acore_world -e "$SQL_WORLD" || echo "(mysql failed for acore_world)"
+  echo "--- acore_characters ---"
+  $FRACTURED_MYSQL acore_characters -e "$SQL_CHAR" || echo "(mysql failed for acore_characters)"
+
+  sub "DATABASE — DBC parity for runes / Paragon (acore_world)"
+  # Common DK rune spenders (WotLK). Override: export FRACTURED_SPELL_IDS='45477 45462'
+  SPELL_IDS="${FRACTURED_SPELL_IDS:-45477 45462 49923 55050 56815}"
+  IDS_CSV=$(echo "$SPELL_IDS" | tr ' ' ',')
+  echo "--- spell_dbc table size (world DB overrides; 0 rows = all spells from disk DBC only) ---"
+  $FRACTURED_MYSQL acore_world -e "SELECT COUNT(*) AS spell_dbc_rows FROM spell_dbc;" 2>/dev/null || echo "(spell_dbc missing or no access)"
+  echo "--- acore_world.version (last core revision written by worldserver) ---"
+  $FRACTURED_MYSQL acore_world -e "SELECT * FROM version LIMIT 5;" 2>/dev/null || echo "(version table missing?)"
+
+  echo "--- chrclasses_dbc class 6 + 12 (DisplayPower: 0=mana, 5=POWER_RUNE in AC) ---"
+  $FRACTURED_MYSQL acore_world -e "
+SELECT ID, DisplayPower, Name_Lang_enUS FROM chrclasses_dbc WHERE ID IN (6,12);
+" 2>/dev/null || echo "(query failed — chrclasses_dbc missing?)"
+  echo "Note: If only ID=12 appears, class 6 (DK) is not overridden in DB — loaded from disk DBC (normal)."
+
+  echo "--- spell_dbc: are sample DK spells overridden in DB? ---"
+  spell_sample_n=$($FRACTURED_MYSQL acore_world -N -B -e \
+    "SELECT COUNT(*) FROM spell_dbc WHERE ID IN ($IDS_CSV);" 2>/dev/null || echo 0)
+  echo "Row count in spell_dbc for sample IDs ($SPELL_IDS): ${spell_sample_n:-0}"
+  if [[ "${spell_sample_n:-0}" == "0" ]]; then
+    echo "=> 0 means those spells use on-disk Spell.dbc only; the sample block below will be empty (not an error)."
+  fi
+  echo "--- spell_dbc sample (PowerType 5 = POWER_RUNE in AC) ---"
+  $FRACTURED_MYSQL acore_world -e "
+SELECT ID, PowerType, ManaCost, RuneCostID FROM spell_dbc WHERE ID IN ($IDS_CSV);
+" 2>/dev/null || echo "(query failed — spell_dbc missing or wrong schema)"
+  echo "--- spellrunecost join for sample IDs (empty if no spell_dbc rows above) ---"
+  $FRACTURED_MYSQL acore_world -e "
+SELECT s.ID AS spell_id, s.PowerType, s.RuneCostID, r.Blood, r.Unholy, r.Frost, r.RunicPower
+FROM spell_dbc s
+LEFT JOIN spellrunecost_dbc r ON r.ID = s.RuneCostID
+WHERE s.ID IN ($IDS_CSV);
+" 2>/dev/null || echo "(join failed — check spellrunecost_dbc)"
+
+  echo "--- spell_dbc suspicious overrides: RuneCostID>0 but PowerType!=5 (can break rune checks) ---"
+  $FRACTURED_MYSQL acore_world -e "
+SELECT ID, PowerType, ManaCost, RuneCostID FROM spell_dbc
+ WHERE RuneCostID > 0 AND PowerType <> 5
+ ORDER BY ID LIMIT 40;
+" 2>/dev/null || echo "(query failed)"
+  echo "Compare counts/IDs to dev: unexpected rows here warrant a DB diff."
+
+  echo "--- spell_dbc POWER_RUNE (5) spells with RuneCostID (sample) ---"
+  $FRACTURED_MYSQL acore_world -e "
+SELECT ID, PowerType, RuneCostID FROM spell_dbc
+ WHERE PowerType = 5 AND RuneCostID > 0
+ ORDER BY ID LIMIT 15;
+" 2>/dev/null || echo "(query failed)"
+else
+  echo "FRACTURED_MYSQL not set — run manually (example: export FRACTURED_MYSQL='mysql -uUSER -hHOST')"
+  echo "acore_world:"
+  echo "$SQL_WORLD"
+  echo "acore_characters:"
+  echo "$SQL_CHAR"
+  echo ""
+  echo "Optional DBC parity (acore_world) — run after connecting:"
+  echo "  SELECT ID, DisplayPower, Name_Lang_enUS FROM chrclasses_dbc WHERE ID IN (6,12);"
+  echo "  SELECT ID, PowerType, ManaCost, RuneCostID FROM spell_dbc WHERE ID IN (45477,45462,49923,55050,56815);"
+  echo "  SELECT s.ID, s.RuneCostID, r.Blood, r.Unholy, r.Frost, r.RunicPower FROM spell_dbc s"
+  echo "    LEFT JOIN spellrunecost_dbc r ON r.ID = s.RuneCostID WHERE s.ID IN (45477,45462,49923,55050,56815);"
+fi
+
+sub "mod_paragon.conf vs .dist (install etc)"
+ETC=""
+if [[ -n "$WS" ]]; then
+  ETC=$(readlink -f "$(dirname "$WS")/../etc" 2>/dev/null || true)
+fi
+if [[ -z "$ETC" || ! -d "$ETC" ]]; then
+  ETC=$(readlink -f "$HOME/azeroth-server/etc" 2>/dev/null || true)
+fi
+if [[ -n "$ETC" && -d "$ETC/modules" ]]; then
+  MP="$ETC/modules/mod_paragon.conf"
+  MPD="$ETC/modules/mod_paragon.conf.dist"
+  if [[ -f "$MP" && -f "$MPD" ]]; then
+    diff -u "$MP" "$MPD" 2>/dev/null | head -80 || true
+  else
+    echo "ETC=$ETC — mod_paragon.conf or .dist missing (MP=$MP MPD=$MPD)"
+  fi
+else
+  echo "Could not find install etc/modules (set paths manually for diff)."
+fi
+
+hr
+echo "DELIVERABLE for maintainer:"
+echo "1) Paste 1A–1D (binary mtime, git HEAD, strings, sha256 + revision strings)."
+echo "2) Paste DATABASE blocks: updates + DBC parity (chrclasses 12, spell_dbc, spellrunecost join)."
+echo "3) Paste 2A path strings + 2D listings (or MISSING lines)."
+echo "4) From dev: same 1D sha256 of worldserver OR same SQL block — proves binary/data parity."
+echo "5) ONE sentence: exact in-game symptom."
+echo "Done."
+echo ""
+echo "Full transcript: $DIAG_OUT"
@@ -0,0 +1,40 @@
+#!/usr/bin/env bash
+# Omit Docker-only paths from the working tree (native VPS / production clones).
+# Repository root is the AzerothCore tree (flat layout).
+#
+# Run from repository root (directory that contains acore.sh and apps/).
+#
+# Usage:
+#   bash scripts/vps-sparse-checkout-no-docker.sh
+#
+# Restore full tree: git sparse-checkout disable
+
+set -euo pipefail
+
+ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+cd "$ROOT"
+
+if [[ ! -d .git ]]; then
+  echo "error: run from a git clone (no .git in $ROOT)." >&2
+  exit 1
+fi
+
+git sparse-checkout init --no-cone
+
+cat >.git/info/sparse-checkout <<'EOF'
+/*
+!/docker-compose.yml
+!/docker-compose.override.yml
+!/apps/docker/
+!/env/docker-focal-build/
+!/.devcontainer/
+EOF
+
+if git sparse-checkout reapply 2>/dev/null; then
+  :
+else
+  git read-tree -mu HEAD
+fi
+
+echo "Sparse checkout applied (Docker-only paths omitted)."
+echo "To restore full tree locally: git sparse-checkout disable"
@@ -0,0 +1,202 @@
+#!/usr/bin/env bash
+# Fractured / AzerothCore — native VPS rolling update (git + compile).
+#
+# Run from anywhere; resolves the repository root from this script's location.
+# Typical production layout: sources in ~/src/Fractured, install prefix in ~/azeroth-server
+# (see docs/DEPLOY_LINUX_VPS.md).
+#
+# What this does:
+#   1. git pull on the current branch (optional; can skip)
+#   2. ./acore.sh compiler build  — or  compiler all  for a full clean rebuild
+#
+# Database migrations from data/sql/updates/ run when you next start worldserver/authserver
+# (Updates.* / SourceDirectory in *.conf). This script does not start or stop daemons unless
+# you pass --run-after or set FRACTURED_POST_UPDATE_CMD.
+#
+# Usage:
+#   bash scripts/vps-update-server.sh
+#   bash scripts/vps-update-server.sh --full
+#   bash scripts/vps-update-server.sh --no-pull
+#   bash scripts/vps-update-server.sh --dry-run
+#   FRACTURED_POST_UPDATE_CMD='sudo systemctl restart fractured-world' bash scripts/vps-update-server.sh --run-after
+#   bash scripts/vps-update-server.sh --run-after 'sudo systemctl restart fractured-world'
+#
+# Environment:
+#   FRACTURED_GIT_REMOTE   — remote name (default: origin)
+#   FRACTURED_POST_UPDATE_CMD — shell command run after a successful compile (if --run-after is passed without an argument, this is used)
+
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+ROOT="$(cd "$SCRIPT_DIR/.." && pwd)"
+
+NO_PULL=0
+FULL_BUILD=0
+COMPILE_ONLY=0
+DRY_RUN=0
+DO_RUN_AFTER=0
+INSTALL_PREFIX=""
+POST_UPDATE_CMD="${FRACTURED_POST_UPDATE_CMD:-}"
+GIT_REMOTE="${FRACTURED_GIT_REMOTE:-origin}"
+
+usage() {
+  cat <<'EOF'
+Fractured VPS update — git pull + compiler (see header in script for full notes).
+
+Usage:
+  bash scripts/vps-update-server.sh [options]
+
+Options:
+  --no-pull       Skip git pull (only compile current tree).
+  --full          ./acore.sh compiler all (clean + configure + compile).
+  --compile-only  ./acore.sh compiler compile (incremental).
+  --prefix PATH   Override CMAKE_INSTALL_PREFIX (updates conf/config.sh BINPATH).
+  --dry-run       Print commands without running them.
+  --run-after [CMD]  Run shell command after successful compile. If CMD is omitted,
+                  uses FRACTURED_POST_UPDATE_CMD from the environment.
+
+Environment:
+  FRACTURED_GIT_REMOTE         Git remote (default: origin).
+  FRACTURED_POST_UPDATE_CMD    Used with bare --run-after.
+EOF
+}
+
+run() {
+  if [[ "$DRY_RUN" -eq 1 ]]; then
+    printf '[dry-run] '
+    printf '%q ' "$@"
+    printf '\n'
+  else
+    "$@"
+  fi
+}
+
+while [[ $# -gt 0 ]]; do
+  case "$1" in
+    -h | --help)
+      usage
+      exit 0
+      ;;
+    --no-pull)
+      NO_PULL=1
+      shift
+      ;;
+    --full)
+      FULL_BUILD=1
+      shift
+      ;;
+    --compile-only)
+      COMPILE_ONLY=1
+      shift
+      ;;
+    --prefix)
+      shift
+      if [[ $# -eq 0 || "$1" == -* ]]; then
+        echo "error: --prefix requires a path argument" >&2
+        exit 2
+      fi
+      INSTALL_PREFIX="$1"
+      shift
+      ;;
+    --dry-run)
+      DRY_RUN=1
+      shift
+      ;;
+    --run-after)
+      DO_RUN_AFTER=1
+      shift
+      if [[ $# -gt 0 && "$1" != -* ]]; then
+        POST_UPDATE_CMD="$1"
+        shift
+      fi
+      ;;
+    *)
+      echo "error: unknown option: $1" >&2
+      echo "Try: bash scripts/vps-update-server.sh --help" >&2
+      exit 2
+      ;;
+  esac
+done
+
+if [[ "$FULL_BUILD" -eq 1 && "$COMPILE_ONLY" -eq 1 ]]; then
+  echo "error: use only one of --full or --compile-only" >&2
+  exit 2
+fi
+
+if [[ ! -d "$ROOT/.git" ]]; then
+  echo "error: not a git clone: $ROOT" >&2
+  exit 1
+fi
+
+if [[ ! -f "$ROOT/acore.sh" ]]; then
+  echo "error: acore.sh not found under $ROOT" >&2
+  exit 1
+fi
+
+if [[ ! -f "$ROOT/conf/config.sh" ]]; then
+  echo "error: missing $ROOT/conf/config.sh — copy conf/dist/config.sh and edit (see DEPLOY_LINUX_VPS.md)." >&2
+  exit 1
+fi
+
+cd "$ROOT"
+
+if [[ -n "$INSTALL_PREFIX" ]]; then
+  echo "==> updating conf/config.sh BINPATH to: $INSTALL_PREFIX"
+  if grep -q '^BINPATH=' conf/config.sh; then
+    run sed -i "s|^BINPATH=.*|BINPATH=\"$INSTALL_PREFIX\"|" conf/config.sh
+  else
+    echo "BINPATH=\"$INSTALL_PREFIX\"" >> conf/config.sh
+  fi
+  export BINPATH="$INSTALL_PREFIX"
+fi
+
+if [[ "$DO_RUN_AFTER" -eq 1 && -z "${POST_UPDATE_CMD// }" ]]; then
+  echo "error: --run-after needs a command or FRACTURED_POST_UPDATE_CMD set in the environment." >&2
+  exit 2
+fi
+
+current_branch() {
+  git symbolic-ref -q --short HEAD || git rev-parse --short HEAD
+}
+
+if [[ "$NO_PULL" -eq 0 ]]; then
+  ref="$(current_branch)"
+  if [[ "$ref" == "HEAD" ]]; then
+    echo "error: detached HEAD; checkout a branch or use --no-pull." >&2
+    exit 1
+  fi
+  echo "==> git pull $GIT_REMOTE $ref"
+  run git pull "$GIT_REMOTE" "$ref"
+else
+  echo "==> skipping git pull (--no-pull)"
+fi
+
+echo "==> ensuring acore.sh and JSONPath are executable"
+if [[ "$DRY_RUN" -eq 1 ]]; then
+  run chmod +x acore.sh deps/jsonpath/JSONPath.sh
+else
+  chmod +x acore.sh deps/jsonpath/JSONPath.sh 2>/dev/null || true
+fi
+
+if [[ "$FULL_BUILD" -eq 1 ]]; then
+  echo "==> ./acore.sh compiler all  (clean, configure, compile)"
+  run ./acore.sh compiler all
+elif [[ "$COMPILE_ONLY" -eq 1 ]]; then
+  echo "==> ./acore.sh compiler compile  (incremental; build dir must exist)"
+  run ./acore.sh compiler compile
+else
+  echo "==> ./acore.sh compiler build  (configure + compile)"
+  run ./acore.sh compiler build
+fi
+
+if [[ "$DO_RUN_AFTER" -eq 1 ]]; then
+  echo "==> post-update: $POST_UPDATE_CMD"
+  if [[ "$DRY_RUN" -eq 1 ]]; then
+    printf '[dry-run] eval %q\n' "$POST_UPDATE_CMD"
+  else
+    # shellcheck disable=SC2086
+    eval "$POST_UPDATE_CMD"
+  fi
+fi
+
+echo "Done. Restart authserver/worldserver (or your service manager) when ready so new binaries and SQL updates apply."
@@ -53,12 +53,14 @@ MaxPingTime = 30
 #
 #    RealmServerPort
 #        Description: TCP port the auth server listens on (login handshake).
-#        Fractured production: match your client realmlist host:port, e.g.
-#          set realmlist hsrwow.net:47497
-#        requires RealmServerPort = 47497 and firewall/NAT to this process.
-#        Default:     3724 (stock WoW); Fractured dist default: 47497
+#        3724 is the stock WoW default; clients with `set realmlist <host>`
+#        (no port) connect here. Production deployments that cannot bind
+#        3724 (NAT, conflicting service, etc.) can set this to e.g. 47497
+#        and have clients use `set realmlist <host>:47497` -- the
+#        Fractured-patched Wow.exe supports the host:port syntax.
+#        Default:     3724

-RealmServerPort = 47497
+RealmServerPort = 3724

 #
 #
@@ -4767,6 +4767,36 @@ Respawn.DynamicEscortNPC = 0

 Respawn.ForceCompatibilityMode = 0

+#
+#    Paragon.WildcardFamilyMatching
+#        Description: Fractured / Paragon class (CLASS_PARAGON, id 12) only.
+#                     When enabled, the SpellFamilyName equality check is
+#                     wildcarded for Paragon characters in proc evaluation
+#                     (SpellMgr::CanSpellTriggerProcOnEvent), talent
+#                     SpellMod application (Player::ApplySpellMod /
+#                     SpellInfo::IsAffectedBySpellMod), and the
+#                     ParagonFamilyMatches() helper used by ad-hoc
+#                     `switch (SpellFamilyName)` listener gates in
+#                     Unit/SpellEffects/SpellAuraEffects code.
+#                     This makes cross-class talent procs and modifiers
+#                     (e.g. Predator's Swiftness 69369 making Shaman
+#                     Chain Lightning instant cast off a Rogue Eviscerate
+#                     finisher) apply to Paragon characters even when the
+#                     listener was authored for one specific class family.
+#                     SpellFamilyFlags / class-mask flag-bit checks still
+#                     run, so listener gates that explicitly opt into a
+#                     subset of spells via flag bits are still respected.
+#                     Stock classes (Warrior / Paladin / etc.) are NEVER
+#                     wildcarded; this only affects players whose class
+#                     id is CLASS_PARAGON. Set to 0 to disable the
+#                     wildcard at runtime (no rebuild required) if a
+#                     regression appears.
+#        Default:     1 - (Enabled, Paragon characters get cross-class procs/mods)
+#                     0 - (Disabled, Paragon characters are gated by stock family equality)
+#
+
+Paragon.WildcardFamilyMatching = 1
+
 #
 ###################################################################################################

@@ -669,7 +669,12 @@ bool AuctionHouseUsablePlayerInfo::PlayerCanUseItem(ItemTemplate const* proto) c
            return false;
    }

-    if ((proto->AllowableClass & classMask) == 0 || (proto->AllowableRace & raceMask) == 0)
+    // mod-paragon: class 12 (Paragon) ignores AllowableClass for AH "Usable"
+    // filter. classMask here is the searching player's mask; PARAGON_BIT 0x800
+    // = (1 << (12 - 1)). Race restriction still applies.
+    bool const searcherIsParagon = (classMask & 0x800u) != 0;
+    if ((!searcherIsParagon && (proto->AllowableClass & classMask) == 0)
+        || (proto->AllowableRace & raceMask) == 0)
        return false;

    if (proto->RequiredSkill != 0)
@@ -7143,6 +7143,18 @@ bool Player::CheckAttackFitToAuraRequirement(WeaponAttackType attackType, AuraEf
    if (spellInfo->EquippedItemClass == -1)
        return true;

+    // Fractured / Paragon: cross-class wildcard relaxes the weapon-subclass
+    // gate ONLY for the curated allowlist of cross-class proc talents
+    // (currently just Maelstrom Weapon 51528-51532). Weapon-specialization
+    // talents like Sword Specialization, Mace Specialization, Hack and
+    // Slash, Two-Handed Weapon Specialization etc. deliberately stay
+    // weapon-gated for Paragon -- the player picks a weapon and the
+    // matching specialization passive activates, same as any class.
+    if (spellInfo->EquippedItemClass == ITEM_CLASS_WEAPON
+        && IsParagonWildcardCaller(this)
+        && IsParagonWeaponSubclassWildcardSpell(spellInfo->Id))
+        return GetWeaponForAttack(attackType, true) != nullptr;
+
    Item* item = GetWeaponForAttack(attackType, true);
    if (!item || !item->IsFitToSpellRequirements(spellInfo))
        return false;
@@ -7208,7 +7220,7 @@ void Player::ApplyEquipSpell(SpellInfo const* spellInfo, Item* item, bool apply,
            return;

        // Cannot be used in this stance/form
-        if (spellInfo->CheckShapeshift(GetShapeshiftForm()) != SPELL_CAST_OK)
+        if (spellInfo->CheckShapeshift(GetShapeshiftForm(), this) != SPELL_CAST_OK)
            return;

        if (form_change)                                    // check aura active state from other form
@@ -7228,7 +7240,7 @@ void Player::ApplyEquipSpell(SpellInfo const* spellInfo, Item* item, bool apply,
        if (form_change)                                     // check aura compatibility
        {
            // Cannot be used in this stance/form
-            if (spellInfo->CheckShapeshift(GetShapeshiftForm()) == SPELL_CAST_OK)
+            if (spellInfo->CheckShapeshift(GetShapeshiftForm(), this) == SPELL_CAST_OK)
                return;                                     // and remove only not compatible at form change
        }

@@ -9773,7 +9785,11 @@ bool Player::IsAffectedBySpellmod(SpellInfo const* spellInfo, SpellModifier* mod
    if (mod->op == SPELLMOD_DURATION && spellInfo->GetDuration() == -1)
        return false;

-    return spellInfo->IsAffectedBySpellMod(mod);
+    // Fractured / Paragon: pass the player owning the modifier aura so the
+    // SpellFamilyName equality check can be wildcarded for CLASS_PARAGON.
+    // Stock classes hit the same code path with `this` as a non-Paragon
+    // unit, which makes IsAffected behave identically to the 2-arg form.
+    return spellInfo->IsAffectedBySpellMod(mod, this);
 }

 template <class T>
@@ -10687,7 +10703,12 @@ bool Player::BuyItemFromVendorSlot(ObjectGuid vendorguid, uint32 vendorslot, uin
        return false;
    }

-    if (!(pProto->AllowableClass & getClassMask()) && pProto->Bonding == BIND_WHEN_PICKED_UP && !IsGameMaster())
+    // mod-paragon: class 12 ignores BoP buy-side AllowableClass gate, so
+    // class-restricted vendor items (e.g. class glyphs) can be purchased.
+    if (getClass() != CLASS_PARAGON
+        && !(pProto->AllowableClass & getClassMask())
+        && pProto->Bonding == BIND_WHEN_PICKED_UP
+        && !IsGameMaster())
    {
        SendBuyError(BUY_ERR_CANT_FIND_ITEM, nullptr, item, 0);
        return false;
@@ -12012,6 +12033,41 @@ void Player::learnSkillRewardedSpells(uint32 skill_id, uint32 skill_value)
    uint32 raceMask  = getRaceMask();
    uint32 classMask = getClassMask();

+    // Fractured / Paragon: the Character Advancement panel is the sole
+    // authority over which class abilities a Paragon owns. The skill-line
+    // cascade re-fires from _LoadSkills (every login), UpdateSkillsForLevel
+    // (every level-up), UpdateSkillPro (every weapon-skill tick on a
+    // training dummy), and SetSkill (first time a class skill is granted).
+    // Each of those re-grants every SLA-tagged class ability on the
+    // matching skill line — leaking Blood Presence / Death Coil / Death
+    // Grip / etc. back into the spellbook within seconds even after the
+    // player intentionally refunded them via the panel. Skip the cascade
+    // for class-category skill lines on Paragon characters; mod-paragon
+    // calls Player::learnSpell directly for the abilities the player
+    // actually purchased, including their attached passives. Profession,
+    // weapon, language, and racial skill cascades stay enabled so things
+    // like recipe auto-learn, weapon proficiencies, and racial perks
+    // still work.
+    //
+    // Carve-out: SKILL_RUNEFORGING (776) is a CLASS-category skill but
+    // behaves like a profession in this context — the player buys ONE
+    // panel ability (Runeforging, spell 53428) and the rune-enchant
+    // spells (Rune of the Fallen Crusader, Razorice, Cinderglacier, ...)
+    // are supposed to come along for the ride via the standard SLA
+    // cascade, exactly the same way they do for a stock DK. Without
+    // this carve-out, the early-return below blocks the cascade and a
+    // Paragon who buys Runeforging gets the skill but no actual rune
+    // options at the runeforge anvil. The cascade only fires once per
+    // skill-grant for 776 (it's not on UpdateSkillsForLevel) so the
+    // "leaking back into the spellbook" concern that motivates the
+    // early-return doesn't apply to this skill.
+    if (getClass() == CLASS_PARAGON && skill_id != SKILL_RUNEFORGING)
+    {
+        if (SkillLineEntry const* sl = sSkillLineStore.LookupEntry(skill_id))
+            if (sl->categoryId == SKILL_CATEGORY_CLASS)
+                return;
+    }
+
    // Get all abilities for this skill and sort by MinSkillLineRank (lowest to highest)
    auto abilities = GetSkillLineAbilitiesBySkillLine(skill_id);
    std::vector<SkillLineAbilityEntry const*> sortedAbilities(abilities.begin(), abilities.end());
@@ -12550,6 +12606,31 @@ bool Player::HasItemFitToSpellRequirements(SpellInfo const* spellInfo, Item cons
    if (spellInfo->EquippedItemClass < 0)
        return true;

+    // Fractured / Paragon: cross-class wildcard relaxes the weapon-subclass
+    // gate ONLY for the curated allowlist of cross-class proc talents
+    // (currently just Maelstrom Weapon 51528-51532) so the passive talent
+    // aura attaches when the player wields a non-stock weapon. Weapon-
+    // specialization talents (Sword/Mace Specialization, Hack and Slash,
+    // Two-Handed Weapon Specialization, etc.) deliberately stay weapon-
+    // gated -- they're meant to bind to a specific weapon type. Still
+    // requires *some* weapon equipped (unarmed Paragons don't auto-activate
+    // weapon talents). ITEM_CLASS_ARMOR (shield) is left alone -- shield-
+    // gated talents still need an actual shield.
+    if (spellInfo->EquippedItemClass == ITEM_CLASS_WEAPON
+        && IsParagonWildcardCaller(this)
+        && IsParagonWeaponSubclassWildcardSpell(spellInfo->Id))
+    {
+        for (uint8 i = EQUIPMENT_SLOT_MAINHAND; i < EQUIPMENT_SLOT_TABARD; ++i)
+            if (Item const* item = GetUseableItemByPos(INVENTORY_SLOT_BAG_0, i))
+                if (item != ignoreItem)
+                    if (ItemTemplate const* proto = item->GetTemplate())
+                        if (proto->Class == ITEM_CLASS_WEAPON)
+                            return true;
+        // No weapon equipped at all -- fall through to stock logic, which
+        // returns false for passive talent auras (correct: an unarmed
+        // Paragon shouldn't have weapon talents active).
+    }
+
    // scan other equipped items for same requirements (mostly 2 daggers/etc)
    // for optimize check 2 used cases only
    switch (spellInfo->EquippedItemClass)
@@ -14084,7 +14165,12 @@ void Player::LearnTalent(uint32 talentId, uint32 talentRank, bool command /*= fa
    }

    // xinef: check if talent deponds on another talent
-    if (talentInfo->DependsOn > 0)
+    // mod-paragon: Character Advancement gates talents by AE/TE essence cost,
+    // not by the column-arrow prereq from Blizzard's spec UI. For class 12
+    // (Paragon) we skip the DependsOn check so e.g. Deep Wounds, Bloody
+    // Vengeance and Expose Weakness can be picked without first speccing into
+    // their unrelated prereq sibling.
+    if (talentInfo->DependsOn > 0 && getClass() != CLASS_PARAGON)
        if (TalentEntry const* depTalentInfo = sTalentStore.LookupEntry(talentInfo->DependsOn))
        {
            bool hasEnoughRank = false;
@@ -2364,7 +2364,16 @@ InventoryResult Player::CanUseItem(ItemTemplate const* proto) const
        return EQUIP_ERR_YOU_CAN_NEVER_USE_THAT_ITEM;
    }

-    if ((proto->AllowableClass & getClassMask()) == 0 || (proto->AllowableRace & getRaceMask()) == 0)
+    // mod-paragon: class 12 (Paragon) ignores AllowableClass entirely, so any
+    // class-restricted item (including class glyphs) can be equipped/used.
+    // Race restriction still applies; proficiency/level/skill checks below
+    // still gate it sensibly via the standard skill cascade.
+    if (getClass() != CLASS_PARAGON
+        && (proto->AllowableClass & getClassMask()) == 0)
+    {
+        return EQUIP_ERR_YOU_CAN_NEVER_USE_THAT_ITEM;
+    }
+    if ((proto->AllowableRace & getRaceMask()) == 0)
    {
        return EQUIP_ERR_YOU_CAN_NEVER_USE_THAT_ITEM;
    }
@@ -2430,7 +2439,11 @@ InventoryResult Player::CanRollForItemInLFG(ItemTemplate const* proto, WorldObje
        SKILL_FISHING
    }; //Copy from function Item::GetSkill()

-    if ((proto->AllowableClass & getClassMask()) == 0 || (proto->AllowableRace & getRaceMask()) == 0)
+    // mod-paragon: class 12 ignores AllowableClass for LFG roll eligibility.
+    if (getClass() != CLASS_PARAGON
+        && (proto->AllowableClass & getClassMask()) == 0)
+        return EQUIP_ERR_YOU_CAN_NEVER_USE_THAT_ITEM;
+    if ((proto->AllowableRace & getRaceMask()) == 0)
        return EQUIP_ERR_YOU_CAN_NEVER_USE_THAT_ITEM;

    if (proto->RequiredSpell != 0 && !HasSpell(proto->RequiredSpell))
@@ -385,6 +385,13 @@ void Player::UpdateAttackPowerAndDamage(bool ranged)
                break;
            }
        }
+        else if (getClass() == CLASS_PARAGON)
+        {
+            // Fractured class 12: same hybrid curve as requested for Paragon UI
+            // (level*2 + AGI + STR - 20). Implemented in core so we do not rely
+            // on PlayerScript hooks in this hot path.
+            val2 = level * 2.0f + GetStat(STAT_AGILITY) + GetStat(STAT_STRENGTH) - 20.0f;
+        }
        else
        {
            val2 = GetStat(STAT_AGILITY) - 10.0f;
@@ -467,7 +474,25 @@ void Player::UpdateAttackPowerAndDamage(bool ranged)
            switch (GetShapeshiftForm())
            {
            case FORM_CAT:
-                val2 = (GetLevel() * mLevelMult) + GetStat(STAT_STRENGTH) * 2.0f + GetStat(STAT_AGILITY) - 20.0f + weapon_bonus + m_baseFeralAP;
+                // Fractured: Cat Form gets 2 AP per Agility instead of stock 1.
+                // Field reports said "weapons dont automatically feature feral
+                // AP on this server and nothing is currently rescaled, super
+                // low feral scale" -- specifically a CAT issue, not a bear
+                // issue (the resident bear had 11k AP, the resident cat was
+                // miles behind because Stam > AP and Armor > AP for bears
+                // hides the missing weapon-AP for them but cat's whole
+                // mainline is melee crits scaling off AP). The cleanest knob
+                // that does NOT touch bear is the AGI multiplier in this
+                // switch -- bears get STR*2 with no AGI term, so doubling
+                // the AGI coefficient lifts cat's primary scaling stat
+                // without re-buffing bear. Also pairs with the cat-form
+                // Master Shapeshifter buff in SpellAuraEffects.cpp's
+                // FORM_CAT branch (bp doubled there). Together that lands
+                // the resident Feral expert's recommendation
+                // ("instead of adding a new passive, you could probably
+                // just increase Cat Form's Master Shapeshifter value along
+                // with its tooltip, alongside buffing the agi scaling").
+                val2 = (GetLevel() * mLevelMult) + GetStat(STAT_STRENGTH) * 2.0f + GetStat(STAT_AGILITY) * 2.0f - 20.0f + weapon_bonus + m_baseFeralAP;
                break;
            case FORM_BEAR:
            case FORM_DIREBEAR:
@@ -481,6 +506,10 @@ void Player::UpdateAttackPowerAndDamage(bool ranged)
                break;
            }
        }
+        else if (getClass() == CLASS_PARAGON)
+        {
+            val2 = level * 2.0f + GetStat(STAT_STRENGTH) + GetStat(STAT_AGILITY) - 20.0f;
+        }
        else if (IsClass(CLASS_MAGE, CLASS_CONTEXT_STATS) || IsClass(CLASS_PRIEST, CLASS_CONTEXT_STATS) || IsClass(CLASS_WARLOCK, CLASS_CONTEXT_STATS))
        {
            val2 = GetStat(STAT_STRENGTH) - 10.0f;
@@ -72,11 +72,153 @@
 #include "Util.h"
 #include "Vehicle.h"
 #include "World.h"
+#include "WorldConfig.h"
 #include "WorldPacket.h"
 #include <algorithm>
 #include <cmath>
 #include <limits>

+// Fractured / Paragon: single source of truth for the runtime "is this
+// caller eligible for the cross-class wildcard?" question. Centralizing
+// here keeps every dependent behavior (family-name skip in
+// SpellInfo::IsAffected, PERIODIC_LEECH disease counting in
+// GetDiseasesByCaster, instant-cast intercept in Spell::prepare for
+// Predator's / Nature's Swiftness, Vampiric Embrace CheckProc cross-family
+// path, etc.) flipping in lockstep when the config flag is toggled.
+bool IsParagonWildcardCaller(Unit const* listener)
+{
+    return listener && listener->getClass() == CLASS_PARAGON
+        && sWorld->getBoolConfig(CONFIG_PARAGON_WILDCARD_FAMILY);
+}
+
+// Fractured / Paragon: cross-class wildcard helper used by ad-hoc
+// `switch (SpellFamilyName)` listener gates in Unit / SpellEffects /
+// SpellAuraEffects. Returns true when the listener is a CLASS_PARAGON
+// player and the wildcard config flag is enabled, otherwise falls back
+// to strict family-name equality.
+bool ParagonFamilyMatches(Unit const* listener, uint32 expectedFamily, uint32 actualFamily)
+{
+    if (IsParagonWildcardCaller(listener))
+        return true;
+    return expectedFamily == actualFamily;
+}
+
+bool IsParagonWeaponSubclassWildcardSpell(uint32 spellId)
+{
+    if (!spellId)
+        return false;
+
+    // Resolve to the first-rank id so callers can pass any rank.
+    uint32 firstRankId = spellId;
+    if (SpellInfo const* info = sSpellMgr->GetSpellInfo(spellId))
+        if (SpellInfo const* first = info->GetFirstRankSpell())
+            firstRankId = first->Id;
+
+    switch (firstRankId)
+    {
+        // Maelstrom Weapon (talent ranks 51528 / 51529 / 51530 / 51531 / 51532).
+        // Cross-class proc talent that should fire off any equipped weapon
+        // for a Paragon caster (1H sword, polearm, staff, fist, dagger, etc.).
+        case 51528:
+            return true;
+        default:
+            return false;
+    }
+}
+
+bool IsFracturedExclusiveStanceSpell(uint32 spellId)
+{
+    if (!spellId)
+        return false;
+
+    // Resolve to the first-rank id so callers can pass any rank. This means
+    // every rank of Aspect of the Hawk / Wild / Pack / Dragonhawk is covered
+    // by listing only the rank-1 id below; same for druid forms that have
+    // multiple ranks via talent (none in WotLK actually, but kept consistent).
+    uint32 firstRankId = spellId;
+    if (SpellInfo const* info = sSpellMgr->GetSpellInfo(spellId))
+        if (SpellInfo const* first = info->GetFirstRankSpell())
+            firstRankId = first->Id;
+
+    switch (firstRankId)
+    {
+        // -- Warrior stances (engine-shapeshifts; engine already mutually
+        //    excludes them with each other and with druid forms via
+        //    AuraEffect::HandleAuraModShapeshift's RemoveAurasByType, but we
+        //    list them here so they participate in the union with presences /
+        //    aspects).
+        case 2457:  // Battle Stance
+        case 71:    // Defensive Stance
+        case 2458:  // Berserker Stance
+
+        // -- Paragon Advancement warrior stance clones (951010-951012).
+        case 951010:
+        case 951011:
+        case 951012:
+
+        // -- Druid combat forms (engine-shapeshifts).
+        case 5487:  // Bear Form
+        case 9634:  // Dire Bear Form
+        case 768:   // Cat Form
+        case 24858: // Moonkin Form
+        case 33891: // Tree of Life Form
+
+        // -- Druid utility forms (engine-shapeshifts; included per design
+        //    decision 2026-05-11 -- player must drop Travel/Aquatic/Flight to
+        //    apply Hawk / Frost Presence / Berserker Stance, and vice versa).
+        case 783:   // Travel Form
+        case 1066:  // Aquatic Form
+        case 33943: // Flight Form
+        case 40120: // Swift Flight Form
+
+        // -- Shaman utility form (engine-shapeshift FORM_GHOSTWOLF).
+        case 2645:  // Ghost Wolf
+
+        // -- Rogue base stealth (engine-shapeshift FORM_STEALTH). Shadow
+        //    Dance (51713) is intentionally NOT listed -- it is a 6s
+        //    stealth-burst on a 60s CD, gating it would defeat its purpose.
+        case 1784:  // Stealth
+
+        // -- Priest combat form (engine-shapeshift FORM_SHADOW).
+        case 15473: // Shadowform
+
+        // -- Warlock combat form (engine-shapeshift FORM_METAMORPHOSIS).
+        case 47241: // Metamorphosis
+
+        // -- Death Knight Presences. NOT engine-shapeshifts in stock AC --
+        //    they are regular auras that the client just renders in the
+        //    stance bar -- which is exactly why stock DK can stack them on
+        //    top of Bear Form / Defensive Stance / Aspect of the Hawk on a
+        //    Paragon character. Listing them here is what plugs the gap.
+        case 48266: // Blood Presence
+        case 48263: // Frost Presence
+        case 48265: // Unholy Presence
+
+        // -- Paragon Advancement DK presence clones (951013-951015).
+        case 951013:
+        case 951014:
+        case 951015:
+
+        // -- Hunter Aspects (combat). Like presences, these are regular
+        //    auras stock AC, not engine-shapeshifts; rank-1 ids cover all
+        //    ranks via GetFirstRankSpell. Cheetah / Pack are the utility
+        //    aspects -- included per design decision so a hunter must pick
+        //    between Hawk and Cheetah (no more "always Hawk while running",
+        //    matches Ascension's nerf rationale for Monkey).
+        case 13165: // Aspect of the Hawk (rank 1; ranks 14318/14319/14320/14321/14322/25296/27044 covered via first-rank)
+        case 5118:  // Aspect of the Cheetah
+        case 13159: // Aspect of the Pack (rank 1; rank 27047 covered via first-rank)
+        case 20043: // Aspect of the Wild (rank 1; ranks 20190/27045 covered via first-rank)
+        case 13161: // Aspect of the Beast
+        case 13163: // Aspect of the Monkey
+        case 34074: // Aspect of the Viper
+        case 61846: // Aspect of the Dragonhawk (rank 1; rank 61847 covered via first-rank)
+            return true;
+        default:
+            return false;
+    }
+}
+
 float baseMoveSpeed[MAX_MOVE_TYPE] =
 {
    2.5f,                  // MOVE_WALK
@@ -6122,17 +6264,40 @@ AuraEffect* Unit::IsScriptOverriden(SpellInfo const* spell, int32 script) const

 uint32 Unit::GetDiseasesByCaster(ObjectGuid casterGUID, uint8 mode)
 {
-    static const AuraType diseaseAuraTypes[] =
+    ObjectGuid drwGUID;
+
+    // Fractured / Paragon: when the caller (the unit whose strike is
+    // counting diseases -- e.g. Death Strike heal, Blood Strike / Heart
+    // Strike / Obliterate per-disease damage, Glyph of Scourge Strike
+    // refresh) is a CLASS_PARAGON player AND Paragon.WildcardFamilyMatching
+    // is on, also walk SPELL_AURA_PERIODIC_LEECH. That picks up Priest
+    // Devouring Plague, which uses ApplyAuraName 53 (PERIODIC_LEECH) instead
+    // of 3 (PERIODIC_DAMAGE) and is therefore invisible to the stock loop
+    // even though its Dispel field is DISPEL_DISEASE. A full Spell.dbc scan
+    // confirms Devouring Plague is the ONLY entry that satisfies both
+    // `Dispel == DISPEL_DISEASE` and a leech periodic effect, so this does
+    // not accidentally drag any other spell into the disease pool. Stock
+    // (non-Paragon) callers fall through to the original 2-entry iteration
+    // and observe identical behavior.
+    bool paragonWildcardLeech = false;
+    if (Player* playerCaster = ObjectAccessor::GetPlayer(*this, casterGUID))
+    {
+        drwGUID = playerCaster->getRuneWeaponGUID();
+        paragonWildcardLeech = IsParagonWildcardCaller(playerCaster);
+    }
+
+    AuraType diseaseAuraTypes[4] =
    {
        SPELL_AURA_PERIODIC_DAMAGE, // Frost Fever and Blood Plague
        SPELL_AURA_LINKED,          // Crypt Fever and Ebon Plague
+        SPELL_AURA_NONE,
        SPELL_AURA_NONE
    };
-
-    ObjectGuid drwGUID;
-
-    if (Player* playerCaster = ObjectAccessor::GetPlayer(*this, casterGUID))
-        drwGUID = playerCaster->getRuneWeaponGUID();
+    if (paragonWildcardLeech)
+    {
+        diseaseAuraTypes[2] = SPELL_AURA_PERIODIC_LEECH; // Priest Devouring Plague (Paragon-only)
+        diseaseAuraTypes[3] = SPELL_AURA_NONE;
+    }

    uint32 diseases = 0;
    for (uint8 index = 0; diseaseAuraTypes[index] != SPELL_AURA_NONE; ++index)
@@ -9046,6 +9211,21 @@ int32 Unit::SpellBaseDamageBonusDone(SpellSchoolMask schoolMask)
        DoneAdvertisedBenefit += ToPlayer()->GetBaseSpellPowerBonus();
        DoneAdvertisedBenefit += ToPlayer()->GetBaseSpellDamageBonus();

+        // Fractured class 12 (Paragon) intrinsic spell power:
+        //   SP = level*2 + INT + SPI - 20 (clamped at 0)
+        // Read live from current stats so character-sheet refreshes (via
+        // UpdateSpellDamageAndHealingBonus) and live spell casts both see the
+        // up-to-date value with no script hooks or m_baseSpellPower mutation.
+        if (ToPlayer()->getClass() == CLASS_PARAGON)
+        {
+            int32 paragonSP = int32(GetLevel()) * 2
+                            + int32(GetStat(STAT_INTELLECT))
+                            + int32(GetStat(STAT_SPIRIT))
+                            - 20;
+            if (paragonSP > 0)
+                DoneAdvertisedBenefit += paragonSP;
+        }
+
        // Damage bonus from stats
        AuraEffectList const& mDamageDoneOfStatPercent = GetAuraEffectsByType(SPELL_AURA_MOD_SPELL_DAMAGE_OF_STAT_PERCENT);
        for (AuraEffectList::const_iterator i = mDamageDoneOfStatPercent.begin(); i != mDamageDoneOfStatPercent.end(); ++i)
@@ -9687,7 +9867,7 @@ uint32 Unit::SpellHealingBonusTaken(Unit* caster, SpellInfo const* spellProto, u

    // Nourish cast - 20% bonus if target has Rejuvenation, Regrowth, Lifebloom, or Wild Growth from caster
    // Glyph of Nourish is handled by spell_dru_nourish script
-    if (spellProto->SpellFamilyName == SPELLFAMILY_DRUID && spellProto->SpellFamilyFlags[1] & 0x2000000 && caster)
+    if (ParagonFamilyMatches(caster, SPELLFAMILY_DRUID, spellProto->SpellFamilyName) && spellProto->SpellFamilyFlags[1] & 0x2000000 && caster)
    {
        AuraEffectList const& auras = GetAuraEffectsByType(SPELL_AURA_PERIODIC_HEAL);
        for (AuraEffectList::const_iterator i = auras.begin(); i != auras.end(); ++i)
@@ -9803,6 +9983,20 @@ int32 Unit::SpellBaseHealingBonusDone(SpellSchoolMask schoolMask)
        AdvertisedBenefit += ToPlayer()->GetBaseSpellPowerBonus();
        AdvertisedBenefit += ToPlayer()->GetBaseSpellHealingBonus();

+        // Fractured class 12 (Paragon) intrinsic spell power: same level*2 +
+        // INT + SPI - 20 floor as on the damage side (the character sheet
+        // shows a single Spell Power value, so both sides must add the same
+        // bonus).
+        if (ToPlayer()->getClass() == CLASS_PARAGON)
+        {
+            int32 paragonSP = int32(GetLevel()) * 2
+                            + int32(GetStat(STAT_INTELLECT))
+                            + int32(GetStat(STAT_SPIRIT))
+                            - 20;
+            if (paragonSP > 0)
+                AdvertisedBenefit += paragonSP;
+        }
+
        // Healing bonus from stats
        AuraEffectList const& mHealingDoneOfStatPercent = GetAuraEffectsByType(SPELL_AURA_MOD_SPELL_HEALING_OF_STAT_PERCENT);
        for (AuraEffectList::const_iterator i = mHealingDoneOfStatPercent.begin(); i != mHealingDoneOfStatPercent.end(); ++i)
@@ -10392,7 +10586,7 @@ uint32 Unit::MeleeDamageBonusTaken(Unit* attacker, uint32 pdamage, WeaponAttackT
        uint64 mechanicMask = spellProto->GetAllEffectsMechanicMask();

        // Shred, Maul - "Effects which increase Bleed damage also increase Shred damage"
-        if (spellProto->SpellFamilyName == SPELLFAMILY_DRUID && spellProto->SpellFamilyFlags[0] & 0x00008800)
+        if (ParagonFamilyMatches(attacker, SPELLFAMILY_DRUID, spellProto->SpellFamilyName) && spellProto->SpellFamilyFlags[0] & 0x00008800)
            mechanicMask |= (1ULL << MECHANIC_BLEED);

        if (mechanicMask)
@@ -2268,6 +2268,66 @@ private:
    ValuesUpdateCache _valuesUpdateCache;
 };

+// Fractured / Paragon: returns true iff `listener` is a CLASS_PARAGON player
+// AND `Paragon.WildcardFamilyMatching` is enabled. Single source of truth for
+// the gate that controls every cross-class wildcard path (family-name skip in
+// SpellInfo::IsAffected, leech-aura disease counting in
+// Unit::GetDiseasesByCaster, the cross-school instant-cast intercept in
+// Spell::prepare for Predator's / Nature's Swiftness, the Vampiric Embrace
+// CheckProc cross-family path, etc.). Centralizing the check means runtime
+// kill-switching the wildcard config flips every behavior together.
+[[nodiscard]] bool IsParagonWildcardCaller(Unit const* listener);
+
+// Fractured / Paragon: helper for ad-hoc `switch (SpellFamilyName)` listener
+// gates scattered across Unit / SpellEffects / SpellAuraEffects. When the
+// listener (i.e. the unit holding the gating talent / aura) is a Paragon
+// AND `Paragon.WildcardFamilyMatching` is enabled, accept any source family
+// so cross-class procs / bonuses can fire. Stock classes use stock equality.
+// Defined inline here so call sites do not need an extra include for World.h
+// beyond what they already include via Unit.h's transitive headers.
+[[nodiscard]] bool ParagonFamilyMatches(Unit const* listener, uint32 expectedFamily, uint32 actualFamily);
+
+// Fractured / Paragon: returns true iff `spellId` is on the curated allowlist
+// of cross-class proc talents whose `EquippedItemSubClassMask` should be
+// bypassed for Paragon casters (e.g. Maelstrom Weapon ranks 51528-51532).
+// Used by `Player::HasItemFitToSpellRequirements`,
+// `Player::CheckAttackFitToAuraRequirement`, and
+// `Aura::IsProcTriggeredOnEvent` to let these specific talents fire from
+// any equipped weapon while keeping weapon-specialization talents
+// (Sword Specialization, Mace Specialization, Hack and Slash, Two-Handed
+// Weapon Specialization, etc.) gated by their stock weapon-class mask.
+// The allowlist is matched against `SpellInfo::GetFirstRankSpell()`'s id
+// so all ranks of a talent are covered by listing the rank-1 id.
+[[nodiscard]] bool IsParagonWeaponSubclassWildcardSpell(uint32 spellId);
+
+// Fractured: returns true iff `spellId` is one of the cross-class
+// "stance-like" auras that we treat as mutually exclusive on this server,
+// regardless of the caster's class. Stock AC engine-shapeshifts (warrior
+// stances, druid forms, Shadowform, Metamorphosis) already auto-replace
+// each other via `RemoveAurasByType(SPELL_AURA_MOD_SHAPESHIFT)` in
+// `AuraEffect::HandleAuraModShapeshift`, but DK Presences and Hunter
+// Aspects are regular auras (the client just renders them in the stance
+// bar), so they coexist with shapeshifts in stock AC. The Fractured rule
+// makes the entire union mutually exclusive: warrior stances + druid
+// forms (combat AND utility -- Travel/Aquatic/Flight/Swift Flight) +
+// Ghost Wolf + Stealth + Shadowform + Metamorphosis + DK Presences +
+// Hunter Aspects (combat AND utility -- Cheetah/Pack). Casting any of
+// them removes any other from the same set, so e.g. a Paragon DK can no
+// longer stack Frost Presence on top of Bear Form, and a hunter must
+// pick between Hawk and Cheetah even out of combat.
+//
+// The set is matched against `SpellInfo::GetFirstRankSpell()`'s id so
+// every rank of every aspect / form is covered by listing the rank-1 id.
+// Server-wide -- this is *not* gated on CLASS_PARAGON because the only
+// stock-class-only effect of the rule (a DK losing Travel Form when
+// they cast Frost Presence) is impossible: stock DKs cannot shapeshift.
+// Used by `Aura::CanStackWith` to refuse stacking, which then drives
+// `Unit::_RemoveNoStackAurasDueToAura` to drop the older aura -- the
+// same mechanism Battle Elixirs / Curses already use (spell_group rule
+// SPELL_GROUP_STACK_RULE_EXCLUSIVE), implemented in C++ here so we do
+// not have to enumerate every rank of every aspect / form in SQL.
+[[nodiscard]] bool IsFracturedExclusiveStanceSpell(uint32 spellId);
+
 namespace Acore
 {
    // Binary predicate for sorting Units based on percent value of a power
@@ -99,7 +99,13 @@ enum ShapeshiftForm
    FORM_FLIGHT                         = 0x1D,
    FORM_STEALTH                        = 0x1E,
    FORM_MOONKIN                        = 0x1F,
-    FORM_SPIRITOFREDEMPTION             = 0x20
+    FORM_SPIRITOFREDEMPTION             = 0x20,
+
+    // Fractured / Paragon: Character Advancement warrior stance clones (Spell.dbc
+    // MOD_SHAPESHIFT -> SpellShapeshiftForm 33-35, BonusActionBar=0, no client bar swap).
+    FORM_PARAGON_BATTLE_STANCE          = 33,
+    FORM_PARAGON_DEFENSIVE_STANCE       = 34,
+    FORM_PARAGON_BERSERKER_STANCE       = 35,
 };

 enum ShapeshiftFlags
@@ -908,7 +908,12 @@ void WorldSession::SendListInventory(ObjectGuid vendorGuid, uint32 vendorEntry)
        {
            if (ItemTemplate const* itemTemplate = sObjectMgr->GetItemTemplate(item->item))
            {
-                if (!(itemTemplate->AllowableClass & _player->getClassMask()) && itemTemplate->Bonding == BIND_WHEN_PICKED_UP && !_player->IsGameMaster())
+                // mod-paragon: class 12 sees every BoP class-restricted item
+                // in vendor lists (class glyphs, class tier sets, ...).
+                if (_player->getClass() != CLASS_PARAGON
+                    && !(itemTemplate->AllowableClass & _player->getClassMask())
+                    && itemTemplate->Bonding == BIND_WHEN_PICKED_UP
+                    && !_player->IsGameMaster())
                {
                    continue;
                }
@@ -1373,12 +1373,15 @@ void AuraEffect::HandleShapeshiftBoosts(Unit* target, bool apply) const
            HotWSpellId = 24899;
            break;
        case FORM_BATTLESTANCE:
+        case FORM_PARAGON_BATTLE_STANCE:
            spellId = 21156;
            break;
        case FORM_DEFENSIVESTANCE:
+        case FORM_PARAGON_DEFENSIVE_STANCE:
            spellId = 7376;
            break;
        case FORM_BERSERKERSTANCE:
+        case FORM_PARAGON_BERSERKER_STANCE:
            spellId = 7381;
            break;
        case FORM_MOONKIN:
@@ -1545,7 +1548,21 @@ void AuraEffect::HandleShapeshiftBoosts(Unit* target, bool apply) const
                    // Master Shapeshifter - Cat
                    if (AuraEffect const* aurEff = target->GetDummyAuraEffect(SPELLFAMILY_GENERIC, 2851, 0))
                    {
-                        int32 bp = aurEff->GetAmount();
+                        // Fractured: cat-only Master Shapeshifter bonus is
+                        // doubled (rank 1: 2% -> 4%, rank 2: 4% -> 8%) to
+                        // make Feral Cat builds feel less "super low feral
+                        // scale" without touching bear / moonkin / tree (the
+                        // FORM_BEAR / FORM_MOONKIN / FORM_TREE branches
+                        // below pass `bp` straight through, unchanged). The
+                        // talent's own SpellInfo Effects[].BasePoints is
+                        // intentionally NOT bumped -- aurEff->GetAmount()
+                        // returns the per-rank talent value (2 / 4) shared
+                        // across all four forms, so we apply the cat
+                        // multiplier here at the cast site, leaving every
+                        // other form on the stock value. Pairs with the
+                        // Cat-Form AGI doubling in StatSystem.cpp's
+                        // UpdateAttackPowerAndDamage FORM_CAT branch.
+                        int32 bp = aurEff->GetAmount() * 2;
                        target->CastCustomSpell(target, 48420, &bp, nullptr, nullptr, true);
                    }
                    break;
@@ -1630,7 +1647,7 @@ void AuraEffect::HandleShapeshiftBoosts(Unit* target, bool apply) const

        // Xinef: Remove autoattack spells
        if (Spell* spell = target->GetCurrentSpell(CURRENT_MELEE_SPELL))
-            if (spell->GetSpellInfo()->CheckShapeshift(newAura ? newAura->GetMiscValue() : 0) != SPELL_CAST_OK)
+            if (spell->GetSpellInfo()->CheckShapeshift(newAura ? newAura->GetMiscValue() : 0, target) != SPELL_CAST_OK)
                spell->cancel(true);
    }
 }
@@ -1981,7 +1998,7 @@ void AuraEffect::HandlePhase(AuraApplication const* aurApp, uint8 mode, bool app
 /***   UNIT MODEL   ***/
 /**********************/

-void AuraEffect::HandleAuraModShapeshift(AuraApplication const* aurApp, uint8 mode, bool apply) const
+static void Fractured_ApplyShapeshiftFormFromAuraEffect(AuraEffect const* aurEff, AuraApplication const* aurApp, uint8 mode, bool apply, ShapeshiftForm form)
 {
    if (!(mode & AURA_EFFECT_HANDLE_REAL_OR_REAPPLY_MASK))
        return;
@@ -1990,8 +2007,6 @@ void AuraEffect::HandleAuraModShapeshift(AuraApplication const* aurApp, uint8 mo

    uint32 modelid = 0;
    Powers PowerType = POWER_MANA;
-    ShapeshiftForm form = ShapeshiftForm(GetMiscValue());
-
    switch (form)
    {
        case FORM_CAT:                                      // 0x01
@@ -2005,6 +2020,9 @@ void AuraEffect::HandleAuraModShapeshift(AuraApplication const* aurApp, uint8 mo
        case FORM_BATTLESTANCE:                             // 0x11
        case FORM_DEFENSIVESTANCE:                          // 0x12
        case FORM_BERSERKERSTANCE:                          // 0x13
+        case FORM_PARAGON_BATTLE_STANCE:
+        case FORM_PARAGON_DEFENSIVE_STANCE:
+        case FORM_PARAGON_BERSERKER_STANCE:
            PowerType = POWER_RAGE;
            break;

@@ -2035,10 +2053,10 @@ void AuraEffect::HandleAuraModShapeshift(AuraApplication const* aurApp, uint8 mo
        case FORM_SPIRITOFREDEMPTION:                       // 0x20
            break;
        default:
-            LOG_ERROR("spells.aura.effect", "Auras: Unknown Shapeshift Type: {}", GetMiscValue());
+            LOG_ERROR("spells.aura.effect", "Auras: Unknown Shapeshift Type: {}", aurEff->GetMiscValue());
    }

-    modelid = target->GetModelForForm(form, GetId());
+    modelid = target->GetModelForForm(form, aurEff->GetId());

    if (apply)
    {
@@ -2073,8 +2091,8 @@ void AuraEffect::HandleAuraModShapeshift(AuraApplication const* aurApp, uint8 mo

        // remove other shapeshift before applying a new one
        // xinef: rogue shouldnt be wrapped by this check (shadow dance vs stealth)
-        if (GetSpellInfo()->SpellFamilyName != SPELLFAMILY_ROGUE)
-            target->RemoveAurasByType(SPELL_AURA_MOD_SHAPESHIFT, ObjectGuid::Empty, GetBase());
+        if (aurEff->GetSpellInfo()->SpellFamilyName != SPELLFAMILY_ROGUE)
+            target->RemoveAurasByType(SPELL_AURA_MOD_SHAPESHIFT, ObjectGuid::Empty, aurEff->GetBase());

        // stop handling the effect if it was removed by linked event
        if (aurApp->GetRemoveMode())
@@ -2098,13 +2116,13 @@ void AuraEffect::HandleAuraModShapeshift(AuraApplication const* aurApp, uint8 mo
                        if (AuraEffect const* dummy = target->GetDummyAuraEffect(SPELLFAMILY_DRUID, 238, 0))
                            FurorChance = std::max(dummy->GetAmount(), 0);

-                        switch (GetMiscValue())
+                        switch (aurEff->GetMiscValue())
                        {
                            case FORM_CAT:
                                {
                                    int32 basePoints = int32(std::min(oldPower, FurorChance));
                                    target->SetPower(POWER_ENERGY, 0);
-                                    target->CastCustomSpell(target, 17099, &basePoints, nullptr, nullptr, true, nullptr, this);
+                                    target->CastCustomSpell(target, 17099, &basePoints, nullptr, nullptr, true, nullptr, aurEff);
                                    break;
                                }
                            case FORM_BEAR:
@@ -2178,13 +2196,16 @@ void AuraEffect::HandleAuraModShapeshift(AuraApplication const* aurApp, uint8 mo
            case FORM_BATTLESTANCE:
            case FORM_DEFENSIVESTANCE:
            case FORM_BERSERKERSTANCE:
+            case FORM_PARAGON_BATTLE_STANCE:
+            case FORM_PARAGON_DEFENSIVE_STANCE:
+            case FORM_PARAGON_BERSERKER_STANCE:
                {
                    uint32 Rage_val = 0;
                    // Defensive Tactics
-                    if (form == FORM_DEFENSIVESTANCE)
+                    if (form == FORM_DEFENSIVESTANCE || form == FORM_PARAGON_DEFENSIVE_STANCE)
                    {
-                        if (AuraEffect const* aurEff = target->IsScriptOverriden(m_spellInfo, 831))
-                            Rage_val += aurEff->GetAmount() * 10;
+                        if (AuraEffect const* scriptEff = target->IsScriptOverriden(aurEff->GetSpellInfo(), 831))
+                            Rage_val += scriptEff->GetAmount() * 10;
                    }
                    // Stance mastery + Tactical mastery (both passive, and last have aura only in defense stance, but need apply at any stance switch)
                    if (target->IsPlayer())
@@ -2224,7 +2245,7 @@ void AuraEffect::HandleAuraModShapeshift(AuraApplication const* aurApp, uint8 mo

    // adding/removing linked auras
    // add/remove the shapeshift aura's boosts
-    HandleShapeshiftBoosts(target, apply);
+    aurEff->HandleShapeshiftBoosts(target, apply);

    if (target->IsPlayer())
        target->ToPlayer()->InitDataForForm();
@@ -2232,8 +2253,8 @@ void AuraEffect::HandleAuraModShapeshift(AuraApplication const* aurApp, uint8 mo
    if (target->IsClass(CLASS_DRUID, CLASS_CONTEXT_ABILITY))
    {
        // Dash
-        if (AuraEffect* aurEff = target->GetAuraEffect(SPELL_AURA_MOD_INCREASE_SPEED, SPELLFAMILY_DRUID, 0, 0, 0x8))
-            aurEff->RecalculateAmount();
+        if (AuraEffect* dashSpeedEff = target->GetAuraEffect(SPELL_AURA_MOD_INCREASE_SPEED, SPELLFAMILY_DRUID, 0, 0, 0x8))
+            dashSpeedEff->RecalculateAmount();

        // Disarm handling
        // If druid shifts while being disarmed we need to deal with that since forms aren't affected by disarm
@@ -2267,6 +2288,11 @@ void AuraEffect::HandleAuraModShapeshift(AuraApplication const* aurApp, uint8 mo
    if (target->IsPlayer())
    {
        SpellShapeshiftFormEntry const* shapeInfo = sSpellShapeshiftFormStore.LookupEntry(form);
+        if (!shapeInfo)
+        {
+            LOG_ERROR("spells.aura.effect", "Fractured_ApplyShapeshiftFormFromAuraEffect: missing SpellShapeshiftForm {}", uint32(form));
+            return;
+        }
        // Learn spells for shapeshift form - no need to send action bars or add spells to spellbook
        for (uint8 i = 0; i < MAX_SHAPESHIFT_SPELLS; ++i)
        {
@@ -2280,6 +2306,11 @@ void AuraEffect::HandleAuraModShapeshift(AuraApplication const* aurApp, uint8 mo
    }
 }

+void AuraEffect::HandleAuraModShapeshift(AuraApplication const* aurApp, uint8 mode, bool apply) const
+{
+    Fractured_ApplyShapeshiftFormFromAuraEffect(this, aurApp, mode, apply, ShapeshiftForm(GetMiscValue()));
+}
+
 void AuraEffect::HandleAuraTransform(AuraApplication const* aurApp, uint8 mode, bool apply) const
 {
    if (!(mode & AURA_EFFECT_HANDLE_SEND_FOR_CLIENT_MASK))
@@ -5160,6 +5191,20 @@ void AuraEffect::HandleAuraDummy(AuraApplication const* aurApp, uint8 mode, bool

    Unit* caster = GetCaster();

+    // Fractured: Paragon warrior stance clones (951010-951012) use SPELL_AURA_DUMMY on Spell.dbc **effect2**
+    // (misc = Paragon SpellShapeshiftForm 33-35). Effect1 is a separate DUMMY for the buff strip; passive stats
+    // (e.g. armor pen / threat) live on Effect3. **AttributesEx** clears SPELL_ATTR1_NO_AURA_ICON (DBC + SpellInfoCorrections)
+    // so the client shows an aura icon — stock Warrior stances keep that bit set on purpose.
+    if (GetAuraType() == SPELL_AURA_DUMMY && m_effIndex == 1)
+    {
+        uint32 const sid = GetSpellInfo()->Id;
+        if (sid == 951010 || sid == 951011 || sid == 951012)
+        {
+            Fractured_ApplyShapeshiftFormFromAuraEffect(this, aurApp, mode, apply, ShapeshiftForm(GetMiscValue()));
+            return;
+        }
+    }
+
    if (mode & AURA_EFFECT_HANDLE_REAL)
    {
        // pet auras
@@ -1973,6 +1973,31 @@ bool Aura::CanStackWith(Aura const* existingAura) const
            || (sameCaster && m_spellInfo->IsAuraExclusiveBySpecificPerCasterWith(existingSpellInfo)))
        return false;

+    // Fractured: cross-class stance / form / presence / aspect exclusivity.
+    // Stock AC's engine-shapeshift removal in HandleAuraModShapeshift only
+    // covers warrior stances, druid forms, Shadowform, Metamorphosis, etc.
+    // -- DK Presences and Hunter Aspects are regular auras (the client just
+    // happens to render them in the stance bar) and therefore stack with
+    // engine-shapeshifts in stock AC. The Fractured rule (server-wide --
+    // see IsFracturedExclusiveStanceSpell in Unit.h for the curated set
+    // and the design rationale) treats the union of stances + forms (combat
+    // AND utility) + presences + aspects as mutually exclusive. Refusing
+    // to stack here triggers the same _RemoveNoStackAurasDueToAura cleanup
+    // path that Battle Elixirs / Curses already use, so the older aura
+    // drops and the newly-cast one applies cleanly. Different ranks of the
+    // same talent (e.g. Hawk rank 4 -> Hawk rank 7) are NOT treated as
+    // exclusive with each other -- IsFracturedExclusiveStanceSpell resolves
+    // to first-rank ids, so we compare those.
+    if (IsFracturedExclusiveStanceSpell(m_spellInfo->Id) && IsFracturedExclusiveStanceSpell(existingSpellInfo->Id))
+    {
+        SpellInfo const* newFirst = m_spellInfo->GetFirstRankSpell();
+        SpellInfo const* oldFirst = existingSpellInfo->GetFirstRankSpell();
+        uint32 newFirstId = newFirst ? newFirst->Id : m_spellInfo->Id;
+        uint32 oldFirstId = oldFirst ? oldFirst->Id : existingSpellInfo->Id;
+        if (newFirstId != oldFirstId)
+            return false;
+    }
+
    // check spell group stack rules
    switch (sSpellMgr->CheckSpellGroupStackRules(m_spellInfo, existingSpellInfo))
    {
@@ -2175,7 +2200,9 @@ uint8 Aura::GetProcEffectMask(AuraApplication* aurApp, ProcEventInfo& eventInfo,
        return 0;

    // do checks against db data
-    if (!sSpellMgr->CanSpellTriggerProcOnEvent(*procEntry, eventInfo))
+    // Fractured / Paragon: the unit that owns this aura is the listener;
+    // pass it through so cross-family procs can match for Paragon players.
+    if (!sSpellMgr->CanSpellTriggerProcOnEvent(*procEntry, eventInfo, aurApp->GetTarget()))
        return 0;

    // check if spell was affected by this aura's spellmod (used by Arcane Potency and similar effects)
@@ -2249,8 +2276,23 @@ uint8 Aura::GetProcEffectMask(AuraApplication* aurApp, ProcEventInfo& eventInfo,
                item = target->ToPlayer()->GetUseableItemByPos(INVENTORY_SLOT_BAG_0, EQUIPMENT_SLOT_OFFHAND);
            }

-            if (!item || item->IsBroken() || !item->IsFitToSpellRequirements(GetSpellInfo()))
+            if (!item || item->IsBroken())
                return 0;
+            if (!item->IsFitToSpellRequirements(GetSpellInfo()))
+            {
+                // Fractured / Paragon: cross-class wildcard relaxes the
+                // weapon-subclass gate ONLY for the curated allowlist of
+                // cross-class proc talents (currently just Maelstrom Weapon
+                // 51528-51532). Weapon-specialization talents (Sword/Mace
+                // Specialization, Hack and Slash, Two-Handed Weapon
+                // Specialization, etc.) deliberately stay weapon-gated for
+                // Paragon. Restricted to ITEM_CLASS_WEAPON so shield-gated
+                // talents still need an actual shield.
+                if (!(GetSpellInfo()->EquippedItemClass == ITEM_CLASS_WEAPON
+                      && IsParagonWildcardCaller(target)
+                      && IsParagonWeaponSubclassWildcardSpell(GetSpellInfo()->Id)))
+                    return 0;
+            }
        }
    }

@@ -51,6 +51,7 @@
 #include "Vehicle.h"
 #include "World.h"
 #include "WorldPacket.h"
+#include <array>
 #include <cmath>

 /// @todo: this import is not necessary for compilation and marked as unused by the IDE
@@ -3540,6 +3541,52 @@ SpellCastResult Spell::prepare(SpellCastTargets const* targets, AuraEffect const
        if (m_caster->ToPlayer()->GetCommandStatus(CHEAT_CASTTIME))
            m_casttime = 0;

+    // Fractured / Paragon: cross-class "next Nature spell becomes instant"
+    // intercept for the three buffs that share that semantic in 3.3.5:
+    //
+    //   69369 - Predator's Swiftness (Cataclysm proc payload triggered by
+    //           our spell_paragon_predatory_strikes; see Paragon_SC.cpp)
+    //   17116 - Druid Nature's Swiftness
+    //   16188 - Shaman Nature's Swiftness
+    //
+    // All three apply SPELL_AURA_ADD_PCT_MODIFIER on SPELLMOD_CASTING_TIME
+    // gated by a Druid- or Shaman-only SpellClassMask, so a Paragon with the
+    // buff cannot instant-cast a Nature spell from a different family
+    // (e.g. a Druid NS Paragon casting Shaman Chain Lightning, or a Shaman
+    // NS Paragon casting Druid Healing Touch). Tooltip text on all three
+    // promises "next Nature spell with a base cast time below 10 sec becomes
+    // instant"; honor that here for CLASS_PARAGON callers when the wildcard
+    // config is on. The stock SpellMod path is untouched -- real Druids /
+    // Shamans / proc consumers continue to hit the existing class-mask code
+    // path unchanged.
+    if (Player* paragonCaster = m_caster->ToPlayer())
+    {
+        if (m_casttime > 0
+            && IsParagonWildcardCaller(paragonCaster)
+            && (m_spellInfo->SchoolMask & SPELL_SCHOOL_MASK_NATURE)
+            && m_spellInfo->CastTimeEntry
+            && !m_spellInfo->IsChanneled()
+            && !HasTriggeredCastFlag(TRIGGERED_FULL_MASK)
+            && m_spellInfo->CalcCastTime() < 10 * IN_MILLISECONDS)
+        {
+            static constexpr std::array<uint32, 3> kParagonNatureInstantBuffs =
+            {
+                69369u, // Predator's Swiftness (Paragon proc payload)
+                17116u, // Druid Nature's Swiftness
+                16188u  // Shaman Nature's Swiftness
+            };
+            for (uint32 buffId : kParagonNatureInstantBuffs)
+            {
+                if (paragonCaster->HasAura(buffId))
+                {
+                    m_casttime = 0;
+                    paragonCaster->RemoveAurasDueToSpell(buffId);
+                    break; // consume only one buff per cast
+                }
+            }
+        }
+    }
+
    // don't allow channeled spells / spells with cast time to be casted while moving
    // (even if they are interrupted on moving, spells with almost immediate effect get to have their effect processed before movement interrupter kicks in)
    if ((m_spellInfo->IsChanneled() || m_casttime) && m_caster->IsPlayer() && m_caster->isMoving() && m_spellInfo->InterruptFlags & SPELL_INTERRUPT_FLAG_MOVEMENT && !IsTriggered())
@@ -5722,7 +5769,7 @@ SpellCastResult Spell::CheckCast(bool strict, uint32* /*param1*/, uint32* /*para
        if (checkForm)
        {
            // Cannot be used in this stance/form
-            SpellCastResult shapeError = m_spellInfo->CheckShapeshift(m_caster->GetShapeshiftForm());
+            SpellCastResult shapeError = m_spellInfo->CheckShapeshift(m_caster->GetShapeshiftForm(), m_caster);
            if (shapeError != SPELL_CAST_OK)
                return shapeError;

@@ -7296,8 +7343,16 @@ SpellCastResult Spell::CheckItems(uint32* param1, uint32* param2)
    {
        // Xinef: this is not true in my opinion, in eg bladestorm will not be canceled after disarm
        //if (!HasTriggeredCastFlag(TRIGGERED_IGNORE_EQUIPPED_ITEM_REQUIREMENT))
-        if (m_caster->IsPlayer() && !m_caster->ToPlayer()->HasItemFitToSpellRequirements(m_spellInfo))
-            return SPELL_FAILED_EQUIPPED_ITEM_CLASS;
+        if (m_caster->IsPlayer())
+        {
+            // Cast-from-glyph: many glyph on-use spells set EquippedItemClass to ITEM_CLASS_GLYPH.
+            // HasItemFitToSpellRequirements only implements weapon/armor, so it would always fail here
+            // even though the glyph item in the bag is the valid spell source.
+            bool const castFromGlyphScroll = m_CastItem && m_CastItem->GetTemplate() &&
+                m_CastItem->GetTemplate()->Class == ITEM_CLASS_GLYPH;
+            if (!castFromGlyphScroll && !m_caster->ToPlayer()->HasItemFitToSpellRequirements(m_spellInfo))
+                return SPELL_FAILED_EQUIPPED_ITEM_CLASS;
+        }
    }

    // do not take reagents for these item casts
@@ -7677,56 +7732,64 @@ SpellCastResult Spell::CheckItems(uint32* param1, uint32* param2)
                    switch (pItem->GetTemplate()->SubClass)
                    {
                        case ITEM_SUBCLASS_WEAPON_THROWN:
-                            {
-                                uint32 ammo = pItem->GetEntry();
-                                if (!m_caster->ToPlayer()->HasItemCount(ammo))
-                                    return SPELL_FAILED_NO_AMMO;
-                            };
+                        {
+                            // Fractured: thrown abilities behave like DK runes -- they
+                            // remain usable even when the player has run out of the
+                            // throwing item. Stock AC returned SPELL_FAILED_NO_AMMO
+                            // here; we just drop the gate. Spell::TakeAmmo's stack
+                            // decrement is wrapped in a HasItemCount check via
+                            // DestroyItemCount and will silently no-op at zero. The
+                            // ranged-DPS bonus naturally vanishes when the stack runs
+                            // out, so the player still throws but loses the per-shot
+                            // damage contribution from the throwing item.
                            break;
+                        };
                        case ITEM_SUBCLASS_WEAPON_GUN:
                        case ITEM_SUBCLASS_WEAPON_BOW:
                        case ITEM_SUBCLASS_WEAPON_CROSSBOW:
-                            {
-                                uint32 ammo = m_caster->ToPlayer()->GetUInt32Value(PLAYER_AMMO_ID);
-                                if (!ammo)
-                                {
-                                    // Requires No Ammo
-                                    if (m_caster->HasAura(46699))
-                                        break;                      // skip other checks
-
-                                    return SPELL_FAILED_NO_AMMO;
-                                }
-
-                                ItemTemplate const* ammoProto = sObjectMgr->GetItemTemplate(ammo);
-                                if (!ammoProto)
-                                    return SPELL_FAILED_NO_AMMO;
-
-                                if (ammoProto->Class != ITEM_CLASS_PROJECTILE)
-                                    return SPELL_FAILED_NO_AMMO;
-
-                                // check ammo ws. weapon compatibility
-                                switch (pItem->GetTemplate()->SubClass)
-                                {
-                                    case ITEM_SUBCLASS_WEAPON_BOW:
-                                    case ITEM_SUBCLASS_WEAPON_CROSSBOW:
-                                        if (ammoProto->SubClass != ITEM_SUBCLASS_ARROW)
-                                            return SPELL_FAILED_NO_AMMO;
-                                        break;
-                                    case ITEM_SUBCLASS_WEAPON_GUN:
-                                        if (ammoProto->SubClass != ITEM_SUBCLASS_BULLET)
-                                            return SPELL_FAILED_NO_AMMO;
-                                        break;
-                                    default:
-                                        return SPELL_FAILED_NO_AMMO;
-                                }
-
-                                if (!m_caster->ToPlayer()->HasItemCount(ammo))
-                                {
-                                    m_caster->ToPlayer()->SetUInt32Value(PLAYER_AMMO_ID, 0);
-                                    return SPELL_FAILED_NO_AMMO;
-                                }
-                            };
+                        {
+                            // Fractured: ranged abilities behave like DK runes -- they
+                            // remain usable when the player has no ammo loaded or the
+                            // quiver / pouch is empty. The DPS-bonus path (StatSystem.cpp:
+                            // `weaponMin/MaxDamage += GetAmmoDPS() * attackSpeedMod`)
+                            // reads `m_ammoDPS`, which is 0 when no ammo is loaded and
+                            // recomputed via Player::_ApplyAmmoBonuses on equip / stack
+                            // exhaustion, so a hunter with an empty bag still casts
+                            // Steady Shot / Aimed Shot etc. -- they just lose the arrow
+                            // / bullet DPS contribution.
+                            //
+                            // We deliberately do NOT clear PLAYER_AMMO_ID when the bag
+                            // empties. Defense in depth alongside the data-side fix:
+                            //
+                            //   * The primary client-side fix lives in Spell.dbc --
+                            //     SpellInfoCorrections.cpp's "drop EquippedItemClass on
+                            //     hunter shot abilities" block (mirrored client-side by
+                            //     fractured-tooling/_patch_spell_dbc_hunter_ammo.py)
+                            //     sets EquippedItemClass = -1 on every player-castable
+                            //     hunter shot, which removes the 3.3.5a client's
+                            //     "ranged weapon AND ammo slot non-empty" preflight
+                            //     gate entirely. After that, ammo is purely a
+                            //     server-side DPS bonus, never a hard requirement.
+                            //
+                            //   * Keeping the (now-stale) ammo id in PLAYER_AMMO_ID
+                            //     field is harmless: TakeAmmo's DestroyItemCount
+                            //     silently no-ops when HasItemCount is 0, and
+                            //     _ApplyAmmoBonuses already recomputes m_ammoDPS to 0
+                            //     when the proto can no longer be found / the stack is
+                            //     empty. So the StatSystem.cpp ammo-DPS path gracefully
+                            //     degrades to "no bonus" the moment the bag goes empty.
+                            //
+                            //   * Player un-equipping the ammo via the paper-doll
+                            //     right-click still routes through RemoveAmmo() and
+                            //     zeroes the field -- that is the player's explicit
+                            //     action and we leave it alone.
+                            //
+                            // Net result: hunter has bow + ammo -> full DPS; bow only ->
+                            // shots still fire, no ammo DPS; no bow -> client engine's
+                            // own ranged-weapon gate still blocks (Auto Shot timer
+                            // simply never spins up without a ranged weapon equipped).
                            break;
+                        };
                        case ITEM_SUBCLASS_WEAPON_WAND:
                            break;
                        default:
@@ -7797,6 +7860,36 @@ SpellCastResult Spell::CheckSpellFocus()
    // check spell focus object
    if (m_spellInfo->RequiresSpellFocus)
    {
+        // Fractured / Paragon: skip the GO proximity check for Paragon
+        // casters when the spell is a runeforge enchant (skill line 776).
+        // Paragons get a Runeforge tab in the Character Advancement
+        // panel that lets them apply rune-enchants from anywhere in the
+        // world -- no need to fly back to Acherus or find the nearest
+        // Eastern Plaguelands anvil. The skill-line gate keeps the
+        // bypass tightly scoped: only the 10 SkillLineAbility-tagged
+        // rune-enchant spells qualify, every other spell that uses
+        // SpellFocusObject (Enchanting bench, Cooking fire, Lockpicking
+        // anvil, etc.) keeps its requirement intact.
+        //
+        // DK / other class casters are unchanged -- this carve-out
+        // intentionally checks getClass() == CLASS_PARAGON rather than
+        // IsClass(CLASS_DEATH_KNIGHT, CLASS_CONTEXT_ABILITY) (which
+        // would also return true for Paragons via mod-paragon's hook).
+        // Stock DK behavior must stay vanilla; the QoL bypass is a
+        // class-12 feature only.
+        if (m_caster && m_caster->IsPlayer()
+            && m_caster->ToPlayer()->getClass() == CLASS_PARAGON)
+        {
+            auto bounds = sSpellMgr->GetSkillLineAbilityMapBounds(m_spellInfo->Id);
+            for (auto it = bounds.first; it != bounds.second; ++it)
+            {
+                if (it->second->SkillLine == SKILL_RUNEFORGING)
+                {
+                    return SPELL_CAST_OK;
+                }
+            }
+        }
+
        CellCoord p(Acore::ComputeCellCoord(m_caster->GetPositionX(), m_caster->GetPositionY()));
        Cell cell(p);

@@ -27,6 +27,8 @@
 #include "SpellAuraDefines.h"
 #include "SpellAuraEffects.h"
 #include "SpellMgr.h"
+#include "World.h"
+#include "WorldConfig.h"

 uint32 GetTargetFlagMask(SpellTargetObjectTypes objType)
 {
@@ -1323,11 +1325,26 @@ bool SpellInfo::HasInitialAggro() const
 }

 bool SpellInfo::IsAffected(uint32 familyName, flag96 const& familyFlags) const
+{
+    return IsAffected(familyName, familyFlags, nullptr);
+}
+
+bool SpellInfo::IsAffected(uint32 familyName, flag96 const& familyFlags,
+                           Unit const* listenerOwner) const
 {
    if (!familyName)
        return true;

-    if (familyName != SpellFamilyName)
+    // Fractured / Paragon: when the unit that owns the listening proc /
+    // spellmod aura is a Paragon, accept any source family. The class
+    // mask flag-bit check below still runs, so listeners that explicitly
+    // opt into a subset of spells via SpellFamilyFlags / class mask are
+    // still respected; only the family-name equality gate is wildcarded.
+    bool const wildcardFamily = listenerOwner
+        && listenerOwner->getClass() == CLASS_PARAGON
+        && sWorld->getBoolConfig(CONFIG_PARAGON_WILDCARD_FAMILY);
+
+    if (!wildcardFamily && familyName != SpellFamilyName)
        return false;

    if (familyFlags && !(familyFlags & SpellFamilyFlags))
@@ -1342,6 +1359,11 @@ bool SpellInfo::IsAffectedBySpellMods() const
 }

 bool SpellInfo::IsAffectedBySpellMod(SpellModifier const* mod) const
+{
+    return IsAffectedBySpellMod(mod, nullptr);
+}
+
+bool SpellInfo::IsAffectedBySpellMod(SpellModifier const* mod, Unit const* listenerOwner) const
 {
    // xinef: dont check duration mod
    if (mod->op != SPELLMOD_DURATION)
@@ -1356,7 +1378,43 @@ bool SpellInfo::IsAffectedBySpellMod(SpellModifier const* mod) const
    if (!sScriptMgr->OnIsAffectedBySpellModCheck(affectSpell, this, mod))
        return true;

-    return IsAffected(affectSpell->SpellFamilyName, mod->mask);
+    if (IsAffected(affectSpell->SpellFamilyName, mod->mask, listenerOwner))
+        return true;
+
+    // Fractured / Paragon: explicit cross-family allowlist for specific
+    // listener auras whose SpellClassMask cannot otherwise bridge classes.
+    // The standard IsAffected wildcard relaxes SpellFamilyName equality but
+    // still requires SpellClassMask & SpellFamilyFlags to overlap; for these
+    // Paragon-only cross-class enablers the source spells live in different
+    // families with non-overlapping class bits, so we whitelist by mod owner
+    // spell ID + target spell first-rank ID. Stock classes never enter here
+    // because IsParagonWildcardCaller short-circuits on non-Paragon owners.
+    if (IsParagonWildcardCaller(listenerOwner))
+    {
+        switch (mod->spellId)
+        {
+            case 53817: // Shaman: Maelstrom Weapon
+            {
+                // Allow any rank of Mage Fireball / Frostbolt to benefit from
+                // the cast-time + cost reduction spellmod. Arcane Blast was on
+                // the allowlist briefly but proved too potent stacked with its
+                // own self-buff -- removed.
+                if (SpellFamilyName == SPELLFAMILY_MAGE)
+                {
+                    SpellInfo const* first = GetFirstRankSpell();
+                    uint32 firstId = first ? first->Id : Id;
+                    if (firstId == 133 /*Fireball*/
+                        || firstId == 116 /*Frostbolt*/)
+                        return true;
+                }
+                break;
+            }
+            default:
+                break;
+        }
+    }
+
+    return false;
 }

 bool SpellInfo::CanPierceImmuneAura(SpellInfo const* auraSpellInfo) const
@@ -1441,7 +1499,7 @@ bool SpellInfo::IsAuraExclusiveBySpecificPerCasterWith(SpellInfo const* spellInf
    }
 }

-SpellCastResult SpellInfo::CheckShapeshift(uint32 form) const
+SpellCastResult SpellInfo::CheckShapeshift(uint32 form, Unit const* caster /*= nullptr*/) const
 {
    // talents that learn spells can have stance requirements that need ignore
    // (this requirement only for client-side stance show in talent description)
@@ -1449,6 +1507,38 @@ SpellCastResult SpellInfo::CheckShapeshift(uint32 form) const
            (Effects[0].Effect == SPELL_EFFECT_LEARN_SPELL || Effects[1].Effect == SPELL_EFFECT_LEARN_SPELL || Effects[2].Effect == SPELL_EFFECT_LEARN_SPELL))
        return SPELL_CAST_OK;

+    // Fractured / Paragon: Paragons learn Warrior abilities through Advancement
+    // without picking up Battle/Defensive/Berserker Stance, so stance-gated
+    // Warrior spells (e.g. Whirlwind, Sunder Armor, Shield Slam) would otherwise
+    // be uncastable. Bypass the stance check for Paragon casters on any spell
+    // that has a non-zero Stances bitmask, regardless of SpellFamilyName.
+    //
+    // We previously gated this on SpellFamilyName == SPELLFAMILY_WARRIOR, but a
+    // number of SPELLFAMILY_GENERIC spells (notably the iconic Warrior toolbox
+    // -- Berserker Rage 18499, Sunder Armor 7405 / 11596 / 11597 / 25225 /
+    // 47467, Charge 100 / 6178 / 11578, Pummel 6552 / 6554, Shield Bash 72 /
+    // 1671 / 1672 / 29704, Retaliation 20230, Recklessness 1719, Shield Wall
+    // 871, etc.) carry the Stances bitmask but live under SPELLFAMILY_GENERIC
+    // (family 0). The previous narrower gate let those re-trigger the stance
+    // failure for Paragons. Widening to "any non-zero Stances + Paragon" is
+    // safe because:
+    //
+    //   * The bypass returns SPELL_CAST_OK only when IsParagonWildcardCaller
+    //     is true -- stock classes never enter this branch.
+    //   * Druid form-gated spells (Cat Form / Bear Form / Moonkin / Tree)
+    //     still fire the Druid GCD/form rules elsewhere; CheckShapeshift is
+    //     about *requiring* a form to cast, which is exactly what we want
+    //     to bypass for Paragons (they never picked the form).
+    //   * Item enchant scrolls and other shapeshift-marked utility spells
+    //     remain unaffected because they aren't in a Paragon's spellbook.
+    if (Stances != 0 && IsParagonWildcardCaller(caster))
+    {
+        LOG_DEBUG("server.scripts",
+                  "[paragon-diag] CheckShapeshift bypass: spell={} family={} stances=0x{:x} form={}",
+                  Id, SpellFamilyName, Stances, form);
+        return SPELL_CAST_OK;
+    }
+
    uint32 stanceMask = (form ? 1 << (form - 1) : 0);

    if (stanceMask & StancesNot)                 // can explicitly not be casted in this stance
@@ -2057,6 +2147,10 @@ SpellSpecificType SpellInfo::LoadSpellSpecific() const
    {
        case SPELLFAMILY_GENERIC:
            {
+                // Fractured / Paragon: DK presence advancement clones (SpellFamilyName=0 in Spell.dbc for client UX).
+                if (Id == 951013 || Id == 951014 || Id == 951015)
+                    return SPELL_SPECIFIC_PRESENCE;
+
                // Food / Drinks (mostly)
                if (AuraInterruptFlags & AURA_INTERRUPT_FLAG_NOT_SEATED)
                {
@@ -494,9 +494,21 @@ public:
    bool HasInitialAggro() const;

    [[nodiscard]] bool IsAffected(uint32 familyName, flag96 const& familyFlags) const;
+    // Fractured / Paragon overload. When `listenerOwner` is a CLASS_PARAGON
+    // unit and Paragon.WildcardFamilyMatching is enabled, the
+    // SpellFamilyName equality check is skipped (flag-bit check still runs)
+    // so cross-class procs / spellmods can react to the spell. Passing
+    // nullptr (or any non-Paragon unit) reproduces the stock 2-arg
+    // behavior; the 2-arg form forwards to this overload with nullptr.
+    [[nodiscard]] bool IsAffected(uint32 familyName, flag96 const& familyFlags,
+                                  Unit const* listenerOwner) const;

    bool IsAffectedBySpellMods() const;
    bool IsAffectedBySpellMod(SpellModifier const* mod) const;
+    // Fractured / Paragon overload: pass the player who owns the modifier
+    // aura so wildcard-family matching can apply when that player is a
+    // Paragon. Stock callers may forward to this with nullptr.
+    bool IsAffectedBySpellMod(SpellModifier const* mod, Unit const* listenerOwner) const;

    bool CanPierceImmuneAura(SpellInfo const* auraSpellInfo) const;
    bool CanDispelAura(SpellInfo const* auraSpellInfo) const;
@@ -509,7 +521,7 @@ public:
    bool IsAuraExclusiveBySpecificWith(SpellInfo const* spellInfo) const;
    bool IsAuraExclusiveBySpecificPerCasterWith(SpellInfo const* spellInfo) const;

-    SpellCastResult CheckShapeshift(uint32 form) const;
+    SpellCastResult CheckShapeshift(uint32 form, Unit const* caster = nullptr) const;
    SpellCastResult CheckLocation(uint32 map_id, uint32 zone_id, uint32 area_id, Player* player = nullptr, bool strict = true) const;
    SpellCastResult CheckTarget(Unit const* caster, WorldObject const* target, bool implicit = true) const;
    SpellCastResult CheckExplicitTarget(Unit const* caster, WorldObject const* target, Item const* itemTarget = nullptr) const;
@@ -18,6 +18,7 @@
 #include "DBCStores.h"
 #include "DBCStructure.h"
 #include "GameGraveyard.h"
+#include "ItemTemplate.h"
 #include "SpellInfo.h"
 #include "SpellMgr.h"

@@ -5368,6 +5369,259 @@ void SpellMgr::LoadSpellInfoCorrections()
    LockEntry* key = const_cast<LockEntry*>(sLockStore.LookupEntry(36)); // 3366 Opening, allows to open without proper key
    key->Type[2] = LOCK_KEY_NONE;

+    // Fractured / Paragon: DK weapon-line "passives" Forceful Deflection and
+    // Runic Focus ship in 3.3.5a Spell.dbc without SPELL_ATTR0_PASSIVE set.
+    // SpellInfo::IsPassive() is therefore false, and mod-paragon's panel-learn
+    // diff treats them as castable actives and revokes them — while true
+    // actives (Blood Presence, Death Coil, Death Grip, ...) must stay
+    // stripped. Mark these two passive in-memory so the panel policy matches
+    // the spellbook UX for every class (stock DK benefits too).
+    ApplySpellFix({ 49410, 61455 }, [](SpellInfo* spellInfo)
+    {
+        spellInfo->Attributes |= SPELL_ATTR0_PASSIVE;
+    });
+
+    // Fractured: move Death Knight Presences and Hunter Aspects out of
+    // SpellCategory 47 ("Combat States") so they cancel/toggle the same
+    // way Druid shapeshift forms do.
+    //
+    // Category 47 is the "stance bar" category. The 3.3.5a client UI
+    // explicitly disables right-click-cancel and `/cancelaura <name>` for
+    // any aura whose Spell.dbc Category column points at a SpellCategory
+    // entry that is "Combat States" (47). Druid forms (Bear Form, Cat
+    // Form, Travel Form, Moonkin, Tree of Life, etc.) sit in Category 0
+    // and are therefore freely cancellable -- right-click drops the form,
+    // /cancelaura drops it, recasting from the action bar drops it.
+    // Warrior stances, DK Presences and Hunter Aspects all live in
+    // Category 47, which is why none of them are cancellable in stock.
+    //
+    // For the cross-class stance / form / presence / aspect exclusivity
+    // rule (see IsFracturedExclusiveStanceSpell in Unit.cpp), a Paragon
+    // hybrid often wants to drop their active presence/aspect so they can
+    // apply a different stance/form *without* first switching to a
+    // different presence/aspect. Setting Category to 0 here mirrors what
+    // Druid forms already do, gives the cancel/toggle UX the user
+    // explicitly asked for, and -- importantly -- does NOT change the
+    // action bar (presences and aspects are not engine-shapeshifts, the
+    // bar swap behavior is owned by SPELL_AURA_MOD_SHAPESHIFT, not by
+    // SpellCategory). The matching client-side Spell.dbc edit ships in
+    // patch-enUS-4.MPQ via _patch_spell_dbc_presences_cancelable.py.
+    //
+    // Warrior stances are also included per design decision 2026-05-11
+    // ("you could make Warrior Stances toggleable as well, it should be
+    // okay"). The previously-shipped Stances=0 client patch already lets
+    // Paragon non-warriors cast every warrior ability without picking up
+    // a stance, so a stock warrior who right-clicks their stance just
+    // ends up at "no stance" -- which on this server still leaves all
+    // their warrior abilities available. Stock warriors who like the
+    // never-cancel UX can simply not right-click; nothing forces them.
+    //
+    // Tradeoff: stances / presences / aspects lose the 1s SpellCategory
+    // GCD that Category 47 enforces between same-category spells. This
+    // matches the Druid-form UX (Bear -> Cat -> Bear has no shared GCD),
+    // and the cross-class exclusivity rule in Aura::CanStackWith already
+    // prevents stacking, so the only thing actually possible at "0s GCD"
+    // is rapid-toggling the same stance on and off, which is harmless.
+    ApplySpellFix({
+        // Warrior Stances.
+        2457,  // Battle Stance
+        71,    // Defensive Stance
+        2458,  // Berserker Stance
+        951010, 951011, 951012, // Paragon advancement warrior stance clones
+
+        // Death Knight Presences.
+        48266, // Blood Presence
+        48263, // Frost Presence
+        48265, // Unholy Presence
+        951013, 951014, 951015, // Paragon advancement DK presence clones (SpellFamily GENERIC in Spell.dbc)
+
+        // Hunter Aspects -- every rank, since AC stores the per-rank
+        // SpellInfo as separate objects and `Category` lives on each.
+        // Rank-1 ids are the same ones listed in
+        // IsFracturedExclusiveStanceSpell; trailing ids are higher ranks.
+        13165, 14318, 14319, 14320, 14321, 14322, 25296, 27044, // Aspect of the Hawk r1..r8
+        5118,                                                    // Aspect of the Cheetah
+        13159,                                                   // Aspect of the Pack (only one rank in WotLK; 27047 is "Growl", do NOT add)
+        20043, 20190, 27045,                                     // Aspect of the Wild r1..r3
+        13161,                                                    // Aspect of the Beast
+        13163,                                                    // Aspect of the Monkey
+        34074,                                                    // Aspect of the Viper
+        61846, 61847,                                             // Aspect of the Dragonhawk r1..r2
+    }, [](SpellInfo* spellInfo)
+    {
+        spellInfo->CategoryEntry = nullptr;
+    });
+
+    // Fractured: clear AttributesEx6 bit 0x1000 on Warrior Stances and DK
+    // Presences so the 3.3.5 client UI lets right-click and `/cancelaura`
+    // drop them, the same way Druid forms / Hunter Aspects already cancel.
+    //
+    // Empirical finding (see fractured-tooling/inspect_stance_attr6.py for
+    // the diff script): when only `SpellCategory` is cleared (the Combat-
+    // States gate at column 1), Hunter Aspects become cancellable but
+    // Warrior Stances and DK Presences still aren't. Diffing the Spell.dbc
+    // rows of working vs broken stance-bar buffs across patched-Aspects and
+    // unpatched-Stances/Presences identifies a SECOND gating column:
+    // `AttributesEx6` (col 10) bit `0x1000`. It is set on every Warrior
+    // Stance (Battle/Defensive/Berserker) and every DK Presence
+    // (Blood/Frost/Unholy) but NOT on any Hunter Aspect (and not on Druid
+    // forms / Ghost Wolf / Stealth / Shadowform). Clearing the bit removes
+    // the secondary client-UI gate without changing how the action bar /
+    // shapeshift system works (those are owned by SPELL_AURA_MOD_SHAPESHIFT,
+    // not by attribute bits).
+    //
+    // AC names this bit `SPELL_ATTR6_ALLOW_WHILE_RIDING_VEHICLE`. That name
+    // is from a different role of the same bit -- when set on a regular
+    // ability, AC's `Spell::CheckCast` vehicle-passenger gate uses it to
+    // grant "this spell is castable from a vehicle seat". Stripping it from
+    // Warrior Stances / DK Presences is harmless because those aren't cast
+    // from vehicle seats anyway (the player is `IsCharmed()` in a seat and
+    // the stance / presence wouldn't apply meaningfully). The matching
+    // client-side Spell.dbc edit ships in patch-enUS-4.MPQ via
+    // _patch_spell_dbc_presences_cancelable.py.
+    //
+    // Hunter Aspects intentionally NOT included -- their AttributesEx6 is
+    // already 0 (or 0x04000000 for Pack/Wild, which is a different bit
+    // unrelated to cancel gating), and listing them here would be a no-op.
+    ApplySpellFix({
+        2457,  // Battle Stance
+        71,    // Defensive Stance
+        2458,  // Berserker Stance
+        951010, 951011, 951012, // Paragon advancement warrior stance clones
+        48266, // Blood Presence
+        48263, // Frost Presence
+        48265, // Unholy Presence
+        951013, 951014, 951015, // Paragon advancement DK presence clones (SpellFamily GENERIC in Spell.dbc)
+    }, [](SpellInfo* spellInfo)
+    {
+        spellInfo->AttributesEx6 &= ~SPELL_ATTR6_ALLOW_WHILE_RIDING_VEHICLE;
+    });
+
+    // Fractured / Paragon: advancement warrior stance clones — strip SPELL_ATTR1_NO_AURA_ICON
+    // (copied from stock 2457/71/2458). Stock Warrior stances intentionally hide from the default aura bar;
+    // these clones are meant to show a cancellable buff icon instead. Client Spell.dbc is patched in tandem via
+    // fractured-tooling/_patch_spell_dbc_paragon_stance_presence_clones.py.
+    ApplySpellFix({ 951010, 951011, 951012 }, [](SpellInfo* spellInfo)
+    {
+        spellInfo->AttributesEx &= ~SPELL_ATTR1_NO_AURA_ICON;
+    });
+
+    // Fractured / Paragon: advancement DK presence clones — strip SPELL_ATTR2_USE_SHAPESHIFT_BAR (0x10) copied
+    // from 48266/48263/48265. That client-only bit is what parks a spell on the secondary stance bar above the
+    // action bar; SkillLine / SpellFamily alone do not remove it. Spellbook tabs still come from SkillLines 770/771/772.
+    ApplySpellFix({ 951013, 951014, 951015 }, [](SpellInfo* spellInfo)
+    {
+        spellInfo->AttributesEx2 &= ~SPELL_ATTR2_USE_SHAPESHIFT_BAR;
+    });
+
+    // Fractured: strip reagent requirements from every player-class spell at
+    // load time. Filtered by SpellFamilyName != 0 so that profession spells
+    // (cooking, alchemy, enchanting, blacksmithing, jewelcrafting, leatherworking,
+    // tailoring, engineering, inscription, mining, herbalism, skinning, fishing,
+    // first aid — all SpellFamilyName == SPELLFAMILY_GENERIC == 0) keep their
+    // mats and only the class abilities that asked for ankhs / candles / soul
+    // shards / verdant spheres / etc. cast freely. Done here in core spell
+    // data rather than as a runtime bypass in Spell::CheckItems / TakeReagents
+    // so the change is data-driven (the in-memory SpellInfo simply has no
+    // reagents to require). The client-side preflight is mirrored by the
+    // matching Spell.dbc patch shipped via patch-enUS-4.MPQ
+    // (fractured-tooling/_patch_spell_dbc_reagents.py).
+    {
+        uint32 fixedClassSpells = 0;
+        for (uint32 spellId = 1; spellId < sSpellMgr->GetSpellInfoStoreSize(); ++spellId)
+        {
+            SpellInfo const* info = sSpellMgr->GetSpellInfo(spellId);
+            if (!info || info->SpellFamilyName == 0)
+                continue;
+
+            bool hadAny = false;
+            for (uint32 i = 0; i < MAX_SPELL_REAGENTS; ++i)
+                if (info->Reagent[i] != 0 || info->ReagentCount[i] != 0)
+                { hadAny = true; break; }
+            if (!hadAny)
+                continue;
+
+            SpellInfo* mut = const_cast<SpellInfo*>(info);
+            for (uint32 i = 0; i < MAX_SPELL_REAGENTS; ++i)
+            {
+                mut->Reagent[i] = 0;
+                mut->ReagentCount[i] = 0;
+            }
+            ++fixedClassSpells;
+        }
+        LOG_INFO("server.loading", ">> Fractured: cleared reagents on {} class spells", fixedClassSpells);
+    }
+
+    // Fractured: drop EquippedItemClass on hunter shot abilities at load time
+    // so the server agrees with the matching client-side Spell.dbc patch
+    // (fractured-tooling/_patch_spell_dbc_hunter_ammo.py). Both surfaces have
+    // to agree -- if only the client patch shipped, the server's stock
+    // EquippedItemClass check would still reject mid-cast; if only the server
+    // mirror shipped, the 3.3.5a client preflight would still block the cast
+    // packet from leaving the box with "Ammo needs to be in the paper doll
+    // ammo slot before it can be fired." The Spell::CheckCast soft-fail
+    // (Spell.cpp 7741..) and the never-clear-PLAYER_AMMO_ID change there are
+    // still in place as defense in depth so a half-deployed client / server
+    // pair degrades to the soft-fail behavior rather than to hard rejects.
+    //
+    // Filter mirrors the Python patcher byte-for-byte:
+    //   SpellFamilyName == SPELLFAMILY_HUNTER (9)
+    //   AND EquippedItemClass == ITEM_CLASS_WEAPON (2)
+    //   AND EquippedItemSubClassMask & ((1<<BOW)|(1<<GUN)|(1<<XBOW)) != 0
+    // with a small DENYLIST of item-equip-driven passive auras (Quiver /
+    // Ammo Pouch haste ranks, Legendary Bow Haste, Aynasha's Bow proc) whose
+    // entire purpose is "have a ranged weapon equipped" -- those keep their
+    // stock EquippedItemClass = 2.
+    //
+    // Effect: after this fix, hunter shots leave the client preflight without
+    // hitting the ammo-slot gate AND pass the server's EquippedItemClass
+    // check unconditionally. _ApplyAmmoBonuses still gates the arrow / bullet
+    // DPS bonus on actually having a stack in the quiver, so equipping ammo
+    // continues to give the DPS bump and an empty quiver no longer bricks
+    // abilities -- "you still get the DPS increase from arrows but aren't
+    // completely neutered if you run out", per the resident hunter expert.
+    {
+        constexpr uint32 RANGED_SUBCLASS_MASK =
+              (1u << ITEM_SUBCLASS_WEAPON_BOW)
+            | (1u << ITEM_SUBCLASS_WEAPON_GUN)
+            | (1u << ITEM_SUBCLASS_WEAPON_CROSSBOW);
+
+        // Keep in sync with DENYLIST in
+        // fractured-tooling/_patch_spell_dbc_hunter_ammo.py.
+        static const std::unordered_set<uint32> hunterAmmoDenylist = {
+            // Quiver / Ammo Pouch ranged-attack-speed haste passives (gun).
+            14824, 14825, 14826, 14827, 14828, 14829,
+            // Quiver passive haste (bow + crossbow).
+            29413, 29414, 29415, 29416, 29417, 29418,
+            // Late-rank quiver haste, gun-only.
+            44333,
+            // Legendary Bow Haste (item proc on a specific bow).
+            44972,
+            // Aynasha's Bow item proc.
+            19767,
+        };
+
+        uint32 fixedShots = 0;
+        for (uint32 spellId = 1; spellId < sSpellMgr->GetSpellInfoStoreSize(); ++spellId)
+        {
+            SpellInfo const* info = sSpellMgr->GetSpellInfo(spellId);
+            if (!info || info->SpellFamilyName != SPELLFAMILY_HUNTER)
+                continue;
+            if (info->EquippedItemClass != ITEM_CLASS_WEAPON)
+                continue;
+            if (info->EquippedItemSubClassMask <= 0
+                || (uint32(info->EquippedItemSubClassMask) & RANGED_SUBCLASS_MASK) == 0)
+                continue;
+            if (hunterAmmoDenylist.find(spellId) != hunterAmmoDenylist.end())
+                continue;
+
+            SpellInfo* mut = const_cast<SpellInfo*>(info);
+            mut->EquippedItemClass = -1;
+            ++fixedShots;
+        }
+        LOG_INFO("server.loading", ">> Fractured: dropped EquippedItemClass on {} hunter shot abilities", fixedShots);
+    }
+
    LOG_INFO("server.loading", ">> Loading spell dbc data corrections  in {} ms", GetMSTimeDiffToNow(oldMSTime));
    LOG_INFO("server.loading", " ");
 }
@@ -842,7 +842,8 @@ SpellProcEntry const* SpellMgr::GetSpellProcEntry(uint32 spellId) const
    return nullptr;
 }

-bool SpellMgr::CanSpellTriggerProcOnEvent(SpellProcEntry const& procEntry, ProcEventInfo& eventInfo) const
+bool SpellMgr::CanSpellTriggerProcOnEvent(SpellProcEntry const& procEntry, ProcEventInfo& eventInfo,
+                                          Unit const* procOwner /*= nullptr*/) const
 {
    // proc type doesn't match
    if (!(eventInfo.GetTypeMask() & procEntry.ProcFlags))
@@ -873,7 +874,10 @@ bool SpellMgr::CanSpellTriggerProcOnEvent(SpellProcEntry const& procEntry, ProcE
    // check spell family name/flags (if set) for spells
    if (eventInfo.GetTypeMask() & SPELL_PROC_FLAG_MASK)
        if (SpellInfo const* eventSpellInfo = eventInfo.GetSpellInfo())
-            if (!eventSpellInfo->IsAffected(procEntry.SpellFamilyName, procEntry.SpellFamilyMask))
+            // Fractured / Paragon: thread the proc-aura owner so a Paragon
+            // listener accepts cross-family source spells. See
+            // SpellInfo::IsAffected(family, flags, listenerOwner).
+            if (!eventSpellInfo->IsAffected(procEntry.SpellFamilyName, procEntry.SpellFamilyMask, procOwner))
                return false;

    // check spell type mask (if set)
@@ -699,7 +699,12 @@ public:

    // Spell proc table
    [[nodiscard]] SpellProcEntry const* GetSpellProcEntry(uint32 spellId) const;
-    bool CanSpellTriggerProcOnEvent(SpellProcEntry const& procEntry, ProcEventInfo& eventInfo) const;
+    // Fractured / Paragon: `procOwner` is the unit that holds the listening
+    // proc aura. Passing it lets SpellInfo::IsAffected wildcard the family
+    // check when the listener is on a CLASS_PARAGON player. Non-Paragon
+    // owners (or nullptr) reproduce stock behavior exactly.
+    bool CanSpellTriggerProcOnEvent(SpellProcEntry const& procEntry, ProcEventInfo& eventInfo,
+                                    Unit const* procOwner = nullptr) const;

    // Spell bonus data table
    [[nodiscard]] SpellBonusEntry const* GetSpellBonusData(uint32 spellId) const;
@@ -684,4 +684,10 @@ void WorldConfig::BuildConfigCache()

    // Achievement
    SetConfigValue<uint32>(CONFIG_ACHIEVEMENT_REALM_FIRST_KILL_WINDOW, "Achievement.RealmFirstKillWindow", 60);
+
+    // Fractured / Paragon: cross-class wildcard for SpellFamilyName gating.
+    // Default ON because the Paragon class is designed around it; flip to 0
+    // (no rebuild required) if a regression appears and stock family
+    // gating needs to be restored without backing out the code.
+    SetConfigValue<bool>(CONFIG_PARAGON_WILDCARD_FAMILY, "Paragon.WildcardFamilyMatching", true);
 }
@@ -495,6 +495,12 @@ enum ServerConfigs
    CONFIG_NEW_CHAR_STRING,
    CONFIG_VALIDATE_SKILL_LEARNED_BY_SPELLS,
    CONFIG_ACHIEVEMENT_REALM_FIRST_KILL_WINDOW,
+    // Fractured / Paragon: when true, CLASS_PARAGON characters bypass the
+    // SpellFamilyName equality check in proc / spellmod / aura listener
+    // gates so cross-class talent procs and modifiers can interact with
+    // spells learned from other classes (e.g. Predator's Swiftness 69369
+    // making Shaman Chain Lightning instant). Stock classes are unaffected.
+    CONFIG_PARAGON_WILDCARD_FAMILY,

    MAX_NUM_SERVER_CONFIGS
 };
@@ -64,10 +64,227 @@ struct npc_pet_mage_mirror_image : CasterAI
    uint32 dist = urand(1, 5);
    bool _delayAttack;

+    // Fractured / Paragon: when the owner is a Paragon character with the
+    // wildcard config enabled, replace the stock Frostbolt + Fireblast
+    // allowlist (loaded by CombatAI from creature_template_spell for
+    // creature 31216) with a curated list of damaging spells from the
+    // owner's spellbook. UpdateAI's override picks a random spell from
+    // the list per cast so the rotation isn't deterministic.
+    //
+    // The image still casts as itself (not via the owner), so spell
+    // coefficients apply to the image's stats -- spells naturally do less
+    // damage than they would in the owner's hands. We accept that as the
+    // cost of "free cross-class spell variety" rather than try to rebalance
+    // every player spell here.
+    static bool IsDamagingForMirrorImage(SpellInfo const* si)
+    {
+        // Direct damage effect.
+        if (si->HasEffect(SPELL_EFFECT_SCHOOL_DAMAGE))
+            return true;
+
+        // Spells like Arcane Missiles (TRIGGER_MISSILE) and most channeled
+        // multi-tick nukes route their damage through a child spell, so the
+        // parent has no SCHOOL_DAMAGE effect of its own. Accept that here.
+        if (si->HasEffect(SPELL_EFFECT_TRIGGER_MISSILE))
+            return true;
+
+        // DoTs and channels-as-aura (Mind Flay, Curse of Doom, Immolate,
+        // Corruption, Vampiric Touch, Drain Life leech, etc.). Also accept
+        // PERIODIC_TRIGGER_SPELL auras -- that's how Arcane Missiles fires
+        // each individual missile (parent has Aura=23 -> child damaging
+        // spell). Same pattern is used by Hunter Volley, Curse of Doom (in
+        // some ranks), and similar tick-by-trigger spells.
+        for (uint8 i = 0; i < MAX_SPELL_EFFECTS; ++i)
+        {
+            uint32 aura = si->Effects[i].ApplyAuraName;
+            if (aura == SPELL_AURA_PERIODIC_DAMAGE
+                || aura == SPELL_AURA_PERIODIC_DAMAGE_PERCENT
+                || aura == SPELL_AURA_PERIODIC_LEECH
+                || aura == SPELL_AURA_PERIODIC_TRIGGER_SPELL)
+                return true;
+        }
+
+        return false;
+    }
+
+    void RebuildSpellsFromOwnerSpellbookForParagon(Player* owner)
+    {
+        SpellVct curated;
+        curated.reserve(8);
+
+        uint32 scanned = 0, kept = 0, rejInactive = 0, rejPassive = 0, rejWeaponStrike = 0,
+               rejNoDmg = 0, rejAoe = 0, rejGate = 0, rejLongCD = 0, rejLowRank = 0;
+
+        // For diagnosis: collect IDs of spells we'd expect to keep (Fireball,
+        // Frostbolt, Lightning Bolt, Mind Blast, Shadow Bolt, etc.) but that
+        // we instead reject. The sample is small so per-spell logging is OK.
+        auto trackProbe = [&](uint32 spellId, char const* phase)
+        {
+            // Only log "interesting" spell IDs to avoid 177-line spam per image.
+            // These are first-rank IDs of common cross-class single-target nukes.
+            static constexpr uint32 probes[] = {
+                133,   116,   30451,                           // Mage: Fireball, Frostbolt, Arcane Blast
+                5143,                                          // Mage: Arcane Missiles (channel via PERIODIC_TRIGGER_SPELL)
+                403,   529,   8042,                            // Shaman: Lightning Bolt, Chain Lightning, Earth Shock
+                585,   14914,                                  // Priest: Smite, Holy Fire
+                8092,  15407,                                  // Priest: Mind Blast, Mind Flay
+                686,   348,                                    // Warlock: Shadow Bolt, Immolate (DoT w/ cast time)
+                5176,  2912,                                   // Druid: Wrath, Starfire
+                635,                                           // Paladin: Holy Light
+            };
+            for (uint32 probe : probes)
+            {
+                if (spellId == probe)
+                {
+                    LOG_DEBUG("server.scripts",
+                              "[paragon-diag] MirrorImage probe spell={} phase={}",
+                              spellId, phase);
+                    return;
+                }
+                // Also walk rank chain: if the spellbook has rank N of probe,
+                // probe matches via GetFirstRankSpell.
+                if (SpellInfo const* si = sSpellMgr->GetSpellInfo(spellId))
+                    if (SpellInfo const* first = si->GetFirstRankSpell())
+                        if (first->Id == probe)
+                        {
+                            LOG_DEBUG("server.scripts",
+                                      "[paragon-diag] MirrorImage probe spell={} (rank of {}) phase={}",
+                                      spellId, probe, phase);
+                            return;
+                        }
+            }
+        };
+
+        for (auto const& kv : owner->GetSpellMap())
+        {
+            ++scanned;
+            uint32 spellId = kv.first;
+            PlayerSpell const* ps = kv.second;
+            if (!ps || ps->State == PLAYERSPELL_REMOVED || !ps->Active)
+            {
+                ++rejInactive;
+                trackProbe(spellId, "inactive");
+                continue;
+            }
+
+            SpellInfo const* spellInfo = sSpellMgr->GetSpellInfo(spellId);
+            if (!spellInfo)
+                continue;
+
+            // Spec (per user): damaging single-target spells, instant or
+            // cast-time or channeled all OK, no melee/ranged "strike" style
+            // weapon-attack abilities, and no long-cooldown spells (>10s) so
+            // the image cycles through a varied rotation rather than blowing
+            // a 2-min cooldown once.
+            if (spellInfo->IsPassive())                             { ++rejPassive; trackProbe(spellId, "passive");      continue; }
+            if (!IsDamagingForMirrorImage(spellInfo))               { ++rejNoDmg;   trackProbe(spellId, "noDmg");        continue; }
+            if (spellInfo->IsAffectingArea())                       { ++rejAoe;     trackProbe(spellId, "aoe");          continue; }
+            if (spellInfo->DmgClass == SPELL_DAMAGE_CLASS_MELEE
+                || spellInfo->DmgClass == SPELL_DAMAGE_CLASS_RANGED) { ++rejWeaponStrike; trackProbe(spellId, "weaponStrike"); continue; }
+            // Reject anything with a base cooldown longer than 10s (either
+            // RecoveryTime or CategoryRecoveryTime). A 0/very-short CD is
+            // fine. The mage Mirror Image only lives for 30s, so anything
+            // gated by a long CD would only ever fire once anyway.
+            uint32 cd = std::max(spellInfo->RecoveryTime, spellInfo->CategoryRecoveryTime);
+            if (cd > 10000)                                         { ++rejLongCD;  trackProbe(spellId, "longCD");       continue; }
+
+            // Skip spells the image would never realistically be able to
+            // cast successfully or whose side-effects don't make sense on a
+            // pet (totems, summons, item / reagent / focus requirements,
+            // ranged-weapon / shapeshift / stealth gates, profession spells,
+            // teleports, etc.).
+            char const* gateReason = nullptr;
+            if (spellInfo->RequiresSpellFocus)                                              gateReason = "focus";
+            else if (spellInfo->Reagent[0] > 0)                                             gateReason = "reagent";
+            else if (spellInfo->Stances || spellInfo->StancesNot)                           gateReason = "stance";
+            else if (spellInfo->EquippedItemClass >= 0)                                     gateReason = "equipped";
+            else if (spellInfo->IsCooldownStartedOnEvent())                                 gateReason = "cdEvent";
+            else if (spellInfo->HasAttribute(SPELL_ATTR0_PASSIVE))                          gateReason = "attrPassive";
+            else if (spellInfo->HasAttribute(SPELL_ATTR0_DO_NOT_DISPLAY))                   gateReason = "attrHidden";
+            // SPELL_ATTR0_NOT_SHAPESHIFTED is intentionally NOT a gate -- it
+            // means "cannot be cast while caster IS shapeshifted", not "this
+            // spell requires a shapeshift". The attribute is set on every
+            // standard caster nuke (Fireball, Frostbolt, Lightning Bolt,
+            // Shadow Bolt, etc.) and Mirror Images are never shapeshifted,
+            // so the runtime check trivially passes for them. Filtering on
+            // it here was the bug that left the curated list empty.
+            else if (spellInfo->HasAttribute(SPELL_ATTR0_ONLY_STEALTHED))                   gateReason = "attrStealth";
+            // SPELL_ATTR1_NO_AUTOCAST_AI is intentionally NOT a gate -- it is set
+            // on most player nukes (Fireball / Lightning Bolt / Shadow Bolt) to
+            // stop class pets from auto-casting them. Mirror Images are
+            // server-curated player-spell mimics, so we WANT to auto-cast
+            // those exact spells.
+            else if (spellInfo->HasAttribute(SPELL_ATTR2_FAIL_ON_ALL_TARGETS_IMMUNE))       gateReason = "attrFailImmune";
+            else if (spellInfo->HasEffect(SPELL_EFFECT_SUMMON))                             gateReason = "fxSummon";
+            else if (spellInfo->HasEffect(SPELL_EFFECT_SUMMON_PET))                         gateReason = "fxSummonPet";
+            else if (spellInfo->HasEffect(SPELL_EFFECT_TELEPORT_UNITS))                     gateReason = "fxTeleport";
+            else if (spellInfo->HasEffect(SPELL_EFFECT_TRANS_DOOR))                         gateReason = "fxTransDoor";
+            else if (spellInfo->HasEffect(SPELL_EFFECT_OPEN_LOCK))                          gateReason = "fxOpenLock";
+            else if (spellInfo->HasEffect(SPELL_EFFECT_INSTAKILL))                          gateReason = "fxInstakill";
+            else if (spellInfo->HasEffect(SPELL_EFFECT_LEARN_SPELL))                        gateReason = "fxLearn";
+            if (gateReason) { ++rejGate; trackProbe(spellId, gateReason); continue; }
+
+            // Ignore spell ranks below the highest the player owns -- the
+            // spellbook contains all learned ranks; we want only the latest.
+            if (SpellInfo const* nextRank = spellInfo->GetNextRankSpell())
+                if (owner->HasSpell(nextRank->Id))
+                    { ++rejLowRank; trackProbe(spellId, "lowRank"); continue; }
+
+            ++kept;
+            curated.push_back(spellId);
+            LOG_DEBUG("server.scripts",
+                      "[paragon-diag] MirrorImage kept spell={} ({})",
+                      spellId,
+                      spellInfo->SpellName[0] ? spellInfo->SpellName[0] : "?");
+        }
+
+        LOG_DEBUG("server.scripts",
+                  "[paragon-diag] MirrorImage rebuild owner={} scanned={} kept={} "
+                  "rejInactive={} rejPassive={} rejNoDmg={} rejAoe={} rejWeaponStrike={} rejLongCD={} rejGate={} rejLowRank={}",
+                  owner->GetName(), scanned, kept,
+                  rejInactive, rejPassive, rejNoDmg, rejAoe, rejWeaponStrike, rejLongCD, rejGate, rejLowRank);
+
+        if (curated.empty())
+        {
+            LOG_DEBUG("server.scripts",
+                      "[paragon-diag] MirrorImage rebuild for {} produced empty list, keeping stock 59637/59638",
+                      owner->GetName());
+            return; // keep stock 59637 / 59638 fallback
+        }
+
+        // Log the first few spell IDs we picked so we can verify the list.
+        std::string sample;
+        for (size_t i = 0; i < curated.size() && i < 8; ++i)
+        {
+            if (!sample.empty())
+                sample += ',';
+            sample += std::to_string(curated[i]);
+        }
+        LOG_DEBUG("server.scripts",
+                  "[paragon-diag] MirrorImage rebuild swapping spells for {} (sample: {})",
+                  owner->GetName(), sample);
+
+        spells.swap(curated);
+    }
+
    void InitializeAI() override
    {
        CasterAI::InitializeAI();

+        // Fractured / Paragon: do the spellbook rebuild EARLY -- before
+        // owner->CastSpell(CLONE_ME) and before any threat-list inheritance,
+        // because any of those can synchronously fire JustEngagedWith on the
+        // image and cause CasterAI::JustEngagedWith to schedule events from
+        // the stock [59638 Frostbolt, 59637 Fireblast] m_spells[] entries
+        // before our swap takes effect. The override of JustEngagedWith
+        // below also reasserts the swap + flushes events, so even if a later
+        // combat-entry path fires JustEngagedWith again it picks up the
+        // curated list.
+        if (Unit* owner = me->GetOwner())
+            if (Player* playerOwner = owner->ToPlayer())
+                if (IsParagonWildcardCaller(playerOwner))
+                    RebuildSpellsFromOwnerSpellbookForParagon(playerOwner);
+
        _delayAttack = true;
        me->m_Events.AddEventAtOffset([this]()
        {
@@ -76,11 +293,21 @@ struct npc_pet_mage_mirror_image : CasterAI

        Unit* owner = me->GetOwner();
        if (!owner)
+        {
+            LOG_DEBUG("server.scripts",
+                      "[paragon-diag] MirrorImage InitializeAI: no owner, spells.size={} (stock)",
+                      spells.size());
            return;
+        }

        // Clone Me!
        owner->CastSpell(me, SPELL_MAGE_CLONE_ME, true);

+        LOG_DEBUG("server.scripts",
+                  "[paragon-diag] MirrorImage InitializeAI: post-rebuild spells.size={} first={}",
+                  spells.size(),
+                  spells.empty() ? 0u : spells.front());
+
        // xinef: Glyph of Mirror Image (4th copy)
        float angle = 0.0f;
        switch (me->GetUInt32Value(UNIT_CREATED_BY_SPELL))
@@ -139,6 +366,37 @@ struct npc_pet_mage_mirror_image : CasterAI
        me->m_Events.AddEventAtOffset(new DeathEvent(*me), 29500ms);
    }

+    void JustEngagedWith(Unit* who) override
+    {
+        // Fractured / Paragon: re-apply the spellbook rebuild here as well,
+        // because the engagement can fire synchronously from inside
+        // InitializeAI (via owner->CastSpell(CLONE_ME) or summon-side threat
+        // propagation) BEFORE InitializeAI's own rebuild call has run.
+        // Re-running it here is cheap and idempotent: the curated list is
+        // re-derived from the owner's current spellbook, and we wipe any
+        // previously-scheduled events so the stock 59637 / 59638 entries
+        // CasterAI may already have queued get evicted before scheduling.
+        if (Unit* owner = me->GetOwner())
+            if (Player* playerOwner = owner->ToPlayer())
+                if (IsParagonWildcardCaller(playerOwner))
+                {
+                    RebuildSpellsFromOwnerSpellbookForParagon(playerOwner);
+                    events.Reset();
+                }
+
+        std::string sample;
+        for (size_t i = 0; i < spells.size() && i < 8; ++i)
+        {
+            if (!sample.empty()) sample += ',';
+            sample += std::to_string(spells[i]);
+        }
+        LOG_DEBUG("server.scripts",
+                  "[paragon-diag] MirrorImage JustEngagedWith: spells.size={} sample=[{}] who={}",
+                  spells.size(), sample, who ? who->GetName() : "<null>");
+
+        CasterAI::JustEngagedWith(who);
+    }
+
    // Do not reload Creature templates on evade mode enter - prevent visual lost
    void EnterEvadeMode(EvadeReason /*why*/) override
    {
@@ -217,10 +475,61 @@ struct npc_pet_mage_mirror_image : CasterAI
        if (me->HasUnitState(UNIT_STATE_CASTING))
            return;

-        if (uint32 spellId = events.ExecuteEvent())
+        if (uint32 queuedId = events.ExecuteEvent())
        {
-            events.RescheduleEvent(spellId, spellId == 59637 ? 6500ms : 2500ms);
-            me->CastSpell(me->GetVictim(), spellId, false);
+            // Fractured / Paragon: when the curated spellbook list is in
+            // play, pick a random spell from it for THIS cast instead of
+            // using the EventMap-scheduled spellId directly. The events
+            // queue (populated by CasterAI::JustEngagedWith) is otherwise
+            // deterministic for our small list and the image ends up
+            // rotating in lockstep; randomizing here makes each image
+            // (and each cast) feel like a mage ad-libbing from the
+            // player's repertoire.
+            uint32 actualId = queuedId;
+            bool isParagon = false;
+            if (Unit* owner = me->GetOwner())
+                if (Player* playerOwner = owner->ToPlayer())
+                    if (IsParagonWildcardCaller(playerOwner) && !spells.empty())
+                    {
+                        actualId = spells[urand(0, uint32(spells.size()) - 1)];
+                        isParagon = true;
+                    }
+
+            // Reschedule the queue based on the spell we actually cast,
+            // not the one originally queued. For channeled spells this
+            // matters: Arcane Missiles is a 5s channel, so if we keep
+            // rescheduling every 2.5s the image is always either mid-
+            // channel or immediately re-rolling for another channel,
+            // and over four images you see effectively continuous
+            // Arcane Missiles. Wait for cast/channel to finish + a
+            // small breather before picking again.
+            Milliseconds nextDelay = (queuedId == 59637 ? 6500ms : 2500ms);
+            if (isParagon)
+            {
+                if (SpellInfo const* picked = sSpellMgr->GetSpellInfo(actualId))
+                {
+                    uint32 castMs = picked->CalcCastTime();
+                    uint32 chanMs = 0;
+                    if (picked->IsChanneled())
+                    {
+                        int32 dur = picked->GetDuration();
+                        if (dur > 0)
+                            chanMs = uint32(dur);
+                    }
+                    uint32 minMs = std::max(castMs, chanMs) + 750; // breather
+                    if (Milliseconds(minMs) > nextDelay)
+                        nextDelay = Milliseconds(minMs);
+                }
+            }
+            events.RescheduleEvent(queuedId, nextDelay);
+
+            SpellCastResult castRes = me->CastSpell(me->GetVictim(), actualId, false);
+            LOG_DEBUG("server.scripts",
+                      "[paragon-diag] MirrorImage cast spell={} victim={} result={} nextDelay={}ms",
+                      actualId,
+                      me->GetVictim() ? me->GetVictim()->GetName() : "<null>",
+                      uint32(castRes),
+                      uint32(nextDelay.count()));
        }
    }
 };
@@ -66,6 +66,9 @@ enum DeathKnightSpells
    SPELL_DK_ITEM_T8_MELEE_4P_BONUS             = 64736,
    SPELL_DK_MASTER_OF_GHOULS                   = 52143,
    SPELL_DK_BLOOD_PLAGUE                       = 55078,
+    // Fractured / Paragon: stock Priest Devouring Plague vs Character Advancement multidot clone
+    SPELL_PRIEST_DEVOURING_PLAGUE_R1            = 2944,
+    SPELL_PARAGON_MULTIDOT_DEVOURING_PLAGUE_R1  = 951000,
    SPELL_DK_RAISE_DEAD_USE_REAGENT             = 48289,
    SPELL_DK_RUNIC_POWER_ENERGIZE               = 49088,
    SPELL_DK_SCENT_OF_BLOOD                     = 50422,
@@ -107,6 +110,10 @@ enum DeathKnightSpells
    SPELL_DK_RUNE_STRIKE_OFF_HAND_R1             = 66217,
    SPELL_DK_BLOOD_STRIKE_OFF_HAND_R1            = 66215,
    SPELL_DK_KILLING_MACHINE                     = 51124,
+    // Fractured / Paragon: Character Advancement DK presence clones (SpellFamily GENERIC in Spell.dbc).
+    SPELL_PARAGON_ADV_BLOOD_PRESENCE             = 951013,
+    SPELL_PARAGON_ADV_FROST_PRESENCE             = 951014,
+    SPELL_PARAGON_ADV_UNHOLY_PRESENCE            = 951015,
 };

 enum DeathKnightSpellIcons
@@ -126,6 +133,21 @@ enum Misc
    NPC_RISEN_ALLY                              = 30230
 };

+inline bool Fractured_UnitHasBloodPresenceAura(Unit const* unit)
+{
+    return unit->HasAura(SPELL_DK_BLOOD_PRESENCE) || unit->HasAura(SPELL_PARAGON_ADV_BLOOD_PRESENCE);
+}
+
+inline bool Fractured_UnitHasFrostPresenceAura(Unit const* unit)
+{
+    return unit->HasAura(SPELL_DK_FROST_PRESENCE) || unit->HasAura(SPELL_PARAGON_ADV_FROST_PRESENCE);
+}
+
+inline bool Fractured_UnitHasUnholyPresenceAura(Unit const* unit)
+{
+    return unit->HasAura(SPELL_DK_UNHOLY_PRESENCE) || unit->HasAura(SPELL_PARAGON_ADV_UNHOLY_PRESENCE);
+}
+
 // 50526 - Wandering Plague
 class spell_dk_wandering_plague : public SpellScript
 {
@@ -664,6 +686,23 @@ class spell_dk_dancing_rune_weapon : public AuraScript
            return false;

        SpellInfo const* spellInfo = eventInfo.GetSpellInfo();
+
+        // Fractured / Paragon: Paragon owners get a "ghostly weapon copies
+        // your swings" identity instead of the stock magical-doppelganger
+        // (which also re-cast Death Coil / Icy Touch / Howling Blast /
+        // etc.). For Paragon callers only, accept auto-attacks and
+        // melee-class abilities (Hamstring, Sinister Strike, Heart Strike,
+        // Frost Strike, Mortal Strike, ...) and reject magic / ranged
+        // spells. Stock DK gating below is left untouched.
+        if (IsParagonWildcardCaller(eventInfo.GetActor()))
+        {
+            if (!eventInfo.GetDamageInfo())
+                return false;
+            if (spellInfo && spellInfo->DmgClass != SPELL_DAMAGE_CLASS_MELEE)
+                return false;
+            return true;
+        }
+
        if (!spellInfo)
            return true;

@@ -1780,8 +1819,11 @@ class spell_dk_improved_blood_presence : public AuraScript
        return ValidateSpellInfo(
            {
                SPELL_DK_BLOOD_PRESENCE,
+                SPELL_PARAGON_ADV_BLOOD_PRESENCE,
                SPELL_DK_FROST_PRESENCE,
+                SPELL_PARAGON_ADV_FROST_PRESENCE,
                SPELL_DK_UNHOLY_PRESENCE,
+                SPELL_PARAGON_ADV_UNHOLY_PRESENCE,
                SPELL_DK_IMPROVED_BLOOD_PRESENCE_TRIGGERED
            });
    }
@@ -1789,14 +1831,14 @@ class spell_dk_improved_blood_presence : public AuraScript
    void HandleEffectApply(AuraEffect const* aurEff, AuraEffectHandleModes /*mode*/)
    {
        Unit* target = GetTarget();
-        if (target->HasAnyAuras(SPELL_DK_FROST_PRESENCE, SPELL_DK_UNHOLY_PRESENCE) && !target->HasAura(SPELL_DK_IMPROVED_BLOOD_PRESENCE_TRIGGERED))
+        if (target->HasAnyAuras(SPELL_DK_FROST_PRESENCE, SPELL_DK_UNHOLY_PRESENCE, SPELL_PARAGON_ADV_FROST_PRESENCE, SPELL_PARAGON_ADV_UNHOLY_PRESENCE) && !target->HasAura(SPELL_DK_IMPROVED_BLOOD_PRESENCE_TRIGGERED))
            target->CastCustomSpell(SPELL_DK_IMPROVED_BLOOD_PRESENCE_TRIGGERED, SPELLVALUE_BASE_POINT1, aurEff->GetAmount(), target, true, nullptr, aurEff);
    }

    void HandleEffectRemove(AuraEffect const* /*aurEff*/, AuraEffectHandleModes /*mode*/)
    {
        Unit* target = GetTarget();
-        if (!target->HasAura(SPELL_DK_BLOOD_PRESENCE))
+        if (!Fractured_UnitHasBloodPresenceAura(target))
            target->RemoveAura(SPELL_DK_IMPROVED_BLOOD_PRESENCE_TRIGGERED);
    }

@@ -1817,8 +1859,11 @@ class spell_dk_improved_frost_presence : public AuraScript
        return ValidateSpellInfo(
            {
                SPELL_DK_BLOOD_PRESENCE,
+                SPELL_PARAGON_ADV_BLOOD_PRESENCE,
                SPELL_DK_FROST_PRESENCE,
+                SPELL_PARAGON_ADV_FROST_PRESENCE,
                SPELL_DK_UNHOLY_PRESENCE,
+                SPELL_PARAGON_ADV_UNHOLY_PRESENCE,
                SPELL_DK_FROST_PRESENCE_TRIGGERED
            });
    }
@@ -1826,14 +1871,14 @@ class spell_dk_improved_frost_presence : public AuraScript
    void HandleEffectApply(AuraEffect const* aurEff, AuraEffectHandleModes /*mode*/)
    {
        Unit* target = GetTarget();
-        if (target->HasAnyAuras(SPELL_DK_BLOOD_PRESENCE, SPELL_DK_UNHOLY_PRESENCE) && !target->HasAura(SPELL_DK_FROST_PRESENCE_TRIGGERED))
+        if (target->HasAnyAuras(SPELL_DK_BLOOD_PRESENCE, SPELL_DK_UNHOLY_PRESENCE, SPELL_PARAGON_ADV_BLOOD_PRESENCE, SPELL_PARAGON_ADV_UNHOLY_PRESENCE) && !target->HasAura(SPELL_DK_FROST_PRESENCE_TRIGGERED))
            target->CastCustomSpell(SPELL_DK_FROST_PRESENCE_TRIGGERED, SPELLVALUE_BASE_POINT0, aurEff->GetAmount(), target, true, nullptr, aurEff);
    }

    void HandleEffectRemove(AuraEffect const* /*aurEff*/, AuraEffectHandleModes /*mode*/)
    {
        Unit* target = GetTarget();
-        if (!target->HasAura(SPELL_DK_FROST_PRESENCE))
+        if (!Fractured_UnitHasFrostPresenceAura(target))
            target->RemoveAura(SPELL_DK_FROST_PRESENCE_TRIGGERED);
    }

@@ -1854,8 +1899,11 @@ class spell_dk_improved_unholy_presence : public AuraScript
        return ValidateSpellInfo(
            {
                SPELL_DK_BLOOD_PRESENCE,
+                SPELL_PARAGON_ADV_BLOOD_PRESENCE,
                SPELL_DK_FROST_PRESENCE,
+                SPELL_PARAGON_ADV_FROST_PRESENCE,
                SPELL_DK_UNHOLY_PRESENCE,
+                SPELL_PARAGON_ADV_UNHOLY_PRESENCE,
                SPELL_DK_IMPROVED_UNHOLY_PRESENCE_TRIGGERED,
                SPELL_DK_UNHOLY_PRESENCE_TRIGGERED
            });
@@ -1864,14 +1912,14 @@ class spell_dk_improved_unholy_presence : public AuraScript
    void HandleEffectApply(AuraEffect const* aurEff, AuraEffectHandleModes /*mode*/)
    {
        Unit* target = GetTarget();
-        if (target->HasAura(SPELL_DK_UNHOLY_PRESENCE) && !target->HasAura(SPELL_DK_IMPROVED_UNHOLY_PRESENCE_TRIGGERED))
+        if (Fractured_UnitHasUnholyPresenceAura(target) && !target->HasAura(SPELL_DK_IMPROVED_UNHOLY_PRESENCE_TRIGGERED))
        {
            // Not listed as any effect, only base points set in dbc
            int32 basePoints = GetSpellInfo()->Effects[EFFECT_1].CalcValue();
            target->CastCustomSpell(target, SPELL_DK_IMPROVED_UNHOLY_PRESENCE_TRIGGERED, &basePoints, &basePoints, &basePoints, true, nullptr, aurEff);
        }

-        if (target->HasAnyAuras(SPELL_DK_BLOOD_PRESENCE, SPELL_DK_FROST_PRESENCE) && !target->HasAura(SPELL_DK_UNHOLY_PRESENCE_TRIGGERED))
+        if (target->HasAnyAuras(SPELL_DK_BLOOD_PRESENCE, SPELL_DK_FROST_PRESENCE, SPELL_PARAGON_ADV_BLOOD_PRESENCE, SPELL_PARAGON_ADV_FROST_PRESENCE) && !target->HasAura(SPELL_DK_UNHOLY_PRESENCE_TRIGGERED))
            target->CastCustomSpell(SPELL_DK_UNHOLY_PRESENCE_TRIGGERED, SPELLVALUE_BASE_POINT0, aurEff->GetAmount(), target, true, nullptr, aurEff);
    }

@@ -1881,7 +1929,7 @@ class spell_dk_improved_unholy_presence : public AuraScript

        target->RemoveAura(SPELL_DK_IMPROVED_UNHOLY_PRESENCE_TRIGGERED);

-        if (!target->HasAura(SPELL_DK_UNHOLY_PRESENCE))
+        if (!Fractured_UnitHasUnholyPresenceAura(target))
            target->RemoveAura(SPELL_DK_UNHOLY_PRESENCE_TRIGGERED);
    }

@@ -1916,6 +1964,20 @@ class spell_dk_pestilence : public SpellScript
        if (!target)
            return;

+        // Fractured / Paragon: when the Pestilence caster is a Paragon and
+        // wildcard family matching is on, also spread (or refresh) Priest
+        // Devouring Plague. Devouring Plague's Dispel field is DISPEL_DISEASE
+        // and Unit::GetDiseasesByCaster already counts it for Paragon callers
+        // (see Unit.cpp), so it is conceptually a disease; stock Pestilence
+        // just hard-codes Blood Plague + Frost Fever and so silently drops it.
+        // GetAuraOfRankedSpell with the rank-1 id (2944 / 951000) covers every rank of
+        // Devouring Plague the player has on the target -- we re-cast that
+        // exact same rank so the spread copy carries the caster's actual
+        // damage tier rather than always rank 1. Stock DKs cannot cast
+        // Devouring Plague at all, so both lookups return null for them and
+        // this branch is a no-op there.
+        bool const paragonSpread = IsParagonWildcardCaller(caster);
+
        // Spread on others
        if (target != hitUnit)
        {
@@ -1926,6 +1988,17 @@ class spell_dk_pestilence : public SpellScript
            // Frost Fever
            if (target->GetAura(SPELL_DK_FROST_FEVER, caster->GetGUID()))
                caster->CastSpell(hitUnit, SPELL_DK_FROST_FEVER, true);
+
+            // Fractured / Paragon: Devouring Plague spread (stock 2944 chain or
+            // Character Advancement multidot clone 951000 chain).
+            if (paragonSpread)
+            {
+                Aura const* dp = target->GetAuraOfRankedSpell(SPELL_PRIEST_DEVOURING_PLAGUE_R1, caster->GetGUID());
+                if (!dp)
+                    dp = target->GetAuraOfRankedSpell(SPELL_PARAGON_MULTIDOT_DEVOURING_PLAGUE_R1, caster->GetGUID());
+                if (dp)
+                    caster->CastSpell(hitUnit, dp->GetId(), true);
+            }
        }
        // Refresh on target
        else if (caster->GetAura(SPELL_DK_GLYPH_OF_DISEASE))
@@ -1946,6 +2019,16 @@ class spell_dk_pestilence : public SpellScript
                disease->RefreshDuration();
            else if (Aura* disease = target->GetAuraOfRankedSpell(SPELL_DK_CRYPT_FEVER_R1, caster->GetGUID()))
                disease->RefreshDuration();
+
+            // Fractured / Paragon: Devouring Plague Glyph-of-Disease refresh.
+            if (paragonSpread)
+            {
+                Aura* dp = target->GetAuraOfRankedSpell(SPELL_PRIEST_DEVOURING_PLAGUE_R1, caster->GetGUID());
+                if (!dp)
+                    dp = target->GetAuraOfRankedSpell(SPELL_PARAGON_MULTIDOT_DEVOURING_PLAGUE_R1, caster->GetGUID());
+                if (dp)
+                    dp->RefreshDuration();
+            }
        }
    }

@@ -1969,6 +2052,9 @@ class spell_dk_presence : public AuraScript
                SPELL_DK_BLOOD_PRESENCE,
                SPELL_DK_FROST_PRESENCE,
                SPELL_DK_UNHOLY_PRESENCE,
+                SPELL_PARAGON_ADV_BLOOD_PRESENCE,
+                SPELL_PARAGON_ADV_FROST_PRESENCE,
+                SPELL_PARAGON_ADV_UNHOLY_PRESENCE,
                SPELL_DK_IMPROVED_BLOOD_PRESENCE_R1,
                SPELL_DK_IMPROVED_FROST_PRESENCE_R1,
                SPELL_DK_IMPROVED_UNHOLY_PRESENCE_R1,
@@ -1983,7 +2069,7 @@ class spell_dk_presence : public AuraScript
    {
        Unit* target = GetTarget();

-        if (GetId() == SPELL_DK_BLOOD_PRESENCE)
+        if (GetId() == SPELL_DK_BLOOD_PRESENCE || GetId() == SPELL_PARAGON_ADV_BLOOD_PRESENCE)
            target->CastSpell(target, SPELL_DK_IMPROVED_BLOOD_PRESENCE_TRIGGERED, true);
        else if (AuraEffect const* impAurEff = target->GetAuraEffectOfRankedSpell(SPELL_DK_IMPROVED_BLOOD_PRESENCE_R1, EFFECT_0))
            if (!target->HasAura(SPELL_DK_IMPROVED_BLOOD_PRESENCE_TRIGGERED))
@@ -1994,7 +2080,7 @@ class spell_dk_presence : public AuraScript
    {
        Unit* target = GetTarget();

-        if (GetId() == SPELL_DK_FROST_PRESENCE)
+        if (GetId() == SPELL_DK_FROST_PRESENCE || GetId() == SPELL_PARAGON_ADV_FROST_PRESENCE)
            target->CastSpell(target, SPELL_DK_FROST_PRESENCE_TRIGGERED, true);
        else if (AuraEffect const* impAurEff = target->GetAuraEffectOfRankedSpell(SPELL_DK_IMPROVED_FROST_PRESENCE_R1, EFFECT_0))
            if (!target->HasAura(SPELL_DK_FROST_PRESENCE_TRIGGERED))
@@ -2005,12 +2091,12 @@ class spell_dk_presence : public AuraScript
    {
        Unit* target = GetTarget();

-        if (GetId() == SPELL_DK_UNHOLY_PRESENCE)
+        if (GetId() == SPELL_DK_UNHOLY_PRESENCE || GetId() == SPELL_PARAGON_ADV_UNHOLY_PRESENCE)
            target->CastSpell(target, SPELL_DK_UNHOLY_PRESENCE_TRIGGERED, true);

        if (AuraEffect const* impAurEff = target->GetAuraEffectOfRankedSpell(SPELL_DK_IMPROVED_UNHOLY_PRESENCE_R1, EFFECT_0))
        {
-            if (GetId() == SPELL_DK_UNHOLY_PRESENCE)
+            if (GetId() == SPELL_DK_UNHOLY_PRESENCE || GetId() == SPELL_PARAGON_ADV_UNHOLY_PRESENCE)
            {
                // Not listed as any effect, only base points set
                int32 bp = impAurEff->GetSpellInfo()->Effects[EFFECT_1].CalcValue();
@@ -490,12 +490,22 @@ class spell_mage_cold_snap : public SpellScript
    {
        Player* caster = GetCaster()->ToPlayer();
        // immediately finishes the cooldown on Frost spells
-
+        //
+        // Fractured / Paragon: ParagonFamilyMatches() drops the
+        // SpellFamilyName == SPELLFAMILY_MAGE gate when the caster is a
+        // CLASS_PARAGON player AND Paragon.WildcardFamilyMatching is on,
+        // so any Frost-school spell in the Paragon's spellbook with a real
+        // recovery time (Howling Blast, Frost Shock, Frost Trap, etc.)
+        // also gets its cooldown wiped. Stock Mage callers fall through to
+        // strict family-name equality and observe identical behavior.
        PlayerSpellMap const& spellMap = caster->GetSpellMap();
        for (PlayerSpellMap::const_iterator itr = spellMap.begin(); itr != spellMap.end(); ++itr)
        {
            SpellInfo const* spellInfo = sSpellMgr->AssertSpellInfo(itr->first);
-            if (spellInfo->SpellFamilyName == SPELLFAMILY_MAGE && (spellInfo->GetSchoolMask() & SPELL_SCHOOL_MASK_FROST) && spellInfo->Id != SPELL_MAGE_COLD_SNAP && spellInfo->GetRecoveryTime() > 0)
+            if (ParagonFamilyMatches(caster, SPELLFAMILY_MAGE, spellInfo->SpellFamilyName)
+                && (spellInfo->GetSchoolMask() & SPELL_SCHOOL_MASK_FROST)
+                && spellInfo->Id != SPELL_MAGE_COLD_SNAP
+                && spellInfo->GetRecoveryTime() > 0)
            {
                SpellCooldowns::iterator citr = caster->GetSpellCooldownMap().find(spellInfo->Id);
                if (citr != caster->GetSpellCooldownMap().end() && citr->second.needSendToClient)
@@ -946,6 +956,107 @@ class spell_mage_summon_water_elemental : public SpellScript
    }
 };

+// 44543, 44545 - Fingers of Frost (talent ranks - the proc-trigger aura, NOT the
+// 74396 buff aura that is APPLIED when this talent fires).
+//
+// Stock spell_proc gates this talent by SpellFamilyName=MAGE plus a
+// SpellFamilyMask covering the Mage Frost spells that count as "chill-effect
+// dealers" (Frostbolt / Frost Nova / Cone of Cold / Blizzard / Frostfire Bolt /
+// Deep Freeze etc.). For Paragon characters with `Paragon.WildcardFamilyMatching`
+// enabled, we relax the spell_proc row to wildcard family/mask + SchoolMask=
+// FROST + SpellTypeMask=DAMAGE so that any Frost-school damage spell (DK Howling
+// Blast / Icy Touch, Hunter Frost Trap / Wing Clip-as-frost, Shaman Frost Shock,
+// Druid Hibernate damage payload, etc.) reaches this CheckProc; this script
+// then re-enforces the stock Mage allowlist for non-Paragon owners and lets
+// Paragons through unconditionally (the FROST + DAMAGE gate already happens at
+// the spell_proc layer, so any spell reaching us here is safe to accept).
+class spell_mage_fingers_of_frost_talent : public AuraScript
+{
+    PrepareAuraScript(spell_mage_fingers_of_frost_talent);
+
+    bool CheckProc(ProcEventInfo& eventInfo)
+    {
+        SpellInfo const* procSpell = eventInfo.GetSpellInfo();
+        if (!procSpell)
+            return false;
+
+        // Stock Mage allowlist: re-derive from this talent's own effect-0
+        // SpellClassMask so behavior matches the original auto-generated
+        // proc filter exactly (no risk of mask drift across DBC versions).
+        if (procSpell->SpellFamilyName == SPELLFAMILY_MAGE
+            && (GetSpellInfo()->Effects[EFFECT_0].SpellClassMask & procSpell->SpellFamilyFlags))
+            return true;
+
+        return IsParagonWildcardCaller(GetUnitOwner());
+    }
+
+    void Register() override
+    {
+        DoCheckProc += AuraCheckProcFn(spell_mage_fingers_of_frost_talent::CheckProc);
+    }
+};
+
+// 11071, 12496, 12497 - Frostbite (talent ranks - the proc-trigger aura that
+// chains into 12494 Frostbite freeze).
+//
+// Stock spell_proc (auto-generated from DBC) gates this talent by Mage family +
+// the talent's effect SpellClassMask (Mage Frost slow-applying spells). For
+// Paragon characters we relax the row to SchoolMask=FROST wildcard so that
+// chill-applying Frost spells from any class can reach this CheckProc; the
+// Paragon path additionally requires the proc spell to actually apply a slow
+// (SPELL_AURA_MOD_DECREASE_SPEED) so that pure damage Frost spells without a
+// chill component (e.g. raw Ice Lance on a non-frozen target) do NOT freeze.
+// Stock Mage owners get the original behavior re-enforced here.
+class spell_mage_frostbite : public AuraScript
+{
+    PrepareAuraScript(spell_mage_frostbite);
+
+    bool CheckProc(ProcEventInfo& eventInfo)
+    {
+        SpellInfo const* procSpell = eventInfo.GetSpellInfo();
+        if (!procSpell)
+            return false;
+
+        // Stock Mage path: re-derive from this talent's own effect-0
+        // SpellClassMask so behavior matches the original auto-generated
+        // proc filter exactly (no risk of mask drift across DBC versions).
+        if (procSpell->SpellFamilyName == SPELLFAMILY_MAGE
+            && (GetSpellInfo()->Effects[EFFECT_0].SpellClassMask & procSpell->SpellFamilyFlags))
+            return true;
+
+        if (!IsParagonWildcardCaller(GetUnitOwner()))
+            return false;
+
+        // Paragon path: any Frost-school spell that applies a chill effect
+        // (decrease-speed aura). The spell_proc row already gates by
+        // SchoolMask=FROST so we only need to verify chill semantics here.
+        for (uint8 i = 0; i < MAX_SPELL_EFFECTS; ++i)
+        {
+            if (procSpell->Effects[i].ApplyAuraName == SPELL_AURA_MOD_DECREASE_SPEED)
+                return true;
+        }
+
+        // Also accept the Improved-Blizzard-style cross-class case where the
+        // chill is applied by a separate triggered aura: if the proc spell's
+        // damage hit landed and the target already has a chill from us, treat
+        // it as eligible. Cheap and matches player expectations for Paragon.
+        if (Unit* procTarget = eventInfo.GetProcTarget())
+        {
+            Unit::AuraEffectList const& slows = procTarget->GetAuraEffectsByType(SPELL_AURA_MOD_DECREASE_SPEED);
+            for (AuraEffect const* slowEff : slows)
+                if (slowEff->GetCasterGUID() == GetUnitOwner()->GetGUID())
+                    return true;
+        }
+
+        return false;
+    }
+
+    void Register() override
+    {
+        DoCheckProc += AuraCheckProcFn(spell_mage_frostbite::CheckProc);
+    }
+};
+
 // 74396 - Fingers of Frost
 class spell_mage_fingers_of_frost : public AuraScript
 {
@@ -1631,5 +1742,7 @@ void AddSC_mage_spell_scripts()
    RegisterSpellScript(spell_mage_polymorph_cast_visual);
    RegisterSpellScript(spell_mage_summon_water_elemental);
    RegisterSpellScript(spell_mage_fingers_of_frost);
+    RegisterSpellScript(spell_mage_fingers_of_frost_talent);
+    RegisterSpellScript(spell_mage_frostbite);
    RegisterSpellScript(spell_mage_magic_absorption);
 }
@@ -1005,12 +1005,38 @@ class spell_pri_vampiric_embrace : public AuraScript

    bool CheckProc(ProcEventInfo& eventInfo)
    {
-        // Not proc from Mind Sear
        SpellInfo const* procSpell = eventInfo.GetSpellInfo();
        if (!procSpell)
            return false;

-        return !(procSpell->SpellFamilyFlags[1] & 0x80000);
+        // Stock: filter Mind Sear (the damage-tick spell carries this
+        // SpellFamilyFlags[1] bit; the channel itself is filtered by the
+        // standard data-row mask). Kept as a bit-test so the stock priest
+        // path is byte-identical to before this change.
+        if (procSpell->SpellFamilyFlags[1] & 0x80000)
+            return false;
+
+        // Fractured / Paragon: any single-target Shadow-school damage spell
+        // procs Vampiric Embrace, not just Priest Shadow spells. The
+        // SchoolMask=Shadow gate is enforced by the spell_proc data row
+        // (SchoolMask=32). The data-row family/mask was wildcarded in
+        // mod-paragon's 2026_05_11_01.sql update so this CheckProc fires for
+        // cross-family Shadow spells; here we add the single-target
+        // requirement (Mind Sear was already filtered above; this also
+        // catches AoE Warlock Shadow spells like Seed of Corruption,
+        // Hellfire, etc. that a Paragon could otherwise cast).
+        if (IsParagonWildcardCaller(GetTarget()))
+            return !procSpell->IsAffectingArea();
+
+        // Stock priest path: re-enforce the original Priest Shadow damage
+        // gate that used to live entirely in the data row. Without this,
+        // wildcarding the data row would let item-cast Shadow effects
+        // (consumables, trinkets) accidentally proc VE on stock priests.
+        if (procSpell->SpellFamilyName != SPELLFAMILY_PRIEST)
+            return false;
+        return (procSpell->SpellFamilyFlags[0] & 0x0280A010)
+            || (procSpell->SpellFamilyFlags[1] & 0x00002402)
+            || (procSpell->SpellFamilyFlags[2] & 0x00000008);
    }

    void HandleProc(AuraEffect const* aurEff, ProcEventInfo& eventInfo)
@@ -1790,6 +1790,45 @@ class spell_sha_maelstrom_weapon : public AuraScript
        });
    }

+    // Fractured / Paragon: spell_proc row 53817 is data-relaxed (wildcard
+    // family/mask) so cross-class spells can reach this CheckProc. We
+    // restore the original Shaman gating here for stock callers and add
+    // the Paragon-only Mage Fireball / Frostbolt allowlist mirroring the
+    // IsAffectedBySpellMod hook in SpellInfo.cpp. Arcane Blast was on the
+    // allowlist briefly but proved too potent stacked with its own
+    // self-buff -- removed.
+    bool CheckProc(ProcEventInfo& eventInfo)
+    {
+        SpellInfo const* procSpell = eventInfo.GetSpellInfo();
+        if (!procSpell)
+            return false;
+
+        // Stock allowlist (Shaman): Lightning Bolt, Chain Lightning,
+        // Lesser Healing Wave, Healing Wave, Hex. Encoded as the original
+        // SpellFamilyMask values from the pre-relaxation spell_proc row
+        // (Mask0 = 451, Mask1 = 32768).
+        bool stockMatch = procSpell->SpellFamilyName == SPELLFAMILY_SHAMAN
+            && ((procSpell->SpellFamilyFlags[0] & 451u)
+                || (procSpell->SpellFamilyFlags[1] & 32768u));
+        if (stockMatch)
+            return true;
+
+        if (!IsParagonWildcardCaller(GetUnitOwner()))
+            return false;
+
+        // Paragon path: also accept the curated Mage cast-time nukes.
+        if (procSpell->SpellFamilyName == SPELLFAMILY_MAGE)
+        {
+            SpellInfo const* first = procSpell->GetFirstRankSpell();
+            uint32 firstId = first ? first->Id : procSpell->Id;
+            if (firstId == 133 /*Fireball*/
+                || firstId == 116 /*Frostbolt*/)
+                return true;
+        }
+
+        return false;
+    }
+
    void HandleBonus(AuraEffect const* /*aurEff*/, AuraEffectHandleModes /*mode*/)
    {
        if (GetStackAmount() < int32(GetSpellInfo()->StackAmount))
@@ -1805,6 +1844,7 @@ class spell_sha_maelstrom_weapon : public AuraScript

    void Register() override
    {
+        DoCheckProc += AuraCheckProcFn(spell_sha_maelstrom_weapon::CheckProc);
        OnEffectApply += AuraEffectApplyFn(spell_sha_maelstrom_weapon::HandleBonus, EFFECT_0, SPELL_AURA_ADD_PCT_MODIFIER, AURA_EFFECT_HANDLE_CHANGE_AMOUNT);
    }
 };
@@ -215,6 +215,14 @@ Updates.AllowRehash = 1
 #                    -1 - (Enabled - unlimited)

 Updates.CleanDeadRefMaxCount = 3
+
+#
+#    Updates.ExceptionShutdownDelay
+#        Description: Time (in milliseconds) to wait before shutting down after a fatal exception (e.g. failed SQL update).
+#        Default:     10000 - 10 seconds
+#                     0     - Disabled (immediate shutdown)
+
+Updates.ExceptionShutdownDelay = 10000
 ###################################################################################################

 ###################################################################################################
@@ -0,0 +1,5 @@
+node_modules/
+dist/
+launcher.json
+.DS_Store
+Thumbs.db
@@ -0,0 +1,176 @@
+# Fractured Launcher (Electron)
+
+**Windows** and **Linux (AppImage)** launcher with **no extra console window**, **native Browse folder** dialog, **Gitea or GitHub** release assets + GitHub repo file sync, **realmlist**, optional **auth**, **Play**, and **auto-update** (via `electron-updater`). This is the **only** supported client launcher in this repo.
+
+## Requirements
+
+- [Node.js](https://nodejs.org/) 20+ (includes npm)
+
+## Run from source
+
+```bash
+cd tools/fractured-launcher-electron
+npm install
+npm start
+```
+
+On first run, **`launcher.json`** is created: **dev** — next to the app in this folder; **Windows packaged** — beside the `.exe`; **Linux AppImage / macOS packaged** — under Electron **`app.getPath('userData')`** (typically under **`~/.config/`**, folder name from the app; AppImage mount is read-only so config cannot live beside the binary).
+
+### Where patches download from
+
+- **Recommended (self-hosted Gitea):** set **`gitea.base_url`**, **`gitea.owner`**, **`gitea.repo`** in `launcher.json` (see **`default-launcher.json`**). Players need **`GITEA_TOKEN`** (or the env name in **`gitea.token_env`**) if the Gitea repo is **private** — same trade-off as any private host (per-player token, SSO proxy, or a read-only deploy token you accept distributing).
+- **Fallback:** if **`gitea.base_url`** is empty, **`from_release`** uses the **GitHub** Releases API against **`github.owner` / `github.repo`** (defaults to this **`Fractured`** repo for non-release paths), with optional **`GITHUB_TOKEN`** for private assets.
+
+## Build Windows installers
+
+```bash
+npm install
+npm run pack:win
+```
+
+Produces under **`dist/`**:
+
+| Artifact | Purpose |
+|----------|---------|
+| `Fractured-Launcher-${version}-Setup.exe` (NSIS) | **Recommended for players** — supports seamless **auto-update** and restart. |
+| `Fractured-Launcher-${version}-Windows-Portable.exe` | No installer; players replace the file manually. Auto-update is **less reliable** than NSIS. |
+
+## Build Linux AppImage
+
+```bash
+cd tools/fractured-launcher-electron
+npm install
+npm run pack:linux
+```
+
+Produces **`dist/Fractured-Launcher-${version}-Linux-x86_64.AppImage`**. Same **`lib/baked-gitea-channel.js`** and **`default-launcher.json`** as Windows; run on **Linux** (or use **Fractured launcher CI** / **Sync release to Gitea**, which upload this file to Gitea with the Windows installers).
+
+**Quick local test (avoids tag snapshot / CI):**
+- **Linux:** from repo root, **`bash tools/fractured-launcher-electron/scripts/manual-pack-linux.sh`** → **`dist/*.AppImage`**.
+- **Windows:** on a Windows machine, **`cd tools/fractured-launcher-electron`**, **`npm ci`**, **`npm run pack:win`** → **`dist/*.exe`**.
+
+### Hardcoded Gitea channel (non-token)
+
+**`lib/baked-gitea-channel.js`** exports **`base_url`**, **`owner`**, **`repo`**, **`release_tag`**. Set those strings once in the repo (same values you use for CI upload — not secret). At runtime **`config-store`** merges them into **`gitea.*`** so **`launcher.json`** does not need those fields; **`GITEA_TOKEN`** (or **`gitea.token_env`**) is still only for **private** Gitea. Leave a field **`''`** in the baked file to fall back to **`default-launcher.json`** / user **`launcher.json`** for that key.
+
+**`npm run pack:win`** is plain **electron-builder** — no inject step, no extra JSON beside the app.
+
+## Auto-update behaviour
+
+- **Packaged** builds only (`npm run pack:win` output). In `npm start` dev mode, update checks are skipped (button still explains that).
+- **No implicit GitHub feed:** the app does **not** guess `package.json` → `repository` anymore. Without configuration you get a clear “skipped” message instead of a **404** on a private repo.
+- **Configured feeds** (first match wins): **`update_feed_url` / `LAUNCHER_UPDATE_URL`** (generic `latest.yml`); or **`gitea`** block filled in + **`GITEA_TOKEN`** when the instance is private (resolves `…/releases/download/{tag}/`); or **`GITHUB_TOKEN`** + **`github.owner` / `github.repo`** for **private** GitHub releases only.
+- **~5 seconds** after launch, then **every 6 hours**, the app checks when a feed is configured.
+- When a download finishes, a dialog offers **Restart now** (calls `quitAndInstall`) or **Later**.
+- **Manual check:** button **Check launcher updates** in the UI.
+
+### Where launcher updates are hosted
+
+**`npm run publish:win`** runs **`electron-builder` with `--publish never`** — artifacts stay in **`dist/`**; CI uploads them to Gitea when you **publish a GitHub release**. For ad-hoc uploads, use **`scripts/upload-release-to-gitea.sh`**. For launcher auto-update, prefer:
+
+- Set **`update_feed_url`** (or **`LAUNCHER_UPDATE_URL`**) to a **generic** HTTPS base URL where **`latest.yml`** and the installer files are hosted (often the same Gitea release attachment URLs pattern your reverse proxy exposes), **or**
+- Keep publishing to a GitHub release only for **`latest.yml`** + installers if you accept that small metadata/binary channel there.
+
+**Private GitHub** updater: set **`GH_TOKEN`** / **`GITHUB_TOKEN`** / **`github.token_env`** as documented in `lib/auto-update.js` behaviour.
+
+**Generic feed:** optional Bearer token via the same token envs if your static host checks `Authorization`.
+
+### Publishing a new launcher version
+
+1. Bump **`version`** in `package.json` on `main` (or your release branch) and merge.
+2. Create a **GitHub release** (tag + attach patches / `Wow.exe` if needed) and click **Publish** — **Sync release to Gitea** builds **Windows + Linux** launcher artifacts and mirrors everything to Gitea.
+3. Local check: **`npm run pack:win`** (on Windows) or **`npm run pack:linux`** / **`scripts/manual-pack-linux.sh`**, then **`scripts/upload-release-to-gitea.sh`** with the same **`GITEA_*`** env vars as CI if you need a manual upload.
+
+## Sync to Gitea (patches + launcher binaries)
+
+CI workflow **Sync release to Gitea** (`.github/workflows/gitea-release-sync.yml`) runs on **every published GitHub release** on this repo:
+
+1. Triggers on **release published** on **`Dawnforger/Fractured`** (or **workflow_dispatch** with a tag).
+2. Builds **Windows** (NSIS + portable) and **Linux** (AppImage) in parallel, each using **`tools/fractured-launcher-electron` from the default branch** (overlaid onto the tag checkout), so older release tags never ship a launcher missing new **`lib/*.js`** files.
+3. Downloads **all assets** attached to that **GitHub** release (MPQs, patched `Wow.exe`, etc.).
+4. Merges with the built launcher artifacts and uploads to a **Gitea release** with the **same tag** (existing attachments on that Gitea release are replaced). **Launcher installers** attached on GitHub (**`Fractured-Launcher*`**, case-insensitive) are **not** merged — the **CI build from the default branch** is the only source of launcher binaries, so an old installer on the GitHub release cannot “stick” on Gitea next to a newer build. **`*.blockmap`** and **`builder-debug.yml`** are omitted from the merge and from Gitea uploads.
+
+**GitHub Actions secrets** (repository → Settings → Secrets and variables → Actions):
+
+| Secret | Example |
+|--------|---------|
+| **`GITEA_BASE_URL`** | `https://git.yourdomain.com` (no trailing slash) |
+| **`GITEA_TOKEN`** | Gitea personal access token with permission to manage releases and attachments on the target repo |
+| **`GITEA_OWNER`** | Organization or username on Gitea |
+| **`GITEA_REPO`** | Repository name — must already have **at least one commit** (Gitea returns HTTP 422 “repo is empty” for zero-commit repos; push e.g. a README on **`main`** or set **`GITEA_TARGET_REF`** to your default branch) |
+
+**Optional variable** (Settings → Variables): **`GITEA_TARGET_REF`** — default branch/commitish used **only when the workflow must create a new Gitea release** and Gitea needs `target_commitish` (defaults to **`main`** in the upload script if unset).
+
+**Player `launcher.json`:** packaged builds should already include **`gitea.base_url` / `owner` / `repo`** from the bake step above. Players only need to set **`GITEA_TOKEN`** (or your **`token_env`**) if the Gitea repo is **private**. To point at another instance, edit **`gitea`** in **`launcher.json`**:
+
+```json
+"gitea": {
+  "base_url": "https://git.yourdomain.com",
+  "owner": "myorg",
+  "repo": "fractured-patches",
+  "release_tag": "latest",
+  "token_env": "GITEA_TOKEN"
+}
+```
+
+**Manual upload:** `bash scripts/upload-release-to-gitea.sh /path/to/files v1.0.0` with the same env vars as CI.
+
+### Sync did not run / Gitea unchanged — checklist
+
+1. **Git tag ≠ GitHub Release** — Only **Releases** (published on the GitHub **Releases** page) trigger this workflow. If your teammate only **`git push --tags`**, create a **Release** from that tag and click **Publish** (or run **Actions → Sync release to Gitea → Run workflow** and enter the tag).
+2. **Manual run: tag vs title** — **Run workflow** must receive the **git tag** (e.g. `v0.7.11-paragon-…`), copied from the release page’s tag badge. Pasting the **release title** (long line with spaces/parentheses) breaks `git fetch` with `invalid refspec`.
+3. **Draft release** — Must click **Publish release**; drafts do not mirror.
+4. **Workflow on default branch** — GitHub runs `release` workflows from the **default branch** (e.g. `main`). Ensure `.github/workflows/gitea-release-sync.yml` is merged there.
+5. **Repo name guard** — Jobs use `if: github.repository == 'Dawnforger/Fractured'`. Forks or renames must change that line or runs are skipped.
+6. **Secrets** — **`GITEA_BASE_URL`**, **`GITEA_TOKEN`**, **`GITEA_OWNER`**, **`GITEA_REPO`** must be set under **Settings → Secrets and variables → Actions**. A failed “Upload to Gitea” step usually prints which is missing.
+7. **Actions tab** — Open the latest **Sync release to Gitea** run; a red **build-electron** (old tag without `package-lock.json`, etc.) or **Upload to Gitea** step shows the real error.
+8. **HTTP 422 `repo is empty`** — The Gitea repo has **no commits** yet. Push any initial commit (e.g. **Add README** in the Gitea web UI, or `git push` to **`main`**). Optionally set **`GITEA_TARGET_REF`** to match your real default branch if it is not **`main`**. From this repo you can run **`scripts/bootstrap-gitea-repo.sh`** (see script header for `GITEA_*` env or pass the HTTPS/SSH clone URL as the first argument).
+9. **`sync Wow.exe: fetch failed`** — Often **HTTPS/TLS** to Gitea; use **`http://…`** in **`lib/baked-gitea-channel.js`** if you only serve plain HTTP, or fix certs / **`NODE_EXTRA_CA_CERTS`**. Ensure **`Wow-patched.exe`** exists on the release (**`release_tag`**: `latest` vs pinned). Errors include the failing URL when possible.
+10. **Wine + Windows portable** — If the folder picker returns **`/home/...`**, the launcher maps it to **`Z:\home\...`** (Wine’s Unix root). **`Wow.exe`** is matched case-insensitively for Linux-backed folders. Re-save the WoW folder after upgrading if validation still fails.
+11. **`EBUSY` / file locked on Windows** — The client (or antivirus) may keep **`.MPQ`** files open. The launcher **retries** for a short window and downloads the new file **before** replacing the old one; if sync still fails, **exit WoW** (and any tool previewing that folder) and run **Download updates** again.
+12. **`.bak-*` clutter** — When **Download updates** finishes without error, the launcher removes matching **`*.bak-YYYYMMDD-HHmmss`** files from earlier runs (same pattern it uses when replacing files). Failed syncs do not delete backups.
+13. **Gitea still shows an old launcher version** — The sync workflow overlays **`tools/fractured-launcher-electron` from the default branch**, so **`package.json`** there defines the built version. Ensure launcher changes are **merged to `main`** before publishing the GitHub release (or re-run **Actions → Sync release to Gitea** after merging). Previously, **Fractured-Launcher\*** files **attached on the GitHub release** were merged too, which could leave **two** installer versions on Gitea; those assets are now skipped in favor of CI-only builds.
+
+### Private Gitea token for players
+
+Do **not** embed a shared admin PAT in a shipped `launcher.json`. Prefer read-only tokens scoped to one repo, short-lived tokens, or a small auth service that redirects to signed URLs.
+
+**Release asset names** must match **`files[].source`** when **`from_release`**: true. Use **`release_tag`**: `"latest"` or a pinned tag matching both GitHub and Gitea.
+
+## Patch versions (same filenames, different bytes)
+
+The launcher does **not** read Git commits. For **turn-key** updates when asset names stay fixed (e.g. **`Wow-patched.exe`** — add more **`files`** entries for any extra MPQs you ship):
+
+1. Ship **`patch-manifest.json`** next to those files on **every** release (Gitea/GitHub attachment). It lists a **`version`** label (any string you bump per release, e.g. `v0.9.0-client`) and a **`sha256`** per **`files[].source`** name.
+2. With **`patch_manifest.enabled`**: true (default in **`default-launcher.json`**), **Download updates** first fetches the manifest from the same release channel. If the files already on disk match those checksums, the player sees **“already match build … (nothing to download)”** — no redundant downloads.
+3. After a real download, the launcher **re-hashes** installed files and compares to the manifest; mismatch → clear error. It also writes **`.fractured/patch-state.json`** under the WoW folder so the UI can show **“Installed client files: …”**.
+
+If **`patch-manifest.json`** is missing on a release, the launcher falls back to **always downloading** all configured files (same as before).
+
+**Generate the manifest** when you cut a release (paths are your local patch binaries):
+
+```bash
+cd /path/to/staging
+node tools/fractured-launcher-electron/scripts/generate-patch-manifest.js v0.9.0-client Wow-patched.exe > patch-manifest.json
+```
+
+Attach **`patch-manifest.json`** together with the MPQ/exe to the GitHub release (CI sync copies it to Gitea with everything else).
+
+## CI
+
+Workflow **Fractured launcher CI** (`.github/workflows/fractured-launcher-ci.yml`) runs on pushes/PRs under `tools/fractured-launcher-electron/`: **Windows** (`npm run pack:win`) and **Linux** (`npm run pack:linux`) jobs, each **`electron-builder … --publish never`**. **Actions → Fractured launcher CI → Run workflow** runs it manually.
+
+**Sync release to Gitea** (`.github/workflows/gitea-release-sync.yml`) uses the same pack commands. If you see `GH_TOKEN` / `GitHubPublisher` errors in logs, the job is almost certainly an old **Re-run failed jobs** — open **Actions → Sync release to Gitea → Run workflow**, enter the tag, and start a **new** run instead.
+
+## Config
+
+Schema is defined by **`default-launcher.json`** (shipped in the app; first run copies to **`launcher.json`** — beside the **Windows** exe, or under **`userData`** on **Linux/macOS** packaged builds):
+
+- **`game_dir`**: WoW 3.3.5a root (contains `Wow.exe`).
+- **`update_feed_url`**: optional generic HTTPS base for launcher auto-update.
+- **`launcher_updates_from_github`**: default **`false`**. Only when **`true`** will a **`GITHUB_TOKEN`** (or **`github.token_env`**) enable **electron-updater**’s GitHub provider against **`github.owner` / `github.repo`**. Leave **`false`** when launcher binaries and **`latest.yml`** live on **Gitea** (use **`gitea`** + token instead) so a stray GitHub token does not produce “No published versions on GitHub”.
+- **`gitea`**: **`base_url`**, **`owner`**, **`repo`**, **`release_tag`**, **`token_env`** — when **`base_url`** is set (and owner/repo set), **`from_release`** downloads and (with token if needed) the **generic** updater feed use **Gitea**. **Required** for players if your CI mirrors patches/launchers to Gitea only.
+- **`github`**: used for **non-release** repo paths (`from_release`: false) and for **GitHub** **`from_release`** when **`gitea.base_url`** is empty.
+- **`patch_manifest`**: **`enabled`**, **`source`** (default `patch-manifest.json`), **`from_release`** — checksum-based skip + verify (see above).
+- **`files`**: default **`[]`**. **Download updates** resolves what to pull in order: (**1**) non-empty **`files`** if you set explicit **`source`** → **`dest`** pairs; (**2**) else each key in **`patch-manifest.json`** on the release (recommended); (**3**) else release attachments except launcher artifacts (`Fractured-Launcher*`, `*.blockmap`, `latest*.yml`, `.AppImage`, `patch-manifest.json`): **`.MPQ`** → **`Data/enUS/<name>.MPQ`** (extension forced to **`.MPQ`** caps for client compatibility), one **`.exe`** → **`launch.exe`**. Multiple `.exe` attachments require a manifest. Legacy **`Wow-patched.exe`** entries are removed when merging **`launcher.json`**.
+- **`realmlist`**, **`auth`**, **`launch`** (`**exe**`, **`args`**). Only **`Data/enUS/realmlist.wtf`** is written: any **`realmlist.paths`** entry that is not the enUS file is ignored (so **`enGB`** is never created). On **Linux**, **Play** never runs `Wow.exe` as a native process (that yields **EACCES**). Use **`launch.linux_wrapper`** (default **`["wine"]`**) so the launcher runs e.g. **`wine /path/Wow.exe` …`args`**, or set **`launch.linux_steam_uri`** to a Steam URI (e.g. **`steam://rungameid/…`** for a **non-Steam game** shortcut — the number is shown in Steam’s shortcut properties). Optional **`linux_steam_binary`** defaults to **`steam`**; for Flatpak Steam use **`linux_steam_spawn`**: **`["flatpak", "run", "com.valvesoftware.Steam"]`** (the URI is appended as the last argument). After a **successful** **Download updates** run, the launcher deletes prior **`*.bak-YYYYMMDD-HHmmss`** backup files it created under the WoW folder.
@@ -0,0 +1,45 @@
+{
+  "game_dir": "",
+  "update_feed_url": "",
+  "launcher_updates_from_github": false,
+  "gitea": {
+    "base_url": "",
+    "owner": "",
+    "repo": "",
+    "release_tag": "latest",
+    "token_env": "GITEA_TOKEN"
+  },
+  "github": {
+    "owner": "Dawnforger",
+    "repo": "Fractured",
+    "ref": "main",
+    "release_tag": "latest",
+    "token_env": "GITHUB_TOKEN"
+  },
+  "patch_manifest": {
+    "enabled": true,
+    "source": "patch-manifest.json",
+    "from_release": true
+  },
+  "files": [],
+  "realmlist": {
+    "enabled": true,
+    "line": "set realmlist fracturedwow.ddns.net:47497",
+    "paths": ["Data/enUS/realmlist.wtf"]
+  },
+  "auth": {
+    "enabled": false,
+    "url": "https://auth.your-realm.example/api/launcher/login",
+    "method": "POST",
+    "username_field": "username",
+    "password_field": "password"
+  },
+  "launch": {
+    "exe": "Wow.exe",
+    "args": [],
+    "linux_wrapper": ["wine"],
+    "linux_steam_uri": "",
+    "linux_steam_binary": "",
+    "linux_steam_spawn": []
+  }
+}
@@ -0,0 +1,46 @@
+<!DOCTYPE html>
+<html lang="en">
+<head>
+  <meta charset="UTF-8" />
+  <meta http-equiv="Content-Security-Policy" content="default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'" />
+  <title>Fractured Launcher</title>
+  <link rel="stylesheet" href="styles.css" />
+</head>
+<body>
+  <header>
+    <h1>Fractured Launcher</h1>
+    <p class="sub">Point at your 3.3.5a client, download patches, then play.</p>
+  </header>
+
+  <section class="card">
+    <label class="lbl">World of Warcraft folder (contains <span id="wowExeName">Wow.exe</span>)</label>
+    <div class="row">
+      <input type="text" id="gameDir" placeholder="Browse… or paste the folder that contains Wow.exe" />
+      <button type="button" id="btnBrowse">Browse…</button>
+      <button type="button" id="btnSaveFolder" class="primary">Save folder</button>
+    </div>
+  </section>
+
+  <section class="card hidden" id="authCard">
+    <label class="lbl">Account</label>
+    <div class="row stack">
+      <input type="text" id="username" autocomplete="username" placeholder="Username" />
+      <input type="password" id="password" autocomplete="current-password" placeholder="Password" />
+      <button type="button" id="btnAuth" class="primary">Sign in</button>
+    </div>
+  </section>
+
+  <section class="card row-actions">
+    <button type="button" id="btnCheckLauncher" class="ghost">Check launcher updates</button>
+  </section>
+
+  <section class="card">
+    <button type="button" id="btnSync" class="primary wide" disabled>Download updates</button>
+    <button type="button" id="btnPlay" class="success wide hidden" disabled>Play</button>
+  </section>
+
+  <pre id="log" class="log" aria-live="polite"></pre>
+
+  <script src="renderer.js"></script>
+</body>
+</html>
@@ -0,0 +1,148 @@
+'use strict';
+
+const { dialog } = require('electron');
+const { autoUpdater } = require('electron-updater');
+const { useGiteaReleases, getGiteaUpdaterFeedBase } = require('./gitea-release');
+
+/**
+ * @param {import('electron').App} app
+ * @param {() => import('electron').BrowserWindow | null} getMainWindow
+ * @param {{
+ *   updateFeedUrl?: string,
+ *   githubOwner?: string,
+ *   githubRepo?: string,
+ *   githubToken?: string,
+ *   giteaToken?: string,
+ *   allowGithubLauncherUpdates?: boolean,
+ *   config?: object,
+ * }} opts
+ */
+async function setupAutoUpdater(app, getMainWindow, opts = {}) {
+  if (!app.isPackaged) {
+    return {
+      checkNow: async () => ({ skipped: true, reason: 'development build' }),
+    };
+  }
+
+  const ghToken = String(opts.githubToken || '').trim();
+  const giteaTok = String(opts.giteaToken || '').trim();
+  const envGeneric = String(process.env.LAUNCHER_UPDATE_URL || '').trim();
+  const configGeneric = String(opts.updateFeedUrl || '').trim();
+  let genericUrl = envGeneric || configGeneric;
+  let genericAuthHeader = '';
+
+  if (!genericUrl && opts.config && useGiteaReleases(opts.config)) {
+    const gfb = await getGiteaUpdaterFeedBase(opts.config);
+    if (gfb && gfb.url) {
+      genericUrl = gfb.url;
+      const t = String(gfb.token || giteaTok || '').trim();
+      if (t) genericAuthHeader = `token ${t}`;
+    }
+  } else if (genericUrl) {
+    if (giteaTok) genericAuthHeader = `token ${giteaTok}`;
+    else if (ghToken) genericAuthHeader = `Bearer ${ghToken}`;
+  }
+
+  const owner = String(opts.githubOwner || '').trim();
+  const repo = String(opts.githubRepo || '').trim();
+
+  let feedConfigured = false;
+
+  if (genericUrl) {
+    const base = genericUrl.replace(/\/?$/, '/');
+    autoUpdater.setFeedURL({
+      provider: 'generic',
+      url: base,
+    });
+    if (genericAuthHeader) {
+      autoUpdater.requestHeaders = {
+        ...autoUpdater.requestHeaders,
+        Authorization: genericAuthHeader,
+      };
+    }
+    feedConfigured = true;
+  } else if (opts.allowGithubLauncherUpdates && ghToken && owner && repo) {
+    autoUpdater.setFeedURL({
+      provider: 'github',
+      owner,
+      repo,
+      private: true,
+      token: ghToken,
+    });
+    feedConfigured = true;
+  }
+
+  if (!feedConfigured) {
+    const reason =
+      'No update channel configured. Set launcher.json → update_feed_url (HTTPS folder with latest.yml), ' +
+      'or fill gitea.base_url/owner/repo (+ GITEA_TOKEN for private), ' +
+      'or set launcher_updates_from_github to true with GITHUB_TOKEN for private GitHub release feeds.';
+    return {
+      checkNow: async () => ({ skipped: true, reason }),
+    };
+  }
+
+  autoUpdater.autoDownload = true;
+  autoUpdater.autoInstallOnAppQuit = true;
+
+  const send = (msg) => {
+    const w = getMainWindow();
+    if (w && !w.isDestroyed()) {
+      w.webContents.send('launcher:progress', msg);
+    }
+  };
+
+  autoUpdater.on('checking-for-update', () => send('Checking for launcher updates…'));
+  autoUpdater.on('update-available', (info) => {
+    send(`Launcher update available: ${info.version}`);
+  });
+  autoUpdater.on('update-not-available', () => {});
+  autoUpdater.on('error', (err) => {
+    const m = (err && (err.message || String(err))) || '';
+    if (/404|releases\.atom|HttpError:\s*404/i.test(m)) {
+      send(
+        'Launcher update: 404 (no latest.yml or wrong URL). For Gitea use gitea.* + token, or set update_feed_url. ' +
+          'For private GitHub set GITHUB_TOKEN.'
+      );
+      return;
+    }
+    if (m && !/net::ERR|ENOTFOUND|ETIMEDOUT/i.test(m)) {
+      send(`Launcher update: ${m.slice(0, 400)}`);
+    }
+  });
+  autoUpdater.on('download-progress', (p) => {
+    const pct = Math.round(p.percent || 0);
+    send(`Launcher update download: ${pct}%`);
+  });
+  autoUpdater.on('update-downloaded', async (info) => {
+    const win = getMainWindow();
+    const r = await dialog.showMessageBox(win || undefined, {
+      type: 'info',
+      title: 'Launcher update',
+      message: `Version ${info.version} is ready to install.`,
+      detail: 'Restart the launcher now to finish. You can finish patching WoW after restart.',
+      buttons: ['Restart now', 'Later'],
+      defaultId: 0,
+      cancelId: 1,
+      noLink: true,
+    });
+    if (r.response === 0) {
+      autoUpdater.quitAndInstall(false, true);
+    }
+  });
+
+  const checkNow = async () => {
+    const r = await autoUpdater.checkForUpdates();
+    return { ok: true, updateInfo: r && r.updateInfo };
+  };
+
+  const tick = () => {
+    checkNow().catch(() => {});
+  };
+  setTimeout(tick, 5000);
+  setInterval(tick, 6 * 60 * 60 * 1000);
+
+  return { checkNow };
+}
+
+module.exports = { setupAutoUpdater };
@@ -0,0 +1,14 @@
+'use strict';
+
+/**
+ * Production Gitea mirror (non-secret). Edit here and ship — no inject script,
+ * no fractured-release-channel.json, no CI env needed for these fields.
+ * Token stays in env: GITEA_TOKEN or launcher.json → gitea.token_env.
+ */
+module.exports = {
+  // http:// kept as-is; bare host gets https in gitea-release.js
+  base_url: 'http://brassnet.ddns.net:33983',
+  owner: 'Dawnsorrow',
+  repo: 'Fractured-Distro',
+  release_tag: 'latest',
+};
@@ -0,0 +1,116 @@
+'use strict';
+
+const path = require('path');
+const fs = require('fs').promises;
+const { normalizeWinGameDir } = require('./win-game-dir');
+
+/** Sources no longer shipped; drop from merged files so old launcher.json does not keep fetching them. */
+const DEPRECATED_FILE_SOURCES = new Set(['patch-Z.MPQ', 'Wow-patched.exe']);
+
+function mergeFilesList(defaults, user) {
+  const dep = (e) => DEPRECATED_FILE_SOURCES.has(String(e && e.source ? e.source : '').trim());
+  if (Array.isArray(user.files) && user.files.length) {
+    const filtered = user.files.map((e) => ({ ...e })).filter((e) => !dep(e));
+    if (filtered.length) return filtered;
+  }
+  const defList = Array.isArray(defaults.files) ? defaults.files : [];
+  return defList.map((e) => ({ ...e })).filter((e) => !dep(e));
+}
+
+function userFilesContainDeprecated(user) {
+  const files = user && user.files;
+  if (!Array.isArray(files)) return false;
+  return files.some((e) => DEPRECATED_FILE_SOURCES.has(String(e && e.source ? e.source : '').trim()));
+}
+
+function mergeConfig(defaults, user) {
+  return {
+    ...defaults,
+    ...user,
+    update_feed_url:
+      user.update_feed_url != null && user.update_feed_url !== ''
+        ? user.update_feed_url
+        : defaults.update_feed_url,
+    launcher_updates_from_github:
+      user.launcher_updates_from_github != null
+        ? user.launcher_updates_from_github
+        : defaults.launcher_updates_from_github,
+    github: { ...defaults.github, ...(user.github || {}) },
+    gitea: { ...defaults.gitea, ...(user.gitea || {}) },
+    patch_manifest: { ...defaults.patch_manifest, ...(user.patch_manifest || {}) },
+    launch: { ...defaults.launch, ...(user.launch || {}) },
+    auth: user.auth != null ? { ...defaults.auth, ...user.auth } : defaults.auth,
+    realmlist: user.realmlist != null ? { ...defaults.realmlist, ...user.realmlist } : defaults.realmlist,
+    files: mergeFilesList(defaults, user),
+  };
+}
+
+/** Hardcoded Gitea host/repo (see lib/baked-gitea-channel.js). Non-empty baked values win. */
+function applyBakedGitea(cfg) {
+  let baked;
+  try {
+    baked = require('./baked-gitea-channel');
+  } catch {
+    return cfg;
+  }
+  if (!baked || typeof baked !== 'object') return cfg;
+  cfg.gitea = { ...(cfg.gitea || {}) };
+  for (const k of ['base_url', 'owner', 'repo', 'release_tag']) {
+    const v = baked[k];
+    if (v != null && String(v).trim() !== '') cfg.gitea[k] = String(v).trim();
+  }
+  return cfg;
+}
+
+function getConfigPath(app) {
+  if (process.env.FRACTURED_LAUNCHER_CONFIG) return process.env.FRACTURED_LAUNCHER_CONFIG;
+  if (app && app.isPackaged) {
+    // AppImage (and macOS .app) run from a read-only mount — cannot write beside execPath.
+    if (process.platform === 'linux' || process.platform === 'darwin') {
+      return path.join(app.getPath('userData'), 'launcher.json');
+    }
+    return path.join(path.dirname(process.execPath), 'launcher.json');
+  }
+  return path.join(__dirname, '..', 'launcher.json');
+}
+
+async function loadConfig(app) {
+  const p = getConfigPath(app);
+  const defPath = path.join(__dirname, '..', 'default-launcher.json');
+  const defaults = JSON.parse(await fs.readFile(defPath, 'utf8'));
+  try {
+    const user = JSON.parse(await fs.readFile(p, 'utf8'));
+    const config = applyBakedGitea(mergeConfig(defaults, user));
+    if (userFilesContainDeprecated(user)) {
+      await fs.writeFile(p, JSON.stringify(config, null, 2), 'utf8');
+    }
+    return { configPath: p, config };
+  } catch (e) {
+    if (e.code === 'ENOENT') {
+      const initial = applyBakedGitea(mergeConfig(defaults, {}));
+      await fs.writeFile(p, JSON.stringify(initial, null, 2), 'utf8');
+      return { configPath: p, config: JSON.parse(JSON.stringify(initial)) };
+    }
+    throw e;
+  }
+}
+
+async function saveGameDir(configPath, gameDir) {
+  const defPath = path.join(__dirname, '..', 'default-launcher.json');
+  const defaults = JSON.parse(await fs.readFile(defPath, 'utf8'));
+  const user = JSON.parse(await fs.readFile(configPath, 'utf8'));
+  user.game_dir = gameDir;
+  const merged = applyBakedGitea(mergeConfig(defaults, user));
+  await fs.writeFile(configPath, JSON.stringify(merged, null, 2), 'utf8');
+  return merged;
+}
+
+function resolveGameDir(cfg, configPath) {
+  const gd = cfg.game_dir;
+  if (!gd) return '';
+  const abs = path.isAbsolute(gd) ? path.normalize(gd) : path.normalize(path.join(path.dirname(configPath), gd));
+  if (process.platform === 'win32') return normalizeWinGameDir(abs);
+  return abs;
+}
+
+module.exports = { getConfigPath, loadConfig, saveGameDir, resolveGameDir, mergeConfig, applyBakedGitea };
@@ -0,0 +1,120 @@
+'use strict';
+
+const { downloadBodyToFile, fetchOrThrow } = require('./http-download');
+
+function normalizeGiteaBaseUrl(raw) {
+  let b = String(raw || '').trim().replace(/\/+$/, '');
+  if (!b) return '';
+  if (!/^https?:\/\//i.test(b)) b = `https://${b}`;
+  return b;
+}
+
+function giteaApiBase(cfg) {
+  const base = normalizeGiteaBaseUrl(cfg.gitea.base_url);
+  return `${base}/api/v1`;
+}
+
+function giteaToken(cfg) {
+  const name = cfg.gitea && cfg.gitea.token_env;
+  if (name && process.env[name]) return String(process.env[name]).trim();
+  return String(process.env.GITEA_TOKEN || '').trim();
+}
+
+function giteaHeaders(token, json = false) {
+  const h = { 'User-Agent': 'Fractured-Launcher-Electron' };
+  if (json) h.Accept = 'application/json';
+  if (token) h.Authorization = `token ${token}`;
+  return h;
+}
+
+function useGiteaReleases(cfg) {
+  const g = cfg.gitea;
+  if (!g) return false;
+  return !!(String(g.base_url || '').trim() && String(g.owner || '').trim() && String(g.repo || '').trim());
+}
+
+async function fetchGiteaReleaseRecord(cfg) {
+  const api = giteaApiBase(cfg);
+  const { owner, repo } = cfg.gitea;
+  const tag = (cfg.gitea.release_tag || 'latest').trim() || 'latest';
+  const token = giteaToken(cfg);
+
+  let listUrl;
+  if (tag.toLowerCase() === 'latest') {
+    listUrl = `${api}/repos/${encodeURIComponent(owner)}/${encodeURIComponent(repo)}/releases/latest`;
+  } else {
+    listUrl = `${api}/repos/${encodeURIComponent(owner)}/${encodeURIComponent(repo)}/releases/tags/${encodeURIComponent(tag)}`;
+  }
+
+  const res = await fetchOrThrow(listUrl, { headers: giteaHeaders(token, true) });
+  const text = await res.text();
+  if (!res.ok) {
+    let hint = '';
+    if (res.status === 404) hint = ' (wrong tag / no release / check base_url owner repo)';
+    if (res.status === 401 || res.status === 403) hint = ' (set GITEA_TOKEN or gitea.token_env)';
+    throw new Error(`Gitea release ${res.status}${hint}: ${text.slice(0, 600)}`);
+  }
+  return JSON.parse(text);
+}
+
+async function listGiteaReleaseAttachmentNames(cfg) {
+  const rel = await fetchGiteaReleaseRecord(cfg);
+  const list = rel.attachments || rel.assets || [];
+  return list.map((x) => x.name).filter(Boolean);
+}
+
+async function downloadGiteaReleaseAsset(cfg, assetName, destPath) {
+  const token = giteaToken(cfg);
+  const rel = await fetchGiteaReleaseRecord(cfg);
+  const list = rel.attachments || rel.assets || [];
+  let downloadUrl = '';
+  for (const a of list) {
+    if (a.name !== assetName) continue;
+    downloadUrl = a.browser_download_url || a.download_url || '';
+    break;
+  }
+  if (!downloadUrl) {
+    const names = list.map((x) => x.name).filter(Boolean);
+    throw new Error(`Gitea release asset "${assetName}" not found; attachments: ${names.join(', ') || '(none)'}`);
+  }
+
+  const h = { Accept: 'application/octet-stream' };
+  if (token) h.Authorization = `token ${token}`;
+  const dl = await fetchOrThrow(downloadUrl, { headers: h, redirect: 'follow' });
+  await downloadBodyToFile(dl, destPath);
+}
+
+/**
+ * Base URL for electron-updater generic provider (expects latest.yml under this path).
+ * Matches Gitea’s pattern: …/owner/repo/releases/download/{tag}/latest.yml
+ */
+async function getGiteaUpdaterFeedBase(cfg) {
+  if (!useGiteaReleases(cfg)) return null;
+  const api = giteaApiBase(cfg);
+  const { owner, repo } = cfg.gitea;
+  const tag = (cfg.gitea.release_tag || 'latest').trim() || 'latest';
+  const token = giteaToken(cfg);
+  let listUrl;
+  if (tag.toLowerCase() === 'latest') {
+    listUrl = `${api}/repos/${encodeURIComponent(owner)}/${encodeURIComponent(repo)}/releases/latest`;
+  } else {
+    listUrl = `${api}/repos/${encodeURIComponent(owner)}/${encodeURIComponent(repo)}/releases/tags/${encodeURIComponent(tag)}`;
+  }
+  const res = await fetchOrThrow(listUrl, { headers: giteaHeaders(token, true) });
+  if (!res.ok) return null;
+  const rel = await res.json();
+  const tagName = rel.tag_name;
+  if (!tagName || typeof tagName !== 'string') return null;
+  const root = normalizeGiteaBaseUrl(cfg.gitea.base_url);
+  const url = `${root}/${encodeURIComponent(owner)}/${encodeURIComponent(repo)}/releases/download/${encodeURIComponent(tagName)}/`;
+  return { url, token };
+}
+
+module.exports = {
+  downloadGiteaReleaseAsset,
+  fetchGiteaReleaseRecord,
+  listGiteaReleaseAttachmentNames,
+  giteaToken,
+  useGiteaReleases,
+  getGiteaUpdaterFeedBase,
+};
@@ -0,0 +1,9 @@
+'use strict';
+
+function githubToken(cfg) {
+  const name = cfg.github && cfg.github.token_env;
+  if (name && process.env[name]) return process.env[name];
+  return process.env.GITHUB_TOKEN || '';
+}
+
+module.exports = { githubToken };
@@ -0,0 +1,141 @@
+'use strict';
+
+const path = require('path');
+const fs = require('fs').promises;
+const { githubToken } = require('./github-token');
+const { downloadGiteaReleaseAsset, useGiteaReleases, listGiteaReleaseAttachmentNames } = require('./gitea-release');
+const { fetchToFile, downloadBodyToFile, fetchOrThrow } = require('./http-download');
+
+function encodeRepoPath(repoPath) {
+  let p = String(repoPath || '').replace(/\\/g, '/').replace(/^\/+|\/+$/g, '');
+  if (!p) return '';
+  return p.split('/').map((seg) => encodeURIComponent(seg)).join('/');
+}
+
+function ghHeaders(token, json = false) {
+  const h = {
+    'User-Agent': 'Fractured-Launcher-Electron',
+    'X-GitHub-Api-Version': '2022-11-28',
+  };
+  if (json) h.Accept = 'application/vnd.github+json';
+  if (token) h.Authorization = `Bearer ${token}`;
+  return h;
+}
+
+async function downloadGitHubRepoFile(cfg, repoPath, destPath) {
+  const token = githubToken(cfg);
+  const enc = encodeRepoPath(repoPath);
+  const ref = cfg.github.ref || 'main';
+  const { owner, repo } = cfg.github;
+
+  if (!token) {
+    const url = `https://raw.githubusercontent.com/${owner}/${repo}/${ref}/${enc}`;
+    await fetchToFile(url, {}, destPath);
+    return;
+  }
+
+  const apiUrl = `https://api.github.com/repos/${owner}/${repo}/contents/${enc}?ref=${encodeURIComponent(ref)}`;
+  const res = await fetchOrThrow(apiUrl, { headers: ghHeaders(token, true) });
+  const body = await res.text();
+  if (!res.ok) {
+    throw new Error(`GitHub contents API ${res.status}: ${body.slice(0, 800)}`);
+  }
+  const meta = JSON.parse(body);
+  if (meta.type && meta.type !== 'file') {
+    throw new Error(`not a file: ${repoPath}`);
+  }
+  if (meta.download_url) {
+    const h = { Accept: 'application/octet-stream' };
+    if (token) {
+      h.Authorization = `Bearer ${token}`;
+      h['X-GitHub-Api-Version'] = '2022-11-28';
+    }
+    await fetchToFile(meta.download_url, h, destPath);
+    return;
+  }
+  if (meta.content && meta.encoding === 'base64') {
+    const buf = Buffer.from(String(meta.content).replace(/\n/g, ''), 'base64');
+    if (!buf.length) throw new Error('empty base64 content');
+    await fs.mkdir(path.dirname(destPath), { recursive: true });
+    const tmp = destPath + '.downloading';
+    await fs.writeFile(tmp, buf);
+    await fs.rename(tmp, destPath);
+    return;
+  }
+  throw new Error(`unexpected GitHub response for ${repoPath}`);
+}
+
+async function fetchGitHubReleaseJson(cfg) {
+  const token = githubToken(cfg);
+  const tag = (cfg.github.release_tag || 'latest').trim() || 'latest';
+  const { owner, repo } = cfg.github;
+  let listUrl;
+  if (tag.toLowerCase() === 'latest') {
+    listUrl = `https://api.github.com/repos/${owner}/${repo}/releases/latest`;
+  } else {
+    listUrl = `https://api.github.com/repos/${owner}/${repo}/releases/tags/${encodeURIComponent(tag)}`;
+  }
+  const res = await fetchOrThrow(listUrl, { headers: ghHeaders(token, true) });
+  const text = await res.text();
+  if (!res.ok) {
+    let hint = '';
+    if (res.status === 404) {
+      hint =
+        ' (wrong tag, private repo without token, or releases live on Gitea — set gitea.base_url, gitea.owner, gitea.repo in launcher.json)';
+    }
+    if (res.status === 401 || res.status === 403) hint = ' (set GITHUB_TOKEN or token_env PAT)';
+    throw new Error(`releases list ${res.status}${hint}: ${text.slice(0, 600)}`);
+  }
+  return JSON.parse(text);
+}
+
+async function listReleaseAttachmentNames(cfg) {
+  if (useGiteaReleases(cfg)) {
+    return listGiteaReleaseAttachmentNames(cfg);
+  }
+  const rel = await fetchGitHubReleaseJson(cfg);
+  const assets = rel.assets || [];
+  return assets.map((a) => a.name).filter(Boolean);
+}
+
+async function downloadReleaseAsset(cfg, assetName, destPath) {
+  if (useGiteaReleases(cfg)) {
+    return downloadGiteaReleaseAsset(cfg, assetName, destPath);
+  }
+  const token = githubToken(cfg);
+  const rel = await fetchGitHubReleaseJson(cfg);
+  const assets = rel.assets || [];
+  let assetURL = '';
+  for (const a of assets) {
+    if (a.name !== assetName) continue;
+    if (token && a.url) {
+      assetURL = a.url;
+      break;
+    }
+    if (a.browser_download_url) {
+      assetURL = a.browser_download_url;
+      break;
+    }
+    assetURL = a.url;
+    break;
+  }
+  if (!assetURL) {
+    const names = assets.map((x) => x.name);
+    throw new Error(`release asset "${assetName}" not found; attachments: ${names.join(', ')}`);
+  }
+  const h = { Accept: 'application/octet-stream' };
+  if (token) {
+    h.Authorization = `Bearer ${token}`;
+    h['X-GitHub-Api-Version'] = '2022-11-28';
+  }
+  const dl = await fetchOrThrow(assetURL, { headers: h, redirect: 'follow' });
+  await downloadBodyToFile(dl, destPath);
+}
+
+module.exports = {
+  downloadGitHubRepoFile,
+  downloadReleaseAsset,
+  encodeRepoPath,
+  fetchGitHubReleaseJson,
+  listReleaseAttachmentNames,
+};
@@ -0,0 +1,76 @@
+'use strict';
+
+const fs = require('fs').promises;
+const path = require('path');
+const { createWriteStream } = require('fs');
+const { pipeline } = require('stream/promises');
+const { Readable } = require('stream');
+
+function safeUrlForLog(url) {
+  try {
+    const u = new URL(url);
+    return `${u.origin}${u.pathname}`;
+  } catch {
+    return String(url || '').split('?')[0].slice(0, 200);
+  }
+}
+
+function explainFetchFailure(err, url) {
+  const msg = err && err.message ? err.message : String(err);
+  const cause = err && err.cause;
+  const code = cause && cause.code ? cause.code : '';
+  const combined = `${msg} ${code}`;
+  const hints = [];
+  if (/CERT|TLS|SSL|UNABLE_TO_VERIFY|SELF_SIGNED|certificate|unknown ca|unable to verify/i.test(combined)) {
+    hints.push(
+      'TLS certificate not trusted — install a valid cert on Gitea, or trust your CA system-wide, or set NODE_EXTRA_CA_CERTS to a .pem bundle (self-signed mirrors)'
+    );
+  }
+  if (/ECONNREFUSED/.test(combined)) hints.push('connection refused (wrong host/port or server down)');
+  if (/ENOTFOUND|EAI_AGAIN/.test(combined)) hints.push('DNS lookup failed');
+  if (/ETIMEDOUT|TIMEOUT/i.test(combined)) hints.push('connection timed out');
+  const hintStr = hints.length ? ` ${hints.join(' ')}` : '';
+  return new Error(`${msg}${hintStr} — ${safeUrlForLog(url)}`);
+}
+
+/** Wrap global fetch with clearer errors for TLS/DNS/refused (Electron reports bare "fetch failed"). */
+async function fetchOrThrow(url, init) {
+  try {
+    return await fetch(url, init);
+  } catch (e) {
+    throw explainFetchFailure(e, url);
+  }
+}
+
+async function downloadBodyToFile(res, destPath) {
+  if (!res.ok) {
+    const errText = await res.text().catch(() => '');
+    throw new Error(`HTTP ${res.status}: ${errText.slice(0, 500)}`);
+  }
+  if (!res.body) {
+    throw new Error('download has no body');
+  }
+  await fs.mkdir(path.dirname(destPath), { recursive: true });
+  const tmp = destPath + '.downloading';
+  let body = res.body;
+  if (body && typeof body.pipe !== 'function') {
+    body = Readable.fromWeb(body);
+  }
+  await pipeline(body, createWriteStream(tmp));
+  const st = await fs.stat(tmp);
+  if (st.size === 0) {
+    await fs.unlink(tmp).catch(() => {});
+    throw new Error('empty download');
+  }
+  await fs.rename(tmp, destPath);
+}
+
+async function fetchToFile(url, headers, destPath) {
+  const res = await fetchOrThrow(url, {
+    headers,
+    redirect: 'follow',
+  });
+  await downloadBodyToFile(res, destPath);
+}
+
+module.exports = { fetchToFile, downloadBodyToFile, fetchOrThrow, safeUrlForLog };
@@ -0,0 +1,150 @@
+'use strict';
+
+const fs = require('fs').promises;
+const path = require('path');
+const os = require('os');
+const { createHash } = require('node:crypto');
+const { downloadReleaseAsset, downloadGitHubRepoFile } = require('./github');
+
+async function sha256File(absPath) {
+  const buf = await fs.readFile(absPath);
+  return createHash('sha256').update(buf).digest('hex');
+}
+
+function stateDir(gameDir) {
+  return path.join(gameDir, '.fractured');
+}
+
+function statePath(gameDir) {
+  return path.join(stateDir(gameDir), 'patch-state.json');
+}
+
+async function readPatchState(gameDir) {
+  if (!gameDir) return null;
+  try {
+    const t = await fs.readFile(statePath(gameDir), 'utf8');
+    return JSON.parse(t);
+  } catch {
+    return null;
+  }
+}
+
+async function writePatchState(gameDir, manifestVersion, fileShas) {
+  const p = statePath(gameDir);
+  await fs.mkdir(path.dirname(p), { recursive: true });
+  const body = {
+    client_build: manifestVersion,
+    updated_at: new Date().toISOString(),
+    files: fileShas,
+  };
+  const tmp = p + '.tmp';
+  await fs.writeFile(tmp, JSON.stringify(body, null, 2), 'utf8');
+  await fs.rename(tmp, p);
+}
+
+function validateManifest(m) {
+  if (!m || m.version == null || String(m.version).trim() === '') return false;
+  if (!m.files || typeof m.files !== 'object') return false;
+  return true;
+}
+
+/**
+ * Download and parse patch-manifest.json (or custom name). Returns null on any failure.
+ */
+async function loadManifest(cfg) {
+  const pm = cfg.patch_manifest;
+  if (!pm || !pm.enabled || !String(pm.source || '').trim()) return null;
+  const tmp = path.join(os.tmpdir(), `fr-patch-manifest-${Date.now()}-${Math.random().toString(36).slice(2)}.json`);
+  try {
+    if (pm.from_release) {
+      await downloadReleaseAsset(cfg, String(pm.source).trim(), tmp);
+    } else {
+      await downloadGitHubRepoFile(cfg, String(pm.source).trim(), tmp);
+    }
+    const raw = await fs.readFile(tmp, 'utf8');
+    await fs.unlink(tmp).catch(() => {});
+    return JSON.parse(raw);
+  } catch {
+    await fs.unlink(tmp).catch(() => {});
+    return null;
+  }
+}
+
+/**
+ * True if every from_release file on disk matches manifest sha256.
+ */
+async function patchesMatchManifest(cfg, manifest, onStatus) {
+  if (!validateManifest(manifest)) return false;
+  const { buildResolvedReleaseFiles } = require('./release-sync');
+  const entries = await buildResolvedReleaseFiles(cfg, manifest);
+  const gameDir = cfg.game_dir;
+  for (const entry of entries) {
+    if (!entry.from_release) continue;
+    const spec = manifest.files[entry.source];
+    if (!spec || !spec.sha256) return false;
+    const parts = String(entry.dest).replace(/\\/g, '/').split('/').filter(Boolean);
+    const destAbs = path.join(gameDir, ...parts);
+    let disk;
+    try {
+      disk = await sha256File(destAbs);
+    } catch {
+      return false;
+    }
+    if (disk.toLowerCase() !== String(spec.sha256).trim().toLowerCase()) return false;
+  }
+  if (onStatus) {
+    onStatus(`Client files already match build ${manifest.version} (nothing to download).`);
+  }
+  return true;
+}
+
+async function verifyInstalledAgainstManifest(cfg, manifest) {
+  if (!validateManifest(manifest)) return;
+  const { buildResolvedReleaseFiles } = require('./release-sync');
+  const entries = await buildResolvedReleaseFiles(cfg, manifest);
+  for (const entry of entries) {
+    if (!entry.from_release) continue;
+    const spec = manifest.files[entry.source];
+    if (!spec || !spec.sha256) {
+      throw new Error(
+        `patch-manifest.json is missing a sha256 for "${entry.source}" — regenerate the manifest for this release.`
+      );
+    }
+    const parts = String(entry.dest).replace(/\\/g, '/').split('/').filter(Boolean);
+    const destAbs = path.join(cfg.game_dir, ...parts);
+    const disk = await sha256File(destAbs);
+    if (disk.toLowerCase() !== String(spec.sha256).trim().toLowerCase()) {
+      throw new Error(
+        `${entry.source}: checksum mismatch after install (expected ${spec.sha256.slice(0, 12)}…, got ${disk.slice(0, 12)}…). Try syncing again.`
+      );
+    }
+  }
+}
+
+async function recordPatchState(cfg, manifest) {
+  if (!validateManifest(manifest)) return;
+  const { buildResolvedReleaseFiles } = require('./release-sync');
+  const entries = await buildResolvedReleaseFiles(cfg, manifest);
+  const shas = {};
+  for (const entry of entries) {
+    if (!entry.from_release) continue;
+    const parts = String(entry.dest).replace(/\\/g, '/').split('/').filter(Boolean);
+    const destAbs = path.join(cfg.game_dir, ...parts);
+    try {
+      shas[entry.source] = await sha256File(destAbs);
+    } catch {
+      /* skip */
+    }
+  }
+  await writePatchState(cfg.game_dir, String(manifest.version), shas);
+}
+
+module.exports = {
+  loadManifest,
+  validateManifest,
+  patchesMatchManifest,
+  verifyInstalledAgainstManifest,
+  recordPatchState,
+  readPatchState,
+  statePath,
+};
@@ -0,0 +1,249 @@
+'use strict';
+
+const path = require('path');
+const fs = require('fs').promises;
+const fsSync = require('fs');
+const { downloadGitHubRepoFile, downloadReleaseAsset } = require('./github');
+const { normalizeWinGameDir } = require('./win-game-dir');
+const { loadManifest } = require('./patch-manifest');
+const { buildResolvedReleaseFiles } = require('./release-sync');
+
+function pad2(n) {
+  return String(n).padStart(2, '0');
+}
+function backupSuffix() {
+  const d = new Date();
+  return `${d.getFullYear()}${pad2(d.getMonth() + 1)}${pad2(d.getDate())}-${pad2(d.getHours())}${pad2(d.getMinutes())}${pad2(d.getSeconds())}`;
+}
+
+function sleep(ms) {
+  return new Promise((r) => setTimeout(r, ms));
+}
+
+/** Windows often returns EBUSY/EPERM when WoW or AV still has an MPQ open. */
+function isRetryableFsLockError(e) {
+  const c = e && e.code;
+  if (!c) return false;
+  if (c === 'EBUSY' || c === 'EPERM' || c === 'EACCES') return true;
+  if (process.platform === 'win32' && (c === 'UNKNOWN' || c === 'EUNKNOWN')) return true;
+  return false;
+}
+
+async function retryFsLock(op, opts) {
+  const attempts = (opts && opts.attempts) || (process.platform === 'win32' ? 30 : 10);
+  const delayMs = (opts && opts.delayMs) || 500;
+  let last;
+  for (let i = 0; i < attempts; i++) {
+    try {
+      return await op();
+    } catch (e) {
+      last = e;
+      if (!isRetryableFsLockError(e)) throw e;
+      if (i === attempts - 1) break;
+      await sleep(delayMs);
+    }
+  }
+  const hint =
+    process.platform === 'win32'
+      ? ' Close World of Warcraft and any launcher using this folder, then try again.'
+      : ' Close programs using this file, then try again.';
+  const err = new Error(String((last && last.message) || last) + hint);
+  err.code = last && last.code;
+  throw err;
+}
+
+function wowExePath(cfg) {
+  const gd = normalizeWinGameDir(cfg.game_dir || '');
+  const exe = (cfg.launch && cfg.launch.exe) || 'Wow.exe';
+  const parts = exe.replace(/\\/g, '/').split('/').filter(Boolean);
+  const primary = path.join(gd, ...parts);
+  if (process.platform === 'win32' && gd && fsSync.existsSync(primary)) return primary;
+  if (process.platform === 'win32' && gd) {
+    try {
+      const base = path.basename(primary);
+      const dir = path.dirname(primary);
+      const names = fsSync.readdirSync(dir);
+      const hit = names.find((n) => n.toLowerCase() === base.toLowerCase());
+      if (hit) {
+        const alt = path.join(dir, hit);
+        if (fsSync.statSync(alt).isFile()) return alt;
+      }
+    } catch (_) {
+      /* ignore */
+    }
+  }
+  return primary;
+}
+
+function wowInstallValid(cfg) {
+  if (!cfg.game_dir) return false;
+  const p = wowExePath(cfg);
+  return fsSync.existsSync(p) && fsSync.statSync(p).isFile();
+}
+
+/** WoW expects patch MPQ names with a literal .MPQ extension (case-sensitive clients). */
+function normalizeMpqDestinationPath(absPath) {
+  const s = String(absPath || '');
+  return /\.mpq$/i.test(s) ? s.replace(/\.mpq$/i, '.MPQ') : s;
+}
+
+/** Matches backup names from installFile: `<orig>.bak-YYYYMMDD-HHmmss`. */
+const LAUNCHER_BACKUP_BASENAME_RE = /\.bak-\d{8}-\d{6}$/;
+
+async function removeLauncherBackupFiles(gameDir) {
+  const root = normalizeWinGameDir(gameDir || '');
+  if (!root) return;
+  const stack = [root];
+  while (stack.length) {
+    const dir = stack.pop();
+    let entries;
+    try {
+      entries = await fs.readdir(dir, { withFileTypes: true });
+    } catch (_) {
+      continue;
+    }
+    for (const d of entries) {
+      const abs = path.join(dir, d.name);
+      if (d.isDirectory()) {
+        stack.push(abs);
+      } else if (d.isFile() && LAUNCHER_BACKUP_BASENAME_RE.test(d.name)) {
+        try {
+          await fs.unlink(abs);
+        } catch (e) {
+          if (e.code !== 'ENOENT') {
+            /* best effort: sync already succeeded */
+          }
+        }
+      }
+    }
+  }
+}
+
+function isEnUsRealmlistPath(rel) {
+  const n = String(rel || '')
+    .trim()
+    .replace(/\\/g, '/')
+    .toLowerCase();
+  return n.endsWith('/enus/realmlist.wtf') || n === 'enus/realmlist.wtf';
+}
+
+async function installFile(cfg, entry) {
+  const parts = String(entry.dest).replace(/\\/g, '/').split('/').filter(Boolean);
+  const root = normalizeWinGameDir(cfg.game_dir || '');
+  const destAbs = normalizeMpqDestinationPath(path.join(root, ...parts));
+  const tmp = destAbs + '.new';
+
+  if (entry.from_release) {
+    await downloadReleaseAsset(cfg, entry.source, tmp);
+  } else {
+    await downloadGitHubRepoFile(cfg, entry.source, tmp);
+  }
+
+  async function removeOrBackupExisting() {
+    if (entry.backup) {
+      try {
+        const st = await fs.stat(destAbs);
+        if (st.isFile()) {
+          const bak = `${destAbs}.bak-${backupSuffix()}`;
+          await fs.rename(destAbs, bak);
+        }
+      } catch (e) {
+        if (e.code !== 'ENOENT') throw e;
+      }
+    } else {
+      try {
+        await fs.unlink(destAbs);
+      } catch (e) {
+        if (e.code !== 'ENOENT') throw e;
+      }
+    }
+  }
+
+  await retryFsLock(() => removeOrBackupExisting());
+  await retryFsLock(() => fs.rename(tmp, destAbs));
+
+  if (process.platform === 'linux' && /\.exe$/i.test(destAbs)) {
+    try {
+      await fs.chmod(destAbs, 0o755);
+    } catch (_) {
+      /* non-fatal */
+    }
+  }
+}
+
+async function applyRealmlist(cfg) {
+  if (!cfg.realmlist || !cfg.realmlist.enabled) return;
+  let line = String(cfg.realmlist.line || '').trim();
+  if (!line) throw new Error('realmlist.line empty');
+  if (!line.toLowerCase().startsWith('set realmlist ')) {
+    line = `set realmlist ${line}`;
+  }
+  const content = line + '\n';
+  let paths = cfg.realmlist.paths;
+  if (!paths || !paths.length) paths = ['Data/enUS/realmlist.wtf'];
+  paths = paths.filter(isEnUsRealmlistPath);
+  if (!paths.length) paths = ['Data/enUS/realmlist.wtf'];
+  for (const rel of paths) {
+    const r = String(rel).trim().replace(/\\/g, '/');
+    if (!r) continue;
+    const segs = r.split('/').filter(Boolean);
+    const abs = path.join(normalizeWinGameDir(cfg.game_dir || ''), ...segs);
+    await fs.mkdir(path.dirname(abs), { recursive: true });
+    await fs.writeFile(abs, content, 'utf8');
+  }
+}
+
+async function applyPatches(cfg, onStatus) {
+  let manifest = null;
+  if (cfg.patch_manifest && cfg.patch_manifest.enabled) {
+    manifest = await loadManifest(cfg);
+  }
+  const entries = await buildResolvedReleaseFiles(cfg, manifest);
+  for (const f of entries) {
+    if (onStatus) onStatus(`Updating ${f.dest} …`);
+    try {
+      await installFile(cfg, f);
+    } catch (e) {
+      throw new Error(`sync ${f.dest}: ${e.message || e}`);
+    }
+  }
+  if (cfg.realmlist && cfg.realmlist.enabled) {
+    if (onStatus) onStatus('Applying realmlist …');
+    await applyRealmlist(cfg);
+  }
+  if (onStatus) onStatus('Removing old backup copies …');
+  try {
+    await removeLauncherBackupFiles(cfg.game_dir);
+  } catch (_) {
+    /* Patches and realmlist already applied; leave .bak files if cleanup cannot run. */
+  }
+  if (onStatus) onStatus('All patches applied.');
+}
+
+async function doAuth(cfg, username, password) {
+  if (!cfg.auth || !cfg.auth.enabled) return;
+  const u = String(username || '').trim();
+  const p = String(password || '');
+  if (!u || !p) throw new Error('username and password required');
+  const body = {
+    [cfg.auth.username_field || 'username']: u,
+    [cfg.auth.password_field || 'password']: p,
+  };
+  const res = await fetch(cfg.auth.url, {
+    method: cfg.auth.method || 'POST',
+    headers: { 'Content-Type': 'application/json', Accept: 'application/json' },
+    body: JSON.stringify(body),
+  });
+  const t = await res.text();
+  if (res.status < 200 || res.status >= 300) {
+    throw new Error(`login failed ${res.status}: ${t.slice(0, 400)}`);
+  }
+}
+
+module.exports = {
+  applyPatches,
+  applyRealmlist,
+  wowExePath,
+  wowInstallValid,
+  doAuth,
+};
@@ -0,0 +1,128 @@
+'use strict';
+
+const path = require('path');
+const { listReleaseAttachmentNames } = require('./github');
+
+/** Legacy launcher.json rows — ignored when merging explicit files. */
+const DEPRECATED_SOURCES = new Set(['patch-Z.MPQ', 'Wow-patched.exe']);
+
+function filterExplicitFiles(files) {
+  if (!Array.isArray(files)) return [];
+  return files
+    .filter((e) => e && String(e.source || '').trim())
+    .filter((e) => !DEPRECATED_SOURCES.has(String(e.source).trim()))
+    .map((e) => ({
+      source: String(e.source).trim(),
+      dest: String(e.dest || '').trim(),
+      backup: e.backup !== false,
+      from_release: e.from_release !== false,
+    }))
+    .filter((e) => e.dest);
+}
+
+function manifestLooksUsable(m) {
+  return !!(m && m.files && typeof m.files === 'object' && Object.keys(m.files).length > 0);
+}
+
+/** Launcher / updater attachments — never copied into the WoW folder. */
+function isExcludedFromGameSync(fileName) {
+  const n = String(fileName || '');
+  const lower = n.toLowerCase();
+  if (lower === 'patch-manifest.json') return true;
+  if (/^fractured-launcher/i.test(n)) return true;
+  if (/\.blockmap$/i.test(n)) return true;
+  if (/^latest.*\.ya?ml$/i.test(n) || lower === 'latest.yml') return true;
+  if (lower.includes('builder-debug')) return true;
+  if (/\.appimage$/i.test(n)) return true;
+  return false;
+}
+
+function mpqDestFromSource(source) {
+  const base = path.basename(String(source || ''));
+  const stem = base.replace(/\.mpq$/i, '');
+  return `Data/enUS/${stem}.MPQ`;
+}
+
+function destForReleaseSource(source, cfg) {
+  const base = path.basename(String(source || ''));
+  if (/\.mpq$/i.test(base)) return mpqDestFromSource(source);
+  if (/\.exe$/i.test(base)) return (cfg.launch && cfg.launch.exe) || 'Wow.exe';
+  return base;
+}
+
+/**
+ * Explicit `files` in config wins. Otherwise use patch-manifest keys if present,
+ * else discover attachments on the release (excluding launcher artifacts).
+ */
+async function buildResolvedReleaseFiles(cfg, manifestMaybeNull) {
+  const explicit = filterExplicitFiles(cfg.files);
+  if (explicit.length) return explicit;
+
+  const manifest = manifestMaybeNull;
+  if (manifestLooksUsable(manifest)) {
+    const keys = Object.keys(manifest.files).filter((k) => k && !isExcludedFromGameSync(k));
+    if (!keys.length) {
+      throw new Error('patch-manifest.json has no file entries — add files or attach assets to the release.');
+    }
+    return keys.map((source) => ({
+      source,
+      dest: destForReleaseSource(source, cfg),
+      backup: true,
+      from_release: true,
+    }));
+  }
+
+  const names = await listReleaseAttachmentNames(cfg);
+  const game = names.filter((n) => n && !isExcludedFromGameSync(n));
+  if (!game.length) {
+    throw new Error(
+      'No patch files on this release (after excluding launcher installers). ' +
+        'Attach MPQ/exe assets or ship patch-manifest.json listing filenames.'
+    );
+  }
+
+  const exes = game.filter((n) => /\.exe$/i.test(n));
+  const mpqs = game.filter((n) => /\.mpq$/i.test(n));
+  const rest = game.filter((n) => !/\.(exe|mpq)$/i.test(n));
+
+  if (exes.length > 1) {
+    throw new Error(
+      `Release has multiple .exe files (${exes.join(', ')}). ` +
+        'Remove extras or publish patch-manifest.json with the exact filenames to install.'
+    );
+  }
+
+  const out = [];
+  for (const n of mpqs) {
+    out.push({
+      source: n,
+      dest: mpqDestFromSource(n),
+      backup: true,
+      from_release: true,
+    });
+  }
+  if (exes.length === 1) {
+    out.push({
+      source: exes[0],
+      dest: (cfg.launch && cfg.launch.exe) || 'Wow.exe',
+      backup: true,
+      from_release: true,
+    });
+  }
+  for (const n of rest) {
+    out.push({
+      source: n,
+      dest: path.basename(n),
+      backup: true,
+      from_release: true,
+    });
+  }
+  return out;
+}
+
+module.exports = {
+  buildResolvedReleaseFiles,
+  filterExplicitFiles,
+  isExcludedFromGameSync,
+  DEPRECATED_SOURCES,
+};
@@ -0,0 +1,21 @@
+'use strict';
+
+const path = require('path');
+
+/**
+ * Under Wine, the folder picker often returns a Unix absolute path (/home/...).
+ * Windows Node does not resolve that to the WoW install; map to Wine's Z: drive
+ * (Z: == / on typical Wine prefixes).
+ */
+function normalizeWinGameDir(gameDir) {
+  if (process.platform !== 'win32') return String(gameDir || '').trim();
+  let s = String(gameDir || '').trim();
+  if (!s) return s;
+  s = s.replace(/\//g, path.win32.sep);
+  if (s.startsWith('\\\\')) return path.normalize(s);
+  if (/^[A-Za-z]:/.test(s)) return path.normalize(s);
+  if (s.startsWith(path.win32.sep)) return path.win32.normalize(`Z:${s}`);
+  return path.normalize(s);
+}
+
+module.exports = { normalizeWinGameDir };
@@ -0,0 +1,193 @@
+'use strict';
+
+const { app, BrowserWindow, ipcMain, dialog, Menu } = require('electron');
+const path = require('path');
+const { spawn } = require('child_process');
+const { loadConfig, saveGameDir, resolveGameDir } = require('./lib/config-store');
+const { normalizeWinGameDir } = require('./lib/win-game-dir');
+const { applyPatches, wowExePath, wowInstallValid, doAuth } = require('./lib/patch');
+const { readPatchState } = require('./lib/patch-manifest');
+const { setupAutoUpdater } = require('./lib/auto-update');
+
+let mainWindow;
+let autoUpdateApi = {
+  checkNow: async () => ({ skipped: true, reason: 'not initialized' }),
+};
+
+function createWindow() {
+  mainWindow = new BrowserWindow({
+    width: 720,
+    height: 640,
+    show: false,
+    autoHideMenuBar: true,
+    webPreferences: {
+      preload: path.join(__dirname, 'preload.cjs'),
+      contextIsolation: true,
+      nodeIntegration: false,
+      sandbox: false,
+    },
+  });
+  Menu.setApplicationMenu(null);
+  mainWindow.loadFile(path.join(__dirname, 'index.html'));
+  mainWindow.once('ready-to-show', () => mainWindow.show());
+}
+
+function sendProgress(msg) {
+  if (mainWindow && !mainWindow.isDestroyed()) {
+    mainWindow.webContents.send('launcher:progress', msg);
+  }
+}
+
+async function readMergedConfig() {
+  const { configPath, config } = await loadConfig(app);
+  const gameDir = resolveGameDir(config, configPath);
+  const merged = { ...config, game_dir: gameDir };
+  return { configPath, config: merged };
+}
+
+app.whenReady().then(async () => {
+  createWindow();
+  const { config } = await loadConfig(app);
+  const ghEnv = config.github && config.github.token_env;
+  const githubToken =
+    (ghEnv && String(process.env[ghEnv] || '').trim()) ||
+    String(process.env.GH_TOKEN || process.env.GITHUB_TOKEN || '').trim();
+  const giteaEnv = config.gitea && config.gitea.token_env;
+  const giteaToken =
+    (giteaEnv && String(process.env[giteaEnv] || '').trim()) ||
+    String(process.env.GITEA_TOKEN || '').trim();
+  const updateFeedUrl = String(process.env.LAUNCHER_UPDATE_URL || config.update_feed_url || '').trim();
+  autoUpdateApi = await setupAutoUpdater(app, () => mainWindow, {
+    updateFeedUrl,
+    config,
+    githubOwner: config.github && config.github.owner,
+    githubRepo: config.github && config.github.repo,
+    githubToken,
+    giteaToken,
+    allowGithubLauncherUpdates: config.launcher_updates_from_github === true,
+  });
+  app.on('activate', () => {
+    if (BrowserWindow.getAllWindows().length === 0) createWindow();
+  });
+});
+
+app.on('window-all-closed', () => {
+  if (process.platform !== 'darwin') app.quit();
+});
+
+ipcMain.handle('launcher:load', async () => {
+  const { configPath, config } = await readMergedConfig();
+  let clientBuild = '';
+  if (wowInstallValid(config)) {
+    const st = await readPatchState(config.game_dir);
+    if (st && st.client_build) clientBuild = String(st.client_build);
+  }
+  return {
+    configPath,
+    gameDir: config.game_dir || '',
+    authEnabled: !!(config.auth && config.auth.enabled),
+    wowExe: (config.launch && config.launch.exe) || 'Wow.exe',
+    wowOk: wowInstallValid(config),
+    clientBuild,
+  };
+});
+
+ipcMain.handle('launcher:saveGameDir', async (_e, dir) => {
+  const trimmed = String(dir || '').trim();
+  if (!trimmed) throw new Error('folder path is empty');
+  const { configPath } = await loadConfig(app);
+  const norm =
+    process.platform === 'win32' ? normalizeWinGameDir(path.normalize(trimmed)) : path.normalize(trimmed);
+  const probe = { ...(await readMergedConfig()).config, game_dir: norm };
+  if (!wowInstallValid(probe)) {
+    throw new Error(`That folder does not contain ${(probe.launch && probe.launch.exe) || 'Wow.exe'}`);
+  }
+  const c = await saveGameDir(configPath, norm);
+  const merged = { ...c, game_dir: resolveGameDir(c, configPath) };
+  return { ok: true, gameDir: merged.game_dir, wowOk: wowInstallValid(merged) };
+});
+
+ipcMain.handle('launcher:pickFolder', async (_e, startDir) => {
+  const win = BrowserWindow.getFocusedWindow() || mainWindow;
+  const r = await dialog.showOpenDialog(win, {
+    title: 'Select World of Warcraft 3.3.5a folder',
+    properties: ['openDirectory', 'createDirectory'],
+    defaultPath: startDir && String(startDir).trim() ? String(startDir).trim() : undefined,
+  });
+  if (r.canceled || !r.filePaths || !r.filePaths[0]) return { canceled: true, path: '' };
+  return { canceled: false, path: r.filePaths[0] };
+});
+
+ipcMain.handle('launcher:auth', async (_e, { user, pass }) => {
+  const { config } = await readMergedConfig();
+  await doAuth(config, user, pass);
+  return { ok: true };
+});
+
+ipcMain.handle('launcher:sync', async () => {
+  const { config } = await readMergedConfig();
+  if (!wowInstallValid(config)) {
+    throw new Error('Set a valid WoW folder (must contain Wow.exe) first.');
+  }
+  await applyPatches(config, sendProgress);
+  return { ok: true };
+});
+
+ipcMain.handle('launcher:checkUpdates', async () => {
+  try {
+    return await autoUpdateApi.checkNow();
+  } catch (e) {
+    const msg = e && (e.message || String(e));
+    return { ok: false, error: msg };
+  }
+});
+
+ipcMain.handle('launcher:play', async () => {
+  const { config } = await readMergedConfig();
+  const exe = wowExePath(config);
+  const gameArgs = (config.launch && config.launch.args) || [];
+  const lc = config.launch || {};
+  const cwd = config.game_dir;
+
+  let cmd;
+  let spawnArgs;
+  if (process.platform === 'linux') {
+    const steamUri = String(lc.linux_steam_uri || '').trim();
+    const steamSpawn = Array.isArray(lc.linux_steam_spawn) ? lc.linux_steam_spawn.filter(Boolean) : [];
+    if (steamUri) {
+      if (steamSpawn.length) {
+        cmd = steamSpawn[0];
+        spawnArgs = [...steamSpawn.slice(1), steamUri];
+      } else {
+        const bin = String(lc.linux_steam_binary || 'steam').trim() || 'steam';
+        cmd = bin;
+        spawnArgs = [steamUri];
+      }
+    } else {
+      const wrap = Array.isArray(lc.linux_wrapper) ? lc.linux_wrapper.filter(Boolean) : [];
+      if (wrap.length) {
+        cmd = wrap[0];
+        spawnArgs = [...wrap.slice(1), exe, ...gameArgs];
+      } else {
+        throw new Error(
+          'On Linux, Wow.exe is a Windows program and cannot be run directly. ' +
+            'Set launch.linux_steam_uri (e.g. steam://rungameid/… for your Steam shortcut) ' +
+            'or launch.linux_wrapper (e.g. ["wine"]) in launcher.json.'
+        );
+      }
+    }
+  } else {
+    cmd = exe;
+    spawnArgs = gameArgs;
+  }
+
+  const child = spawn(cmd, spawnArgs, {
+    cwd,
+    detached: true,
+    stdio: 'ignore',
+    windowsHide: true,
+    shell: false,
+  });
+  child.unref();
+  return { ok: true };
+});
@@ -0,0 +1,78 @@
+{
+  "name": "fractured-launcher-electron",
+  "version": "1.0.12",
+  "description": "Fractured WoW launcher (Electron) — no console window, native folder picker, auto-update",
+  "main": "main.js",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/Dawnforger/Fractured.git"
+  },
+  "scripts": {
+    "start": "electron .",
+    "pack:win": "electron-builder --win nsis portable --x64 --publish never",
+    "pack:linux": "electron-builder --linux AppImage --x64 --publish never",
+    "publish:win": "electron-builder --win nsis portable --x64 --publish never"
+  },
+  "author": "",
+  "license": "GPL-3.0",
+  "devDependencies": {
+    "electron": "^33.2.1",
+    "electron-builder": "^25.1.8"
+  },
+  "dependencies": {
+    "electron-updater": "^6.3.9"
+  },
+  "build": {
+    "appId": "net.fractured.launcher",
+    "productName": "Fractured Launcher",
+    "directories": {
+      "output": "dist"
+    },
+    "publish": null,
+    "files": [
+      "main.js",
+      "preload.cjs",
+      "index.html",
+      "renderer.js",
+      "styles.css",
+      "default-launcher.json",
+      "lib/win-game-dir.js",
+      "lib/baked-gitea-channel.js",
+      "lib/gitea-release.js",
+      "lib/patch-manifest.js",
+      "lib/**/*"
+    ],
+    "win": {
+      "target": [
+        {
+          "target": "nsis",
+          "arch": ["x64"]
+        },
+        {
+          "target": "portable",
+          "arch": ["x64"]
+        }
+      ]
+    },
+    "nsis": {
+      "oneClick": false,
+      "allowToChangeInstallationDirectory": true,
+      "artifactName": "Fractured-Launcher-${version}-Setup.${ext}"
+    },
+    "portable": {
+      "artifactName": "Fractured-Launcher-${version}-Windows-Portable.${ext}"
+    },
+    "linux": {
+      "target": [
+        {
+          "target": "AppImage",
+          "arch": ["x64"]
+        }
+      ],
+      "category": "Game"
+    },
+    "appImage": {
+      "artifactName": "Fractured-Launcher-${version}-Linux-x86_64.${ext}"
+    }
+  }
+}
@@ -0,0 +1,16 @@
+'use strict';
+
+const { contextBridge, ipcRenderer } = require('electron');
+
+contextBridge.exposeInMainWorld('launcher', {
+  load: () => ipcRenderer.invoke('launcher:load'),
+  saveGameDir: (dir) => ipcRenderer.invoke('launcher:saveGameDir', dir),
+  pickFolder: (startDir) => ipcRenderer.invoke('launcher:pickFolder', startDir),
+  auth: (user, pass) => ipcRenderer.invoke('launcher:auth', { user, pass }),
+  sync: () => ipcRenderer.invoke('launcher:sync'),
+  checkUpdates: () => ipcRenderer.invoke('launcher:checkUpdates'),
+  play: () => ipcRenderer.invoke('launcher:play'),
+  onProgress: (cb) => {
+    ipcRenderer.on('launcher:progress', (_e, msg) => cb(msg));
+  },
+});
@@ -0,0 +1,130 @@
+'use strict';
+
+const logEl = document.getElementById('log');
+const gameDirEl = document.getElementById('gameDir');
+const btnBrowse = document.getElementById('btnBrowse');
+const btnSave = document.getElementById('btnSaveFolder');
+const btnSync = document.getElementById('btnSync');
+const btnPlay = document.getElementById('btnPlay');
+const btnCheckLauncher = document.getElementById('btnCheckLauncher');
+const authCard = document.getElementById('authCard');
+const btnAuth = document.getElementById('btnAuth');
+const wowExeName = document.getElementById('wowExeName');
+
+function log(msg) {
+  logEl.textContent += (logEl.textContent ? '\n' : '') + msg;
+  logEl.scrollTop = logEl.scrollHeight;
+}
+
+function setError(e) {
+  const m = e && (e.message || String(e));
+  log('Error: ' + m);
+}
+
+let authEnabled = false;
+let signedIn = false;
+
+async function refresh() {
+  try {
+    const s = await window.launcher.load();
+    authEnabled = s.authEnabled;
+    signedIn = !s.authEnabled;
+    wowExeName.textContent = s.wowExe || 'Wow.exe';
+    gameDirEl.value = s.gameDir || '';
+    authCard.classList.toggle('hidden', !authEnabled);
+    btnSync.disabled = !s.wowOk || (authEnabled && !signedIn);
+    btnPlay.classList.add('hidden');
+    btnPlay.disabled = true;
+    logEl.textContent = '';
+    if (!s.gameDir) log('Choose your WoW installation folder.');
+    else if (!s.wowOk) log('Folder does not look valid yet — pick the directory that contains ' + (s.wowExe || 'Wow.exe') + ', then Save folder.');
+    else if (authEnabled && !signedIn) log('Sign in, then download updates.');
+    else log('Ready — tap Download updates to sync from GitHub.');
+  } catch (e) {
+    setError(e);
+  }
+}
+
+window.launcher.onProgress((msg) => log(msg));
+
+btnBrowse.addEventListener('click', async () => {
+  try {
+    const start = gameDirEl.value.trim();
+    const r = await window.launcher.pickFolder(start);
+    if (!r.canceled && r.path) {
+      gameDirEl.value = r.path;
+      log('Selected: ' + r.path);
+    }
+  } catch (e) {
+    setError(e);
+  }
+});
+
+btnSave.addEventListener('click', async () => {
+  try {
+    const dir = gameDirEl.value.trim();
+    if (!dir) {
+      log('Pick a folder with Browse… first.');
+      return;
+    }
+    const r = await window.launcher.saveGameDir(dir);
+    gameDirEl.value = r.gameDir;
+    btnSync.disabled = !r.wowOk || (authEnabled && !signedIn);
+    log('Saved installation folder.');
+  } catch (e) {
+    setError(e);
+  }
+});
+
+btnAuth.addEventListener('click', async () => {
+  try {
+    const u = document.getElementById('username').value;
+    const p = document.getElementById('password').value;
+    await window.launcher.auth(u, p);
+    signedIn = true;
+    log('Signed in.');
+    btnSync.disabled = !gameDirEl.value.trim() || (authEnabled && !signedIn);
+    const s = await window.launcher.load();
+    btnSync.disabled = !s.wowOk;
+  } catch (e) {
+    setError(e);
+  }
+});
+
+btnSync.addEventListener('click', async () => {
+  btnSync.disabled = true;
+  log('—');
+  try {
+    await window.launcher.sync();
+    btnPlay.classList.remove('hidden');
+    btnPlay.disabled = false;
+    log('Done. You can launch the game.');
+  } catch (e) {
+    setError(e);
+  } finally {
+    const s = await window.launcher.load().catch(() => null);
+    btnSync.disabled = !s || !s.wowOk || (authEnabled && !signedIn);
+  }
+});
+
+btnPlay.addEventListener('click', async () => {
+  try {
+    await window.launcher.play();
+    window.close();
+  } catch (e) {
+    setError(e);
+  }
+});
+
+btnCheckLauncher.addEventListener('click', async () => {
+  try {
+    log('Checking for launcher updates…');
+    const r = await window.launcher.checkUpdates();
+    if (r && r.skipped) log('Launcher auto-update: ' + (r.reason || 'skipped (use a packaged build).'));
+    else if (r && r.ok === false && r.error) setError(new Error(r.error));
+  } catch (e) {
+    setError(e);
+  }
+});
+
+refresh();
@@ -0,0 +1,50 @@
+#!/usr/bin/env bash
+# Push a one-file README so the Gitea repo is non-empty (fixes HTTP 422 "repo is empty"
+# when CI creates a release). Safe to re-run only if the repo still has no commits;
+# if it already has history, skip or use the Gitea web UI instead.
+#
+# Usage:
+#   export GITEA_BASE_URL=https://git.example.com
+#   export GITEA_OWNER=myorg
+#   export GITEA_REPO=fractured-patches
+#   ./bootstrap-gitea-repo.sh
+#
+# Or pass an explicit clone URL (HTTPS or SSH):
+#   ./bootstrap-gitea-repo.sh https://git.example.com/myorg/fractured-patches.git
+#
+set -euo pipefail
+
+BRANCH="${GITEA_TARGET_REF:-main}"
+
+if [ "${1:-}" != "" ]; then
+  URL="$1"
+else
+  : "${GITEA_BASE_URL:?Set GITEA_BASE_URL or pass clone URL as first argument}"
+  : "${GITEA_OWNER:?Set GITEA_OWNER or pass clone URL as first argument}"
+  : "${GITEA_REPO:?Set GITEA_REPO or pass clone URL as first argument}"
+  BASE="${GITEA_BASE_URL%/}"
+  URL="${BASE}/${GITEA_OWNER}/${GITEA_REPO}.git"
+fi
+
+TMP=$(mktemp -d)
+trap 'rm -rf "$TMP"' EXIT
+cd "$TMP"
+
+git init -q
+git checkout -q -b "$BRANCH"
+
+cat >README.md <<'EOF'
+# Fractured release mirror
+
+Release assets (launcher builds, patches, `patch-manifest.json`, etc.) are uploaded here by **GitHub Actions** (“Sync release to Gitea”) from the main Fractured repository.
+
+This initial commit exists because **Gitea requires at least one commit** in the repository before releases can be created.
+EOF
+
+git add README.md
+git commit -q -m "chore: initial commit (required for Gitea releases)"
+
+git remote add origin "$URL"
+git push -u origin "$BRANCH"
+
+echo "Pushed initial README to $URL (branch $BRANCH)."
@@ -0,0 +1,32 @@
+#!/usr/bin/env node
+/**
+ * Build patch-manifest.json for a release (same names as files[].source in launcher.json).
+ *
+ * Usage (from a folder containing the patch binaries — list every files[].source name):
+ *   node generate-patch-manifest.js v0.9.0-client Wow-patched.exe
+ *
+ * Prints JSON to stdout — redirect to file:
+ *   node generate-patch-manifest.js v0.9.0-client Wow-patched.exe > patch-manifest.json
+ */
+'use strict';
+
+const fs = require('fs');
+const path = require('path');
+const crypto = require('crypto');
+
+const version = process.argv[2];
+const names = process.argv.slice(3);
+if (!version || names.length === 0) {
+  console.error('Usage: generate-patch-manifest.js <version-label> <file1> [file2 ...]');
+  console.error('  Example: generate-patch-manifest.js v0.9.0-client Wow-patched.exe');
+  process.exit(1);
+}
+
+const out = { version, files: {} };
+for (const f of names) {
+  const base = path.basename(f);
+  const buf = fs.readFileSync(f);
+  const sha256 = crypto.createHash('sha256').update(buf).digest('hex');
+  out.files[base] = { sha256 };
+}
+process.stdout.write(`${JSON.stringify(out, null, 2)}\n`);
@@ -0,0 +1,11 @@
+#!/usr/bin/env bash
+# Local Linux AppImage build (uses current tree — no tag snapshot). Run from repo root or this dir.
+set -euo pipefail
+ROOT="$(cd "$(dirname "$0")/.." && pwd)"
+cd "$ROOT"
+echo "==> npm ci"
+npm ci
+echo "==> npm run pack:linux (AppImage x64)"
+npm run pack:linux
+echo "==> dist/:"
+ls -la dist/
@@ -0,0 +1,73 @@
+#!/usr/bin/env bash
+# Upload local files to a GitHub release on the public distro repo (default: Dawnforger/Fractured-Distro).
+#
+# Usage (from repo root or this directory):
+#   export GH_TOKEN=ghp_...   # PAT with repo/releases on the distro repo
+#   ./tools/fractured-launcher-electron/scripts/publish-to-distro.sh v1.0.0 Wow-patched.exe
+#
+# Optional:
+#   DISTRO_REPO=YourOrg/Fratured-Distro   # if your GitHub slug differs
+#   SRC_TAG=v1.0.0 ./publish-to-distro.sh v1.0.0   # copy all assets from SOURCE_REPO release SRC_TAG
+#
+set -euo pipefail
+
+DISTRO_REPO="${DISTRO_REPO:-Dawnforger/Fractured-Distro}"
+SOURCE_REPO="${SOURCE_REPO:-Dawnforger/Fractured}"
+
+if ! command -v gh >/dev/null 2>&1; then
+  echo "Install GitHub CLI: https://cli.github.com/"
+  exit 1
+fi
+
+if [ -z "${GH_TOKEN:-}" ]; then
+  echo "Set GH_TOKEN to a PAT with releases write access to ${DISTRO_REPO}."
+  exit 1
+fi
+
+if [ "$#" -lt 1 ]; then
+  echo "Usage: $0 <release-tag> [files...]"
+  echo "   or: SRC_TAG=v1.0.0 $0 <release-tag>   # copies all assets from ${SOURCE_REPO} release SRC_TAG"
+  exit 1
+fi
+
+TAG="$1"
+shift
+if [ "$#" -eq 0 ] && [ -z "${SRC_TAG:-}" ]; then
+  echo "After the tag, list files to upload, or set SRC_TAG=... to copy all assets from ${SOURCE_REPO}."
+  exit 1
+fi
+
+tmpdir=$(mktemp -d)
+cleanup() { rm -rf "$tmpdir"; }
+trap cleanup EXIT
+
+if [ "$#" -eq 0 ] && [ -n "${SRC_TAG:-}" ]; then
+  echo "Downloading assets from ${SOURCE_REPO}@${SRC_TAG} …"
+  gh release download "$SRC_TAG" -R "$SOURCE_REPO" -D "$tmpdir"
+else
+  for f in "$@"; do
+    if [ ! -f "$f" ]; then
+      echo "Not a file: $f"
+      exit 1
+    fi
+    cp -a "$f" "$tmpdir/"
+  done
+fi
+
+shopt -s nullglob
+files=("$tmpdir"/*)
+if [ "${#files[@]}" -eq 0 ]; then
+  echo "No files to upload."
+  exit 1
+fi
+
+if gh release view "$TAG" -R "$DISTRO_REPO" &>/dev/null; then
+  gh release upload "$TAG" -R "$DISTRO_REPO" "${files[@]}" --clobber
+  echo "Uploaded to https://github.com/${DISTRO_REPO}/releases/tag/${TAG}"
+else
+  gh release create "$TAG" -R "$DISTRO_REPO" \
+    --title "Fractured ${TAG}" \
+    --notes "Published from ${SOURCE_REPO} (local script)." \
+    "${files[@]}"
+  echo "Created https://github.com/${DISTRO_REPO}/releases/tag/${TAG}"
+fi
@@ -0,0 +1,26 @@
+#!/usr/bin/env bash
+# Shared filters for GitHub → Gitea / distro release merges and Gitea uploads.
+# shellcheck shell=bash
+
+# Skip when copying assets from `gh release download` into combined/: CI-built launcher is authoritative.
+should_skip_merge_from_github() {
+  local l
+  l=$(printf '%s' "${1##*/}" | tr '[:upper:]' '[:lower:]')
+  case "$l" in
+    fractured-launcher*) return 0 ;;
+    *.blockmap) return 0 ;;
+    builder-debug.yml|builder-debug.yaml) return 0 ;;
+  esac
+  return 1
+}
+
+# Skip when POSTing attachments to Gitea (belt-and-suspenders if something slips into combined/).
+should_skip_gitea_upload() {
+  local l
+  l=$(printf '%s' "${1##*/}" | tr '[:upper:]' '[:lower:]')
+  case "$l" in
+    *.blockmap) return 0 ;;
+    builder-debug.yml|builder-debug.yaml) return 0 ;;
+  esac
+  return 1
+}
@@ -0,0 +1,116 @@
+#!/usr/bin/env bash
+# Upload all files in a directory as attachments on a Gitea release (create release if missing).
+#
+# Usage:
+#   export GITEA_BASE_URL=https://git.example.com
+#   export GITEA_TOKEN=gta_...
+#   export GITEA_OWNER=myorg
+#   export GITEA_REPO=fractured-patches
+#   export GITEA_TARGET_REF=main   # optional, used when creating a new release (tag must not exist yet)
+#   ./upload-release-to-gitea.sh /path/to/combined v1.0.0
+#
+set -euo pipefail
+
+SCRIPT_DIR=$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)
+# shellcheck source=release-sync-filters.sh
+. "$SCRIPT_DIR/release-sync-filters.sh"
+
+COMBINED_DIR="${1:?first arg: directory of files to attach}"
+TAG="${2:?second arg: release tag (e.g. v1.0.0)}"
+
+: "${GITEA_BASE_URL:?Set GITEA_BASE_URL (no trailing slash required)}"
+: "${GITEA_TOKEN:?Set GITEA_TOKEN}"
+: "${GITEA_OWNER:?Set GITEA_OWNER}"
+: "${GITEA_REPO:?Set GITEA_REPO}"
+
+BASE="${GITEA_BASE_URL%/}"
+API="$BASE/api/v1"
+TARGET="${GITEA_TARGET_REF:-main}"
+AUTH_H=(-H "Authorization: token ${GITEA_TOKEN}" -H "Accept: application/json")
+
+TAG_ENC=$(python3 -c "import urllib.parse,sys; print(urllib.parse.quote(sys.argv[1], safe=''))" "$TAG")
+REL_JSON=$(mktemp)
+trap 'rm -f "$REL_JSON"' EXIT
+
+code=$(curl -sS -o "$REL_JSON" -w "%{http_code}" "${AUTH_H[@]}" \
+  "$API/repos/${GITEA_OWNER}/${GITEA_REPO}/releases/tags/${TAG_ENC}")
+
+if [ "$code" = "200" ]; then
+  rel_id=$(jq -r '.id' "$REL_JSON")
+elif [ "$code" = "404" ]; then
+  body=$(jq -n \
+    --arg tag "$TAG" \
+    --arg name "Fractured $TAG" \
+    --arg body "Synced from GitHub Actions (Fractured)." \
+    --arg target "$TARGET" \
+    '{tag_name:$tag,name:$name,body:$body,draft:false,prerelease:false,target_commitish:$target}')
+  code=$(curl -sS -o "$REL_JSON" -w "%{http_code}" -X POST "${AUTH_H[@]}" \
+    -H "Content-Type: application/json" \
+    -d "$body" \
+    "$API/repos/${GITEA_OWNER}/${GITEA_REPO}/releases")
+  if [ "$code" != "201" ] && [ "$code" != "200" ]; then
+    echo "Gitea create release failed HTTP $code:" >&2
+    cat "$REL_JSON" >&2
+    if [ "$code" = "422" ] && jq -e '.message == "repo is empty"' "$REL_JSON" >/dev/null 2>&1; then
+      echo >&2
+      echo "Gitea does not allow releases on a repo with zero commits. Fix: push at least one commit" >&2
+      echo "to ${GITEA_OWNER}/${GITEA_REPO} (e.g. add README.md on branch ${TARGET} via web UI or git push)," >&2
+      echo "or set Actions variable GITEA_TARGET_REF to an existing default branch name." >&2
+    fi
+    exit 1
+  fi
+  rel_id=$(jq -r '.id' "$REL_JSON")
+else
+  echo "Gitea GET release by tag failed HTTP $code:" >&2
+  cat "$REL_JSON" >&2
+  exit 1
+fi
+
+if [ -z "$rel_id" ] || [ "$rel_id" = "null" ]; then
+  echo "Could not resolve Gitea release id" >&2
+  exit 1
+fi
+
+shopt -s nullglob
+files=("$COMBINED_DIR"/*)
+if [ "${#files[@]}" -eq 0 ]; then
+  echo "No files in $COMBINED_DIR" >&2
+  exit 1
+fi
+
+uploadable=0
+for f in "${files[@]}"; do
+  [ -f "$f" ] || continue
+  bn=$(basename "$f")
+  if should_skip_gitea_upload "$bn"; then
+    continue
+  fi
+  uploadable=$((uploadable + 1))
+done
+if [ "$uploadable" -eq 0 ]; then
+  echo "No files to upload after exclusions (check $COMBINED_DIR) — not clearing Gitea attachments." >&2
+  exit 1
+fi
+
+while read -r aid; do
+  [ -z "$aid" ] || [ "$aid" = "null" ] && continue
+  curl -fsS -X DELETE "${AUTH_H[@]}" \
+    "$API/repos/${GITEA_OWNER}/${GITEA_REPO}/releases/${rel_id}/assets/${aid}" || true
+done < <(jq -r '(.attachments // .assets // [])[] | .id' "$REL_JSON")
+
+uploaded=0
+for f in "${files[@]}"; do
+  [ -f "$f" ] || continue
+  bn=$(basename "$f")
+  if should_skip_gitea_upload "$bn"; then
+    echo "Skipping upload (excluded): $bn"
+    continue
+  fi
+  echo "Uploading $bn …"
+  curl -fsS -X POST "${AUTH_H[@]}" \
+    -F "attachment=@${f}" \
+    "$API/repos/${GITEA_OWNER}/${GITEA_REPO}/releases/${rel_id}/assets"
+  uploaded=$((uploaded + 1))
+done
+
+echo "Gitea release $TAG (id=$rel_id) updated with $uploaded file(s)."
@@ -0,0 +1,126 @@
+* {
+  box-sizing: border-box;
+}
+body {
+  margin: 0;
+  font-family: system-ui, Segoe UI, Roboto, sans-serif;
+  background: #121018;
+  color: #e8e4f0;
+  padding: 20px 24px 28px;
+  min-height: 100vh;
+}
+header h1 {
+  margin: 0 0 6px;
+  font-size: 1.35rem;
+  font-weight: 600;
+}
+.sub {
+  margin: 0 0 18px;
+  color: #9a92b0;
+  font-size: 0.9rem;
+}
+.card {
+  background: #1c1828;
+  border: 1px solid #2e2840;
+  border-radius: 10px;
+  padding: 14px 16px;
+  margin-bottom: 14px;
+}
+.lbl {
+  display: block;
+  font-size: 0.8rem;
+  color: #b8b0d0;
+  margin-bottom: 8px;
+}
+.row {
+  display: flex;
+  gap: 8px;
+  align-items: center;
+  flex-wrap: wrap;
+}
+.row.stack {
+  flex-direction: column;
+  align-items: stretch;
+}
+#gameDir {
+  flex: 1;
+  min-width: 200px;
+  padding: 10px 12px;
+  border-radius: 8px;
+  border: 1px solid #3d3558;
+  background: #0e0c14;
+  color: #f0ecff;
+  font-size: 0.85rem;
+}
+input[type='text'],
+input[type='password'] {
+  padding: 10px 12px;
+  border-radius: 8px;
+  border: 1px solid #3d3558;
+  background: #0e0c14;
+  color: #f0ecff;
+  font-size: 0.9rem;
+}
+button {
+  padding: 10px 16px;
+  border-radius: 8px;
+  border: 1px solid #4a4268;
+  background: #2a243c;
+  color: #e8e4f0;
+  cursor: pointer;
+  font-size: 0.88rem;
+}
+button:hover:not(:disabled) {
+  background: #352d4c;
+}
+button:disabled {
+  opacity: 0.45;
+  cursor: not-allowed;
+}
+button.primary {
+  background: #4c3d8a;
+  border-color: #5c4d9a;
+}
+button.primary:hover:not(:disabled) {
+  background: #5a4a9e;
+}
+button.success {
+  background: #1d6b45;
+  border-color: #2a8a5a;
+  margin-top: 10px;
+}
+button.success:hover:not(:disabled) {
+  background: #258055;
+}
+button.ghost {
+  background: transparent;
+  border-color: #4a4268;
+  color: #b0a8d0;
+  font-size: 0.82rem;
+}
+button.ghost:hover:not(:disabled) {
+  background: #241f34;
+}
+.row-actions {
+  padding: 10px 16px;
+}
+button.wide {
+  width: 100%;
+}
+.log {
+  margin: 12px 0 0;
+  padding: 12px;
+  background: #0a090e;
+  border-radius: 8px;
+  border: 1px solid #2a2438;
+  min-height: 120px;
+  max-height: 200px;
+  overflow: auto;
+  font-size: 0.78rem;
+  color: #c4bdd8;
+  white-space: pre-wrap;
+  word-break: break-word;
+}
+.hidden {
+  display: none !important;
+}